HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Toggle main menu visibility
Loading...
Searching...
No Matches
etw_settings.cpp
Go to the documentation of this file.
1
#include "
etw_settings.h
"
2
3
#include <string>
4
#include <vector>
5
#include <sstream>
6
#include <fstream>
7
8
#define WATCH_PROCESS_START "WATCH_PROCESS_START"
9
#define WATCH_IMG_LOAD "WATCH_IMG_LOAD"
10
#define WATCH_ALLOCATION "WATCH_ALLOCATION"
11
#define WATCH_TCP_IP "WATCH_TCP_IP"
12
#define WATCH_OBJ_MGR "WATCH_OBJ_MGR"
13
14
namespace
util
{
15
16
std::string
WHITESPACES
=
" \t\n\v\f\r"
;
17
18
static
inline
void
ltrim(std::string& s)
19
{
20
size_t
startpos = s.find_first_not_of(
WHITESPACES
);
21
if
(startpos != std::string::npos) {
22
s = s.substr(startpos);
23
}
24
}
25
26
static
inline
void
rtrim(std::string& s)
27
{
28
size_t
endpos = s.find_last_not_of(
WHITESPACES
);
29
if
(endpos != std::string::npos) {
30
s = s.substr(0, endpos + 1);
31
}
32
}
33
34
std::string
trim
(std::string& s)
35
{
36
ltrim(s);
37
rtrim(s);
38
return
s;
39
}
40
41
bool
iequals
(
const
std::string& a,
const
std::string& b)
42
{
43
size_t
aLen = a.size();
44
if
(b.size() != aLen)
return
false
;
45
46
for
(
size_t
i = 0; i < aLen; ++i) {
47
if
(tolower(a[i]) != tolower(b[i]))
return
false
;
48
}
49
return
true
;
50
}
51
52
size_t
splitList
(
const
std::string& sline,
const
char
delimiter, std::vector<std::string>& args)
53
{
54
std::istringstream f(sline);
55
std::string s;
56
while
(getline(f, s, delimiter)) {
57
args.push_back(s);
58
}
59
return
args.size();
60
}
61
62
63
int
loadInt
(
const
std::string& str,
bool
as_hex=
false
)
64
{
65
int
intVal = 0;
66
67
std::stringstream ss;
68
ss << (as_hex ? std::hex : std::dec) << str;
69
ss >> intVal;
70
71
return
intVal;
72
}
73
74
bool
loadBoolean
(
const
std::string& str,
bool
defaultVal)
75
{
76
if
(
util::iequals
(str,
"True"
) ||
util::iequals
(str,
"on"
) ||
util::iequals
(str,
"yes"
)) {
77
return
true
;
78
}
79
if
(
util::iequals
(str,
"False"
) ||
util::iequals
(str,
"off"
) ||
util::iequals
(str,
"no"
)) {
80
return
false
;
81
}
82
const
int
val =
loadInt
(str);
83
if
(val == 0)
return
false
;
84
return
true
;
85
}
86
87
std::string
booleanToStr
(
bool
val)
88
{
89
return
(val) ?
"True"
:
"False"
;
90
}
91
92
93
};
// util
94
95
//---
96
const
char
ETWProfile::DELIM
=
'='
;
97
98
void
ETWProfile::stripComments
(std::string& str)
99
{
100
size_t
found = str.find_first_of(
";#"
);
101
if
(found != std::string::npos) {
102
str.resize(found);
103
}
104
}
105
106
bool
ETWProfile::fillSettings
(
const
std::string &line)
107
{
108
using namespace
util
;
109
110
std::vector<std::string> args;
111
util::splitList
(line,
DELIM
, args);
112
113
if
(args.size() < 2) {
114
return
false
;
115
}
116
bool
isFilled =
false
;
117
std::string valName = args[0];
118
std::string valStr = args[1];
119
util::trim
(valName);
120
util::trim
(valStr);
121
122
if
(
util::iequals
(valName,
WATCH_PROCESS_START
)) {
123
this->
process_start
=
loadBoolean
(valStr, this->
process_start
);
124
isFilled =
true
;
125
}
126
if
(
util::iequals
(valName,
WATCH_IMG_LOAD
)) {
127
this->
img_load
=
loadBoolean
(valStr, this->
img_load
);
128
isFilled =
true
;
129
}
130
if
(
util::iequals
(valName,
WATCH_ALLOCATION
)) {
131
this->
allocation
=
loadBoolean
(valStr, this->
allocation
);
132
isFilled =
true
;
133
}
134
if
(
util::iequals
(valName,
WATCH_TCP_IP
)) {
135
this->
tcpip
=
loadBoolean
(valStr, this->
tcpip
);
136
isFilled =
true
;
137
}
138
if
(
util::iequals
(valName,
WATCH_OBJ_MGR
)) {
139
this->
obj_mgr
=
loadBoolean
(valStr, this->
obj_mgr
);
140
isFilled =
true
;
141
}
142
return
isFilled;
143
}
144
145
bool
ETWProfile::loadIni
(
const
std::string& filename)
146
{
147
std::ifstream myfile(filename.c_str());
148
if
(!myfile.is_open()) {
149
return
false
;
150
}
151
const
size_t
MAX_LINE = 300;
152
char
line[MAX_LINE] = { 0 };
153
bool
filledAny =
false
;
154
155
while
(!myfile.eof()) {
156
myfile.getline(line, MAX_LINE);
157
std::string lineStr = line;
158
stripComments
(lineStr);
159
160
if
(
fillSettings
(lineStr)) {
161
filledAny =
true
;
162
}
163
}
164
myfile.close();
165
return
filledAny;
166
}
167
168
bool
ETWProfile::saveIni
(
const
std::string& filename)
169
{
170
using namespace
util
;
171
std::ofstream myfile(filename.c_str());
172
if
(!myfile.is_open()) {
173
return
false
;
174
}
175
myfile <<
WATCH_PROCESS_START
<<
DELIM
<<
booleanToStr
(this->
process_start
) <<
"\n"
;
176
myfile <<
WATCH_IMG_LOAD
<<
DELIM
<<
booleanToStr
(this->
img_load
) <<
"\n"
;
177
myfile <<
WATCH_ALLOCATION
<<
DELIM
<<
booleanToStr
(this->
allocation
) <<
"\n"
;
178
myfile <<
WATCH_TCP_IP
<<
DELIM
<<
booleanToStr
(this->
tcpip
) <<
"\n"
;
179
myfile <<
WATCH_OBJ_MGR
<<
DELIM
<<
booleanToStr
(this->
obj_mgr
) <<
"\n"
;
180
myfile.close();
181
return
true
;
182
}
WATCH_TCP_IP
#define WATCH_TCP_IP
Definition
etw_settings.cpp:11
WATCH_ALLOCATION
#define WATCH_ALLOCATION
Definition
etw_settings.cpp:10
WATCH_IMG_LOAD
#define WATCH_IMG_LOAD
Definition
etw_settings.cpp:9
WATCH_PROCESS_START
#define WATCH_PROCESS_START
Definition
etw_settings.cpp:8
WATCH_OBJ_MGR
#define WATCH_OBJ_MGR
Definition
etw_settings.cpp:12
etw_settings.h
util
Definition
etw_settings.cpp:14
util::WHITESPACES
std::string WHITESPACES
Definition
etw_settings.cpp:16
util::splitList
size_t splitList(const std::string &sline, const char delimiter, std::vector< std::string > &args)
Definition
etw_settings.cpp:52
util::booleanToStr
std::string booleanToStr(bool val)
Definition
etw_settings.cpp:87
util::iequals
bool iequals(const std::string &a, const std::string &b)
Definition
etw_settings.cpp:41
util::trim
std::string trim(std::string &s)
Definition
etw_settings.cpp:34
util::loadInt
int loadInt(const std::string &str, bool as_hex=false)
Definition
etw_settings.cpp:63
util::loadBoolean
bool loadBoolean(const std::string &str, bool defaultVal)
Definition
etw_settings.cpp:74
ETWProfile::fillSettings
bool fillSettings(const std::string &line)
Definition
etw_settings.cpp:106
ETWProfile::obj_mgr
bool obj_mgr
Definition
etw_settings.h:11
ETWProfile::allocation
bool allocation
Definition
etw_settings.h:9
ETWProfile::stripComments
void stripComments(std::string &str)
Definition
etw_settings.cpp:98
ETWProfile::loadIni
bool loadIni(const std::string &fileName)
Definition
etw_settings.cpp:145
ETWProfile::DELIM
static const char DELIM
Definition
etw_settings.h:55
ETWProfile::tcpip
bool tcpip
Definition
etw_settings.h:10
ETWProfile::process_start
bool process_start
Definition
etw_settings.h:7
ETWProfile::img_load
bool img_load
Definition
etw_settings.h:8
ETWProfile::saveIni
bool saveIni(const std::string &fileName)
Definition
etw_settings.cpp:168
Generated by
1.17.0