Commit Graph

Select branches

Hide Pull Requests

atom-api-handlers

debugger

gdb-stop-on-handled-memory-fault

hammer_hooks

master

minor-improvements

structured-args

structured-args-02-followups

structured-args-03-drivers

structured-args-04-user32

structured-args-05-msvcrt

structured-args-06-shell

structured-args-07-network

structured-args-08-kernel32-a

structured-args-09-ntoskrnl

structured-args-10-kernel32-b

structured-args-11-advapi32

unified-api-addresses-v2

update_unicorn

worktree-fix-initterm-107

worktree-fix-issue-21

#1

#10

#100

#101

#103

#104

#105

#108

#109

#11

#111

#112

#114

#115

#117

#118

#119

#12

#120

#121

#123

#124

#125

#126

#129

#13

#131

#132

#133

#135

#136

#137

#14

#140

#141

#142

#144

#148

#15

#150

#151

#152

#153

#154

#155

#156

#158

#159

#160

#162

#164

#166

#168

#169

#171

#172

#173

#175

#176

#177

#178

#179

#182

#183

#184

#185

#186

#188

#190

#191

#192

#193

#194

#195

#196

#198

#199

#2

#200

#201

#202

#203

#204

#205

#206

#207

#208

#209

#210

#211

#212

#213

#214

#215

#216

#219

#220

#221

#226

#227

#229

#230

#231

#232

#232

#234

#235

#237

#238

#242

#245

#250

#251

#256

#257

#258

#259

#260

#261

#263

#264

#265

#266

#267

#268

#269

#270

#271

#272

#273

#274

#275

#276

#277

#277

#278

#279

#28

#280

#281

#282

#283

#283

#284

#285

#286

#288

#29

#290

#291

#292

#297

#308

#309

#31

#310

#311

#312

#313

#314

#315

#316

#317

#318

#32

#320

#321

#322

#324

#325

#326

#327

#328

#329

#33

#330

#331

#332

#333

#334

#335

#336

#337

#338

#339

#34

#340

#341

#342

#343

#344

#345

#346

#348

#349

#35

#350

#351

#352

#354

#36

#37

#38

#4

#40

#42

#44

#46

#47

#48

#49

#5

#50

#51

#52

#56

#57

#58

#59

#6

#60

#61

#62

#63

#64

#65

#66

#67

#68

#7

#70

#71

#72

#73

#78

#79

#8

#80

#81

#82

#87

#89

#9

#90

#91

#92

#93

#95

#96

#97

#98

#99

v1.4.5

v1.4.6

v1.4.7

v1.5.0

v1.5.1

v1.5.10

v1.5.11

v1.5.2

v1.5.3

v1.5.4

v1.5.5

v1.5.6

v1.5.7

v1.5.7.1

v1.5.7.2

v1.5.8

v1.5.8.1

v1.5.9

v1.6.0

v1.6.1

v2.0.0b1

v2.0.0b2

v2.0.0b3

v2.0.0b4

v2.0.0b5

v2.0.0b6

v2.0.0b7

v2.0.0b8

v2.0.0b9

Mono Color

• aa9f22643f v2.0.0b9 master v2.0.0b9 Willi Ballenthin 2026-10-11 22:28:10 +03:00
• e02ae99109 winemu: keep kernel KUSER_SHARED_DATA readable from executed code warsang 2026-09-14 02:24:59 -07:00
• d17497eb7a Move function-level imports to module level Willi Ballenthin 2026-10-11 20:31:23 +03:00
• 282e1ec501 Remove dead code Willi Ballenthin 2026-10-11 20:29:17 +03:00
• 3ec70c6615 Stop the debugger before unsupported API calls Willi Ballenthin 2026-10-09 20:37:55 +01:00
• 18b3b2909b Add max_total_time to cap execution across all runs Willi Ballenthin 2026-10-09 20:37:55 +01:00
• 5d6a1885ea Run TLS callbacks and DllMain of native dependencies Willi Ballenthin 2026-10-11 20:14:42 +03:00
• 3f12afca1d Track PEB module membership for each process Willi Ballenthin 2026-10-09 20:37:55 +01:00
• c79722eb4d Take export tables from the physical export manifests Willi Ballenthin 2026-10-09 20:37:55 +01:00
• 2001f64681 Add get_api_symbols for string symbol labels Willi Ballenthin 2026-10-09 20:36:37 +01:00
• 6b34be60ad Remove the decoy PE builder and decoy files Willi Ballenthin 2026-10-09 20:36:01 +01:00
• 4730f34fbe Resolve Windows APIs through mapped entry points Willi Ballenthin 2026-10-11 20:11:41 +03:00
• 056afbfb71 Add physical export manifests of Windows modules Willi Ballenthin 2026-10-09 20:05:01 +01:00
• 2e6d5a3a35 Add a builder for mapped synthetic API module images Willi Ballenthin 2026-10-09 20:03:27 +01:00
• 84308e832c Parse guest PE inventories leniently and keep raw import slots Willi Ballenthin 2026-10-09 20:02:29 +01:00
• ec11c61cc7 Add per-DLL declaration catalogs to sigdb Willi Ballenthin 2026-10-09 19:59:57 +01:00
• 9594e0ce63 Report unknown driver names from ObReferenceObjectByName Willi Ballenthin 2026-10-11 21:04:16 +03:00
• 2bdc0886f7 Keep the input metadata when MapViewOfFile maps an image Willi Ballenthin 2026-10-11 21:03:07 +03:00
• f3c4f1223d Fill szExePath and hModule in Module32First and Module32Next Willi Ballenthin 2026-10-11 21:02:36 +03:00
• debc9a1e45 Key cached EmuStruct types by their field layout Willi Ballenthin 2026-10-11 21:02:36 +03:00
• 0ca5dcd0f8 Read FLS slots in FlsGetValue2 Willi Ballenthin 2026-10-11 21:00:03 +03:00
• 26cc769388 Set ERROR_INVALID_PARAMETER when ProcessIdToSessionId fails Willi Ballenthin 2026-10-11 20:59:46 +03:00
• bfce75ad3d Apply timeout and max_instructions to each run Willi Ballenthin 2026-10-09 20:03:08 +01:00
• d058294b44 Mark three phnt Rtl functions as x64-only Willi Ballenthin 2026-10-09 19:58:41 +01:00
• 38a965d852 Take static strings only from the input image Willi Ballenthin 2026-10-09 20:00:41 +01:00
• bc10e62722 Invalidate translated code on host memory writes Willi Ballenthin 2026-10-09 19:58:47 +01:00
• 09f523217f Stop GDB watchpoints after the watched write completes Willi Ballenthin 2026-10-09 20:00:51 +01:00
• 3a88b5ea27 Set ERROR_PROC_NOT_FOUND when GetProcAddress fails Willi Ballenthin 2026-10-09 19:58:33 +01:00
• 020c861bcd Remove wrong ordinals from four ws2_32 handlers Willi Ballenthin 2026-10-09 20:00:06 +01:00
• c22fe66855 Link PEB loader lists through their list heads Willi Ballenthin 2026-10-09 20:00:05 +01:00
• aa1707ae16 Keep dotted module names when normalizing Willi Ballenthin 2026-10-09 19:57:46 +01:00
• 94bc175396 Stop SEH replay when a handler does not repair the fault Willi Ballenthin 2026-10-09 19:59:33 +01:00
• d61e2780e6 Resolve declared procedures that the export manifest lacks unified-api-addresses-v2 Willi Ballenthin 2026-10-09 16:04:27 +01:00
• 7018e50904 Apply review decisions for unified API addresses Willi Ballenthin 2026-10-09 15:38:35 +01:00
• 53f8c8e9b5 Align documentation with the unified API implementation Willi Ballenthin 2026-10-09 14:53:16 +01:00
• 66896e6e2c Fix resume and budget regressions and restore review consistency Willi Ballenthin 2026-10-09 14:53:16 +01:00
• f4d9ed51ef Build synthetic export tables from physical export manifests Willi Ballenthin 2026-10-09 14:32:48 +01:00
• 7e3c11916a Remove leftover API address state and merge pending-control handling Willi Ballenthin 2026-10-09 13:54:12 +01:00
• ae3434c707 Match test coverage claims to the current suite Willi Ballenthin 2026-10-09 13:33:59 +01:00
• de06a3d439 Declare emulator and run state instead of probing for it Willi Ballenthin 2026-10-09 13:33:59 +01:00
• 9cdfc3e8f8 Drop unreachable API image options and checks Willi Ballenthin 2026-10-09 13:33:59 +01:00
• 5991c5ee33 Trust signature sources to filter their own declarations Willi Ballenthin 2026-10-09 13:28:59 +01:00
• 4d586ca38c Keep only behavioral tests for unified API addresses Willi Ballenthin 2026-10-09 13:27:01 +01:00
• a6facf3f9e Remove the same-address alias hook merge Willi Ballenthin 2026-10-09 13:24:42 +01:00
• c6d1c24b7f Document earlier review coverage and remaining fidelity limits Willi Ballenthin 2026-10-09 12:34:03 +01:00
• 18669ad5d3 Preserve bounded best-effort analysis across unified API dispatch Willi Ballenthin 2026-10-09 12:29:37 +01:00
• 0da761f69b Document supplied patch coverage and confirmed integration fixes Willi Ballenthin 2026-10-09 11:36:28 +01:00
• e8f5a8a2d6 Cover review repros through public PE IAT calls and run transitions Willi Ballenthin 2026-10-09 11:30:56 +01:00
• a892f0ef58 Preserve raw import slots and non-ASCII module identity Willi Ballenthin 2026-10-09 11:30:51 +01:00
• bc7e964950 Record SEH replay diagnosis and refreshed corpus validation Willi Ballenthin 2026-10-09 08:39:46 +01:00
• 3130d76bfa Preserve SEH replay guards until resumed guest execution advances Willi Ballenthin 2026-10-09 08:38:17 +01:00
• d65702fbd6 Document reviewed compatibility policies and corpus evidence Willi Ballenthin 2026-10-09 07:55:05 +01:00
• 8d8814d854 Verify unpacked Lab 18-03 reverse-shell behavior under its required filename Willi Ballenthin 2026-10-09 07:51:59 +01:00
• 08e0977b46 Restore per-run limits and architecture-safe guest API recovery Willi Ballenthin 2026-10-09 07:50:50 +01:00
• 3a3204734e Isolate module observers and make injected IAT repair atomic Willi Ballenthin 2026-10-09 07:49:35 +01:00
• 55648eb12e Restore symbol snapshots and preserve kernel PE headers Willi Ballenthin 2026-10-09 07:49:09 +01:00
• 11f279379f Classify CRT startup globals as shared writable data exports Willi Ballenthin 2026-10-09 07:38:22 +01:00
• b483cdea10 Tolerate malformed optional guest PE inventories by default Willi Ballenthin 2026-10-09 07:29:29 +01:00
• 12b2c3eaea Index signature catalogs by physical DLL once Willi Ballenthin 2026-10-09 07:26:27 +01:00
• e38aed3023 Cover explicit timeout results in bounded malware regressions Willi Ballenthin 2026-10-08 22:57:11 +01:00
• a64ade5334 Unify Windows API resolution through mapped entry points Willi Ballenthin 2026-10-08 22:42:52 +01:00
• 351c1d7683 Compute the RC4 test oracle without pycryptodome Willi Ballenthin 2026-10-08 12:02:51 +01:00
• 67439f1c44 Annotate two values for mypy Willi Ballenthin 2026-10-07 23:57:49 +01:00
• 89b396c31a Keep registry keys loaded from the config Willi Ballenthin 2026-10-07 23:22:46 +01:00
• e33e9ee2d3 Match whole path components when finding parent keys Willi Ballenthin 2026-10-07 23:22:25 +01:00
• 2288223c81 Return TRUE from the CryptStringToBinary size query Willi Ballenthin 2026-10-07 23:04:18 +01:00
• 5518199583 Report zero services from EnumServicesStatus Willi Ballenthin 2026-10-07 23:03:56 +01:00
• bcc543bb6f Write TokenElevation for a non-admin user Willi Ballenthin 2026-10-07 23:03:37 +01:00
• 7765664913 Report both sizes from LookupAccountName Willi Ballenthin 2026-10-07 23:03:05 +01:00
• 3a29c7ed96 Accept empty data in CryptHashData Willi Ballenthin 2026-10-07 23:02:15 +01:00
• 80c5c3bba5 Return the hash value from CryptGetHashParam Willi Ballenthin 2026-10-07 23:01:56 +01:00
• 52c816d541 Derive RC4 keys of the right length in CryptDeriveKey Willi Ballenthin 2026-10-07 23:01:06 +01:00
• 488c13089f Compare whole SIDs in EqualSid Willi Ballenthin 2026-10-07 23:00:08 +01:00
• cafd370024 Reject unknown provider handles when importing keys Willi Ballenthin 2026-10-07 22:59:44 +01:00
• 0d8580fffb Use only the low 32 bits of the NCryptImportKey size Willi Ballenthin 2026-10-07 22:59:12 +01:00
• 5557a31b89 Open the default key storage provider for a NULL name Willi Ballenthin 2026-10-07 22:59:02 +01:00
• e5fab71a03 Reject unknown handles when closing crypto contexts Willi Ballenthin 2026-10-07 22:58:26 +01:00
• fb52766a60 Terminate and size-check the GetUserName output Willi Ballenthin 2026-10-07 22:57:47 +01:00
• ee81624dc4 Check the buffer size in GetUserNameEx Willi Ballenthin 2026-10-07 22:57:30 +01:00
• 2e034a0387 Check buffer sizes in LookupAccountSid Willi Ballenthin 2026-10-07 22:57:05 +01:00
• c8a2d747e6 Fill RtlGenRandom buffers longer than 256 bytes Willi Ballenthin 2026-10-07 22:56:23 +01:00
• e05825ea65 Fill the RegQueryInfoKey out-params Willi Ballenthin 2026-10-07 22:56:08 +01:00
• be1cfecee2 Open subkeys of open handles in RegOpenKeyEx Willi Ballenthin 2026-10-07 22:55:38 +01:00
• 8633f586d0 Return the new key handle from RegCreateKey Willi Ballenthin 2026-10-07 22:54:39 +01:00
• a8a071f664 List each direct subkey once Willi Ballenthin 2026-10-07 22:53:47 +01:00
• bcce191ab2 Return subkey names from RegEnumKeyEx Willi Ballenthin 2026-10-07 22:53:30 +01:00
• cfc1f1b673 Compute the RC4 test oracle without pycryptodome structured-args-11-advapi32 Willi Ballenthin 2026-10-08 12:02:51 +01:00
• e021ee974b Annotate two values for mypy Willi Ballenthin 2026-10-07 23:57:49 +01:00
• 45e104db72 Keep registry keys loaded from the config Willi Ballenthin 2026-10-07 23:22:46 +01:00
• 4cbdc75ad1 Match whole path components when finding parent keys Willi Ballenthin 2026-10-07 23:22:25 +01:00
• dab8322421 Return TRUE from the CryptStringToBinary size query Willi Ballenthin 2026-10-07 23:04:18 +01:00
• 84a7cd19fb Report zero services from EnumServicesStatus Willi Ballenthin 2026-10-07 23:03:56 +01:00
• ecc7a182a6 Write TokenElevation for a non-admin user Willi Ballenthin 2026-10-07 23:03:37 +01:00
• 5b33cc63bd Report both sizes from LookupAccountName Willi Ballenthin 2026-10-07 23:03:05 +01:00
• 90a78da272 Accept empty data in CryptHashData Willi Ballenthin 2026-10-07 23:02:15 +01:00
• 751fe73c08 Return the hash value from CryptGetHashParam Willi Ballenthin 2026-10-07 23:01:56 +01:00
• 7306287c0d Derive RC4 keys of the right length in CryptDeriveKey Willi Ballenthin 2026-10-07 23:01:06 +01:00
• 1a5eed00df Compare whole SIDs in EqualSid Willi Ballenthin 2026-10-07 23:00:08 +01:00
• a1f351c88c Reject unknown provider handles when importing keys Willi Ballenthin 2026-10-07 22:59:44 +01:00
• f9156ab2bf Use only the low 32 bits of the NCryptImportKey size Willi Ballenthin 2026-10-07 22:59:12 +01:00