using Serilog; using server.Database.Entity; using server.Database.Entity.Report; using server.Database.Model; using server.Types.ClientReport; using System; using System.Collections.Generic; using System.Drawing.Printing; using System.Linq; using System.Text; using System.Threading.Tasks; using static server.Message.MessageHandler; namespace server.Message { public class ClientReport : IClientMessage { private readonly ILogger _logger; private byte[] _buffer; private int _bufferSize; private PACKET_HEADER _packetHeader; private CLIENT_REPORT_PACKET_HEADER _clientReportPacketHeader; private CLIENT_REPORT_PACKET_RESPONSE _responsePacket; private enum CLIENT_SEND_REPORT_ID { MODULE_VERIFICATION = 10, START_ADDRESS_VERIFICATION = 20, PAGE_PROTECTION_VERIFICATION = 30, PATTERN_SCAN_FAILURE = 40, NMI_CALLBACK_FAILURE = 50, MODULE_VALIDATION_FAILURE = 60, ILLEGAL_HANDLE_OPERATION = 70, INVALID_PROCESS_ALLOCATION = 80, HIDDEN_SYSTEM_THREAD = 90, ILLEGAL_ATTACH_PROCESS = 100 } private struct CLIENT_REPORT_PACKET_HEADER { public int reportCode; } private struct CLIENT_REPORT_PACKET_RESPONSE { public int success; } public ClientReport(ILogger logger, ref byte[] buffer, int bufferSize, PACKET_HEADER packetHeader) { this._logger = logger; this._buffer = buffer; this._bufferSize = bufferSize; this._packetHeader = packetHeader; this._responsePacket = new CLIENT_REPORT_PACKET_RESPONSE(); this.GetPacketHeader(); } unsafe public void GetPacketHeader() { this._clientReportPacketHeader = Helper.BytesToStructure(_buffer, sizeof(PACKET_HEADER)); } public byte[] GetResponsePacket() { return Helper.StructureToBytes(ref this._responsePacket); } private void SetResponsePacketData(int success) { this._responsePacket.success = success; } public bool HandleMessage() { if (this._clientReportPacketHeader.reportCode == 0) { _logger.Error("Failed to get the report packet code"); return false; } switch (this._clientReportPacketHeader.reportCode) { case (int)CLIENT_SEND_REPORT_ID.MODULE_VERIFICATION: _logger.Information("REPORT CODE: MODULE_VERIFICATION"); break; case (int)CLIENT_SEND_REPORT_ID.START_ADDRESS_VERIFICATION: _logger.Information("REPORT_CODE_START_ADDRESS_VERIFICATION"); break; case (int)CLIENT_SEND_REPORT_ID.PAGE_PROTECTION_VERIFICATION: _logger.Information("REPORT_PAGE_PROTECTION_VERIFICATION"); break; case (int)CLIENT_SEND_REPORT_ID.PATTERN_SCAN_FAILURE: _logger.Information("REPORT_PATTERN_SCAN_FAILURE"); break; case (int)CLIENT_SEND_REPORT_ID.NMI_CALLBACK_FAILURE: _logger.Information("REPORT_NMI_CALLBACK_FAILURE"); break; case (int)CLIENT_SEND_REPORT_ID.MODULE_VALIDATION_FAILURE: _logger.Information("REPORT_MODULE_VALIDATION_FAILURE"); break; case (int)CLIENT_SEND_REPORT_ID.ILLEGAL_HANDLE_OPERATION: HandleReportIllegalHandleOperation(); break; case (int)CLIENT_SEND_REPORT_ID.INVALID_PROCESS_ALLOCATION: _logger.Information("REPORT_INVALID_PROCESS_ALLOCATION"); break; case (int)CLIENT_SEND_REPORT_ID.HIDDEN_SYSTEM_THREAD: _logger.Information("REPORT_HIDDEN_SYSTEM_THREAD"); break; case (int)CLIENT_SEND_REPORT_ID.ILLEGAL_ATTACH_PROCESS: _logger.Information("REPORT_ILLEGAL_ATTACH_PROCESS"); break; default: _logger.Information("Report code not handled yet"); break; } SetResponsePacketData(1); return true; } unsafe public void HandleReportIllegalHandleOperation() { OPEN_HANDLE_FAILURE_REPORT report = Helper.BytesToStructure(_buffer, sizeof(PACKET_HEADER)); _logger.Information("ProcessName: {0}, ProcessID: {1:x}, ThreadId: {2:x}, DesiredAccess{3:x}", report.ProcessName, report.ProcessId, report.ThreadId, report.DesiredAccess); using (var context = new ModelContext()) { /* * This doesn't seem to be the most optimal way to do this, but it works.. * Maybe look into it further at somepoint.. */ UserEntity user = new UserEntity(context); var newReport = new IllegalHandleOperationEntity(context) { User = user.GetUserBySteamId(this._packetHeader.steam64_id), IsKernelHandle = report.IsKernelHandle, ProcessId = report.ProcessId, ThreadId = report.ThreadId, DesiredAccess = report.DesiredAccess, ProcessName = report.ProcessName }; newReport.InsertReport(); context.SaveChanges(); } } } }