Release of version 1.0

advanced-threat-research · Aug 5, 2022 · 7c67b86 · 7c67b86
1 parent 8e6165b
commit 7c67b86
Show file tree

Hide file tree

Showing 115 changed files with 32,564 additions and 0 deletions.
diff --git a/DotDumper.sln b/DotDumper.sln
@@ -0,0 +1,31 @@
+
+Microsoft Visual Studio Solution File, Format Version 12.00
+# Visual Studio Version 16
+VisualStudioVersion = 16.0.29201.188
+MinimumVisualStudioVersion = 10.0.40219.1
+Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "DotDumper", "DotDumper\DotDumper.csproj", "{97B3A6FF-A6EC-488A-8206-9820DC1F109B}"
+EndProject
+Global
+	GlobalSection(SolutionConfigurationPlatforms) = preSolution
+		Debug|Any CPU = Debug|Any CPU
+		Debug|x64 = Debug|x64
+		Release|Any CPU = Release|Any CPU
+		Release|x64 = Release|x64
+	EndGlobalSection
+	GlobalSection(ProjectConfigurationPlatforms) = postSolution
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Debug|Any CPU.Build.0 = Debug|Any CPU
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Debug|x64.ActiveCfg = Debug|x64
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Debug|x64.Build.0 = Debug|x64
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Release|Any CPU.ActiveCfg = Release|Any CPU
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Release|Any CPU.Build.0 = Release|Any CPU
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Release|x64.ActiveCfg = Release|x64
+		{97B3A6FF-A6EC-488A-8206-9820DC1F109B}.Release|x64.Build.0 = Release|x64
+	EndGlobalSection
+	GlobalSection(SolutionProperties) = preSolution
+		HideSolutionNode = FALSE
+	EndGlobalSection
+	GlobalSection(ExtensibilityGlobals) = postSolution
+		SolutionGuid = {73ACB997-98D1-4343-8558-3318327C48C5}
+	EndGlobalSection
+EndGlobal
diff --git a/DotDumper/ArgumentHandler.cs b/DotDumper/ArgumentHandler.cs
diff --git a/DotDumper/Config.cs b/DotDumper/Config.cs
@@ -0,0 +1,63 @@
+namespace DotDumper
+{
+    /// <summary>
+    /// This class contains the default configuration values. Fields are overwritten with user-provided arguments if present.
+    /// </summary>
+    class Config
+    {
+        /// <summary>
+        /// The complete path to the sample that is to be executed. The default value is null.
+        /// </summary>
+        public static string SamplePath = null;
+
+        /// <summary>
+        /// The name of the folder that is to be used to place all artifacts in. This folder always resides within DotDumper.exe's folder. The default value is null.
+        /// </summary>
+        public static string LoggerFolder = null;
+
+        /// <summary>
+        /// True if deprecated functions should also be hooked (when a hook is present for such a function that is), false if not. The default value is true.
+        /// </summary>
+        public static bool IncludeDeprecatedFunctions = true;
+
+        /// <summary>
+        /// True if the hooks should be printed in string form during DotDumper's startup, false if not. The default value is true.
+        /// </summary>
+        public static bool LogHooks = true;
+
+        /// <summary>
+        /// The amount of milliseconds that the timer waits before calling the callback function for the rehook. The default value is 20.
+        /// </summary>
+        public static int RaceConditionDueTime = 20;
+
+        /// <summary>
+        /// Defines if the entry point (if present) should be overriden. A sample without an entrypoint should still be overridden! The default value is false.
+        /// </summary>
+        public static bool OverrideEntryPoint = false;
+
+        /// <summary>
+        /// The fully qualified class name, including the namespace(s). The default value is null.
+        /// </summary>
+        public static string DllFullyQualifiedClassName = null;
+
+        /// <summary>
+        /// The name of the public function in the given fully qualified class name. The default value is null.
+        /// </summary>
+        public static string DllFunctionName = null;
+
+        /// <summary>
+        /// The provided arguments for the given function (or the entry point). The default value is null.
+        /// </summary>
+        public static object[] DllArguments = null;
+
+        /// <summary>
+        /// True if calls to Thread.Sleep should be skipped, false if not. The default value is true.
+        /// </summary>
+        public static bool SleepSkip = true;
+
+        /// <summary>
+        /// True if the logs should be printed to the console, false if not. The default value is true.
+        /// </summary>
+        public static bool PrintLogsToConsole = true;
+    }
+}
diff --git a/DotDumper/DotDumper.csproj b/DotDumper/DotDumper.csproj
@@ -0,0 +1,129 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
+  <PropertyGroup>
+    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
+    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
+    <ProjectGuid>{97B3A6FF-A6EC-488A-8206-9820DC1F109B}</ProjectGuid>
+    <OutputType>Exe</OutputType>
+    <RootNamespace>DotDumper</RootNamespace>
+    <AssemblyName>DotDumper</AssemblyName>
+    <TargetFrameworkVersion>v4.8</TargetFrameworkVersion>
+    <FileAlignment>512</FileAlignment>
+    <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
+    <Deterministic>true</Deterministic>
+    <TargetFrameworkProfile />
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugSymbols>true</DebugSymbols>
+    <DebugType>full</DebugType>
+    <Optimize>false</Optimize>
+    <OutputPath>bin\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
+    <PlatformTarget>AnyCPU</PlatformTarget>
+    <DebugType>pdbonly</DebugType>
+    <Optimize>true</Optimize>
+    <OutputPath>bin\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <ErrorReport>prompt</ErrorReport>
+    <WarningLevel>4</WarningLevel>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Debug|x64'">
+    <DebugSymbols>true</DebugSymbols>
+    <OutputPath>bin\x64\Debug\</OutputPath>
+    <DefineConstants>DEBUG;TRACE</DefineConstants>
+    <DebugType>full</DebugType>
+    <PlatformTarget>x64</PlatformTarget>
+    <ErrorReport>prompt</ErrorReport>
+    <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <Prefer32Bit>true</Prefer32Bit>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)' == 'Release|x64'">
+    <OutputPath>bin\x64\Release\</OutputPath>
+    <DefineConstants>TRACE</DefineConstants>
+    <Optimize>true</Optimize>
+    <DebugType>pdbonly</DebugType>
+    <PlatformTarget>x64</PlatformTarget>
+    <ErrorReport>prompt</ErrorReport>
+    <CodeAnalysisRuleSet>MinimumRecommendedRules.ruleset</CodeAnalysisRuleSet>
+    <Prefer32Bit>true</Prefer32Bit>
+    <AllowUnsafeBlocks>true</AllowUnsafeBlocks>
+  </PropertyGroup>
+  <ItemGroup>
+    <Reference Include="Microsoft.VisualBasic" />
+    <Reference Include="System" />
+    <Reference Include="System.Core" />
+    <Reference Include="System.Diagnostics.Process, Version=4.1.1.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a, processorArchitecture=MSIL">
+      <HintPath>..\packages\System.Diagnostics.Process.4.3.0\lib\net461\System.Diagnostics.Process.dll</HintPath>
+      <Private>True</Private>
+      <Private>True</Private>
+    </Reference>
+    <Reference Include="System.Drawing" />
+    <Reference Include="System.Web.Extensions" />
+    <Reference Include="System.Xml.Linq" />
+    <Reference Include="System.Data.DataSetExtensions" />
+    <Reference Include="Microsoft.CSharp" />
+    <Reference Include="System.Data" />
+    <Reference Include="System.Net.Http" />
+    <Reference Include="System.Xml" />
+  </ItemGroup>
+  <ItemGroup>
+    <Compile Include="ArgumentHandler.cs" />
+    <Compile Include="Config.cs" />
+    <Compile Include="Helpers\ArgumentHelper.cs" />
+    <Compile Include="Helpers\AssemblyMapper.cs" />
+    <Compile Include="Helpers\LogEntryHelper.cs" />
+    <Compile Include="Helpers\Serialise.cs" />
+    <Compile Include="Helpers\MissedAssemblyDumper.cs" />
+    <Compile Include="Helpers\StagnationHandler.cs" />
+    <Compile Include="HookHandlers\Activator\ActivatorHooks.cs" />
+    <Compile Include="HookHandlers\Assembly\AssemblyHooks.cs" />
+    <Compile Include="HookHandlers\Console\ConsoleHooks.cs" />
+    <Compile Include="HookHandlers\Console\ConsoleHooksHelper.cs" />
+    <Compile Include="HookHandlers\Convert\ConvertHooks.cs" />
+    <Compile Include="HookHandlers\Convert\ConvertHooksHelper.cs" />
+    <Compile Include="HookHandlers\Environment\EnvironmentHooks.cs" />
+    <Compile Include="HookHandlers\File\FileHooks.cs" />
+    <Compile Include="HookHandlers\File\FileHooksHelper.cs" />
+    <Compile Include="HookHandlers\MethodBase\MethodBaseHooks.cs" />
+    <Compile Include="HookHandlers\MethodBase\MethodBaseHooksHelper.cs" />
+    <Compile Include="HookHandlers\Path\PathHooks.cs" />
+    <Compile Include="HookHandlers\Path\PathHooksHelper.cs" />
+    <Compile Include="HookHandlers\Process\ProcessHooks.cs" />
+    <Compile Include="HookHandlers\Process\ProcessHooksHelper.cs" />
+    <Compile Include="HookHandlers\ResourceManager\ResourceManagerHooks.cs" />
+    <Compile Include="HookHandlers\ResourceManager\ResourceManagerHooksHelper.cs" />
+    <Compile Include="HookHandlers\Thread\ThreadHooks.cs" />
+    <Compile Include="HookHandlers\Thread\ThreadHooksHelper.cs" />
+    <Compile Include="HookHandlers\Type\TypeHooks.cs" />
+    <Compile Include="HookHandlers\Type\TypeHooksHelper.cs" />
+    <Compile Include="Hooks\Hook.cs" />
+    <Compile Include="Helpers\Hashes.cs" />
+    <Compile Include="HookHandlers\Assembly\AssemblyHooksHelper.cs" />
+    <Compile Include="HookHandlers\GenericHookHelper.cs" />
+    <Compile Include="Hooks\HookManager.cs" />
+    <Compile Include="Hooks\OriginalManagedFunctions.cs" />
+    <Compile Include="Logger.cs" />
+    <Compile Include="Models\Argument.cs" />
+    <Compile Include="Models\AssemblyObject.cs" />
+    <Compile Include="Models\Hash.cs" />
+    <Compile Include="Models\LogEntry.cs" />
+    <Compile Include="Models\UnmanagedMethodInfo.cs" />
+    <Compile Include="Program.cs" />
+    <Compile Include="Properties\AssemblyInfo.cs" />
+    <Compile Include="Helpers\RaceConditionHandler.cs" />
+  </ItemGroup>
+  <ItemGroup>
+    <None Include="app.config" />
+    <None Include="packages.config" />
+  </ItemGroup>
+  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
+</Project>