thread_scanner.cpp

Go to the documentation of this file.

#include "thread_scanner.h"
#include <peconv.h>
#include "mempage_data.h"
#include "../utils/process_util.h"
#include "../utils/ntddk.h"
#include "../stats/stats.h"
#include "../utils/process_symbols.h"
#include "../utils/syscall_extractor.h"
#include "../utils/artefacts_util.h"
 
extern pesieve::SyscallTable g_SyscallTable;
 
#define ENTROPY_THRESHOLD 3.0
#define ENTROPY_ENC_THRESHOLD 6.0
//#define NO_ENTROPY_CHECK
 
#ifdef _DEBUG
#define _SHOW_THREAD_INFO
#endif
 
using namespace pesieve;
 
//---
 
namespace pesieve {
 
    bool is_thread_running(HANDLE hThread)
    {
        DWORD exit_code = 0;
        if (GetExitCodeThread(hThread, &exit_code)) {
            if (exit_code != STILL_ACTIVE) {
#ifdef _DEBUG
                std::cout << " Thread ExitCode: " << std::dec << exit_code << "\n";
#endif
                return false;
            }
        }
        return true;
    }
 
};
 
bool get_page_details(HANDLE processHandle, LPVOID start_va, MEMORY_BASIC_INFORMATION& page_info)
{
    size_t page_info_size = sizeof(MEMORY_BASIC_INFORMATION);
    const SIZE_T out = VirtualQueryEx(processHandle, (LPCVOID)start_va, &page_info, page_info_size);
    const bool is_read = (out == page_info_size) ? true : false;
    const DWORD error = is_read ? ERROR_SUCCESS : GetLastError();
    if (error != ERROR_SUCCESS) {
        //nothing to read
        return false;
    }
    return true;
}
 
std::string ThreadScanReport::translate_wait_reason(DWORD thread_wait_reason)
{
    switch (thread_wait_reason) {
        case DelayExecution: return "DelayExecution";
        case Suspended: return "Suspended";
        case Executive: return "Executive";
        case UserRequest: return "UserRequest";
        case WrUserRequest: return "WrUserRequest";
        case WrEventPair: return "WrEventPair";
        case WrQueue: return "WrQueue";
        case WrAlertByThreadId: return "WrAlertByThreadId";
    }
    std::stringstream ss;
    ss << "Other: " << std::dec << thread_wait_reason;
    return ss.str();
}
 
std::string ThreadScanReport::translate_thread_state(DWORD thread_state)
{
    switch (thread_state) {
        case Initialized: return "Initialized";
        case Ready: return "Ready";
        case Running: return "Running";
        case Standby: return "Standby";
        case Terminated: return "Terminated";
        case Waiting: return "Waiting";
        case Transition: return "Transition";
        case DeferredReady: return "DeferredReady";
        case GateWaitObsolete: return "GateWaitObsolete";
        case WaitingForProcessInSwap: return "WaitingForProcessInSwap";
    }
    std::stringstream ss;
    ss << "Other: " << std::dec << thread_state;
    return ss.str();
}
 
//---
 
std::string pesieve::ThreadScanner::choosePreferredFunctionName(const std::string& dbgSymbol, const std::string& manualSymbol)
{
    if (dbgSymbol.empty()) {
        if (manualSymbol.empty()) {
            return "";
        }
        // Give priority to the manual symbol if the debug symbol is empty
        return manualSymbol;
    }
    // Give priority to the manual symbol if it denotes the actual syscall
    if (!SyscallTable::isSyscallFunc(dbgSymbol)) {
        if (SyscallTable::isSyscallFunc(manualSymbol)) {
            return manualSymbol;
        }
    }
    //otherwise use the debug symbol
    return dbgSymbol;
}
 
bool ThreadScanner::checkReturnAddrIntegrity(IN const std::vector<ULONGLONG>& callStack, IN OUT ThreadScanReport& my_report)
{
    if (this->info.last_syscall == INVALID_SYSCALL || !callStack.size() || !info.is_extended || !g_SyscallTable.isReady()) {
        return true; // skip the check
    }
    const ULONGLONG lastCalled = *(callStack.begin());
    const std::string debugFuncName = (symbols) ? symbols->funcNameFromAddr(lastCalled) : "";
    const std::string manualSymbol = exportsMap ? resolveLowLevelFuncName(lastCalled) : "";
    if (debugFuncName.empty() && !exportsMap) {
        return true; // skip the check
    }
    const std::string lastFuncCalled = choosePreferredFunctionName(debugFuncName, manualSymbol);
    my_report.lastFunction = lastFuncCalled;
    if (this->info.last_syscall == 0) {
        if (this->info.ext.wait_reason == Suspended && callStack.size() == 1 && lastFuncCalled == "RtlUserThreadStart") {
            return true; //normal for suspended threads that just started
        }
        return false; // otherwise it is an anomaly
    }
 
    // Further checks require symbols:
    if (!symbols) {
        return true; // skip the check
    }
 
    if (lastFuncCalled.empty()) {
#ifdef _DEBUG
        std::cout << "ERR: Can't fetch the name of the last function called!\n";
#endif
        return false;
    }
 
    // Proceed to check if the last syscall matches the last function called...
 
#ifndef _WIN64
    static bool isWow64 = util::is_current_wow64();
    if (!isWow64 && lastFuncCalled == "KiFastSystemCallRet") {
        return true;
    }
#endif
    const std::string syscallFuncName = my_report.lastSyscall;
    if (syscallFuncName.empty()) {
        return true; // skip the check
    }
 
    if (SyscallTable::isSameSyscallFunc(syscallFuncName, lastFuncCalled)) {
        return true; // valid
    }
 
    const ScannedModule* mod = modulesInfo.findModuleContaining(lastCalled);
    const std::string lastModName = mod ? mod->getModName() : "";
 
    if (syscallFuncName == "NtCallbackReturn") {
        if (lastModName == "win32u.dll"
            || lastModName == "user32.dll" || lastModName == "winsrv.dll") // for Windows7
        {
            return true;
        }
    }
    if (!SyscallTable::isSyscallDll(lastModName)) {
#ifdef _DEBUG
        std::cout << "[@]" << std::dec << info.tid << " : " << "LastSyscall: " << syscallFuncName << " VS LastCalledAddr: " << std::hex << lastCalled
            << " : " << lastFuncCalled << "(" << lastModName << "." << manualSymbol << " )" << " DIFFERENT!"
            << " WaitReason: " << std::dec << ThreadScanReport::translate_wait_reason(this->info.ext.wait_reason) << std::endl;
#endif //_DEBUG
        return false;
    }
 
    if (this->info.ext.wait_reason == WrUserRequest ||
        this->info.ext.wait_reason == UserRequest)
    {
        if (syscallFuncName.rfind("NtUser", 0) == 0) {
            if (lastFuncCalled.rfind("NtUser", 0) == 0) return true;
            if (lastFuncCalled.rfind("NtGdi", 0) == 0) return true;
        }
        if (syscallFuncName.rfind("NtGdi", 0) == 0) {
            if (lastFuncCalled.rfind("NtGdi", 0) == 0) return true;
            if (lastFuncCalled.rfind("NtUser", 0) == 0) return true;
        }
    }
 
    if (this->info.ext.wait_reason == UserRequest) {
        if (syscallFuncName.rfind("NtDxgkGet", 0) == 0 &&
            lastFuncCalled.rfind("NtWaitFor", 0) == 0)
        {
            return true;
        }
        if (syscallFuncName.find("WaitFor", 0) != std::string::npos &&
            (lastFuncCalled.find("WaitFor", 0) != std::string::npos))
        {
            return true;
        }
        if (syscallFuncName == "NtWaitForSingleObject") {
            if ((lastFuncCalled.rfind("NtQuery", 0) == 0) || lastFuncCalled == "NtDelayExecution") return true;
        }
        if (syscallFuncName.rfind("NtUser", 0) == 0 && lastFuncCalled == "NtWaitForWorkViaWorkerFactory") {
            return true;
        }
        if (syscallFuncName.rfind("NtUserModify", 0) == 0 && lastFuncCalled == "NtDeviceIoControlFile") {
            return true;
        }
    }
 
    if (this->info.ext.wait_reason == WrQueue) {
        if (syscallFuncName.rfind("NtWaitFor", 0) == 0 && lastFuncCalled == "NtWaitForWorkViaWorkerFactory") {
            return true;
        }
        if (syscallFuncName == "NtWaitForWorkViaWorkerFactory") {
            if (lastFuncCalled.rfind("NtWaitFor", 0) == 0
                || lastFuncCalled.rfind("NtUserMsgWaitFor", 0) == 0
                || lastFuncCalled.rfind("NtUserCreate", 0) == 0)
            {
                return true;
            }
        }
    }
 
    if (this->info.ext.wait_reason == DelayExecution) {
        if (syscallFuncName == "NtDelayExecution") {
            if ((lastFuncCalled.rfind("NtUserMsgWaitFor", 0) == 0) || (lastFuncCalled.rfind("NtWaitFor", 0) == 0)) return true;
        }
    }
 
#ifdef _DEBUG
    std::cout << "[@]" << std::dec << info.tid << " : " << "LastSyscall: " << syscallFuncName << " VS LastCalledAddr: " << std::hex << lastCalled
        << " : " << lastFuncCalled << "(" << lastModName << "." << manualSymbol << " )" << " DIFFERENT!"
        << " WaitReason: " << std::dec << ThreadScanReport::translate_wait_reason(this->info.ext.wait_reason) << std::endl;
#endif //_DEBUG
#ifdef _SHOW_THREAD_INFO
    printThreadInfo(info);
    std::cout << "STACK:\n";
    for (auto itr = callStack.rbegin(); itr != callStack.rend(); ++itr) {
        ULONGLONG next_return = *itr;
        symbols->dumpSymbolInfo(next_return);
        std::cout << "\t";
        printResolvedAddr(next_return);
    }
    std::cout << std::endl;
#endif //_SHOW_THREAD_INFO
    return false;
}
 
size_t pesieve::ThreadScanner::_analyzeCallStack(IN OUT ctx_details& cDetails, OUT IN std::set<ULONGLONG> &shcCandidates)
{
    size_t processedCntr = 0;
 
    cDetails.is_managed = false;
    cDetails.is_ret_in_frame = false;
#ifdef _SHOW_THREAD_INFO
    std::cout << "\n" << "Stack frame Size: " << std::dec << cDetails.callStack.size() << "\n===\n";
#endif //_SHOW_THREAD_INFO
    for (auto itr = cDetails.callStack.rbegin(); itr != cDetails.callStack.rend() ;++itr, ++processedCntr) {
        const ULONGLONG next_return = *itr;
        if (cDetails.ret_on_stack == next_return) {
            cDetails.is_ret_in_frame = true;
        }
        
#ifdef _SHOW_THREAD_INFO
        if (symbols && symbols->IsInitialized()) {
            symbols->dumpSymbolInfo(next_return);
        }
        std::cout << "\t";
        printResolvedAddr(next_return);
#endif //_SHOW_THREAD_INFO
        bool is_curr_shc = false;
        const ScannedModule* mod = modulesInfo.findModuleContaining(next_return);
        const std::string mod_name = mod ? mod->getModName() : "";
        if (mod_name.length() == 0) {
            if (!cDetails.is_managed) {
                is_curr_shc = true;
                shcCandidates.insert(next_return);
#ifdef _SHOW_THREAD_INFO
                std::cout << "\t" << std::hex << next_return << " <=== SHELLCODE\n";
#endif //_SHOW_THREAD_INFO
            } else {
#ifdef _SHOW_THREAD_INFO
                std::cout << "\t" << std::hex << next_return << " <=== .NET JIT\n";
#endif //_SHOW_THREAD_INFO
            }
        }
        if (!is_curr_shc) {
            // store the last address, till the first called shellcode:
            cDetails.last_ret = next_return;
        }
        // check if the found shellcode is a .NET JIT:
        if (mod_name == "clr.dll" || mod_name == "coreclr.dll") {
            cDetails.is_managed = true;
#ifdef _SHOW_THREAD_INFO
            std::cout << "\t" << std::hex << next_return << " <--- .NET\n";
#endif //_SHOW_THREAD_INFO
        }
    }
#ifdef _SHOW_THREAD_INFO
    std::cout << "\n===\n";
#endif //_SHOW_THREAD_INFO
    return processedCntr;
}
 
size_t pesieve::ThreadScanner::analyzeCallStackInfo(IN OUT ThreadScanReport& my_report)
{
    const size_t analyzedCount = _analyzeCallStack(my_report.cDetails, my_report.shcCandidates);
 
    bool checkCalls = true;
    if (my_report.cDetails.is_managed) {
        checkCalls = false;
    }
    if (info.is_extended) {
        if (info.ext.wait_reason > WrQueue ||
            info.ext.wait_reason == WrFreePage || info.ext.wait_reason == WrPageIn || info.ext.wait_reason == WrPoolAllocation ||
            info.ext.wait_reason == FreePage || info.ext.wait_reason == PageIn || info.ext.wait_reason == PoolAllocation ||
            info.ext.wait_reason == Suspended)// there can be last func. vs last syscall mismatch in case of suspended threads
        {
            checkCalls = false;
        }
    }
    if (checkCalls) {
        my_report.cDetails.is_ret_as_syscall = checkReturnAddrIntegrity(my_report.cDetails.callStack, my_report);
    } 
    return analyzedCount;
}
 
size_t enum_callstack(IN ProcessSymbolsManager* symbols, const pesieve::ctx_details& cDetails, IN HANDLE hThread, IN LPVOID ctx, DWORD MachineType, std::vector<ULONGLONG>& callStack)
{
    if (!ctx || !symbols || !symbols->IsInitialized()) {
        return 0;
    }
    const size_t max_frames = 128;
 
    size_t fetched = 0;
    STACKFRAME64 frame = { 0 };
 
    frame.AddrPC.Offset = cDetails.rip;
    frame.AddrPC.Mode = AddrModeFlat;
    frame.AddrStack.Offset = cDetails.rsp;
    frame.AddrStack.Mode = AddrModeFlat;
    frame.AddrFrame.Offset = cDetails.rbp;
    frame.AddrFrame.Mode = AddrModeFlat;
 
    DWORD64 prevPc = 0;
    size_t frameCount = 0;
 
    while (symbols->RunStackWalk64(MachineType, hThread, &frame, ctx, NULL, SymFunctionTableAccess64, SymGetModuleBase64, NULL)) {
 
        DWORD64 next_return = frame.AddrPC.Offset;
        if (next_return == 0) break;
 
        if (next_return == prevPc) break;
 
        prevPc = next_return;
        if (++frameCount > max_frames) break;
 
        callStack.push_back(next_return);
        fetched++;
    }
    return fetched;
}
 
size_t pesieve::ThreadScanner::fillCallStackInfo(IN HANDLE hThread, IN const LPVOID ctx, IN OUT ctx_details& cDetails)
{
    if (!ctx ||
        !this->symbols || !this->symbols->IsInitialized())
    {
        return 0;
    }
    std::vector<ULONGLONG> callStack;
    const DWORD machineType = cDetails.is64b ? IMAGE_FILE_MACHINE_AMD64 : IMAGE_FILE_MACHINE_I386;
    const size_t fetched = enum_callstack(this->symbols, cDetails, hThread, ctx, machineType, callStack);
    if (!fetched) {
        return 0;
    }
    cDetails.callStack = callStack;
    return callStack.size();
}
 
namespace pesieve {
    template <typename PTR_T>
    bool read_return_ptr(IN HANDLE hProcess, IN OUT ctx_details& cDetails) {
        PTR_T ret_addr = 0;
        cDetails.ret_on_stack = 0;
        if (peconv::read_remote_memory(hProcess, (LPVOID)cDetails.rsp, (BYTE*)&ret_addr, sizeof(ret_addr)) == sizeof(ret_addr)) {
            cDetails.ret_on_stack = (ULONGLONG)ret_addr;
            return true;
        }
        return false;
    }
}; //namespace pesieve
 
bool pesieve::ThreadScanner::fetchNativeThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, IN OUT ctx_details& cDetails)
{
    CONTEXT ctx = { 0 };
    ctx.ContextFlags = CONTEXT_INTEGER | CONTEXT_CONTROL;
    if (!GetThreadContext(hThread, &ctx)) {
        return false;
    }
#ifdef _WIN64
    cDetails.init(true, ctx.Rip, ctx.Rsp, ctx.Rbp);
    read_return_ptr<ULONGLONG>(hProcess, cDetails);
#else
    cDetails.init(false, ctx.Eip, ctx.Esp, ctx.Ebp);
    read_return_ptr<DWORD>(hProcess, cDetails);
#endif
    fillCallStackInfo(hThread, &ctx, cDetails);
    return true;
}
 
#ifdef _WIN64
bool pesieve::ThreadScanner::fetchWow64ThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, IN OUT ctx_details& cDetails)
{
    WOW64_CONTEXT ctx = { 0 };
    ctx.ContextFlags = WOW64_CONTEXT_INTEGER | WOW64_CONTEXT_CONTROL;
    if (!pesieve::util::wow64_get_thread_context(hThread, &ctx)) {
        return false;
    }
    cDetails.init(false, ctx.Eip, ctx.Esp, ctx.Ebp);
    read_return_ptr<DWORD>(hProcess, cDetails);
    fillCallStackInfo(hThread, &ctx, cDetails);
    return true;
}
#endif
 
bool pesieve::ThreadScanner::fetchThreadCtxDetails(IN HANDLE hProcess, IN HANDLE hThread, OUT ThreadScanReport& my_report)
{
#ifdef _WIN64
    BOOL is_wow64 = FALSE;
    pesieve::util::is_process_wow64(hProcess, &is_wow64);
 
    if (is_wow64) {
        const bool native_ok = fetchNativeThreadCtxDetails(hProcess, hThread, my_report.nativeWow64Details);
        my_report.has_native_wow64_context = native_ok;
 
        const bool wow64_ok = fetchWow64ThreadCtxDetails(hProcess, hThread, my_report.cDetails);
        if (!wow64_ok && native_ok) {
            // Preserve a usable primary stack if the WOW64 guest context could not be fetched.
            // Avoid reporting the same native stack twice.
            my_report.cDetails = my_report.nativeWow64Details;
            my_report.has_native_wow64_context = false;
        }
#ifdef _DEBUG
        std::cout << std::dec << "[" << GetThreadId(hThread) << "] Retrieved WOW64 guest callstack: " << my_report.cDetails.callStack.size()
            << ", native callstack: " << my_report.nativeWow64Details.callStack.size() << std::endl;
#endif //_DEBUG
        return wow64_ok || native_ok;
    }
#endif
 
    const bool is_ok = fetchNativeThreadCtxDetails(hProcess, hThread, my_report.cDetails);
#ifdef _DEBUG
    std::cout << std::dec << "[" << GetThreadId(hThread) << "] Retrieved callstack: " << my_report.cDetails.callStack.size() << std::endl;
#endif //_DEBUG
    return is_ok;
}
 
bool pesieve::ThreadScanner::isAddrInNamedModule(const ULONGLONG addr)
{
    ScannedModule* mod = modulesInfo.findModuleContaining(addr);
    if (!mod) return false;
 
    //the module is named
    if (mod->getModName().length() > 0) {
        return true;
    }
    return false;
}
 
std::string pesieve::ThreadScanner::resolveLowLevelFuncName(IN const ULONGLONG addr, OUT OPTIONAL size_t* displacement)
{
    size_t MAX_DISP = 25;
    if (!exportsMap) {
        return "";
    }
    ScannedModule* mod = modulesInfo.findModuleContaining(addr);
    if (!mod) {
        return "";
    }
    if (!SyscallTable::isSyscallDll(mod->getModName())) {
        // not a DLL containing syscalls
        return "";
    }
    size_t _displacement = 0;
    std::string expName;
    for (size_t disp = 0; disp < MAX_DISP; disp++) {
        _displacement = disp;
        const ULONGLONG va = addr - disp;
 
        const std::set<peconv::ExportedFunc>* exp_set = exportsMap->find_exports_by_va(va);
        if (!exp_set) {
            continue; // no exports at this VA
        }
        // walk through the export candicates, and find the most suitable one:
        for (auto it1 = exp_set->begin(); it1 != exp_set->end(); ++it1) {
            const peconv::ExportedFunc& exp = *it1;
            const std::string libName = exp.libName;
            if (!SyscallTable::isSyscallDll(libName)) {
                // it is not a low-level export
                continue;
            }
            expName = exp.nameToString();
            // give preference to the functions naming syscalls:
            if (SyscallTable::isSyscallFunc(expName)) {
                if (displacement) {
                    (*displacement) = _displacement;
                }
                return expName;
            }
        }
    }
    // otherwise, return any found
    if (displacement) {
        (*displacement) = _displacement;
    }
    return expName;
}
 
std::string pesieve::ThreadScanner::resolveAddrToString(IN const ULONGLONG addr)
{
    ScannedModule* mod = modulesInfo.findModuleContaining(addr);
    ULONGLONG modBase = 0;
    if (!mod) {
        return "";
    }
    std::stringstream ss;
    modBase = mod->getStart();
    ss << mod->getModName();
 
    char SEPARATOR = '!';
    bool is_resolved = false;
    size_t disp = 0;
    if (symbols && symbols->IsInitialized()) {
        std::string funcName = symbols->funcNameFromAddr(addr, &disp);
        if (!funcName.empty()) {
            is_resolved = true;
            ss << SEPARATOR << funcName;
        }
    }
    if (!is_resolved) {
        std::string funcName = resolveLowLevelFuncName(addr, &disp);
        if (!funcName.empty()) {
            is_resolved = true;
            ss << SEPARATOR << funcName;
        }
    }
    if (is_resolved) {
        if (disp) {
            ss << "+0x" << std::hex << disp;
        }
    }
    else {
        ULONGLONG diff = addr - modBase;
        ss << "+0x" << std::hex << diff;
    }
    return ss.str();
}
 
bool pesieve::ThreadScanner::printResolvedAddr(const ULONGLONG addr)
{
    bool is_resolved = false;
    std::cout << std::hex << addr;
    ScannedModule* mod = modulesInfo.findModuleContaining(addr);
    if (mod) {
        std::cout << " : " << mod->getModName();
        is_resolved = true;
    }
    std::cout << " : " << resolveLowLevelFuncName(addr);
    std::cout << std::endl;
    return is_resolved;
}
 
void pesieve::ThreadScanner::printThreadInfo(const pesieve::util::thread_info& threadi)
{
    std::cout << std::dec << "TID: " << threadi.tid << "\n";
    std::cout << std::hex << "\tStart   : ";
    printResolvedAddr(threadi.start_addr);
 
    if (threadi.is_extended) {
        std::cout << std::hex << "\tSysStart: ";
        printResolvedAddr(threadi.ext.sys_start_addr);
        if (threadi.last_syscall != INVALID_SYSCALL) {
            std::cout << "\tLast Syscall: " << std::hex << threadi.last_syscall << " Func: " << g_SyscallTable.getSyscallName(threadi.last_syscall) << std::endl;
        }
        std::cout << "\tState: [" << ThreadScanReport::translate_thread_state(threadi.ext.state) << "]";
        if (threadi.ext.state == Waiting) {
            std::cout << " Reason: [" << ThreadScanReport::translate_wait_reason(threadi.ext.wait_reason) << "] Time: " << threadi.ext.wait_time;
        }
        std::cout << "\n";
    }
    std::cout << "\n";
}
 
bool pesieve::ThreadScanner::fillAreaStats(SuspAddrReport* report)
{
    if (!report) return false;
 
    ULONG_PTR end_va = (ULONG_PTR)report->module + report->moduleSize;
    MemPageData mem(this->processHandle, this->isReflection, (ULONG_PTR)report->module, end_va);
    if (!mem.fillInfo() || !mem.load()) {
        return false;
    }
    report->is_code = util::is_code(mem.loadedData.getData(true), mem.loadedData.getDataSize(true));
    AreaStatsCalculator calc(mem.loadedData);
    return calc.fill(report->stats, nullptr);
}
 
bool pesieve::ThreadScanner::reportSuspiciousAddr(ThreadScanReport* my_report, ULONGLONG susp_addr)
{
    SuspAddrReport* susRep = my_report->findAreaForAddress(susp_addr);
    if (!susRep) {
        MEMORY_BASIC_INFORMATION page_info = { 0 };
        if (!get_page_details(processHandle, (LPVOID)susp_addr, page_info)) {
            return false;
        }
        if (!(page_info.State & MEM_COMMIT)) {
            return false;
        }
        ULONGLONG base = (ULONGLONG)page_info.BaseAddress;
        susRep = new SuspAddrReport(base, page_info.RegionSize, page_info.AllocationProtect);
        susRep->curr_protection = page_info.Protect;
        my_report->suspAreaReports[base] = susRep;
        fillAreaStats(susRep);
    }
    if (!susRep) {
        return false;
    }
    susRep->addSuspAddr(susp_addr);
#ifdef _DEBUG
    susRep->print();
#endif //_DEBUG
    my_report->status = SCAN_SUSPICIOUS;
    return true;
}
 
// if extended info given, allow to filter out from the scan basing on the thread state and conditions
bool should_scan_context(const util::thread_info& info)
{
    if (!info.is_extended) {
        return true;
    }
    const KTHREAD_STATE state = (KTHREAD_STATE)info.ext.state;
    if (state == Ready) {
        // Detailed context walking is intentionally limited to dormant threads.
        // The start-address check still runs for Ready threads in scanRemote(),
        // but their register and stack snapshots are not stable enough to analyze.
        return false;
    }
    if (state == Terminated) {
        return false;
    }
    if (state == Waiting && info.ext.wait_reason < MaximumWaitReason) {
        return true;
    }
    return false;
}
 
bool pesieve::ThreadScanner::scanRemoteThreadCtx(HANDLE hThread, ThreadScanReport& my_report)
{
    const DWORD tid = info.tid;
    ctx_details &cDetails = my_report.cDetails;
 
    const bool is_ok = fetchThreadCtxDetails(processHandle, hThread, my_report);
    if (!pesieve::is_thread_running(hThread)) {
        return false;
    }
    if (!is_ok || !analyzeCallStackInfo(my_report)) {
        // could not fetch the thread context and information
        return false;
    }
    
    my_report.stack_ptr = cDetails.rsp;
    bool is_unnamed = !isAddrInNamedModule(cDetails.rip);
    if (is_unnamed) {
        my_report.indicators.insert(THI_SUS_IP);
        if (reportSuspiciousAddr(&my_report, cDetails.rip)) {
            my_report.indicators.insert(THI_SUS_CALLSTACK_SHC);
        }
    }
 
    for (auto itr = my_report.shcCandidates.begin(); itr != my_report.shcCandidates.end(); ++itr) {
        const ULONGLONG addr = *itr;
#ifdef _SHOW_THREAD_INFO
        std::cout << "Checking shc candidate: " << std::hex << addr << "\n";
#endif //_SHOW_THREAD_INFO
        //automatically verifies if the address is legit:
        if (reportSuspiciousAddr(&my_report, addr)) {
            my_report.indicators.insert(THI_SUS_CALLSTACK_SHC);
#ifdef _DEBUG
                std::cout << "[@]" << std::dec << tid << " : " << "Suspicious, possible shc: " << std::hex << addr << std::endl;
#endif //_DEBUG
        }
    }
 
    if (this->info.is_extended && info.ext.state == Waiting && this->info.ext.wait_reason != Suspended 
        && !cDetails.is_ret_in_frame)
    {
        const ULONGLONG ret_addr = cDetails.ret_on_stack;
        is_unnamed = !isAddrInNamedModule(ret_addr);
#ifdef _SHOW_THREAD_INFO
        std::cout << "Return addr: " << std::hex << ret_addr << "\n";
        printResolvedAddr(ret_addr);
#endif //_SHOW_THREAD_INFO
        if (is_unnamed) {
            my_report.indicators.insert(THI_SUS_RET);
            if (reportSuspiciousAddr(&my_report, (ULONGLONG)ret_addr)) {
                my_report.indicators.insert(THI_SUS_CALLSTACK_SHC);
            }
        }
    }
 
    // other indicators of stack being corrupt:
    
    if (this->info.is_extended && !my_report.cDetails.is_managed && !my_report.cDetails.is_ret_as_syscall)
    {
        my_report.indicators.insert(THI_SUS_CALLS_INTEGRITY);
        my_report.status = SCAN_SUSPICIOUS;
    }
    return (my_report.status == SCAN_SUSPICIOUS) ? true : false;
}
 
bool pesieve::ThreadScanner::filterDotNet(ThreadScanReport& my_report)
{
    if (!isManaged) {
        return false;
    }
 
    size_t dnet_common = 0; //common indicators present in .NET executables
 
    for (auto itr = my_report.indicators.begin();
        itr != my_report.indicators.end();
        ++itr)
    {
        const ThSusIndicator& indicator = *itr;
        switch (indicator) {
        case THI_SUS_CALLSTACK_SHC:
        case THI_SUS_IP:
        case THI_SUS_START:
            dnet_common++;
            break;
        default:
            break;
        }
    }
    if (dnet_common == my_report.indicators.size()) {
        my_report.status = SCAN_NOT_SUSPICIOUS;
        return true;
    }
    return false;
}
 
static int scoreArea(const SuspAddrReport& area)
{
    int score = 0;
 
    if (area.is_code) {
        score += 15;
    }
 
    if (area.stats.isFilled()) {
        if (area.stats.entropy >= ENTROPY_THRESHOLD) {
            score += 10;
        }
        if (area.stats.entropy >= ENTROPY_ENC_THRESHOLD) {
            score += 10;
        }
    }
    return score;
}
 
bool pesieve::ThreadScanner::assessIndicators(ThreadScanReport& my_report)
{
    if (my_report.status == SCAN_NOT_SUSPICIOUS) {
        return false;
    }
    if (filterDotNet(my_report)) {
        return true;
    }
    ULONGLONG best_base = 0;
    size_t best_module_size = 0;
    int best_score = 0;
    double best_entropy = 0;
    for (auto itr1 = my_report.suspAreaReports.begin(); itr1 != my_report.suspAreaReports.end(); ++itr1) {
        ULONGLONG base = itr1->first;
        const SuspAddrReport* rep = itr1->second;
        if (!rep) continue;
 
        const int score = scoreArea(*rep);
        if (score == 0) continue;
 
        if (score > best_score 
            || (score == best_score && rep->stats.entropy > best_entropy))
        {
            best_base = rep->module;
            best_module_size = rep->moduleSize;
            best_score = score;
            best_entropy = rep->stats.entropy;
        }
    }
 
    std::set< ThSusIndicator> validatedIndicators;
    for (auto itr = my_report.indicators.begin();
        itr != my_report.indicators.end();
        ++itr)
    {
        const ThSusIndicator& indicator = *itr;
        switch (indicator) {
        case THI_SUS_START:
        case THI_SUS_IP:
        case THI_SUS_RET:
        case THI_SUS_CALLSTACK_SHC:
            if (best_base) {
                validatedIndicators.insert(indicator);
            }
            break;
        default:
            validatedIndicators.insert(indicator);
            break;
        }
    }
    if (!validatedIndicators.size()) {
        my_report.status = SCAN_NOT_SUSPICIOUS;
        return true;
    }
    my_report.module = (HMODULE)best_base;
    my_report.moduleSize = best_module_size;
    return true;
}
 
void pesieve::ThreadScanner::initReport(ThreadScanReport& my_report)
{
    if (!this->info.is_extended) {
        return;
    }
    my_report.thread_state = info.ext.state;
    my_report.thread_wait_reason = info.ext.wait_reason;
    my_report.thread_wait_time = info.ext.wait_time;
    if (this->info.last_syscall != INVALID_SYSCALL) {
        my_report.lastSyscall = g_SyscallTable.getSyscallName(this->info.last_syscall);
    }
}
 
void pesieve::ThreadScanner::reportResolvedCallstack(ThreadScanReport& my_report)
{
    for (auto itr = my_report.cDetails.callStack.begin(); itr != my_report.cDetails.callStack.end(); ++itr) {
        ULONGLONG addr = *itr;
        my_report.addrToSymbol[addr] = this->resolveAddrToString(addr);
    }
    for (auto itr = my_report.nativeWow64Details.callStack.begin(); itr != my_report.nativeWow64Details.callStack.end(); ++itr) {
        ULONGLONG addr = *itr;
        my_report.addrToSymbol[addr] = this->resolveAddrToString(addr);
    }
}
 
ThreadScanReport* pesieve::ThreadScanner::scanRemote()
{
    if (GetCurrentThreadId() == info.tid) {
        return nullptr; // do not scan your own thread
    }
    ThreadScanReport* my_report = new (std::nothrow) ThreadScanReport(info.tid);
    if (!my_report) {
        return nullptr;
    }
 
    initReport(*my_report);
 
#ifdef _SHOW_THREAD_INFO
    printThreadInfo(info);
#endif // _SHOW_THREAD_INFO
    // initialize the report with the collected info:
 
    bool is_unnamed = !isAddrInNamedModule(info.start_addr);
    if (is_unnamed) {
        my_report->indicators.insert(THI_SUS_START);
        if (reportSuspiciousAddr(my_report, info.start_addr)) {
            my_report->indicators.insert(THI_SUS_CALLSTACK_SHC);
        }
    }
    if (should_scan_context(info)) {
        // proceed with detailed checks:
        HANDLE hThread = OpenThread(
            THREAD_GET_CONTEXT | THREAD_QUERY_INFORMATION | SYNCHRONIZE,
            FALSE,
            info.tid
        );
        if (hThread) {
            scanRemoteThreadCtx(hThread, *my_report);
            CloseHandle(hThread);
        }
        else {
#ifdef _DEBUG
            std::cerr << "[-] Could not OpenThread. Error: " << GetLastError() << std::endl;
#endif
        }
    }
    assessIndicators(*my_report);
    reportResolvedCallstack(*my_report);
    return my_report;
}