iat_scanner.h

Go to the documentation of this file.

#pragma once
 
#include <windows.h>
 
#include "module_scanner.h"
#include "scanned_modules.h"
 
namespace pesieve {
 
    class IATScanReport : public ModuleScanReport
    {
    public:
 
        static bool saveNotRecovered(IN const std::string &fileName,
            IN HANDLE hProcess,
            IN peconv::ImportsCollection *storedFunc,
            IN peconv::ImpsNotCovered &notCovered,
            IN const ModulesInfo &modulesInfo,
            IN const peconv::ExportsMapper *exportsMap);
 
        IATScanReport(HMODULE _module, size_t _moduleSize, std::string _moduleFile)
            : ModuleScanReport(_module, _moduleSize, SCAN_SUSPICIOUS)
        {
            moduleFile = _moduleFile;
        }
 
        const virtual bool toJSON(std::stringstream &outs, size_t level, const pesieve::t_json_level &jdetails)
        {
            size_t hooks = countHooked();
            OUT_PADDED(outs, level, "\"iat_scan\" : ");
            outs << "{\n";
            ModuleScanReport::_toJSON(outs, level + 1);
            outs << ",\n";
            OUT_PADDED(outs, level + 1, "\"hooks\" : ");
            outs << std::dec << hooks;
            if (jdetails >= JSON_DETAILS && hooks) {
                outs << ",\n";
                this->hooksToJSON(outs, level + 1);
            }
            outs << "\n";
            OUT_PADDED(outs, level, "}");
            return true;
        }
 
        bool generateList(IN const std::string &fileName, IN HANDLE hProcess, IN const ModulesInfo &modulesInfo, IN const peconv::ExportsMapper *exportsMap);
 
        const bool hooksToJSON(std::stringstream &outs, size_t level);
        size_t countHooked() { return notCovered.count(); }
 
        peconv::ImportsCollection storedFunc;
        peconv::ImpsNotCovered notCovered;
 
    protected:
        static std::string formatHookedFuncName(IN peconv::ImportsCollection* storedFunc, DWORD thunk_rva);
        static std::string formatTargetName(IN const peconv::ExportsMapper* exportsMap, IN const ModulesInfo& modulesInfo, IN const ULONGLONG module_start, IN ULONGLONG addr);
    };
 
    //---
 
    class IATScanner : public ModuleScanner {
    public:
 
        IATScanner(
            HANDLE hProc,
            ModuleData &moduleData,
            RemoteModuleData &remoteModData,
            const peconv::ExportsMapper &_exportsMap,
            IN const ModulesInfo &_modulesInfo,
            t_iat_scan_mode _hooksFilter
        )
            : ModuleScanner(hProc, moduleData, remoteModData),
            exportsMap(_exportsMap), modulesInfo(_modulesInfo),
            hooksFilter(_hooksFilter)
        {
            initExcludedPaths();
        }
 
        virtual IATScanReport* scanRemote();
 
    private:
        bool scanByOriginalTable(peconv::ImpsNotCovered &not_covered);
        bool isValidFuncFilled(ULONGLONG filled_val, const peconv::ExportedFunc &definedFunc, const peconv::ExportedFunc& possibleFunc);
 
        void initExcludedPaths();
        bool isInSystemDir(const std::string &moduleName);
 
        bool filterResults(peconv::ImpsNotCovered &not_covered, IATScanReport &report);
 
        bool listAllImports(peconv::ImportsCollection &collection);
 
        const peconv::ExportsMapper &exportsMap;
        const ModulesInfo &modulesInfo;
 
        t_iat_scan_mode hooksFilter;
        
        //excluded paths:
        std::string m_sysWow64Path_str;
        std::string m_system32Path_str;
    };
 
}; //namespace pesieve