search

brad-sp / cuckoo-modified

Modified edition of cuckoo
271 stars 100 forks source link

self-modifying office documents would make human.py stuck #115

Closed MerX1030 closed 9 years ago

MerX1030 commented 9 years ago

Self-modifying office documents such as bartallex would cause Microsoft Word to pop-up a "Save Changes" prompt when you try to close it. Thus, causing a stuck in the "Save Changes" prompt.

I did some testing and found out its because the USER32.SendMessageW call would wait for the closing of the main Microsoft Word window. But since nothing would click the buttons in "Save changes" prompt because the code the was supposed to do that is after the Microsoft Word window is closed, it remains stuck. The workaround I did was to separate the thread for clicking the buttons so that it wouldn't have to wait for the closure of Microsoft Word.

Here's sample I used for testing: MD5 933f638a4e5a6df49301a6954f821c0b SHA1 a277bda2068ed8cdbba5fc998baa29de6a22f3cc SHA256 1d3ca0a972e788bd6e693d4a08ea80d228ebe4b4a56a3ff47cfd025bfd607999

brad-sp commented 9 years ago

Sounds good -- could you send me a PR with that change?

Thanks!

brad-sp commented 9 years ago

Thanks, applied!

brad-sp commented 9 years ago

I'm continuing to see a problem with that sample and some others -- it appears that we're not seeing the buttons at all for some reason. EnumWindows/EnumChildWindows simply aren't listing them in this case.

brad-sp commented 9 years ago

So the problem is that the buttons don't "exist" in a window sense. There's only a NUIDialog window with a single child of a NetUIHWND window. I'll see if we can at least simulate a alt+s key sequence to the NetUIHWND window we find.

brad-sp commented 9 years ago

Latest commit should fix this for good.