Program behavior analyzer for Win32/Win64.
Program behavior analyzer for Win32/Win64
English | 简体中文
PEDoll is a parody of @matrixcascade's PeDoll (the "original PeDoll"), aimed to support the x64 platform, multiple clients and multi-threaded applications.
PEDoll consists of three parts:
libDoll.dll
). libDoll communicates with the Controller, installs inline hooks into the process and respond to the Controller's commands in case of a hook has activated.These parts communicate by the Puppet Protocol, a simple, TCP-based scheme of packets.
PEDoll works by installing hooks on Windows APIs or inner procedures into a Doll process, wait for hooks to activate, then examine the hooks' context (function arguments, memory buffers, etc.) and give out verdicts on whether the process can continue execution.
You can get a prebulit PEDoll package from the "Releases" page, or compile it yourself with instructions below.
Comparing to the original PeDoll:
The project's wiki provides a simple example.
More & detailed information on commands, expressions, etc. will be available on the project's wiki.
The IDE of choice is Visual Studio Community 2019 with workloads Desktop development with C++
(for building the Monitor and libDoll) and .NET desktop development
(for building the Controller).
This project utilizes Detours and includes it as a git submodule. In order to build the Monitor and libDoll, you need to obtain it by either use git clone --recursive https://github.com/EZForever/PEDoll.git
while cloning this repo, or run git submodule update --init --recursive
afterwards.
Do not expect all features in Controller to work when debugging; important files like Monitor executables and scripts will be missing. The file GenerateRelease.cmd
, when run under a Visual Studio Developer Command Prompt, will build the whole solution, place all files accordingly and process all API scripts to support x64. Always use the build generated by GenerateRelease.cmd
for normal usage.
More information on implementation details will be available on the project's wiki.