Skip to content

Exception in anti_injection #10

@dimakad

Description

@dimakad

Just found exception on triggering:
module.anti_injection(python_dll='python312.dll')

Seems like ntd1l.dll is related to Sentinel One security agent, but not sure. Any way, seems like a check is required before reading DLL.

Exception in thread Thread-1 (monitor_dll_bytes):
Traceback (most recent call last):
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python312\Lib\threading.py", line 1073, in _bootstrap_inner
    self.run()
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python312\Lib\threading.py", line 1010, in run
    self._target(*self._args, **self._kwargs)
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python312\Lib\site-packages\guardshield\main.py", line 118, in monitor_dll_bytes
    res = dll_scan.check_dll_bytes()
          ^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python312\Lib\site-packages\guardshield\utils\dll_scan.py", line 54, in check_dll_bytes
    module_bytes = read_bytes_from_file(module_path)
                   ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\Users\xxx\AppData\Local\Programs\Python\Python312\Lib\site-packages\guardshield\utils\dll_scan.py", line 25, in read_bytes_from_file
    with open(file_path, 'rb') as file:
         ^^^^^^^^^^^^^^^^^^^^^
FileNotFoundError: [Errno 2] No such file or directory: 'C:\\Windows\\SYSTEM32\\ntd1l.dll'

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions