forked from cuckoosandbox/cuckoomon
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathunhook.c
More file actions
41 lines (30 loc) · 1.24 KB
/
Copy pathunhook.c
File metadata and controls
41 lines (30 loc) · 1.24 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
/*
Cuckoo Sandbox - Automated Malware Analysis
Copyright (C) 2010-2014 Cuckoo Sandbox Developers
This program is free software: you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation, either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include <stdio.h>
#include <windows.h>
int main(int argc, char *argv[])
{
FARPROC fp = GetProcAddress(
GetModuleHandle("kernel32"), "IsDebuggerPresent");
unsigned long old_protect;
VirtualProtect(fp, 0x1000, PAGE_EXECUTE_READWRITE, &old_protect);
// Corrupt the hook.
memset(fp, 0xcc, 32);
fp = GetProcAddress(GetModuleHandle("kernel32"), "CopyFileA");
VirtualProtect(fp, 0x1000, PAGE_EXECUTE_READWRITE, &old_protect);
// Restore the hook.
memcpy(fp, "\x8b\xff\x55\x8b\xec", 5);
Sleep(10000);
}