diff options
Diffstat (limited to 'general/obcallback/control/main.cpp')
| -rw-r--r-- | general/obcallback/control/main.cpp | 320 |
1 files changed, 320 insertions, 0 deletions
diff --git a/general/obcallback/control/main.cpp b/general/obcallback/control/main.cpp new file mode 100644 index 00000000..e5a36224 --- /dev/null +++ b/general/obcallback/control/main.cpp @@ -0,0 +1,320 @@ +/*++ + +Module Name: + + main.cpp + +Abstract: + + Main module for for ps/Ob sample + +Notice: + + Use this sample code at your own risk; there is no support from Microsoft for the sample code. + In addition, this sample code is licensed to you under the terms of the Microsoft Public License + (http://www.microsoft.com/opensource/licenses.mspx) + + +--*/ + +#include "pch.h" +#include "common.h" + +// +// PrintUsage +// + +void TcPrintUsage() +{ + puts ("Usage:"); + puts (""); + puts(" ObCallbackTestCtrl.exe -install -name NameofExe -reject NameofExe -uninstall -deprotect [-?]"); + puts(" -install install driver"); + puts(" -uninstall uninstall driver"); + puts(" -name NameofExe protect/filter access to NameofExe"); + puts(" -reject NameofExe prevents execution of NameofExe"); + puts(" -deprotect unprotect/unfilter"); +} + +// +// wmain() +// + +int _cdecl +wmain ( + _In_ int argc, + _In_reads_(argc) LPCWSTR argv[] +) +{ + int ExitCode = ERROR_SUCCESS; + + if (argc > 1) + { + const wchar_t * arg = argv[1]; + + // initialize globals and logging + if (!TcInitialize()) { + puts("Initialization failed - program exiting"); + ExitCode = ERROR_FUNCTION_FAILED; + goto Exit; + } + + if (0 == wcscmp (arg, L"-install")) { + TcInstallDriver(); + } else + if (0 == wcscmp (arg, L"-uninstall")) { + TcUninstallDriver(); + } else + if ((0 == wcscmp (arg, L"-?")) || (0 == wcscmp (arg, L"-h")) || (0 == wcscmp (arg, L"-help"))) { + TcPrintUsage(); + } else + if (0 == wcscmp (arg, L"-deprotect")) { + TcRemoveProtection(); + } else + if (0 == wcscmp (arg, L"-name")) { + TcProcessName (argc, argv, TDProtectName_Protect); + } else + if (0 == wcscmp (arg, L"-reject")) { + TcProcessName (argc, argv, TDProtectName_Reject); + } else { + puts ("Unknown command!"); + TcPrintUsage(); + } + + } + else + { + TcPrintUsage(); + } + +Exit: + + if (!TcUnInitialize()) { + puts("UnInitialization failed"); + ExitCode = ERROR_FUNCTION_FAILED; + } + + return ExitCode; +} + + + +// +// TcRemoveProtection +// + +BOOL TcRemoveProtection () +{ + BOOL ReturnValue = FALSE; + + LOG_INFO(_T("TcRemoveProtection: Entering")); + + + // + // Open a handle to the device. + // + + ReturnValue = TcOpenDevice(); + if (ReturnValue != TRUE) + { + LOG_INFO_FAILURE (_T("TcOpenDevice failed")); + goto Exit; + } + + + // + // Send the command to the driver + // + ReturnValue = TcUnprotectCallback(); + if (ReturnValue != TRUE) + { + LOG_INFO_FAILURE (_T("TcUnprotectCallback failed")); + goto Exit; + } + +Exit: + + // + // Close our handle to the device. + // + + ReturnValue = TcCloseDevice(); + if (ReturnValue != TRUE) + { + LOG_INFO_FAILURE (_T("TcCloseDevice failed")); + } + + + LOG_INFO(_T("TcRemoveProtection: Exiting")); + + return ReturnValue; +} + + +// +// TcProcessName +// + +BOOL TcProcessName( + _In_ int argc, + _In_reads_(argc) LPCWSTR argv[], + _In_ ULONG ulOperation +) +{ + BOOL ReturnValue = FALSE; + + PCWSTR pwProcessName = NULL; + + LOG_INFO(L"TcProcessName: Entering"); + + + // + // Parse command line. + // + // argv[1] is "-name" so starting from arg #2 that should be the process name to protect + // + + if (argc < 3) { + LOG_INFO_FAILURE (L"TcProcessName: Too few parameters"); + LOG_INFO_FAILURE (L"TcProcessName: Usage -name nameofExe -reject nameofExe"); + ReturnValue = FALSE; + goto Exit; + } + + pwProcessName = argv[2]; + + if (!pwProcessName) { + LOG_INFO_FAILURE (L"TcProcessName: NULL process name to process"); + ReturnValue = FALSE; + goto Exit; + } + + + LOG_INFO(L"Ready to copy process name"); + LOG_INFO(L"Name to pass to driver %ls", pwProcessName); + + + // + // Open a handle to the device. + // + + ReturnValue = TcOpenDevice(); + if (ReturnValue != TRUE) + { + LOG_INFO_FAILURE (L"TcProcessName: TcOpenDevice failed"); + goto Exit; + } + + + // + // Send process name to protect and the command to the driver + // + ReturnValue = TcProcessNameCallback(pwProcessName, ulOperation); + if (ReturnValue != TRUE) + { + LOG_INFO_FAILURE (L"TcProcessName: TcProcessNameCallback failed"); + goto Exit; + } + +Exit: + + // + // Close our handle to the device. + // + + ReturnValue = TcCloseDevice(); + if (ReturnValue != TRUE) + { + LOG_INFO_FAILURE (L"TcProtectProcess: TcCloseDevice failed"); + } + + + LOG_INFO(L"TcProtectProcess: Exiting"); + + return ReturnValue; +} + + + +// +// TcInstallDriver - installs the kernel driver +// + +BOOL TcInstallDriver () +{ + BOOL bRC = TRUE; + + LOG_INFO(L"TcInstallDriver: Entering"); + BOOL Result = TcLoadDriver(); + + if (Result != TRUE) + { + LOG_ERROR (L"TcLoadDriver failed, exiting"); + bRC = FALSE; + goto Exit; + } + +Exit: + + LOG_INFO(L"TcInstallDriver: Exiting"); + return bRC; +} + + +// +// TcUninstallDriver - uninstalls the kernel driver +// + +BOOL TcUninstallDriver () +{ + BOOL bRC = TRUE; + + LOG_INFO(L"TcUninstallDriver: Entering"); + BOOL Result = TcUnloadDriver(); + + if (Result != TRUE) + { + LOG_ERROR (L"TcUnloadDriver failed, exiting"); + bRC = FALSE; + goto Exit; + } + +Exit: + + LOG_INFO(L"TcUninstallDriver: Exiting"); + return bRC; +} + + +// +// TcInitialize +// + +BOOL bLoggingInitialized = FALSE; + +BOOL TcInitialize () +{ + + BOOL Result = TcInitializeGlobals(); + if (Result != TRUE) + { + LOG_ERROR (L"TcInitializeGlobals failed, exiting"); + return FALSE; + } + + LOG_INFO(L"TcInitialize: Entering"); + return TRUE; + +} + +// +// TcUnInitialize +// + +BOOL TcUnInitialize() +{ + if (TcCleanupSCM() == FALSE){ + LOG_ERROR (L"TcUnInitialize failed cleanup of SCM"); + } + return TRUE; +} |