Add KernelHooksToggleButton to the main window toolbar, wire up the
integrity-level and conceal-hook-presence controls in the launch flow,
and adjust panel sizing for the updated pane layout.
Ignore SimpleVisor-master.zip and similar reference archive drops at repo root.
_pendingDeferredLaunchGateResume tracks whether the interface should signal the
launch gate after hook-ready notification. When set, the session startup flow
sends the gate release after confirming hook ready state rather than leaving the
gate decision to the controller.
DisarmTeardownProtectionBestEffort is called on window close to ensure the
controller releases any held gate before the interface exits, preventing the
target process from hanging indefinitely on a closed interface session. Refs #16.
KernelHooksToggleButton in the toolbar lets the operator disarm and re-arm kernel
NT-API hook coverage at runtime by toggling BLACKBIRD_RUNTIME_FLAG_NTAPI_HOOKS_DISARMED
through a SetRuntimeConfig IOCTL. Disarming hooks also forces anti-virtualization off
since that mode depends on the NT hook surface. Button state is reflected with
green/amber color coding.
MainWindow.SignatureIntel.cs initializes and disposes the SignatureIntelService,
configures its scan options from startup profile settings (enabled, memory scan,
page scan), and provides QueueSignatureIntelForRootPid and QueueSignatureIntelForView
so event-driven scans can be queued from the existing ETW and IOCTL event paths.
Closes#9.
The API graph view was republishing the entire snapshot on every timer tick
when rows already existed, even if no new hook data had arrived. Because the
view model resets the backing observable collection during publish, that caused
constant UI churn, repeated allocations, and self-noise that obscured the real
call stream.
At the same time, memory action details were not surfacing the captured hook
origin chain well enough to answer where an allocation originated from. The UI
only considered a small fixed set of symbol tokens and had no fallback to raw
IPs or any visible validation around the return address.
Tighten the analysis surface in two ways:
- only republish the API graph when the snapshot is marked dirty
- expose the shared IPC stack-frame constant to the analysis formatter
- build hook frame lists from all available symbol slots and fall back to raw
stack IPs when symbols are not yet resolved
- derive origin-module text from either OriginPath or originSymbol
- append hook frame summaries directly into memory action details
- surface return-address resolved/in-stack checks so the operator can judge
whether the caller origin is backed by the captured stack
This cuts the constant redraw pressure and makes memory.alloc style events far
more actionable when tracing module origin and caller flow.
dutchpsycho