Panoptes 1.0.0
Endpoint Detection and Response
Loading...
Searching...
No Matches
Functions
driver.cpp File Reference
#include "driver.h"
#include "error_message.h"

Go to the source code of this file.

Functions

ERRORCODE GetKernelServiceStatus ()
 
ERRORCODE StopWindowsDriver ()
 
ERRORCODE StartWindowsDriver ()
 

Function Documentation

◆ GetKernelServiceStatus()

ERRORCODE GetKernelServiceStatus ( )

Definition at line 4 of file driver.cpp.

5{
6 SC_HANDLE serviceControlManager = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);
7 if (serviceControlManager == NULL) {
8 //cout << "Failed to open Service Control Manager. Error code: " << GetLastError() << endl;
9 return NOT_SET;
10 }
11
12 // Open the service
13 SC_HANDLE service = OpenServiceA(serviceControlManager, KERNEL_DRIVER_SERVICE_NAME, SERVICE_INTERROGATE);
14 if (service == NULL) {
15 //string message = format("Failed to open and stop the service. Error code: {}", GetLastError());
16 //LogErrorMessage(message);
17
18 CloseServiceHandle(serviceControlManager);
19 return NOT_INSTALLED;
20 }
21
22 SERVICE_STATUS serviceStatus;
23 ERRORCODE serviceStatusReturn = 0;
24 if (!ControlService(service, SERVICE_CONTROL_INTERROGATE, &serviceStatus)) {
25 serviceStatusReturn = CONTROL_SERVICE;
26 }
27 else if (serviceStatus.dwCurrentState == SERVICE_STOPPED)
28 {
29 serviceStatusReturn = PANO_SERVICE_STOPPED;
30 }
31 else if (serviceStatus.dwCurrentState == SERVICE_RUNNING)
32 {
33 serviceStatusReturn = PANO_SERVICE_RUNNING;
34 }
35
36 CloseServiceHandle(service);
37 CloseServiceHandle(serviceControlManager);
38
39 return serviceStatusReturn;
40}
#define PANO_SERVICE_STOPPED
#define PANO_SERVICE_RUNNING
#define NOT_SET
#define CONTROL_SERVICE
#define NOT_INSTALLED
#define KERNEL_DRIVER_SERVICE_NAME
#define ERRORCODE

References CONTROL_SERVICE, ERRORCODE, KERNEL_DRIVER_SERVICE_NAME, NOT_INSTALLED, NOT_SET, PANO_SERVICE_RUNNING, and PANO_SERVICE_STOPPED.

Referenced by WinMain().

◆ StartWindowsDriver()

ERRORCODE StartWindowsDriver ( )

Definition at line 82 of file driver.cpp.

83{
84 SC_HANDLE serviceControlManager = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);
85 if (serviceControlManager == NULL) {
86 //string message = format("Failed to obtain a handle to the service control manager: {}", GetLastError());
87 //LogErrorMessage(message);
88 return NOT_SET;
89 }
90
91 SC_HANDLE service = OpenServiceA(serviceControlManager, KERNEL_DRIVER_SERVICE_NAME, SERVICE_START | SERVICE_STOP);
92 if (service == NULL) {
93
94 //string message = format("Failed to open and start the service. Error code: {}", GetLastError());
95 //LogErrorMessage(message);
96
97 CloseServiceHandle(serviceControlManager);
98 return NOT_INSTALLED;
99 }
100
101 if (!StartService(service, 0, NULL)) {
102 if (GetLastError() == ERROR_SERVICE_ALREADY_RUNNING) {
103 SERVICE_STATUS serviceStatus;
104 //LogInformationMessage("Attempting to restart Panoptes Kernel Driver.");
105 if (!ControlService(service, SERVICE_CONTROL_STOP, &serviceStatus)) {
106 //string message = format("Error attempting to control the service: {}", GetLastError());
107 //LogErrorMessage(message);
108 return CONTROL_SERVICE;
109 }
110
111 //LogInformationMessage("Service stopped successfully.");
112 if (!StartService(service, 0, NULL)) {
113 //string message = format("Error restarting service: {}", GetLastError());
114 //LogErrorMessage(message);
116 }
117 //LogInformationMessage("Successfully restarted the Panoptes Kernel Driver");
118 }
119 else {
120 //string message = format("Error starting service: {}", GetLastError());
121 //LogErrorMessage(message);
123 }
124 }
125
126 CloseServiceHandle(service);
127 CloseServiceHandle(serviceControlManager);
128
129 return PANO_SUCCESS;
130}
#define ERROR_STARTING_SERVICE
#define PANO_SUCCESS

References CONTROL_SERVICE, ERROR_STARTING_SERVICE, KERNEL_DRIVER_SERVICE_NAME, NOT_INSTALLED, NOT_SET, and PANO_SUCCESS.

Referenced by WinMain().

◆ StopWindowsDriver()

ERRORCODE StopWindowsDriver ( )

Definition at line 42 of file driver.cpp.

43{
44 SC_HANDLE serviceControlManager = OpenSCManager(NULL, NULL, SC_MANAGER_CONNECT);
45 if (serviceControlManager == NULL) {
46 //cout << "Failed to open Service Control Manager. Error code: " << GetLastError() << endl;
47 return NOT_SET;
48 }
49
50 // Open the service
51 SC_HANDLE service = OpenServiceA(serviceControlManager, KERNEL_DRIVER_SERVICE_NAME, SERVICE_START | SERVICE_STOP);
52 if (service == NULL) {
53 //string message = format("Failed to open and stop the service. Error code: {}", GetLastError());
54 //LogErrorMessage(message);
55
56 CloseServiceHandle(serviceControlManager);
57 return NOT_INSTALLED;
58 }
59
60 SERVICE_STATUS serviceStatus;
61 if (!ControlService(service, SERVICE_CONTROL_STOP, &serviceStatus)) {
62 DWORD errorCode = GetLastError();
63 if (errorCode != ERROR_SERVICE_NOT_ACTIVE) {
64 //string message = format("Error attempting to control the service: {}", GetLastError());
65 //LogErrorMessage(message);
66 return CONTROL_SERVICE;
67 }
68 else if (errorCode == ERROR_SERVICE_NOT_ACTIVE) {
69 //LogInformationMessage("Service not running.");
70 return PANO_SUCCESS;
71 }
72 }
73 else {
74 //LogInformationMessage("Service stopped successfully.");
75
76 CloseServiceHandle(service);
77 CloseServiceHandle(serviceControlManager);
78 return PANO_SUCCESS;
79 }
80}
unsigned long DWORD
Definition inject.h:2

References CONTROL_SERVICE, KERNEL_DRIVER_SERVICE_NAME, NOT_INSTALLED, NOT_SET, and PANO_SUCCESS.

Referenced by WinMain().