[FEATURE] Added one more exclusion case to the return integrity check

hasherezade · Sep 8, 2024 · b2ac6af · b2ac6af
1 parent 7173a46
commit b2ac6af
Showing 1 changed file with 5 additions and 0 deletions.
diff --git a/scanners/thread_scanner.cpp b/scanners/thread_scanner.cpp
@@ -185,6 +185,11 @@ bool pesieve::ThreadScanner::checkReturnAddrIntegrity(IN const std::vector<ULONG
 	if (this->info.ext.wait_reason == Suspended && callStack.size() == 1 && lastFuncCalled == "RtlUserThreadStart" && this->info.last_syscall == 0) {
 		return true; //normal for suspended threads
 	}
+	if (this->info.ext.wait_reason == UserRequest && syscallFuncName == "NtWaitForSingleObject") {
+		if (lastFuncCalled.rfind("NtQuery", 0) == 0 || lastFuncCalled.rfind("ZwQuery", 0) == 0) {
+			return true;
+		}
+	}
 	if (syscallFuncName == "NtCallbackReturn") {
 		const ScannedModule* mod = modulesInfo.findModuleContaining(lastCalled);
 		if (mod && mod->getModName() == "win32u.dll") return true;