diff --git a/artefacts__util_8cpp_source.html b/artefacts__util_8cpp_source.html index 153fea843..253d1b96f 100644 --- a/artefacts__util_8cpp_source.html +++ b/artefacts__util_8cpp_source.html @@ -263,67 +263,70 @@
153 isLoaded = true;
154 std::vector<Signature*> signatures;
155 Signature::loadFromFile(filename, signatures);
-
156 if (!mainMatcher.addPatterns(signatures)) {
-
157 return 0;
-
158 }
-
159 return signatures.size();
-
160}
+
156 const size_t added = mainMatcher.addPatterns(signatures);
+
157 // delete the loaded signatures:
+
158 for (auto itr = signatures.begin(); itr != signatures.end(); ++itr) {
+
159 Signature* sign = *itr;
+
160 delete sign;
+
161 }
+
162 return added;
+
163}
-
161
-
-
162bool pesieve::matcher::init_shellcode_patterns()
-
163{
-
164 static bool isLoaded = false;
-
165 if (isLoaded) return false; // allow to load only once
-
166
-
167 isLoaded = true;
-
168 init_32_patterns(&mainMatcher);
-
169 init_64_patterns(&mainMatcher);
-
170 return true;
-
171}
+
164
+
+
165bool pesieve::matcher::init_shellcode_patterns()
+
166{
+
167 static bool isLoaded = false;
+
168 if (isLoaded) return false; // allow to load only once
+
169
+
170 isLoaded = true;
+
171 init_32_patterns(&mainMatcher);
+
172 init_64_patterns(&mainMatcher);
+
173 return true;
+
174}
-
172
-
-
173size_t pesieve::matcher::find_all_patterns(BYTE* loadedData, size_t loadedSize, std::vector<sig_finder::Match>& allMatches)
-
174{
-
175 if (!is_matcher_ready()) {
-
176 return false;
-
177 }
-
178 if (peconv::is_padding(loadedData, loadedSize, 0)) {
+
175
+
+
176size_t pesieve::matcher::find_all_patterns(BYTE* loadedData, size_t loadedSize, std::vector<sig_finder::Match>& allMatches)
+
177{
+
178 if (!is_matcher_ready()) {
179 return false;
180 }
-
181 const size_t matches = sig_finder::find_all_matches(mainMatcher, loadedData, loadedSize, allMatches);
-
182 return matches;
-
183}
+
181 if (peconv::is_padding(loadedData, loadedSize, 0)) {
+
182 return false;
+
183 }
+
184 const size_t matches = sig_finder::find_all_matches(mainMatcher, loadedData, loadedSize, allMatches);
+
185 return matches;
+
186}
-
184
-
-
185size_t pesieve::matcher::filter_custom(std::vector<sig_finder::Match>& allMatches, std::vector<sig_finder::Match>& customPatternMatches)
-
186{
-
187 size_t customCount = 0;
-
188 for (auto itr = allMatches.begin(); itr != allMatches.end(); ++itr) {
-
189 sig_finder::Match m = *itr;
-
190 if (m.sign) {
-
191 const DWORD checks = m.sign->checksum();
-
192 if (HardcodedPatterns.find(checks) != HardcodedPatterns.end()) {
-
193 continue;
-
194 }
-
195 customPatternMatches.push_back(m);
-
196 customCount++;
-
197 }
-
198 }
-
199 return customCount;
-
200}
+
187
+
+
188size_t pesieve::matcher::filter_custom(std::vector<sig_finder::Match>& allMatches, std::vector<sig_finder::Match>& customPatternMatches)
+
189{
+
190 size_t customCount = 0;
+
191 for (auto itr = allMatches.begin(); itr != allMatches.end(); ++itr) {
+
192 sig_finder::Match m = *itr;
+
193 if (m.sign) {
+
194 const DWORD checks = m.sign->checksum();
+
195 if (HardcodedPatterns.find(checks) != HardcodedPatterns.end()) {
+
196 continue;
+
197 }
+
198 customPatternMatches.push_back(m);
+
199 customCount++;
+
200 }
+
201 }
+
202 return customCount;
+
203}
mainMatcher
sig_finder::Node mainMatcher
Definition artefacts_util.cpp:141
artefacts_util.h
PATTERN_NOT_FOUND
#define PATTERN_NOT_FOUND
Definition artefacts_util.h:4
code_patterns.h
pesieve::matcher::load_pattern_file
size_t load_pattern_file(const char *filename)
Definition artefacts_util.cpp:148
-
pesieve::matcher::find_all_patterns
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
Definition artefacts_util.cpp:173
-
pesieve::matcher::filter_custom
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
Definition artefacts_util.cpp:185
+
pesieve::matcher::find_all_patterns
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
Definition artefacts_util.cpp:176
+
pesieve::matcher::filter_custom
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
Definition artefacts_util.cpp:188
- +
pesieve::util::is_32bit_code
size_t is_32bit_code(BYTE *loadedData, size_t loadedSize)
Definition artefacts_util.cpp:72
pesieve::util::is_readable
bool is_readable(DWORD mapping_type, DWORD protection)
Definition artefacts_util.cpp:115
pesieve::util::find_pattern
BYTE * find_pattern(BYTE *buffer, size_t buf_size, BYTE *pattern_buf, size_t pattern_size, size_t max_iter=0)
Definition artefacts_util.cpp:10
diff --git a/artefacts__util_8h_source.html b/artefacts__util_8h_source.html index 3bdbca6a8..e265b0787 100644 --- a/artefacts__util_8h_source.html +++ b/artefacts__util_8h_source.html @@ -140,10 +140,10 @@
52}
pesieve::matcher::load_pattern_file
size_t load_pattern_file(const char *filename)
Definition artefacts_util.cpp:148
-
pesieve::matcher::find_all_patterns
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
Definition artefacts_util.cpp:173
-
pesieve::matcher::filter_custom
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
Definition artefacts_util.cpp:185
+
pesieve::matcher::find_all_patterns
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
Definition artefacts_util.cpp:176
+
pesieve::matcher::filter_custom
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
Definition artefacts_util.cpp:188
- +
pesieve::util::is_32bit_code
size_t is_32bit_code(BYTE *loadedData, size_t loadedSize)
Definition artefacts_util.cpp:72
pesieve::util::is_readable
bool is_readable(DWORD mapping_type, DWORD protection)
Definition artefacts_util.cpp:115
pesieve::util::find_pattern
BYTE * find_pattern(BYTE *buffer, size_t buf_size, BYTE *pattern_buf, size_t pattern_size, size_t max_iter=0)
Definition artefacts_util.cpp:10
diff --git a/classpesieve_1_1_working_set_scanner.html b/classpesieve_1_1_working_set_scanner.html index 1eba0af00..ce27e45cf 100644 --- a/classpesieve_1_1_working_set_scanner.html +++ b/classpesieve_1_1_working_set_scanner.html @@ -303,7 +303,7 @@

-

Definition at line 157 of file workingset_scanner.cpp.

+

Definition at line 160 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -344,7 +344,7 @@

-

Definition at line 165 of file workingset_scanner.cpp.

+

Definition at line 168 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -385,7 +385,7 @@

-

Definition at line 239 of file workingset_scanner.cpp.

+

Definition at line 242 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -424,7 +424,7 @@

-

Definition at line 198 of file workingset_scanner.cpp.

+

Definition at line 201 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -465,7 +465,7 @@

-

Definition at line 250 of file workingset_scanner.cpp.

+

Definition at line 253 of file workingset_scanner.cpp.

Here is the call graph for this function:
@@ -560,7 +560,7 @@

pesieve::ProcessFeatureScanner.

-

Definition at line 303 of file workingset_scanner.cpp.

+

Definition at line 306 of file workingset_scanner.cpp.

Here is the call graph for this function:
diff --git a/namespacepesieve_1_1matcher.html b/namespacepesieve_1_1matcher.html index b2163cf50..af04ddaac 100644 --- a/namespacepesieve_1_1matcher.html +++ b/namespacepesieve_1_1matcher.html @@ -116,7 +116,7 @@

-

Definition at line 185 of file artefacts_util.cpp.

+

Definition at line 188 of file artefacts_util.cpp.

@@ -144,7 +144,7 @@

-

Definition at line 173 of file artefacts_util.cpp.

+

Definition at line 176 of file artefacts_util.cpp.

Here is the call graph for this function:
@@ -173,7 +173,7 @@

-

Definition at line 162 of file artefacts_util.cpp.

+

Definition at line 165 of file artefacts_util.cpp.

Here is the call graph for this function:
diff --git a/pe__sieve_8cpp_source.html b/pe__sieve_8cpp_source.html index 06ec96e41..1bb24beb8 100644 --- a/pe__sieve_8cpp_source.html +++ b/pe__sieve_8cpp_source.html @@ -400,7 +400,7 @@
console_color.h
format_util.h
pesieve::matcher::load_pattern_file
size_t load_pattern_file(const char *filename)
Definition artefacts_util.cpp:148
- +
pesieve::util::make_minidump
bool make_minidump(DWORD pid, const std::string &out_file)
Definition process_minidump.cpp:51
pesieve::util::get_integrity_level
process_integrity_t get_integrity_level(HANDLE hProcess)
Definition process_privilege.cpp:159
diff --git a/workingset__scanner_8cpp_source.html b/workingset__scanner_8cpp_source.html index b5e80e655..7a72d8803 100644 --- a/workingset__scanner_8cpp_source.html +++ b/workingset__scanner_8cpp_source.html @@ -237,237 +237,240 @@
143 else if (this->args.shellcode == SHELLC_PATTERNS_OR_STATS) {
144 code = (codeP || codeS);
145 }
-
146 my_report->has_shellcode = code;
-
147
-
148 if ( (this->args.obfuscated != OBFUSC_NONE && obfuscated) || ((this->args.shellcode != SHELLC_NONE) && code) ){
-
149 my_report->status = SCAN_SUSPICIOUS;
-
150 }
-
151 if (my_report->status == SCAN_SUSPICIOUS) {
-
152 my_report->data_cache = memPage.loadedData;
+
146
+
147 my_report->has_shellcode = code;
+
148
+
149 if ( (obfuscated && this->args.obfuscated != OBFUSC_NONE)
+
150 || (code && (this->args.shellcode != SHELLC_NONE || custom_matched_count) ))
+
151 {
+
152 my_report->status = SCAN_SUSPICIOUS;
153 }
-
154 return true;
-
155}
+
154 if (my_report->status == SCAN_SUSPICIOUS) {
+
155 my_report->data_cache = memPage.loadedData;
+
156 }
+
157 return true;
+
158}
-
156
-
-
157bool pesieve::WorkingSetScanner::isExecutable(MemPageData &memPage)
-
158{
-
159 if (pesieve::util::is_executable(memPage.mapping_type, memPage.protection)) {
-
160 return true;
-
161 }
-
162 return isPotentiallyExecutable(memPage, this->args.data);
-
163}
+
159
+
+
160bool pesieve::WorkingSetScanner::isExecutable(MemPageData &memPage)
+
161{
+
162 if (pesieve::util::is_executable(memPage.mapping_type, memPage.protection)) {
+
163 return true;
+
164 }
+
165 return isPotentiallyExecutable(memPage, this->args.data);
+
166}
-
164
-
-
165bool pesieve::WorkingSetScanner::isPotentiallyExecutable(MemPageData &memPage, const t_data_scan_mode &mode)
-
166{
-
167 if (mode == pesieve::PE_DATA_NO_SCAN) {
-
168 return false;
-
169 }
-
170
-
171 // check preconditions:
-
172 const bool is_managed = this->processReport.isManagedProcess();
-
173 if (mode == pesieve::PE_DATA_SCAN_NO_DEP
-
174 && this->pDetails.isDEP && !is_managed)
-
175 {
-
176 return false;
-
177 }
-
178 if (mode == pesieve::PE_DATA_SCAN_DOTNET
-
179 && !is_managed)
-
180 {
-
181 return false;
-
182 }
-
183 // preconditions are fulfilled, now check the access:
-
184 const bool is_page_readable = pesieve::util::is_readable(memPage.mapping_type, memPage.protection);
-
185 if (mode != pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY) {
-
186 if (is_page_readable) {
-
187 return true;
-
188 }
-
189 }
-
190 if ((mode >= pesieve::PE_DATA_SCAN_INACCESSIBLE) || (mode == pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY)) {
-
191 if (this->pDetails.isReflection && (memPage.protection & PAGE_NOACCESS)) {
-
192 return true;
-
193 }
-
194 }
-
195 return false;
-
196}
+
167
+
+
168bool pesieve::WorkingSetScanner::isPotentiallyExecutable(MemPageData &memPage, const t_data_scan_mode &mode)
+
169{
+
170 if (mode == pesieve::PE_DATA_NO_SCAN) {
+
171 return false;
+
172 }
+
173
+
174 // check preconditions:
+
175 const bool is_managed = this->processReport.isManagedProcess();
+
176 if (mode == pesieve::PE_DATA_SCAN_NO_DEP
+
177 && this->pDetails.isDEP && !is_managed)
+
178 {
+
179 return false;
+
180 }
+
181 if (mode == pesieve::PE_DATA_SCAN_DOTNET
+
182 && !is_managed)
+
183 {
+
184 return false;
+
185 }
+
186 // preconditions are fulfilled, now check the access:
+
187 const bool is_page_readable = pesieve::util::is_readable(memPage.mapping_type, memPage.protection);
+
188 if (mode != pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY) {
+
189 if (is_page_readable) {
+
190 return true;
+
191 }
+
192 }
+
193 if ((mode >= pesieve::PE_DATA_SCAN_INACCESSIBLE) || (mode == pesieve::PE_DATA_SCAN_INACCESSIBLE_ONLY)) {
+
194 if (this->pDetails.isReflection && (memPage.protection & PAGE_NOACCESS)) {
+
195 return true;
+
196 }
+
197 }
+
198 return false;
+
199}
-
197
-
-
198WorkingSetScanReport* pesieve::WorkingSetScanner::scanExecutableArea(MemPageData &_memPage)
-
199{
-
200 if (!_memPage.load()) {
-
201 return nullptr;
-
202 }
-
203 // check for PE artifacts (regardless if it has shellcode patterns):
-
204 if (!isScannedAsModule(_memPage)) {
-
205 ArtefactScanner artefactScanner(this->processHandle, this->pDetails, _memPage, this->processReport);
-
206 WorkingSetScanReport *my_report1 = artefactScanner.scanRemote();
-
207 if (my_report1) {
-
208 //pe artefacts found
-
209 return my_report1;
-
210 }
-
211 }
-
212 if ((!matcher::is_matcher_ready())
-
213 && (this->args.obfuscated == OBFUSC_NONE))
-
214 {
-
215 // not a PE file, and we are not interested in patterns or obfuscated contents, so just finish it here
-
216 return nullptr;
-
217 }
-
218
-
219 //report about shellcode:
-
220 ULONGLONG region_start = _memPage.region_start;
-
221 const size_t region_size = size_t(_memPage.region_end - region_start);
-
222 WorkingSetScanReport* my_report = new WorkingSetScanReport((HMODULE)region_start, region_size, SCAN_NOT_SUSPICIOUS);
-
223 if (!my_report) {
-
224 return nullptr;
-
225 }
-
226
-
227 if (!checkAreaContent(_memPage, my_report)) { // check for shellcode patterns & stats
-
228 my_report->status = SCAN_ERROR;
-
229 }
-
230 if (my_report->status == SCAN_NOT_SUSPICIOUS) {
-
231 // do not keep reports for not suspicious areas
-
232 delete my_report;
-
233 return nullptr;
-
234 }
-
235 my_report->has_pe = isScannedAsModule(_memPage) && this->processReport.hasModule(_memPage.region_start);
-
236 return my_report;
-
237}
+
200
+
+
201WorkingSetScanReport* pesieve::WorkingSetScanner::scanExecutableArea(MemPageData &_memPage)
+
202{
+
203 if (!_memPage.load()) {
+
204 return nullptr;
+
205 }
+
206 // check for PE artifacts (regardless if it has shellcode patterns):
+
207 if (!isScannedAsModule(_memPage)) {
+
208 ArtefactScanner artefactScanner(this->processHandle, this->pDetails, _memPage, this->processReport);
+
209 WorkingSetScanReport *my_report1 = artefactScanner.scanRemote();
+
210 if (my_report1) {
+
211 //pe artefacts found
+
212 return my_report1;
+
213 }
+
214 }
+
215 if ((!matcher::is_matcher_ready())
+
216 && (this->args.obfuscated == OBFUSC_NONE))
+
217 {
+
218 // not a PE file, and we are not interested in patterns or obfuscated contents, so just finish it here
+
219 return nullptr;
+
220 }
+
221
+
222 //report about shellcode:
+
223 ULONGLONG region_start = _memPage.region_start;
+
224 const size_t region_size = size_t(_memPage.region_end - region_start);
+
225 WorkingSetScanReport* my_report = new WorkingSetScanReport((HMODULE)region_start, region_size, SCAN_NOT_SUSPICIOUS);
+
226 if (!my_report) {
+
227 return nullptr;
+
228 }
+
229
+
230 if (!checkAreaContent(_memPage, my_report)) { // check for shellcode patterns & stats
+
231 my_report->status = SCAN_ERROR;
+
232 }
+
233 if (my_report->status == SCAN_NOT_SUSPICIOUS) {
+
234 // do not keep reports for not suspicious areas
+
235 delete my_report;
+
236 return nullptr;
+
237 }
+
238 my_report->has_pe = isScannedAsModule(_memPage) && this->processReport.hasModule(_memPage.region_start);
+
239 return my_report;
+
240}
-
238
-
-
239bool pesieve::WorkingSetScanner::isScannedAsModule(MemPageData &memPage)
-
240{
-
241 if (memPage.mapping_type != MEM_IMAGE) {
-
242 return false;
-
243 }
-
244 if (this->processReport.hasModule((ULONGLONG)memPage.alloc_base)) {
-
245 return true; // it was already scanned as a PE
+
241
+
+
242bool pesieve::WorkingSetScanner::isScannedAsModule(MemPageData &memPage)
+
243{
+
244 if (memPage.mapping_type != MEM_IMAGE) {
+
245 return false;
246 }
-
247 return false;
-
248}
+
247 if (this->processReport.hasModule((ULONGLONG)memPage.alloc_base)) {
+
248 return true; // it was already scanned as a PE
+
249 }
+
250 return false;
+
251}
-
249
-
-
250bool pesieve::WorkingSetScanner::scanImg(MemPageData& memPage)
-
251{
-
252 if (!memPage.loadMappedName()) {
-
253 //cannot retrieve the mapped name
-
254 return false;
-
255 }
-
256
-
257 const HMODULE module_start = (HMODULE)memPage.alloc_base;
-
258
-
259 if (!args.quiet) {
-
260 std::cout << "[!] Scanning detached: " << std::hex << module_start << " : " << memPage.mapped_name << std::endl;
-
261 }
-
262 RemoteModuleData remoteModData(this->processHandle, this->pDetails.isReflection, module_start);
-
263 if (!remoteModData.isInitialized()) {
-
264 if (!args.quiet) {
-
265 std::cout << "[-] Could not read the remote PE at: " << std::hex << module_start << std::endl;
-
266 }
-
267 return false;
-
268 }
-
269
-
270 //load module from file:
-
271 ModuleData modData(processHandle, module_start, memPage.mapped_name, args.use_cache);
-
272 if (!modData.loadOriginal()) {
-
273 if (!args.quiet) {
-
274 std::cerr << "[-] [" << std::hex << modData.moduleHandle << "] Could not read the module file" << std::endl;
-
275 }
-
276 processReport.appendReport(new UnreachableModuleReport(module_start, 0, memPage.mapped_name));
-
277 return false;
-
278 }
-
279 t_scan_status scan_status = ProcessScanner::scanForHollows(processHandle, modData, remoteModData, processReport);
-
280#ifdef _DEBUG
-
281 std::cout << "[*] Scanned for hollows. Status: " << scan_status << std::endl;
-
282#endif
-
283 if (scan_status == SCAN_ERROR) {
-
284 // failed scanning it as a loaded PE module
-
285 return false;
-
286 }
-
287 if (scan_status == SCAN_SUSPICIOUS) {
-
288 // detected as hollowed, no need for further scans
-
289 return true;
-
290 }
-
291 if (!args.no_hooks) {
-
292 const bool scan_data = (this->args.data >= pesieve::PE_DATA_SCAN_ALWAYS && this->args.data != PE_DATA_SCAN_INACCESSIBLE_ONLY)
-
293 || (!this->pDetails.isDEP && (this->args.data == pesieve::PE_DATA_SCAN_NO_DEP));
-
294 const bool scan_inaccessible = (this->pDetails.isReflection && (this->args.data >= pesieve::PE_DATA_SCAN_INACCESSIBLE));
-
295 scan_status = ProcessScanner::scanForHooks(processHandle, modData, remoteModData, processReport, scan_data, scan_inaccessible);
-
296#ifdef _DEBUG
-
297 std::cout << "[*] Scanned for hooks. Status: " << scan_status << std::endl;
-
298#endif
-
299 }
-
300 return true;
-
301}
+
252
+
+
253bool pesieve::WorkingSetScanner::scanImg(MemPageData& memPage)
+
254{
+
255 if (!memPage.loadMappedName()) {
+
256 //cannot retrieve the mapped name
+
257 return false;
+
258 }
+
259
+
260 const HMODULE module_start = (HMODULE)memPage.alloc_base;
+
261
+
262 if (!args.quiet) {
+
263 std::cout << "[!] Scanning detached: " << std::hex << module_start << " : " << memPage.mapped_name << std::endl;
+
264 }
+
265 RemoteModuleData remoteModData(this->processHandle, this->pDetails.isReflection, module_start);
+
266 if (!remoteModData.isInitialized()) {
+
267 if (!args.quiet) {
+
268 std::cout << "[-] Could not read the remote PE at: " << std::hex << module_start << std::endl;
+
269 }
+
270 return false;
+
271 }
+
272
+
273 //load module from file:
+
274 ModuleData modData(processHandle, module_start, memPage.mapped_name, args.use_cache);
+
275 if (!modData.loadOriginal()) {
+
276 if (!args.quiet) {
+
277 std::cerr << "[-] [" << std::hex << modData.moduleHandle << "] Could not read the module file" << std::endl;
+
278 }
+
279 processReport.appendReport(new UnreachableModuleReport(module_start, 0, memPage.mapped_name));
+
280 return false;
+
281 }
+
282 t_scan_status scan_status = ProcessScanner::scanForHollows(processHandle, modData, remoteModData, processReport);
+
283#ifdef _DEBUG
+
284 std::cout << "[*] Scanned for hollows. Status: " << scan_status << std::endl;
+
285#endif
+
286 if (scan_status == SCAN_ERROR) {
+
287 // failed scanning it as a loaded PE module
+
288 return false;
+
289 }
+
290 if (scan_status == SCAN_SUSPICIOUS) {
+
291 // detected as hollowed, no need for further scans
+
292 return true;
+
293 }
+
294 if (!args.no_hooks) {
+
295 const bool scan_data = (this->args.data >= pesieve::PE_DATA_SCAN_ALWAYS && this->args.data != PE_DATA_SCAN_INACCESSIBLE_ONLY)
+
296 || (!this->pDetails.isDEP && (this->args.data == pesieve::PE_DATA_SCAN_NO_DEP));
+
297 const bool scan_inaccessible = (this->pDetails.isReflection && (this->args.data >= pesieve::PE_DATA_SCAN_INACCESSIBLE));
+
298 scan_status = ProcessScanner::scanForHooks(processHandle, modData, remoteModData, processReport, scan_data, scan_inaccessible);
+
299#ifdef _DEBUG
+
300 std::cout << "[*] Scanned for hooks. Status: " << scan_status << std::endl;
+
301#endif
+
302 }
+
303 return true;
+
304}
-
302
-
-
303WorkingSetScanReport* pesieve::WorkingSetScanner::scanRemote()
-
304{
-
305 MemPageData memPage(this->processHandle, this->pDetails.isReflection, this->memRegion.base, 0);
-
306 memPage.is_listed_module = this->processReport.hasModule(this->memRegion.base);
-
307
-
308 if (!memPage.isInfoFilled() && !memPage.fillInfo()) {
-
309#ifdef _DEBUG
-
310 std::cout << "[!] Could not fill: " << std::hex << memPage.start_va << " to: " << memPage.region_end << "\n";
-
311#endif
-
312 return nullptr;
-
313 }
-
314 // sanity checks to make sure that we are scanning the same page that was previously collected:
-
315 if (memPage.alloc_base != this->memRegion.alloc_base) {
-
316#ifdef _DEBUG
-
317 std::cerr << "WARNING: Alloc Base mismatch: " << std::hex << memPage.alloc_base << " vs " << this->memRegion.alloc_base << std::endl;
-
318#endif
-
319 return nullptr;
-
320 }
-
321 if ((memPage.region_end - memPage.region_start) != this->memRegion.size) {
-
322#ifdef _DEBUG
-
323 std::cerr << "WARNING: Size mismatch: " << std::hex << (memPage.region_end - memPage.region_start) << " vs " << this->memRegion.size << std::endl;
-
324#endif
-
325 return nullptr;
-
326 }
-
327
-
328 // is the page executable?
-
329 const bool is_any_exec = isExecutable(memPage);
-
330 if (!is_any_exec) {
-
331 // probably not interesting
-
332 return nullptr;
-
333 }
-
334
-
335 if (memPage.mapping_type == MEM_MAPPED && memPage.isRealMapping()) {
-
336 //probably legit
-
337 return nullptr;
-
338 }
-
339
-
340 if (memPage.mapping_type == MEM_IMAGE) {
-
341 memPage.loadModuleName();
-
342 memPage.loadMappedName();
-
343 if (!isScannedAsModule(memPage)) {
-
344 scanImg(memPage);
-
345 }
-
346 const size_t region_size = (memPage.region_end) ? (memPage.region_end - memPage.region_start) : 0;
-
347 if (this->processReport.hasModuleContaining(memPage.region_start, region_size)) {
-
348 // the area was already scanned
-
349 return nullptr;
-
350 }
-
351 }
-
352#ifdef _DEBUG
-
353 std::cout << std::hex << memPage.start_va << ": Scanning executable area" << std::endl;
-
354#endif
-
355 WorkingSetScanReport* my_report = this->scanExecutableArea(memPage);
-
356 if (!my_report) {
-
357 return nullptr;
-
358 }
-
359 my_report->is_executable = true;
-
360 my_report->protection = memPage.protection;
-
361 my_report->mapping_type = memPage.mapping_type;
-
362 my_report->mapped_name = memPage.mapped_name;
-
363 return my_report;
-
364}
+
305
+
+
306WorkingSetScanReport* pesieve::WorkingSetScanner::scanRemote()
+
307{
+
308 MemPageData memPage(this->processHandle, this->pDetails.isReflection, this->memRegion.base, 0);
+
309 memPage.is_listed_module = this->processReport.hasModule(this->memRegion.base);
+
310
+
311 if (!memPage.isInfoFilled() && !memPage.fillInfo()) {
+
312#ifdef _DEBUG
+
313 std::cout << "[!] Could not fill: " << std::hex << memPage.start_va << " to: " << memPage.region_end << "\n";
+
314#endif
+
315 return nullptr;
+
316 }
+
317 // sanity checks to make sure that we are scanning the same page that was previously collected:
+
318 if (memPage.alloc_base != this->memRegion.alloc_base) {
+
319#ifdef _DEBUG
+
320 std::cerr << "WARNING: Alloc Base mismatch: " << std::hex << memPage.alloc_base << " vs " << this->memRegion.alloc_base << std::endl;
+
321#endif
+
322 return nullptr;
+
323 }
+
324 if ((memPage.region_end - memPage.region_start) != this->memRegion.size) {
+
325#ifdef _DEBUG
+
326 std::cerr << "WARNING: Size mismatch: " << std::hex << (memPage.region_end - memPage.region_start) << " vs " << this->memRegion.size << std::endl;
+
327#endif
+
328 return nullptr;
+
329 }
+
330
+
331 // is the page executable?
+
332 const bool is_any_exec = isExecutable(memPage);
+
333 if (!is_any_exec) {
+
334 // probably not interesting
+
335 return nullptr;
+
336 }
+
337
+
338 if (memPage.mapping_type == MEM_MAPPED && memPage.isRealMapping()) {
+
339 //probably legit
+
340 return nullptr;
+
341 }
+
342
+
343 if (memPage.mapping_type == MEM_IMAGE) {
+
344 memPage.loadModuleName();
+
345 memPage.loadMappedName();
+
346 if (!isScannedAsModule(memPage)) {
+
347 scanImg(memPage);
+
348 }
+
349 const size_t region_size = (memPage.region_end) ? (memPage.region_end - memPage.region_start) : 0;
+
350 if (this->processReport.hasModuleContaining(memPage.region_start, region_size)) {
+
351 // the area was already scanned
+
352 return nullptr;
+
353 }
+
354 }
+
355#ifdef _DEBUG
+
356 std::cout << std::hex << memPage.start_va << ": Scanning executable area" << std::endl;
+
357#endif
+
358 WorkingSetScanReport* my_report = this->scanExecutableArea(memPage);
+
359 if (!my_report) {
+
360 return nullptr;
+
361 }
+
362 my_report->is_executable = true;
+
363 my_report->protection = memPage.protection;
+
364 my_report->mapping_type = memPage.mapping_type;
+
365 my_report->mapped_name = memPage.mapped_name;
+
366 return my_report;
+
367}
artefact_scanner.h
artefacts_util.h
@@ -500,18 +503,18 @@
pesieve::WorkingSetScanReport::custom_matched
std::vector< sig_finder::Match > custom_matched
Definition workingset_scanner.h:111
pesieve::WorkingSetScanReport::generateTags
size_t generateTags(const std::string &reportPath)
Definition workingset_scanner.cpp:45
-
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:198
-
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:165
+
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:201
+
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:168
pesieve::WorkingSetScanner::checkAreaContent
bool checkAreaContent(IN MemPageData &_memPage, OUT WorkingSetScanReport *my_report)
Definition workingset_scanner.cpp:68
-
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:239
-
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:250
-
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:157
-
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:303
+
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:242
+
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:253
+
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:160
+
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:306
pesieve.t_data_scan_mode
Definition pesieve.py:73
pesieve.t_shellc_mode
Definition pesieve.py:27
module_data.h
-
pesieve::matcher::find_all_patterns
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
Definition artefacts_util.cpp:173
-
pesieve::matcher::filter_custom
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
Definition artefacts_util.cpp:185
+
pesieve::matcher::find_all_patterns
size_t find_all_patterns(BYTE *loadedData, size_t loadedSize, std::vector< sig_finder::Match > &allMatches)
Definition artefacts_util.cpp:176
+
pesieve::matcher::filter_custom
size_t filter_custom(std::vector< sig_finder::Match > &allMatches, std::vector< sig_finder::Match > &customPatternMatches)
Definition artefacts_util.cpp:188
pesieve::stats::fillCodeStrings
size_t fillCodeStrings(OUT std::set< std::string > &codeStrings)
Definition stats_analyzer.cpp:118
diff --git a/workingset__scanner_8h_source.html b/workingset__scanner_8h_source.html index ec78736f3..d3e847778 100644 --- a/workingset__scanner_8h_source.html +++ b/workingset__scanner_8h_source.html @@ -293,17 +293,17 @@
pesieve::WorkingSetScanner
A scanner for detection of code implants in the process workingset.
Definition workingset_scanner.h:136
-
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:198
-
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:165
+
pesieve::WorkingSetScanner::scanExecutableArea
WorkingSetScanReport * scanExecutableArea(MemPageData &memPageData)
Definition workingset_scanner.cpp:201
+
pesieve::WorkingSetScanner::isPotentiallyExecutable
bool isPotentiallyExecutable(MemPageData &memPageData, const t_data_scan_mode &mode)
Definition workingset_scanner.cpp:168
pesieve::WorkingSetScanner::processReport
ProcessScanReport & processReport
Definition workingset_scanner.h:162
pesieve::WorkingSetScanner::pDetails
const process_details pDetails
Definition workingset_scanner.h:159
pesieve::WorkingSetScanner::checkAreaContent
bool checkAreaContent(IN MemPageData &_memPage, OUT WorkingSetScanReport *my_report)
Definition workingset_scanner.cpp:68
-
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:239
+
pesieve::WorkingSetScanner::isScannedAsModule
bool isScannedAsModule(MemPageData &memPageData)
Definition workingset_scanner.cpp:242
pesieve::WorkingSetScanner::WorkingSetScanner
WorkingSetScanner(HANDLE _procHndl, process_details _proc_details, const util::mem_region_info _mem_region, pesieve::t_params _args, ProcessScanReport &_process_report)
Definition workingset_scanner.h:138
pesieve::WorkingSetScanner::memRegion
const util::mem_region_info memRegion
Definition workingset_scanner.h:160
-
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:250
-
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:157
-
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:303
+
pesieve::WorkingSetScanner::scanImg
bool scanImg(MemPageData &memPage)
Definition workingset_scanner.cpp:253
+
pesieve::WorkingSetScanner::isExecutable
bool isExecutable(MemPageData &memPageData)
Definition workingset_scanner.cpp:160
+
pesieve::WorkingSetScanner::scanRemote
virtual WorkingSetScanReport * scanRemote()
Definition workingset_scanner.cpp:306
pesieve.t_data_scan_mode
Definition pesieve.py:73
pesieve.t_json_level
Definition pesieve.py:82