Add cross-platform x86 emulation via Unicorn Engine

Solves Linux execution limitation without Wine!

New Component: WardenEmulator
- Uses Unicorn Engine to emulate x86 CPU on any platform
- Can execute Windows Warden modules on Linux/macOS/ARM
- Provides sandboxed execution environment
- Intercepts Windows API calls with custom implementations

Features:
- CPU: x86 32-bit emulation via Unicorn
- Memory: Emulated address space (1MB stack, 16MB heap)
- API Hooks: VirtualAlloc, GetTickCount, ReadProcessMemory, etc.
- Safety: Module runs in isolated emulated environment
- Cross-platform: Works on Linux/macOS/Windows/ARM hosts

Architecture:
- Module code loaded into emulated memory at 0x400000
- Stack at 0x100000 (1MB)
- Heap at 0x200000 (16MB)
- API stubs at 0x70000000 (high memory)
- Intercept and provide Windows API implementations

Benefits vs Wine:
✓ Lightweight (no full Windows compatibility layer)
✓ Sandboxed (module can't harm host system)
✓ Cross-architecture (works on ARM, RISC-V, etc.)
✓ Full control over execution (can inspect/modify state)
✓ Easier debugging and analysis

Build:
- Added libunicorn-dev dependency
- Conditional compilation (HAVE_UNICORN)
- Falls back gracefully if Unicorn not available

Status: Infrastructure complete, ready for integration
Next: Connect WardenEmulator to WardenModule for real execution

Note: RSA modulus extraction script added but needs refinement
(current candidates are x86 code, not data section)
This commit is contained in:
Kelsi 2026-02-12 03:01:36 -08:00
parent 1464990c13
commit ea69cac526
4 changed files with 657 additions and 0 deletions

View file

@ -25,6 +25,18 @@ find_package(ZLIB REQUIRED)
find_package(PkgConfig REQUIRED)
pkg_check_modules(FFMPEG REQUIRED libavformat libavcodec libswscale libavutil)
# Unicorn Engine (x86 emulator for cross-platform Warden module execution)
find_library(UNICORN_LIBRARY NAMES unicorn)
find_path(UNICORN_INCLUDE_DIR unicorn/unicorn.h)
if(NOT UNICORN_LIBRARY OR NOT UNICORN_INCLUDE_DIR)
message(WARNING "Unicorn Engine not found. Install with: sudo apt-get install libunicorn-dev")
message(WARNING "Warden emulation will be disabled")
set(HAVE_UNICORN FALSE)
else()
message(STATUS "Found Unicorn Engine: ${UNICORN_LIBRARY}")
set(HAVE_UNICORN TRUE)
endif()
# GLM (header-only math library)
find_package(glm QUIET)
if(NOT glm_FOUND)
@ -91,6 +103,7 @@ set(WOWEE_SOURCES
src/game/game_handler.cpp
src/game/warden_crypto.cpp
src/game/warden_module.cpp
src/game/warden_emulator.cpp
src/game/transport_manager.cpp
src/game/world.cpp
src/game/player.cpp
@ -324,6 +337,13 @@ if(TARGET imgui)
target_link_libraries(wowee PRIVATE imgui)
endif()
# Link Unicorn if available
if(HAVE_UNICORN)
target_link_libraries(wowee PRIVATE ${UNICORN_LIBRARY})
target_include_directories(wowee PRIVATE ${UNICORN_INCLUDE_DIR})
target_compile_definitions(wowee PRIVATE HAVE_UNICORN)
endif()
# Link GLM if found
if(TARGET glm::glm)
target_link_libraries(wowee PRIVATE glm::glm)