Skip to content

Commit

Permalink
[BUGFIX] Protect pattern loading to mainMatcher by a mutex
Browse files Browse the repository at this point in the history
  • Loading branch information
hasherezade committed Jun 13, 2024
1 parent 2898fdd commit ccf82ce
Showing 1 changed file with 9 additions and 0 deletions.
9 changes: 9 additions & 0 deletions utils/artefacts_util.cpp
Original file line number Diff line number Diff line change
@@ -1,6 +1,7 @@
#include "artefacts_util.h"
#include <peconv.h>
#include "code_patterns.h"
#include "custom_mutex.h"
#ifdef _DEBUG
#include <iostream>
#endif
Expand All @@ -21,9 +22,11 @@ BYTE* pesieve::util::find_pattern(BYTE* buffer, size_t buf_size, BYTE* pattern_b
namespace pesieve {

std::set<DWORD> HardcodedPatterns;
pesieve::util::Mutex g_HardcodedPatternsMutex;

size_t init_32_patterns(Node* rootN)
{
util::MutexLocker guard(g_HardcodedPatternsMutex);
if (!rootN) return 0;

size_t added = 0;
Expand All @@ -42,6 +45,7 @@ namespace pesieve {

size_t init_64_patterns(Node* rootN)
{
util::MutexLocker guard(g_HardcodedPatternsMutex);
if (!rootN) return 0;

size_t added = 0;
Expand Down Expand Up @@ -139,14 +143,17 @@ bool pesieve::util::is_normal_inaccessible(DWORD state, DWORD mapping_type, DWOR
// matcher:

sig_finder::Node mainMatcher;
pesieve::util::Mutex g_mainMatcherMutex;

bool pesieve::matcher::is_matcher_ready()
{
util::MutexLocker guard(g_mainMatcherMutex);
return (mainMatcher.isEnd()) ? false : true;
}

size_t pesieve::matcher::load_pattern_file(const char* filename)
{
util::MutexLocker guard(g_mainMatcherMutex);
static bool isLoaded = false;
if (isLoaded) return 0; // allow to load file only once

Expand All @@ -164,6 +171,7 @@ size_t pesieve::matcher::load_pattern_file(const char* filename)

bool pesieve::matcher::init_shellcode_patterns()
{
util::MutexLocker guard(g_mainMatcherMutex);
static bool isLoaded = false;
if (isLoaded) return false; // allow to load only once

Expand All @@ -187,6 +195,7 @@ size_t pesieve::matcher::find_all_patterns(BYTE* loadedData, size_t loadedSize,

size_t pesieve::matcher::filter_custom(std::vector<sig_finder::Match>& allMatches, std::vector<sig_finder::Match>& customPatternMatches)
{
util::MutexLocker guard(g_HardcodedPatternsMutex);
size_t customCount = 0;
for (auto itr = allMatches.begin(); itr != allMatches.end(); ++itr) {
sig_finder::Match m = *itr;
Expand Down

0 comments on commit ccf82ce

Please sign in to comment.