tags:

views:

36

answers:

0

Hey, can someone please show me how i can write the output of OnCreateFile to a GUI? I thought the GUI would have to be declared at the bottom in the main function, so how do i then refer to it within OnCreateFile?

using System;
using System.Collections.Generic;
using System.Runtime.Remoting;
using System.Text;
using System.Diagnostics;
using System.IO;
using EasyHook;
using System.Drawing;
using System.Windows.Forms;

namespace FileMon
{
    public class FileMonInterface : MarshalByRefObject
    {
        public void IsInstalled(Int32 InClientPID)
        {

            //Console.WriteLine("FileMon has been installed in target {0}.\r\n", InClientPID);
        }

        public void OnCreateFile(Int32 InClientPID, String[] InFileNames)
        {
            for (int i = 0; i < InFileNames.Length; i++)
            {
                String[] s = InFileNames[i].ToString().Split('\t');

                if (s[0].ToString().Contains("ROpen"))
                {
                    //Console.WriteLine(DateTime.Now.Hour+":"+DateTime.Now.Minute+":"+DateTime.Now.Second+"."+DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + getRootHive(s[2]));
                    Program.ff.enterText(DateTime.Now.Hour + ":" + DateTime.Now.Minute + ":" + DateTime.Now.Second + "." + DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + getRootHive(s[2]));
                }
                else if (s[0].ToString().Contains("RQuery"))
                {
                    Console.WriteLine(DateTime.Now.Hour + ":" + DateTime.Now.Minute + ":" + DateTime.Now.Second + "." + DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + getRootHive(s[2]));
                }
                else if (s[0].ToString().Contains("RDelete"))
                {
                    Console.WriteLine(DateTime.Now.Hour + ":" + DateTime.Now.Minute + ":" + DateTime.Now.Second + "." + DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[0])) + "\t" + getRootHive(s[1]));
                }
                else if (s[0].ToString().Contains("FCreate"))
                {
                    //Console.WriteLine(DateTime.Now.Hour+":"+DateTime.Now.Minute+":"+DateTime.Now.Second+"."+DateTime.Now.Millisecond + "\t" + s[0] + "\t" + getProcessName(int.Parse(s[1])) + "\t" + s[2]);
                }
            }
        }

        public void ReportException(Exception InInfo)
        {
            Console.WriteLine("The target process has reported an error:\r\n" + InInfo.ToString());
        }

        public void Ping()
        {
        }

        public String getProcessName(int ID)
        {
            String name = "";
            Process[] process = Process.GetProcesses();
            for (int i = 0; i < process.Length; i++)
            {
                if (process[i].Id == ID)
                {
                    name = process[i].ProcessName;
                }
            }
            return name;
        }

        public String getRootHive(String hKey)
        {
            int r = hKey.CompareTo("2147483648");
            int r1 = hKey.CompareTo("2147483649");
            int r2 = hKey.CompareTo("2147483650");
            int r3 = hKey.CompareTo("2147483651");
            int r4 = hKey.CompareTo("2147483653");

            if (r == 0)
            {
                return "HKEY_CLASSES_ROOT";
            }
            else if (r1 == 0)
            {
                return "HKEY_CURRENT_USER";
            }
            else if (r2 == 0)
            {
                return "HKEY_LOCAL_MACHINE";
            }
            else if (r3 == 0)
            {
                return "HKEY_USERS";
            }
            else if (r4 == 0)
            {
                return "HKEY_CURRENT_CONFIG";
            }
            else return hKey.ToString();
        }
    }

    class Program : System.Windows.Forms.Form
    {
        static String ChannelName = null;
        public static Form1 ff;

        Program() // ADD THIS CONSTRUCTOR
        {

            InitializeComponent();


        }

        static void Main()
        {

            try
            {

                Config.Register("A FileMon like demo application.", "FileMon.exe", "FileMonInject.dll");
                RemoteHooking.IpcCreateServer<FileMonInterface>(ref ChannelName, WellKnownObjectMode.SingleCall);
                Process[] p = Process.GetProcesses();
                for (int i = 0; i < p.Length; i++)
                {
                    try
                    {
                        RemoteHooking.Inject(p[i].Id, "FileMonInject.dll", "FileMonInject.dll", ChannelName);
                    }
                    catch (Exception e)
                    {
                    }
                }
            }
            catch (Exception ExtInfo)
            {
                Console.WriteLine("There was an error while connecting to target:\r\n{0}", ExtInfo.ToString());
            }


        }
    }
}