diff --git a/rpcFirewall/dllmain.cpp b/rpcFirewall/dllmain.cpp index 3c06dcd..46a537e 100644 --- a/rpcFirewall/dllmain.cpp +++ b/rpcFirewall/dllmain.cpp @@ -452,10 +452,28 @@ std::wstring extractKeyValueFromConfigLineInner(const std::wstring& confLine, co return val; } +void removeCharFromStrig(const std::wstring& chr, std::wstring& s) +{ + size_t pos = s.find(chr.c_str()); + while (pos != std::wstring::npos) { + s.replace(pos, 1, L""); + pos = s.find(chr.c_str(), pos); + } +} + +void removeEOLCharsFromString(std::wstring& s) +{ + removeCharFromStrig(L"\r", s); + removeCharFromStrig(L"\n", s); +} + std::wstring extractKeyValueFromConfigLine(const std::wstring& confLine, const std::wstring& key) { std::wstring fixedConfLine = confLine; + removeEOLCharsFromString(fixedConfLine); + removeEOLCharsFromString(fixedConfLine); + fixedConfLine.replace(fixedConfLine.size() - 1, 1, _T(" ")); return extractKeyValueFromConfigLineInner(fixedConfLine, key); @@ -1417,6 +1435,7 @@ bool processRPCCallInternal(wchar_t* functionName, PRPC_MESSAGE pRpcMsg) byte buffSrc[0x80] = {0}; unsigned long buffersize = 0x80; + std::wstring srcAddrFromConnectionTmp; std::wstring srcAddrFromConnection; unsigned short srcPort = 0; @@ -1427,7 +1446,14 @@ bool processRPCCallInternal(wchar_t* functionName, PRPC_MESSAGE pRpcMsg) } else { - srcPort = getAddressAndPortFromBuffer(srcAddrFromConnection, buffSrc); + srcPort = getAddressAndPortFromBuffer(srcAddrFromConnectionTmp, buffSrc); + } + + // Removing possible excess chars from Ipv6 addresses + for (wchar_t ch : srcAddrFromConnectionTmp) { + if (ch != L'\\' && ch != L'[' && ch != L']') { + srcAddrFromConnection += ch; + } } byte buffDst[0x80] = { 0 }; diff --git a/rpcFwManager/RPCMgr.cpp b/rpcFwManager/RPCMgr.cpp index f1abe39..d4ebbf1 100644 --- a/rpcFwManager/RPCMgr.cpp +++ b/rpcFwManager/RPCMgr.cpp @@ -141,6 +141,7 @@ void getHelp() _tprintf(TEXT("Usage: rpcFwManager / [options] \n\n")); _tprintf(TEXT("command:\n")); _tprintf(TEXT("----------\n")); + _tprintf(TEXT("show\t\t - print various rpc related info (protected processes, for now...).\n")); _tprintf(TEXT("install\t\t - configure EventLogs, auditing, put DLLs in the %%SystemRoot%%\\system32 folder.\n")); _tprintf(TEXT("uninstall\t - undo installation changes.\n")); _tprintf(TEXT("start [options/pid/process]\t- Apply RPC protections according to the configuration file.\n")); @@ -475,8 +476,6 @@ void cmdStatusRPCFW() outputMessage(L"\n"); printProcessesWithRPCFW(); - outputMessage(L"\n"); - printProtectedProcesses(); outputMessage(L"\n\tconfiguration:"); @@ -485,6 +484,13 @@ void cmdStatusRPCFW() } +void cmdShow() +{ + elevateCurrentProcessToSystem(); + outputMessage(L"\n"); + printProtectedProcesses(); +} + void cmdStatus(std::wstring& param) { std::wstring errMsg = _T("usage: /status \n"); @@ -616,6 +622,10 @@ int _tmain(int argc, wchar_t* argv[]) { cmdStatus(param); } + else if (cmmd.find(_T("/show")) != std::string::npos) + { + cmdShow(); + } else { getHelp();