Skip to content

Netlog #1

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Open
ldh0227 wants to merge 107 commits into
base: master
Choose a base branch
from
Open

Netlog #1

ldh0227 wants to merge 107 commits into from

Conversation

@ldh0227
Copy link
Owner

@ldh0227 ldh0227 commented Nov 23, 2013

No description provided.

jbremer added 30 commits December 25, 2012 10:57
@jbremer
added ntopendirectoryobject and ntcreatenamedpipefile hooks
56384d5
@jbremer
added mov eax, addr ; jmp eax hooking technique
ad5e86f
@jbremer
added some hooking techniques involving eax
3f2a7b1
@jbremer
turn defines into one big enum
853fb15
@jbremer
utilize a random hooking technique
a8b5087
@jbremer
add hook_nop_push_retn, disable fpu hook by default
5036522
@jbremer
fixed inconsistent return values part two
d21f2ec
@jbremer
renamed callgate to trampoline, added backup for registers for except…
7e00e8b 
…ion handling
@jbremer
hooking test compiles again, not like it will work as well.. but oh w…
19ba52e 
…ell..
@jbremer
fixed merge conflict error of hooking technique return values
e9f30d3
@jbremer
implemented ability to add is-valid-backtrace function
aad179a
@jbremer
introduced wrapper around the fs segment
08a2e40
@jbremer
locating backtrace stuff
16b22a6
@jbremer
added ntunmapviewofsection hook
8f30f4f
@jbremer
initial config file stuff
b64a232
@jbremer
put config stuff in a seperate file, added global constants
8164067
@jbremer
cuckoo now gives the entire pipe filename
43bb0fe
@jbremer
use randomized paths for the logging files
5fdb8fa
@jbremer
prevent Sleep bypass in child processes
01f1cb4
@jbremer
simple poc for child-sleep bug
2d0d485
@jbremer
removed unnecessary newline
0d5c67c
@jbremer
implemented unimportant files not being dropped (those that are not w…
22cbcc4 
…ritten to)
@jbremer
added license stuff where needed, changed dates to 2010-2013
0bf938b
@jbremer
added simple file record thingy
5ef19bc
@jbremer
removed ascii version of ignore file stuff and simplified stuff
8a1f05f
@jbremer
fixed failing file ignore stuff
c7899f8
@jbremer
fixed incorrect unicode string length
92dd839
@jbremer
wip on improving file dumping
4113e6a
@jbremer
added nullpointer check for lookup-del
e4b8c94
@jbremer
remove ignore file logic from new-file function
0547b82
rep and others added 30 commits January 29, 2013 21:05
@rep
fix registry log formats, flush after every loq
19df8a8
@rep
log_free before ExitProcess
847a0f7
@rep
dont have 2 ints for buffer, check for null
7ad5eaa
@rep
make sure we give space to read-/writeprocessmemory
2a8d903
@rep
support buffer / argv format specifiers
7b289a2
@rep
disable hook randomization, disable VirtualFreeEx for now
1a137e7
@rep
announce netlog on connection, choosing the netlog protocol
37c7138
@rep
remove a few hooks, modify pre-tramp to count depth and always call p…
fc8fb27 
…ost-tramp (with retaddr stack)
@rep
LOQ for hook_special, skipping one more name char
9431dab
@rep
special hooks get pre-tramp, hook_info_t into .h, hook_info() into .h
1397107
@rep
let the special hooks log if directly called
33995f1
@rep
only special, don't use normal
f5746c2
@rep
check buffer pointer for NULL
5d55723
@rep
zwmapviewofsection
7e616d3
@jbremer
added functionaddress to ldrgetprocedureaddress
2a92c09
@jbremer
consistency between cuckoo logtbl.py and cuckoomon version
e6edcfa
@rep
without ntallocatevirtualmemory
046f39a
@rep
Merge branch 'netlog' of github.com:cuckoobox/cuckoomon into netlog
7562c6e
@rep
remove some magic in NtOpenProcess to gain even more stability
c019da1
@jbremer
added getsystemmetrics hook
6106b04
@rep
NtOpenProcess checks ClientId != NULL always now - and rearranged a bit
a528078
@rep
prepare for injecting on zwmapviewofsection, dont do yet before fixin…
fe62927 
…g some other problems
@rep
inject for mapviewofsection, remove ntopenprocess for now :(
c6af920
@rep
proper null ptr check for string/wstring
b0eb233
@jbremer
added getcursorpos hook
6843f99
@jbremer
add support for limiting hooks to certain dlls
8dcc9fc
@jbremer
fixed compilation error in distorm
dcf850d
@jbremer
added mark to cuckoomon authors
c453d49
@jbremer
stupid indentation
7bcd4af
@jbremer
build and install script for cuckoomon (credits to Lukas Heberle)
5b6d08d
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@ldh0227 @Thorsten-Sick @jbremer @rep