warsang e02ae99109 winemu: keep kernel KUSER_SHARED_DATA readable from executed code ...

Unicorn's vendored QEMU defines a 52-bit guest physical address space for x86-64 and truncates accesses that resolve above it, so loads from the canonical x64 alias (0xFFFFF78000000000) fault even though the page is mapped. Mirror the page at the address that executed accesses resolve to (the alias masked to 52 bits).

Build the user shared data page once and write the same bytes to every alias, so all views report the same time values. Skip aliases that another mapping already owns, so that a duplicate map does not break kernel-mode loading and the foreign page keeps its contents.

2026-10-11 20:26:52 +01:00

..

bins

winemu: better fallback PE images

2026-06-19 22:02:49 +02:00

capa-testfiles @ 413fd2803e

Add capa-testfiles submodule and configure CI for recursive checkout

2026-03-02 13:11:19 +00:00

__init__.py

Initial commit

2020-08-21 17:05:28 -04:00

conftest.py

Share the handler test harness

2026-10-08 20:09:30 +01:00

guest_harness.py

Link PEB loader lists through their list heads

2026-10-11 19:45:24 +01:00

handler_harness.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

pe_builder.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

pma_cases.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

pma_harness.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

pma_profiles.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_advapi32_handlers.py

Compute the RC4 test oracle without pycryptodome

2026-10-08 20:30:13 +01:00

test_aggregate_execution_budget.py

Move function-level imports to module level

2026-10-11 20:13:28 +01:00

test_api_dispatch_lifecycle.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_api_image.py

Add a builder for mapped synthetic API module images

2026-10-11 19:50:30 +01:00

test_api_inline_hooks.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_api_trap_faults.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_apihook_signatures.py

Take export tables from the physical export manifests

2026-10-11 20:13:28 +01:00

test_argv.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test_artifact_store.py

Remove unicorn v1 support

2026-03-06 14:05:47 +01:00

test_cli_config.py

document config overlay more

2026-03-06 14:47:25 +01:00

test_cli_runtime_flags.py

Remove unicorn v1 support

2026-03-06 14:05:47 +01:00

test_code_patching.py

Invalidate translated code on host memory writes

2026-10-11 19:45:24 +01:00

test_config_memory_dumps.py

Remove unicorn v1 support

2026-03-06 14:05:47 +01:00

test_config.py

Remove packaged config profiles

2026-03-06 17:46:49 +01:00

test_coverage.py

cleanup tests

2026-02-27 10:20:17 +01:00

test_crt_data_exports.py

Add get_api_symbols for string symbol labels

2026-10-11 20:08:51 +01:00

test_dlls.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test_do_str_format.py

api: handle C99 z/j/t printf modifiers in do_str_format

2026-08-28 15:49:12 +01:00

test_driver_handlers.py

Use the low byte of the WdfUsbInterfaceGetConfiguredPipe index

2026-10-08 20:09:58 +01:00

test_eh_prolog_guest.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_error_context.py

Add rich exception context to error diagnostics (#281)

2026-03-12 10:04:18 +01:00

test_examples.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test_export_catalog.py

Add per-DLL declaration catalogs to sigdb

2026-10-11 19:50:30 +01:00

test_export_manifests.py

Take export tables from the physical export manifests

2026-10-11 20:13:28 +01:00

test_file_access.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_filename_override.py

Add filename parameter to load_module and load_shellcode (#285)

2026-03-25 10:42:12 +01:00

test_find_files.py

Fix FindFirstFile wildcard search to find directories from config paths (#276)

2026-03-25 10:50:19 +01:00

test_func_args.py

apply ruff format to test_func_args

2026-07-23 16:17:15 +01:00

test_gdb_api_entries.py

Stop the debugger before unsupported API calls

2026-10-11 20:13:28 +01:00

test_gdb_compat.py

gdb: allow memory reads that fill the advertised packet size

2026-10-07 09:58:44 +01:00

test_gdb.py

Move function-level imports to module level

2026-10-11 20:13:28 +01:00

test_gen_phnt_signatures.py

Add per-DLL declaration catalogs to sigdb

2026-10-11 19:50:30 +01:00

test_gen_win32_signatures.py

Name the urlmon download parameters

2026-10-08 20:08:50 +01:00

test_get_proc_address.py

Take export tables from the physical export manifests

2026-10-11 20:13:28 +01:00

test_guest_dependency_loading.py

Remove dead code

2026-10-11 20:13:28 +01:00

test_handle_determinism.py

Move function-level imports to module level

2026-10-11 20:13:28 +01:00

test_handler_arg_access.py

Give API handlers a parameter-level view of the call arguments

2026-10-08 20:08:50 +01:00

test_handler_args.py

Remove the unused HandlerArg type setter and negative indexes

2026-10-08 20:09:30 +01:00

test_handler_displays.py

Share the handler test harness

2026-10-08 20:09:30 +01:00

test_iat_after_seh.py

tests: add test for disabled code hook after import dispatch

2026-05-20 12:48:20 +02:00

test_import_normalization.py

Move function-level imports to module level

2026-10-11 20:13:28 +01:00

test_injected_import_binding.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_instruction_budget.py

Apply timeout and max_instructions to each run

2026-10-11 19:45:24 +01:00

test_kernel32_handlers_1.py

Keep the input metadata when MapViewOfFile maps an image

2026-10-11 19:45:24 +01:00

test_kernel32_handlers_2.py

Fail InitOnceBeginInitialize with INIT_ONCE_CHECK_ONLY

2026-10-08 20:29:56 +01:00

test_kernel_bootstrap.py

winemu: keep kernel KUSER_SHARED_DATA readable from executed code

2026-10-11 20:26:52 +01:00

test_loaders.py

Remove dead code

2026-10-11 20:13:28 +01:00

test_map_view_of_file.py

fix MapViewOfFile memory protections

2026-03-02 12:42:13 +00:00

test_memory_capture.py

tests: trim low-signal memory and structural checks

2026-03-06 14:30:24 +01:00

test_module_bases.py

Load the container process image only for non-EXE inputs

2026-10-05 18:00:51 +01:00

test_module_load_rollback.py

Remove dead code

2026-10-11 20:13:28 +01:00

test_module_name_normalization.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_module_system.py

winemu: better fallback PE images

2026-06-19 22:02:49 +02:00

test_msvcrt_handlers.py

Write one percent sign for %% in formats without arguments

2026-10-08 20:26:16 +01:00

test_network_handlers.py

Remove wrong ordinals from four ws2_32 handlers

2026-10-11 19:45:24 +01:00

test_ntoskrnl_api.py

Count 64-bit by-value arguments as two x86 slots

2026-10-08 20:26:16 +01:00

test_ntoskrnl_handlers.py

Report unknown driver names from ObReferenceObjectByName

2026-10-11 19:45:24 +01:00

test_page_protection.py

Protect PE section pages in contiguous runs instead of one page at a time

2026-10-05 16:51:10 +01:00

test_pe_api_calls.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_peb_module_links.py

Track PEB module membership for each process

2026-10-11 20:13:28 +01:00

test_pinned_export_catalog.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_pma_samples.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_process_parameters.py

Support PEB field RTL_USER_PROCESS_PARAMETERS (#272)

2026-03-24 21:01:35 +01:00

test_profiler_artifacts.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test_query_dos_device.py

Give API handlers a parameter-level view of the call arguments

2026-10-08 20:08:50 +01:00

test_regman.py

Mask the registry DWORD and QWORD data to its size

2026-10-08 20:09:30 +01:00

test_run_boundaries.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_run_isolation.py

reset CPU registers, EFLAGS, and stack memory between runs

2026-07-24 11:17:16 +01:00

test_run_limits.py

Apply timeout and max_instructions to each run

2026-10-11 19:45:24 +01:00

test_section_access.py

tests: trim low-signal memory and structural checks

2026-03-06 14:30:24 +01:00

test_seh_progress.py

Stop SEH replay when a handler does not repair the fault

2026-10-11 19:45:24 +01:00

test_seh.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test_shell_handlers.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_shellcode_strings.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_sigdb.py

Emulate unhooked imports from Win32 API signatures (win32metadata + phnt) (#324)

2026-09-15 09:14:55 +01:00

test_sigfmt.py

Give API handlers a parameter-level view of the call arguments

2026-10-08 20:08:50 +01:00

test_signature_fallback.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test_struct.py

Key cached EmuStruct types by their field layout

2026-10-11 19:45:24 +01:00

test_symbol_compatibility.py

Add get_api_symbols for string symbol labels

2026-10-11 20:08:51 +01:00

test_unified_api_addresses.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_user32_handlers.py

Resolve Windows APIs through mapped entry points

2026-10-11 20:08:51 +01:00

test_version.py

Add version.dll handlers reporting no version resource

2026-09-30 12:08:50 +01:00

test_volumes.py

Remove unicorn v1 support

2026-03-06 14:05:47 +01:00

test_wdm.py

Record API arguments as a list of objects

2026-10-08 20:08:50 +01:00

test.json

Remove the decoy PE builder and decoy files

2026-10-11 20:08:51 +01:00