HollowsHunter
Scans all running processes. Recognizes and dumps a variety of potentially malicious implants (replaced/implanted PEs, shellcodes, hooks, in-memory patches).
Loading...
Searching...
No Matches
etw_settings.cpp
Go to the documentation of this file.
1#include "etw_settings.h"
2
3#include <string>
4#include <vector>
5#include <sstream>
6#include <fstream>
7
8#define WATCH_PROCESS_START "WATCH_PROCESS_START"
9#define WATCH_IMG_LOAD "WATCH_IMG_LOAD"
10#define WATCH_ALLOCATION "WATCH_ALLOCATION"
11#define WATCH_TCP_IP "WATCH_TCP_IP"
12#define WATCH_OBJ_MGR "WATCH_OBJ_MGR"
13
14namespace util {
15
16 std::string WHITESPACES = " \t\n\v\f\r";
17
18 static inline void ltrim(std::string& s)
19 {
20 size_t startpos = s.find_first_not_of(WHITESPACES);
21 if (startpos != std::string::npos) {
22 s = s.substr(startpos);
23 }
24 }
25
26 static inline void rtrim(std::string& s)
27 {
28 size_t endpos = s.find_last_not_of(WHITESPACES);
29 if (endpos != std::string::npos) {
30 s = s.substr(0, endpos + 1);
31 }
32 }
33
34 std::string trim(std::string& s)
35 {
36 ltrim(s);
37 rtrim(s);
38 return s;
39 }
40
41 bool iequals(const std::string& a, const std::string& b)
42 {
43 size_t aLen = a.size();
44 if (b.size() != aLen) return false;
45
46 for (size_t i = 0; i < aLen; ++i) {
47 if (tolower(a[i]) != tolower(b[i])) return false;
48 }
49 return true;
50 }
51
52 size_t splitList(const std::string& sline, const char delimiter, std::vector<std::string>& args)
53 {
54 std::istringstream f(sline);
55 std::string s;
56 while (getline(f, s, delimiter)) {
57 args.push_back(s);
58 }
59 return args.size();
60 }
61
62
63 int loadInt(const std::string& str, bool as_hex=false)
64 {
65 int intVal = 0;
66
67 std::stringstream ss;
68 ss << (as_hex ? std::hex : std::dec) << str;
69 ss >> intVal;
70
71 return intVal;
72 }
73
74 bool loadBoolean(const std::string& str, bool defaultVal)
75 {
76 if (util::iequals(str, "True") || util::iequals(str, "on") || util::iequals(str, "yes")) {
77 return true;
78 }
79 if (util::iequals(str, "False") || util::iequals(str, "off") || util::iequals(str, "no")) {
80 return false;
81 }
82 const int val = loadInt(str);
83 if (val == 0) return false;
84 return true;
85 }
86
87 std::string booleanToStr(bool val)
88 {
89 return (val) ? "True": "False";
90 }
91
92
93}; // util
94
95//---
96const char ETWProfile::DELIM = '=';
97
98void ETWProfile::stripComments(std::string& str)
99{
100 size_t found = str.find_first_of(";#");
101 if (found != std::string::npos) {
102 str.resize(found);
103 }
104}
105
106bool ETWProfile::fillSettings(const std::string &line)
107{
108 using namespace util;
109
110 std::vector<std::string> args;
111 util::splitList(line, DELIM, args);
112
113 if (args.size() < 2) {
114 return false;
115 }
116 bool isFilled = false;
117 std::string valName = args[0];
118 std::string valStr = args[1];
119 util::trim(valName);
120 util::trim(valStr);
121
122 if (util::iequals(valName, WATCH_PROCESS_START)) {
123 this->process_start = loadBoolean(valStr, this->process_start);
124 isFilled = true;
125 }
126 if (util::iequals(valName, WATCH_IMG_LOAD)) {
127 this->img_load = loadBoolean(valStr, this->img_load);
128 isFilled = true;
129 }
130 if (util::iequals(valName, WATCH_ALLOCATION)) {
131 this->allocation = loadBoolean(valStr, this->allocation);
132 isFilled = true;
133 }
134 if (util::iequals(valName, WATCH_TCP_IP)) {
135 this->tcpip = loadBoolean(valStr, this->tcpip);
136 isFilled = true;
137 }
138 if (util::iequals(valName, WATCH_OBJ_MGR)) {
139 this->obj_mgr = loadBoolean(valStr, this->obj_mgr);
140 isFilled = true;
141 }
142 return isFilled;
143}
144
145bool ETWProfile::loadIni(const std::string& filename)
146{
147 std::ifstream myfile(filename.c_str());
148 if (!myfile.is_open()) {
149 return false;
150 }
151 const size_t MAX_LINE = 300;
152 char line[MAX_LINE] = { 0 };
153 bool filledAny = false;
154
155 while (!myfile.eof()) {
156 myfile.getline(line, MAX_LINE);
157 std::string lineStr = line;
158 stripComments(lineStr);
159
160 if (fillSettings(lineStr)) {
161 filledAny = true;
162 }
163 }
164 myfile.close();
165 return filledAny;
166}
167
168bool ETWProfile::saveIni(const std::string& filename)
169{
170 using namespace util;
171 std::ofstream myfile(filename.c_str());
172 if (!myfile.is_open()) {
173 return false;
174 }
175 myfile << WATCH_PROCESS_START << DELIM << booleanToStr(this->process_start) << "\n";
176 myfile << WATCH_IMG_LOAD << DELIM << booleanToStr(this->img_load) << "\n";
177 myfile << WATCH_ALLOCATION << DELIM << booleanToStr(this->allocation) << "\n";
178 myfile << WATCH_TCP_IP << DELIM << booleanToStr(this->tcpip) << "\n";
179 myfile << WATCH_OBJ_MGR << DELIM << booleanToStr(this->obj_mgr) << "\n";
180 myfile.close();
181 return true;
182}
#define WATCH_TCP_IP
#define WATCH_ALLOCATION
#define WATCH_IMG_LOAD
#define WATCH_PROCESS_START
#define WATCH_OBJ_MGR
std::string WHITESPACES
size_t splitList(const std::string &sline, const char delimiter, std::vector< std::string > &args)
std::string booleanToStr(bool val)
bool iequals(const std::string &a, const std::string &b)
std::string trim(std::string &s)
int loadInt(const std::string &str, bool as_hex=false)
bool loadBoolean(const std::string &str, bool defaultVal)
bool fillSettings(const std::string &line)
bool allocation
Definition etw_settings.h:9
void stripComments(std::string &str)
bool loadIni(const std::string &fileName)
static const char DELIM
bool process_start
Definition etw_settings.h:7
bool img_load
Definition etw_settings.h:8
bool saveIni(const std::string &fileName)