From 97e08818bcd6cbf3065e7b4055c46022eaff71fe Mon Sep 17 00:00:00 2001 From: hasherezade Date: Fri, 6 Sep 2024 18:14:07 +0000 Subject: [PATCH] deploy: 9d3d31f2c421b433e6041fa779595489ffe1a835 --- classpesieve_1_1_thread_scanner.html | 4 +- scanner_8cpp_source.html | 2 +- thread__scanner_8cpp_source.html | 283 ++++++++++++++------------- thread__scanner_8h_source.html | 4 +- 4 files changed, 148 insertions(+), 145 deletions(-) diff --git a/classpesieve_1_1_thread_scanner.html b/classpesieve_1_1_thread_scanner.html index 5348a57a0..5a2970224 100644 --- a/classpesieve_1_1_thread_scanner.html +++ b/classpesieve_1_1_thread_scanner.html @@ -608,7 +608,7 @@

pesieve::ProcessFeatureScanner.

-

Definition at line 501 of file thread_scanner.cpp.

+

Definition at line 504 of file thread_scanner.cpp.

Here is the call graph for this function:
@@ -652,7 +652,7 @@

-

Definition at line 415 of file thread_scanner.cpp.

+

Definition at line 418 of file thread_scanner.cpp.

Here is the call graph for this function:
diff --git a/scanner_8cpp_source.html b/scanner_8cpp_source.html index 2619d096f..3b734dd7a 100644 --- a/scanner_8cpp_source.html +++ b/scanner_8cpp_source.html @@ -718,7 +718,7 @@
pesieve::ThreadScanReport
A report from the thread scan, generated by ThreadScanner.
Definition thread_scanner.h:15
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:501
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:504
pesieve::WorkingSetScanReport
A report from the working set scan, generated by WorkingSetScanner.
Definition workingset_scanner.h:29
diff --git a/thread__scanner_8cpp_source.html b/thread__scanner_8cpp_source.html index 61c52e940..b2ada0292 100644 --- a/thread__scanner_8cpp_source.html +++ b/thread__scanner_8cpp_source.html @@ -524,150 +524,153 @@
397bool should_scan_context(const util::thread_info& info)
398{
-
399 if (!info.is_extended) {
-
400 return true;
+
399 if (GetCurrentThreadId() == info.tid) {
+
400 return false; // don't scan the current thread
401 }
-
402 const KTHREAD_STATE state = (KTHREAD_STATE)info.ext.state;
-
403 if (state == Ready || state == Running) {
-
404 return true;
-
405 }
-
406 if (state == Terminated) {
-
407 return false;
+
402 if (!info.is_extended) {
+
403 return true;
+
404 }
+
405 const KTHREAD_STATE state = (KTHREAD_STATE)info.ext.state;
+
406 if (state == Ready || state == Running) {
+
407 return true;
408 }
-
409 if (state == Waiting && info.ext.wait_reason <= WrQueue) {
-
410 return true;
+
409 if (state == Terminated) {
+
410 return false;
411 }
-
412 return false;
-
413}
+
412 if (state == Waiting && info.ext.wait_reason <= WrQueue) {
+
413 return true;
+
414 }
+
415 return false;
+
416}
-
414
-
-
415bool pesieve::ThreadScanner::scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport* my_report)
-
416{
-
417 const DWORD tid = GetThreadId(hThread);
-
418 ctx_details cDetails = { 0 };
-
419 const bool is_ok = fetchThreadCtxDetails(processHandle, hThread, cDetails);
-
420
-
421 DWORD exit_code = 0;
-
422 GetExitCodeThread(hThread, &exit_code);
+
417
+
+
418bool pesieve::ThreadScanner::scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport* my_report)
+
419{
+
420 const DWORD tid = GetThreadId(hThread);
+
421 ctx_details cDetails = { 0 };
+
422 const bool is_ok = fetchThreadCtxDetails(processHandle, hThread, cDetails);
423
-
424 if (exit_code != STILL_ACTIVE) {
-
425#ifdef _DEBUG
-
426 std::cout << " ExitCode: " << std::dec << exit_code << "\n";
-
427#endif
-
428 my_report->status = SCAN_NOT_SUSPICIOUS;
-
429 return false;
-
430 }
-
431
-
432 if (!is_ok) {
-
433 // could not fetch the thread context and information
-
434 my_report->status = SCAN_ERROR;
-
435 return false;
-
436 }
-
437
-
438 bool is_shc = isAddrInShellcode(cDetails.rip);
-
439 if (is_shc) {
-
440 if (reportSuspiciousAddr(my_report, cDetails.rip)) {
-
441 if (my_report->status == SCAN_SUSPICIOUS) {
-
442 return true;
-
443 }
-
444 }
-
445 }
-
446
-
447 for (auto itr = cDetails.shcCandidates.begin(); itr != cDetails.shcCandidates.end(); ++itr) {
-
448 const ULONGLONG addr = *itr;
-
449#ifdef _SHOW_THREAD_INFO
-
450 std::cout << "Checking shc candidate: " << std::hex << addr << "\n";
-
451#endif //_SHOW_THREAD_INFO
-
452 //automatically verifies if the address is legit:
-
453 if (reportSuspiciousAddr(my_report, addr)) {
-
454 if (my_report->status == SCAN_SUSPICIOUS) {
-
455#ifdef _SHOW_THREAD_INFO
-
456 std::cout << "Found! " << std::hex << addr << "\n";
-
457#endif //_SHOW_THREAD_INFO
-
458 return true;
-
459 }
-
460 }
-
461 }
-
462
-
463 if (this->info.is_extended && info.ext.state == Waiting
-
464 && !cDetails.is_ret_in_frame)
-
465 {
-
466 const ULONGLONG ret_addr = cDetails.ret_on_stack;
-
467 is_shc = isAddrInShellcode(ret_addr);
-
468#ifdef _SHOW_THREAD_INFO
-
469 std::cout << "Return addr: " << std::hex << ret_addr << "\n";
-
470 printResolvedAddr(ret_addr);
-
471#endif //_SHOW_THREAD_INFO
-
472 if (is_shc && reportSuspiciousAddr(my_report, (ULONGLONG)ret_addr)) {
-
473 if (my_report->status == SCAN_SUSPICIOUS) {
-
474 return true;
-
475 }
-
476 my_report->status = SCAN_SUSPICIOUS;
-
477 my_report->stack_ptr = cDetails.rsp;
-
478 if (my_report->stats.entropy < 1) { // discard, do not dump
-
479 my_report->module = 0;
-
480 my_report->moduleSize = 0;
-
481 }
-
482 return true;
-
483 }
-
484 }
-
485
-
486 const bool hasEmptyGUI = has_empty_gui_info(tid);
-
487 if (hasEmptyGUI &&
-
488 cDetails.stackFramesCount == 1
-
489 && this->info.is_extended && info.ext.state == Waiting && info.ext.wait_reason == UserRequest)
-
490 {
-
491 my_report->thread_state = info.ext.state;
-
492 my_report->thread_wait_reason = info.ext.wait_reason;
-
493 my_report->thread_wait_time = info.ext.wait_time;
-
494 my_report->stack_ptr = cDetails.rsp;
-
495 my_report->status = SCAN_SUSPICIOUS;
-
496 }
-
497 return true;
-
498}
+
424 DWORD exit_code = 0;
+
425 GetExitCodeThread(hThread, &exit_code);
+
426
+
427 if (exit_code != STILL_ACTIVE) {
+
428#ifdef _DEBUG
+
429 std::cout << " ExitCode: " << std::dec << exit_code << "\n";
+
430#endif
+
431 my_report->status = SCAN_NOT_SUSPICIOUS;
+
432 return false;
+
433 }
+
434
+
435 if (!is_ok) {
+
436 // could not fetch the thread context and information
+
437 my_report->status = SCAN_ERROR;
+
438 return false;
+
439 }
+
440
+
441 bool is_shc = isAddrInShellcode(cDetails.rip);
+
442 if (is_shc) {
+
443 if (reportSuspiciousAddr(my_report, cDetails.rip)) {
+
444 if (my_report->status == SCAN_SUSPICIOUS) {
+
445 return true;
+
446 }
+
447 }
+
448 }
+
449
+
450 for (auto itr = cDetails.shcCandidates.begin(); itr != cDetails.shcCandidates.end(); ++itr) {
+
451 const ULONGLONG addr = *itr;
+
452#ifdef _SHOW_THREAD_INFO
+
453 std::cout << "Checking shc candidate: " << std::hex << addr << "\n";
+
454#endif //_SHOW_THREAD_INFO
+
455 //automatically verifies if the address is legit:
+
456 if (reportSuspiciousAddr(my_report, addr)) {
+
457 if (my_report->status == SCAN_SUSPICIOUS) {
+
458#ifdef _SHOW_THREAD_INFO
+
459 std::cout << "Found! " << std::hex << addr << "\n";
+
460#endif //_SHOW_THREAD_INFO
+
461 return true;
+
462 }
+
463 }
+
464 }
+
465
+
466 if (this->info.is_extended && info.ext.state == Waiting
+
467 && !cDetails.is_ret_in_frame)
+
468 {
+
469 const ULONGLONG ret_addr = cDetails.ret_on_stack;
+
470 is_shc = isAddrInShellcode(ret_addr);
+
471#ifdef _SHOW_THREAD_INFO
+
472 std::cout << "Return addr: " << std::hex << ret_addr << "\n";
+
473 printResolvedAddr(ret_addr);
+
474#endif //_SHOW_THREAD_INFO
+
475 if (is_shc && reportSuspiciousAddr(my_report, (ULONGLONG)ret_addr)) {
+
476 if (my_report->status == SCAN_SUSPICIOUS) {
+
477 return true;
+
478 }
+
479 my_report->status = SCAN_SUSPICIOUS;
+
480 my_report->stack_ptr = cDetails.rsp;
+
481 if (my_report->stats.entropy < 1) { // discard, do not dump
+
482 my_report->module = 0;
+
483 my_report->moduleSize = 0;
+
484 }
+
485 return true;
+
486 }
+
487 }
+
488
+
489 const bool hasEmptyGUI = has_empty_gui_info(tid);
+
490 if (hasEmptyGUI &&
+
491 cDetails.stackFramesCount == 1
+
492 && this->info.is_extended && info.ext.state == Waiting && info.ext.wait_reason == UserRequest)
+
493 {
+
494 my_report->thread_state = info.ext.state;
+
495 my_report->thread_wait_reason = info.ext.wait_reason;
+
496 my_report->thread_wait_time = info.ext.wait_time;
+
497 my_report->stack_ptr = cDetails.rsp;
+
498 my_report->status = SCAN_SUSPICIOUS;
+
499 }
+
500 return true;
+
501}
-
499
-
500
-
-
501ThreadScanReport* pesieve::ThreadScanner::scanRemote()
-
502{
-
503 ThreadScanReport* my_report = new ThreadScanReport(info.tid);
-
504 if (!my_report) return nullptr;
-
505
-
506#ifdef _SHOW_THREAD_INFO
-
507 printThreadInfo(info);
-
508#endif // _SHOW_THREAD_INFO
-
509
-
510 bool is_shc = isAddrInShellcode(info.start_addr);
-
511 if (is_shc) {
-
512 if (reportSuspiciousAddr(my_report, info.start_addr)) {
-
513 if (my_report->status == SCAN_SUSPICIOUS) {
-
514 return my_report;
-
515 }
-
516 }
-
517 }
-
518 if (!should_scan_context(info)) {
-
519 my_report->status = SCAN_NOT_SUSPICIOUS;
-
520 return my_report;
-
521 }
-
522 // proceed with detailed checks:
-
523 HANDLE hThread = OpenThread(
-
524 THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
-
525 FALSE,
-
526 info.tid
-
527 );
-
528 if (!hThread) {
-
529#ifdef _DEBUG
-
530 std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
-
531#endif
-
532 my_report->status = SCAN_ERROR;
-
533 return my_report;
-
534 }
-
535 scanRemoteThreadCtx(hThread, my_report);
-
536 CloseHandle(hThread);
-
537 return my_report;
-
538}
+
502
+
503
+
+
504ThreadScanReport* pesieve::ThreadScanner::scanRemote()
+
505{
+
506 ThreadScanReport* my_report = new ThreadScanReport(info.tid);
+
507 if (!my_report) return nullptr;
+
508
+
509#ifdef _SHOW_THREAD_INFO
+
510 printThreadInfo(info);
+
511#endif // _SHOW_THREAD_INFO
+
512
+
513 bool is_shc = isAddrInShellcode(info.start_addr);
+
514 if (is_shc) {
+
515 if (reportSuspiciousAddr(my_report, info.start_addr)) {
+
516 if (my_report->status == SCAN_SUSPICIOUS) {
+
517 return my_report;
+
518 }
+
519 }
+
520 }
+
521 if (!should_scan_context(info)) {
+
522 my_report->status = SCAN_NOT_SUSPICIOUS;
+
523 return my_report;
+
524 }
+
525 // proceed with detailed checks:
+
526 HANDLE hThread = OpenThread(
+
527 THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
+
528 FALSE,
+
529 info.tid
+
530 );
+
531 if (!hThread) {
+
532#ifdef _DEBUG
+
533 std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
+
534#endif
+
535 my_report->status = SCAN_ERROR;
+
536 return my_report;
+
537 }
+
538 scanRemoteThreadCtx(hThread, my_report);
+
539 CloseHandle(hThread);
+
540 return my_report;
+
541}
pesieve::AreaStatsCalculator
A class responsible for filling in the statistics with the data from the particular buffer.
Definition stats.h:73
@@ -691,7 +694,7 @@
pesieve::ThreadScanReport::translate_thread_state
static std::string translate_thread_state(DWORD thread_state)
Definition thread_scanner.cpp:118
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:501
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:504
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:366
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:195
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:322
@@ -700,7 +703,7 @@
pesieve::ThreadScanner::analyzeCallStack
size_t analyzeCallStack(IN const std::vector< ULONGLONG > stack_frame, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:139
pesieve::ThreadScanner::fetchThreadCtxDetails
bool fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details &c)
Definition thread_scanner.cpp:241
pesieve::ThreadScanner::printResolvedAddr
bool printResolvedAddr(ULONGLONG addr)
Definition thread_scanner.cpp:292
-
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:415
+
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:418
mempage_data.h
pesieve::util::is_process_wow64
BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL *isProcWow64)
Definition process_util.cpp:27
pesieve::util::wow64_get_thread_context
BOOL wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
Definition process_util.cpp:73
diff --git a/thread__scanner_8h_source.html b/thread__scanner_8h_source.html index af547eae2..41d8a629c 100644 --- a/thread__scanner_8h_source.html +++ b/thread__scanner_8h_source.html @@ -295,7 +295,7 @@
pesieve::ThreadScanner::ThreadScanner
ThreadScanner(HANDLE hProc, bool _isReflection, const util::thread_info &_info, ModulesInfo &_modulesInfo, peconv::ExportsMapper *_exportsMap, ProcessSymbolsManager *_symbols)
Definition thread_scanner.h:133
-
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:501
+
pesieve::ThreadScanner::scanRemote
virtual ThreadScanReport * scanRemote()
Definition thread_scanner.cpp:504
pesieve::ThreadScanner::reportSuspiciousAddr
bool reportSuspiciousAddr(ThreadScanReport *my_report, ULONGLONG susp_addr)
Definition thread_scanner.cpp:366
pesieve::ThreadScanner::fillCallStackInfo
size_t fillCallStackInfo(IN HANDLE hProcess, IN HANDLE hThread, IN LPVOID ctx, IN OUT ctx_details &cDetails)
Definition thread_scanner.cpp:195
pesieve::ThreadScanner::printThreadInfo
void printThreadInfo(const util::thread_info &threadi)
Definition thread_scanner.cpp:322
@@ -307,7 +307,7 @@
pesieve::ThreadScanner::fetchThreadCtxDetails
bool fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ctx_details &c)
Definition thread_scanner.cpp:241
pesieve::ThreadScanner::printResolvedAddr
bool printResolvedAddr(ULONGLONG addr)
Definition thread_scanner.cpp:292
pesieve::ThreadScanner::symbols
ProcessSymbolsManager * symbols
Definition thread_scanner.h:156
-
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:415
+
pesieve::ThreadScanner::scanRemoteThreadCtx
bool scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport *my_report)
Definition thread_scanner.cpp:418
pesieve.t_json_level
Definition pesieve.py:82
entropy_stats.h