Archives
/
defender-control
mirror of https://github.com/qtkite/defender-control
2
0
Fork 0
Code Issues Projects Releases Wiki Activity

wmic wrapper for SET

Browse Source
pull/1/head
qtkite 3 years ago
parent 41dda76795
commit 14e1dd75a7
7 changed files with 165 additions and 180 deletions
Show Stats Download Patch File Download Diff File

2
src/defender-control/defender-control.vcxproj
Unescape Escape View File

@ -143,10 +143,12 @@
<ItemGroup>
<ClCompile Include="dcontrol.cpp" />
<ClCompile Include="main.cpp" />
<ClCompile Include="util.cpp" />
<ClCompile Include="wmic.cpp" />
</ItemGroup>
<ItemGroup>
<ClInclude Include="dcontrol.hpp" />
<ClInclude Include="util.hpp" />
<ClInclude Include="wmic.hpp" />
</ItemGroup>
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />

9
src/defender-control/defender-control.vcxproj.filters
Unescape Escape View File

@ -19,6 +19,9 @@
<Filter Include="Source Files\defender-control\wmic">
<UniqueIdentifier>{db30358b-f563-460e-92fb-eacafe3a68cb}</UniqueIdentifier>
</Filter>
<Filter Include="Source Files\defender-control\util">
<UniqueIdentifier>{0cabcba0-6285-4ad6-9295-add0563d0d48}</UniqueIdentifier>
</Filter>
</ItemGroup>
<ItemGroup>
<ClCompile Include="main.cpp">
@ -30,6 +33,9 @@
<ClCompile Include="wmic.cpp">
<Filter>Source Files\defender-control\wmic</Filter>
</ClCompile>
<ClCompile Include="util.cpp">
<Filter>Source Files\defender-control\util</Filter>
</ClCompile>
</ItemGroup>
<ItemGroup>
<ClInclude Include="dcontrol.hpp">
@ -38,5 +44,8 @@
<ClInclude Include="wmic.hpp">
<Filter>Source Files\defender-control\wmic</Filter>
</ClInclude>
<ClInclude Include="util.hpp">
<Filter>Source Files\defender-control\util</Filter>
</ClInclude>
</ItemGroup>
</Project>

25
src/defender-control/main.cpp
Unescape Escape View File

@ -14,12 +14,29 @@ int main()
"Windows defender is ACTIVE turning off..\n" :
"Windows defender is OFF turning on...\n");
//if (DCONTROL::check_defender())
// wmic::test_exec(true);
//else
// wmic::test_exec(false);
auto helper = new wmic::helper(
"Root\\Microsoft\\Windows\\Defender",
"MSFT_MpPreference",
"Set"
);
if (auto error = helper->get_last_error())
{
printf("Error has occured: %d", error);
system("pause");
return 1;
}
if (DCONTROL::check_defender())
wmic::test_exec(true);
else
wmic::test_exec(false);
helper->execute_cmd<BOOL>("DisableRealtimeMonitoring", wmic::variant_type::t_bool, TRUE);
else
helper->execute_cmd<BOOL>("DisableRealtimeMonitoring", wmic::variant_type::t_bool, FALSE);
system("pause");
return 0;
}

17
src/defender-control/util.cpp
Unescape Escape View File

@ -0,0 +1,17 @@
#include "util.hpp"
namespace util
{
std::wstring string_to_wide(const std::string& s)
{
std::wstring temp(s.length(), L' ');
std::copy(s.begin(), s.end(), temp.begin());
return temp;
}
std::string wide_to_string(const std::wstring& s) {
std::string temp(s.length(), ' ');
std::copy(s.begin(), s.end(), temp.begin());
return temp;
}
}

8
src/defender-control/util.hpp
Unescape Escape View File

@ -0,0 +1,8 @@
#pragma once
#include <string>
namespace util
{
std::wstring string_to_wide(const std::string& s);
std::string wide_to_string(const std::wstring& s);
}

205
src/defender-control/wmic.cpp
Unescape Escape View File

@ -6,11 +6,20 @@
namespace wmic
{
// function to test getting executing a command
//
bool test_exec(BOOL toggle)
helper::helper(std::string wnamespace, std::string wclass, std::string wmethod)
{
HRESULT hres;
// Initialize
//
last_error = 0;
hres = 0;
loc_ptr = nullptr;
service_ptr = nullptr;
class_ptr = nullptr;
param_def_ptr = nullptr;
class_inst_ptr = nullptr;
method_name = SysAllocString(util::string_to_wide(wmethod).c_str());
class_name = SysAllocString(util::string_to_wide(wclass).c_str());
// Setup COM library
//
@ -18,12 +27,10 @@ namespace wmic
if (FAILED(hres))
{
std::cout << "Failed to initialize COM. Error code = 0x"
<< std::hex << hres << std::endl;
return false;
last_error = 1;
return;
}
// Setup general security levels
//
hres = CoInitializeSecurity(
@ -40,49 +47,39 @@ namespace wmic
if (FAILED(hres))
{
std::cout << "Failed to initialize security. Error code = 0x"
<< std::hex << hres << std::endl;
last_error = 2;
CoUninitialize();
return false;
return;
}
// Obtain locator for wmi
//
IWbemLocator* loc_ptr = nullptr;
hres = CoCreateInstance(CLSID_WbemLocator, 0,
CLSCTX_INPROC_SERVER,
IID_IWbemLocator, (LPVOID*)&loc_ptr);
if (FAILED(hres))
{
std::cout << "Failed to create IWbemLocator object."
<< " Err code = 0x"
<< std::hex << hres << std::endl;
last_error = 3;
CoUninitialize();
return false;
return;
}
// Connect to wmi with IbwemLocator::ConnectServer
//
IWbemServices* service_ptr = nullptr;
hres = loc_ptr->ConnectServer(
_bstr_t("root\\Microsoft\\Windows\\Defender"),
_bstr_t(wnamespace.c_str()),
0, 0, 0, 0, 0, 0, &service_ptr
);
if (FAILED(hres))
{
std::cout << "Could not connect. Error code = 0x"
<< std::hex << hres << std::endl;
last_error = 4;
loc_ptr->Release();
CoUninitialize();
return false;
return;
}
std::cout << "Connected to root/Microsoft/Windows/Defender namespace" << std::endl;
// Set security levels for the proxy
//
hres = CoSetProxyBlanket(
@ -98,67 +95,22 @@ namespace wmic
if (FAILED(hres))
{
std::cout << "Could not set proxy blanket. Error code = 0x"
<< std::hex << hres << std::endl;
last_error = 5;
service_ptr->Release();
loc_ptr->Release();
CoUninitialize();
return false;
return;
}
// Make requests to the WMI
// Setup WMI request
//
BSTR method_name = SysAllocString(L"Set");
BSTR class_name = SysAllocString(L"MSFT_MpPreference");
IWbemClassObject* class_ptr = nullptr;
hres = service_ptr->GetObjectA(class_name, 0, 0, &class_ptr, 0);
IWbemClassObject* param_def_ptr = nullptr;
hres = class_ptr->GetMethod(method_name, 0, &param_def_ptr, 0);
IWbemClassObject* class_inst_ptr = nullptr;
hres = param_def_ptr->SpawnInstance(0, &class_inst_ptr);
}
// Create values for in parameter
//
VARIANT var_cmd;
var_cmd.vt = VT_BOOL;
var_cmd.boolVal = toggle;
// Store the value for the parameters
//
hres = class_inst_ptr->Put(L"DisableRealtimeMonitoring", 0,
&var_cmd, 0);
std::cout << "executing DisableRealtimeMonitoring" << std::endl;
// Execute
//
IWbemClassObject* pOutParams = nullptr;
hres = service_ptr->ExecMethod(class_name, method_name, 0,
0, class_inst_ptr, &pOutParams, 0);
if (FAILED(hres))
{
std::cout << "Could not execute method. Error code = 0x"
<< std::hex << hres << std::endl;
VariantClear(&var_cmd);
SysFreeString(class_name);
SysFreeString(method_name);
class_ptr->Release();
class_inst_ptr->Release();
param_def_ptr->Release();
pOutParams->Release();
service_ptr->Release();
loc_ptr->Release();
CoUninitialize();
return false;
}
// Clean up
//
VariantClear(&var_cmd);
helper::~helper()
{
SysFreeString(class_name);
SysFreeString(method_name);
@ -177,106 +129,15 @@ namespace wmic
if (service_ptr)
service_ptr->Release();
if (pOutParams)
pOutParams->Release();
CoUninitialize();
return true;
}
helper::helper(std::string wnamespace, std::string wclass)
// Return the last error
//
int helper::get_last_error()
{
// Initialize
//
last_error = 0;
hres = 0;
loc_ptr = nullptr;
service_ptr = nullptr;
// Setup COM library
//
hres = CoInitializeEx(0, COINIT_MULTITHREADED);
if (FAILED(hres))
{
last_error = 1;
return;
}
// Setup general security levels
//
hres = CoInitializeSecurity(
NULL,
-1, // COM authentication
NULL, // Authentication services
NULL, // Reserved
RPC_C_AUTHN_LEVEL_DEFAULT, // Default authentication
RPC_C_IMP_LEVEL_IMPERSONATE, // Default Impersonation
NULL, // Authentication info
EOAC_NONE, // Additional capabilities
NULL // Reserved
);
if (FAILED(hres))
{
last_error = 2;
CoUninitialize();
return;
}
// Obtain locator for wmi
//
hres = CoCreateInstance(CLSID_WbemLocator, 0,
CLSCTX_INPROC_SERVER,
IID_IWbemLocator, (LPVOID*)&loc_ptr);
if (FAILED(hres))
{
last_error = 3;
CoUninitialize();
return;
}
// Connect to wmi with IbwemLocator::ConnectServer
//
hres = loc_ptr->ConnectServer(
_bstr_t(wnamespace.c_str()),
0, 0, 0, 0, 0, 0, &service_ptr
);
if (FAILED(hres))
{
last_error = 4;
loc_ptr->Release();
CoUninitialize();
return;
}
// Set security levels for the proxy
//
hres = CoSetProxyBlanket(
service_ptr, // Indicates the proxy to set
RPC_C_AUTHN_WINNT, // RPC_C_AUTHN_xxx
RPC_C_AUTHZ_NONE, // RPC_C_AUTHZ_xxx
NULL, // Server principal name
RPC_C_AUTHN_LEVEL_CALL, // RPC_C_AUTHN_LEVEL_xxx
RPC_C_IMP_LEVEL_IMPERSONATE, // RPC_C_IMP_LEVEL_xxx
NULL, // client identity
EOAC_NONE // proxy capabilities
);
if (FAILED(hres))
{
service_ptr->Release();
loc_ptr->Release();
CoUninitialize();
return;
}
return last_error;
}
helper::~helper()
{
}
}

79
src/defender-control/wmic.hpp
Unescape Escape View File

@ -7,23 +7,94 @@
#include <Wbemidl.h>
#pragma comment(lib, "wbemuuid.lib")
#include "util.hpp"
namespace wmic
{
// function to test getting executing a command
//
bool test_exec(BOOL toggle);
enum class variant_type : int
{
t_bool,
t_bstr,
t_uint8,
t_uint32
};
class helper
{
int last_error;
HRESULT hres;
IWbemServices* service_ptr;
IWbemLocator* loc_ptr;
IWbemClassObject* class_ptr;
IWbemClassObject* param_def_ptr;
IWbemClassObject* class_inst_ptr;
BSTR method_name;
BSTR class_name;
public:
helper(std::string wnamespace, std::string wclass);
helper(std::string wnamespace, std::string wclass, std::string wmethod);
~helper();
// Return the last error
//
int get_last_error();
// Execute WMI set function
//
template<typename T>
void execute_cmd(std::string variable, variant_type type, T value)
{
// Create values for in parameter
//
VARIANT var_cmd;
switch (type)
{
case variant_type::t_bstr:
var_cmd.vt = VT_BSTR;
var_cmd.bstrVal = _bstr_t(value);
break;
case variant_type::t_bool:
var_cmd.vt = VT_BOOL;
var_cmd.boolVal = value;
break;
case variant_type::t_uint8:
var_cmd.vt = VT_UI1;
var_cmd.uintVal = value;
break;
case variant_type::t_uint32:
var_cmd.vt = VT_UI4;
var_cmd.uintVal = value;
default:
last_error = 6;
return;
}
// Store the value for the parameters
//
hres = class_inst_ptr->Put(util::string_to_wide(variable).c_str(), 0, &var_cmd, 0);
// Execute
//
IWbemClassObject* pOutParams = nullptr;
hres = service_ptr->ExecMethod(class_name, method_name, 0,
0, class_inst_ptr, &pOutParams, 0);
// Cleanup
//
VariantClear(&var_cmd);
if (pOutParams)
pOutParams->Release();
}
};
}

Write Preview
Loading…
Cancel
Save