Panoptes 1.0.0
Endpoint Detection and Response
Loading...
Searching...
No Matches
service.cpp
Go to the documentation of this file.
1#include "panoptes_service.h"
2#include "ResourceCore.h"
3#include <iostream>
4#include "grpc.hpp"
5#include "TrayNotifications.h"
6#include "events.h"
7#include "error_message.h"
8#include "mutex.hpp"
9#include "containers.h"
10#include "utils.h"
11#include "database.hpp"
12#include "driver.h"
13#include "Configuration.hpp"
14
17 std::string msg = GetErrorMessage(err);
19 return err;
20}
21
22
23int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
24{
25
26#ifndef _DEBUG
27 if (IsDebuggerPresent()) {
28 auto msg = GetErrorMessage(DEBUGGER);
30 return DEBUGGER;
31 }
32#endif
33
36
37#pragma region Admin Check
38 if (!IsRunningAsAdmin()) {
39 auto msg = GetErrorMessage(NOT_ADMIN);
41 return NOT_ADMIN;
42 }
43#pragma endregion
44
45#pragma region Mutex Check
46 if (MutexExist() != PANO_SUCCESS) {
48 auto msg = GetErrorMessage(MUTEX_SET);
50 return MUTEX_SET;
51 }
52 }
53 else {
54 auto msg = GetErrorMessage(MUTEX_SET);
56 return MUTEX_SET;
57 }
58#pragma endregion
59
60#pragma region Panoptes Configuration
61#ifdef _DEBUG
62 std::string configPath = GetCurrentPath() + "\\panoptes.config";
63#else
64 std::string configPath = "C:\\ProgramData\\Panoptes\\Panoptes.config";
65#endif // _DEBUG
66
67 Configuration* configuration = new Configuration(configPath);
68 try {
69 configuration->Parse();
70 serviceContext.config = configuration;
71 }
72 catch (const int& err) {
73 return CleanupWithError(err);
74 }
75#pragma endregion
76
77#pragma region Database
78 auto dbTmp = serviceContext.database.load();
79 ERRORCODE errCode = dbTmp.InitializeDatabase();
80 if (errCode != PANO_SUCCESS) {
81 return CleanupWithError(errCode);
82 }
83#pragma endregion
84
85#pragma region GRPC Server
86 HANDLE grpcThread = CreateThread(
87 NULL, // default security attributes
88 0, // default stack size
89 (LPTHREAD_START_ROUTINE)RunServiceServer, // thread function
90 &serviceContext, // no thread function arguments
91 0, // default creation flags
92 NULL // receive thread identifier
93 );
94 Sleep(2000);
95
96 if (grpcThread == NULL || serviceContext.threadError) {
98 }
99#pragma endregion
100
101#pragma region Container Start
102 errCode = StartContainers(configuration->m_extensibility);
103 if (errCode != PANO_SUCCESS) {
104 return CleanupWithError(errCode);
105 }
106#pragma endregion
107
108#pragma region ETW Trace
109 HANDLE etwThread = CreateThread(
110 NULL, // default security attributes
111 0, // default stack size
112 (LPTHREAD_START_ROUTINE)StartPanoptesTrace, // thread function
113 &serviceContext, // no thread function arguments
114 0, // default creation flags
115 NULL // receive thread identifier
116 );
117 Sleep(2000);
118
119 if (etwThread == NULL || serviceContext.threadError){
121 }
122#pragma endregion
123
124#pragma region Driver Check
125 //Check to see if the driver is installed and running/stopped
126 if (!configuration->m_ignoreDriver) {
127 errCode = GetKernelServiceStatus();
128 if (errCode == NOT_INSTALLED)
129 {
130 return CleanupWithError(errCode);
131 }
132 else if (errCode == PANO_SERVICE_RUNNING) {
133 errCode = StopWindowsDriver();
134 if (errCode != PANO_SUCCESS)
135 {
136 return CleanupWithError(errCode);
137 }
138 }
139 else if (errCode == PANO_SERVICE_STOPPED) {
140 errCode = StartWindowsDriver();
141 if (errCode != PANO_SUCCESS)
142 {
143 return CleanupWithError(errCode);
144 }
145 }
146 }
147#pragma endregion
148
149 HANDLE proc = GetCurrentProcess();
150 while (1) {
151 WaitForSingleObject(proc, INFINITE);
152 }
153
154 return 0;
155}
#define START_TRACE
#define PANO_SUCCESS
#define DEBUGGER
#define PANO_SERVICE_STOPPED
#define NOT_ADMIN
#define PANO_SERVICE_RUNNING
#define MUTEX_SET
#define GRPC_SERVER_ERROR
#define NOT_INSTALLED
std::vector< Configuration::ContainerType > m_extensibility
The extensibility selected from the configuration file.
void Parse()
Parse the configuration file.
bool m_ignoreDriver
The ignore driver from the configuration file.
ERRORCODE StartContainers(std::vector< Configuration::ContainerType > selectedExtensibility)
ERRORCODE StartWindowsDriver()
Definition driver.cpp:82
ERRORCODE GetKernelServiceStatus()
Definition driver.cpp:4
ERRORCODE StopWindowsDriver()
Definition driver.cpp:42
std::string GetErrorMessage(UINT resourceID)
void DisplayErrorMessage(std::string errorMessage)
ULONG StartPanoptesTrace(LPVOID lpParam)
Definition events.cpp:305
PanoptesContext * serviceContext
Definition grpc.cpp:27
VOID RunServiceServer(LPVOID lpParam)
Definition grpc.cpp:371
ERRORCODE DestroyMutex()
Definition mutex.cpp:33
ERRORCODE SetEnvironmentMutex()
Definition mutex.cpp:5
ERRORCODE MutexExist()
Definition mutex.cpp:19
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow)
Definition service.cpp:23
ERRORCODE CleanupWithError(ERRORCODE err)
Definition service.cpp:15
#define ERRORCODE
std::atomic< bool > threadError
Configuration * config
std::atomic< PanoptesDatabase > database
std::string GetCurrentPath()
Definition utils.cpp:68
bool IsRunningAsAdmin()
Definition utils.cpp:9