From 136d38e2d9dbc48e9cec5d3a2c962254a8ff803b Mon Sep 17 00:00:00 2001 From: hasherezade Date: Sun, 24 May 2026 10:52:45 -0800 Subject: [PATCH] [FEATURE] Added argument sym to commandline --- params.h | 9 +++++++++ pe_sieve_ver_short.h | 4 ++-- scanners/scanner.cpp | 2 +- utils/process_symbols.h | 12 ++++-------- 4 files changed, 16 insertions(+), 11 deletions(-) diff --git a/params.h b/params.h index fca13841..7a65d17a 100644 --- a/params.h +++ b/params.h @@ -19,6 +19,7 @@ using namespace pesieve; #define PARAM_MODULES_IGNORE "mignore" #define PARAM_REFLECTION "refl" #define PARAM_DOTNET_POLICY "dnet" +#define PARAM_SYMBOLS "sym" //dump options: #define PARAM_IMP_REC "imp" @@ -164,6 +165,11 @@ public: std::string(INFO_SPACER) + "This allows i.e. to force-read inaccessible pages." ); + //PARAM_SYMBOLS + this->addParam(new BoolParam(PARAM_SYMBOLS, false)); + this->setInfo(PARAM_SYMBOLS, + "Autodownload symbols for scanned modules." + ); //PARAM_IAT enumParam = new EnumParam(PARAM_IAT, "iat_scan_mode", false); if (enumParam) { @@ -225,6 +231,7 @@ public: this->addGroup(new ParamGroup(str_group)); this->addParamToGroup(PARAM_QUIET, str_group); this->addParamToGroup(PARAM_REFLECTION, str_group); + this->addParamToGroup(PARAM_SYMBOLS, str_group); str_group = "3. scan options"; this->addGroup(new ParamGroup(str_group)); @@ -294,6 +301,8 @@ public: copyCStr(PARAM_DIR, ps.output_dir, _countof(ps.output_dir)); fillStringParam(PARAM_PATTERN, ps.pattern_file); + + copyVal(PARAM_SYMBOLS, ps.download_symbols); } void printBanner() diff --git a/pe_sieve_ver_short.h b/pe_sieve_ver_short.h index 05a9a9f4..641f28d6 100644 --- a/pe_sieve_ver_short.h +++ b/pe_sieve_ver_short.h @@ -3,6 +3,6 @@ #define PESIEVE_MAJOR_VERSION 0 #define PESIEVE_MINOR_VERSION 4 #define PESIEVE_MICRO_VERSION 1 -#define PESIEVE_PATCH_VERSION 2 +#define PESIEVE_PATCH_VERSION 3 -#define PESIEVE_VERSION_STR "0.4.1.2" +#define PESIEVE_VERSION_STR "0.4.1.3" diff --git a/scanners/scanner.cpp b/scanners/scanner.cpp index a5dd582f..e0f9d5ec 100644 --- a/scanners/scanner.cpp +++ b/scanners/scanner.cpp @@ -446,7 +446,7 @@ size_t pesieve::ProcessScanner::scanModulesIATs(ProcessScanReport &pReport) //th } const size_t modules_count = hMods.size(); if (!args.quiet) { - std::cout << "Scanning for IAT hooks: " << modules_count << " modules." << std::endl; + std::cout << "Scanning for IAT hooks: " << std::dec << modules_count << " modules." << std::endl; } DWORD start_tick = GetTickCount(); diff --git a/utils/process_symbols.h b/utils/process_symbols.h index 5acec01d..515d73b3 100644 --- a/utils/process_symbols.h +++ b/utils/process_symbols.h @@ -61,16 +61,13 @@ public: } const bool isSrv = (_strnicmp(token.c_str(), "srv*", 4) == 0); - if (isSrv) - { - if (allowDownload) - { + if (isSrv) { + if (allowDownload) { // Keep full srv* entry if (!result.empty()) result += ";"; result += token; } - else - { + else { // Extract cache path: srv** size_t first = token.find('*'); size_t second = token.find('*', first + 1); @@ -86,8 +83,7 @@ public: } } } - else - { + else { // Non-srv entries are always safe if (!result.empty()) result += ";"; result += token;