Expand behavior log process information with image base, image size a…

…nd bitness
kevoreilly · Sep 13, 2024 · ba39c0c · ba39c0c
1 parent 14dd5b6
commit ba39c0c
Show file tree

Hide file tree

Showing 4 changed files with 14 additions and 0 deletions.
diff --git a/analyzer/windows/dll/capemon.dll b/analyzer/windows/dll/capemon.dll
diff --git a/analyzer/windows/dll/capemon_x64.dll b/analyzer/windows/dll/capemon_x64.dll
diff --git a/changelog.md b/changelog.md
@@ -1,3 +1,8 @@
+### [13.09.2024]
+* Fix issue with sign extension causing 32-bit values to be misrepresented in web ui (e.g. 0xffffffffc000005 for 0xc000005)
+* bytes2str(): if any values in dict type are already str then keep them
+* Expand behavior log process information with image base, image size and bitness
+
 ### [10.09.2024]
 * Monitor update: Add capability to dynamically unhook previously hooked functions (unhook-apis option takes colon-separated list e.g. unhook-apis=NtSetInformationThread:NtDelayExecution)
 * Themida detonation shim

diff --git a/web/templates/analysis/behavior/_processes.html b/web/templates/analysis/behavior/_processes.html
@@ -135,6 +135,15 @@
                 {% if process.environ.CommandLine %}
                 <br />Command Line: <b>{{ process.environ.CommandLine }}</b>
                 {% endif %}
+                {% if process.environ.MainExeBase %}
+                    <br />Image Base: <b>{{ process.environ.MainExeBase }}</b>,
+                {% endif %}
+                {% if process.environ.MainExeSize %}
+                    Image Size: <b>{{ process.environ.MainExeSize }}</b>,
+                {% endif %}
+                {% if process.environ.Bitness %}
+                    <b>{{ process.environ.Bitness }}</b>
+                {% endif %}
             </div>
 
             <div>