c40033b12f
Merge pull request #111 from CertainLach/patch-1
...
fix: reset num_pe_exports on export dir parsing
2022-01-23 10:34:48 -08:00
e3af2aa1f3
fix: reset num_pe_exports on export dir parsing
2022-01-23 21:19:19 +03:00
105e1e4046
attempt to fix #98
2021-05-18 11:50:58 -07:00
19c781901c
mising stub for FileTimeToSystemTime
2021-02-03 07:50:18 -08:00
890a53efd1
put EventTracing code in the right place
2021-02-03 07:50:01 -08:00
cae8b63d6b
add stub for EventActivityIdControl
2021-02-03 07:43:42 -08:00
76a60119c6
fix #92 , mpengine doesnt check QPC return code.
2021-02-03 07:42:55 -08:00
fc38e30214
fix #90 , incorrect format specifiers
2021-01-17 22:23:01 -08:00
7511a8adff
missing newline
2021-01-17 22:19:37 -08:00
32f4c36e12
Merge pull request #89 from cube0x8/isdebugpresent_conflict
...
IsDebuggerPresent -> IsGdbPresent
2021-01-17 22:17:28 -08:00
e53fc8b68a
Added IsDebuggerPresent Win API
2021-01-13 14:33:58 -05:00
827eaae276
IsDebuggerPresent -> IsGdbPresent, since it conflicts with IsDebuggerPresent Win API
2021-01-13 14:24:48 -05:00
bdedcb0b67
stub GetLocaleInfoEx, required for some samples.
2021-01-12 13:55:29 -08:00
3602f39622
cleanup some compiler warnings
2021-01-12 13:49:23 -08:00
16ddcd4d17
Merge pull request #88 from cube0x8/additional_apis
...
Additional apis + some fix and improvement
2021-01-12 13:43:04 -08:00
8585b6352e
Fixed GetLongPathNameW
2021-01-10 15:25:23 -05:00
829b960b50
Forgot to free()
2021-01-07 04:55:38 -05:00
faa5d9da18
Fixed some winnt type and added additional information for LdrLoadDll debug log
2021-01-07 02:26:21 -05:00
8df9845779
LdrLoadDll return the HANDLE in the ModuleHandle ptr passed as argument.
2021-01-06 15:02:45 -05:00
33dac1dfc9
Added GetLongPathName APIs, which basically return the short path passed as argument.
2021-01-06 14:37:59 -05:00
de5bda0d19
Added RtlFreeHeap and RtlSetHeapInformation APIs
2021-01-06 14:37:10 -05:00
95c74311f2
Fixed LdrLoadDll and added LdrUnloadDll. Improved LdrGetProcedureAddress.
2021-01-06 14:35:55 -05:00
4da63119a5
Added new files to host Process and Wer related APIs. Added NtSetInformationProcess and WerRegisterMemoryBlock APIs
2021-01-06 14:32:39 -05:00
a478b03cfd
Added new NT types for Process and string related functions
2021-01-06 14:31:38 -05:00
9910ceda2e
silence warning from missing include
2021-01-03 16:38:58 -08:00
b5ea40a014
Merge pull request #87 from cube0x8/LdrLoadDll_api
...
Added new API ntdll.LdrLoadDll
2021-01-03 16:35:30 -08:00
2a6e10f99f
Removed Wide to Ansi conversion for ModuleFilename unicode string
2021-01-03 07:24:40 -05:00
8357dfcf4b
Added new API ntdll.LdrLoadDll
2021-01-02 09:02:50 -05:00
6d4970bd4a
add new imports to fix #84
2020-09-07 08:04:12 -07:00
5b671d6ae4
Merge pull request #83 from gertdreyer/master
...
Added GlobalAlloc and GlobalFree.
2020-08-04 07:01:42 -07:00
207f56a17c
Added GlobalAlloc metods to mirror LocalAlloc
2020-08-04 09:17:43 +02:00
d74abc85f8
attempt to fix #82 , add basic fls support.
2020-08-02 18:10:13 -07:00
3cb541e025
Update README.md
2020-03-10 07:52:49 -07:00
3d52865c58
remove old files
2020-03-09 09:39:45 -07:00
e949a2a733
warn if selinux will block stub creation
2020-03-03 11:01:03 -08:00
3650f51f6f
reduce optimization while debugging
2020-03-01 21:50:41 -08:00
3b76c18a14
testing support for more engines
2020-03-01 21:06:28 -08:00
a4379b27b4
fix #75 , we need to provide a valid certificate
...
There were two problems, some missing syncapi functions and Microsoft
now import SymCrypt and verify that the provided certificate chain
is valid when doing authenticode verification. This means they don't
just trust the system and we can say "everything is fine", they want
to double check.
An easy workaround is just to give them the root certificate they
expect.
2020-03-01 10:20:21 -08:00
316ad6329f
fake support for SHA-256, this fixes #73
2019-11-07 12:52:30 -08:00
f517d284f0
I don't think we need MAP_SHARED
2019-08-20 16:12:43 -07:00
165a9657cb
no longer need codealloc in pe_linker
2019-08-20 16:08:41 -07:00
c4e905f729
Merge pull request #62 from chrisnew/master
...
fix_pe_image: replaced code_malloc with mmap to preserve image base
2019-08-20 14:59:43 -07:00
e364b4c705
define DosDateTimeToFileTime
2019-08-20 14:28:43 -07:00
cbe8dc034e
hide some compiler warnings.
2019-08-20 14:28:27 -07:00
eb7b94e36f
add some stubs for vista threadpools
2019-08-20 14:09:22 -07:00
4e2655ae85
add GetDiskFreeSpaceExW
2019-08-20 14:08:58 -07:00
f937692709
reset lasterror on CreateEvent
2019-08-20 14:07:36 -07:00
e14ffb3ec8
First attempt at fixing #65
...
We need to do at least minimal processing of .tls sections.
2019-08-20 12:00:08 -07:00
bcef398300
make tls slots accessible via teb
2019-06-19 14:02:27 -07:00
2f1ac6b3a2
fix #64 - crash on startup
...
RegisterTraceGuidsW was incorrectly declared as using cdecl calling convention.
This was causing the stack to be misaligned, and then a security check failed.
Windows code will sometimes execute int 0x29 when an error is detected, this is
what was happening here.
Secondly, some code changed that used to check the return code of
GetEnvironmentVariable, but now ignores the return code and checks the value of
GetLastError. On Windows that would usually be set to ERROR_ENVVAR_NOT_FOUND if
a variable wasn't set - I never bothered setting it because nobody checked it,
but now it needs that.
2019-04-09 13:14:24 -07:00
Tavis Ormandy