Skip to content
This repository has been archived by the owner on Jul 23, 2020. It is now read-only.

Add new APIs #40

Open
RaoufAbderrahmane opened this issue Feb 18, 2015 · 7 comments
Open

Add new APIs #40

RaoufAbderrahmane opened this issue Feb 18, 2015 · 7 comments

Comments

@RaoufAbderrahmane
Copy link

i want to add some new APIs to cuckoomon dll and delete some APIs but i'm noob and i don't know which file i need to modify so pleas help me. thanks
API that i want to add :
(kernel32, LocalFree)
(kernel32, GetModuleFileNameA)
(kernel32, LoadLibraryA)
(kernel32, GetVersion)
(user32, LoadImageA)
(user32, DefWindowProcA)
(user32, CreateWindowExA)
(user32, GetWindowThreadProcessId)
(advapi32, RegOpenKeyA)
(user32, GetFocus)
(user32, GetWindow)
(kernel32,CloseHandle)
(kernel32, GetPrivateProfileStringA)
(kernel32, GetWindowsDirectoryA)
(user32, WindowFromPoint)
(kernel32, LoadLibraryW)
(kernel32, FindFirstFileA)
(kernel32, FindNextFileA)
(user32, GetDlgItem)
(kernel32, RegOpenCurrentUser)
(advapi32, RegOpenKeyW)
(user32, LoadStringW)
(user32, SystemParametersInfoA)
(kernel32, GetSystemDirectoryA)
(advapi32, RegCreateKeyW)
(kernel32, CreateFileA)
(kernel32, ReadFile)
(kernel32, WriteFile)
(kernel32,CreateFileMappingA)
(kernel32, CreateFileW)
(kernel32, FreeResource)
(kernel32, CreateProcessW)
(kernel32, SetFileAttributesA)
(kernel32, FindFirstFileW)
(advapi32, RegCreateKeyA)
(kernel32, OpenProcess)
(kernel32, CreateDirectoryA)
(user32, SendDlgItemMessageA)
(wininet, InternetSetOptionA)
(kernel32, FindResourceExA)
(kernel32, GetCommandLineW)
(kernel32, IsValidLocale)
(kernel32, Process32Next)
(kernel32, CreateProcessA)
kernel32, MoveFileA)
(kernel32, GlobalReAlloc)
(kernel32, SetEndOfFile)
(advapi32, GetSecurityDescriptorDacl)
(user32, SetWindowTextW)
(kernel32, GetStartupInfoW)
(wininet, InternetSetOptionW)
(kernel32, TerminateProcess)
(kernel32, MoveFileExA)
(user32, CharUpperW)
(kernel32, GetConsoleOutputCP)
(kernel32, MoveFileExW)

@jbremer
Copy link
Member

jbremer commented Feb 19, 2015

Hi Raouf,

I don't actively maintain CuckooMon anymore, rather, in the next upcoming version of Cuckoo I'm going to integrate the new Monitor (https://github.com/jbremer/monitor). So it'd make more sense to add certain functions there.
Other than that, although I definitely like your request for new functions, your list kind of looks like a dump of an IAT of some sample - a bunch of functions are either already in the monitor (and cuckoomon, as well) or are arguably not that interesting.
So if you could take a few minutes to trim the list down then we can work from there (e.g., CreateProcessA is already being hooked as CreateProcessInternalW, CharUpperW sounds like it'd create a lot of garbage data, etc).
Unfortunately there's no list of all hooked functions in the new monitor, but you can browse through them here: https://github.com/jbremer/monitor/tree/master/sigs.

Thanks!

@RaoufAbderrahmane
Copy link
Author

Hi,

First thank's for reply;

In fact I have a master 2 project in which I have to build a classificaion model for malware detection. To build the model I have to monitor only a subset of 126 apis functions from cuckoo sandbox.

The problem is that I don't know exactly how to add apis.

-Then please could you simply explain me and show me just by ONE example for one function api(Let's say CharUpperW api fucntion) how add it STEP BY STEP; from zero to the last; all modification I have to do in all files...etc, in order to display finaly this api in the log file output by cuckoo sandbox.

@jhg
Copy link

jhg commented Apr 6, 2015

@jbremer when the new monitor will be add to cuckoo organization and replace to old monitor? Is https://github.com/jbremer/monitor the "main" repo for new monitor?

@jbremer
Copy link
Member

jbremer commented Apr 7, 2015

@jhg For the 1.3 release, I guess. Yes, that's currently still the main repository.

@jhg
Copy link

jhg commented Apr 7, 2015

@jbremer thank you for info. And there is a date estimated for 1.3 release? New monitor will have hardening for don't need patch it?

@jbremer
Copy link
Member

jbremer commented Apr 7, 2015

@jhg I'll try to do as much as possible. If you have 'hardening requests', please do let me know, though. Feel free to send me an email or leave a pull request for the new monitor.

@jhg
Copy link

jhg commented Apr 8, 2015

@jbremer I'm beginner in cuckoo, I don't know so cuckoo code as for write new feature still, when I learn more I would like leave pull request. Many books explain about hardening with pafish and editing hook_reg for a malware don't read reg keys about VirtualBox, VMware, etc; I think it is good for use in cuckoo by default, without modify the monitor.

Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
None yet
Projects
None yet
Development

No branches or pull requests

3 participants