params.h

#pragma once
#include <sstream>

#include "pe_sieve.h"
#include "params_info/pe_sieve_params_info.h"

#include <paramkit.h>

using namespace paramkit;
using namespace pesieve;

//scan options:
#define PARAM_PID "pid"
#define PARAM_SHELLCODE "shellc"
#define PARAM_OBFUSCATED "obfusc"
#define PARAM_THREADS "threads"
#define PARAM_DATA "data"
#define PARAM_IAT "iat"
#define PARAM_MODULES_IGNORE "mignore"
#define PARAM_REFLECTION "refl"
#define PARAM_DOTNET_POLICY "dnet"

//dump options:
#define PARAM_IMP_REC "imp"
#define PARAM_DUMP_MODE "dmode"
//output options:
#define PARAM_OUT_FILTER "ofilter"
#define PARAM_QUIET "quiet"
#define PARAM_JSON "json"
#define PARAM_JSON_LVL "jlvl"
#define PARAM_DIR "dir"
#define PARAM_MINIDUMP "minidmp"
#define PARAM_PATTERN "pattern"


bool alloc_strparam(PARAM_STRING& strparam, ULONG len)
{
	if (strparam.buffer != nullptr) { // already allocated
		return false;
	}
	strparam.buffer = (char*)calloc(len + 1, sizeof(char));
	if (strparam.buffer) {
		strparam.length = len;
		return true;
	}
	return false;
}

void free_strparam(PARAM_STRING& strparam)
{
	free(strparam.buffer);
	strparam.buffer = nullptr;
	strparam.length = 0;
}

class PEsieveParams : public Params
{
public:
	PEsieveParams(const std::string &version)
		: Params(version)
	{
		this->addParam(new IntParam(PARAM_PID, true));
		this->setInfo(PARAM_PID, "Set the PID of the target process.");

		EnumParam *enumParam = new EnumParam(PARAM_IMP_REC, "imprec_mode", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_IMP_REC, "Set in which mode the ImportTable should be recovered");
			for (size_t i = 0; i < PE_IMPREC_MODES_COUNT; i++) {
				t_imprec_mode mode = (t_imprec_mode)(i);
				enumParam->addEnumValue(mode, imprec_mode_to_id(mode), translate_imprec_mode(mode));
			}
		}

		enumParam = new EnumParam(PARAM_OUT_FILTER, "ofilter_id", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_OUT_FILTER, "Filter the dumped output.");
			for (size_t i = 0; i < OUT_FILTERS_COUNT; i++) {
				t_output_filter mode = (t_output_filter)(i);
				enumParam->addEnumValue(mode, translate_out_filter(mode));
			}
		}

		this->addParam(new StringListParam(PARAM_MODULES_IGNORE, false, PARAM_LIST_SEPARATOR));
		{
			std::stringstream ss1;
			ss1 << "Do not scan module/s with given name/s.";
			std::stringstream ss2;
			ss2 << INFO_SPACER << "Example: kernel32.dll" << PARAM_LIST_SEPARATOR << "user32.dll";
			this->setInfo(PARAM_MODULES_IGNORE, ss1.str(), ss2.str());
		}
		
		this->addParam(new BoolParam(PARAM_QUIET, false));
		this->setInfo(PARAM_QUIET, "Print only the summary. Do not log on stdout during the scan.");

		this->addParam(new BoolParam(PARAM_JSON, false));
		this->setInfo(PARAM_JSON, "Print the JSON report as the summary.");
		//
		//PARAM_JSON_LVL
		enumParam = new EnumParam(PARAM_JSON_LVL, "json_lvl", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_JSON_LVL, "Level of details of the JSON report.");
			for (size_t i = 0; i < JSON_LVL_COUNT; i++) {
				t_json_level mode = (t_json_level)(i);
				enumParam->addEnumValue(mode, translate_json_level(mode));
			}
		}

		this->addParam(new BoolParam(PARAM_MINIDUMP, false));
		this->setInfo(PARAM_MINIDUMP, "Create a minidump of the full suspicious process.");

		//PARAM_SHELLCODE
		enumParam = new EnumParam(PARAM_SHELLCODE, "shellc_mode", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_SHELLCODE, "Detect shellcode implants (by patterns or statistics). ");
			for (size_t i = 0; i < SHELLC_COUNT; i++) {
				t_shellc_mode mode = (t_shellc_mode)(i);
				enumParam->addEnumValue(mode, shellc_mode_mode_to_id(mode), translate_shellc_mode(mode));
			}
		}
		
		this->addParam(new StringParam(PARAM_PATTERN, false));
		this->setInfo(PARAM_PATTERN, "Set additional shellcode patterns (file in the SIG format).");

		//PARAM_OBFUSCATED
		enumParam = new EnumParam(PARAM_OBFUSCATED, "obfusc_mode", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_OBFUSCATED, "Detect encrypted content, and possible obfuscated shellcodes.");
			for (size_t i = 0; i < OBFUSC_COUNT; i++) {
				t_obfusc_mode mode = (t_obfusc_mode)(i);
				enumParam->addEnumValue(mode, obfusc_mode_mode_to_id(mode), translate_obfusc_mode(mode));
			}
		}

		//PARAM_THREADS
		this->addParam(new BoolParam(PARAM_THREADS, false));
		this->setInfo(PARAM_THREADS, "Scan threads' callstack. Detect shellcodes, incl. 'sleeping beacons'.");

		//PARAM_REFLECTION
		this->addParam(new BoolParam(PARAM_REFLECTION, false));
		this->setInfo(PARAM_REFLECTION, 
			"Make a process reflection before scan.", 
			std::string(INFO_SPACER) + "This allows i.e. to force-read inaccessible pages."
		);

		//PARAM_IAT
		enumParam = new EnumParam(PARAM_IAT, "iat_scan_mode", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_IAT, "Scan for IAT hooks.");
			for (size_t i = 0; i < PE_IATS_MODES_COUNT; i++) {
				t_iat_scan_mode mode = (t_iat_scan_mode)(i);
				enumParam->addEnumValue(mode, translate_iat_scan_mode(mode));
			}
		}

		//PARAM_DOTNET_POLICY
		enumParam = new EnumParam(PARAM_DOTNET_POLICY, "dotnet_policy", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_DOTNET_POLICY, "Set the policy for scanning managed processes (.NET).");
			for (size_t i = 0; i < PE_DNET_COUNT; i++) {
				t_dotnet_policy mode = (t_dotnet_policy)(i);
				enumParam->addEnumValue(mode, translate_dotnet_policy(mode));
			}
		}

		//PARAM_DATA
		enumParam = new EnumParam(PARAM_DATA, "data_scan_mode", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_DATA, "Set if non-executable pages should be scanned.");
			for (size_t i = 0; i < PE_DATA_COUNT; i++) {
				t_data_scan_mode mode = (t_data_scan_mode)(i);
				enumParam->addEnumValue(mode, translate_data_mode(mode));
			}
		}

		//PARAM_DUMP_MODE
		enumParam = new EnumParam(PARAM_DUMP_MODE, "dump_mode", false);
		if (enumParam) {
			this->addParam(enumParam);
			this->setInfo(PARAM_DUMP_MODE, "Set in which mode the detected PE files should be dumped.");
			for (size_t i = 0; i < PE_DUMP_MODES_COUNT; i++) {
				peconv::t_pe_dump_mode mode = (peconv::t_pe_dump_mode)(i);
				enumParam->addEnumValue(mode, dump_mode_to_id(mode), translate_dump_mode(mode));
			}
		}

		//PARAM_DIR
		this->addParam(new StringParam(PARAM_DIR, false));
		this->setInfo(PARAM_DIR, "Set a root directory for the output (default: current directory).");

		//optional: group parameters
		std::string str_group = "5. output options";
		this->addGroup(new ParamGroup(str_group));
		this->addParamToGroup(PARAM_DIR, str_group);
		this->addParamToGroup(PARAM_JSON, str_group);
		this->addParamToGroup(PARAM_JSON_LVL, str_group);
		this->addParamToGroup(PARAM_OUT_FILTER, str_group);

		str_group = "1. scanner settings";
		this->addGroup(new ParamGroup(str_group));
		this->addParamToGroup(PARAM_QUIET, str_group);
		this->addParamToGroup(PARAM_REFLECTION, str_group);

		str_group = "3. scan options";
		this->addGroup(new ParamGroup(str_group));
		this->addParamToGroup(PARAM_DATA, str_group);
		this->addParamToGroup(PARAM_IAT, str_group);
		this->addParamToGroup(PARAM_SHELLCODE, str_group);
		this->addParamToGroup(PARAM_OBFUSCATED, str_group);
		this->addParamToGroup(PARAM_THREADS, str_group);
		this->addParamToGroup(PARAM_PATTERN, str_group);

		str_group = "4. dump options";
		this->addGroup(new ParamGroup(str_group));
		this->addParamToGroup(PARAM_MINIDUMP, str_group);
		this->addParamToGroup(PARAM_IMP_REC, str_group);
		this->addParamToGroup(PARAM_DUMP_MODE, str_group);

		str_group = "2. scan exclusions";
		this->addGroup(new ParamGroup(str_group));
		this->addParamToGroup(PARAM_DOTNET_POLICY, str_group);
		this->addParamToGroup(PARAM_MODULES_IGNORE, str_group);
	}

	bool fillStringParam(const std::string &paramId, PARAM_STRING &strparam)
	{
		StringParam* myStr = dynamic_cast<StringParam*>(this->getParam(paramId));
		if (!myStr || !myStr->isSet()) {
			return false;
		}
		std::string val = myStr->valToString();
		const size_t len = val.length();
		if (!len) {
			return false;
		}
		alloc_strparam(strparam, len);
		bool is_copied = false;
		if (strparam.buffer) {
			is_copied = copyCStr<StringParam>(paramId, strparam.buffer, strparam.length);
		}
		return is_copied;
	}

	void fillStruct(t_params &ps)
	{
		copyVal<IntParam>(PARAM_PID, ps.pid);
		copyVal<EnumParam>(PARAM_IMP_REC, ps.imprec_mode);
		copyVal<EnumParam>(PARAM_OUT_FILTER, ps.out_filter);

		fillStringParam(PARAM_MODULES_IGNORE, ps.modules_ignored);

		copyVal<BoolParam>(PARAM_QUIET, ps.quiet);
		copyVal<BoolParam>(PARAM_JSON, ps.json_output);

		copyVal<EnumParam>(PARAM_JSON_LVL, ps.json_lvl);

		copyVal<BoolParam>(PARAM_MINIDUMP, ps.minidump);
		copyVal<EnumParam>(PARAM_SHELLCODE, ps.shellcode);
		copyVal<EnumParam>(PARAM_OBFUSCATED, ps.obfuscated);
		copyVal<BoolParam>(PARAM_THREADS, ps.threads);
		copyVal<BoolParam>(PARAM_REFLECTION, ps.make_reflection);

		copyVal<EnumParam>(PARAM_IAT, ps.iat);
		copyVal<EnumParam>(PARAM_DOTNET_POLICY, ps.dotnet_policy);
		copyVal<EnumParam>(PARAM_DATA, ps.data);
		copyVal<EnumParam>(PARAM_DUMP_MODE, ps.dump_mode);

		copyCStr<StringParam>(PARAM_DIR, ps.output_dir, _countof(ps.output_dir));
		fillStringParam(PARAM_PATTERN, ps.pattern_file);
	}

	void printBanner()
	{
		char logo[] = "\
.______    _______           _______. __   ___________    ____  _______ \n\
|   _  \\  |   ____|         /       ||  | |   ____\\   \\  /   / |   ____|\n\
|  |_)  | |  |__    ______ |   (----`|  | |  |__   \\   \\/   /  |  |__   \n\
|   ___/  |   __|  |______| \\   \\    |  | |   __|   \\      /   |   __|  \n\
|  |      |  |____      .----)   |   |  | |  |____   \\    /    |  |____ \n\
| _|      |_______|     |_______/    |__| |_______|   \\__/     |_______|\n";

		char logo2[] = "\
  _        _______       _______      __   _______     __       _______ \n";
		char logo3[] = "\
________________________________________________________________________\n";
		paramkit::print_in_color(DARK_GREEN, logo);
		paramkit::print_in_color(DARK_RED, logo2);
		paramkit::print_in_color(DARK_RED, logo3);
		std::cout << "\n";
		std::cout << pesieve::info();
	}

};