Skip to content

Commit

Permalink
cleanup
Browse files Browse the repository at this point in the history
  • Loading branch information
Lasha Khasaia committed Mar 16, 2019
1 parent 5a7eee8 commit c385498
Show file tree
Hide file tree
Showing 4 changed files with 14 additions and 17 deletions.
Binary file modified asho/dllmain.cpp
Binary file not shown.
2 changes: 0 additions & 2 deletions makin/checks.json
Original file line number Diff line number Diff line change
Expand Up @@ -2,9 +2,7 @@
"title": "VM checks",

"Registry": {

"KeyChecks": {

"VMware": [
"vmware"
],
Expand Down
28 changes: 14 additions & 14 deletions makin/makin.cpp
Original file line number Diff line number Diff line change
Expand Up @@ -141,7 +141,6 @@ VOID ProcessOutputString(const PROCESS_INFORMATION pi, const OUTPUT_DEBUG_STRING
hookFunctions.emplace_back("RegOpenKeyExInternalW");
else if (tmpStr.find("RegQueryValueExW") != std::string::npos)
hookFunctions.emplace_back("RegQueryValueExW");

}

VOID GenRandStr(TCHAR* str, const size_t size) // just enough randomness
Expand Down Expand Up @@ -267,10 +266,10 @@ int _tmain()

// Map just one page
auto lpMapAddress = MapViewOfFile(hMapFile,
FILE_MAP_READ,
0,
0,
sysInfo.dwPageSize); // one page size is more than we need for now
FILE_MAP_READ,
0,
0,
sysInfo.dwPageSize); // one page size is more than we need for now

if (!lpMapAddress)
{
Expand All @@ -279,17 +278,18 @@ int _tmain()
return err;
}
// IMAGE_DOS_HEADER->e_lfanew
const auto e_lfanew = *reinterpret_cast<DWORD*>(static_cast<byte*>(lpMapAddress) + sizeof(IMAGE_DOS_HEADER) - sizeof(
DWORD));
const auto e_lfanew = *reinterpret_cast<DWORD*>(static_cast<byte*>(lpMapAddress) + sizeof(IMAGE_DOS_HEADER) - sizeof
(
DWORD));
UnmapViewOfFile(lpMapAddress);


const auto ntMapAddrLow = (e_lfanew / sysInfo.dwAllocationGranularity) * sysInfo.dwAllocationGranularity;
lpMapAddress = MapViewOfFile(hMapFile,
FILE_MAP_READ,
0,
ntMapAddrLow,
sysInfo.dwPageSize);
FILE_MAP_READ,
0,
ntMapAddrLow,
sysInfo.dwPageSize);

if (!lpMapAddress)
{
Expand Down Expand Up @@ -342,7 +342,7 @@ int _tmain()
const auto pBeingDebugged = DWORD_PTR(reinterpret_cast<byte*>(peb) + 0x2); // PEB->BeingDebugged

#ifndef _WIN64
peb -= 0x1000; // 32-bit PEB
peb -= 0x1000; // 32-bit PEB
#endif

const auto pImageBaseAddress = DWORD_PTR(reinterpret_cast<byte*>(peb) + 0x10);
Expand All @@ -360,8 +360,8 @@ int _tmain()
#ifdef _WIN64
pNtGlobalFlag = DWORD_PTR(reinterpret_cast<byte*>(peb) + 0xBC);
#else
pNtGlobalFlag = DWORD_PTR(reinterpret_cast<byte*>(peb) + 0x68);
pNtGlobalFlag += 0x1000; // 32-bit PEB
pNtGlobalFlag = DWORD_PTR(reinterpret_cast<byte*>(peb) + 0x68);
pNtGlobalFlag += 0x1000; // 32-bit PEB
#endif

SetHardwareBreakpoint(pi.hThread, cxt, pNtGlobalFlag, 2, Dr1);
Expand Down
1 change: 0 additions & 1 deletion makin/stdafx.h
Original file line number Diff line number Diff line change
Expand Up @@ -23,5 +23,4 @@
#include <ctime>



#pragma comment(lib, "Shlwapi.lib")

0 comments on commit c385498

Please sign in to comment.