dllmain.cpp

Go to the documentation of this file.

#include "PanoptesYara.h"
#include <string>
 
BOOL APIENTRY DllMain(HMODULE module, DWORD  dllAction, LPVOID lpReserved)
{
    switch (dllAction)
    {
    case DLL_PROCESS_ATTACH:
        //DisableThreadLibraryCalls(module);
        break;
    case DLL_THREAD_ATTACH:
        // Code to run when a thread is created
        break;
    case DLL_THREAD_DETACH:
        // Code to run when a thread ends
        break;
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
 
extern "C" PANO_API int PanoBind(int ContainerPort)
{
    PanoptesServiceClient client = PanoptesServiceClient();
    if (!client.Hello(ExtensibilityType::EXTENSIBILITY_TYPE_YARA, ContainerPort)) {
        return 0;
    }
 
    return ContainerPort;
}
 
extern "C" PANO_API bool PanoEntry(PeScan* data, MemScan* mem_data)
{
    std::string rules = "rules.pkg";
 
    YaraScanner yaraScan = YaraScanner::YaraScanner(rules.c_str());
    std::vector<std::string> scanDataResults = yaraScan.YaraScanFile(data->PePath);
 
    PanoptesServiceClient client = PanoptesServiceClient();
    if (!client.SendResults_Yara(data->PePath, data->FileHash, scanDataResults)) {
        return false;
    }
 
    return true;
}
 
extern "C" PANO_API bool PanoUnbind()
{
    HMODULE hModule = GetModuleHandleA("PanoptesYara.dll");
    if (hModule != NULL) {
        FreeLibraryAndExitThread(hModule, 0);
    }
    return true;
}