Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Fix potential ZwMapViewOfSection and GetKeyboardLayoutList bugs and add support for SystemCodeInformation class #226

Merged
merged 7 commits into from
Feb 15, 2023
Merged

Fix potential ZwMapViewOfSection and GetKeyboardLayoutList bugs and add support for SystemCodeInformation class #226

merged 7 commits into from
Feb 15, 2023

Conversation

stonerhash
Copy link
Contributor

Modified ZwMapViewOfSection in order to use win_perms_to_emu_perms to successfully map Windows permission to emulation engine permissions. Definition of win_perms_to_emu_perms is also added

williballenthin and others added 2 commits February 14, 2023 23:22
@williballenthin @stonerhash
Merge pull request mandiant#221 from sacx/master
74cf405 
Modified ZwMapViewOfSection in order to use win_perms_to_emu_perms to successfully map Windows permission to emulation engine permissions. Definition of win_perms_to_emu_perms is also added.
@stonerhash
Merge branch 'master' of https://github.com/stonerhash/speakeasy
f66858f
@stonerhash stonerhash mentioned this pull request Feb 14, 2023
Closed
@stonerhash
Added support of SystemCodeIntegrityInformation in ZwQuerySystemInfor…
859749c 
…mation. This is an anti-vm / anti-analysis. The code returns value 1. Definitions in ddk.py also updated.
@stonerhash
Correct usage of GetKeygboardLayoutList requires the nBuff to be set …
b477697 
…to zero. Then the function returns the number of items in order to allocate the necessary space. Without this change an "unmapped memory error" occurs
@stonerhash stonerhash changed the title Update ZwMapViewOfSections to correctly map Windows memory permissions to emulator permissions Fix potential ZwMapViewOfSection and GetKeyboardLayout list bugs and add support for SystemCodeInformation class Feb 15, 2023
@stonerhash stonerhash changed the title Fix potential ZwMapViewOfSection and GetKeyboardLayout list bugs and add support for SystemCodeInformation class Fix potential ZwMapViewOfSection and GetKeyboardLayoutList bugs and add support for SystemCodeInformation class Feb 15, 2023
williballenthin
williballenthin approved these changes Feb 15, 2023
View reviewed changes
Copy link
Contributor

@williballenthin williballenthin left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

would you accept the formatting changes and then i'm happy to merge? thank you!

@stonerhash
Copy link
Contributor Author

would you accept the formatting changes and then i'm happy to merge? thank you!

Of course! Thank you for the changes

@williballenthin williballenthin merged commit 6e2c805 into mandiant:master Feb 15, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@williballenthin williballenthin williballenthin approved these changes

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@stonerhash @williballenthin