diff --git a/.gitignore b/.gitignore index 74b42e6..31e54a5 100644 --- a/.gitignore +++ b/.gitignore @@ -12,3 +12,5 @@ bson/Release objects Release tests/logging-test.* +*.suo +*.opendb diff --git a/bson/bson.vcxproj b/bson/bson.vcxproj index 1f3051b..28fadd7 100644 --- a/bson/bson.vcxproj +++ b/bson/bson.vcxproj @@ -1,5 +1,5 @@  - + Debug @@ -26,26 +26,26 @@ StaticLibrary true - v120 + v140 MultiByte StaticLibrary true - v120 + v140 MultiByte StaticLibrary false - v120_xp + v140_xp MultiByte true StaticLibrary false - v120_xp + v140_xp MultiByte true diff --git a/config.c b/config.c index c239b4c..0e534f9 100644 --- a/config.c +++ b/config.c @@ -67,8 +67,10 @@ int read_config(void) } else if (!strcmp(key, "results")) { strncpy(g_config.results, value, - ARRAYSIZE(g_config.results)); - } + ARRAYSIZE(g_config.results) - 1); + for (i = 0; i < ARRAYSIZE(g_config.results); i++) + g_config.w_results[i] = (wchar_t)(unsigned short)g_config.results[i]; + } else if (!strcmp(key, "file-of-interest")) { unsigned int len = (unsigned int)strlen(value); if (len > 1) { @@ -110,13 +112,12 @@ int read_config(void) } else if (!strcmp(key, "analyzer")) { strncpy(g_config.analyzer, value, - ARRAYSIZE(g_config.analyzer)-2); - strcat(g_config.analyzer, "\\"); + ARRAYSIZE(g_config.analyzer)-1); for (i = 0; i < ARRAYSIZE(g_config.analyzer); i++) g_config.w_analyzer[i] = (wchar_t)(unsigned short)g_config.analyzer[i]; wcscpy(g_config.dllpath, g_config.w_analyzer); - if (wcslen(g_config.dllpath) < ARRAYSIZE(g_config.dllpath) - 4) - wcscat(g_config.dllpath, L"dll\\"); + if (wcslen(g_config.dllpath) < ARRAYSIZE(g_config.dllpath) - 5) + wcscat(g_config.dllpath, L"\\dll\\"); } else if(!strcmp(key, "shutdown-mutex")) { strncpy(g_config.shutdown_mutex, value, diff --git a/config.h b/config.h index cac529c..750fbc6 100644 --- a/config.h +++ b/config.h @@ -25,7 +25,10 @@ struct _g_config { // results directory, has to be hidden char results[MAX_PATH]; - // analyzer directory, has to be hidden + // results directory, has to be hidden + wchar_t w_results[MAX_PATH]; + + // analyzer directory, has to be hidden char analyzer[MAX_PATH]; // analyzer directory, has to be hidden diff --git a/hook_file.c b/hook_file.c index 2f5e88b..125ccf5 100644 --- a/hook_file.c +++ b/hook_file.c @@ -747,8 +747,11 @@ HOOKDEF(HANDLE, WINAPI, FindFirstFileExA, HANDLE ret = Old_FindFirstFileExA(lpFileName, fInfoLevelId, lpFindFileData, fSearchOp, lpSearchFilter, dwAdditionalFlags); - // XXX: change me if we ever move the analyzer dir out of the root directory - if (!g_config.no_stealth && ret != INVALID_HANDLE_VALUE && !stricmp(((PWIN32_FIND_DATAA)lpFindFileData)->cFileName, g_config.analyzer + 3)) { + // XXX: change me if we ever move the analyzer or results dir out of the root directory + if (!g_config.no_stealth && ret != INVALID_HANDLE_VALUE && + (!stricmp(((PWIN32_FIND_DATAA)lpFindFileData)->cFileName, g_config.analyzer + 3) || + !stricmp(((PWIN32_FIND_DATAA)lpFindFileData)->cFileName, g_config.results + 3)) + ) { lasterror_t lasterror; lasterror.Win32Error = 0x00000002; @@ -788,7 +791,10 @@ HOOKDEF(HANDLE, WINAPI, FindFirstFileExW, lpFindFileData, fSearchOp, lpSearchFilter, dwAdditionalFlags); // XXX: change me if we ever move the analyzer dir out of the root directory - if (!g_config.no_stealth && ret != INVALID_HANDLE_VALUE && !wcsicmp(((PWIN32_FIND_DATAW)lpFindFileData)->cFileName, g_config.w_analyzer + 3)) { + if (!g_config.no_stealth && ret != INVALID_HANDLE_VALUE && + (!wcsicmp(((PWIN32_FIND_DATAW)lpFindFileData)->cFileName, g_config.w_analyzer + 3) || + !wcsicmp(((PWIN32_FIND_DATAW)lpFindFileData)->cFileName, g_config.w_results + 3)) + ) { lasterror_t lasterror; lasterror.Win32Error = 0x00000002; @@ -821,7 +827,8 @@ HOOKDEF(BOOL, WINAPI, FindNextFileW, ) { BOOL ret = Old_FindNextFileW(hFindFile, lpFindFileData); - if (!g_config.no_stealth && ret && !wcsicmp(lpFindFileData->cFileName, g_config.w_analyzer + 3)) { + while (!g_config.no_stealth && ret && (!wcsicmp(lpFindFileData->cFileName, g_config.w_analyzer + 3) || + !wcsicmp(lpFindFileData->cFileName, g_config.w_results + 3))) { ret = Old_FindNextFileW(hFindFile, lpFindFileData); } diff --git a/loader/loader/loader.vcxproj b/loader/loader/loader.vcxproj index fd9a004..adc76d1 100644 --- a/loader/loader/loader.vcxproj +++ b/loader/loader/loader.vcxproj @@ -1,5 +1,5 @@  - + Debug @@ -27,26 +27,26 @@ Application true - v120_xp + v140_xp Unicode Application true - v120_xp + v140_xp Unicode Application false - v120_xp + v140_xp true Unicode Application false - v120_xp + v140_xp true Unicode