From 4a7db746e75600fc482b99d826af515c11b38dbe Mon Sep 17 00:00:00 2001 From: hasherezade Date: Sun, 9 Jun 2024 18:19:30 +0000 Subject: [PATCH] deploy: b1760e946f991c43d49a2bd7484799a1196f37fb --- class_h_h_scanner.html | 8 +- hh__scanner_8cpp_source.html | 342 ++++++++++++++++++----------------- hh__scanner_8h_source.html | 8 +- 3 files changed, 182 insertions(+), 176 deletions(-) diff --git a/class_h_h_scanner.html b/class_h_h_scanner.html index 71769f2..5936ceb 100644 --- a/class_h_h_scanner.html +++ b/class_h_h_scanner.html @@ -347,7 +347,7 @@

-

Definition at line 315 of file hh_scanner.cpp.

+

Definition at line 320 of file hh_scanner.cpp.

Here is the call graph for this function:
@@ -429,7 +429,7 @@

-

Definition at line 252 of file hh_scanner.cpp.

+

Definition at line 255 of file hh_scanner.cpp.

Here is the call graph for this function:
@@ -545,7 +545,7 @@

-

Definition at line 345 of file hh_scanner.cpp.

+

Definition at line 350 of file hh_scanner.cpp.

Here is the call graph for this function:
@@ -608,7 +608,7 @@

-

Definition at line 328 of file hh_scanner.cpp.

+

Definition at line 333 of file hh_scanner.cpp.

Here is the call graph for this function:
diff --git a/hh__scanner_8cpp_source.html b/hh__scanner_8cpp_source.html index c198e68..39f355a 100644 --- a/hh__scanner_8cpp_source.html +++ b/hh__scanner_8cpp_source.html @@ -335,176 +335,181 @@
215 if (hh_args.quiet) return;
216
217 if (report.errors == pesieve::ERROR_SCAN_FAILURE) {
-
218 WORD old_color = set_color(MAKE_COLOR(SILVER, DARK_RED));
-
219 if (report.errors == pesieve::ERROR_SCAN_FAILURE) {
-
220 std::cout << "[!] Could not access: " << std::dec << report.pid;
-
221 }
-
222 set_color(old_color);
-
223 std::cout << std::endl;
-
224 return;
-
225 }
-
226#ifndef _WIN64
-
227 if (report.is_64bit) {
-
228 WORD old_color = set_color(MAKE_COLOR(SILVER, DARK_MAGENTA));
-
229 std::cout << "[!] Partial scan: " << std::dec << report.pid << " : " << (report.is_64bit ? 64 : 32) << "b";
-
230 set_color(old_color);
-
231 std::cout << std::endl;
-
232 }
-
233#endif
-
234 if (report.suspicious) {
-
235 int color = YELLOW;
-
236 if (report.replaced || report.implanted) {
-
237 color = RED;
-
238 }
-
239 if (report.is_managed) {
-
240 color = MAKE_COLOR(color, DARK_BLUE);
-
241 }
-
242 WORD old_color = set_color(color);
-
243 std::cout << ">> Detected: " << std::dec << report.pid;
-
244 if (report.is_managed) {
-
245 std::cout << " [.NET]";
-
246 }
-
247 set_color(old_color);
-
248 std::cout << std::endl;
-
249 }
-
250}
+
218 const std::lock_guard<std::mutex> stdOutLock(g_stdOutMutex);
+
219 WORD old_color = set_color(MAKE_COLOR(SILVER, DARK_RED));
+
220 if (report.errors == pesieve::ERROR_SCAN_FAILURE) {
+
221 std::cout << "[!] Could not access: " << std::dec << report.pid;
+
222 }
+
223 set_color(old_color);
+
224 std::cout << std::endl;
+
225 return;
+
226 }
+
227#ifndef _WIN64
+
228 if (report.is_64bit) {
+
229 const std::lock_guard<std::mutex> stdOutLock(g_stdOutMutex);
+
230 WORD old_color = set_color(MAKE_COLOR(SILVER, DARK_MAGENTA));
+
231 std::cout << "[!] Partial scan: " << std::dec << report.pid << " : " << (report.is_64bit ? 64 : 32) << "b";
+
232 set_color(old_color);
+
233 std::cout << std::endl;
+
234 }
+
235#endif
+
236 if (report.suspicious) {
+
237 int color = YELLOW;
+
238 if (report.replaced || report.implanted) {
+
239 color = RED;
+
240 }
+
241 if (report.is_managed) {
+
242 color = MAKE_COLOR(color, DARK_BLUE);
+
243 }
+
244 const std::lock_guard<std::mutex> stdOutLock(g_stdOutMutex);
+
245 WORD old_color = set_color(color);
+
246 std::cout << ">> Detected: " << std::dec << report.pid;
+
247 if (report.is_managed) {
+
248 std::cout << " [.NET]";
+
249 }
+
250 set_color(old_color);
+
251 std::cout << std::endl;
+
252 }
+
253}
-
251
-
-
252t_single_scan_status HHScanner::scanNextProcess(DWORD pid, WCHAR* exe_file, HHScanReport &my_report)
-
253{
-
254 bool found = false;
-
255
-
256 const bool is_process_wow64 = process_util::is_wow_64_by_pid(pid);
-
257
-
258 const bool check_time = (hh_args.ptimes != TIME_UNDEFINED) ? true : false;
-
259#ifdef _DEBUG
-
260 if (check_time) {
-
261 std::cout << "Init Time: " << std::hex << this->initTime << std::endl;
-
262 }
-
263#endif
-
264 // filter by the time
-
265 time_t time_diff = 0;
-
266 if (check_time) { // if the parameter was set
-
267 const time_t process_time = util::process_start_time(pid);
-
268 if (process_time == INVALID_TIME) return SSCAN_ERROR0; //skip process if cannot retrieve the time
-
269
-
270 // if HH was started after the process
-
271 if (this->initTime > process_time) {
-
272 time_diff = this->initTime - process_time;
-
273 if (time_diff > hh_args.ptimes) return SSCAN_NOT_MATCH; // skip process created before the supplied time
-
274 }
-
275 }
-
276 //filter by the names/PIDs
-
277 if (hh_args.names_list.size() || hh_args.pids_list.size()) {
-
278 if (!util::is_searched_name(exe_file, hh_args.names_list) && !util::is_searched_pid(pid, hh_args.pids_list)) {
-
279 //it is not the searched process, so skip it
-
280 return SSCAN_NOT_MATCH;
-
281 }
-
282 found = true;
-
283 }
-
284 if (!found && hh_args.ignored_names_list.size()) {
-
285 if (util::is_searched_name(exe_file, hh_args.ignored_names_list)) {
-
286 return SSCAN_IGNORED;
-
287 }
-
288 }
-
289 if (!hh_args.quiet) {
-
290 std::cout << ">> Scanning PID: " << std::setw(PID_FIELD_SIZE) << std::dec << pid;
-
291 std::wcout << " : " << exe_file;
-
292
-
293 if (is_process_wow64) {
-
294 std::cout << " : 32b";
-
295 }
-
296 if (check_time) {
-
297 std::cout << " : " << time_diff << "s";
-
298 }
-
299 std::cout << std::endl;
-
300 }
-
301 //perform the scan:
-
302 pesieve::t_params &pesieve_args = this->hh_args.pesieve_args;
-
303 pesieve_args.pid = pid;
-
304
-
305 pesieve::t_report report = PESieve_scan(pesieve_args);
-
306 my_report.appendReport(report, exe_file);
-
307
-
308 printSingleReport(report);
-
309 if (report.scanned > 0) {
-
310 return SSCAN_SUCCESS;
-
311 }
-
312 return SSCAN_ERROR1;
-
313}
+
254
+
+
255t_single_scan_status HHScanner::scanNextProcess(DWORD pid, WCHAR* exe_file, HHScanReport &my_report)
+
256{
+
257 bool found = false;
+
258
+
259 const bool is_process_wow64 = process_util::is_wow_64_by_pid(pid);
+
260
+
261 const bool check_time = (hh_args.ptimes != TIME_UNDEFINED) ? true : false;
+
262#ifdef _DEBUG
+
263 if (check_time) {
+
264 const std::lock_guard<std::mutex> stdOutLock(g_stdOutMutex);
+
265 std::cout << "Init Time: " << std::hex << this->initTime << std::endl;
+
266 }
+
267#endif
+
268 // filter by the time
+
269 time_t time_diff = 0;
+
270 if (check_time) { // if the parameter was set
+
271 const time_t process_time = util::process_start_time(pid);
+
272 if (process_time == INVALID_TIME) return SSCAN_ERROR0; //skip process if cannot retrieve the time
+
273
+
274 // if HH was started after the process
+
275 if (this->initTime > process_time) {
+
276 time_diff = this->initTime - process_time;
+
277 if (time_diff > hh_args.ptimes) return SSCAN_NOT_MATCH; // skip process created before the supplied time
+
278 }
+
279 }
+
280 //filter by the names/PIDs
+
281 if (hh_args.names_list.size() || hh_args.pids_list.size()) {
+
282 if (!util::is_searched_name(exe_file, hh_args.names_list) && !util::is_searched_pid(pid, hh_args.pids_list)) {
+
283 //it is not the searched process, so skip it
+
284 return SSCAN_NOT_MATCH;
+
285 }
+
286 found = true;
+
287 }
+
288 if (!found && hh_args.ignored_names_list.size()) {
+
289 if (util::is_searched_name(exe_file, hh_args.ignored_names_list)) {
+
290 return SSCAN_IGNORED;
+
291 }
+
292 }
+
293 if (!hh_args.quiet) {
+
294 const std::lock_guard<std::mutex> stdOutLock(g_stdOutMutex);
+
295 std::cout << ">> Scanning PID: " << std::setw(PID_FIELD_SIZE) << std::dec << pid;
+
296 std::wcout << " : " << exe_file;
+
297
+
298 if (is_process_wow64) {
+
299 std::cout << " : 32b";
+
300 }
+
301 if (check_time) {
+
302 std::cout << " : " << time_diff << "s";
+
303 }
+
304 std::cout << std::endl;
+
305 }
+
306 //perform the scan:
+
307 pesieve::t_params &pesieve_args = this->hh_args.pesieve_args;
+
308 pesieve_args.pid = pid;
+
309
+
310 pesieve::t_report report = PESieve_scan(pesieve_args);
+
311 my_report.appendReport(report, exe_file);
+
312
+
313 printSingleReport(report);
+
314 if (report.scanned > 0) {
+
315 return SSCAN_SUCCESS;
+
316 }
+
317 return SSCAN_ERROR1;
+
318}
-
314
-
-
315HHScanReport* HHScanner::scan()
-
316{
-
317 const time_t scan_start = time(NULL); //start time of the current scan
-
318 pesieve::t_params &pesieve_args = this->hh_args.pesieve_args;
-
319 initOutDir(scan_start, pesieve_args);
-
320
-
321 HHScanReport *my_report = new HHScanReport(GetTickCount(), scan_start);
-
322 scanProcesses(*my_report);
-
323
-
324 my_report->setEndTick(GetTickCount(), time(NULL));
-
325 return my_report;
-
326}
-
-
327
-
-
328bool HHScanner::writeToLog(HHScanReport* hh_report)
-
329{
-
330 if (!hh_args.log) {
-
331 return false;
-
332 }
-
333
-
334 const bool suspiciousOnly = false;
-
335
-
336 std::string summary_str;
-
337 summary_str = hh_report->toString(suspiciousOnly);
-
338 std::cout << summary_str;
-
339
-
340 static std::mutex logMutx;
-
341 const std::lock_guard<std::mutex> lock(logMutx);
-
342 return files_util::write_to_file("hollows_hunter.log", summary_str, true);
-
343}
+
319
+
+
320HHScanReport* HHScanner::scan()
+
321{
+
322 const time_t scan_start = time(NULL); //start time of the current scan
+
323 pesieve::t_params &pesieve_args = this->hh_args.pesieve_args;
+
324 initOutDir(scan_start, pesieve_args);
+
325
+
326 HHScanReport *my_report = new HHScanReport(GetTickCount(), scan_start);
+
327 scanProcesses(*my_report);
+
328
+
329 my_report->setEndTick(GetTickCount(), time(NULL));
+
330 return my_report;
+
331}
+
332
+
+
333bool HHScanner::writeToLog(HHScanReport* hh_report)
+
334{
+
335 if (!hh_args.log) {
+
336 return false;
+
337 }
+
338
+
339 const bool suspiciousOnly = false;
+
340
+
341 std::string summary_str;
+
342 summary_str = hh_report->toString(suspiciousOnly);
+
343 std::cout << summary_str;
344
-
-
345void HHScanner::summarizeScan(HHScanReport *hh_report, bool suspiciousOnly)
-
346{
-
347 if (!hh_report) return;
-
348 std::string summary_str;
+
345 static std::mutex logMutx;
+
346 const std::lock_guard<std::mutex> lock(logMutx);
+
347 return files_util::write_to_file("hollows_hunter.log", summary_str, true);
+
348}
+
349
-
350 if (!this->hh_args.json_output) {
-
351 summary_str = hh_report->toString(suspiciousOnly);
-
352 std::cout << summary_str;
-
353 }
-
354 else {
-
355 summary_str = hh_report->toJSON(this->hh_args);
-
356 std::cout << summary_str;
-
357 }
-
358
-
359 if (hh_args.pesieve_args.out_filter != OUT_NO_DIR) {
-
360 //file the same report into the directory with dumps:
-
361 if (hh_report->suspicious.size()) {
-
362 std::string report_path = files_util::join_path(this->outDir, "summary.json");
+
+
350void HHScanner::summarizeScan(HHScanReport *hh_report, bool suspiciousOnly)
+
351{
+
352 if (!hh_report) return;
+
353 std::string summary_str;
+
354
+
355 if (!this->hh_args.json_output) {
+
356 summary_str = hh_report->toString(suspiciousOnly);
+
357 std::cout << summary_str;
+
358 }
+
359 else {
+
360 summary_str = hh_report->toJSON(this->hh_args);
+
361 std::cout << summary_str;
+
362 }
363
-
364 static std::mutex summaryMutx;
-
365 const std::lock_guard<std::mutex> lock(summaryMutx);
-
366 //TODO: fix JSON formatting for the appended reports
-
367 files_util::write_to_file(report_path, hh_report->toJSON(this->hh_args), true);
-
368 }
-
369 }
-
370 if (hh_args.log) {
-
371 writeToLog(hh_report);
-
372 }
-
373 if (hh_args.suspend_suspicious) {
-
374 process_util::suspend_suspicious(hh_report->suspicious);
-
375 }
-
376 if (hh_args.kill_suspicious) {
-
377 process_util::kill_suspicious(hh_report->suspicious);
-
378 }
-
379}
+
364 if (hh_args.pesieve_args.out_filter != OUT_NO_DIR) {
+
365 //file the same report into the directory with dumps:
+
366 if (hh_report->suspicious.size()) {
+
367 std::string report_path = files_util::join_path(this->outDir, "summary.json");
+
368
+
369 static std::mutex summaryMutx;
+
370 const std::lock_guard<std::mutex> lock(summaryMutx);
+
371 //TODO: fix JSON formatting for the appended reports
+
372 files_util::write_to_file(report_path, hh_report->toJSON(this->hh_args), true);
+
373 }
+
374 }
+
375 if (hh_args.log) {
+
376 writeToLog(hh_report);
+
377 }
+
378 if (hh_args.suspend_suspicious) {
+
379 process_util::suspend_suspicious(hh_report->suspicious);
+
380 }
+
381 if (hh_args.kill_suspicious) {
+
382 process_util::kill_suspicious(hh_report->suspicious);
+
383 }
+
384}
HHScanReport::appendReport
bool appendReport(pesieve::t_report &scan_report, const std::wstring &img_name)
Definition hh_report.cpp:26
@@ -512,16 +517,16 @@
HHScanReport::suspicious
std::vector< DWORD > suspicious
Definition hh_report.h:65
HHScanReport::toJSON
std::string toJSON(const t_hh_params &params)
Definition hh_report.cpp:111
HHScanReport::toString
std::string toString(bool suspiciousOnly=true)
Definition hh_report.cpp:156
-
HHScanner::summarizeScan
void summarizeScan(HHScanReport *hh_report, bool suspiciousOnly=true)
Definition hh_scanner.cpp:345
-
HHScanner::writeToLog
bool writeToLog(HHScanReport *hh_report)
Definition hh_scanner.cpp:328
+
HHScanner::summarizeScan
void summarizeScan(HHScanReport *hh_report, bool suspiciousOnly=true)
Definition hh_scanner.cpp:350
+
HHScanner::writeToLog
bool writeToLog(HHScanReport *hh_report)
Definition hh_scanner.cpp:333
HHScanner::outDir
std::string outDir
Definition hh_scanner.h:43
-
HHScanner::scanNextProcess
t_single_scan_status scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report)
Definition hh_scanner.cpp:252
+
HHScanner::scanNextProcess
t_single_scan_status scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report)
Definition hh_scanner.cpp:255
HHScanner::isScannerWow64
bool isScannerWow64
Definition hh_scanner.h:47
HHScanner::printScanRoundStats
void printScanRoundStats(size_t found, size_t ignored_count)
Definition hh_scanner.cpp:154
HHScanner::scanProcesses
size_t scanProcesses(HHScanReport &my_report)
Definition hh_scanner.cpp:175
HHScanner::initTime
time_t initTime
Definition hh_scanner.h:46
HHScanner::hh_args
t_hh_params & hh_args
Definition hh_scanner.h:42
-
HHScanner::scan
HHScanReport * scan()
Definition hh_scanner.cpp:315
+
HHScanner::scan
HHScanReport * scan()
Definition hh_scanner.cpp:320
HHScanner::initOutDir
void initOutDir(time_t scan_time, pesieve::t_params &pesieve_args)
Definition hh_scanner.cpp:141
HHScanner::HHScanner
HHScanner(t_hh_params &_args)
Definition hh_scanner.cpp:124
HHScanner::isScannerCompatibile
static bool isScannerCompatibile()
Definition hh_scanner.cpp:131
@@ -565,6 +570,7 @@
hh_params::ptimes
LONGLONG ptimes
Definition hh_params.h:23
set_color
WORD set_color(WORD color)
Definition term_util.cpp:20
+
g_stdOutMutex
std::mutex g_stdOutMutex
Definition term_util.cpp:9
term_util.h
MAKE_COLOR
#define MAKE_COLOR(fg_color, bg_color)
Definition term_util.h:26
SILVER
#define SILVER
Definition term_util.h:16
diff --git a/hh__scanner_8h_source.html b/hh__scanner_8h_source.html index 94d2579..453da23 100644 --- a/hh__scanner_8h_source.html +++ b/hh__scanner_8h_source.html @@ -147,16 +147,16 @@
52extern t_hh_params g_hh_args;
-
HHScanner::summarizeScan
void summarizeScan(HHScanReport *hh_report, bool suspiciousOnly=true)
Definition hh_scanner.cpp:345
-
HHScanner::writeToLog
bool writeToLog(HHScanReport *hh_report)
Definition hh_scanner.cpp:328
+
HHScanner::summarizeScan
void summarizeScan(HHScanReport *hh_report, bool suspiciousOnly=true)
Definition hh_scanner.cpp:350
+
HHScanner::writeToLog
bool writeToLog(HHScanReport *hh_report)
Definition hh_scanner.cpp:333
HHScanner::outDir
std::string outDir
Definition hh_scanner.h:43
-
HHScanner::scanNextProcess
t_single_scan_status scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report)
Definition hh_scanner.cpp:252
+
HHScanner::scanNextProcess
t_single_scan_status scanNextProcess(DWORD pid, WCHAR *image_buf, HHScanReport &report)
Definition hh_scanner.cpp:255
HHScanner::isScannerWow64
bool isScannerWow64
Definition hh_scanner.h:47
HHScanner::printScanRoundStats
void printScanRoundStats(size_t found, size_t ignored_count)
Definition hh_scanner.cpp:154
HHScanner::scanProcesses
size_t scanProcesses(HHScanReport &my_report)
Definition hh_scanner.cpp:175
HHScanner::initTime
time_t initTime
Definition hh_scanner.h:46
HHScanner::hh_args
t_hh_params & hh_args
Definition hh_scanner.h:42
-
HHScanner::scan
HHScanReport * scan()
Definition hh_scanner.cpp:315
+
HHScanner::scan
HHScanReport * scan()
Definition hh_scanner.cpp:320
HHScanner::initOutDir
void initOutDir(time_t scan_time, pesieve::t_params &pesieve_args)
Definition hh_scanner.cpp:141
HHScanner::HHScanner
HHScanner(t_hh_params &_args)
Definition hh_scanner.cpp:124
HHScanner::isScannerCompatibile
static bool isScannerCompatibile()
Definition hh_scanner.cpp:131