Merge branch 'pattern_report2'

hh_ver_short.h

@@ -3,6 +3,6 @@
 #define HH_MAJOR_VERSION 0
 #define HH_MINOR_VERSION 3
 #define HH_MICRO_VERSION 8
-#define HH_PATCH_VERSION 1
+#define HH_PATCH_VERSION 2
 
-#define HH_VERSION_STR	"0.3.8.1"
+#define HH_VERSION_STR	"0.3.8.2"

main.cpp

@@ -53,6 +53,7 @@ t_pesieve_res deploy_scan(t_hh_params &hh_args)
 void free_params(t_params& args)
 {
     free_strparam(args.modules_ignored);
+    free_strparam(args.pattern_file);
 }
 
 int main(int argc, char *argv[])

params_info/params.h

@@ -40,6 +40,7 @@ using namespace pesieve;
 #define PARAM_KILL "kill"
 #define PARAM_UNIQUE_DIR "uniqd"
 #define PARAM_DIR "dir"
+#define PARAM_PATTERN "pattern"
 #define PARAM_MINIDUMP "minidmp"
 #define PARAM_LOG "log"
 #define PARAM_JSON "json"
@@ -247,6 +248,9 @@ class HHParams : public Params
             }
         }
 
+        this->addParam(new StringParam(PARAM_PATTERN, false));
+        this->setInfo(PARAM_PATTERN, "Set additional shellcode patterns (file in the SIG format).");
+
         //PARAM_DOTNET_POLICY
         enumParam = new EnumParam(PARAM_DOTNET_POLICY, "dotnet_policy", false);
         if (enumParam) {
@@ -308,7 +312,8 @@ class HHParams : public Params
         this->addParamToGroup(PARAM_OBFUSCATED, str_group);  
         this->addParamToGroup(PARAM_THREADS, str_group);
         this->addParamToGroup(PARAM_HOOKS, str_group);
-
+        this->addParamToGroup(PARAM_PATTERN, str_group);
+
         str_group = "5. dump options";
         this->addGroup(new ParamGroup(str_group));
         this->addParamToGroup(PARAM_MINIDUMP, str_group);
@@ -372,7 +377,6 @@ class HHParams : public Params
         copyVal<BoolParam>(PARAM_HOOKS, hooks);
         ps.pesieve_args.no_hooks = hooks ? false : true;
 
-        copyVal<StringParam>(PARAM_DIR, ps.out_dir);
         copyVal<BoolParam>(PARAM_UNIQUE_DIR, ps.unique_dir);
         copyVal<BoolParam>(PARAM_SUSPEND, ps.suspend_suspicious);
         copyVal<BoolParam>(PARAM_KILL, ps.kill_suspicious);
@@ -440,5 +444,7 @@ class HHParams : public Params
             copyVal<EnumParam>(PARAM_DOTNET_POLICY, ps.dotnet_policy);
             copyVal<EnumParam>(PARAM_DATA, ps.data);
             copyVal<EnumParam>(PARAM_DUMP_MODE, ps.dump_mode);
+
+            fillStringParam(PARAM_PATTERN, ps.pattern_file);
         }
 };