JPCERTCC/YAMA

Try/catch on failed processes

Opened this issue · 0 comments

When running Yama.exe with -a, it will iterate through all processes, however will run to exception and quits when fetching the PEB address fails, and will not continue iterating further on other processes in the list.

Example: Lsalso.exe

trace    : now scanning pid: 1880 (yamascanner.cpp:ScanPidList L#12)
error    : Failed to get address of PEB. error_code: %lu (998:process.cpp L#Peb)

Would be a nice enhancement to keep iterating through the other processes and simply skip on the failed process.