forked from cuckoosandbox/cuckoomon
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathmisc.c
More file actions
129 lines (107 loc) · 4.1 KB
/
Copy pathmisc.c
File metadata and controls
129 lines (107 loc) · 4.1 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
/*
Cuckoo Sandbox - Automated Malware Analysis
Copyright (C) 2010-2013 Cuckoo Sandbox Developers
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <stdio.h>
#include <windows.h>
#include <ctype.h>
#include "ntapi.h"
#include "misc.h"
ULONG_PTR parent_process_id() // By Napalm @ NetCore2K (rohitab.com)
{
ULONG_PTR pbi[6]; ULONG ulSize = 0;
LONG (WINAPI *NtQueryInformationProcess)(HANDLE ProcessHandle,
ULONG ProcessInformationClass, PVOID ProcessInformation,
ULONG ProcessInformationLength, PULONG ReturnLength);
*(FARPROC *) &NtQueryInformationProcess = GetProcAddress(
LoadLibrary("ntdll"), "NtQueryInformationProcess");
if(NtQueryInformationProcess != NULL && NtQueryInformationProcess(
GetCurrentProcess(), 0, &pbi, sizeof(pbi), &ulSize) >= 0 &&
ulSize == sizeof(pbi)) {
return pbi[5];
}
return 0;
}
DWORD pid_from_process_handle(HANDLE process_handle)
{
PROCESS_BASIC_INFORMATION pbi = {}; ULONG ulSize;
LONG (WINAPI *NtQueryInformationProcess)(HANDLE ProcessHandle,
ULONG ProcessInformationClass, PVOID ProcessInformation,
ULONG ProcessInformationLength, PULONG ReturnLength);
*(FARPROC *) &NtQueryInformationProcess = GetProcAddress(
LoadLibrary("ntdll"), "NtQueryInformationProcess");
if(NtQueryInformationProcess != NULL && NtQueryInformationProcess(
process_handle, 0, &pbi, sizeof(pbi), &ulSize) >= 0 &&
ulSize == sizeof(pbi)) {
return pbi.UniqueProcessId;
}
return 0;
}
DWORD pid_from_thread_handle(HANDLE thread_handle)
{
THREAD_BASIC_INFORMATION tbi = {}; ULONG ulSize;
LONG (WINAPI *NtQueryInformationThread)(HANDLE ThreadHandle,
ULONG ThreadInformationClass, PVOID ThreadInformation,
ULONG ThreadInformationLength, PULONG ReturnLength);
*(FARPROC *) &NtQueryInformationThread = GetProcAddress(
LoadLibrary("ntdll"), "NtQueryInformationThread");
if(NtQueryInformationThread != NULL && NtQueryInformationThread(
thread_handle, 0, &tbi, sizeof(tbi), &ulSize) >= 0 &&
ulSize == sizeof(tbi)) {
return (DWORD) tbi.ClientId.UniqueProcess;
}
return 0;
}
DWORD random()
{
static BOOLEAN (WINAPI *pRtlGenRandom)(PVOID RandomBuffer,
ULONG RandomBufferLength);
if(pRtlGenRandom == NULL) {
*(FARPROC *) &pRtlGenRandom = GetProcAddress(
GetModuleHandleW(L"advapi32"), "SystemFunction036");
}
DWORD ret;
return pRtlGenRandom(&ret, sizeof(ret)) ? ret : rand();
}
DWORD randint(DWORD min, DWORD max)
{
return min + (random() % (max - min + 1));
}
BOOL is_directory_objattr(const OBJECT_ATTRIBUTES *obj)
{
static NTSTATUS (WINAPI *pNtQueryAttributesFile)(
_In_ const OBJECT_ATTRIBUTES *ObjectAttributes,
_Out_ PFILE_BASIC_INFORMATION FileInformation
);
if(pNtQueryAttributesFile == NULL) {
*(FARPROC *) &pNtQueryAttributesFile = GetProcAddress(
GetModuleHandle("ntdll"), "NtQueryAttributesFile");
}
FILE_BASIC_INFORMATION basic_information;
if(NT_SUCCESS(pNtQueryAttributesFile(obj, &basic_information))) {
return basic_information.FileAttributes & FILE_ATTRIBUTE_DIRECTORY;
}
return FALSE;
}
int path_compare(const wchar_t *a, const wchar_t *b, int len)
{
for (; len != 0; len--, a++, b++) {
if((*a == '/' || *a == '\\') && (*b == '/' || *b == '\\')) {
continue;
}
if(towlower(*a) != towlower(*b)) {
return towlower(*a) < towlower(*b) ? -1 : 1;
}
}
return 0;
}