diff --git a/SbieTestConsole/ConsoleEntry.cpp b/SbieTestConsole/ConsoleEntry.cpp index 0bfba10..86b30fb 100644 --- a/SbieTestConsole/ConsoleEntry.cpp +++ b/SbieTestConsole/ConsoleEntry.cpp @@ -1,9 +1,47 @@ #include "MINT.h" #include +#include +#include +#include char NameBuffer[0x1000] = {}; PUNICODE_STRING MemoryMappedFilename = reinterpret_cast(NameBuffer); +int PrintModules(DWORD processID) +{ + HMODULE hMods[1024]; + HANDLE hProcess; + DWORD cbNeeded; + unsigned int i; + + printf("\nProcess ID: %u\n", processID); + + hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | + PROCESS_VM_READ, + FALSE, processID); + if (NULL == hProcess) + return 1; + + if (EnumProcessModules(hProcess, hMods, sizeof(hMods), &cbNeeded)) + { + for (i = 0; i < (cbNeeded / sizeof(HMODULE)); i++) + { + TCHAR szModName[MAX_PATH]; + + if (GetModuleFileNameEx(hProcess, hMods[i], szModName, + sizeof(szModName) / sizeof(TCHAR))) + { + + _tprintf(TEXT("\t%s (0x%08X)\n"), szModName, hMods[i]); + } + } + } + + CloseHandle(hProcess); + + return 0; +} + VOID CheckSandboxieByGetModuleHandle() { printf("Handle of SbieHide.dll is 0x%016llX\n", reinterpret_cast(GetModuleHandleA("SbieHide.dll"))); printf("Handle of SbieDll.dll is 0x%016llX\n", reinterpret_cast(GetModuleHandleA("SbieDll.dll"))); @@ -20,7 +58,7 @@ VOID CheckSandboxieByQueryVirtualMemoryMappedFilename() { } Status = NtQueryVirtualMemory(NtCurrentProcess(), GetModuleHandleA("SbieHide.dll"), MemoryMappedFilenameInformation, NameBuffer, 0x1000, &ReturnedLength); - + if (Status != STATUS_ACCESS_DENIED) { printf("Sbiedll found! check hook\n"); } @@ -32,7 +70,7 @@ VOID CheckSandboxieByQueryVirtualMemoryMappedFilename() { int main() { CheckSandboxieByGetModuleHandle(); CheckSandboxieByQueryVirtualMemoryMappedFilename(); - + PrintModules(reinterpret_cast(NtCurrentProcessId())); getchar(); return 0; } \ No newline at end of file