[FEATURE] Filter out cache from obfuscated regions detection

hasherezade · Jul 16, 2023 · 8d27203 · 8d27203
1 parent b2aa69e
commit 8d27203
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/scanners/workingset_scanner.cpp b/scanners/workingset_scanner.cpp
@@ -89,6 +89,13 @@ bool pesieve::WorkingSetScanner::checkAreaContent(IN MemPageData& memPage, OUT W
 				pesieve::RuleMatchersSet obfMatcher(rules);
 				if (obfMatcher.findMatches(my_report->stats, my_report->area_info)) {
 					obfuscated = true;
+					// filter out cache:
+					if (memPage.mapping_type == MEM_MAPPED // mapped memory
+						&& !util::is_executable(memPage.mapping_type, memPage.protection) // non executable page
+						&& memPage.loadMappedName()) //named
+					{
+						obfuscated = false;
+					}
 				}
 			}
 		}