dllmain.cpp

Go to the documentation of this file.

#include <string>
#include <codecvt>
#include <locale>
#include <amsi.h>
#include "PanoptesAMSI.h"
#define VERSION "1.0.0"
 
BOOL APIENTRY DllMain(HMODULE module, DWORD dllAction, LPVOID lpReserved)
{
    switch (dllAction)
    {
    case DLL_PROCESS_ATTACH:
        //DisableThreadLibraryCalls(module);
        break;
    case DLL_THREAD_ATTACH:
        // Code to run when a thread is created
        break;
    case DLL_THREAD_DETACH:
        // Code to run when a thread ends
        break;
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
 
extern "C" PANO_API int PanoBind(int ContainerPort)
{
    PanoptesServiceClient client = PanoptesServiceClient();
    if (!client.Hello(ExtensibilityType::EXTENSIBILITY_TYPE_AMSI, ContainerPort)) {
        return 0;
    }
 
    return ContainerPort;
}
 
extern "C" PANO_API bool PanoEntry(PeScan* data, MemScan* mem_data)
{
    if (data->PePath.empty()) {
        return false;
    }
 
    INT amsi_result = 0;
    HRESULT status = AmsiScanner::AmsiScanFile(data->PePath, "", &amsi_result);
    if (FAILED(status)) {
        return false;
    }
    else {
        PanoptesServiceClient client = PanoptesServiceClient();
        if (!client.SendResults_AMSI(data->PePath, data->FileHash, amsi_result)) {
            return false;
        }
 
        return true;
    }
}
 
extern "C" PANO_API bool PanoUnbind()
{
    HMODULE hModule = GetModuleHandleA("PanoptesAMSI.dll");
    if (hModule != NULL) {
        FreeLibraryAndExitThread(hModule, 0);
    }
    return true;
}