From a49f027fdeb82f25a10b4e32c76f7ce196674ac1 Mon Sep 17 00:00:00 2001 From: es3n1n Date: Wed, 7 May 2025 17:01:09 +0900 Subject: [PATCH] initial --- .clang-format | 108 ++++++ .gitignore | 352 ++++++++++++++++++ .gitmodules | 3 + LICENSE | 201 ++++++++++ README.md | 44 +++ cxx-shared/cxx-shared.vcxitems | 23 ++ cxx-shared/cxx-shared.vcxitems.user | 6 + cxx-shared/shared/ctx.hpp | 52 +++ cxx-shared/shared/defer.hpp | 30 ++ cxx-shared/shared/ipc.hpp | 83 +++++ cxx-shared/shared/names.hpp | 10 + cxx-shared/shared/util.hpp | 30 ++ defendnot-loader/core/autorun.cpp | 177 +++++++++ defendnot-loader/core/core.hpp | 19 + defendnot-loader/core/inject.cpp | 58 +++ defendnot-loader/defendnot-loader.vcxproj | 262 +++++++++++++ .../defendnot-loader.vcxproj.filters | 33 ++ .../defendnot-loader.vcxproj.user | 18 + defendnot-loader/main.cpp | 127 +++++++ defendnot.sln | 81 ++++ defendnot/bootstrap/bootstrap.cpp | 40 ++ defendnot/bootstrap/bootstrap.hpp | 5 + defendnot/core/com.hpp | 73 ++++ defendnot/core/log.hpp | 19 + defendnot/defendnot.vcxproj | 263 +++++++++++++ defendnot/defendnot.vcxproj.filters | 36 ++ defendnot/defendnot.vcxproj.user | 6 + defendnot/dllmain.cpp | 47 +++ vendor/argparse | 1 + wsc-binary-check/main.cpp | 129 +++++++ wsc-binary-check/wsc-binary-check.vcxproj | 245 ++++++++++++ .../wsc-binary-check.vcxproj.filters | 22 ++ .../wsc-binary-check.vcxproj.user | 6 + 33 files changed, 2609 insertions(+) create mode 100644 .clang-format create mode 100644 .gitignore create mode 100644 .gitmodules create mode 100644 LICENSE create mode 100644 README.md create mode 100644 cxx-shared/cxx-shared.vcxitems create mode 100644 cxx-shared/cxx-shared.vcxitems.user create mode 100644 cxx-shared/shared/ctx.hpp create mode 100644 cxx-shared/shared/defer.hpp create mode 100644 cxx-shared/shared/ipc.hpp create mode 100644 cxx-shared/shared/names.hpp create mode 100644 cxx-shared/shared/util.hpp create mode 100644 defendnot-loader/core/autorun.cpp create mode 100644 defendnot-loader/core/core.hpp create mode 100644 defendnot-loader/core/inject.cpp create mode 100644 defendnot-loader/defendnot-loader.vcxproj create mode 100644 defendnot-loader/defendnot-loader.vcxproj.filters create mode 100644 defendnot-loader/defendnot-loader.vcxproj.user create mode 100644 defendnot-loader/main.cpp create mode 100644 defendnot.sln create mode 100644 defendnot/bootstrap/bootstrap.cpp create mode 100644 defendnot/bootstrap/bootstrap.hpp create mode 100644 defendnot/core/com.hpp create mode 100644 defendnot/core/log.hpp create mode 100644 defendnot/defendnot.vcxproj create mode 100644 defendnot/defendnot.vcxproj.filters create mode 100644 defendnot/defendnot.vcxproj.user create mode 100644 defendnot/dllmain.cpp create mode 160000 vendor/argparse create mode 100644 wsc-binary-check/main.cpp create mode 100644 wsc-binary-check/wsc-binary-check.vcxproj create mode 100644 wsc-binary-check/wsc-binary-check.vcxproj.filters create mode 100644 wsc-binary-check/wsc-binary-check.vcxproj.user diff --git a/.clang-format b/.clang-format new file mode 100644 index 0000000..70d161e --- /dev/null +++ b/.clang-format @@ -0,0 +1,108 @@ +# es3n1n's clang-format -- 29 jun 2023 11:20:59 -- https://pastebin.com/4mtxipKe +--- +AlignAfterOpenBracket: Align +AlignEscapedNewlines: Left +AlignOperands: Align +AlignTrailingComments: false +AllowAllArgumentsOnNextLine: false +AllowAllParametersOfDeclarationOnNextLine: false +AllowShortBlocksOnASingleLine: Empty +AllowShortCaseLabelsOnASingleLine: false +AllowShortLambdasOnASingleLine: Inline +AllowShortEnumsOnASingleLine: false +AllowShortFunctionsOnASingleLine: Empty +AllowShortIfStatementsOnASingleLine: Never +AllowShortLoopsOnASingleLine: false +AlwaysBreakAfterReturnType: None +AlwaysBreakBeforeMultilineStrings: false +AlwaysBreakTemplateDeclarations: Yes +BasedOnStyle: WebKit +BinPackArguments: true +BinPackParameters: true +BitFieldColonSpacing: None +BraceWrapping: + AfterCaseLabel: false + AfterClass: false + AfterControlStatement: Never + AfterEnum: false + AfterFunction: false + AfterNamespace: false + AfterObjCDeclaration: false + AfterStruct: false + AfterUnion: false + AfterExternBlock: false + BeforeCatch: false + BeforeElse: false + IndentBraces: false + SplitEmptyFunction: false + SplitEmptyRecord: false + SplitEmptyNamespace: false + BeforeLambdaBody: false + BeforeWhile: false +BreakBeforeBinaryOperators: None +BreakBeforeBraces: Custom +BreakBeforeInheritanceComma: false +BreakInheritanceList: BeforeColon +BreakBeforeConceptDeclarations: false +BreakBeforeTernaryOperators: false +BreakConstructorInitializers: BeforeColon +BreakAfterJavaFieldAnnotations: false +BreakStringLiterals: true +ColumnLimit: 155 +CompactNamespaces: false +ConstructorInitializerAllOnOneLineOrOnePerLine: false +ConstructorInitializerIndentWidth : 4 +ContinuationIndentWidth: 4 +Cpp11BracedListStyle: true +DeriveLineEnding: true +DerivePointerAlignment: false +EmptyLineBeforeAccessModifier: Always +ExperimentalAutoDetectBinPacking: false +FixNamespaceComments: true +IncludeBlocks: Preserve +IndentCaseBlocks: false +IndentCaseLabels: false +IndentExternBlock: Indent +IndentGotoLabels: false +IndentPPDirectives: BeforeHash +IndentWrappedFunctionNames: false +InsertTrailingCommas: None +Language: Cpp +NamespaceIndentation: All +PenaltyBreakAssignment: 2 +PenaltyBreakBeforeFirstCallParameter: 19 +PenaltyBreakComment: 300 +PenaltyBreakFirstLessLess: 120 +PenaltyBreakString: 1000 +PenaltyBreakTemplateDeclaration: 10 +PenaltyExcessCharacter: 1000000 +PenaltyIndentedWhitespace: 0 +PenaltyReturnTypeOnItsOwnLine: 60 +PointerAlignment: Left +ReflowComments: true +SortIncludes: CaseInsensitive +SortUsingDeclarations: true +SpaceAfterCStyleCast: false +SpaceAfterLogicalNot: false +SpaceAfterTemplateKeyword: true +SpaceAroundPointerQualifiers: Default +SpaceBeforeAssignmentOperators: true +SpaceBeforeCaseColon: false +SpaceBeforeCpp11BracedList: false +SpaceBeforeCtorInitializerColon: false +SpaceBeforeInheritanceColon: true +SpaceBeforeParens: ControlStatements +SpaceBeforeRangeBasedForLoopColon: true +SpaceBeforeSquareBrackets: false +SpaceInEmptyBlock: true +SpaceInEmptyParentheses: false +SpacesBeforeTrailingComments: 1 +SpacesInAngles: false +SpacesInContainerLiterals: true +SpacesInCStyleCastParentheses: false +SpacesInConditionalStatement: false +SpacesInParentheses: false +SpacesInSquareBrackets: false +Standard: Latest +TabWidth: 8 +UseCRLF: false \ No newline at end of file diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..27e6996 --- /dev/null +++ b/.gitignore @@ -0,0 +1,352 @@ +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +# *.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +bld/ +[Bb]in/ +[Oo]bj/ +[Ll]og/ +[Ll]ogs/ +intermediates/* +output/* + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ \ No newline at end of file diff --git a/.gitmodules b/.gitmodules new file mode 100644 index 0000000..ec2c90e --- /dev/null +++ b/.gitmodules @@ -0,0 +1,3 @@ +[submodule "vendor/argparse"] + path = vendor/argparse + url = https://github.com/p-ranav/argparse.git diff --git a/LICENSE b/LICENSE new file mode 100644 index 0000000..e82c6f4 --- /dev/null +++ b/LICENSE @@ -0,0 +1,201 @@ + Apache License + Version 2.0, January 2004 + http://www.apache.org/licenses/ + + TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION + + 1. Definitions. + + "License" shall mean the terms and conditions for use, reproduction, + and distribution as defined by Sections 1 through 9 of this document. + + "Licensor" shall mean the copyright owner or entity authorized by + the copyright owner that is granting the License. + + "Legal Entity" shall mean the union of the acting entity and all + other entities that control, are controlled by, or are under common + control with that entity. For the purposes of this definition, + "control" means (i) the power, direct or indirect, to cause the + direction or management of such entity, whether by contract or + otherwise, or (ii) ownership of fifty percent (50%) or more of the + outstanding shares, or (iii) beneficial ownership of such entity. + + "You" (or "Your") shall mean an individual or Legal Entity + exercising permissions granted by this License. + + "Source" form shall mean the preferred form for making modifications, + including but not limited to software source code, documentation + source, and configuration files. + + "Object" form shall mean any form resulting from mechanical + transformation or translation of a Source form, including but + not limited to compiled object code, generated documentation, + and conversions to other media types. + + "Work" shall mean the work of authorship, whether in Source or + Object form, made available under the License, as indicated by a + copyright notice that is included in or attached to the work + (an example is provided in the Appendix below). + + "Derivative Works" shall mean any work, whether in Source or Object + form, that is based on (or derived from) the Work and for which the + editorial revisions, annotations, elaborations, or other modifications + represent, as a whole, an original work of authorship. For the purposes + of this License, Derivative Works shall not include works that remain + separable from, or merely link (or bind by name) to the interfaces of, + the Work and Derivative Works thereof. + + "Contribution" shall mean any work of authorship, including + the original version of the Work and any modifications or additions + to that Work or Derivative Works thereof, that is intentionally + submitted to Licensor for inclusion in the Work by the copyright owner + or by an individual or Legal Entity authorized to submit on behalf of + the copyright owner. For the purposes of this definition, "submitted" + means any form of electronic, verbal, or written communication sent + to the Licensor or its representatives, including but not limited to + communication on electronic mailing lists, source code control systems, + and issue tracking systems that are managed by, or on behalf of, the + Licensor for the purpose of discussing and improving the Work, but + excluding communication that is conspicuously marked or otherwise + designated in writing by the copyright owner as "Not a Contribution." + + "Contributor" shall mean Licensor and any individual or Legal Entity + on behalf of whom a Contribution has been received by Licensor and + subsequently incorporated within the Work. + + 2. Grant of Copyright License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + copyright license to reproduce, prepare Derivative Works of, + publicly display, publicly perform, sublicense, and distribute the + Work and such Derivative Works in Source or Object form. + + 3. Grant of Patent License. Subject to the terms and conditions of + this License, each Contributor hereby grants to You a perpetual, + worldwide, non-exclusive, no-charge, royalty-free, irrevocable + (except as stated in this section) patent license to make, have made, + use, offer to sell, sell, import, and otherwise transfer the Work, + where such license applies only to those patent claims licensable + by such Contributor that are necessarily infringed by their + Contribution(s) alone or by combination of their Contribution(s) + with the Work to which such Contribution(s) was submitted. If You + institute patent litigation against any entity (including a + cross-claim or counterclaim in a lawsuit) alleging that the Work + or a Contribution incorporated within the Work constitutes direct + or contributory patent infringement, then any patent licenses + granted to You under this License for that Work shall terminate + as of the date such litigation is filed. + + 4. Redistribution. You may reproduce and distribute copies of the + Work or Derivative Works thereof in any medium, with or without + modifications, and in Source or Object form, provided that You + meet the following conditions: + + (a) You must give any other recipients of the Work or + Derivative Works a copy of this License; and + + (b) You must cause any modified files to carry prominent notices + stating that You changed the files; and + + (c) You must retain, in the Source form of any Derivative Works + that You distribute, all copyright, patent, trademark, and + attribution notices from the Source form of the Work, + excluding those notices that do not pertain to any part of + the Derivative Works; and + + (d) If the Work includes a "NOTICE" text file as part of its + distribution, then any Derivative Works that You distribute must + include a readable copy of the attribution notices contained + within such NOTICE file, excluding those notices that do not + pertain to any part of the Derivative Works, in at least one + of the following places: within a NOTICE text file distributed + as part of the Derivative Works; within the Source form or + documentation, if provided along with the Derivative Works; or, + within a display generated by the Derivative Works, if and + wherever such third-party notices normally appear. The contents + of the NOTICE file are for informational purposes only and + do not modify the License. You may add Your own attribution + notices within Derivative Works that You distribute, alongside + or as an addendum to the NOTICE text from the Work, provided + that such additional attribution notices cannot be construed + as modifying the License. + + You may add Your own copyright statement to Your modifications and + may provide additional or different license terms and conditions + for use, reproduction, or distribution of Your modifications, or + for any such Derivative Works as a whole, provided Your use, + reproduction, and distribution of the Work otherwise complies with + the conditions stated in this License. + + 5. Submission of Contributions. Unless You explicitly state otherwise, + any Contribution intentionally submitted for inclusion in the Work + by You to the Licensor shall be under the terms and conditions of + this License, without any additional terms or conditions. + Notwithstanding the above, nothing herein shall supersede or modify + the terms of any separate license agreement you may have executed + with Licensor regarding such Contributions. + + 6. Trademarks. This License does not grant permission to use the trade + names, trademarks, service marks, or product names of the Licensor, + except as required for reasonable and customary use in describing the + origin of the Work and reproducing the content of the NOTICE file. + + 7. Disclaimer of Warranty. Unless required by applicable law or + agreed to in writing, Licensor provides the Work (and each + Contributor provides its Contributions) on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or + implied, including, without limitation, any warranties or conditions + of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A + PARTICULAR PURPOSE. You are solely responsible for determining the + appropriateness of using or redistributing the Work and assume any + risks associated with Your exercise of permissions under this License. + + 8. Limitation of Liability. In no event and under no legal theory, + whether in tort (including negligence), contract, or otherwise, + unless required by applicable law (such as deliberate and grossly + negligent acts) or agreed to in writing, shall any Contributor be + liable to You for damages, including any direct, indirect, special, + incidental, or consequential damages of any character arising as a + result of this License or out of the use or inability to use the + Work (including but not limited to damages for loss of goodwill, + work stoppage, computer failure or malfunction, or any and all + other commercial damages or losses), even if such Contributor + has been advised of the possibility of such damages. + + 9. Accepting Warranty or Additional Liability. While redistributing + the Work or Derivative Works thereof, You may choose to offer, + and charge a fee for, acceptance of support, warranty, indemnity, + or other liability obligations and/or rights consistent with this + License. However, in accepting such obligations, You may act only + on Your own behalf and on Your sole responsibility, not on behalf + of any other Contributor, and only if You agree to indemnify, + defend, and hold each Contributor harmless for any liability + incurred by, or claims asserted against, such Contributor by reason + of your accepting any such warranty or additional liability. + + END OF TERMS AND CONDITIONS + + APPENDIX: How to apply the Apache License to your work. + + To apply the Apache License to your work, attach the following + boilerplate notice, with the fields enclosed by brackets "[]" + replaced with your own identifying information. (Don't include + the brackets!) The text should be enclosed in the appropriate + comment syntax for the file format. We also recommend that a + file or class name and description of purpose be included on the + same "printed page" as the copyright notice for easier + identification within third-party archives. + + Copyright 2025-present es3n1n + + Licensed under the Apache License, Version 2.0 (the "License"); + you may not use this file except in compliance with the License. + You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + + Unless required by applicable law or agreed to in writing, software + distributed under the License is distributed on an "AS IS" BASIS, + WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. + See the License for the specific language governing permissions and + limitations under the License. \ No newline at end of file diff --git a/README.md b/README.md new file mode 100644 index 0000000..d312713 --- /dev/null +++ b/README.md @@ -0,0 +1,44 @@ +# defendnot + +An even funnier way to disable windows defender. + +Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender). + +![](https://i.imgur.com/VGE8g6a.jpeg) + +## How it works + +There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender. +This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation. + +The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly. + +## Limitations + +Sadly, to keep this WSC stuff even after reboot, defendnot adds itself to the autorun. Thus, you would need to keep the defendnot binaries on your disk :( + +## Usage + +```commandline +Usage: defendnot-loader [--help] [--version] [--name VAR] [--disable] [--verbose] + +Optional arguments: + -h, --help shows help message and exits + -v, --version prints version information and exits + -n, --name av display name [default: "https://github.com/es3n1n/defendnot"] + -d, --disable disable defendnot + -v, --verbose verbose logging +``` + +## Implementation + +A more detailed writeup will be coming in a few days. + +## Special thanks + +* [mrbruh](https://mrbruh.com) for poking me to research this topic +* [pindos](https://github.com/pind0s) for providing their machine for WSC service debugging + +## License + +Apache-2.0 diff --git a/cxx-shared/cxx-shared.vcxitems b/cxx-shared/cxx-shared.vcxitems new file mode 100644 index 0000000..081badd --- /dev/null +++ b/cxx-shared/cxx-shared.vcxitems @@ -0,0 +1,23 @@ + + + + $(MSBuildAllProjects);$(MSBuildThisFileFullPath) + true + {8704ed28-3d20-4f31-9ba2-9a0040649372} + + + + %(AdditionalIncludeDirectories);$(MSBuildThisFileDirectory) + + + + + + + + + + + + + \ No newline at end of file diff --git a/cxx-shared/cxx-shared.vcxitems.user b/cxx-shared/cxx-shared.vcxitems.user new file mode 100644 index 0000000..429333d --- /dev/null +++ b/cxx-shared/cxx-shared.vcxitems.user @@ -0,0 +1,6 @@ + + + + true + + \ No newline at end of file diff --git a/cxx-shared/shared/ctx.hpp b/cxx-shared/shared/ctx.hpp new file mode 100644 index 0000000..2e439b8 --- /dev/null +++ b/cxx-shared/shared/ctx.hpp @@ -0,0 +1,52 @@ +#pragma once +#include +#include +#include +#include + +#include "shared/util.hpp" + +namespace shared { + constexpr std::size_t kMaxNameLength = 128; + constexpr std::string_view kCtxPath = "ctx.bin"; + + namespace detail { + inline std::string ctx_path() { + auto path = get_this_module_path().parent_path(); + path /= kCtxPath; + return path.string(); + } + } // namespace detail + + enum class State : std::uint8_t { + OFF = 0, + ON, + }; + + inline constinit struct Context { + public: + State state = State::ON; + bool verbose = false; + std::array name = {0}; // +1 for the nullterm + + void serialize() const { + std::ofstream stream(detail::ctx_path(), std::ios::binary); + if (!stream.good()) { + throw std::runtime_error("can not write ctx.bin"); + } + + stream.write(reinterpret_cast(this), sizeof(*this)); + } + + void deserialize() { + std::ifstream stream(detail::ctx_path(), std::ios::binary); + if (!stream.good()) { + throw std::runtime_error("can not read ctx.bin"); + } + + stream.read(reinterpret_cast(this), sizeof(*this)); + } + } ctx = {}; + + static_assert(std::is_trivially_copyable_v); +} // namespace shared diff --git a/cxx-shared/shared/defer.hpp b/cxx-shared/shared/defer.hpp new file mode 100644 index 0000000..ae948c3 --- /dev/null +++ b/cxx-shared/shared/defer.hpp @@ -0,0 +1,30 @@ +#pragma once +#include + +template +class DeferHolder { +public: + explicit DeferHolder(Callable&& callable) noexcept: callable_(std::forward(callable)) { } + + ~DeferHolder() { + callable_(); + } + +private: + Callable callable_; +}; + +class Defer { +public: + constexpr Defer() noexcept = default; + constexpr ~Defer() noexcept = default; + + template + DeferHolder operator%(Callable&& cb) { + return DeferHolder{std::forward(cb)}; + } +}; + +#define COMMON_CAT_(x, y) x##y +#define COMMON_CAT(x, y) COMMON_CAT_(x, y) +#define defer auto COMMON_CAT(_defer_instance_, __LINE__) = Defer{} % [&]() diff --git a/cxx-shared/shared/ipc.hpp b/cxx-shared/shared/ipc.hpp new file mode 100644 index 0000000..d67fac8 --- /dev/null +++ b/cxx-shared/shared/ipc.hpp @@ -0,0 +1,83 @@ +#pragma once +#include + +#include +#include + +namespace shared { + constexpr std::string_view kSegName = "defender-disabler-ipc"; + + enum class InterProcessCommunicationMode : std::uint8_t { + READ = 0, + WRITE, + READ_WRITE, + }; + + class InterProcessCommunication { + class Data { + public: + bool finished = false; + bool success = false; + }; + static_assert(std::is_trivially_copyable_v); + + public: + explicit InterProcessCommunication(InterProcessCommunicationMode mode, bool should_create = false): mode_(mode), was_created_(should_create) { + int flag = mode == InterProcessCommunicationMode::READ ? FILE_MAP_READ : + mode == InterProcessCommunicationMode::READ_WRITE ? FILE_MAP_ALL_ACCESS : + FILE_MAP_WRITE; + + if (should_create) { + setup_handle(CreateFileMappingA(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, sizeof(Data), kSegName.data())); + } else { + setup_handle(OpenFileMappingA(flag, FALSE, kSegName.data())); + } + + data_ = reinterpret_cast(MapViewOfFile(handle_, flag, 0, 0, sizeof(Data))); + if (data_ == nullptr) { + throw std::runtime_error("unable to map ipc"); + } + } + + ~InterProcessCommunication() { + if (data_ != nullptr && was_created_ && + (mode_ == InterProcessCommunicationMode::WRITE || mode_ == InterProcessCommunicationMode::READ_WRITE)) { + /// Erase all data + std::memset(data_, 0, sizeof(*data_)); + } + + if (data_ != nullptr) { + UnmapViewOfFile(data_); + data_ = nullptr; + } + + if (handle_ != INVALID_HANDLE_VALUE) { + CloseHandle(handle_); + handle_ = INVALID_HANDLE_VALUE; + } + } + + [[nodiscard]] Data* operator->() noexcept { + return data_; + } + + private: + void setup_handle(HANDLE handle) { + handle_ = handle; + valid_ = handle_ != INVALID_HANDLE_VALUE; + throw_if_invalid(); + } + + void throw_if_invalid() const { + if (!valid_) { + throw std::runtime_error("unable to access ipc seg"); + } + } + + HANDLE handle_ = INVALID_HANDLE_VALUE; + bool valid_ = false; + Data* data_ = nullptr; + InterProcessCommunicationMode mode_; + bool was_created_; + }; +} // namespace shared \ No newline at end of file diff --git a/cxx-shared/shared/names.hpp b/cxx-shared/shared/names.hpp new file mode 100644 index 0000000..89a6ba0 --- /dev/null +++ b/cxx-shared/shared/names.hpp @@ -0,0 +1,10 @@ +#pragma once +#include + +namespace names { + constexpr std::string_view kProjectName = "defendnot"; + constexpr std::string_view kRepoUrl = "https://github.com/es3n1n/defendnot"; + + constexpr std::string_view kVictimProcess = "Taskmgr.exe"; + constexpr std::string_view kDllName = "defendnot.dll"; +} // namespace names diff --git a/cxx-shared/shared/util.hpp b/cxx-shared/shared/util.hpp new file mode 100644 index 0000000..697cacf --- /dev/null +++ b/cxx-shared/shared/util.hpp @@ -0,0 +1,30 @@ +#pragma once +#include +#include + +#include + +namespace shared { + inline std::filesystem::path get_this_module_path() { + char result[_MAX_PATH] = {0}; + + /// \fixme @es3n1n: This is sketchy + HMODULE h_module = nullptr; + GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT, + reinterpret_cast(&get_this_module_path), &h_module); + + GetModuleFileNameA(h_module, result, sizeof(result)); + return result; + } + + inline void alloc_console() { + static std::once_flag fl; + + /// Most likely the process we're injecting to does not have allocated console + std::call_once(fl, []() -> void { + AllocConsole(); + freopen_s(reinterpret_cast(stdout), "CONOUT$", "w", stdout); + freopen_s(reinterpret_cast(stderr), "CONOUT$", "w", stderr); + }); + } +} // namespace shared diff --git a/defendnot-loader/core/autorun.cpp b/defendnot-loader/core/autorun.cpp new file mode 100644 index 0000000..4bc5248 --- /dev/null +++ b/defendnot-loader/core/autorun.cpp @@ -0,0 +1,177 @@ +#include "core/core.hpp" + +#include "shared/ctx.hpp" +#include "shared/defer.hpp" +#include "shared/names.hpp" + +#include +#include + +#include +#include + +#pragma comment(lib, "taskschd.lib") +#pragma comment(lib, "comsupp.lib") +#pragma comment(lib, "ole32.lib") + +namespace loader { + namespace { + constexpr std::string_view kTaskName = names::kProjectName; + + template + [[nodiscard]] bool with_service(Callable&& callback) { + HRESULT hr = CoInitializeEx(nullptr, COINIT_MULTITHREADED); + if (FAILED(hr)) { + return false; + } + + defer->void { + CoUninitialize(); + }; + + ITaskService* service = nullptr; + hr = CoCreateInstance(CLSID_TaskScheduler, nullptr, CLSCTX_INPROC_SERVER, IID_ITaskService, reinterpret_cast(&service)); + if (FAILED(hr)) { + return false; + } + + defer->void { + service->Release(); + }; + + hr = service->Connect(VARIANT{}, VARIANT{}, VARIANT{}, VARIANT{}); + if (FAILED(hr)) { + return false; + } + + ITaskFolder* root_folder = nullptr; + hr = service->GetFolder(BSTR(L"\\"), &root_folder); + if (FAILED(hr)) { + return false; + } + + defer->void { + root_folder->Release(); + }; + + root_folder->DeleteTask(BSTR(kTaskName.data()), 0); + return callback(service, root_folder); + } + } // namespace + + [[nodiscard]] bool add_to_autorun() { + const auto bin_path = shared::get_this_module_path(); + + return with_service([bin_path](ITaskService* service, ITaskFolder* folder) -> bool { + ITaskDefinition* task = nullptr; + auto hr = service->NewTask(0, &task); + if (FAILED(hr)) { + return false; + } + + defer->void { + task->Release(); + }; + + IRegistrationInfo* reg_info = nullptr; + hr = task->get_RegistrationInfo(®_info); + if (FAILED(hr)) { + return false; + } + + defer->void { + reg_info->Release(); + }; + reg_info->put_Author(_bstr_t(names::kRepoUrl.data())); + + IPrincipal* pPrincipal = nullptr; + hr = task->get_Principal(&pPrincipal); + if (FAILED(hr)) { + return false; + } + + defer->void { + pPrincipal->Release(); + }; + + ITriggerCollection* trigger_collection = nullptr; + hr = task->get_Triggers(&trigger_collection); + if (FAILED(hr)) { + return false; + } + + defer->void { + trigger_collection->Release(); + }; + + ITrigger* trigger = nullptr; + hr = trigger_collection->Create(TASK_TRIGGER_LOGON, &trigger); + if (FAILED(hr)) { + return false; + } + + defer->void { + trigger->Release(); + }; + + IActionCollection* action_collection = nullptr; + hr = task->get_Actions(&action_collection); + if (FAILED(hr)) { + return false; + } + + defer->void { + action_collection->Release(); + }; + + IAction* action = nullptr; + hr = action_collection->Create(TASK_ACTION_EXEC, &action); + if (FAILED(hr)) { + return false; + } + + defer->void { + action->Release(); + }; + + IExecAction* exec_action = nullptr; + hr = action->QueryInterface(IID_IExecAction, (void**)&exec_action); + if (FAILED(hr)) { + return false; + } + + defer->void { + exec_action->Release(); + }; + + ITaskSettings* settings = nullptr; + hr = task->get_Settings(&settings); + if (FAILED(hr)) { + return false; + } + + defer->void { + settings->Release(); + }; + + pPrincipal->put_RunLevel(TASK_RUNLEVEL_HIGHEST); + settings->put_DisallowStartIfOnBatteries(VARIANT_FALSE); + settings->put_StopIfGoingOnBatteries(VARIANT_FALSE); + exec_action->put_Path(_bstr_t(bin_path.string().c_str())); + exec_action->put_Arguments(_bstr_t("--from-autorun")); + + IRegisteredTask* registered_task = nullptr; + hr = folder->RegisterTaskDefinition(_bstr_t(kTaskName.data()), task, TASK_CREATE_OR_UPDATE, VARIANT{}, VARIANT{}, TASK_LOGON_INTERACTIVE_TOKEN, + _variant_t(L""), ®istered_task); + + defer->void { + registered_task->Release(); + }; + return SUCCEEDED(hr); + }); + } + + [[nodiscard]] bool remove_from_autorun() { + return with_service([](TArgs...) -> bool { return true; }); + } +} // namespace loader diff --git a/defendnot-loader/core/core.hpp b/defendnot-loader/core/core.hpp new file mode 100644 index 0000000..37dcca7 --- /dev/null +++ b/defendnot-loader/core/core.hpp @@ -0,0 +1,19 @@ +#pragma once +#include +#include + +#include + +namespace loader { + struct Config { + public: + std::string name; + bool disable; + bool verbose; + bool from_autorun; + }; + + [[nodiscard]] HANDLE inject(std::string_view dll_path, std::string_view proc_name); + [[nodiscard]] bool add_to_autorun(); + [[nodiscard]] bool remove_from_autorun(); +} // namespace loader diff --git a/defendnot-loader/core/inject.cpp b/defendnot-loader/core/inject.cpp new file mode 100644 index 0000000..6cf26fe --- /dev/null +++ b/defendnot-loader/core/inject.cpp @@ -0,0 +1,58 @@ +#include "core/core.hpp" + +#include "shared/defer.hpp" +#include +#include + +#include + +namespace loader { + [[nodiscard]] HANDLE inject(std::string_view dll_path, std::string_view proc_name) { + STARTUPINFOA si = { + .cb = sizeof(si), + }; + PROCESS_INFORMATION pi = { + 0, + }; + SECURITY_ATTRIBUTES sa = { + .nLength = sizeof(sa), + .bInheritHandle = TRUE, + }; + + std::println("** booting {}", proc_name); + if (!CreateProcessA(nullptr, const_cast(proc_name.data()), &sa, &sa, FALSE, CREATE_SUSPENDED, nullptr, nullptr, &si, &pi)) { + throw std::runtime_error(std::format("unable to create process: {}", GetLastError())); + } + + defer->void { + CloseHandle(pi.hThread); + /// Not closing hProcess because we return it + }; + + LPVOID mem = VirtualAllocEx(pi.hProcess, nullptr, dll_path.size() + 1, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); + if (mem == nullptr) { + throw std::runtime_error(std::format("unable to allocate memory: {}", GetLastError())); + } + + defer->void { + VirtualFreeEx(pi.hProcess, mem, 0, MEM_RELEASE); + }; + + if (!WriteProcessMemory(pi.hProcess, mem, dll_path.data(), dll_path.size() + 1, nullptr)) { + throw std::runtime_error(std::format("unable to write memory: {}", GetLastError())); + } + + HANDLE thread = CreateRemoteThread(pi.hProcess, nullptr, 0, reinterpret_cast(LoadLibraryA), mem, 0, nullptr); + if (thread == NULL) { + throw std::runtime_error(std::format("unable to create thread: {}", GetLastError())); + } + + defer->void { + CloseHandle(thread); + }; + + /// Wait for DllMain to complete + WaitForSingleObject(thread, INFINITE); + return pi.hProcess; + } +} // namespace loader diff --git a/defendnot-loader/defendnot-loader.vcxproj b/defendnot-loader/defendnot-loader.vcxproj new file mode 100644 index 0000000..fffd22c --- /dev/null +++ b/defendnot-loader/defendnot-loader.vcxproj @@ -0,0 +1,262 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM64 + + + Release + ARM64 + + + + 17.0 + Win32Proj + {91eb6f68-ce01-45ab-8b74-7fd618fdedb5} + defendnotloader + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + $(SolutionDir)vendor\argparse\include\;$(ProjectDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + true + + + Windows + true + RequireAdministrator + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + $(SolutionDir)vendor\argparse\include\;$(ProjectDir);%(AdditionalIncludeDirectories) + MultiThreaded + true + + + Windows + true + true + true + RequireAdministrator + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + $(SolutionDir)vendor\argparse\include\;$(ProjectDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + true + + + Windows + true + RequireAdministrator + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + $(SolutionDir)vendor\argparse\include\;$(ProjectDir);%(AdditionalIncludeDirectories) + MultiThreaded + true + + + Windows + true + true + true + RequireAdministrator + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + $(SolutionDir)vendor\argparse\include\;$(ProjectDir);%(AdditionalIncludeDirectories) + MultiThreadedDebug + true + + + Windows + true + RequireAdministrator + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + $(SolutionDir)vendor\argparse\include\;$(ProjectDir);%(AdditionalIncludeDirectories) + MultiThreaded + true + + + Windows + true + true + true + RequireAdministrator + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + + + + + + + + + + \ No newline at end of file diff --git a/defendnot-loader/defendnot-loader.vcxproj.filters b/defendnot-loader/defendnot-loader.vcxproj.filters new file mode 100644 index 0000000..c414d5c --- /dev/null +++ b/defendnot-loader/defendnot-loader.vcxproj.filters @@ -0,0 +1,33 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + \ No newline at end of file diff --git a/defendnot-loader/defendnot-loader.vcxproj.user b/defendnot-loader/defendnot-loader.vcxproj.user new file mode 100644 index 0000000..b65b8ce --- /dev/null +++ b/defendnot-loader/defendnot-loader.vcxproj.user @@ -0,0 +1,18 @@ + + + + true + + + --verbose + WindowsLocalDebugger + + + --verbose + WindowsLocalDebugger + + + --verbose + WindowsLocalDebugger + + \ No newline at end of file diff --git a/defendnot-loader/main.cpp b/defendnot-loader/main.cpp new file mode 100644 index 0000000..31c1ead --- /dev/null +++ b/defendnot-loader/main.cpp @@ -0,0 +1,127 @@ +#include "core/core.hpp" +#include "shared/ctx.hpp" +#include "shared/defer.hpp" +#include "shared/ipc.hpp" +#include "shared/names.hpp" +#include + +#include +#include +#include + +namespace { + void setup_window(const loader::Config& config) { + if (!config.from_autorun || config.verbose) { + shared::alloc_console(); + } + } + + void setup_context(const loader::Config& config) { + std::println("** setting up context"); + + if (config.name.length() > shared::kMaxNameLength) { + throw std::runtime_error(std::format("Max name length is {} characters", shared::kMaxNameLength)); + } + + shared::ctx.state = config.disable ? shared::State::OFF : shared::State::ON; + shared::ctx.verbose = config.verbose; + std::ranges::copy(config.name, shared::ctx.name.data()); + + /// No need to overwrite ctx if we are called from autorun + if (!config.from_autorun) { + std::println("** overwriting ctx.bin"); + shared::ctx.serialize(); + } + } + + [[nodiscard]] HANDLE load_defendnot() { + std::println("** loading defendnot"); + + auto dll_path = shared::get_this_module_path().parent_path(); + dll_path /= names::kDllName; + if (!std::filesystem::exists(dll_path)) { + throw std::runtime_error(std::format("{} does not exist!", names::kDllName)); + } + + return loader::inject(dll_path.string(), names::kVictimProcess); + } + + void wait_for_finish(shared::InterProcessCommunication& ipc) { + std::println("** waiting for process to finish, this can take a while"); + std::cout << std::flush; + while (!ipc->finished) { + std::this_thread::sleep_for(std::chrono::milliseconds(500)); + } + std::println("** success: {}", ipc->success); + } + + void process_autorun(const loader::Config& config) { + if (shared::ctx.state == shared::State::ON) { + std::println("** added to autorun: {}", loader::add_to_autorun()); + } else { + std::println("** removed from autorun: {}", loader::remove_from_autorun()); + } + } + + void banner(const loader::Config& config) { + std::println(); + std::println("thanks for using {}", names::kProjectName); + std::println("please don't forget to leave a star at {}", names::kRepoUrl); + + if (!config.from_autorun) { + system("pause"); + } + } +} // namespace + +int main(int argc, char* argv[]) try { + argparse::ArgumentParser program(std::format("{}-loader", names::kProjectName), "1.0.0"); + + program.add_argument("-n", "--name").help("av display name").default_value(std::string(names::kRepoUrl)).nargs(1); + program.add_argument("-d", "--disable").help(std::format("disable {}", names::kProjectName)).default_value(false).implicit_value(true); + program.add_argument("-v", "--verbose").help("verbose logging").default_value(false).implicit_value(true); + program.add_argument("--from-autorun").hidden().default_value(false).implicit_value(true); + + try { + program.parse_args(argc, argv); + } catch (...) { + shared::alloc_console(); + std::cerr << program; + system("pause"); + return EXIT_FAILURE; + } + + auto config = loader::Config{ + .name = program.get("-n"), + .disable = program.get("-d"), + .verbose = program.get("-v"), + .from_autorun = program.get("--from-autorun"), + }; + + setup_window(config); + setup_context(config); + + /// \todo @es3n1n: move this to a separate function and add move ctor for ipc + std::println("** setting up ipc"); + auto ipc = shared::InterProcessCommunication(shared::InterProcessCommunicationMode::READ_WRITE, true); + ipc->finished = false; + + const auto process = load_defendnot(); + defer->void { + TerminateProcess(process, 0); + }; + + wait_for_finish(ipc); + process_autorun(config); + banner(config); + + return EXIT_SUCCESS; +} catch (std::exception& err) { + std::println(stderr, "** fatal error: {}", err.what()); + system("pause"); + return EXIT_FAILURE; +} + +int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, PSTR lpCmdLine, int nCmdShow) { + return main(__argc, __argv); +} diff --git a/defendnot.sln b/defendnot.sln new file mode 100644 index 0000000..1c92763 --- /dev/null +++ b/defendnot.sln @@ -0,0 +1,81 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.13.35818.85 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "defendnot", "defendnot\defendnot.vcxproj", "{BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}" +EndProject +Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "cfg", "cfg", "{8EC462FD-D22E-90A8-E5CE-7E832BA40C5D}" + ProjectSection(SolutionItems) = preProject + .clang-format = .clang-format + EndProjectSection +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "cxx-shared", "cxx-shared\cxx-shared.vcxitems", "{8704ED28-3D20-4F31-9BA2-9A0040649372}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "defendnot-loader", "defendnot-loader\defendnot-loader.vcxproj", "{91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}" + ProjectSection(ProjectDependencies) = postProject + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1} = {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1} + EndProjectSection +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "wsc-binary-check", "wsc-binary-check\wsc-binary-check.vcxproj", "{6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|ARM64 = Debug|ARM64 + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|ARM64 = Release|ARM64 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Debug|ARM64.Build.0 = Debug|ARM64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Debug|x64.ActiveCfg = Debug|x64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Debug|x64.Build.0 = Debug|x64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Debug|x86.ActiveCfg = Debug|Win32 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Debug|x86.Build.0 = Debug|Win32 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Release|ARM64.ActiveCfg = Release|ARM64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Release|ARM64.Build.0 = Release|ARM64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Release|x64.ActiveCfg = Release|x64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Release|x64.Build.0 = Release|x64 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Release|x86.ActiveCfg = Release|Win32 + {BE718730-F28D-4B78-ADEA-9BDEAE7ACBF1}.Release|x86.Build.0 = Release|Win32 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Debug|ARM64.Build.0 = Debug|ARM64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Debug|x64.ActiveCfg = Debug|x64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Debug|x64.Build.0 = Debug|x64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Debug|x86.ActiveCfg = Debug|Win32 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Debug|x86.Build.0 = Debug|Win32 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Release|ARM64.ActiveCfg = Release|ARM64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Release|ARM64.Build.0 = Release|ARM64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Release|x64.ActiveCfg = Release|x64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Release|x64.Build.0 = Release|x64 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Release|x86.ActiveCfg = Release|Win32 + {91EB6F68-CE01-45AB-8B74-7FD618FDEDB5}.Release|x86.Build.0 = Release|Win32 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Debug|ARM64.ActiveCfg = Debug|ARM64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Debug|ARM64.Build.0 = Debug|ARM64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Debug|x64.ActiveCfg = Debug|x64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Debug|x64.Build.0 = Debug|x64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Debug|x86.ActiveCfg = Debug|Win32 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Debug|x86.Build.0 = Debug|Win32 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Release|ARM64.ActiveCfg = Release|ARM64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Release|ARM64.Build.0 = Release|ARM64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Release|x64.ActiveCfg = Release|x64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Release|x64.Build.0 = Release|x64 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Release|x86.ActiveCfg = Release|Win32 + {6BCD11C8-5119-49A5-BDA0-50D4B2795EFD}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {EF2507EA-6544-43CD-9893-3DE80BFB1BE0} + EndGlobalSection + GlobalSection(SharedMSBuildProjectFiles) = preSolution + cxx-shared\cxx-shared.vcxitems*{6bcd11c8-5119-49a5-bda0-50d4b2795efd}*SharedItemsImports = 4 + cxx-shared\cxx-shared.vcxitems*{8704ed28-3d20-4f31-9ba2-9a0040649372}*SharedItemsImports = 9 + cxx-shared\cxx-shared.vcxitems*{91eb6f68-ce01-45ab-8b74-7fd618fdedb5}*SharedItemsImports = 4 + cxx-shared\cxx-shared.vcxitems*{be718730-f28d-4b78-adea-9bdeae7acbf1}*SharedItemsImports = 4 + EndGlobalSection +EndGlobal diff --git a/defendnot/bootstrap/bootstrap.cpp b/defendnot/bootstrap/bootstrap.cpp new file mode 100644 index 0000000..878d170 --- /dev/null +++ b/defendnot/bootstrap/bootstrap.cpp @@ -0,0 +1,40 @@ +#include "bootstrap.hpp" +#include "core/com.hpp" +#include "core/log.hpp" +#include "shared/ctx.hpp" +#include "shared/defer.hpp" + +#include + +namespace defendnot { + void startup() { + /// Setup + shared::ctx.deserialize(); + logln("init: {:#x}", com_checked(CoInitialize(nullptr))); + + /// Get the main WSC interface we will be dealing with + auto inst = IWscAVStatus::get(); + + /// This can fail if we dont have any avs registered so no com_checked + logln("unregister: {:#x}", com_retry_while_pending([&inst]() -> HRESULT { return inst->Unregister(); })); + if (shared::ctx.state == shared::State::OFF) { + return; + } + + /// WSC will reject the register request if name is empty + auto name_w = std::wstring(shared::ctx.name.begin(), shared::ctx.name.end()); + if (name_w.empty()) { + throw std::runtime_error("AV Name can not be empty!"); + } + + /// Convert to BSTR + auto name = SysAllocString(name_w.c_str()); + defer->void { + SysFreeString(name); + }; + + /// Register and activate our AV + logln("register: {:#x}", com_checked(inst->Register(name, name))); + logln("update: {:#x}", com_checked(inst->UpdateStatus(WSCSecurityProductState::ON, 3))); + } +} // namespace defendnot diff --git a/defendnot/bootstrap/bootstrap.hpp b/defendnot/bootstrap/bootstrap.hpp new file mode 100644 index 0000000..809e99a --- /dev/null +++ b/defendnot/bootstrap/bootstrap.hpp @@ -0,0 +1,5 @@ +#pragma once + +namespace defendnot { + void startup(); +} diff --git a/defendnot/core/com.hpp b/defendnot/core/com.hpp new file mode 100644 index 0000000..d081436 --- /dev/null +++ b/defendnot/core/com.hpp @@ -0,0 +1,73 @@ +#pragma once +#include +#include +#include +#include + +#include "core/log.hpp" + +#include + +namespace defendnot { + namespace detail { + inline GUID RCLSID = {0x0F2102C37, 0x90C3, 0x450C, {0x0B3, 0x0F6, 0x92, 0x0BE, 0x16, 0x93, 0x0BD, 0x0F2}}; + inline GUID IID_IWscAVStatus = {0x3901A765, 0x0AB91, 0x4BA9, {0xA5, 0x53, 0x5B, 0x85, 0x38, 0xDE, 0xB8, 0x40}}; + } // namespace detail + + enum class WSCSecurityProductState : std::uint32_t { + ON = 0, + OFF = 1, + SNOOZED = 2, + EXPIRED = 3 + }; + + inline HRESULT com_checked(HRESULT result, const std::source_location loc = std::source_location::current()) { + if (result == 0) { + return result; + } + + auto msg = std::format("Got HRESULT={:#x} at\n{}:{}", static_cast(result) & 0xFFFFFFFF, loc.function_name(), loc.line()); + throw std::runtime_error(msg); + } + + template + inline HRESULT com_retry_while_pending(Callable&& fn) { + bool delayed = false; + HRESULT status = 0; + do { + if (status != 0) { + delayed = true; + logln("delaying for com retry..."); + std::this_thread::sleep_for(std::chrono::seconds(5)); + } + + status = fn(); + } while (status == E_PENDING); + + if (delayed) { + /// Sleep for additional 15 seconds to let WSC proceed all previous requests + std::this_thread::sleep_for(std::chrono::seconds(15)); + } + + return status; + } + + class IWscAVStatus { + private: + /// Incomplete stubs to just increase the vfunc id + virtual HRESULT QueryInterface() = 0; + virtual HRESULT AddRef() = 0; + virtual HRESULT Release() = 0; + + public: + virtual HRESULT Register(BSTR path_to_signed_product_exe, BSTR display_name) = 0; + virtual HRESULT Unregister() = 0; + virtual HRESULT UpdateStatus(WSCSecurityProductState state, std::uint32_t idk) = 0; + + static IWscAVStatus* get() { + IWscAVStatus* result = nullptr; + com_checked(CoCreateInstance(detail::RCLSID, 0, 1, detail::IID_IWscAVStatus, reinterpret_cast(&result))); + return result; + } + }; +} // namespace defendnot diff --git a/defendnot/core/log.hpp b/defendnot/core/log.hpp new file mode 100644 index 0000000..1331c0d --- /dev/null +++ b/defendnot/core/log.hpp @@ -0,0 +1,19 @@ +#pragma once +#include "shared/ctx.hpp" +#include "shared/util.hpp" +#include +#include + +#include + +namespace defendnot { + template + void logln(const std::format_string fmt, TArgs... args) noexcept { + if (!shared::ctx.verbose) [[likely]] { + return; + } + + shared::alloc_console(); + std::println(stdout, fmt, std::forward(args)...); + } +} // namespace defendnot diff --git a/defendnot/defendnot.vcxproj b/defendnot/defendnot.vcxproj new file mode 100644 index 0000000..fdd85a6 --- /dev/null +++ b/defendnot/defendnot.vcxproj @@ -0,0 +1,263 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM64 + + + Release + ARM64 + + + + 17.0 + Win32Proj + {be718730-f28d-4b78-adea-9bdeae7acbf1} + defendnot + 10.0 + + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + DynamicLibrary + true + v143 + Unicode + + + DynamicLibrary + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + $(ProjectName) + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + $(ProjectName) + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + $(ProjectName) + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + $(ProjectName) + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + $(ProjectName) + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + $(ProjectName) + + + + Level3 + true + INITGUID;WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreadedDebug + $(ProjectDir);%(AdditionalIncludeDirectories) + true + + + Console + true + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + true + true + INITGUID;WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreaded + $(ProjectDir);%(AdditionalIncludeDirectories) + true + + + Console + true + true + true + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + INITGUID;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreadedDebug + $(ProjectDir);%(AdditionalIncludeDirectories) + true + + + Console + true + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + true + true + INITGUID;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreaded + $(ProjectDir);%(AdditionalIncludeDirectories) + true + + + Console + true + true + true + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + INITGUID;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreadedDebug + $(ProjectDir);%(AdditionalIncludeDirectories) + true + + + Console + true + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + Level3 + true + true + true + INITGUID;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreaded + $(ProjectDir);%(AdditionalIncludeDirectories) + true + + + Console + true + true + true + /pdbaltpath:%_PDB% %(AdditionalOptions) + + + + + + + + + + + + + + + \ No newline at end of file diff --git a/defendnot/defendnot.vcxproj.filters b/defendnot/defendnot.vcxproj.filters new file mode 100644 index 0000000..fffea4c --- /dev/null +++ b/defendnot/defendnot.vcxproj.filters @@ -0,0 +1,36 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + Source Files + + + Source Files + + + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/defendnot/defendnot.vcxproj.user b/defendnot/defendnot.vcxproj.user new file mode 100644 index 0000000..429333d --- /dev/null +++ b/defendnot/defendnot.vcxproj.user @@ -0,0 +1,6 @@ + + + + true + + \ No newline at end of file diff --git a/defendnot/dllmain.cpp b/defendnot/dllmain.cpp new file mode 100644 index 0000000..1e5e407 --- /dev/null +++ b/defendnot/dllmain.cpp @@ -0,0 +1,47 @@ +#include "bootstrap/bootstrap.hpp" +#include "core/log.hpp" +#include "shared/ipc.hpp" + +#include +#include + +#include + +namespace { + void entry_thread(HMODULE base) { + bool success = false; + std::unique_ptr ipc; + + try { + /// Open IPC handle + ipc = std::make_unique(shared::InterProcessCommunicationMode::WRITE); + + /// Invoke the real entry + defendnot::startup(); + success = true; + } catch (std::exception& err) { + MessageBoxA(nullptr, err.what(), "defendnot", MB_TOPMOST | MB_ICONERROR); + } + + if (ipc) { + (*ipc)->success = success; + (*ipc)->finished = true; + } + + /// Always free out module once we are done + FreeLibraryAndExitThread(base, 0); + } +} // namespace + +BOOL __stdcall DllMain(HINSTANCE base, std::uint32_t call_reason, LPVOID reserved) { + if (call_reason != DLL_PROCESS_ATTACH) { + return TRUE; + } + + const auto th = CreateThread(nullptr, 0, reinterpret_cast(entry_thread), base, 0, nullptr); + if (th != nullptr) { + CloseHandle(th); + } + + return TRUE; +} diff --git a/vendor/argparse b/vendor/argparse new file mode 160000 index 0000000..d924b84 --- /dev/null +++ b/vendor/argparse @@ -0,0 +1 @@ +Subproject commit d924b84eba1f0f0adf38b20b7b4829f6f65b6570 diff --git a/wsc-binary-check/main.cpp b/wsc-binary-check/main.cpp new file mode 100644 index 0000000..433a30c --- /dev/null +++ b/wsc-binary-check/main.cpp @@ -0,0 +1,129 @@ +#include +#include + +#include +#include +#include +#include +#include +#include + +#include "shared/defer.hpp" + +#pragma comment(lib, "Crypt32.lib") + +namespace { + constexpr std::string_view kTargetDirectory = "c:\\Windows\\System32"; + /* constexpr */ auto kTargetFileExts = std::set{".exe"}; + + constexpr std::uint16_t kDosMagic = 0x5A4D; + constexpr std::uint32_t kNtSignature = 0x00004550; + constexpr std::uint16_t kARM64Machine = 0xAA64; + constexpr std::uint16_t kAMD64Machine = 0x8664; + constexpr std::uint16_t kI386Machine = 0x014C; + constexpr std::uint16_t kDllCharacteristicsForceIntegrityMask = 0x80; + + [[nodiscard]] std::optional> read_file(const std::filesystem::path path) { + std::ifstream file(path, std::ios::binary); + if (!file.good()) { + return std::nullopt; + } + + const auto size = std::filesystem::file_size(path); + std::vector buffer(size); + + file.read(reinterpret_cast(buffer.data()), static_cast(buffer.size())); + return buffer; + } + + [[nodiscard]] bool check_characteristics(const std::span data) { + if (data.size() < sizeof(IMAGE_DOS_HEADER)) { + throw std::runtime_error("got invalid pe image"); + } + + const auto p_dos = reinterpret_cast(data.data()); + if (p_dos->e_magic != kDosMagic) { + throw std::runtime_error("got invalid pe image (2)"); + } + + const auto p_nt = reinterpret_cast(data.data() + p_dos->e_lfanew); + if (p_nt->Signature != kNtSignature) { + throw std::runtime_error("got invalid pe image (3)"); + } + + const auto machine = p_nt->FileHeader.Machine; + std::uint16_t characteristics; + + if (machine == kARM64Machine || machine == kAMD64Machine) { + characteristics = reinterpret_cast(p_nt)->OptionalHeader.DllCharacteristics; + } else if (machine == kI386Machine) { + characteristics = reinterpret_cast(p_nt)->OptionalHeader.DllCharacteristics; + } else { + throw std::runtime_error(std::format("unsupported machine: {:#x}", machine)); + } + + return (characteristics & kDllCharacteristicsForceIntegrityMask) != 0; + } + + [[nodiscard]] bool check_signature(const std::filesystem::path path) { + HCERTSTORE store = {0}; + HCRYPTMSG msg = {0}; + if (!CryptQueryObject(1, path.wstring().c_str(), 0x400, 0xE, 0, nullptr, nullptr, nullptr, &store, &msg, nullptr) // + || !store || !msg) { + /// Most likely the binary is just not signed + return false; + } + + defer->void { + CryptMsgClose(msg); + CertCloseStore(store, 1); + }; + + PCCERT_CONTEXT signer = nullptr; + if (!CryptMsgGetAndVerifySigner(msg, 0, nullptr, 2, &signer, nullptr) || signer == nullptr) { + throw std::runtime_error(std::format("CryptMsgGetAndVerifySigner() on {}", path.string())); + } + + defer->void { + CertFreeCertificateContext(signer); + }; + + /// I don't think we have to do something with signer? + return true; + } +} // namespace + +int main() try { + for (auto& entry : std::filesystem::recursive_directory_iterator(kTargetDirectory, std::filesystem::directory_options::skip_permission_denied)) { + auto path = entry.path(); + auto ext = path.extension().string() // + | std::views::transform([](const char c) -> char { return ::tolower(c); }) // + | std::ranges::to(); + + if (!kTargetFileExts.contains(ext)) { + continue; + } + + auto file = read_file(path); + if (!file.has_value()) { + std::println(stderr, "unable to read {}", path.string()); + continue; + } + + const std::span file_ptr = *file; + if (!check_characteristics(file_ptr)) { + continue; + } + + if (!check_signature(path)) { + continue; + } + + std::println("matches: {}", path.string()); + } + + return EXIT_SUCCESS; +} catch (const std::exception& e) { + std::println(stderr, "fatal error: {}", e.what()); + return EXIT_FAILURE; +} diff --git a/wsc-binary-check/wsc-binary-check.vcxproj b/wsc-binary-check/wsc-binary-check.vcxproj new file mode 100644 index 0000000..02427b8 --- /dev/null +++ b/wsc-binary-check/wsc-binary-check.vcxproj @@ -0,0 +1,245 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + Debug + ARM64 + + + Release + ARM64 + + + + 17.0 + Win32Proj + {6bcd11c8-5119-49a5-bda0-50d4b2795efd} + wscbinarycheck + 10.0 + + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v143 + true + Unicode + + + + + + + + + + + + + + + + + + + + + + + + + + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + $(SolutionDir)out\$(PlatformName)\ + $(OutDir)imm\$(ProjectName)\ + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreadedDebug + true + + + Console + true + RequireAdministrator + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreaded + true + + + Console + true + true + true + RequireAdministrator + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreadedDebug + true + + + Console + true + RequireAdministrator + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreaded + true + + + Console + true + true + true + RequireAdministrator + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreadedDebug + true + + + Console + true + RequireAdministrator + + + + + Level3 + true + true + true + NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpplatest + stdclatest + MultiThreaded + true + + + Console + true + true + true + RequireAdministrator + + + + + + + + + \ No newline at end of file diff --git a/wsc-binary-check/wsc-binary-check.vcxproj.filters b/wsc-binary-check/wsc-binary-check.vcxproj.filters new file mode 100644 index 0000000..56d4d70 --- /dev/null +++ b/wsc-binary-check/wsc-binary-check.vcxproj.filters @@ -0,0 +1,22 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + \ No newline at end of file diff --git a/wsc-binary-check/wsc-binary-check.vcxproj.user b/wsc-binary-check/wsc-binary-check.vcxproj.user new file mode 100644 index 0000000..429333d --- /dev/null +++ b/wsc-binary-check/wsc-binary-check.vcxproj.user @@ -0,0 +1,6 @@ + + + + true + + \ No newline at end of file