| 12 | |
| 13 | |
| 14 | BOOL ConfigureKernelDriver(int enable) { |
| 15 | HANDLE hDevice = INVALID_HANDLE_VALUE; |
| 16 | wchar_t* targetW = nullptr; |
| 17 | |
| 18 | if (g_Config.targetProcessNames.empty()) { |
| 19 | LOG_A(LOG_ERROR, "Kernel: No target process specified for kernel driver"); |
| 20 | return FALSE; |
| 21 | } |
| 22 | std::string target = g_Config.targetProcessNames[0]; |
| 23 | |
| 24 | try { |
| 25 | hDevice = CreateFile(L"\\\\.\\RedEdr", |
| 26 | GENERIC_READ | GENERIC_WRITE, |
| 27 | 0, |
| 28 | NULL, |
| 29 | OPEN_EXISTING, |
| 30 | FILE_ATTRIBUTE_NORMAL, |
| 31 | NULL); |
| 32 | |
| 33 | if (hDevice == INVALID_HANDLE_VALUE) { |
| 34 | LOG_A(LOG_ERROR, "Kernel: Failed to open device. Error: %d", GetLastError()); |
| 35 | return FALSE; |
| 36 | } |
| 37 | |
| 38 | targetW = string2wcharAlloc(target); |
| 39 | if (targetW == nullptr) { |
| 40 | LOG_A(LOG_ERROR, "Kernel: Failed to convert target string to wchar_t"); |
| 41 | CloseHandle(hDevice); |
| 42 | return FALSE; |
| 43 | } |
| 44 | MY_DRIVER_DATA kernel_config = { 0 }; |
| 45 | if (enable) { |
| 46 | size_t targetLen = wcslen(targetW); |
| 47 | if (targetLen >= sizeof(kernel_config.filename) / sizeof(wchar_t)) { |
| 48 | LOG_A(LOG_ERROR, "Kernel: Target filename too long"); |
| 49 | delete[] targetW; |
| 50 | CloseHandle(hDevice); |
| 51 | return FALSE; |
| 52 | } |
| 53 | wcscpy_s(kernel_config.filename, sizeof(kernel_config.filename) / sizeof(wchar_t), targetW); |
| 54 | kernel_config.enable_dll_injection = g_Config.do_hook; |
| 55 | kernel_config.enable = enable; |
| 56 | |
| 57 | if (g_Config.do_etwti) { |
| 58 | kernel_config.enable_etwti_events = 1; |
| 59 | if (g_Config.do_defendertrace) { |
| 60 | kernel_config.enable_etwti_events_defender = 1; |
| 61 | } else { |
| 62 | kernel_config.enable_etwti_events_defender = 0; |
| 63 | } |
| 64 | } else { |
| 65 | kernel_config.enable_etwti_events = 0; |
| 66 | kernel_config.enable_etwti_events_defender = 0; |
| 67 | } |
| 68 | |
| 69 | // Log |
| 70 | LOG_A(LOG_INFO, "Kernel: enable=%d, dll_injection=%d, etwti_events=%d, etwti_events_defender=%d, filename=%ls", |
| 71 | kernel_config.enable, |