125 Commits

Author	SHA1	Message	Date
momo5502	5ebf2dfd81	Support skipping syscall logging	2025-12-22 16:13:58 +01:00
Maurice Heumann	304dbcc661	Comprehensive WOW64 subsystem implementation (#555) ... # Major Features Implemented **Core WOW64 Architecture** 1. Full TEB, PEB, and Windows structure implementations for 32-bit processes 2. Proper thread context switching with 32-bit stack allocation 3. Configurable memory allocation with 32-bit/64-bit address space handling 4. Automatic WOW64 process identification and handling 5. Heaven's Gate Implementation for handling exceptions **Enhanced Emulation Features** 1. Fixed GDT setup and segment management for WOW64 2. Multi-architecture PE loading with proper import resolution 3. Segment-aware disassembly with WOW64 debugging capabilities **Testing & Validation** **32-bit Test Sample**: Minimal "hello" executable with full ASM source # TODO Needs more testing, currently in very early stages.	2025-10-21 20:13:01 +02:00
Igor Pissolati	1a97f3b2e2	Fix failed check	2025-10-20 23:19:24 -03:00
Igor Pissolati	65de67b24f	Use hard-coded values instead of calling __cpuidex	2025-10-20 22:52:56 -03:00
Igor Pissolati	6fe93375e6	Disable SSE4.x	2025-10-20 22:26:15 -03:00
brian	65eecf1cfd	Comprehensive WOW64 subsystem implementation	2025-10-13 19:55:50 +08:00
momo5502	20a4df5632	Throttle env access logging in concise mode	2025-09-12 19:27:39 +02:00
momo5502	a4f81c4c7a	Fix concise logging	2025-09-09 18:04:36 +02:00
momo5502	a671deb383	Rename is_within method to contains	2025-09-08 18:40:25 +02:00
momo5502	99249a8b3b	Fix printing	2025-09-08 15:37:02 +02:00
momo5502	238c2aea6a	Only slient output before starting the emulation	2025-09-08 08:15:49 +02:00
momo5502	91f58e9d11	Fix GDB address	2025-09-08 08:15:09 +02:00
momo5502	dad460411c	Reduce cpuid, rdtsc and rdtscp logs in concise mode	2025-09-07 17:22:07 +02:00
momo5502	289eb2cbb0	Print counts in decimal	2025-09-06 11:12:51 +02:00
momo5502	037f078302	Revert SGDT hooking support ... It's useless	2025-08-24 13:49:56 +02:00
momo5502	aa1a49ad6f	Get rid of static variables	2025-08-24 09:33:16 +02:00
Maurice Heumann	37310a308b	Fix Node.js analyzer	2025-08-24 08:43:23 +02:00
momo5502	80c8b88d23	Optimize instruction summary	2025-08-18 19:29:25 +02:00
momo5502	1db2c97165	Fix help	2025-08-18 19:16:56 +02:00
momo5502	c71c204583	Print instruction summary	2025-08-18 19:16:56 +02:00
momo5502	f432af419b	Small fix	2025-08-18 19:01:09 +02:00
momo5502	10cd7868ac	Support SGDT hooking	2025-08-18 18:24:46 +02:00
momo5502	7d6648ade0	Extend clang-format column limit to 140	2025-08-16 14:55:07 +02:00
momo5502	bfb874662f	Cache access in concise mode	2025-08-14 19:15:27 +02:00
momo5502	ee679dcd0a	Log ldr access	2025-08-14 18:38:11 +02:00
momo5502	73000c8d22	Log foreign memory access	2025-08-14 17:03:39 +02:00
momo5502	3189e6f701	Log more interesting things if outside any mapped module	2025-08-13 19:50:04 +02:00
momo5502	982d02b674	Log invocations outside of any module	2025-08-13 19:09:44 +02:00
momo5502	74bff93580	Print on unknown exception	2025-08-10 08:40:29 +02:00
momo5502	b980ff6277	Fix crash is module is nullptr	2025-08-10 08:37:02 +02:00
momo5502	09ad463027	Support environment analysis	2025-08-09 14:06:06 +02:00
Maurice Heumann	4d4c04eb78	Finish tenet tracer refactoring	2025-07-17 19:42:59 +02:00
Maurice Heumann	b5e40c3627	Revert line endings	2025-07-17 18:38:26 +02:00
Maurice Heumann	8caf724c95	Fix formatting	2025-07-17 18:30:00 +02:00
maskelihileci	20f96841de	Generate an output that the Tenet plugin can read ... Generates a Tenet tracer output with the -t parameter. The original Tenet tracer plugin is outdated, so I made updates to support our emulator. The forked project below works well. https://github.com/maskelihileci/tenet/tree/master/plugins_sogen-support	2025-07-17 14:36:29 +03:00
momo5502	0794c1038b	Display emulation status	2025-07-11 13:43:21 +02:00
Maurice Heumann	965efadb51	Detailed CPUID logging	2025-07-08 18:50:40 +02:00
Maurice Heumann	d656a18c8b	Print CPUID leaf	2025-07-08 16:36:23 +02:00
Maurice Heumann	a2d343c35b	Update main.cpp	2025-06-30 21:45:47 +02:00
momo5502	6b6dcc9ce2	Conditionally print access to executable memory	2025-06-30 21:22:12 +02:00
momo5502	415d2d2efe	Display application success in playground	2025-06-30 17:32:24 +02:00
momo5502	f1ca3e0981	Log CPUID executions	2025-06-27 19:36:27 +02:00
redthing1	afd80aa9af	make minidump loader fully standalone	2025-06-12 15:13:45 -07:00
redthing1	5d9dd122d2	minidump support: dump loading and process reconstruction	2025-06-09 23:12:45 -07:00
momo5502	bc77faec3d	Move more logging into callbacks	2025-06-06 20:03:53 +02:00
momo5502	9b8ea27a29	Delay process setup	2025-06-05 20:53:38 +02:00
momo5502	3cfb29c5c1	Print buffered stdout	2025-06-05 19:06:39 +02:00
momo5502	f2e0e91630	Isolate more analysis into analyzer	2025-06-05 18:59:27 +02:00
momo5502	c605131a80	Small changes	2025-06-01 12:48:59 +02:00
momo5502	37dd387560	Fix more warnings	2025-05-31 11:05:16 +02:00