mirrors/pafish
1
0
Fork 0
mirror of https://github.com/a0rtega/pafish synced 2025-02-17 23:04:22 +03:00
Code Issues Packages Projects Releases Wiki Activity

Refactor of hooks detection function, add 2 more functions to check

Browse Source
This commit is contained in:
Alberto Ortega 2015-09-04 18:24:53 +02:00
parent 54f33a2929
commit 044760116a
3 changed files with 28 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

33
pafish/hooks.c
View File

@ -5,23 +5,20 @@
#include "types.h" #include "types.h"
/* Thx Inaki for this! (@virtualminds_es) */ /* Thx Inaki for this! (@virtualminds_es) */
int check_hook_DeleteFileW_m1() { static int check_hook_m1(DWORD * dwAddress) {
DWORD *dwAddress = (DWORD *)DeleteFileW;
BYTE *b = (BYTE *)dwAddress; BYTE *b = (BYTE *)dwAddress;
if ((*b == 0xff) && (*(b+1) == 0x25)) { return (*b == 0x8b) && (*(b+1) == 0xff) ? FALSE : TRUE;
b++; b++;
dwAddress = (DWORD *)b;
DWORD *c = (DWORD *)(*dwAddress);
BYTE *op = (BYTE *)*c;
if ((*op == 0x8b) && (*(op+1) == 0xff)) {
return FALSE;
}
else {
return TRUE;
}
}
else {
return FALSE;
}
} }
int check_hook_DeleteFileW_m1() {
return check_hook_m1((DWORD *)DeleteFileW);
}
int check_hook_ShellExecuteExW_m1() {
return check_hook_m1((DWORD *)ShellExecuteExW);
}
int check_hook_CreateProcessA_m1() {
return check_hook_m1((DWORD *)CreateProcessA);
}

4
pafish/hooks.h
View File

@ -4,4 +4,8 @@
int check_hook_DeleteFileW_m1(); int check_hook_DeleteFileW_m1();
int check_hook_ShellExecuteExW_m1();
int check_hook_CreateProcessA_m1();
#endif #endif

10
pafish/main.c
View File

@ -144,7 +144,15 @@ int main(void)
exec_check("Checking function DeleteFileW method 1", exec_check("Checking function DeleteFileW method 1",
&check_hook_DeleteFileW_m1, &check_hook_DeleteFileW_m1,
"Hooks traced using DeleteFileW method 1", "Hooks traced using DeleteFileW method 1",
"hi_hooks_deletefile_m1"); "hi_hooks_deletefilew_m1");
exec_check("Checking function ShellExecuteExW method 1",
&check_hook_ShellExecuteExW_m1,
"Hooks traced using ShellExecuteExW method 1",
"hi_hooks_shellexecuteexw_m1");
exec_check("Checking function CreateProcessA method 1",
&check_hook_CreateProcessA_m1,
"Hooks traced using CreateProcessA method 1",
"hi_hooks_createprocessa_m1");
/* Sandboxie detection tricks */ /* Sandboxie detection tricks */
print_check_group("Sandboxie detection"); print_check_group("Sandboxie detection");