From 44ff0cfd6bd87e4fbd8458502bd9dccb4c9cf938 Mon Sep 17 00:00:00 2001 From: Peter LaFosse Date: Fri, 2 Aug 2024 13:12:18 -0400 Subject: Add workflow for identifying TerminateProcess(GetCurrentProcess) --- view/pe/peview.cpp | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'view/pe/peview.cpp') diff --git a/view/pe/peview.cpp b/view/pe/peview.cpp index 8c2f3020..98cef6ed 100644 --- a/view/pe/peview.cpp +++ b/view/pe/peview.cpp @@ -2782,6 +2782,16 @@ bool PEView::Init() m_logger->LogWarn("Failed to parse resource directory: %s\n", e.what()); } + Ref programSettings = Settings::Instance(); + if (programSettings->Contains("core.function.analyzeConditionalNoReturns") && + opt.subsystem != IMAGE_SUBSYSTEM_NATIVE && ( + GetSymbolByRawName("TerminateProcess", GetExternalNameSpace()) || + GetSymbolByRawName("_TerminateProcess@8", GetExternalNameSpace()))) + { + // TerminateProcess is imported and this is a user mode file + programSettings->Set("corePlugins.workflows.conditionalNoReturn", true); + } + // Add a symbol for the entry point if (m_entryPoint) DefineAutoSymbol(new Symbol(FunctionSymbol, "_start", m_imageBase + m_entryPoint)); -- cgit v1.3.1