Future/hypervisor
1
0
Fork 0
mirror of https://github.com/momo5502/hypervisor.git synced 2025-04-19 21:52:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Finish access watching

Browse Source
This commit is contained in:
momo5502 2022-05-16 12:17:11 +02:00
parent f37a919f77
commit 7c1e10d164
2 changed files with 72 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/driver/ept.cpp
View File

@ -178,7 +178,7 @@ namespace vmx
void ept::record_access(const uint64_t rip) void ept::record_access(const uint64_t rip)
{ {
for (unsigned long long& access_record : this->access_records) for (auto& access_record : this->access_records)
{ {
if (access_record == 0) if (access_record == 0)
{ {

133
src/runner/main.cpp
View File

@ -185,12 +185,13 @@ std::vector<uint64_t> query_records(const driver_device& driver_device, const si
return result; return result;
} }
void report_records(const std::atomic_bool& flag, const driver_device& driver_device, const uint32_t pid, const HMODULE target_module, const std::vector<std::pair<size_t, size_t>>& regions) void report_records(const std::atomic_bool& flag, const driver_device& driver_device, const uint32_t pid,
const HMODULE target_module, const std::vector<std::pair<size_t, size_t>>& regions)
{ {
std::set<uint64_t> access_addresses{}; std::set<uint64_t> access_addresses{};
int i = 0; int i = 0;
while (flag) while (!flag)
{ {
std::this_thread::sleep_for(std::chrono::seconds(1)); std::this_thread::sleep_for(std::chrono::seconds(1));
const auto new_records = query_records(driver_device, access_addresses.size()); const auto new_records = query_records(driver_device, access_addresses.size());
@ -203,7 +204,7 @@ void report_records(const std::atomic_bool& flag, const driver_device& driver_de
} }
} }
if((++i) % 5 == 0) if ((++i) % 5 == 0)
{ {
watch_regions(driver_device, pid, target_module, regions); watch_regions(driver_device, pid, target_module, regions);
} }
@ -212,76 +213,84 @@ void report_records(const std::atomic_bool& flag, const driver_device& driver_de
void unsafe_main(const int /*argc*/, char* /*argv*/[]) void unsafe_main(const int /*argc*/, char* /*argv*/[])
{ {
const auto driver_file = extract_driver();
driver driver{driver_file, "MomoLul"};
const driver_device driver_device{R"(\\.\HelloDev)"};
const auto pid = get_process_id();
printf("Opening process...\n");
auto proc = process::open(pid, PROCESS_QUERY_INFORMATION | PROCESS_VM_READ);
if (!proc)
{ {
printf("Failed to open process...\n"); const auto driver_file = extract_driver();
return;
}
printf("Reading modules...\n"); driver driver{driver_file, "MomoLul"};
const auto modules = process::get_modules(proc); const driver_device driver_device{R"(\\.\HelloDev)"};
printf("Found %zu modules\n", modules.size());
std::vector<std::string> module_files{}; const auto pid = get_process_id();
module_files.reserve(modules.size());
int i = 0; printf("Opening process...\n");
for (const auto& module : modules) auto proc = process::open(pid, PROCESS_QUERY_INFORMATION | PROCESS_VM_READ);
{ if (!proc)
auto name = process::get_module_filename(proc, module); {
printf("(%i)\t%p: %s\n", i++, static_cast<void*>(module), name.data()); printf("Failed to open process...\n");
module_files.emplace_back(std::move(name)); return;
} }
// We don't need this anymore printf("Reading modules...\n");
proc = {}; const auto modules = process::get_modules(proc);
printf("Found %zu modules:\n", modules.size());
std::string module_str{}; std::vector<std::string> module_files{};
printf("\nPlease enter the module number: "); module_files.reserve(modules.size());
std::getline(std::cin, module_str);
int i = 0;
for (const auto& module : modules)
{
auto name = process::get_module_filename(proc, module);
printf("(%i)\t%p: %s\n", i++, static_cast<void*>(module), name.data());
module_files.emplace_back(std::move(name));
}
// We don't need this anymore
proc = {};
std::string module_str{};
printf("\nPlease enter the module number: ");
std::getline(std::cin, module_str);
const auto module_num = atoi(module_str.data());
if (module_num < 0 || static_cast<size_t>(module_num) >= modules.size())
{
printf("Invalid module num\n");
_getch();
return;
}
const auto target_module = modules[module_num];
const auto module_base = reinterpret_cast<uint8_t*>(target_module);
const auto& file = module_files[module_num];
printf("Analyzing %s...\n", file.data());
const auto regions = find_executable_regions(file);
printf("Executable regions:\n");
for (const auto& region : regions)
{
printf("%p - %zu\n", module_base + region.first, region.second);
}
watch_regions(driver_device, pid, target_module, regions);
std::atomic_bool terminate{false};
std::thread t([&]()
{
printf("\nWatching access:\n");
report_records(terminate, driver_device, pid, target_module, regions);
});
const auto module_num = atoi(module_str.data());
if (module_num < 0 || static_cast<size_t>(module_num) >= modules.size())
{
printf("Invalid module num\n");
_getch(); _getch();
return;
terminate = true;
t.join();
} }
const auto target_module = modules[module_num]; printf("\nWatching stopped.\n");
const auto module_base = reinterpret_cast<uint8_t*>(target_module);
const auto& file = module_files[module_num];
printf("Analyzing %s...\n", file.data());
const auto regions = find_executable_regions(file);
for (const auto& region : regions)
{
printf("%p - %zu\n", module_base + region.first, region.second);
}
watch_regions(driver_device, pid, target_module, regions);
std::atomic_bool terminate{false};
std::thread t([&]()
{
report_records(terminate, driver_device, pid, target_module, regions);
});
_getch(); _getch();
terminate = true;
t.join();
return; return;
/* /*
@ -315,13 +324,13 @@ void unsafe_main(const int /*argc*/, char* /*argv*/[])
patch_data(driver_device, pid, 0x52512C, data3, sizeof(data3)); patch_data(driver_device, pid, 0x52512C, data3, sizeof(data3));
*/ */
printf("Press any key to disable all hooks!\n"); /*printf("Press any key to disable all hooks!\n");
(void)_getch(); (void)_getch();
remove_hooks(driver_device); remove_hooks(driver_device);
printf("Press any key to exit!\n"); printf("Press any key to exit!\n");
(void)_getch(); (void)_getch();*/
} }
int main(const int argc, char* argv[]) int main(const int argc, char* argv[])