domainChecker.py move out.

pyc file untrack

Author: linjun

MW.py

@@ -1,5 +1,6 @@
 import frida
 import sys
+import time
 from utils.utils import *
 
 reload(sys)
@@ -21,10 +22,10 @@ def _process_message(self, message, data):
                 if stanza['name'] == '+log':
                     msg = str(stanza["payload"])
                     logl("[" + str(self.pid) + "]\t" + msg)
-                    try:
-                        self.extract.post({'type': '+log-ack'})
-                    except Exception as e:
-                        pass
+                    # try:
+                    #     self.extract.post({'type': '+log-ack'})
+                    # except Exception as e:
+                    #     pass
 
                 elif stanza['name'] == '+pkill':
                     logl("Kill Sub-Process: " + str(stanza['payload']))
@@ -34,7 +35,7 @@ def _process_message(self, message, data):
                 logl(message)
                 logl("=========================")
         except Exception as ae:
-            logl("exception on _process_message")
+            #logl("exception on _process_message")
             pass
 
 
@@ -59,6 +60,7 @@ def main():
     logl("process spwnded.");
     Hooker.inject_script(jsfile)
     logl("js injected.");
+    #time.sleep(1)
     Hooker.go()
     logl("go!");
 

domainChecker.py

@@ -6,20 +6,32 @@ function log(msg)
             name: '+log',
             payload: msg
         });
-        recv('+log-ack', function () {}).wait();
+        //recv('+log-ack', function () {});//.wait();
     }
 };
 
 
 var ptrMessageBoxA = Module.findExportByName("user32.dll","MessageBoxA");
 var MessageBoxA=new NativeFunction(ptrMessageBoxA,'int',['int','pointer','pointer','int'],'stdcall');
-log("ptrMessageBoxA :"+ptrMessageBoxA);
-Interceptor.replace(ptrMessageBoxA,new NativeCallback(function (hwnd,pText,pTitle,type) {
-    strText=Memory.readAnsiString(pText);
-    strTitle=Memory.readAnsiString(pTitle);
-    log("MessageBoxA "+strText+" with title "+strTitle);
-    strHook=Memory.allocAnsiString("hooked!");
-    return MessageBoxA(hwnd,strHook,pTitle,type);
+// log("ptrMessageBoxA :"+ptrMessageBoxA);
+// Interceptor.replace(ptrMessageBoxA,new NativeCallback(function (hwnd,pText,pTitle,type) {
+//     strText=Memory.readAnsiString(pText);
+//     strTitle=Memory.readAnsiString(pTitle);
+//     log("MessageBoxA "+strText+" with title "+strTitle);
+//     strHook=Memory.allocAnsiString("hooked!");
+//     return MessageBoxA(hwnd,strHook,pTitle,type);
+//
+// },'int',['int','pointer','pointer','int'],'stdcall'));
 
-},'int',['int','pointer','pointer','int'],'stdcall'));
+var ptrMessageBoxW = Module.findExportByName("user32.dll","MessageBoxW");
+var MessageBoxW=new NativeFunction(ptrMessageBoxW,'int',['int','pointer','pointer','int'],'stdcall');
+log("ptrMessageBoxW :"+ptrMessageBoxW);
+Interceptor.replace(ptrMessageBoxW,new NativeCallback(function (hwnd,pText,pTitle,type) {
+    strText=Memory.readUtf8String(pText);
+    strTitle=Memory.readUtf8String(pTitle);
+    log("MessageBoxW "+strText+" with title "+strTitle);
+    strHookText=Memory.allocAnsiString("text hooked!");
+    strHookTitle=Memory.allocAnsiString("title hooked!");
+    return MessageBoxA(hwnd,strHookText,strHookTitle,type);
 
+},'int',['int','pointer','pointer','int'],'stdcall'));