Пример #1
0
        public FormInterface()
        {
            InitializeComponent();
            UI = this;

            //Initialize process creation watcher
            procWatcher = new ProcessWatcher();
        }
Пример #2
0
 public HookManager(NktProcess process)
 {
     this.process = process;
     this.ID      = process.Id;
     this.UI      = FormInterface.GetInstance();
     this.pw      = ProcessWatcher.GetInstance();
     intelligence = new IntelliMod(process);
 }
Пример #3
0
 private void WhitelistManager_FormClosed(object sender, FormClosedEventArgs e)
 {
     FormInterface.GetInstance().whiteListButton.Enabled = true;
 }
Пример #4
0
        //Installs the required hooks
        public void InstallHooks()
        {
            try
            {
                Debug.WriteLine("Installing hooks in " + process.Name);

                //Install each function hook


                InstallFunctionHook("advapi32.dll!RegCreateKeyExA");
                InstallFunctionHook("advapi32.dll!RegCreateKeyExW");

                InstallFunctionHook("advapi32.dll!CryptAcquireContextA");
                InstallFunctionHook("advapi32.dll!CryptAcquireContextW");

                InstallFunctionHook("advapi32.dll!CryptImportKey");

                InstallFunctionHook("advapi32.dll!CryptGenKey");

                InstallFunctionHook("advapi32.dll!CryptEncrypt");

                InstallFunctionHook("advapi32.dll!CryptExportKey");

                InstallFunctionHook("advapi32.dll!CryptDestroyKey");

                InstallFunctionHook("kernel32.dll!GetComputerNameA");
                InstallFunctionHook("kernel32.dll!GetComputerNameW");
                InstallFunctionHook("kernel32.dll!GetComputerNameExA");
                InstallFunctionHook("kernel32.dll!GetComputerNameExW");

                InstallFunctionHook("kernel32.dll!SuspendThread");

                InstallFunctionHook("kernel32.dll!CreateRemoteThread");
                InstallFunctionHook("kernel32.dll!CreateRemoteThreadEx");

                InstallFunctionHook("kernel32.dll!CreateFileA");
                InstallFunctionHook("kernel32.dll!CreateFileW");

                InstallFunctionHook("kernel32.dll!FindFirstFileA");
                InstallFunctionHook("kernel32.dll!FindFirstFileW");
                InstallFunctionHook("kernel32.dll!FindFirstFileExA");
                InstallFunctionHook("kernel32.dll!FindFirstFileExW");

                //Consider adding WriteFileEx
                InstallFunctionHook("kernel32.dll!WriteFile");

                InstallFunctionHook("kernel32.dll!DeleteFileA");
                InstallFunctionHook("kernel32.dll!DeleteFileW");

                InstallFunctionHook("kernel32.dll!WinExec");

                InstallFunctionHook("kernel32.dll!CreateProcessA");
                InstallFunctionHook("kernel32.dll!CreateProcessW");



                //Display the new process on the UI
                string   text = process.Name + ' ' + process.PlatformBits;
                string[] row  = { process.Id.ToString() };
                FormInterface.listViewAddItemRange(UI.processListView, text, row, process.Id.ToString());

                Debug.WriteLine("Success");
            }
            catch (NullReferenceException)
            {
                Debug.WriteLine("Hooking failed: Process no longer exists");
            }
        }