diff --git a/classpesieve_1_1_thread_scanner.html b/classpesieve_1_1_thread_scanner.html index 07881e0ee..bb07d7027 100644 --- a/classpesieve_1_1_thread_scanner.html +++ b/classpesieve_1_1_thread_scanner.html @@ -657,7 +657,7 @@

pesieve::ProcessFeatureScanner.

-

Definition at line 575 of file thread_scanner.cpp.

+

Definition at line 574 of file thread_scanner.cpp.

Here is the call graph for this function:
diff --git a/scanner_8cpp_source.html b/scanner_8cpp_source.html index d18532b3f..1e219e412 100644 --- a/scanner_8cpp_source.html +++ b/scanner_8cpp_source.html @@ -733,7 +733,7 @@
pesieve::ThreadScanReport
A report from the thread scan, generated by ThreadScanner.
Definition thread_scanner.h:16
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:575
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:574
pesieve::WorkingSetScanReport
A report from the working set scan, generated by WorkingSetScanner.
Definition workingset_scanner.h:29
diff --git a/thread__scanner_8cpp_source.html b/thread__scanner_8cpp_source.html index 59084cfa4..907e0919f 100644 --- a/thread__scanner_8cpp_source.html +++ b/thread__scanner_8cpp_source.html @@ -678,74 +678,77 @@
544 return true;
545 }
546 }
-
547
-
548 // other indicators of stack being corrupt:
-
549
-
550 bool isStackCorrupt = false;
-
551
-
552 if (this->info.is_extended && !cDetails.is_managed && !cDetails.is_ret_as_syscall)
-
553 {
-
554 isStackCorrupt = true;
-
555 }
-
556
-
557 if (hasEmptyGUI &&
-
558 cDetails.stackFramesCount == 1
-
559 && this->info.is_extended && info.ext.state == Waiting && info.ext.wait_reason == UserRequest)
-
560 {
-
561 isStackCorrupt = true;
-
562 }
-
563
-
564 if (isStackCorrupt) {
-
565 my_report->thread_state = info.ext.state;
-
566 my_report->thread_wait_reason = info.ext.wait_reason;
-
567 my_report->thread_wait_time = info.ext.wait_time;
-
568 my_report->stack_ptr = cDetails.rsp;
-
569 my_report->status = SCAN_SUSPICIOUS;
-
570 }
-
571 return true;
-
572}
+
547 // other indicators of stack being corrupt:
+
548
+
549 bool isStackCorrupt = false;
+
550
+
551 if (this->info.is_extended && !cDetails.is_managed && !cDetails.is_ret_as_syscall)
+
552 {
+
553 isStackCorrupt = true;
+
554 }
+
555
+
556 if (hasEmptyGUI &&
+
557 cDetails.stackFramesCount == 1
+
558 && this->info.is_extended && info.ext.state == Waiting && info.ext.wait_reason == UserRequest)
+
559 {
+
560 isStackCorrupt = true;
+
561 }
+
562
+
563 if (isStackCorrupt) {
+
564 my_report->thread_state = info.ext.state;
+
565 my_report->thread_wait_reason = info.ext.wait_reason;
+
566 my_report->thread_wait_time = info.ext.wait_time;
+
567 my_report->stack_ptr = cDetails.rsp;
+
568 my_report->status = SCAN_SUSPICIOUS;
+
569 }
+
570 return true;
+
571}
+
572
573
-
574
-
-
575ThreadScanReport* pesieve::ThreadScanner::scanRemote()
-
576{
-
577 ThreadScanReport* my_report = new ThreadScanReport(info.tid);
-
578 if (!my_report) return nullptr;
-
579
-
580#ifdef _SHOW_THREAD_INFO
-
581 printThreadInfo(info);
-
582#endif // _SHOW_THREAD_INFO
-
583
-
584 bool is_shc = isAddrInShellcode(info.start_addr);
-
585 if (is_shc) {
-
586 if (reportSuspiciousAddr(my_report, info.start_addr)) {
-
587 if (my_report->status == SCAN_SUSPICIOUS) {
-
588 return my_report;
-
589 }
-
590 }
-
591 }
-
592 if (!should_scan_context(info)) {
-
593 my_report->status = SCAN_NOT_SUSPICIOUS;
-
594 return my_report;
-
595 }
-
596 // proceed with detailed checks:
-
597 HANDLE hThread = OpenThread(
-
598 THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
-
599 FALSE,
-
600 info.tid
-
601 );
-
602 if (!hThread) {
-
603#ifdef _DEBUG
-
604 std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
-
605#endif
-
606 my_report->status = SCAN_ERROR;
-
607 return my_report;
-
608 }
-
609 scanRemoteThreadCtx(hThread, my_report);
-
610 CloseHandle(hThread);
-
611 return my_report;
-
612}
+
+
574ThreadScanReport* pesieve::ThreadScanner::scanRemote()
+
575{
+
576 if (GetCurrentThreadId() == info.tid) {
+
577 return nullptr; // do not scan your own thread
+
578 }
+
579 ThreadScanReport* my_report = new (std::nothrow) ThreadScanReport(info.tid);
+
580 if (!my_report) {
+
581 return nullptr;
+
582 }
+
583#ifdef _SHOW_THREAD_INFO
+
584 printThreadInfo(info);
+
585#endif // _SHOW_THREAD_INFO
+
586
+
587 bool is_shc = isAddrInShellcode(info.start_addr);
+
588 if (is_shc) {
+
589 if (reportSuspiciousAddr(my_report, info.start_addr)) {
+
590 if (my_report->status == SCAN_SUSPICIOUS) {
+
591 return my_report;
+
592 }
+
593 }
+
594 }
+
595 if (!should_scan_context(info)) {
+
596 my_report->status = SCAN_NOT_SUSPICIOUS;
+
597 return my_report;
+
598 }
+
599 // proceed with detailed checks:
+
600 HANDLE hThread = OpenThread(
+
601 THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
+
602 FALSE,
+
603 info.tid
+
604 );
+
605 if (!hThread) {
+
606#ifdef _DEBUG
+
607 std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
+
608#endif
+
609 my_report->status = SCAN_ERROR;
+
610 return my_report;
+
611 }
+
612 scanRemoteThreadCtx(hThread, my_report);
+
613 CloseHandle(hThread);
+
614 return my_report;
+
615}
pesieve::AreaStatsCalculator
A class responsible for filling in the statistics with the data from the particular buffer.
Definition stats.h:73
@@ -769,7 +772,7 @@
pesieve::ThreadScanReport::translate_thread_state
static std::string translate_thread_state(DWORD thread_state)
Definition thread_scanner.cpp:151
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:575
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:574
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:433
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:268
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:399
diff --git a/thread__scanner_8h_source.html b/thread__scanner_8h_source.html index 87c7b241e..9155499ca 100644 --- a/thread__scanner_8h_source.html +++ b/thread__scanner_8h_source.html @@ -295,7 +295,7 @@
pesieve::ThreadScanner::ThreadScanner
ThreadScanner(HANDLE hProc, bool _isReflection, const util::thread_info &_info, ModulesInfo &_modulesInfo, peconv::ExportsMapper *_exportsMap, ProcessSymbolsManager *_symbols)
Definition thread_scanner.h:132
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:575
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:574
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:433
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:268
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:399