Commit Graph

1270 Commits

Author SHA1 Message Date
Maurice Heumann
ec0d626a96 Added additional vmp compatibility (#679) 2026-01-04 15:01:35 +01:00
thejanit0r
3b68260921 Fixed build errors 2026-01-04 14:53:53 +01:00
thejanit0r
f524a8cc38 Fixed clang-tidy errors 2026-01-04 14:47:08 +01:00
thejanit0r
497a4e98cb Fixed formatting 2026-01-04 13:35:54 +01:00
thejanit0r
0688a2cb98 Fixed formatting 2026-01-04 13:37:23 +01:00
thejanit0r
29b8ec4072 Added additional vmp compatibility 2026-01-04 09:33:54 +01:00
thejanit0r
b00f40aba7 Added support for NtCreateDirectoryObject 2026-01-04 04:31:49 +01:00
Maurice Heumann
0de53515ed Fix waiting (#675)
This PR fixes `INFINITE` waiting (`SleepEx`, `WaitForSingleObject`,
etc). Currently `INFINITE` is not infinite but "at this moment" (waiting
point in time == `clock.steady_now()`).
2026-01-02 22:14:02 +01:00
Maurice Heumann
818a4a4b88 Support SystemEmulationProcessorInformation (#672)
This PR implements `SystemEmulationProcessorInformation`. It is used,
for example, in 32-bit `ole32.dll`.
2026-01-02 22:10:52 +01:00
ssvine
7724b0d416 Refactor emulator_object 2026-01-02 19:03:54 +03:00
Maurice Heumann
72a5bc0a42 Fix utf8 output on Windows (#676)
Printing `UTF-8` text on Windows does not work. This PR fixes that by
setting console output code page to `UTF-8`.
2026-01-02 16:52:58 +01:00
ssvine
9bdb5c9562 Fix INFINITE time waiting 2026-01-02 18:33:27 +03:00
ssvine
b9df0682ad Support SystemEmulationProcessorInformation 2026-01-02 18:28:38 +03:00
ssvine
1b2318676d Fix utf8 output on Windows 2026-01-02 17:36:46 +03:00
ssvine
254475e308 Don't read null ptr in NtDelayExecution 2026-01-02 17:36:05 +03:00
ssvine
9de620f713 Fix getting subkey with trailing or duplacate backslashes 2026-01-02 17:35:45 +03:00
Maurice Heumann
452c142463 Build(deps): Bump deps/flatbuffers from a577050 to 8914d06 (#648)
Bumps [deps/flatbuffers](https://github.com/google/flatbuffers) from
`a577050` to `8914d06`.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="8914d06ab7"><code>8914d06</code></a>
Remove invalid dependency on FLATBUFFERS_GENERATE_HEADERS_SCHEMAS (<a
href="https://redirect.github.com/google/flatbuffers/issues/8834">#8834</a>)</li>
<li><a
href="522f2379a6"><code>522f237</code></a>
Update CODEOWNERS</li>
<li><a
href="7cb0bcb212"><code>7cb0bcb</code></a>
C++ Feature: Mutable union getters (<a
href="https://redirect.github.com/google/flatbuffers/issues/8852">#8852</a>)</li>
<li><a
href="b1e7868db6"><code>b1e7868</code></a>
add verification that type_vec.size == vec.size() (<a
href="https://redirect.github.com/google/flatbuffers/issues/8853">#8853</a>)</li>
<li><a
href="68e3c839c3"><code>68e3c83</code></a>
update provenance (<a
href="https://redirect.github.com/google/flatbuffers/issues/8873">#8873</a>)</li>
<li><a
href="0723245085"><code>0723245</code></a>
[Swift] Fixes bazel.build file allowing it to find Vectors folder in
8.5.0 (#...</li>
<li><a
href="9d64b9c0c0"><code>9d64b9c</code></a>
fix(go): add bounds checking to ByteVector (<a
href="https://redirect.github.com/google/flatbuffers/issues/8776">#8776</a>)</li>
<li><a
href="d01f20f2fb"><code>d01f20f</code></a>
Fix python generation with nested flatbuffers (<a
href="https://redirect.github.com/google/flatbuffers/issues/8854">#8854</a>)</li>
<li><a
href="7e163021e5"><code>7e16302</code></a>
FlatBuffers Version 25.12.19 (<a
href="https://redirect.github.com/google/flatbuffers/issues/8871">#8871</a>)</li>
<li><a
href="57fdd4f995"><code>57fdd4f</code></a>
Default Vector Support C++ (<a
href="https://redirect.github.com/google/flatbuffers/issues/8870">#8870</a>)</li>
<li>Additional commits viewable in <a
href="a577050817...8914d06ab7">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
2026-01-02 10:01:01 +01:00
momo5502
fb38127d35 Regenerate flatbuffer files 2026-01-02 09:00:34 +01:00
dependabot[bot]
b3e36b8167 Build(deps): Bump pcode in /src/backends/icicle-emulator/icicle-bridge
Bumps [pcode](https://github.com/icicle-emu/icicle-emu) from `0ce707e` to `395737f`.
- [Commits](0ce707edd1...395737f7ce)

---
updated-dependencies:
- dependency-name: pcode
  dependency-version: 395737f7ce230137f6316166220800634aa9829d
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2026-01-01 17:29:23 +00:00
Maurice Heumann
d3c4c9e906 Fix registry unicode and enhance syscall exception logging (#644) 2025-12-30 17:58:12 +01:00
Maurice Heumann
1f936c024d Fix thread support (#640)
This PR fixes several things related to threads emulation:

1. Support `SameTebFlags.InitialThread`
This flag is needed to support emulation of .net executables (not yet
fully supported) that don't have an entry point set in `PE` header. This
applies to both `PE32` and `PE64` executables. If `InitialThread` is set
the loader substitutes an entry point of the .net executable with
`mscoree.dll!_CorExeMain`.

2. Fix static thread local storage for `WOW64`
This fix resolves `shell32.dll` initialization on `WOW64`. This fix also
uses correct structure and field names that are obtained from the
corresponding `.pdb` files.

3. Fix dynamic thread local storage for `WOW64`

4. Fix setting argument of a `WOW64` thread start proc

5. Fix creating suspended thread and parse create_flags
Currently creating suspended thread doesn't work because
`NtCreateThreadEx` handler uses invalid flag `CREATE_SUSPENDED`. This PR
fixes that, and moreover it carefully parses create_flags of the
`NtCreateThreadEx` call.

6. Fix `FS` and `GS` handling
This PR fixes several problems with `GS` and `FS` segments:

    * Wrong GDT descriptor for selector 0x53
* Update GDT descriptor for selector 0x53 for a `WOW64` process every
context switch like Windows does
* Set `GS` base when `GS` segment register is updated in 64-bit code
(code selector is `0x33`). When `GS` segment register is loaded with
correct selector (`0x2b`) `GS` base is set to 0. So, when the code
accesses something like `gs:[0]`, a page fault occurs. `KiPageFault`
handles this situation and sets correct `GS` base.

Also, take into account that `teb64.ExceptionList` initially contains
`teb32` address for `WOW64` process. This is used to setup `FS` base
when `wrfsbase` instruction is available. We can enable this instruction
using `kusd.ProcessorFeatures.arr[PF_RDWRFSGSBASE_AVAILABLE] = 1;` and
this work perfectly with `unicorn` backend. Unfortunately `icicle`
backend does not support `wrfsbase`, so I don't enable this instruction
by default.
2025-12-30 17:56:30 +01:00
ssvine
f25ee26c36 Fix FS and GS handling 2025-12-30 15:19:05 +03:00
ssvine
57ad277158 Fix creating suspended thread and parse create_flags 2025-12-30 15:18:55 +03:00
ssvine
0370da327b Fix setting argument of a WOW64 thread 2025-12-30 15:18:44 +03:00
ssvine
1ebe5356c9 Fix dynamic TLS for WOW64 2025-12-30 15:18:33 +03:00
ssvine
04ff582fa9 Fix static TLS for WOW64
This fix resolves shell32.dll TLS problems.
Also it uses correct structure and field names
2025-12-30 15:18:18 +03:00
66hh
82dff75f64 Fix the formatting again 2025-12-30 19:22:10 +08:00
brian
e2bb1c4d48 Fix registry unicode and enhance syscall exception logging 2025-12-30 19:13:47 +08:00
66hh
0521fdef7d Fix code formatting issues 2025-12-30 18:50:59 +08:00
ssvine
fea27338bb Support SameTebFlags.InitialThread
This flag is needed to suport emulation of .net executables
that don't have an entry point set in PE header. This applies
to both PE32 and PE64 executables. If InitialThread is set
the loader substitutes an entry point of the .net executable
with mscoree.dll!_CorExeMain.
2025-12-30 13:44:21 +03:00
66hh
d830bea3c5 Try to fix the build 2025-12-30 17:40:16 +08:00
66hh
c144f2f438 Adjust memory allocation method 2025-12-30 17:05:08 +08:00
66hh
536f2ce883 Adjust variable order 2025-12-29 00:54:31 +08:00
66hh
3cd461e2ab Add the debugger_hide attribute to emulator_thread 2025-12-29 00:52:59 +08:00
66hh
12e96c8921 Adjust memory allocation method 2025-12-29 00:31:49 +08:00
66hh
1c11921701 Add error handling to prevent the engine from throwing errors 2025-12-28 23:45:52 +08:00
66hh
478fb7b4dd Register NtWriteVirtualMemory 2025-12-28 20:52:43 +08:00
66hh
83d4cadf76 Modify memory API implementation 2025-12-28 20:48:26 +08:00
66hh
418c5abf49 Extract callback handling into a separate function 2025-12-28 19:51:45 +08:00
66hh
41b86f655b Replace write with try_write in the handle_query function 2025-12-28 19:44:02 +08:00
66hh
c3464dd5c3 Introduce try_read/try_write for emulator_object 2025-12-28 19:40:53 +08:00
66hh
f95081cb6e Introduce try_write_memory for the memory manager 2025-12-28 19:36:40 +08:00
66hh
020e7ca3f6 Fix the base address alignment issue 2025-12-28 19:14:42 +08:00
66hh
d83c602f19 Change data type to fix 32-bit build 2025-12-28 12:40:51 +08:00
66hh
2d24b4189d Fix VMP NtClose detection 2025-12-27 19:51:29 +08:00
66hh
95b17566a0 Add NtRaiseHardError error message logging 2025-12-27 17:17:24 +08:00
66hh
02298e2303 Fix illegal address write 2025-12-27 17:17:24 +08:00
66hh
55310c57ac Add additional path checks for NtOpenSection 2025-12-27 17:17:24 +08:00
66hh
98393c03d2 Add a check before the conversion path 2025-12-27 17:17:24 +08:00
66hh
ecc00216d6 Support ProcessInstrumentationCallback 2025-12-27 17:17:23 +08:00