Brovan 1.1

Please note that this release is very outdated, for now the latest versions of Brovan is available in the GH Actions Build page.

What's Changed

Memory Management

• Added support for MEM_RESET and MEM_RESET_UNDO.
• Added reset-state tracking for memory regions.
• Improved validation and handling in NtAllocateVirtualMemory and NtAllocateVirtualMemoryEx.
• Fixed allocation-type validation and region-size normalization behavior.

Performance

• Optimized guest loading by introducing Span-based paths and reducing allocations.
• Reduced allocations and improved caching in ELF parsing.
• Removed redundant PE image protection application logic.

Linux Support

• Added statfs and prctl syscall implementations.
• Fixed Linux compilation issues.
• Improved native Unicorn library handling for Linux builds and publishes.

Networking

• Added PCAP network dumping support.
• Added support for writing network traffic to AFD on Windows and Linux network syscall paths.

Emulation & Compatibility

• Added whitelisted hooks when no hooks are enabled to improve emulation correctness.
• Improved x86-64 disassembly output formatting.
• Fixed incorrect ImportLookupRVA calculation.
• Fixed corruption detection to correctly consider executable memory permissions.

Miscellaneous

• Improved cross-platform packaging of native Unicorn dependencies.
• Fixed masking issues that caused emulation to fail early on some versions of windows (By @ELJoOker2004)
• Added KsecDD device (by @ELJoOker2004)