From 216d0e2f8807e9446cab5d0e01335aee49f3c07b Mon Sep 17 00:00:00 2001
From: hasherezade <hasherezade@gmail.com>
Date: Wed, 11 Sep 2024 18:39:40 -0700
Subject: [PATCH] [BUGFIX] In ThreadScanner: change rules for 32-bit systems

---
 scanners/thread_scanner.cpp | 18 ++++++++++++++----
 utils/process_util.cpp      | 13 +++++++++++++
 utils/process_util.h        |  2 ++
 3 files changed, 29 insertions(+), 4 deletions(-)

diff --git a/scanners/thread_scanner.cpp b/scanners/thread_scanner.cpp
index 85084c8c4..5a5ffb86b 100644
--- a/scanners/thread_scanner.cpp
+++ b/scanners/thread_scanner.cpp
@@ -51,6 +51,7 @@ namespace pesieve {
 		}
 		return true;
 	}
+
 };
 
 bool get_page_details(HANDLE processHandle, LPVOID start_va, MEMORY_BASIC_INFORMATION& page_info)
@@ -178,13 +179,22 @@ bool pesieve::ThreadScanner::checkReturnAddrIntegrity(IN const std::vector<ULONG
 
 	const ULONGLONG lastCalled = *callStack.begin();
 	const std::string lastFuncCalled = symbols->funcNameFromAddr(lastCalled);
-
-	if (SyscallTable::isSameSyscallFunc(syscallFuncName, lastFuncCalled)) {
+	if (callStack.size() == 1) {
+		if (this->info.ext.wait_reason == Suspended && lastFuncCalled == "RtlUserThreadStart" && this->info.last_syscall == 0) {
+			return true; //normal for suspended threads
+		}
+		return false; // otherwise it is an anomaly
+	}
+#ifndef _WIN64
+	static bool isWow64 = util::is_current_wow64();
+	if (!isWow64 && lastFuncCalled == "KiFastSystemCallRet") {
 		return true;
 	}
-	if (this->info.ext.wait_reason == Suspended && callStack.size() == 1 && lastFuncCalled == "RtlUserThreadStart" && this->info.last_syscall == 0) {
-		return true; //normal for suspended threads
+#endif
+	if (SyscallTable::isSameSyscallFunc(syscallFuncName, lastFuncCalled)) {
+		return true;
 	}
+
 	if (this->info.ext.wait_reason == UserRequest && syscallFuncName == "NtWaitForSingleObject") {
 		if (lastFuncCalled.rfind("NtQuery", 0) == 0 || lastFuncCalled.rfind("ZwQuery", 0) == 0) {
 			return true;
diff --git a/utils/process_util.cpp b/utils/process_util.cpp
index 4fc18b542..f18d696bc 100644
--- a/utils/process_util.cpp
+++ b/utils/process_util.cpp
@@ -70,6 +70,19 @@ bool pesieve::util::is_process_64bit(IN HANDLE process)
 	return true;
 }
 
+bool pesieve::util::is_current_wow64()
+{
+#ifdef _WIN64
+	return false;
+#else
+	BOOL isWow64 = FALSE;
+	if (is_process_wow64(GetCurrentProcess(), &isWow64)) {
+		return false;
+	}
+	return (bool)isWow64;
+#endif
+}
+
 BOOL pesieve::util::wow64_get_thread_context(IN HANDLE hThread, IN OUT PWOW64_CONTEXT lpContext)
 {
 #ifdef _WIN64
diff --git a/utils/process_util.h b/utils/process_util.h
index 696f45d39..c43ed41c8 100644
--- a/utils/process_util.h
+++ b/utils/process_util.h
@@ -8,6 +8,8 @@ namespace pesieve {
 		BOOL is_process_wow64(IN HANDLE processHandle, OUT BOOL* isProcWow64);
 		bool is_process_64bit(IN HANDLE process);
 
+		bool is_current_wow64();
+
 		BOOL wow64_disable_fs_redirection(OUT PVOID* OldValue);
 		BOOL wow64_revert_fs_redirection(IN PVOID  OldValue);