noury/mirror-ac
1
0
Fork 0
mirror of https://github.com/donnaskiez/ac.git synced 2024-11-21 22:24:08 +01:00
Code Issues Projects Releases Packages Wiki Activity

e

Browse source
This commit is contained in:
lhodges1 2023-08-30 21:27:23 +10:00
parent 67a8bdf170
commit fef5fdc01c
3 changed files with 20 additions and 11 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
user/km/kmanager.cpp
View file

@ -34,4 +34,9 @@ void kernelmode::KManager::EnumerateHandleTables()
void kernelmode::KManager::RequestModuleExecutableRegionsForIntegrityCheck()
{
this->thread_pool->QueueJob( [ this ]() { this->driver_interface->RequestModuleExecutableRegions(); } );
}
}
VOID kernelmode::KManager::ScanPoolsForUnlinkedProcesses()
{
this->thread_pool->QueueJob( [ this ]() { this->driver_interface->ScanForUnlinkedProcess(); } );
}

1
user/km/kmanager.h
View file

@ -23,6 +23,7 @@ namespace kernelmode
VOID DetectSystemVirtualization();
VOID EnumerateHandleTables();
VOID RequestModuleExecutableRegionsForIntegrityCheck();
VOID ScanPoolsForUnlinkedProcesses();
};
}

23
user/main.cpp
View file

@ -28,18 +28,21 @@ DWORD WINAPI Init(HINSTANCE hinstDLL)
usermode::UManager umanager( thread_pool, report_interface );
kernelmode::KManager kmanager( driver_name, thread_pool, report_interface);
//kmanager.MonitorCallbackReports();
//kmanager.RunNmiCallbacks();
//kmanager.VerifySystemModules();
kmanager.RequestModuleExecutableRegionsForIntegrityCheck();
//kmanager.MonitorCallbackReports();
//umanager.ValidateProcessModules();
//umanager.ValidateProcessMemory();
while ( !GetAsyncKeyState( VK_DELETE ) )
{
std::this_thread::sleep_for( std::chrono::milliseconds( 100 ) );
kmanager.MonitorCallbackReports();
kmanager.RunNmiCallbacks();
kmanager.VerifySystemModules();
kmanager.RequestModuleExecutableRegionsForIntegrityCheck();
kmanager.MonitorCallbackReports();
kmanager.DetectSystemVirtualization();
kmanager.ScanPoolsForUnlinkedProcesses();
umanager.ValidateProcessModules();
umanager.ValidateProcessMemory();
umanager.ValidateProcessThreads();
std::this_thread::sleep_for( std::chrono::milliseconds( 10000 ) );
}
fclose( stdout );