Comments (1)
The purpose of this was to reduce noise as I recall. I think there are quite a few regions which have execute privileges, but are really just data regions. The assumption this dumping logic works on here is that if it's real shellcode/executable code then it will refer to at least 2 exports within the process (the comment as you pointed out is incorrect, I must have originally had it at 5 then adjusted it to be looser of just needing 2 at a later time without editing the comment). This is usually true but might not always be true if they've carefully obfuscated their shellcode to not refer to any APIs, but it seemed at the time to be a good way to deal with the noisy data regions with executable privileges.
RE: But my real question is why it needs this condition to dump codechunk, can i just ignore this condition?
If you're OK with the noise of dumping lots of data regions, it's OK to remove this condition.
One challenge with this is that the known-module clean hash computation for loose code-chunks is based on the reconstructed import structure of the code-codechunk as well as section size. If there are 0 imports for example, the clean hash will entirely be defined by the size of the region - which may cause it to still miss dumping a lot of these regions:
Line 254 in 07782e5
One way to fix this might be to also hash the first few distinct bytes of the section for example, or maybe it should be hashed with the process name. Maybe it'd add these two hashes into the algorithm if there are less than 2 imports referenced, that way it'd be backwards compatible?
If you'd like to make a pull request adding this as an option, I'd love to review and integrate into process dump!
from process-dump.
Related Issues (20)
- Clean database add by folder can't have trailing slash
- Latest build of Process Dump close monitor is crashing csrss.exe HOT 1
- All zeros in some regions HOT 4
- 64bit ImageBase being truncated to 32bit HOT 3
- can not dump some 32 bit .net exe file which run as 64 bit jit code,like Reflector.exe HOT 2
- Large section size HOT 2
- Walkthrough for restoring OEP and IAT for dumped executables? HOT 11
- .Net dump HOT 1
- Req: -closemon2: detection for new modules loaded after loading pd64.exe -closemon HOT 5
- Clean database generation failing at %USERPROFILE% adding HOT 1
- Compiler error: syntax error: identifier 'pe_hash_database' HOT 1
- Spotify.exe (and some other apps) dumping creating huge dump of main exe HOT 2
- Suggestion HOT 6
- Close monitor mode dumps codechunks from ProcessDump injections
- Increase frequency of multi-threaded queue status prints HOT 1
- Windows XP 32bit process dump not dumping modules HOT 2
- Repeated allocation failure error for close monitor hook HOT 1
- Hook CreateProcess so that short-lived processes are dumped on close
- Stop ProcessDump from hooking it's own processes NtProcessTermination HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from process-dump.