Changeset 1763

Timestamp:

08/22/08 11:05:31 (3 months ago)

Author:

xkovah

Message:

BAM! By throwing cmd.exe into a job object, I can make it so that when I terminate the job object, I terminate cmd.exe and whatever child processes it spawned to open the document. While we don't want to terminate it in the malicious case (we will need to query the events buffer which I need to find or make to see if it is empty), in the non-malicious case, we need to clean up so that the VM can be reused without having a bunch of open documents/applications sucking up memory

Files:

• capture-mod/trunk/CaptureSoapServer.cpp (modified) (3 diffs)
• capture-mod/trunk/CaptureSoapServer.h (modified) (1 diff)
• capture-mod/trunk/install/CaptureBAT.exe (modified) (previous)

capture-mod/trunk/CaptureSoapServer.cpp

@@ -11 +11 @@
-#include "Visitor.h"
-#include "b64.h"
+//#include <winbase.h> //Shouldn't need to include this
-
-CaptureSoapServer::CaptureSoapServer(Visitor* v){
@@ -196 +197 @@
-    //Create the string for the parameters
-    wchar_t * docName = new wchar_t[1024];
-
+
+
+
+
+
+
+
-
-    //open with cmd.exe
-    STARTUPINFO myStart;
-    memset(&myStart, 0, sizeof(STARTUPINFO));
-    myStart.dwFlags = 0;
-    PROCESS_INFORMATION procInfo;
-L""
+docName
-                            NULL, NULL, &myStart, &procInfo);
-    if(!b){
@@ -209 +215 @@
-        return SOAP_ERR;
-    }
+    
+    //Add the process to the job object
+    b = AssignProcessToJobObject(myJobObj, procInfo.hProcess);
+    if(!b){
+        printf("AssignProcessToJobObject failed with error %d\n", GetLastError());
+        return SOAP_ERR;
+    }
-
-    if(debug) printf("dwProcessId = %d, dwThreadId = %d\n", procInfo.dwProcessId, procInfo.dwThreadId);
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-    CloseHandle(procInfo.hProcess);
-    CloseHandle(procInfo.hThread);
-
+    result = 1;
-    return SOAP_OK;
-}

capture-mod/trunk/CaptureSoapServer.h

@@ -4 +4 @@
-
-#pragma once
-//#include "captureGSOAP
+#include "CaptureGlobal
-#include "Thread.h"
-
-#include "CaptureGlobal.h"
-#include <string>
-#include <queue>