Skip to content

Commit

Permalink
[REFACT] Use constant instead of repeating check (isCallerPeModule)
Browse files Browse the repository at this point in the history
  • Loading branch information
hasherezade committed Jan 19, 2022
1 parent b1fcb2b commit 07bcd5c
Showing 1 changed file with 4 additions and 2 deletions.
6 changes: 4 additions & 2 deletions TinyTracer.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -167,6 +167,7 @@ VOID _SaveTransitions(const ADDRINT addrFrom, const ADDRINT addrTo, BOOL isIndir

IMG targetModule = IMG_FindByAddress(addrTo);
IMG callerModule = IMG_FindByAddress(addrFrom);
const bool isCallerPeModule = IMG_Valid(callerModule);
const bool isTargetPeModule = IMG_Valid(targetModule);

/**
Expand All @@ -190,7 +191,7 @@ VOID _SaveTransitions(const ADDRINT addrFrom, const ADDRINT addrTo, BOOL isIndir
/**
trace calls from witin a shellcode:
*/
if (m_Settings.followShellcode && !IMG_Valid(callerModule)) {
if (m_Settings.followShellcode && !isCallerPeModule) {

if (m_Settings.followShellcode == SHELLC_FOLLOW_ANY || isFromTraced) {
const ADDRINT pageFrom = query_region_base(addrFrom);
Expand Down Expand Up @@ -224,8 +225,9 @@ VOID _SaveTransitions(const ADDRINT addrFrom, const ADDRINT addrTo, BOOL isIndir
/**
save the transition when a shellcode returns to a traced area from an API call:
*/
if (!isFromTraced && !IMG_Valid(callerModule) // from an untraced shellcode...
if (!isFromTraced && !isCallerPeModule // from an untraced shellcode...
&& isTargetPeModule // ...into an API call
&& ctx //the context was passed: we can check the return
)
{
// was the shellcode a proxy for making an API call?
Expand Down

0 comments on commit 07bcd5c

Please sign in to comment.