[FEATURE] Apply the same exclusion rules (and/or with Stats) on custo…

…m patterns as on the hardcoded ones
hasherezade · Feb 15, 2024 · 76ff351 · 76ff351
1 parent 9664a78
commit 76ff351
Show file tree

Hide file tree

Showing 2 changed files with 1 addition and 5 deletions.
diff --git a/scanners/workingset_scanner.cpp b/scanners/workingset_scanner.cpp
@@ -145,10 +145,6 @@ bool pesieve::WorkingSetScanner::checkAreaContent(IN MemPageData& memPage, OUT W
 	}
 	my_report->has_shellcode = code;
 
-	if (custom_matched_count && this->args.pattern_file.length) {
-		my_report->has_patterns = true;
-		my_report->status = SCAN_SUSPICIOUS;
-	}
 	if ( (this->args.obfuscated != OBFUSC_NONE && obfuscated) || ((this->args.shellcode != SHELLC_NONE) && code) ){
 		my_report->status = SCAN_SUSPICIOUS;
 	}

diff --git a/scanners/workingset_scanner.h b/scanners/workingset_scanner.h
@@ -106,7 +106,7 @@ namespace pesieve {
 		bool is_listed_module;
 		bool has_pe;
 		bool has_shellcode;
-		bool has_patterns;
+
 		util::ByteBuffer data_cache;
 		std::vector<sig_finder::Match> custom_matched;
 		size_t all_matched_count;