Search blacklisted module/process

search_blacklisted.cpp

#include <stdio.h>

#include <Windows.h>
#include <psapi.h>
#include <TlHelp32.h>

#include <set>

FILE *logFile = NULL;

void log_found(char *name)
{
    printf("found blacklisted: %s\n", name);

    if (logFile == NULL) return;
    fprintf(logFile, "found blacklisted: %s\n", name);
}

void log_checksum(DWORD checksum, char *name)
{
    printf("%08X : %s\n", checksum, name);

    if (logFile == NULL) return;
    fprintf(logFile, "%08X : %s\n", checksum, name);
}

inline DWORD rotl32a(DWORD x, DWORD n)
{
    return (x<<n) | (x>>(32-n));
}

inline char to_lower(char c)
{
    if (c >= 'A' && c <= 'Z') {
        c = c - 'A' + 'a';
    }
    return c;
}

DWORD calc_checksum(char *str, bool enable_tolower)
{
    if (str == NULL) return 0;

    DWORD checksum = 0;
    size_t len = strlen(str);
    for (int i = 0; i < len; i++) {
        checksum = rotl32a(checksum, 7);
        char c = str[i];
        if (enable_tolower) {
            c = to_lower(c);
        }
        checksum ^= c;
    }
    return checksum;
}

size_t find_blacklisted_processes(std::set<DWORD> &process_blacklist, bool enable_tolower)
{
    size_t found = 0;
    HANDLE hProcessSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, 0);
    PROCESSENTRY32 process_entry = { 0 };
    process_entry.dwSize = sizeof(process_entry);

    if (!Process32First(hProcessSnapShot, &process_entry)) {
        return 0;
    }

    DWORD checksum = calc_checksum(process_entry.szExeFile, enable_tolower);
    if (process_blacklist.find(checksum) != process_blacklist.end()){
        log_found(process_entry.szExeFile);
        found++;
    }

    while (Process32Next(hProcessSnapShot, &process_entry)) {
        checksum = calc_checksum(process_entry.szExeFile, enable_tolower);
        if (process_blacklist.find(checksum) != process_blacklist.end()) {
            log_found(process_entry.szExeFile);
            found++;
        }
    }

    // Close the handle
    CloseHandle(hProcessSnapShot);
    return found;
}

DWORD find_blacklisted_module(std::set<DWORD> &blacklist, bool enable_tolower)
{
    size_t found = 0;
    HANDLE hProcessSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, GetCurrentProcessId());
    MODULEENTRY32 module_entry = { 0 };
    module_entry.dwSize = sizeof(module_entry);

    if (!Module32First(hProcessSnapShot, &module_entry)) {
        return 0;
    }

    DWORD checksum = calc_checksum(module_entry.szModule, enable_tolower);
    if (blacklist.find(checksum) != blacklist.end()) {
        found++;
        log_found(module_entry.szModule);
    }

    while (Module32Next(hProcessSnapShot, &module_entry)) {
        checksum = calc_checksum(module_entry.szModule, enable_tolower);
        if (blacklist.find(checksum) != blacklist.end()) {
            found++;
            log_found(module_entry.szModule);
        }
    }

    // Close the handle
    CloseHandle(hProcessSnapShot);
    return found;
}

BOOL check_dos_devices()
{
    char dev[MAX_PATH] = { 0 };
    char dev2[MAX_PATH] = { 0 };
    QueryDosDevice("C:", dev, MAX_PATH);
    printf("dev: %s\n", dev);
    QueryDosDevice(dev, dev, MAX_PATH);
    return true;
}

BOOL CALLBACK check_window(HWND hWnd, LPARAM lParam)
{
    if (lParam == NULL) return FALSE;

    std::set<DWORD>* class_blacklist = (std::set<DWORD>*) lParam;
    bool hide = false;

    size_t found = 0;

    char class_name[MAX_PATH];
	char title[MAX_PATH];
    GetClassName(hWnd, class_name, MAX_PATH);

    DWORD checksum = calc_checksum(class_name, true);
    if (class_blacklist->find(checksum) != class_blacklist->end()) {
        found++;
        log_found(class_name);

        if (hide) {
            ShowWindow(hWnd, SW_HIDE);
        } else {
            ShowWindow(hWnd, SW_SHOW);
        }
    }
    return TRUE;
}

int main(int argc, char *argv[])
{
    logFile = fopen("logfile.txt", "w");

    std::set<DWORD> process_blacklist;
    process_blacklist.insert(0x6169078A);
    process_blacklist.insert(0x47000343);
    process_blacklist.insert(0xC608982D);
    process_blacklist.insert(0x46EE4F10);
    process_blacklist.insert(0xF6EC4B30);

    process_blacklist.insert(0xB1CBC652);
    process_blacklist.insert(0x6D3E6FDD);
    process_blacklist.insert(0x583EB7E8);
    process_blacklist.insert(0xC03EAA65);

    if (find_blacklisted_processes(process_blacklist, false)) {
        printf("Blacklisted process found!\n");
    }
    if (find_blacklisted_processes(process_blacklist, true)) {
        printf("Blacklisted process found!\n");
    }

    fflush(logFile);
    fprintf(logFile, "---\n");

    std::set<DWORD> module_blacklist;
    module_blacklist.insert(0x1C669D6A);
    module_blacklist.insert(0xC2F56A18);
    module_blacklist.insert(0x7457D9DD);

    module_blacklist.insert(0xC106E17B);
    module_blacklist.insert(0x5608BCC4);
    module_blacklist.insert(0x6512F9D0);

    module_blacklist.insert(0xC604D52A);
    module_blacklist.insert(0x4D0651A5);
    module_blacklist.insert(0xAC12B9FB);

    module_blacklist.insert(0x5B747561);
    module_blacklist.insert(0x53309C85);
    module_blacklist.insert(0xE53ED522);

    if (find_blacklisted_module(process_blacklist, false)) {
        printf("Blacklisted module found!\n");
    }
    if (find_blacklisted_module(process_blacklist, true)) {
        printf("Blacklisted module found!\n");
    }

    std::set<DWORD> class_blacklist;

    class_blacklist.insert(0xFE9EA0D5);
    class_blacklist.insert(0x6689BB92);
    class_blacklist.insert(0x3C5FF312);

    class_blacklist.insert(0x9B5A88D9);
    class_blacklist.insert(0x4B4576B5);
    class_blacklist.insert(0xAED304FC);

    class_blacklist.insert(0x225FD98F);
    class_blacklist.insert(0x6D3FA1CA);
    class_blacklist.insert(0xCF388E01);

    class_blacklist.insert(0xD486D951);
    class_blacklist.insert(0x39177889);

    EnumWindows(&check_window, (LPARAM)&class_blacklist);

    check_dos_devices();

    fclose(logFile);
    system("pause");
    return 0;
}