Skip to content

Track and expose Module Overloading evasion techniques #199

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
doomedraven wants to merge 3 commits into
base: capemon
Choose a base branch
from
Open

Track and expose Module Overloading evasion techniques #199

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c65d866
Track and expose Module Overloading evasion techniques
Sep 8, 2026
30d2c26
Fix use-after-free, NULL check, and format string issues in module ov…
doomedraven Sep 8, 2026
4d0ada7
Merge remote-tracking branch 'upstream/capemon' into opt/module-overl…
doomedraven Sep 9, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
143 changes: 136 additions & 7 deletions hook_process.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -791,7 +791,7 @@ HOOKDEF(NTSTATUS, WINAPI, NtCreateSection,

path_from_handle(FileHandle, FileName, UNICODE_STRING_MAX_BYTES);

LOQ_ntstatus("process", "PhopF", "SectionHandle", SectionHandle, "DesiredAccess", DesiredAccess, "ObjectAttributes", ObjectAttributes ? ObjectAttributes->ObjectName : NULL, "FileHandle", FileHandle, "FileName", FileName);
LOQ_ntstatus("process", "PhopipF", "SectionHandle", SectionHandle, "DesiredAccess", DesiredAccess, "ObjectAttributes", ObjectAttributes ? ObjectAttributes->ObjectName : NULL, "SectionPageProtection", SectionPageProtection, "AllocationAttributes", AllocationAttributes, "FileHandle", FileHandle, "FileName", FileName);

if (NT_SUCCESS(ret) && FileHandle && (DesiredAccess & SECTION_MAP_WRITE))
file_write(FileHandle);
Expand Down Expand Up @@ -844,13 +844,41 @@ HOOKDEF(NTSTATUS, WINAPI, NtMapViewOfSection,
NTSTATUS ret = Old_NtMapViewOfSection(SectionHandle, ProcessHandle, BaseAddress, ZeroBits, CommitSize, SectionOffset, ViewSize, InheritDisposition, AllocationType, Win32Protect);

DWORD pid = pid_from_process_handle(ProcessHandle);
UNICODE_STRING *module_name = get_module_name((ULONG_PTR)*BaseAddress);
UNICODE_STRING *module_name = NULL;
UNICODE_STRING dynamic_module_name;
wchar_t basename_buffer[MAX_PATH];
wchar_t *filepath = NULL;
wchar_t *absolutepath = NULL;

if (NT_SUCCESS(ret) && BaseAddress && *BaseAddress) {
module_name = get_module_name((ULONG_PTR)*BaseAddress);
if (!module_name) {
filepath = malloc(MAX_PATH * sizeof(wchar_t));
if (filepath) {
if (GetMappedFileNameW(GetCurrentProcess(), *BaseAddress, filepath, MAX_PATH)) {
absolutepath = malloc(32768 * sizeof(wchar_t));
if (absolutepath) {
ensure_absolute_unicode_path(absolutepath, filepath);
wchar_t *basename = get_dll_basename(absolutepath);
if (basename) {
wcsncpy(basename_buffer, basename, MAX_PATH - 1);
basename_buffer[MAX_PATH - 1] = L'\0';
dynamic_module_name.Buffer = basename_buffer;
dynamic_module_name.Length = wcslen(basename_buffer) * sizeof(wchar_t);
dynamic_module_name.MaximumLength = dynamic_module_name.Length + sizeof(wchar_t);
module_name = &dynamic_module_name;
}
}
}
}
}
}

if (!module_name)
LOQ_ntstatus("process", "ppPpPhs", "SectionHandle", SectionHandle,"ProcessHandle", ProcessHandle, "BaseAddress", BaseAddress,
"SectionOffset", SectionOffset, "ViewSize", ViewSize, "Win32Protect", Win32Protect, "StackPivoted", is_stack_pivoted() ? "yes" : "no");
else
LOQ_ntstatus("process", "ppPspPhs", "SectionHandle", SectionHandle,"ProcessHandle", ProcessHandle, "BaseAddress", BaseAddress,
LOQ_ntstatus("process", "ppPopPhs", "SectionHandle", SectionHandle,"ProcessHandle", ProcessHandle, "BaseAddress", BaseAddress,
"ModuleName", module_name, "SectionOffset", SectionOffset, "ViewSize", ViewSize, "Win32Protect", Win32Protect, "StackPivoted", is_stack_pivoted() ? "yes" : "no");

if (NT_SUCCESS(ret)) {
Expand All @@ -864,6 +892,9 @@ HOOKDEF(NTSTATUS, WINAPI, NtMapViewOfSection,
prevent_module_reloading(BaseAddress);
}

if (filepath) free(filepath);
if (absolutepath) free(absolutepath);

return ret;
}

Expand All @@ -882,8 +913,42 @@ HOOKDEF(NTSTATUS, WINAPI, NtMapViewOfSectionEx,
AllocationType, Win32Protect, Parameters, ParameterCount);
DWORD pid = pid_from_process_handle(ProcessHandle);

LOQ_ntstatus("process", "ppPpPhs", "SectionHandle", SectionHandle,"ProcessHandle", ProcessHandle, "BaseAddress", BaseAddress,
"SectionOffset", SectionOffset, "ViewSize", ViewSize, "Win32Protect", Win32Protect, "StackPivoted", is_stack_pivoted() ? "yes" : "no");
UNICODE_STRING *module_name = NULL;
UNICODE_STRING dynamic_module_name;
wchar_t basename_buffer[MAX_PATH];
wchar_t *filepath = NULL;
wchar_t *absolutepath = NULL;

if (NT_SUCCESS(ret) && BaseAddress && *BaseAddress) {
module_name = get_module_name((ULONG_PTR)*BaseAddress);
if (!module_name) {
filepath = malloc(MAX_PATH * sizeof(wchar_t));
if (filepath) {
if (GetMappedFileNameW(GetCurrentProcess(), *BaseAddress, filepath, MAX_PATH)) {
absolutepath = malloc(32768 * sizeof(wchar_t));
if (absolutepath) {
ensure_absolute_unicode_path(absolutepath, filepath);
wchar_t *basename = get_dll_basename(absolutepath);
if (basename) {
wcsncpy(basename_buffer, basename, MAX_PATH - 1);
basename_buffer[MAX_PATH - 1] = L'\0';
dynamic_module_name.Buffer = basename_buffer;
dynamic_module_name.Length = wcslen(basename_buffer) * sizeof(wchar_t);
dynamic_module_name.MaximumLength = dynamic_module_name.Length + sizeof(wchar_t);
module_name = &dynamic_module_name;
}
}
}
}
}
}

if (!module_name)
LOQ_ntstatus("process", "ppPpPhs", "SectionHandle", SectionHandle,"ProcessHandle", ProcessHandle, "BaseAddress", BaseAddress,
"SectionOffset", SectionOffset, "ViewSize", ViewSize, "Win32Protect", Win32Protect, "StackPivoted", is_stack_pivoted() ? "yes" : "no");
else
LOQ_ntstatus("process", "ppPopPhs", "SectionHandle", SectionHandle,"ProcessHandle", ProcessHandle, "BaseAddress", BaseAddress,
"ModuleName", module_name, "SectionOffset", SectionOffset, "ViewSize", ViewSize, "Win32Protect", Win32Protect, "StackPivoted", is_stack_pivoted() ? "yes" : "no");

if (NT_SUCCESS(ret)) {
if (g_config.injection)
Expand All @@ -896,6 +961,10 @@ HOOKDEF(NTSTATUS, WINAPI, NtMapViewOfSectionEx,
prevent_module_reloading(BaseAddress);
}
}

if (filepath) free(filepath);
if (absolutepath) free(absolutepath);

return ret;
}

Expand Down Expand Up @@ -1242,8 +1311,34 @@ HOOKDEF(NTSTATUS, WINAPI, NtProtectVirtualMemory,
MEMORY_BASIC_INFORMATION meminfo;
DWORD OriginalNewAccessProtection = 0;
UNICODE_STRING *module_name = NULL;
if (BaseAddress)
UNICODE_STRING dynamic_module_name;
wchar_t basename_buffer[MAX_PATH];
wchar_t *filepath = NULL;
wchar_t *absolutepath = NULL;

if (BaseAddress && *BaseAddress) {
module_name = get_module_name((ULONG_PTR)*BaseAddress);
if (!module_name) {
filepath = malloc(MAX_PATH * sizeof(wchar_t));
if (filepath) {
if (GetMappedFileNameW(GetCurrentProcess(), *BaseAddress, filepath, MAX_PATH)) {
absolutepath = malloc(32768 * sizeof(wchar_t));
if (absolutepath) {
ensure_absolute_unicode_path(absolutepath, filepath);
wchar_t *basename = get_dll_basename(absolutepath);
if (basename) {
wcsncpy(basename_buffer, basename, MAX_PATH - 1);
basename_buffer[MAX_PATH - 1] = L'\0';
dynamic_module_name.Buffer = basename_buffer;
dynamic_module_name.Length = wcslen(basename_buffer) * sizeof(wchar_t);
dynamic_module_name.MaximumLength = dynamic_module_name.Length + sizeof(wchar_t);
module_name = &dynamic_module_name;
}
}
}
}
}
}

if (module_name && g_config.ntdll_protect || g_config.hook_protect) {
if (NewAccessProtection == PAGE_EXECUTE_READWRITE && BaseAddress && NumberOfBytesToProtect &&
Expand Down Expand Up @@ -1309,6 +1404,9 @@ HOOKDEF(NTSTATUS, WINAPI, NtProtectVirtualMemory,
"NumberOfBytesProtected", NumberOfBytesToProtect, "MemoryType", meminfo.Type, "NewAccessProtection", NewAccessProtection,
"OldAccessProtection", OldAccessProtection, "StackPivoted", is_stack_pivoted() ? "yes" : "no");

if (filepath) free(filepath);
if (absolutepath) free(absolutepath);

return ret;
}

Expand All @@ -1322,7 +1420,35 @@ HOOKDEF(BOOL, WINAPI, VirtualProtectEx,
BOOL ret;
MEMORY_BASIC_INFORMATION meminfo;
DWORD OriginalNewProtect = 0;
UNICODE_STRING *module_name = get_module_name((ULONG_PTR)lpAddress);
UNICODE_STRING *module_name = NULL;
UNICODE_STRING dynamic_module_name;
wchar_t basename_buffer[MAX_PATH];
wchar_t *filepath = NULL;
wchar_t *absolutepath = NULL;

if (lpAddress) {
module_name = get_module_name((ULONG_PTR)lpAddress);
if (!module_name) {
filepath = malloc(MAX_PATH * sizeof(wchar_t));
if (filepath) {
if (GetMappedFileNameW(GetCurrentProcess(), lpAddress, filepath, MAX_PATH)) {
absolutepath = malloc(32768 * sizeof(wchar_t));
if (absolutepath) {
ensure_absolute_unicode_path(absolutepath, filepath);
wchar_t *basename = get_dll_basename(absolutepath);
if (basename) {
wcsncpy(basename_buffer, basename, MAX_PATH - 1);
basename_buffer[MAX_PATH - 1] = L'\0';
dynamic_module_name.Buffer = basename_buffer;
dynamic_module_name.Length = wcslen(basename_buffer) * sizeof(wchar_t);
dynamic_module_name.MaximumLength = dynamic_module_name.Length + sizeof(wchar_t);
module_name = &dynamic_module_name;
}
}
}
}
}
}

if (module_name && g_config.ntdll_protect || g_config.hook_protect) {
if (flNewProtect == PAGE_EXECUTE_READWRITE && lpAddress && dwSize &&
Expand Down Expand Up @@ -1386,6 +1512,9 @@ HOOKDEF(BOOL, WINAPI, VirtualProtectEx,
LOQ_bool("process", "ppphhHs", "ProcessHandle", hProcess, "Address", lpAddress, "Size", dwSize, "MemType", meminfo.Type,
"Protection", flNewProtect, "OldProtection", lpflOldProtect, "StackPivoted", is_stack_pivoted() ? "yes" : "no");

if (filepath) free(filepath);
if (absolutepath) free(absolutepath);

return ret;
}

Expand Down