CERT-Polska/drakvuf-sandbox
1
0
Fork 0
mirror of https://github.com/CERT-Polska/drakvuf-sandbox.git synced 2026-10-12 02:01:43 +00:00
Code Issues Packages Projects Releases Wiki Activity

cleanup

Browse Source
This commit is contained in:
grzetzp
2025-04-16 04:11:11 -07:00
parent 7058af6632
commit 1ce2e916e7
5 changed files with 42 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.gitignore
+4
View File
@@ -3,3 +3,7 @@
/*.sav
.idea/
.vscode/
*.pdb
*.exe
*.obj
*.ilk
test/drak-tester/src/drakvuf_dump_tester.cpp
+29 -28
View File
@@ -68,7 +68,7 @@ DrakTestStatus InjectPayload(HANDLE hProc, unsigned char* payload, size_t payloa
}
assert(bytesWritten == payloadSize);
if (DEBUG_VERBOSE)
if (DEBUG_EXTRA)
{
ReadRemoteBuffer(hProc, *remoteProcBuffer, payloadSize);
}
@@ -151,7 +151,7 @@ DrakTestStatus ChangeMemProtection(HANDLE hProc, LPVOID* remoteProcBuffer, size_
return DrakTestStatus::Failed;
}
PRINT_DEBUG("old protection: %lu, new protection: %lu\n", oldAccessProtection, PAGE_EXECUTE_READWRITE);
PRINT_DEBUG_VERBOSE("old protection: %lu, new protection: %lu\n", oldAccessProtection, PAGE_EXECUTE_READWRITE);
return DrakTestStatus::OK;
}
@@ -194,28 +194,27 @@ DrakTestStatus RemoteInject(HANDLE hProc, unsigned char* payload, size_t* payloa
}
}
// Sleep(3000);
// int pid;
// pid = FindProc(L"calc.exe");
// if (pid != 0)
// {
// HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
// UINT exitCode = 0;
// if (!TerminateProcess(h, exitCode))
// {
// PRINT_DEBUG("TerminateProcess failed with code: %d\n", GetLastError());
// }
// }
// pid = FindProc(L"CalculatorApp.exe");
// if (pid != 0)
// {
// HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
// UINT exitCode = 0;
// if (!TerminateProcess(h, exitCode))
// {
// PRINT_DEBUG("TerminateProcess failed with code: %d\n", GetLastError());
// }
// }
int pid;
pid = FindProc(L"calc.exe");
if (pid != 0)
{
HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
UINT exitCode = 0;
if (!TerminateProcess(h, exitCode))
{
PRINT_DEBUG("TerminateProcess failed with code: %d\n", GetLastError());
}
}
pid = FindProc(L"CalculatorApp.exe");
if (pid != 0)
{
HANDLE h = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
UINT exitCode = 0;
if (!TerminateProcess(h, exitCode))
{
PRINT_DEBUG("TerminateProcess failed with code: %d\n", GetLastError());
}
}
return DrakTestStatus::OK;
}
@@ -344,8 +343,6 @@ DrakTestStatus NtWriteVirtualMemoryTest()
goto clean_exit;
}
// PostMessage(piNotepad.hProcess, )
if (!TerminateProcess(piNotepad.hProcess, exitCode))
{
PRINT_DEBUG("TerminateProcess failed with code: %d\n", GetLastError());
@@ -469,8 +466,11 @@ DrakTestStatus NtSetInformationThreadTest()
goto clean_exit;
}
// ReadPageProtections(pi.hProcess, wow64Context.Eax);
// ReadPageProtections(pi.hProcess, wow64Context.Eip);
if (DEBUG_EXTRA)
{
ReadPageProtections(pi.hProcess, wow64Context.Eax);
ReadPageProtections(pi.hProcess, wow64Context.Eip);
}
ntStatus = myNtSetInformationThread(pi.hThread, (THREADINFOCLASS) ThreadWow64Context, &wow64Context, sizeof(wow64Context));
@@ -539,6 +539,7 @@ DrakTestStatus NtFreeVirtualMemoryShellcodeTest()
return status;
}
// todo compile to multiple single test executables
int main(int argc, char* argv[])
{
bool waitOnExit = false;
test/drak-tester/src/utils/drakvuf_tester_utils.cpp
+2 -5
View File
@@ -37,13 +37,10 @@ DWORD FindProc(const WCHAR* procname)
while (result)
{
if (DEBUG_VERBOSE)
{
PRINT_DEBUG("proc name: %ls\n", pe.szExeFile);
}
PRINT_DEBUG_VERBOSE("proc name: %ls\n", pe.szExeFile);
if (wcscmp(pe.szExeFile, procname) == 0)
{
PRINT_DEBUG("found: %ls\n", pe.szExeFile);
// PRINT_DEBUG("found: %ls\n", pe.szExeFile);
return pe.th32ProcessID;
}
result = Process32NextW(hProcSnapshot, &pe);
test/drak-tester/src/utils/drakvuf_tester_utils.h
+7 -1
View File
@@ -13,11 +13,17 @@
#define PRINT_DEBUG(...) do {} while (0)
#endif
#ifdef DEBUG_VERBOSE
#define PRINT_DEBUG_VERBOSE(...) do { printf(__VA_ARGS__); } while (0)
#else
#define PRINT_DEBUG_VERBOSE(...) do {} while (0)
#endif
#ifndef ThreadWow64Context
#define ThreadWow64Context 0x1D
#endif
static const int DEBUG_VERBOSE = 0;
static const int DEBUG_EXTRA = 0;
void CheckProcStatus(HANDLE hProc, const char* procName);
void CloseHandleErrCheck(HANDLE handle);
test/test_sanity.py
-1
View File
@@ -115,7 +115,6 @@ def drak_tester_check_memdump_hooks(memdump_log):
d = json.loads(line)
method = d.get(method_field)
if method in hooks and d.get(processname_field) is not None and sample_name in d.get(processname_field):
print(f"{method} found")
hooks_map[method] = True
for k in hooks_map: