vee1e/speakeasy
1
0
Fork 0
mirror of https://github.com/vee1e/speakeasy.git synced 2026-09-01 19:07:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

Commit graph

  • ef13dc98b7 load windows CLI arguments properly master vee1e 2026-01-26 19:29:17 +05:30
  • e50afa89e7
         Merge pull request #257 from enkomio/master Willi Ballenthin 2026-01-06 12:43:35 +01:00
  • bea73fc429 Refactored code used to create exported functions in decoy module unknown 2026-01-06 11:38:17 +01:00
  • fe976a9f23 Improved PR #257 unknown 2025-12-19 12:38:01 +01:00
  • 9673a6cb25 Correctly set HeadersSize and mapped DecoyModule headers to memory unknown 2025-12-12 17:56:11 +01:00
  • b0dc80c879 statement refactoring unknown 2025-12-12 17:33:51 +01:00
  • f165606c35 Improved GetProcAddress function emulation and DecoyModule jitting unknown 2025-12-12 17:29:20 +01:00
  • df0f0309e3
         Merge pull request #256 from enkomio/master Willi Ballenthin 2025-12-02 16:10:50 +01:00
  • 73f0cbe0c3 Moved the class variable ldr_entries to be an instance variable. This will fix errors when speakeasy is used on multiple binaries unknown 2025-12-02 16:03:39 +01:00
  • 046d0fb8ef Remove debug output for argv[1] Antonio Parata 2025-11-21 12:28:26 +01:00
  • 22ef6f7bf5
         Update shell32.py Willi Ballenthin 2025-04-01 13:49:13 +02:00
  • 255cc677f6
         Update setup.cfg Willi Ballenthin 2025-04-01 13:48:03 +02:00
  • 04e28fd6f3
         Merge pull request #250 from snemes/patch-1 Willi Ballenthin 2025-02-28 19:53:39 +01:00
  • fe23eccc2f
         Merge pull request #251 from snemes/patch-2 Willi Ballenthin 2025-02-28 19:51:18 +01:00
  • 545d2ba060
         Added missing read-only KUSER_SHARED_DATA mapping Sandor Nemes 2025-02-28 17:47:17 +01:00
  • e01999c918 Fixed missing whitespace Sandor Nemes 2025-02-28 16:00:24 +01:00
  • 35b6600b27
         v1.6.1 Willi Ballenthin 2025-02-19 16:22:57 +01:00
  • cdf4424ee6
         Merge pull request #242 from dmsft/master Willi Ballenthin 2024-04-12 07:04:33 +02:00
  • ab563cb25c
         Update speakeasy/winenv/api/usermode/kernel32.py dmsft 2024-04-11 22:49:11 +02:00
  • 9f5a6506df Add API signal() dmsft 2024-04-09 23:36:36 +02:00
  • 0b2fef2b7d Add API fputc() dmsft 2024-04-09 22:53:48 +02:00
  • e3677a46ce Add multiple API hooks dmsft 2024-04-09 22:08:07 +02:00
  • 96c26a2a80 Add API hook for msvcrt!_errno() dmsft 2024-04-09 22:05:03 +02:00
  • 5a9eb333f9
         Merge pull request #238 from 0xa13d/add-wsaconnect-api Willi Ballenthin 2024-03-04 17:04:59 +01:00
  • 48fcfa9712 Add WSAConnect API Aled Mason 2024-02-23 16:37:39 +00:00
  • 078db942ec
         Merge pull request #231 from HongThatCong/master Willi Ballenthin 2023-03-24 10:29:15 +01:00
  • 528fc6fd4d Add more API and fix bugs Hồng Thất Công 2023-03-24 16:15:16 +07:00
  • 93ae0c1445 Trim trailing spaces Hồng Thất Công 2023-03-24 12:06:59 +07:00
  • 5c0a507a6d
         Merge pull request #230 from cecio/master Willi Ballenthin 2023-03-02 13:21:26 +01:00
  • 71043bf9ee
         Update speakeasy/winenv/defs/windows/shell32.py Willi Ballenthin 2023-03-02 13:19:45 +01:00
  • 5af4f4a44c
         Update speakeasy/winenv/api/usermode/shell32.py Willi Ballenthin 2023-03-02 13:19:16 +01:00
  • 176bda9cdf Implementation of ShellExecuteEx cecio 2023-03-01 22:42:55 +01:00
  • 08ac824571
         Merge pull request #229 from cecio/master Willi Ballenthin 2023-03-01 15:02:55 +01:00
  • 193f3e595c
         Update speakeasy/windows/win32.py cecio 2023-03-01 14:41:16 +01:00
  • ab7c1aeca3 Allocate SizeOfStackReserve instead of fixed value in 'load_module' cecio 2023-03-01 13:31:49 +01:00
  • 6e2c805c5d
         Merge pull request #226 from stonerhash/master Willi Ballenthin 2023-02-15 23:36:54 +01:00
  • 655f546896
         Update speakeasy/winenv/api/kernelmode/ntoskrnl.py Willi Ballenthin 2023-02-15 23:36:48 +01:00
  • 5e0ea6f134
         Update speakeasy/winenv/api/usermode/user32.py Willi Ballenthin 2023-02-15 23:36:41 +01:00
  • 263652a2e1
         Update speakeasy/winenv/defs/nt/ddk.py Willi Ballenthin 2023-02-15 23:36:33 +01:00
  • b4776976d6 Correct usage of GetKeygboardLayoutList requires the nBuff to be set to zero. Then the function returns the number of items in order to allocate the necessary space. Without this change an "unmapped memory error" occurs stonerhash 2023-02-15 12:30:22 +02:00
  • 859749cf20 Added support of SystemCodeIntegrityInformation in ZwQuerySystemInformation. This is an anti-vm / anti-analysis. The code returns value 1. Definitions in ddk.py also updated. stonerhash 2023-02-15 09:24:27 +02:00
  • f66858f0db Merge branch 'master' of https://github.com/stonerhash/speakeasy stonerhash 2023-02-14 23:23:44 +02:00
  • 74cf405bdb Merge pull request #221 from sacx/master Willi Ballenthin 2022-12-15 11:17:14 +02:00
  • 4ca5936ce4
         Merge pull request #221 from sacx/master Willi Ballenthin 2022-12-15 10:17:14 +01:00
  • 813dccd9fa Added GlobalFlags sacx 2022-12-14 22:05:12 +02:00
  • ad77fd7a29 Added dummy functions for RemoveDirectory SetEndOfFile sacx 2022-12-14 15:33:32 +02:00
  • 2248af0c62
         ci: test: try to fix python 3.10 build Willi Ballenthin 2022-12-14 10:51:19 +01:00
  • 23c1e6a67e
         ci: test: try to fix python 3.10 build Willi Ballenthin 2022-12-14 10:50:34 +01:00
  • df422e7b5c
         Merge pull request #220 from sacx/master Willi Ballenthin 2022-12-14 10:49:19 +01:00
  • 18858be6d1 Added InitCommonControls - Under Comctl32.dll version 6.0 and later, InitCommonControls does nothing. Applications must explicitly register all common controls through InitCommonControlsEx. Added CharPrevA sacx 2022-12-14 10:32:48 +02:00
  • c1ba9b53cd
         ci: remove tests on 3.6, add 3.9 and 3.10 Willi Ballenthin 2022-12-12 11:32:12 +01:00
  • f294b64af9
         Merge pull request #219 from sacx/master Willi Ballenthin 2022-12-12 11:31:21 +01:00
  • d78bc4e60c Added link to LOCALE_SYSTEM_DEFAULT sacx 2022-12-11 19:30:34 +02:00
  • e8653d3f49 Merge branch 'master' of https://github.com/sacx/speakeasy sacx 2022-12-01 11:09:49 +02:00
  • 168d5082a2 Added GetSystemDefaultLCID sacx 2022-11-22 15:18:40 +02:00
  • ab3082bdb1
         Merge pull request #215 from sacx/master Willi Ballenthin 2022-11-22 13:35:57 +01:00
  • 6260604425 Comment sacx 2022-11-19 13:14:30 +02:00
  • 0a11c9f1fc Added: PF_RDPID_INSTRUCTION_AVAILABLE PF_ARM_V81_ATOMIC_INSTRUCTIONS_AVAILABLE PF_MONITORX_INSTRUCTION_AVAILABLE PF_SSSE3_INSTRUCTIONS_AVAILABLE PF_SSE4_1_INSTRUCTIONS_AVAILABLE PF_SSE4_2_INSTRUCTIONS_AVAILABLE PF_AVX_INSTRUCTIONS_AVAILABLE PF_AVX2_INSTRUCTIONS_AVAILABLE PF_AVX512F_INSTRUCTIONS_AVAILABLE sacx 2022-11-16 10:54:50 +02:00
  • 705e905402 I detected some malware which are using IsProcessorFeaturePresent function to detect if we are running in a emulated environment and not. Right now IsProcessorFeaturePresent returns 1 for any feature, bit it should not be the case for some of them. I just createa a small applications to check for all features registered in processthreadsapi.h and I assigned those return values to each feature. Here is the table with those features and their return in a VirtualBox and on a real machine. Feature VirtualBox Return Physical Machine Return PF_FLOATING_POINT_PRECISION_ERRATA 0 0 PF_FLOATING_POINT_EMULATED 0 0 PF_COMPARE_EXCHANGE_DOUBLE 1 1 PF_MMX_INSTRUCTIONS_AVAILABLE 1 1 PF_PPC_MOVEMEM_64BIT_OK 0 0 PF_ALPHA_BYTE_INSTRUCTIONS 0 0 PF_XMMI_INSTRUCTIONS_AVAILABLE 1 1 PF_3DNOW_INSTRUCTIONS_AVAILABLE 0 0 PF_RDTSC_INSTRUCTION_AVAILABLE 1 1 PF_PAE_ENABLED 1 1 PF_XMMI64_INSTRUCTIONS_AVAILABLE 1 1 PF_SSE_DAZ_MODE_AVAILABLE 0 0 PF_NX_ENABLED 1 1 PF_SSE3_INSTRUCTIONS_AVAILABLE 1 1 PF_COMPARE_EXCHANGE128 1 1 PF_COMPARE64_EXCHANGE128 0 0 PF_CHANNELS_ENABLED 0 0 PF_XSAVE_ENABLED 1 1 PF_ARM_VFP_32_REGISTERS_AVAILABLE 0 0 PF_ARM_NEON_INSTRUCTIONS_AVAILABLE 0 0 PF_SECOND_LEVEL_ADDRESS_TRANSLATION 0 1 PF_VIRT_FIRMWARE_ENABLED 1 1 PF_RDWRFSGSBASE_AVAILABLE 1 1 PF_FASTFAIL_AVAILABLE 1 1 PF_ARM_DIVIDE_INSTRUCTION_AVAILABLE 0 0 PF_ARM_64BIT_LOADSTORE_ATOMIC 0 0 PF_ARM_EXTERNAL_CACHE_AVAILABLE 0 0 PF_ARM_FMAC_INSTRUCTIONS_AVAILABLE 0 0 PF_RDRAND_INSTRUCTION_AVAILABLE 1 1 PF_ARM_V8_INSTRUCTIONS_AVAILABLE 0 0 PF_ARM_V8_CRYPTO_INSTRUCTIONS_AVAILABLE 0 0 PF_ARM_V8_CRC32_INSTRUCTIONS_AVAILABLE 0 0 PF_RDTSCP_INSTRUCTION_AVAILABLE 1 1 sacx 2022-11-14 12:44:52 +02:00
  • 833451005e
         Merge pull request #214 from GDATAAdvancedAnalytics/fixes Willi Ballenthin 2022-11-08 22:14:49 +01:00
  • f4a7fcd8f5
         Update binemu.py lucebac 2022-11-08 21:28:48 +01:00
  • 89667e917e fix SHGetFolderPath not respecting char width lucebac 2022-11-08 17:14:17 +01:00
  • 97a3744508 implement WTSGetActiveConsoleSessionId lucebac 2022-11-08 17:11:40 +01:00
  • a6dad50b91 implement GetMemoryStatusEx lucebac 2022-11-08 17:10:55 +01:00
  • 98b91886ad write buffer size even when buffer ptr is nullptr lucebac 2022-11-08 17:10:33 +01:00
  • 673622cb20 fix path length only returned when buffer present lucebac 2022-11-08 17:09:26 +01:00
  • e90a43c85a fix not using file object when getting file info lucebac 2022-11-08 17:08:14 +01:00
  • 61e89cbbaf create file copy on CopyFile call lucebac 2022-11-08 17:07:19 +01:00
  • 08099b22c8 fix formatting for unicode string lucebac 2022-11-08 17:06:36 +01:00
  • c636a7f1bb use nanoseconds in filename to prevent collisions lucebac 2022-11-07 17:27:16 +01:00
  • 90c74f4520 make get GetTempFileName available for latin1 lucebac 2022-11-07 17:26:43 +01:00
  • 7b604a47a2 fix inconsistencies in string reading/writing lucebac 2022-11-07 17:26:13 +01:00
  • 1cb52a92ab
         Merge pull request #213 from ronbarrey/master Willi Ballenthin 2022-10-25 04:41:31 -07:00
  • 8756704fe9 Adding stack_commit parameter for shellcode ronbarrey 2022-10-21 11:31:07 -05:00
  • dd0469d441
         Merge pull request #212 from 0xa13d/bugfix/kernel_expected_str_got_tuple Willi Ballenthin 2022-10-11 21:20:13 +02:00
  • 983d60dfac Fix incorrect type (tuple) getting added to string list Aled Mason 2022-10-11 17:43:49 +01:00
  • 4c6b796ff7
         Merge pull request #211 from sacx/master Willi Ballenthin 2022-09-27 20:49:41 +02:00
  • c7a3d72ac6
         Merge branch 'mandiant:master' into master Adrian Stanila 2022-09-27 07:52:25 +03:00
  • 8eea302d41 Added StartServiceA and ControlService dummy functions. sacx 2022-09-27 07:47:09 +03:00
  • b7d759f88f
         Merge pull request #210 from sacx/master Willi Ballenthin 2022-07-25 10:54:45 -06:00
  • be4ac5f6fd Added SetFilePointerEx. Is just SetFilePointer adapted for Win Api. sacx 2022-07-25 12:29:31 +03:00
  • 7600418322 version bump james.bennett 2022-06-08 14:54:44 -07:00
  • 864e246458
         Merge pull request #209 from mandiant/minor-improvements-fixes jtbennett-fe 2022-06-08 14:52:13 -07:00
  • 4c565fe33c version bump james.bennett 2022-06-08 14:32:22 -07:00
  • ee06f21b15 make string cmp insensitive for PE resource names. add initial support for setting/executing window procedures. james.bennett 2022-06-03 13:46:43 -07:00
  • e568043ff6 Merge branch 'master' of https://github.com/mandiant/speakeasy james.bennett 2022-05-31 13:28:17 -07:00
  • c0d28e82cf update order of operations for initialization of kernel emulator. add get_pc interface for speakeasy. james.bennett 2022-05-31 13:26:22 -07:00
  • d9c15c552a
         Merge pull request #208 from cecio/master Willi Ballenthin 2022-05-29 20:56:45 -06:00
  • 398672be67 Added two simple APIs: - KERNEL32.AllocConsole - USER32.GetAsyncKeyState cecio 2022-05-29 12:11:47 +02:00
  • ac3e4422c1
         Merge pull request #207 from mwilliams31/misc-api-updates Willi Ballenthin 2022-05-26 21:07:31 -06:00
  • e2824442d9 Various usermode API updates Matt Williams 2022-05-26 20:31:34 -04:00
  • 0981fa3865
         Merge pull request #206 from cecio/master Willi Ballenthin 2022-05-23 11:17:54 -06:00
  • 921f1edece Minor fix in "VirtualAllocEx": added check to avoid null reference to tag content cecio 2022-05-20 22:42:40 +02:00
  • 68dda8eab0
         Merge pull request #205 from cecio/master Willi Ballenthin 2022-05-18 10:06:02 -06:00
  • fc412bf9a5 Modification to "MapViewOfFile" API in order to support the mapping of SEC_IMAGE files cecio 2022-05-18 00:08:23 +02:00
  • 22d0243a90
         Merge pull request #204 from mwilliams31/pe-resources-update Willi Ballenthin 2022-05-09 22:26:18 -06:00
  • 86cfe2b40c PE resource API updates Matt Williams 2022-05-09 17:29:50 -04:00
  • f3b060c155
         Merge pull request #203 from mwilliams31/minor-api-updates Willi Ballenthin 2022-05-02 10:21:14 -06:00
  • ac3e43746a wininnet updates Matt Williams 2022-05-01 21:11:09 -04:00
  • 24ab02c6d5 Added CreateDIBSection and GetClientRect Matt Williams 2022-05-01 19:57:43 -04:00