search

bobbystacksmash / Construct

A cross-platform Windows Script Host emulator for dynamically analysing malicious JScript programs.
GNU General Public License v3.0
8 stars 2 forks source link

VFS M/A/C/E timestamps use host time, not sandbox time #2

Open bobbystacksmash opened 6 years ago

bobbystacksmash commented 6 years ago

When creating files using the VFS, the M/A/C/E timestamps (returned via vfs.statSync("/some/path");) are using the host's timestamp, rather than the sandbox clock's time.

This needs to be updated so all MACE times returned by the VFS are modified to suit the sandbox time (which could be far in the past).