aboutsummaryrefslogtreecommitdiff
path: root/MemDriverLib/PatternScanner.cpp
diff options
context:
space:
mode:
authorToni Uhlig <matzeton@googlemail.com>2019-09-28 13:50:32 +0200
committerToni Uhlig <matzeton@googlemail.com>2019-09-28 13:50:32 +0200
commitaf48899954bfd7205f6b0d8d371502cc898a6667 (patch)
tree05047fa3e427d519b97b108bfb7c61adb906cf20 /MemDriverLib/PatternScanner.cpp
parent8f494ce58e35fa39a4802f5238da05be03f10edd (diff)
added an extensible dynamic symbol resolver including support for injected DLLs
Diffstat (limited to 'MemDriverLib/PatternScanner.cpp')
-rw-r--r--MemDriverLib/PatternScanner.cpp56
1 files changed, 21 insertions, 35 deletions
diff --git a/MemDriverLib/PatternScanner.cpp b/MemDriverLib/PatternScanner.cpp
index 3e1b8ee..a274b61 100644
--- a/MemDriverLib/PatternScanner.cpp
+++ b/MemDriverLib/PatternScanner.cpp
@@ -11,19 +11,14 @@
#include <Windows.h>
-static bool map_file_loadlib(MODULE_DATA& module, PVOID * const buffer,
+static bool map_file_loadlib(SymbolResolver& symres, MODULE_DATA& module, PVOID * const buffer,
SIZE_T * const size, PVOID const user_ptr);
-static bool map_file_loadlib_cleanup(MODULE_DATA& module, PVOID buffer,
- PVOID const user_ptr);
-static bool map_file_kmem(MODULE_DATA& module, PVOID * const buffer,
- SIZE_T * const size, PVOID const user_ptr);
-static bool map_file_kmem_cleanup(MODULE_DATA& module, PVOID buffer,
+static bool map_file_loadlib_cleanup(SymbolResolver& symres, MODULE_DATA& module, PVOID buffer,
PVOID const user_ptr);
const struct map_file_data map_loadlib = map_file_data(map_file_loadlib, map_file_loadlib_cleanup, true);
-const struct map_file_data map_kmem = map_file_data(map_file_kmem, map_file_kmem_cleanup, false);
-bool map_file_loadlib(MODULE_DATA& module, PVOID * const buffer,
+bool map_file_loadlib(SymbolResolver& symres, MODULE_DATA& module, PVOID * const buffer,
SIZE_T * const size, PVOID const user_ptr)
{
HMODULE hMod;
@@ -45,7 +40,7 @@ bool map_file_loadlib(MODULE_DATA& module, PVOID * const buffer,
}
}
- hMod = LoadLibraryA(module.FullDllPath);
+ hMod = symres.LoadLibrary(module.FullDllPath);
if (user_data) {
if (dir_cookies.size() > 1) {
@@ -69,24 +64,14 @@ bool map_file_loadlib(MODULE_DATA& module, PVOID * const buffer,
}
}
-bool map_file_loadlib_cleanup(MODULE_DATA& module, PVOID buffer, PVOID const user_ptr)
-{
- return FreeLibrary((HMODULE)buffer);
-}
-
-bool map_file_kmem(MODULE_DATA& module, PVOID * const buffer,
- SIZE_T * const size, PVOID const user_ptr)
+bool map_file_loadlib_cleanup(SymbolResolver& symres, MODULE_DATA& module, PVOID buffer, PVOID const user_ptr)
{
- return false;
-}
-
-bool map_file_kmem_cleanup(MODULE_DATA& module, PVOID buffer, PVOID const user_ptr)
-{
- return false;
+ return symres.FreeLibrary((HMODULE)buffer);
}
-PatternScanner::PatternScanner(struct map_file_data const * const mfd, PVOID map_file_user_data)
- : mfd(mfd), map_file_user_data(map_file_user_data)
+PatternScanner::PatternScanner(SymbolResolver& symres,
+ struct map_file_data const * const mfd, PVOID map_file_user_data)
+ : m_symbolResolver(symres), mfd(mfd), map_file_user_data(map_file_user_data)
{
if (!mfd) {
throw std::runtime_error("MapFileData was NULL");
@@ -137,14 +122,19 @@ bool PatternScanner::checkPattern(MODULE_DATA& module, const char * const patter
return true;
}
-bool PatternScanner::doScan(UINT8 *buf, SIZE_T size, std::vector<UINT64>& foundOffsets)
+#include <iostream>
+bool PatternScanner::doScan(std::string& pattern, UINT8 *buf, SIZE_T size, std::vector<UINT64>& foundOffsets)
{
+ //std::wcout << "BLAAAAAAAAAAAAA" << std::endl;
+ //std::wstring bla(str_pattern.begin(), str_pattern.end());
+ //std::wcout << bla << std::endl;
+ std::cout << pattern << std::endl;
return false;
}
-#include <iostream>
bool PatternScanner::Scan(MODULE_DATA& module, const char * const pattern)
{
+ bool result;
std::string validPattern;
IMAGE_NT_HEADERS *ntHeader;
IMAGE_SECTION_HEADER *secHeader;
@@ -156,7 +146,7 @@ bool PatternScanner::Scan(MODULE_DATA& module, const char * const pattern)
return false;
}
- if (!mfd->mapfile(module, (PVOID *)&mappedBuffer, &mappedSize, map_file_user_data))
+ if (!mfd->mapfile(m_symbolResolver, module, (PVOID *)&mappedBuffer, &mappedSize, map_file_user_data))
{
return false;
}
@@ -180,20 +170,16 @@ bool PatternScanner::Scan(MODULE_DATA& module, const char * const pattern)
virtualSize = secHeader->VirtualAddress - virtualSize;
nBytes += virtualSize;
}
+ result = false;
}
else {
- doScan(mappedBuffer, mappedSize, foundOffsets);
+ result = doScan(validPattern, mappedBuffer, mappedSize, foundOffsets);
}
- if (!mfd->mapcleanup(module, mappedBuffer, map_file_user_data))
+ if (!mfd->mapcleanup(m_symbolResolver, module, mappedBuffer, map_file_user_data))
{
return false;
}
- //std::wcout << "BLAAAAAAAAAAAAA" << std::endl;
- //std::wstring bla(str_pattern.begin(), str_pattern.end());
- //std::wcout << bla << std::endl;
- std::cout << validPattern << std::endl;
-
- return true;
+ return result;
} \ No newline at end of file