Format code

This commit is contained in:
nganhkhoa 2020-08-01 04:47:59 +07:00
parent e2eac767e0
commit ae679b62be
3 changed files with 23 additions and 22 deletions

View File

@ -39,8 +39,7 @@ fn main() -> Result<(), Box<dyn Error>> {
.iter()
.enumerate()
{
let addr: u64 =
addr_.as_str().and_then(|x| parse(x).ok()).unwrap_or(0);
let addr: u64 = addr_.as_str().and_then(|x| parse(x).ok()).unwrap_or(0);
let mut owner = "(??)";
println!("{} {}", addr, get_irp_name(idx));
for kmod in kmods.iter() {

View File

@ -45,29 +45,30 @@ fn main() -> Result<(), Box<dyn Error>> {
if *func > base && *func < base + size {
let module = r["BaseName"].as_str().unwrap();
Some(module)
}
else {
} else {
None
}
});
if owner == Some("ntoskrnl.exe") {
let offset = func - ntosbase.address();
let funcname: String = {
driver.pdb_store.symbols.iter().find_map(|(name, o)| {
if o.clone() == offset {
Some(name.clone())
}
else {
None
}
}).unwrap_or("(??)".to_string())
driver
.pdb_store
.symbols
.iter()
.find_map(|(name, o)| {
if o.clone() == offset {
Some(name.clone())
} else {
None
}
})
.unwrap_or("(??)".to_string())
};
println!("\towned by nt!{}", funcname);
}
else if let Some(owner_) = owner {
} else if let Some(owner_) = owner {
println!("\\thooked by {}", owner_);
}
else {
} else {
println!("\tmissing owner");
}
}

View File

@ -1,13 +1,11 @@
use serde_json::{json};
use serde_json::json;
use std::error::Error;
use std::fs;
use lpus::{
driver_state::DriverState, scan_eprocess, scan_ethread, traverse_activehead,
traverse_handletable, traverse_kiprocesslist, scan_driver, scan_kernel_module,
driver_state::DriverState, scan_driver, scan_eprocess, scan_ethread, scan_kernel_module,
ssdt_table, traverse_activehead, traverse_handletable, traverse_kiprocesslist,
traverse_loadedmodulelist, traverse_unloadeddrivers,
ssdt_table
};
fn main() -> Result<(), Box<dyn Error>> {
@ -30,7 +28,10 @@ fn main() -> Result<(), Box<dyn Error>> {
let kernel_module_1 = scan_kernel_module(&driver)?;
let kernel_module_2 = traverse_loadedmodulelist(&driver)?;
let unloaded_driver = traverse_unloadeddrivers(&driver)?;
let ssdt: Vec<String> = ssdt_table(&driver)?.into_iter().map(|x| format!("0x{:x}", x)).collect();
let ssdt: Vec<String> = ssdt_table(&driver)?
.into_iter()
.map(|x| format!("0x{:x}", x))
.collect();
let result = json!({
"scan_eprocess": eprocess_1,