[BUGFIX] Fixed simultanous matching of patterns and stats for shellco…

…de (shellc B)
hasherezade · Jul 10, 2023 · 05cc926 · 05cc926
1 parent 4f10849
commit 05cc926
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/scanners/workingset_scanner.cpp b/scanners/workingset_scanner.cpp
@@ -50,6 +50,11 @@ bool pesieve::WorkingSetScanner::checkAreaContent(IN MemPageData& memPage, OUT W
 			if (codeMatcher.findMatches(my_report->stats, my_report->area_info)) {
 				code = true;
 			}
+			else {
+				if (this->args.shellcode == SHELLC_PATTERNS_AND_STATS) {
+					code = false; //nullify the previous detection, because both should match
+				}
+			}
 
 			if (!code && (this->args.obfuscated != OBFUSC_NONE)) {
 				int rules = 0;