OnlineChecks: Fix dumb VTAPI responses for recapcha
@@ -839,7 +839,10 @@ NTSTATUS UploadFileThreadStart(
if (jsonRootObject = PhCreateJsonParser(jsonString->Buffer))
{
- // New interface
+ PPH_STRING permalink = PhGetJsonValueAsString(jsonRootObject, "permalink");
+
+ if (PhIsNullOrEmptyString(permalink))
+ {
if (jsonDataObject = PhGetJsonObject(jsonRootObject, "data"))
{
PPH_STRING analysisId = PhGetJsonValueAsString(jsonDataObject, "id");
@@ -853,12 +856,16 @@ NTSTATUS UploadFileThreadStart(
}
else
{
- // Old interface
if (PhGetJsonValueAsLong64(jsonRootObject, "response_code") == 1)
{
PhMoveReference(&context->LaunchCommand, PhGetJsonValueAsString(jsonRootObject, "permalink"));
}
}
+ }
+ else
+ {
+ PhMoveReference(&context->LaunchCommand, PhGetJsonValueAsString(jsonRootObject, "permalink"));
+ }
PhFreeJsonParser(jsonRootObject);
}
@@ -1190,6 +1197,22 @@ NTSTATUS UploadCheckThreadStart(
PPH_BYTES vt3UploadRequestBuffer;
PVOID vt3RootJsonObject;
+ if (context->VtApiUpload)
+ {
+ PPH_BYTES resource = VirusTotalGetCachedDbHash(&ProcessObjectDbHash);
+
+ PhMoveReference(&context->UploadUrl, PhFormatString(
+ L"%s%s?\x0061\x0070\x0069\x006B\x0065\x0079=%S&resource=%s",
+ L"https://www.virustotal.com",
+ L"/vtapi/v2/file/scan",
+ resource->Buffer,
+ PhGetString(context->FileHash)
+ ));
+
+ PhClearReference(&resource);
+ }
+ else
+ {
vt3UploadUrl = PhCreateString(L"/ui/files/upload_url");
if (!(vt3UploadRequestBuffer = PerformSubRequest(
@@ -1208,6 +1231,9 @@ NTSTATUS UploadCheckThreadStart(
PhFreeJsonParser(vt3RootJsonObject);
}
+ PhClearReference(&vt3UploadRequestBuffer);
+ }
+
// No file found... Start the upload.
if (!PhIsNullOrEmptyString(context->UploadUrl))
{
@@ -1217,8 +1243,6 @@ NTSTATUS UploadCheckThreadStart(
{
RaiseUploadError(context, L"Received invalid VT3 response.", RtlNtStatusToDosError(STATUS_FAIL_CHECK));
}
-
- PhClearReference(&vt3UploadRequestBuffer);
}
PhFreeJsonParser(rootJsonObject);
