bobbystacksmash / Construct

A cross-platform Windows Script Host emulator for dynamically analysing malicious JScript programs.
GNU General Public License v3.0
8 stars 2 forks source link

The file currently being inspected should be mapped in to VFS before being run #7

Closed bobbystacksmash closed 6 years ago

bobbystacksmash commented 6 years ago

It's possible that a file may wish to read itself during execution. We need to ensure that any file we run is available somewhere on the filesystem. In the beginning, a sensible default is the homedir (C:\Users\Construct\<name_of_script>.js). We can easily add the file via the vfs during startup.

Something else to think about: make sure the contents of the file is the original contents, not the instrumented source. It may be that self-inspection is line-offset based rather than something else like a string-search offset.

The VFS plugin hooks will provide the ability to intercept reads/writes from the script, so there's a work around if we do need to do something fancy with the file contents.