 hakril
|
fdda80fad6
|
Update version number to 1.0.4
|
2025-08-14 10:35:58 +02:00 |
|
|
hakril
|
6c00426815
|
Add new crypto definitions + function for PEM encoding/decoding
|
2025-08-14 10:25:30 +02:00 |
|
|
hakril
|
4b71ebb174
|
DBG: fix py2 compat
|
2025-08-11 15:01:10 +02:00 |
|
|
hakril
|
35e7a8da4a
|
Add fix + tests to handle debugger memory-bp triggering twice on same instruction (when instruction write on 2 != pages)
|
2025-08-11 13:11:38 +02:00 |
|
|
hakril
|
c46d76a846
|
Fixing pass_memory-breakpoint logic
|
2025-08-07 16:59:02 +02:00 |
|
|
hakril
|
426d28ded9
|
more fix in breakpoints extract_arguments_64bits
|
2025-08-01 11:15:05 +02:00 |
|
|
hakril
|
5f5ad2531b
|
Fixing a bug in FunctionParamDumpBPAbstract triggering remote null deref
|
2025-08-01 09:21:07 +02:00 |
|
|
hakril
|
8d5bb5c032
|
Add simplex_86 ljmp with standard parameter format handling for ptr16:32
|
2025-06-30 15:48:59 +02:00 |
|
|
hakril
|
d8b1ec6536
|
Update CurrentProcess.virtual_alloc to match Winprocess.virtual_alloc parameters + tests
|
2025-05-15 09:46:38 +02:00 |
|
|
hakril
|
dd9a809a58
|
Add CertificateStore.from_user_store
|
2025-05-15 09:33:17 +02:00 |
|
|
hakril
|
7446517863
|
Add type parameter for WinProcess.virtual_alloc
|
2025-05-15 09:27:45 +02:00 |
|
|
hakril
|
1481e9cd46
|
Add some crypto-related ctypes definitions
|
2025-05-15 09:27:18 +02:00 |
|
|
hakril
|
37d5e9089e
|
Add use_memoryview param to NdrStream() for speed. Default=False as it currently require special handling in response.
|
2025-05-15 09:00:59 +02:00 |
|
|
hakril
|
df8a63e918
|
Fix bug in rpc client response view parsing in 32b process
|
2025-05-05 11:28:21 +02:00 |
|
|
hakril
|
6c588cf723
|
Improve thread CONTEXT defitions + ARM64_CONTEXT
|
2025-03-06 10:30:00 +01:00 |
|
|
hakril
|
8eb3384fcf
|
Change test exe to msiexec.exe + pop_proc64 force machine AMD64 with PROC_THREAD_ATTRIBUTE_MACHINE_TYPE
|
2025-02-14 18:52:22 +01:00 |
|
|
hakril
|
1ad456049a
|
Improve stubborn stability on Windows 17763
|
2025-02-11 18:24:46 +01:00 |
|
|
hakril
|
d4952e21ba
|
More arm64 heaven gate NotImplementedError()
|
2025-02-11 14:03:35 +01:00 |
|
|
hakril
|
fc0c81eb70
|
Fix pe parsing for section with 8bytes name
|
2025-02-11 10:37:00 +01:00 |
|
|
hakril
|
bd52b1a5a3
|
More tests adaptation for arm64
|
2025-02-10 15:26:41 +01:00 |
|
|
hakril
|
a93c9b7f11
|
Fix typo
|
2025-02-08 19:31:45 +01:00 |
|
|
hakril
|
06b96e65d0
|
More NotImplementedError for ARM64
|
2025-02-08 13:12:05 +01:00 |
|
|
hakril
|
b51a6e1808
|
Adding CreateRemoteThreadEx definition
|
2025-02-07 13:39:00 +01:00 |
|
|
hakril
|
26b42a0587
|
Adding ctypes_generation for PROC_THREAD_ATTRIBUTE_X
|
2025-02-06 22:53:42 +01:00 |
|
|
hakril
|
13f2993cf1
|
Fix tests for older python
|
2025-02-06 21:59:44 +01:00 |
|
|
hakril
|
54b518ca5f
|
More x86->arm64 limitation exploration
|
2025-02-05 22:52:06 +01:00 |
|
|
hakril
|
d094fb8209
|
More limitation identification for x86 on arm64 heaven gate
|
2025-02-05 22:40:12 +01:00 |
|
|
hakril
|
017867d79d
|
Fox typo
|
2025-02-05 22:30:51 +01:00 |
|
|
hakril
|
e58d80c3c5
|
More raise NotImplementedError on x86 -> arm64 heaven gate
|
2025-02-05 22:24:40 +01:00 |
|
|
hakril
|
d7ff43a829
|
Working on expliciting limitation of x86-on-arm64 NotImplementedError
|
2025-02-05 22:09:02 +01:00 |
|
|
hakril
|
6a54bca39a
|
Fix process.py simple_arm64 import
|
2025-02-04 20:02:43 +01:00 |
|
|
hakril
|
2a1217e7b8
|
Implem current_thread.teb for ARM64 + recognize ARM64 PE in pe_parse
|
2025-02-04 20:00:58 +01:00 |
|
|
hakril
|
bce15d0d3c
|
simple_arm64.Mov(reg, reg) that redirect to Orr(reg, zero, reg)
|
2025-02-03 09:11:01 +01:00 |
|
|
hakril
|
1889899535
|
Readd RtlGetCurrentPeb lost in rebase
|
2025-02-02 19:28:16 +01:00 |
|
|
hakril
|
1bc7818552
|
Still playing with simple_arm64
|
2025-02-02 19:19:28 +01:00 |
|
|
hakril
|
7c96da8c75
|
Working on simple_arm64.py
|
2025-02-02 19:19:28 +01:00 |
|
|
hakril
|
458a0d0558
|
First implem of arm64.assemble()
|
2025-02-02 19:19:28 +01:00 |
|
|
hakril
|
493fe75be8
|
arm64: Ret() encoded \o/ time to tests functions calls
|
2025-02-02 19:19:28 +01:00 |
|
|
hakril
|
e7679ecfcf
|
[WIP] simple_arm64 + testsuite
|
2025-02-02 19:19:12 +01:00 |
|
|
hakril
|
4e5325c8ea
|
Process.architecture now returns flags
|
2025-02-02 19:19:12 +01:00 |
|
|
hakril
|
9b5be5ffd5
|
more arm testing of process.architecture
|
2025-02-02 19:19:12 +01:00 |
|
|
hakril
|
720385d15a
|
Still playing with process.architecture
|
2025-02-02 19:19:12 +01:00 |
|
|
hakril
|
ce13bf08e3
|
First try at WinProcess.architecture
|
2025-02-02 19:19:12 +01:00 |
|
|
hakril
|
8151292042
|
Adding ctypes defintion associated with process & architecture
|
2025-02-02 19:19:12 +01:00 |
|
|
hakril
|
646e55c740
|
fix typo
|
2025-02-02 19:18:43 +01:00 |
|
|
hakril
|
00a2f1a7d6
|
add utils.image_file_machine_to_processor_architecture()
|
2025-02-02 19:18:43 +01:00 |
|
|
hakril
|
2c9a159a81
|
Add system.architecture & process.architecture
|
2025-02-02 19:18:43 +01:00 |
|
|
hakril
|
314cd2b862
|
More arm exploration of api responses
|
2025-02-02 19:16:24 +01:00 |
|
|
hakril
|
234844cf12
|
Remove breakpoint
|
2025-02-02 19:15:21 +01:00 |
|
|
hakril
|
1297996725
|
New implem of is_wow_64(handle)
|
2025-02-02 19:15:21 +01:00 |
|