mirror of
https://github.com/NaC-L/Mergen.git
synced 2026-06-11 09:44:31 +00:00
Claude
4114bb61f7
Adds scripts/dev/trace_external_calls.py: loads a PE into Unicorn, patches every IAT slot with a unique unmapped-address sentinel, then emulates from the chosen entry. When any call/jmp/ret resolves its target to a sentinel, logs the call-site address, the mnemonic, and the addressing form. One-shot diagnostic for answering 'what x86 instruction issues this external call at runtime.' Using it on example2-virt.bin shows the Themida transform precisely: - guest imports (GetStdHandle etc) remain in the IAT - every guest call site is rewritten from 'call [rip+IAT]' to a VM-staged 'push target; ret' where target was loaded from the IAT upstream - for example2, the first external call happens at VA 0x14017fa77 via 'ret 0', popping the GetStdHandle IAT value off the stack - Themida strips its own SDK markers (VirtualizerSDK64.dll#103/#503) from the IAT; our ignore_imports filter already accounts for this The lifter's current recognition handles direct call-through-IAT and register-indirect IAT calls (the non-virt binary resolves 5 imports cleanly). It does not recognize the ret-pops-IAT-loaded- pointer pattern, which is why the virt lift surfaces zero imports. Also annotates themida_samples.json with these properties inline so the transform semantics live next to the test that exercises them.