HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
etw_settings.cpp
Go to the documentation of this file.
1#include "etw_settings.h"
2
3#include <string>
4#include <vector>
5#include <sstream>
6#include <fstream>
7
8#define WATCH_PROCESS_START "WATCH_PROCESS_START"
9#define WATCH_IMG_LOAD "WATCH_IMG_LOAD"
10#define WATCH_ALLOCATION "WATCH_ALLOCATION"
11#define WATCH_TCP_IP "WATCH_TCP_IP"
12#define WATCH_OBJ_MGR "WATCH_OBJ_MGR"
13
14namespace util {
15
16 static inline void ltrim(std::string& s)
17 {
18 s.erase(s.begin(), std::find_if(s.begin(), s.end(), [](unsigned char ch) {
19 return !std::isspace(ch);
20 }));
21 }
22
23 static inline void rtrim(std::string& s)
24 {
25 s.erase(std::find_if(s.rbegin(), s.rend(), [](unsigned char ch) {
26 return !std::isspace(ch);
27 }).base(), s.end());
28 }
29
30 void trim(std::string& s)
31 {
32 ltrim(s);
33 rtrim(s);
34 }
35
36 bool iequals(const std::string& a, const std::string& b)
37 {
38 size_t aLen = a.size();
39 if (b.size() != aLen) return false;
40
41 for (size_t i = 0; i < aLen; ++i) {
42 if (tolower(a[i]) != tolower(b[i])) return false;
43 }
44 return true;
45 }
46
47 size_t splitList(const std::string& sline, const char delimiter, std::vector<std::string>& args)
48 {
49 std::istringstream f(sline);
50 std::string s;
51 while (getline(f, s, delimiter)) {
52 args.push_back(s);
53 }
54 return args.size();
55 }
56
57
58 int loadInt(const std::string& str, bool as_hex=false)
59 {
60 int intVal = 0;
61
62 std::stringstream ss;
63 ss << (as_hex ? std::hex : std::dec) << str;
64 ss >> intVal;
65
66 return intVal;
67 }
68
69 bool loadBoolean(const std::string& str, bool defaultVal)
70 {
71 if (util::iequals(str, "True") || util::iequals(str, "on") || util::iequals(str, "yes")) {
72 return true;
73 }
74 if (util::iequals(str, "False") || util::iequals(str, "off") || util::iequals(str, "no")) {
75 return false;
76 }
77 const int val = loadInt(str);
78 if (val == 0) return false;
79 return true;
80 }
81
82 std::string booleanToStr(bool val)
83 {
84 return (val) ? "True": "False";
85 }
86
87
88}; // util
89
90//---
91const char ETWProfile::DELIM = '=';
92
93void ETWProfile::stripComments(std::string& str)
94{
95 size_t found = str.find_first_of(";#");
96 if (found != std::string::npos) {
97 str.resize(found);
98 }
99}
100
101bool ETWProfile::fillSettings(std::string line)
102{
103 using namespace util;
104
105 std::vector<std::string> args;
106 util::splitList(line, DELIM, args);
107
108 if (args.size() < 2) {
109 return false;
110 }
111 bool isFilled = false;
112 std::string valName = args[0];
113 std::string valStr = args[1];
114 util::trim(valName);
115 util::trim(valStr);
116
117 if (util::iequals(valName, WATCH_PROCESS_START)) {
118 this->process_start = loadBoolean(valStr, this->process_start);
119 isFilled = true;
120 }
121 if (util::iequals(valName, WATCH_IMG_LOAD)) {
122 this->img_load = loadBoolean(valStr, this->img_load);
123 isFilled = true;
124 }
125 if (util::iequals(valName, WATCH_ALLOCATION)) {
126 this->allocation = loadBoolean(valStr, this->allocation);
127 isFilled = true;
128 }
129 if (util::iequals(valName, WATCH_TCP_IP)) {
130 this->tcpip = loadBoolean(valStr, this->tcpip);
131 isFilled = true;
132 }
133 if (util::iequals(valName, WATCH_OBJ_MGR)) {
134 this->obj_mgr = loadBoolean(valStr, this->obj_mgr);
135 isFilled = true;
136 }
137 return isFilled;
138}
139
140bool ETWProfile::loadIni(const std::string& filename)
141{
142 std::ifstream myfile(filename.c_str());
143 if (!myfile.is_open()) {
144 return false;
145 }
146 const size_t MAX_LINE = 300;
147 char line[MAX_LINE] = { 0 };
148 bool filledAny = false;
149
150 while (!myfile.eof()) {
151 myfile.getline(line, MAX_LINE);
152 std::string lineStr = line;
153 stripComments(lineStr);
154
155 if (fillSettings(lineStr)) {
156 filledAny = true;
157 }
158 }
159 myfile.close();
160 return filledAny;
161}
162
163bool ETWProfile::saveIni(const std::string& filename)
164{
165 using namespace util;
166 std::ofstream myfile(filename.c_str());
167 if (!myfile.is_open()) {
168 return false;
169 }
170 myfile << WATCH_PROCESS_START << DELIM << booleanToStr(this->process_start) << "\n";
171 myfile << WATCH_IMG_LOAD << DELIM << booleanToStr(this->img_load) << "\n";
172 myfile << WATCH_ALLOCATION << DELIM << booleanToStr(this->allocation) << "\n";
173 myfile << WATCH_TCP_IP << DELIM << booleanToStr(this->tcpip) << "\n";
174 myfile << WATCH_OBJ_MGR << DELIM << booleanToStr(this->obj_mgr) << "\n";
175 myfile.close();
176 return true;
177}
#define WATCH_TCP_IP
#define WATCH_ALLOCATION
#define WATCH_IMG_LOAD
#define WATCH_PROCESS_START
#define WATCH_OBJ_MGR
void trim(std::string &s)
size_t splitList(const std::string &sline, const char delimiter, std::vector< std::string > &args)
std::string booleanToStr(bool val)
bool iequals(const std::string &a, const std::string &b)
int loadInt(const std::string &str, bool as_hex=false)
bool loadBoolean(const std::string &str, bool defaultVal)
bool allocation
Definition etw_settings.h:9
void stripComments(std::string &str)
bool loadIni(const std::string &fileName)
static const char DELIM
bool process_start
Definition etw_settings.h:7
bool fillSettings(std::string line)
bool img_load
Definition etw_settings.h:8
bool saveIni(const std::string &fileName)