Get more of utils working

mandiant · Nov 17, 2023 · 94f7af3 · 94f7af3
1 parent edabce6
commit 94f7af3
Show file tree

Hide file tree

Showing 7 changed files with 294 additions and 1,428 deletions.
diff --git a/C/FileDeleteRecordPluginDriver/FileDeleteRecordPluginDriver.cpp b/C/FileDeleteRecordPluginDriver/FileDeleteRecordPluginDriver.cpp
@@ -10,29 +10,11 @@ const unsigned long PLUGIN_POOL_TAG = 'LEDS';
 #pragma warning(disable: 6011)
 PluginApis g_Apis;
 
-#if defined(ENABLE_LOG)
-#if defined(__GNUC__) || defined(__clang__)
-
-// On GCC and Clang __VA_ARGS__ must be used differently.
-#define DBGPRINT(format, ...)  DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[STRACE] " format "\n", ##__VA_ARGS__)
-#define LOG_DEBUG(fmt,...)  g_Apis.pLogPrint(LogLevelDebug, __FUNCTION__, fmt, ##__VA_ARGS__)
-#define LOG_INFO(fmt,...)   g_Apis.pLogPrint(LogLevelInfo,  __FUNCTION__, fmt, ##__VA_ARGS__)
-#define LOG_WARN(fmt,...)   g_Apis.pLogPrint(LogLevelWarn,  __FUNCTION__, fmt, ##__VA_ARGS__)
-#define LOG_ERROR(fmt,...)  g_Apis.pLogPrint(LogLevelError, __FUNCTION__, fmt, ##__VA_ARGS__)
-#else
-
 #define DBGPRINT(format, ...)  DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[STRACE] " format "\n", __VA_ARGS__)
 #define LOG_DEBUG(fmt,...)  g_Apis.pLogPrint(LogLevelDebug, __FUNCTION__, fmt,   __VA_ARGS__)
 #define LOG_INFO(fmt,...)   g_Apis.pLogPrint(LogLevelInfo,  __FUNCTION__, fmt,   __VA_ARGS__)
 #define LOG_WARN(fmt,...)   g_Apis.pLogPrint(LogLevelWarn,  __FUNCTION__, fmt,   __VA_ARGS__)
 #define LOG_ERROR(fmt,...)  g_Apis.pLogPrint(LogLevelError, __FUNCTION__, fmt,   __VA_ARGS__)
-#endif // __GNUC__ || __clang__
-
-#else
-
-#define DBGPRINT(format, ...)   ((void)format)
-
-#endif // _DEBUG
 
 enum PROBE_IDS : ULONG64 {
     IdSetInformationFile = 0,
@@ -86,8 +68,6 @@ void PrintStackTrace(CallerInfo& callerinfo) {
     }
 }
 
-
-
 OBJECT_NAME_INFORMATION* getFilePathFromHandle(HANDLE hFile) {
     ULONG dwSize = 0;
     OBJECT_NAME_INFORMATION* pObjectName = nullptr;

diff --git a/C/FileDeleteRecordPluginDriver/FileDeleteRecordPluginDriver.vcxproj b/C/FileDeleteRecordPluginDriver/FileDeleteRecordPluginDriver.vcxproj
@@ -112,6 +112,16 @@
       <EntryPointSymbol>DriverEntry</EntryPointSymbol>
     </Link>
   </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
+    <ClCompile>
+      <LanguageStandard>stdcpp20</LanguageStandard>
+    </ClCompile>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
+    <ClCompile>
+      <LanguageStandard>stdcpp20</LanguageStandard>
+    </ClCompile>
+  </ItemDefinitionGroup>
   <ItemGroup>
     <FilesToPackage Include="$(TargetPath)" />
   </ItemGroup>
@@ -125,7 +135,9 @@
     <ClInclude Include="MyStdint.h" />
     <ClInclude Include="NtBuild.h" />
     <ClInclude Include="NtStructs.h" />
+    <ClInclude Include="string.h" />
     <ClInclude Include="utils.h" />
+    <ClInclude Include="vector.h" />
   </ItemGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
   <ImportGroup Label="ExtensionTargets">

diff --git a/C/FileDeleteRecordPluginDriver/FileDeleteRecordPluginDriver.vcxproj.filters b/C/FileDeleteRecordPluginDriver/FileDeleteRecordPluginDriver.vcxproj.filters
@@ -39,11 +39,17 @@
     <ClInclude Include="Constants.h">
       <Filter>Header Files</Filter>
     </ClInclude>
-    <ClInclude Include="NtStructs.h">
-      <Filter>Source Files</Filter>
-    </ClInclude>
     <ClInclude Include="utils.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="vector.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="string.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="NtStructs.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>