Commit Graph

176 Commits

Author SHA1 Message Date
momo5502
0af756abd5 Use stored RIP as emulators are unreliable 2025-08-24 16:18:26 +02:00
momo5502
549be496c4 Merge remote-tracking branch 'origin/main' into unicorn-upgrade-2 2025-08-23 10:40:48 +02:00
Red
257d9f6d02 Fix exception when NtTerminateThread is called on the active thread. 2025-08-22 00:32:05 +02:00
momo5502
584b770def Store previous IP per thread 2025-08-17 07:32:26 +02:00
momo5502
7d6648ade0 Extend clang-format column limit to 140 2025-08-16 14:55:07 +02:00
momo5502
127ed1b552 Log rdtsc 2025-08-15 12:54:36 +02:00
Maurice Heumann
9e5a6b509b Implement guard pages (#406)
Hey, looking for feedback on my guard page implementation. 

I wasn't sure on how to structure the additional windows specific memory
flags, since the emulation backends won't like additional guard flag. I
opted to create a new `memory_permission_ext` enum to hold the guard
flag, and a `nt_memory_permission` struct to wrap the "common" memory
permission flags, with the new extended flags. This struct implicitly
coerces to the original `memory_permission` to reduce the amount of
changes for the PR.

This however meant that I changed signatures of `map_memory` and
`apply_memory_protection` in `memory_interface` to accommodate this new
structure, and was an afterthought.

The `map_nt_to_emulator_protection` function might also need some
attention now, too. For future reference, windows uses
[MiMakeProtectionMask](https://doxygen.reactos.org/d1/d9a/marea_8c.html#adfb66408771a4df77c1056cc2a99ef21)
in ntoskrnl to map `PAGE_*` flags to [MM PTE
constants](https://reactos.org/wiki/Techwiki:Memory_management_in_the_Windows_XP_kernel).

The test added to the `test-sample` binary seems to be passing.

Fixes #21
2025-07-17 17:41:06 +02:00
Maurice Heumann
91375b22f9 Try upgrading unicorn 2025-07-13 19:37:56 +02:00
Maurice Heumann
d7a1a269b7 Setup thread before dispatching APC 2025-07-12 21:33:12 +02:00
3fault
f4fc9c4a6c fix memory_permissions_ext includes 2025-07-09 14:49:26 -04:00
3fault
6e203d9590 Fix formatting issues 2025-07-02 14:47:51 -04:00
3fault
2e17f37f78 Update hook_memory_violation to handle guard page violations 2025-07-01 19:17:05 -04:00
momo5502
f3b20da9cc Optimize thread scheduling and pausing 2025-06-07 14:20:19 +02:00
momo5502
05c5f0a085 Final cleanup 2025-06-07 08:01:02 +02:00
momo5502
da4a4f90c9 Cleanup exception callbacks 2025-06-07 07:54:11 +02:00
momo5502
bc77faec3d Move more logging into callbacks 2025-06-06 20:03:53 +02:00
momo5502
9b8ea27a29 Delay process setup 2025-06-05 20:53:38 +02:00
momo5502
f2e0e91630 Isolate more analysis into analyzer 2025-06-05 18:59:27 +02:00
momo5502
f046246740 Extract more analysis logic 2025-06-04 21:21:48 +02:00
momo5502
84e8e86b94 Extract sus activity logging 2025-06-04 19:28:50 +02:00
momo5502
009961620b Fix thread deletion 2025-06-01 13:57:14 +02:00
momo5502
da658e5178 Prepare timer support 2025-06-01 13:56:45 +02:00
momo5502
28de07ac8f Explicitly pass desired backend to emulator 2025-05-29 19:49:53 +02:00
momo5502
c559c2ff43 Support stopping emulation while all threads are sleeping
This fixes #242
2025-05-29 08:30:56 +02:00
momo5502
ae77e1b62d Fix fuzzer 2025-05-28 19:47:08 +02:00
momo5502
30363cc760 Reimplement snapshot support 2025-05-25 17:56:50 +02:00
Soham Nandy
cff2feee75 Add rdtscp instruction with stub IA32_TSC_AUX values 2025-05-02 07:20:36 +05:30
Maurice Heumann
6cb571f496 Prepare web debugger (#247) 2025-04-29 09:51:15 +02:00
momo5502
1beb95c2b2 Support thread-switch callback 2025-04-29 09:25:45 +02:00
Igor Pissolati
a629f77e31 Miscellaneous fixes 2025-04-28 12:48:28 -03:00
Igor Pissolati
9d5338b168 Load environment variables from registry 2025-04-28 12:46:36 -03:00
robert-yates
b2296930d3 prepare 32bit support with name and class inheritance modifications 2025-04-22 12:01:40 +02:00
momo5502
4ac8d853a6 Always use static socket factory for emscripten 2025-04-18 08:15:17 +02:00
momo5502
c1553ad2ec Fixes for emscripten 2025-04-17 19:40:20 +02:00
momo5502
68022ef501 Fixes 2025-04-14 20:16:24 +02:00
Maurice Heumann
a6dd9251b8 Prepare 32 bit support 2025-04-14 13:57:54 +02:00
momo5502
b3139cfacd Small fixes 2025-04-13 16:38:50 +02:00
momo5502
2ed35d94b9 Set correct status 2025-04-13 15:00:39 +02:00
momo5502
7910021124 Fix apc dispatching 2025-04-13 14:28:35 +02:00
momo5502
c1e621c2cd Basic hacky working APC dispatching 2025-04-13 13:39:09 +02:00
momo5502
f58dec38a2 Prepare APC support 2025-04-13 13:39:08 +02:00
Soham Nandy
ea7f6a68c8 Use auto for timestamp_counter tick type
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:56 +05:30
Soham Nandy
daeefb4a7f refactor(rdtsc): clean up code overall
Change type of chrono return to be auto

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>

simplify conditional compile and add #else to prevent clang-tidy breaking CI

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 06:39:01 +05:30
Soham Nandy
0271e39474 refactor(rdtsc): clean up tick logic,
fix intrinsics, and resolve x86 compiler issues

- fix `time.hpp` compiler warnings (errors) and use proper intrinsic for gcc
- simplify tick calculation logic
- fix: exclude intrinsics include for non x86 builds and fix style
- fix: get() on clock_ unique ptr
2025-04-11 01:46:52 +05:30
Soham Nandy
dbc1b4439e feat: spoof rdtsc timings
Previously, RDTSC in the VM always returned a constant value, which broke any non deterministic timing-based operations, or caused detections in heuristics of malware and ANTI-VM tools.

This patch introduces a spoofed rdtsc_fake counter that tracks and adjusts timing deltas to simulate realistic TSC increments. Can be extended to simulate rdtsc timings based on CPU clock speed.
2025-04-10 06:58:01 +05:30
Maurice Heumann
67d34b3988 Small fix 2025-04-08 10:17:05 +02:00
Maurice Heumann
66a529cf43 More logging 2025-04-07 15:36:25 +02:00
Maurice Heumann
f087d3998a Ignore certain function calls 2025-04-07 15:17:52 +02:00
momo5502
349526a54a Simplify hooking interface 2025-04-05 11:59:49 +02:00
Maurice Heumann
8de5c7be3a Run icicle tests 2025-04-04 15:34:58 +02:00