Filter out the patch at GuardCFCheckFunctionPointer

hasherezade / pe-sieve

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

https://hshrzd.wordpress.com/pe-sieve/

BSD 2-Clause "Simplified" License

3.01k stars 421 forks source link

Filter out the patch at GuardCFCheckFunctionPointer #27

Closed hasherezade closed 5 years ago

hasherezade commented 5 years ago

The pointer to the function at GuardCFCheckFunctionPointer is overwritten. PE-sieve detects this as a patch, creating unnecessary noise. This type of patches should be filtered out by default.

Test case:

Normaliz.dll (i.e. in the process: explorer.exe)
on Windows 8.1 64bit

Details:

The pointer to the function is located in the scanned section (.text): normaliz_table Detected patch: normaliz_patch