Python dilinde "PyRun_StringFlags_Type" fonksiyonunu hooklayarak çalıştırılan execleri çekebilirsiniz.
(Not: Bazı custom obfuscatorlar genellikle derlenmiş kodlarını çalıştırmak için exec kullanırlar. İşinize yarayabilir)
C++:
#include <windows.h>
#include <detours.h>
#include <iostream>
#include <fstream>
typedef int (*PyRun_StringFlags_Type)(const char* str, int start, void* globals, void* locals, void* flags);
PyRun_StringFlags_Type digerpyrunstringflags = nullptr;
int WINAPI kaltakpyrunstringflags(const char* str, int start, void* globals, void* locals, void* flags)
{
if (str != nullptr)
{
std::cout << "exec:\n";
std::cout << "-----\n";
std::cout << str << "\n";
std::cout << "-----\n\n";
}
return digerpyrunstringflags(str, start, globals, locals, flags);
}
BOOL APIENTRY dllmain(HMODULE hModule, DWORD reason, LPVOID lpReserved)
{
switch (reason)
{
case DLL_PROCESS_ATTACH:
{
HMODULE pythondllkardesim = GetModuleHandle(L"python311.dll");
if (pythondllkardesim == NULL) {
return FALSE;
}
digerpyrunstringflags = (PyRun_StringFlags_Type)GetProcAddress(pythondllkardesim, "PyRun_StringFlags");
if (digerpyrunstringflags == NULL) {
return FALSE;
}
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourAttach(&(PVOID&)digerpyrunstringflags, kaltakpyrunstringflags);
if (DetourTransactionCommit() != NO_ERROR) {
return FALSE;
}
break;
}
case DLL_PROCESS_DETACH:
{
DetourTransactionBegin();
DetourUpdateThread(GetCurrentThread());
DetourDetach(&(PVOID&)digerpyrunstringflags, kaltakpyrunstringflags);
DetourTransactionCommit();
break;
}
}
return TRUE;
}