Windows 进程、恶意异常和您：内存区域

typedef struct _PEB {   BYTE Reserved1 [2] ;   BYTE BeingDebugged;   BYTE Reserved2 [1] ;   PVOID Reserved3 [2] ;   PPEB_LDR_DATA Ldr;   PRTL_USER_PROCESS_PARAMETERS ProcessParameters;   PVOID Reserved4 [3] ;   PVOID AtlThunkSListPtr;   PVOID Reserved5;   ULONG Reserved6;   PVOID Reserved7;   ULONG Reserved8;   ULONG AtlThunkSListPtr32;   PVOID Reserved9 [45] ;   BYTE Reserved10 [96] ;   PPS_POST_PROCESS_INIT_ROUTINE PostProcessInitRoutine;   BYTE Reserved11 [128] ;   PVOID Reserved12 [1] ;   ULONG SessionId; } PEB, *PPEB;

SIZE_T VirtualQueryEx(  [in]           HANDLE                    hProcess,  [in, optional] LPCVOID                   lpAddress,  [out]          PMEMORY_BASIC_INFORMATION lpBuffer,  [in]           SIZE_T                    dwLength);

typedef  struct  _MEMORY_BASIC_INFORMATION {   PVOID BaseAddress;   PVOID AllocationBase;   DWORD AllocationProtect;   WORD PartitionId;   SIZE_T RegionSize;   DWORD State;   DWORD Protect;   DWORD Type; } MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

typedef struct REGION_ { LPVOID BaseAddress = nullptr;       LPVOID AllocationBase = nullptr;       WORD PartitionId = 0 ;       DWORD Size = 0 ;       DWORD ActiveProtect = 0 ;       DWORD InitialProtect = 0 ;       DWORD State = 0 ;       DWORD Type = 0 ;       std:: string Use = "" ; } Region;

std::vector<FENNEC::Processes::Region> FENNEC::Processes::GetAllRegions(HANDLE hProcess){    std::vector<FENNEC::Processes::Region> Regions;    MEMORY_BASIC_INFORMATION mbi = { 0 };    LPVOID offset = 0;    while (VirtualQueryEx(hProcess, offset, &mbi, sizeof(mbi)))    {        if (mbi.RegionSize > 0)        {            offset = (LPVOID)((DWORD_PTR)mbi.BaseAddress + mbi.RegionSize);            FENNEC::Processes::Region Region;            Region.BaseAddress = mbi.BaseAddress;            Region.AllocationBase = mbi.AllocationBase;            Region.PartitionId = mbi.PartitionId;            Region.Size = mbi.RegionSize;            Region.ActiveProtect = mbi.Protect;            Region.InitialProtect = mbi.AllocationProtect;            Region.State = mbi.State;            Region.Type = mbi.Type;            Region.Use = FENNEC::Processes::GetRegionUse(hProcess, Region);            Regions.push_back(Region);        }    }    return Regions;}

std::string FENNEC::Processes::GetModulePath(HANDLE hProcess, HMODULE hModule){    CHAR Path[MAX_PATH];    if (K32GetModuleFileNameExA(hProcess, hModule, Path, sizeof(Path) / sizeof(CHAR)))    {        return std::string(Path);    }    else    {        return "";    }}

void Scanner::HuntRWX(std::vector<FENNEC::Processes::Region> Regions, FENNEC::Comms::Common Common){  for (FENNEC::Processes::Region& Region : Regions)  {    if (Region.ActiveProtect == PAGE_EXECUTE_READWRITE)    {      nlohmann::json Json;      Json["method"] = "RWX";      Json["base_address"] = FENNEC::Strings::LPVOID2StringA(Region.BaseAddress);      Json["use"] = Region.Use;      Json["allocation_base"] = FENNEC::Strings::LPVOID2StringA(Region.AllocationBase);      Json["partition_id"] = std::to_string(Region.PartitionId);      Json["region_size"] = std::to_string(Region.Size);      Json["region_protection_active"] = FENNEC::Strings::ProtectToString(Region.ActiveProtect);      Json["region_allocation_initial"] = FENNEC::Strings::ProtectToString(Region.InitialProtect);      Json["region_state"] = FENNEC::Strings::AllocateToString(Region.State);      Json["region_type"] = FENNEC::Strings::TypeToString(Region.Type);      std::string Log = FENNEC::Comms::ConvertCommonLogStructureToJson(Common, Json);      FENNEC::Logger::Good("RWX Identified: %sn", Log.c_str());      FENNEC::Logger::WriteLogToFile(LOG_TYPE, Log);    }  }}

{  "data": {    "allocation_base": "0x00000000001E0000",    "base_address": "0x00000000001E0000",    "method": "RWX",    "partition_id": "0",    "region_allocation_initial": "PAGE_EXECUTE_READWRITE",    "region_protection_active": "PAGE_EXECUTE_READWRITE",    "region_size": "73728",    "region_state": "MEM_COMMIT",    "region_type": "MEM_PRIVATE",    "use": ""  },  "event_category": "Memory Scanner",  "event_time": "Tue Sep 6 10:07:34 2022",  "guid": "e861eb49-08ab-427f-95d7-e8116475c1e8",  "image_name": "maelstrom.unsafe.x64.exe",  "image_path": "\Device\HarddiskVolume11\maelstrom\agent\stage0\bin\maelstrom.unsafe.x64.exe",  "parent_procecess": 12652,  "process_id": 15372}

LPVOID pAddress = VirtualAlloc ( nullptr，409600， MEM_COMMIT | MEM_RESERVE， PAGE_EXECUTE_READWRITE );   memset ( pAddress ，'a'，409600 );

  LPVOID pAddress = (LPVOID) malloc ( 409600 );   memset (pAddress, 'a' , 409600 );   MEMORY_BASIC_INFORMATION mbi = { 0 };   VirtualQuery (pAddress, &mbi, sizeof mbi);

if (Region.Type == MEM_MAPPED || Region.Type == MEM_IMAGE){    continue;}

BOOL bMzFound = FALSE;BOOL bIsDLLBacked = FALSE;std::vector<unsigned char> bytes = { 0x4d, 0x5a };PCHAR lpBuffer = static_cast<PCHAR>(malloc(Region.Size));

BOOL bRead = ReadProcessMemory(hProcess, (LPVOID)Region.BaseAddress, lpBuffer, Region.Size, NULL);if (bRead == FALSE){      free(lpBuffer);      continue;}

std::vector<unsigned char> vectorBuffer(lpBuffer, lpBuffer + 2);

BOOL FENNEC::Strings::CompareVectors(std::vector<unsigned char> a, std::vector<unsigned char> b){  if (std::equal(a.begin(), a.end(), b.begin()))  {    return TRUE;  }  else  {    return FALSE;  }}

  std::vector<FENNEC::Processes::Module> modules = FENNEC::Processes::GetModules(hProcess);  for (FENNEC::Processes::Module& Module : modules)  {    if (Region.AllocationBase == Module.BaseAddress)    {      bIsDLLBacked = TRUE;      break;    }  }

BOOL FENNEC::PEBLOCK::IsBaseAddressWithDll(LPVOID BaseAddress){  PPEB_LDR_DATA Ldr = FENNEC::PEBLOCK::Peb->Ldr;  LIST_ENTRY* ModuleList = NULL;  BOOL bDllIsBacked = FALSE;  ModuleList = &Ldr->InMemoryOrderModuleList;  LIST_ENTRY* pStartListEntry = ModuleList->Flink;  for (LIST_ENTRY* pListEntry = pStartListEntry; pListEntry != ModuleList; pListEntry = pListEntry->Flink)  {    LDR_DATA_TABLE_ENTRY* pEntry = (LDR_DATA_TABLE_ENTRY*)((BYTE*)pListEntry - sizeof(LIST_ENTRY));    std::wstring wsName(pEntry->BaseDllName.Buffer);    std::wstring wsPath(pEntry->FullDllName.Buffer);    std::string modName = FENNEC::Strings::StringW2StringA(wsName);    std::string modPath = FENNEC::Strings::StringW2StringA(wsPath);    if (BaseAddress == pEntry->DllBase)    {      bDllIsBacked = TRUE;      break;    }  }  return bDllIsBacked;}

{  "data": {    "allocation_base": "0x00000000001E0000",    "base_address": "0x00000000001E0000",    "method": "Memory Allocation without DLL Backing",    "partition_id": "0",    "region_allocation_initial": "PAGE_EXECUTE_READWRITE",    "region_protection_active": "PAGE_EXECUTE_READWRITE",    "region_size": "73728",    "region_state": "MEM_COMMIT",    "region_type": "MEM_PRIVATE",    "use": ""  },  "event_category": "Memory Scanner",  "event_time": "Tue Sep  6 11:57:57 2022",  "guid": "59cd7a5a-53aa-4ca8-91b4-d76e8feecab1",  "image_name": "maelstrom.unsafe.x64.exe",  "image_path": "\Device\HarddiskVolume11\maelstrom\agent\stage0\bin\maelstrom.unsafe.x64.exe",",  "parent_procecess": 12652,  "process_id": 15372}

"method": "Memory Allocation without DLL Backing"

Windows Processes, Nefarious Anomalies, and You: Memory Regionshttps://www.trustedsec.com/blog/windows-processes-nefarious-anomalies-and-you-memory-regions