grpc.cpp File Reference

#include <grpcpp/grpcpp.h>
#include "panoptes.grpc.pb.h"
#include "panoptes_service.h"
#include "grpc.hpp"
#include "hash.h"
#include "pano_log.h"
#include "utils.h"
#include "TrayNotifications.h"
#include "Configuration.hpp"
#include <vector>
#include <string>
#include <algorithm>
#include <filesystem>
#include <regex>
#include "PanoptesAMSI.h"

Go to the source code of this file.

Classes
class	PanoptesImpl
	The PanoptesImpl class is a class that implements the PanoptesExtensibility::Service interface from the gRPC class. More...

Functions
void	MoveFileToQuarantine (std::string filePath)
bool	GetRegistryPortValue (DWORD &portValue)
bool	isPathInExclusions (const std::vector< std::string > &exclusions, const std::string &fullPath)
bool	CheckIfMalicious (std::string jsonString)
bool	CreateRegistryEntryWithPort (DWORD dwPort)
std::string	CleanUpProtobufMessage (std::string msg)
void	SelfQueuePeScan (std::string pePath, std::string fileHash)
void	RunServiceServer (LPVOID lpParam)

Variables
std::unique_ptr< PanoptesExtensibility::Stub >	stub_
std::unique_ptr< PanoptesService::Stub >	selfStub_
std::vector< std::pair< ContainerType, int > >	g_containerServerPorts
PanoptesContext *	serviceContext

Function Documentation

CheckIfMalicious()

bool CheckIfMalicious

(

std::string

jsonString

)

Definition at line 104 of file grpc.cpp.

                                            {
    nlohmann::json jsonObject = nlohmann::json::parse(jsonString);
    if (jsonObject.contains("yara_scan") && jsonObject["yara_scan"].contains("detected_rules"))
    {
        nlohmann::json yaraObject = jsonObject["yara_scan"];
        int detected_rules = yaraObject["detected_rules"].size();
        if (detected_rules > 0) {
            return true;
        }
    }
 
    if (jsonObject.contains("amsi_result"))
    {
        AmsiScanner::AMSI_RESULT_PANO amsiResult = jsonObject["amsi_result"];
        if (amsiResult == AmsiScanner::AMSI_RESULT_PANO_DETECTED) {
            return true;
        }
    }
 
 
    return false;
}

References AmsiScanner::AMSI_RESULT_PANO_DETECTED.

CleanUpProtobufMessage()

std::string CleanUpProtobufMessage

(

std::string

msg

)

Definition at line 170 of file grpc.cpp.

                                                {
    size_t pos;
    while ((pos = msg.find("\\u0000")) != std::string::npos) {
        msg.erase(pos, 6);
    }
 
    nlohmann::json j = nlohmann::json::parse(msg);
    std::time_t now = std::time(nullptr);
    std::string formattedTime = FormatTime(now);
    j["Time"] = std::string(formattedTime);
    std::string dumpAgain = j.dump();
 
    return dumpAgain;
}

References FormatTime().

CreateRegistryEntryWithPort()

bool CreateRegistryEntryWithPort

(

DWORD

dwPort

)

Definition at line 127 of file grpc.cpp.

                                               {
    HKEY hKey;
    DWORD dwDisposition;
 
    // Create or open the key
    LONG lResult = RegCreateKeyExA(
        HKEY_LOCAL_MACHINE,
        "SOFTWARE\\Panoptes",
        0,
        NULL,
        REG_OPTION_NON_VOLATILE,
        KEY_ALL_ACCESS,
        NULL,
        &hKey,
        &dwDisposition
    );
 
    if (lResult != ERROR_SUCCESS) {
        std::cerr << "Error creating/opening registry key. Error code: " << lResult << std::endl;
        return false;
    }
 
    // Set the SRV_PORT value
    lResult = RegSetValueExA(
        hKey,
        "SRV_PORT",
        0,
        REG_DWORD,
        reinterpret_cast<const BYTE*>(&dwPort),
        sizeof(dwPort)
    );
 
    if (lResult != ERROR_SUCCESS) {
        std::cerr << "Error setting registry value. Error code: " << lResult << std::endl;
        RegCloseKey(hKey);
        return false;
    }
 
    RegCloseKey(hKey);
    std::cout << "Registry entry created successfully." << std::endl;
    return true;
}

Referenced by RunServiceServer().

GetRegistryPortValue()

bool GetRegistryPortValue

(

DWORD &

portValue

)

Definition at line 48 of file grpc.cpp.

{
    HKEY hKey;
    DWORD dwType = REG_DWORD;
    DWORD dwSize = sizeof(DWORD);
 
    // Open the key
    LONG lResult = RegOpenKeyExA(
        HKEY_LOCAL_MACHINE,
        "SOFTWARE\\Panoptes",
        0,
        KEY_READ,
        &hKey
    );
 
    if (lResult != ERROR_SUCCESS) {
        std::cerr << "Error opening registry key. Error code: " << lResult << std::endl;
        return false;
    }
 
    // Read the SRV_PORT value
    lResult = RegQueryValueExA(
        hKey,
        "SRV_PORT",
        NULL,
        &dwType,
        reinterpret_cast<LPBYTE>(&portValue),
        &dwSize
    );
 
    RegCloseKey(hKey);
 
    if (lResult != ERROR_SUCCESS) {
        std::cerr << "Error reading registry value. Error code: " << lResult << std::endl;
        return false;
    }
 
    if (dwType != REG_DWORD) {
        std::cerr << "Unexpected value type in registry." << std::endl;
        return false;
    }
 
    return true;
}

Referenced by SelfQueuePeScan().

isPathInExclusions()

bool isPathInExclusions	(	const std::vector< std::string > &	exclusions,
		const std::string &	fullPath
	)

Definition at line 93 of file grpc.cpp.

{
    std::filesystem::path fullPathNormalized = std::filesystem::path(fullPath).lexically_normal();
 
    return std::any_of(exclusions.begin(), exclusions.end(),
        [&fullPathNormalized](const std::string& path) {
            std::filesystem::path pathNormalized = std::filesystem::path(path).lexically_normal();
            return fullPathNormalized.string().find(pathNormalized.string()) == 0;
        });
}

Referenced by SelfQueuePeScan().

MoveFileToQuarantine()

void MoveFileToQuarantine

(

std::string

filePath

)

Definition at line 32 of file grpc.cpp.

                                              {
    std::string quarantinePath = "C:\\ProgramData\\Panoptes\\Quarantine";
 
    if (!fs::exists(quarantinePath)) {
        fs::create_directories(quarantinePath);
    }
    std::filesystem::path sourcePath(filePath);
    std::filesystem::path destinationPath = fs::path(quarantinePath) / sourcePath.filename();
    try {
        fs::rename(sourcePath, destinationPath);
    }
    catch (const std::filesystem::filesystem_error& e) {
        std::cerr << "Error moving file to quarantine: " << e.what() << std::endl;
    }
}

RunServiceServer()

void RunServiceServer

(

LPVOID

lpParam

)

Definition at line 371 of file grpc.cpp.

{
    serviceContext = reinterpret_cast<PanoptesContext*>(lpParam);
    PanoptesImpl service;
    grpc::ServerBuilder builder;
    int selected_port = 0;
    std::string server_url = "localhost:0";
 
    //Setting the server address to localhost:0 will allow the OS to assign an available port
    builder.AddListeningPort(server_url, grpc::InsecureServerCredentials(), &selected_port);
    builder.RegisterService(&service);
 
    std::unique_ptr<grpc::Server> server(builder.BuildAndStart());
    if (server == nullptr) {
        auto threadError = &serviceContext->threadError;
        bool threadState = threadError->load();
        threadError->store(true);
    }
 
    bool updatedReg = CreateRegistryEntryWithPort(selected_port);
    if (!updatedReg) {
        auto threadError = &serviceContext->threadError;
        bool threadState = threadError->load();
        threadError->store(true);
    }
 
    server->Wait();
}

References CreateRegistryEntryWithPort(), serviceContext, and PanoptesContext::threadError.

Referenced by WinMain().

SelfQueuePeScan()

void SelfQueuePeScan	(	std::string	pePath,
		std::string	fileHash
	)

Definition at line 224 of file grpc.cpp.

                                                           {
    auto configuration = serviceContext->config;
    if (isPathInExclusions(configuration->m_exclusions, pePath)) {
        return;
    }
 
    DWORD containerPort = 0;
    GetRegistryPortValue(containerPort);
    std::string server_url = "localhost:" + std::to_string(containerPort);
    std::shared_ptr<grpc::Channel> channel = grpc::CreateChannel(server_url, grpc::InsecureChannelCredentials());
    selfStub_ = PanoptesService::NewStub(channel);
 
    AckMessage reply;
    ClientContext context;
    PeScanInfo request;
    request.set_file_hash(fileHash);
    request.set_portable_executable_path(pePath);
 
    Status status = selfStub_->QueuePeScan(&context, request, &reply);
    if (!status.ok()) {
        std::cout << status.error_code() << ": " << status.error_message() << std::endl;
    }
}

References PanoptesContext::config, GetRegistryPortValue(), isPathInExclusions(), selfStub_, and serviceContext.

Referenced by DisplayEventInfo().

Variable Documentation

g_containerServerPorts

std::vector<std::pair<ContainerType, int> > g_containerServerPorts

Definition at line 26 of file grpc.cpp.

selfStub_

std::unique_ptr<PanoptesService::Stub> selfStub_

Definition at line 25 of file grpc.cpp.

Referenced by SelfQueuePeScan().

serviceContext

PanoptesContext* serviceContext

Definition at line 27 of file grpc.cpp.

Referenced by RunServiceServer(), SelfQueuePeScan(), StartPanoptesTrace(), and WinMain().

stub_

std::unique_ptr<PanoptesExtensibility::Stub> stub_

Definition at line 24 of file grpc.cpp.