#include "utilsSSP.h" const char* LOG_TYPE_STRINGS[LOG_TYPE_COUNT] = { "INFO", "WARNING", "ERROR", "DEBUG" }; PCWSTR W_LOG_TYPE_STRINGS[LOG_TYPE_COUNT] = { L"INFO", L"WARNING", L"ERROR", L"DEBUG" }; //mapowanie nazw ze struktury SECURITY_LOGON_TYPE const char* LOGON_TYPE_STRINGS[] = { "UndefinedLogonType", "UnknownLogonType1", "Interactive", "Network", "Batch", "Service", "Proxy", "Unlock", "NetworkCleartext", "NewCredentials", "RemoteInteractive", "CachedInteractive", "CachedRemoteInteractive", "CachedUnlock" }; PCWSTR W_LOGON_TYPE_STRINGS[] = { L"UndefinedLogonType", L"UnknownLogonType1", L"Interactive", L"Network", L"Batch", L"Service", L"Proxy", L"Unlock", L"NetworkCleartext", L"NewCredentials", L"RemoteInteractive", L"CachedInteractive", L"CachedRemoteInteractive", L"CachedUnlock" }; HANDLE log_file = NULL; BOOL g_logfile_lock_initialized = FALSE; CRITICAL_SECTION g_logfile_lock; const WCHAR rublon_log_filepath[] = L"C:\\RublonSSP.log"; #ifdef _DEBUG void send_to_interprocess_pipe(const char* msg) { HANDLE hPipe = CreateFileA( "\\\\.\\pipe\\sspmonitor", GENERIC_WRITE, 0, NULL, OPEN_EXISTING, 0, NULL ); if (hPipe != INVALID_HANDLE_VALUE) { DWORD bytesWritten; WriteFile(hPipe, msg, (DWORD)strlen(msg), &bytesWritten, NULL); CloseHandle(hPipe); } } #endif //_DEBUG void init_logfile_lock() { if (!g_logfile_lock_initialized) { InitializeCriticalSection(&g_logfile_lock); g_logfile_lock_initialized = TRUE; } } BOOL create_log_file(LPCWSTR log_filename) { if (log_file != NULL && log_file != INVALID_HANDLE_VALUE) { return TRUE; } bool if_new_file = GetFileAttributesW(log_filename) == INVALID_FILE_ATTRIBUTES; log_file = CreateFileW(log_filename, FILE_APPEND_DATA, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL); if (log_file == INVALID_HANDLE_VALUE) { log_file = NULL; return FALSE; } if (if_new_file) { WORD bom = 0xFEFF; DWORD written; WriteFile(log_file, &bom, sizeof(bom), &written, NULL); } WCHAR function_name[64] = { 0 }; MultiByteToWideChar(CP_ACP, 0, __FUNCTION__, -1, function_name, ARRAYSIZE(function_name)); log_line(LOG_TYPE_INFO, L"[%s] Utworzono plik log: %s", function_name, log_filename ); get_process_details(); return TRUE; } void log_line(LOG_TYPE msg_type, PCWSTR msg_fmt, ...) { SYSTEMTIME st; WCHAR date_type_buff[128] = { 0 }; WCHAR var_args[896] = { 0 }; WCHAR log_buff[MAX_LOG_LINE] = { 0 }; GetLocalTime(&st); StringCchPrintfW(date_type_buff, ARRAYSIZE(date_type_buff), L"[%s][%04d-%02d-%02d %02d:%02d:%02d.%03d]", W_LOG_TYPE_STRINGS[msg_type], st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond, st.wMilliseconds); /* wsprintfW(date_type_buff, L"[%s][%04d-%02d-%02d %02d:%02d:%02d.%03d] ", W_LOG_TYPE_STRINGS[msg_type], st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond, st.wMilliseconds);*/ va_list args; va_start(args, msg_fmt); StringCchVPrintfW(var_args, ARRAYSIZE(var_args), msg_fmt, args); va_end(args); StringCchPrintfW(log_buff, ARRAYSIZE(log_buff), L"%s%s\r\n", date_type_buff, var_args); DWORD written = 0; WriteFile(log_file, log_buff, lstrlenW(log_buff) * sizeof(WCHAR), &written, NULL); } void get_process_details() { WCHAR buff[256] = { 0 }; DWORD pid = GetCurrentProcessId(); WCHAR path[MAX_PATH]; if (!GetModuleFileNameW(NULL, path, MAX_PATH)) { lstrcpyW(path, L""); } wsprintfW(buff, L"PID procesu: %lu, Sciezka do pliku: %s", pid, path); log_line(LOG_TYPE_INFO, L"%s", buff); } PCWSTR check_unicode_string(PUNICODE_STRING u_str) { return (u_str && u_str->Buffer && u_str->Length > 0) ? u_str->Buffer : L""; } LPCWSTR check_string(LPCWSTR str) { return (str != NULL && *str != L'\0') ? str : L""; } BOOL compare_unicode_with_wchar(PUNICODE_STRING u_str, WCHAR* name) { if (!u_str || !u_str->Buffer || !name) return FALSE; size_t unicode_str_len = u_str->Length / sizeof(WCHAR); const WCHAR* ptr1 = u_str->Buffer; const WCHAR* ptr2 = name; //log_line(LOG_TYPE_DEBUG, L"[%s] str1 = %s, str2 = %s", L"compare_unicode_with_wchar", u_str->Buffer, name); size_t name_len = 0; if (!SUCCEEDED(StringCchLengthW(name, STRSAFE_MAX_CCH, &name_len))) return FALSE; if (unicode_str_len != name_len) return FALSE; for (size_t i = 0; i < unicode_str_len; i++) { if (ptr1[i] != ptr2[i]) { //log_line(LOG_TYPE_DEBUG, L"[%s] Porownywane ciagi znakow sa rozne...", L"compare_unicode_with_wchar"); return FALSE; } } /* log_line(LOG_TYPE_DEBUG, L"[%s] Porownywane ciagi znakow sa identyczne...", L"compare_unicode_with_wchar"); */ return TRUE; } void copy_lpwstr_string(LPWSTR in, WCHAR* out, size_t out_size) { if (out == NULL || out_size == 0) return; if (in != NULL && *in != L'\0') { StringCchCopyW(out, out_size, in); } else { StringCchCopyW(out, out_size, L""); } } void copy_lpwstr_string(LPCWSTR in, WCHAR* out, size_t out_size) { if (out == NULL || out_size == 0) return; if (in != NULL && *in != L'\0') { StringCchCopyW(out, out_size, in); } else { StringCchCopyW(out, out_size, L""); } } void check_SID(PSID psid, PWSTR out_buff, size_t out_buff_size) { if (!psid || !IsValidSid(psid)) { StringCchCopyW(out_buff, out_buff_size, L""); return; } LPWSTR sid_string = nullptr; if (ConvertSidToStringSidW(psid, &sid_string)) { StringCchCopyW(out_buff, out_buff_size, sid_string); LocalFree(sid_string); } else { StringCchCopyW(out_buff, out_buff_size, L""); } } LPCWSTR remote_protocol_type_to_string(USHORT proto) { switch (proto) { case WTS_PROTOCOL_CONSOLE: return L"Console"; case WTS_PROTOCOL_SHADOW: return L"Shadow"; case WTS_PROTOCOL_RDP: return L"RDP"; default: return L""; } }