Commit Graph

1030 Commits

Author SHA1 Message Date
momo5502
fdab8cd5ec Extend APC test 2025-04-13 13:39:09 +02:00
momo5502
82227e4d41 Prepare NtQueueApcThreadEx2 support 2025-04-13 13:39:08 +02:00
momo5502
9609a550e0 Add APC test 2025-04-13 13:39:08 +02:00
momo5502
71e8aab913 Ignore linter warnings 2025-04-13 13:39:08 +02:00
momo5502
c0252a5f71 Add partial NtContinueEx support 2025-04-13 13:39:08 +02:00
momo5502
f58dec38a2 Prepare APC support 2025-04-13 13:39:08 +02:00
momo5502
4bf2e9287e Use test sample everywhere 2025-04-13 13:38:53 +02:00
momo5502
8e0e81c02d Less intrusive AFD logging 2025-04-12 19:26:07 +02:00
momo5502
532e9d7609 Remove gitattributes 2025-04-12 17:13:51 +02:00
Maurice Heumann
386b5ec249 Bump deps/googletest from 52204f7 to e90fe24 (#196)
Bumps [deps/googletest](https://github.com/google/googletest) from
`52204f7` to `e90fe24`.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="e90fe24856"><code>e90fe24</code></a>
<code>gmock-actions</code>: add a missing conversion operator to
<code>WithArgsAction</code>.</li>
<li><a
href="50a9511f50"><code>50a9511</code></a>
<code>gmock-actions</code>: run clang-format.</li>
<li>See full diff in <a
href="52204f78f9...e90fe24856">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)


</details>
2025-04-12 16:55:17 +02:00
momo5502
1f1e6f4ac4 Upgrade reflect 2025-04-12 16:46:30 +02:00
dependabot[bot]
47c1fe777e Bump deps/googletest from 52204f7 to e90fe24
Bumps [deps/googletest](https://github.com/google/googletest) from `52204f7` to `e90fe24`.
- [Release notes](https://github.com/google/googletest/releases)
- [Commits](52204f78f9...e90fe24856)

---
updated-dependencies:
- dependency-name: deps/googletest
  dependency-version: e90fe2485641bab0d6af4500192dc503384950d1
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
2025-04-12 14:38:36 +00:00
Maurice Heumann
ebbcf33932 Fix root creation batch file 2025-04-12 10:30:12 +02:00
momo5502
4efb9fce18 Add batch files again with correct line endings 2025-04-12 10:22:25 +02:00
momo5502
6e254a2b48 Remove batch files 2025-04-12 10:22:01 +02:00
momo5502
b613c89bab Force correct line endings for batch files 2025-04-12 10:20:29 +02:00
momo5502
84399d987d Add quick start 2025-04-12 09:55:52 +02:00
Maurice Heumann
8bad084b74 Add AVX2 support (#195) 2025-04-12 09:11:18 +02:00
momo5502
fb644b8bf1 Disable avx2 for android 2025-04-12 08:54:18 +02:00
momo5502
35092b9cdf Use test-sample as analysis sample 2025-04-12 08:52:24 +02:00
momo5502
b701d44e90 Disable AVX2 for samples 2025-04-12 08:26:38 +02:00
momo5502
f42005ce5d Add avx2 support 2025-04-12 08:26:38 +02:00
Maurice Heumann
49a27eafff Remove dependencies from sample (#194) 2025-04-12 08:26:12 +02:00
momo5502
d0a24ac65c Remove dependencies from sample 2025-04-12 08:09:19 +02:00
Maurice Heumann
b449684bde Cleanup file syscalls (#193) 2025-04-11 21:23:43 +02:00
momo5502
891dafaf26 Cleanup file syscalls 2025-04-11 21:05:11 +02:00
Maurice Heumann
de3f9e5555 Cleanup system information syscalls (#192) 2025-04-11 19:27:32 +02:00
momo5502
facfe2b6bf More system information syscall cleanup 2025-04-11 17:59:30 +02:00
momo5502
915b31c093 Cleanup system information syscalls 2025-04-11 17:44:57 +02:00
momo5502
2c1edc819d Group backend targets 2025-04-11 17:33:38 +02:00
Maurice Heumann
3933019042 refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp… (#191)
refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp,
splits syscall implementations over multiple files
2025-04-11 17:25:34 +02:00
RektInator
8bc49bdd03 refactor(windows-emulator/syscalls): partial refactor of syscalls.cpp, splits syscall implementations over multiple files 2025-04-11 16:42:00 +02:00
Maurice Heumann
d9b6aefeff Run isolated windows test to reduce CI load (#190) 2025-04-11 11:37:44 +02:00
momo5502
7f6edb46f7 Run isolated windows test to reduce CI load 2025-04-11 11:01:53 +02:00
Maurice Heumann
1751ec6e9a Group backends in a dedicated source directory (#189) 2025-04-11 09:25:51 +02:00
Maurice Heumann
1adb16f8e7 feat: spoof rdtsc timings (#185)
Previously, RDTSC in the VM always returned a constant value of 4, which
broke any timing-based operations, or caused detections in heuristics of
malware and ANTI-VM tools.

This patch introduces a spoofed rdtsc_fake counter that tracks and
adjusts timing deltas to simulate realistic TSC increments. Can be
extended to simulate rdtsc timings based on CPU clock speed.
2025-04-11 09:24:36 +02:00
momo5502
705162d069 Cancel in-progress workflows to speedup CI 2025-04-11 09:07:51 +02:00
momo5502
d409c08ef6 Restructure backends 2025-04-11 08:58:49 +02:00
Soham Nandy
ea7f6a68c8 Use auto for timestamp_counter tick type
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:56 +05:30
Soham Nandy
640cd500c3 fix typo on time.hpp
Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 12:12:31 +05:30
Soham Nandy
daeefb4a7f refactor(rdtsc): clean up code overall
Change type of chrono return to be auto

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>

simplify conditional compile and add #else to prevent clang-tidy breaking CI

Co-authored-by: Maurice Heumann <MauriceHeumann@gmail.com>
2025-04-11 06:39:01 +05:30
Soham Nandy
55f29caf0f Revert "refactor: better conditional compilation on time.hpp"
This reverts commit 3bb599d356.
2025-04-11 02:26:28 +05:30
Soham Nandy
3bb599d356 refactor: better conditional compilation on time.hpp 2025-04-11 02:21:22 +05:30
Soham Nandy
0271e39474 refactor(rdtsc): clean up tick logic,
fix intrinsics, and resolve x86 compiler issues

- fix `time.hpp` compiler warnings (errors) and use proper intrinsic for gcc
- simplify tick calculation logic
- fix: exclude intrinsics include for non x86 builds and fix style
- fix: get() on clock_ unique ptr
2025-04-11 01:46:52 +05:30
Soham Nandy
dbc1b4439e feat: spoof rdtsc timings
Previously, RDTSC in the VM always returned a constant value, which broke any non deterministic timing-based operations, or caused detections in heuristics of malware and ANTI-VM tools.

This patch introduces a spoofed rdtsc_fake counter that tracks and adjusts timing deltas to simulate realistic TSC increments. Can be extended to simulate rdtsc timings based on CPU clock speed.
2025-04-10 06:58:01 +05:30
Maurice Heumann
3836f5d381 Always use release windows artifacts (#186)
This will always use the windows release test sample artifacts. It
doesn't really make sense to test the debug artifacts. They're just
slower and do the same.

This will still run debug artifacts on windows.
The change only applies to non-windows platforms
2025-04-09 19:55:26 +02:00
momo5502
6cb43b672e Redirect to wiki 2025-04-09 18:59:09 +02:00
momo5502
446978ad5a Always use release windows artifacts
This will always use the windows release test sample artifacts.
It doesn't really make sense to test the debug artifacts.
They're just slower and do the same.

This will still run debug artifacts on windows.
The change only applies to non-windows platforms
2025-04-09 18:32:41 +02:00
Maurice Heumann
e737e6ed80 Improve momo_strip_target and add unicord-emulator and windows-emulator-test (#184)
Tested on linux locally in release mode.
Build size before:
105.9 MiB

Build size after:
46.4 MiB
2025-04-09 17:59:02 +02:00
João Lucas de Oliveira Lopes
7029829ec7 revert: add back strip in ios 2025-04-09 12:28:19 -03:00