This commit is contained in:
lhodges1 2023-09-11 03:38:36 +10:00
parent fb10f9ac6f
commit b2eda89255
3 changed files with 3 additions and 57 deletions

View file

@ -68,7 +68,6 @@ OB_PREOP_CALLBACK_STATUS ObPreOpCallbackRoutine(
{
OperationInformation->Parameters->CreateHandleInformation.DesiredAccess = deny_access;
OperationInformation->Parameters->DuplicateHandleInformation.DesiredAccess = deny_access;
DEBUG_LOG( "handle stripped from: %s", process_creator_name );
/*
* These processes will constantly open handles to any open process for various reasons,
@ -79,6 +78,8 @@ OB_PREOP_CALLBACK_STATUS ObPreOpCallbackRoutine(
process_creator_name == "explorer.exe" )
goto end;
DEBUG_LOG( "handle stripped from: %s", process_creator_name );
POPEN_HANDLE_FAILURE_REPORT report = ExAllocatePool2( POOL_FLAG_NON_PAGED, sizeof( OPEN_HANDLE_FAILURE_REPORT ), REPORT_POOL_TAG );
if ( !report )

View file

@ -1,55 +0,0 @@
using Microsoft.Extensions.Logging;
using server.Types.ClientReport;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace server.Database
{
public class ClientReport
{
private ILogger _logger;
private enum ReportCodes
{
MODULE_VERIFICATION_CHECKSUM_FAILURE = 10,
PROCESS_THREAD_START_FAILURE = 20,
PAGE_PROTECTION_FAILURE = 30,
PATTERN_SCAN_FAILURE = 40,
NMI_CALLBACK_FAILURE = 50,
MODULE_VERIFICATION_FAILURE = 60,
MODULE_VERIFICATION_SUCCESS = 70
}
public ClientReport(ILogger<ClientReport> logger)
{
_logger = logger;
}
public void InsertReport<T>(T report, int reportCode)
{
if (report == null)
{
_logger.LogError("Report is null");
return;
}
switch (reportCode)
{
case (int)ReportCodes.MODULE_VERIFICATION_CHECKSUM_FAILURE:
InsertReportWithCode10((MODULE_VERIFICATION_CHECKSUM_FAILURE)Convert.ChangeType(report, typeof(MODULE_VERIFICATION_CHECKSUM_FAILURE)));
break;
default:
_logger.LogError("Unknown report code: {0}", reportCode);
break;
}
}
private void InsertReportWithCode10(MODULE_VERIFICATION_CHECKSUM_FAILURE report)
{
}
}
}

View file

@ -43,7 +43,7 @@ DWORD WINAPI Init(HINSTANCE hinstDLL)
srand( time( NULL ) );
int seed = ( rand() % 5 );
LOG_INFO( "Seed: %i", seed );
std::cout << "Seed: " << seed << std::endl;
switch ( seed )
{