Future/hypervisor
1
0
Fork 0
mirror of https://github.com/momo5502/hypervisor.git synced 2025-04-19 13:42:55 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Finish access watching

Browse Source
This commit is contained in:
momo5502 2022-05-16 12:17:11 +02:00
parent f37a919f77
commit 7c1e10d164
2 changed files with 72 additions and 63 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
src/driver/ept.cpp
View File

@ -178,7 +178,7 @@ namespace vmx
void ept::record_access(const uint64_t rip)
{
for (unsigned long long& access_record : this->access_records)
for (auto& access_record : this->access_records)
{
if (access_record == 0)
{

19
src/runner/main.cpp
View File

@ -185,12 +185,13 @@ std::vector<uint64_t> query_records(const driver_device& driver_device, const si
return result;
}
void report_records(const std::atomic_bool& flag, const driver_device& driver_device, const uint32_t pid, const HMODULE target_module, const std::vector<std::pair<size_t, size_t>>& regions)
void report_records(const std::atomic_bool& flag, const driver_device& driver_device, const uint32_t pid,
const HMODULE target_module, const std::vector<std::pair<size_t, size_t>>& regions)
{
std::set<uint64_t> access_addresses{};
int i = 0;
while (flag)
while (!flag)
{
std::this_thread::sleep_for(std::chrono::seconds(1));
const auto new_records = query_records(driver_device, access_addresses.size());
@ -211,6 +212,7 @@ void report_records(const std::atomic_bool& flag, const driver_device& driver_de
}
void unsafe_main(const int /*argc*/, char* /*argv*/[])
{
{
const auto driver_file = extract_driver();
@ -229,7 +231,7 @@ void unsafe_main(const int /*argc*/, char* /*argv*/[])
printf("Reading modules...\n");
const auto modules = process::get_modules(proc);
printf("Found %zu modules\n", modules.size());
printf("Found %zu modules:\n", modules.size());
std::vector<std::string> module_files{};
module_files.reserve(modules.size());
@ -264,6 +266,7 @@ void unsafe_main(const int /*argc*/, char* /*argv*/[])
printf("Analyzing %s...\n", file.data());
const auto regions = find_executable_regions(file);
printf("Executable regions:\n");
for (const auto& region : regions)
{
printf("%p - %zu\n", module_base + region.first, region.second);
@ -274,13 +277,19 @@ void unsafe_main(const int /*argc*/, char* /*argv*/[])
std::atomic_bool terminate{false};
std::thread t([&]()
{
printf("\nWatching access:\n");
report_records(terminate, driver_device, pid, target_module, regions);
});
_getch();
terminate = true;
t.join();
}
printf("\nWatching stopped.\n");
_getch();
return;
@ -315,13 +324,13 @@ void unsafe_main(const int /*argc*/, char* /*argv*/[])
patch_data(driver_device, pid, 0x52512C, data3, sizeof(data3));
*/
printf("Press any key to disable all hooks!\n");
/*printf("Press any key to disable all hooks!\n");
(void)_getch();
remove_hooks(driver_device);
printf("Press any key to exit!\n");
(void)_getch();
(void)_getch();*/
}
int main(const int argc, char* argv[])