From c871f84df599ed866ddabb613e42a35e57f9e244 Mon Sep 17 00:00:00 2001 From: ar13l Date: Fri, 2 Sep 2016 11:10:25 +0300 Subject: [PATCH] Cuckoo: EXCEPTION_MAXCOUNT adopted --- SandboxEvasion/cuckoo.cpp | 2 +- SandboxEvasion/cuckoo.h | 2 +- SandboxEvasion/helper.cpp | 4 ---- 3 files changed, 2 insertions(+), 6 deletions(-) diff --git a/SandboxEvasion/cuckoo.cpp b/SandboxEvasion/cuckoo.cpp index 9a6811e..5f6bfb0 100644 --- a/SandboxEvasion/cuckoo.cpp +++ b/SandboxEvasion/cuckoo.cpp @@ -1188,7 +1188,7 @@ bool Cuckoo::CheckExceptionsNumberMaster() const { CloseHandle(pi.hThread); CloseHandle(pi.hProcess); - fprintf(stdout, "{+} Exceptions process exit code: 0x%x\n", ec); + // fprintf(stdout, "{+} Exceptions process exit code: 0x%x\n", ec); // check if exit code is a specific one return ec == SLAVE_EXIT_CODE_FAILED; diff --git a/SandboxEvasion/cuckoo.h b/SandboxEvasion/cuckoo.h index 53252f5..665c11d 100644 --- a/SandboxEvasion/cuckoo.h +++ b/SandboxEvasion/cuckoo.h @@ -12,7 +12,7 @@ namespace SandboxEvasion { enum class ProcessCheckHooksFunc { GET_MODULE_HANDLE_W, GET_PROC_ADDRESS, OPEN_EVENT_W, SET_EVENT, CLOSE_HANDLE, EXIT_PROCESS, READ_PROCESS_MEMORY, GET_CURRENT_PROCESS, ZW_DELAY_EXECUTION, ZW_CREATE_PROCESS, ZW_CREATE_THREAD, ZW_OPEN_THREAD, Count }; const uint32_t MAGIC_WHTL_PROC_ARGS = 0xBAADF00D; const unsigned char I_magic[] = { 0x0F, 0x0B, 0x0F, 0x0B, 0xCC, 0xCC, 0xCC, 0xCC, 0x0F, 0x0B, 0x0F, 0x0B, 0xCC, 0xCC, 0xCC, 0xCC }; - const uint32_t EXCEPTION_MAXCOUNT = 0x10000; + const uint32_t EXCEPTION_MAXCOUNT = 1024 + 50; const wchar_t task_pipe_name[] = L"\\\\.\\pipe\\task_sched_se"; const uint32_t task_proc_wait_timeout = 2500; diff --git a/SandboxEvasion/helper.cpp b/SandboxEvasion/helper.cpp index 12df09b..08c9952 100644 --- a/SandboxEvasion/helper.cpp +++ b/SandboxEvasion/helper.cpp @@ -2038,10 +2038,6 @@ bool get_drive_print_names(std::list &disks) { i = 0; do {} while (get_disk_friendly_name(hDevs, i++, disks)); - for (auto & d : disks) { - printf("%s\n", d.c_str()); - } - SetupDiDestroyDeviceInfoList(hDevs); return true; }