Commit Graph

731 Commits

Author SHA1 Message Date
Soham Nandy
ea7f6a68c8 Use auto for timestamp_counter tick type
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:56 +05:30
Soham Nandy
640cd500c3 fix typo on time.hpp
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:31 +05:30
Soham Nandy
daeefb4a7f refactor(rdtsc): clean up code overall
Change type of chrono return to be auto

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>

simplify conditional compile and add #else to prevent clang-tidy breaking CI

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 06:39:01 +05:30
Soham Nandy
55f29caf0f Revert "refactor: better conditional compilation on time.hpp"
This reverts commit 3bb599d356.
2025-04-11 02:26:28 +05:30
Soham Nandy
3bb599d356 refactor: better conditional compilation on time.hpp 2025-04-11 02:21:22 +05:30
Soham Nandy
0271e39474 refactor(rdtsc): clean up tick logic,
fix intrinsics, and resolve x86 compiler issues

- fix `time.hpp` compiler warnings (errors) and use proper intrinsic for gcc
- simplify tick calculation logic
- fix: exclude intrinsics include for non x86 builds and fix style
- fix: get() on clock_ unique ptr
2025-04-11 01:46:52 +05:30
Soham Nandy
dbc1b4439e feat: spoof rdtsc timings
Previously, RDTSC in the VM always returned a constant value, which broke any non deterministic timing-based operations, or caused detections in heuristics of malware and ANTI-VM tools.

This patch introduces a spoofed rdtsc_fake counter that tracks and adjusts timing deltas to simulate realistic TSC increments. Can be extended to simulate rdtsc timings based on CPU clock speed.
2025-04-10 06:58:01 +05:30
João Lucas
ac76a3ffd3 chore: improve momo_strip_target and add unicord-emulator and windows-emulator-test 2025-04-09 11:00:04 -03:00
Maurice Heumann
d73be6b656 Switch back to main icicle repo 2025-04-09 07:02:38 +02:00
momo5502
b9c4cf98ad Disable icicle jit 2025-04-08 20:29:53 +02:00
momo5502
9e8f921be1 Add emulator names 2025-04-08 20:29:53 +02:00
Maurice Heumann
67d34b3988 Small fix 2025-04-08 10:17:05 +02:00
momo5502
f1101cc90d Fix module lookup 2025-04-07 21:04:06 +02:00
momo5502
3c58c1af98 Log debug strings 2025-04-07 21:03:57 +02:00
momo5502
62c972333a Support ignoring multiple functions 2025-04-07 19:01:10 +02:00
Maurice Heumann
73c37eaeb1 Fix NtQueryInformationProcess ProcessDebugFlags 2025-04-07 15:47:00 +02:00
Maurice Heumann
66a529cf43 More logging 2025-04-07 15:36:25 +02:00
Maurice Heumann
f087d3998a Ignore certain function calls 2025-04-07 15:17:52 +02:00
Maurice Heumann
787410ff33 Remove IP skip check 2025-04-07 07:52:02 +02:00
Maurice Heumann
baad36ccf2 Support interrupt hooks 2025-04-07 07:24:46 +02:00
momo5502
1ed997445d Fix IRETQ instruction 2025-04-06 20:56:28 +02:00
momo5502
e8ac70f0d0 Use ghidra spec from icicle-python
--> https://github.com/icicle-emu/icicle-python
2025-04-06 20:55:51 +02:00
momo5502
5fde8c033d Fix hooks
This fixes #180
2025-04-06 20:01:18 +02:00
momo5502
cacf2c152c Fix single stepping after breakpoints 2025-04-06 17:50:02 +02:00
momo5502
e40e1bfb83 Ugly hack to *sometimes* fix instruction skipping 2025-04-06 10:46:21 +02:00
momo5502
3450a6a517 Fix reading/writing eflags 2025-04-06 09:44:46 +02:00
momo5502
320af6bb46 Support GDB stepping
...almost :(
2025-04-06 09:44:05 +02:00
momo5502
ed711197ae Fix GDB debugging with icicle 2025-04-05 16:15:56 +02:00
momo5502
bfb9760d29 Fix unicorn read hook 2025-04-05 15:58:34 +02:00
momo5502
3978eeed2a Finish execution hook support 2025-04-05 15:28:14 +02:00
momo5502
efe5a21e57 Switch to icicle fork 2025-04-05 14:50:11 +02:00
momo5502
638ad2c7a4 Support read and write hooks 2025-04-05 12:51:37 +02:00
momo5502
349526a54a Simplify hooking interface 2025-04-05 11:59:49 +02:00
momo5502
a336bdf2af Simplify violation hook API 2025-04-05 10:01:28 +02:00
momo5502
0fbb7a2e0d Revert "Disable exceptions for now"
This reverts commit 3391780c2f.
2025-04-05 09:28:01 +02:00
Maurice Heumann
3391780c2f Disable exceptions for now 2025-04-05 09:23:30 +02:00
momo5502
d191f8e667 Optimize MMIO handling 2025-04-05 09:03:41 +02:00
momo5502
b696117424 Add safety checks 2025-04-05 09:03:41 +02:00
Maurice Heumann
d6a419d5f6 Add Ghidra processor specification 2025-04-04 15:35:10 +02:00
Maurice Heumann
8de5c7be3a Run icicle tests 2025-04-04 15:34:58 +02:00
Maurice Heumann
24df7c65c2 Support accurate instruction counts 2025-04-04 13:13:09 +02:00
Maurice Heumann
204159f137 Support violation hooks 2025-04-02 08:21:37 +02:00
momo5502
f5b77ffa67 Tests 2025-04-02 07:03:01 +02:00
momo5502
84268bc7e3 More icicle progress 2025-04-02 06:28:01 +02:00
momo5502
ec235202fb Prepare instruction hook injection 2025-04-01 20:54:08 +02:00
momo5502
5846d2c0b9 Generalize hook store 2025-04-01 20:54:08 +02:00
momo5502
bdf5d60fd9 Implement serialization 2025-04-01 20:54:08 +02:00
momo5502
1cdf280fcf Support disabling rust code 2025-04-01 18:49:41 +02:00
momo5502
7d5555e985 Fix unicorn and switch back to it as default emulator 2025-04-01 18:37:00 +02:00
momo5502
afd9344e97 Extract registers 2025-04-01 18:34:29 +02:00