Navigation

← Previous Changeset
Next Changeset →

Changeset 1724

Timestamp:

08/12/08 15:36:04 (4 months ago)

Author:

xkovah

Message:

going to try to get returning structured data to work…but this check in is just for the upcoming rename

Files:

capture-mod/trunk/MySoapServer.cpp (modified) (4 diffs)
capture-mod/trunk/Visitor.cpp (modified) (1 diff)
capture-mod/trunk/captureGSOAP.h (modified) (1 diff)
capture-mod/trunk/client.pl (added)
capture-mod/trunk/install/CaptureBAT.exe (modified) (previous)
capture-mod/trunk/install/CaptureFileMonitor.sys (modified) (previous)
capture-mod/trunk/install/CaptureProcessMonitor.sys (modified) (previous)
capture-mod/trunk/install/CaptureRegistryMonitor.sys (modified) (previous)
capture-mod/trunk/install/FileMonitor.exl (modified) (7 diffs)
capture-mod/trunk/install/ProcessMonitor.exl (modified) (2 diffs)
capture-mod/trunk/install/RegistryMonitor.exl (modified) (4 diffs)
capture-mod/trunk/soapC.cpp (modified) (17 diffs)
capture-mod/trunk/soapClient.cpp (modified) (2 diffs)
capture-mod/trunk/soapH.h (modified) (16 diffs)
capture-mod/trunk/soapServer.cpp (modified) (3 diffs)
capture-mod/trunk/soapStub.h (modified) (15 diffs)
capture-mod/trunk/soapcpp2.exe (added)

Legend:

: Unmodified
: Added
: Removed
: Modified
: Copied
: Moved

capture-mod/trunk/MySoapServer.cpp

r1662	r1724
7	7
8	8	#include "soapH.h"
9		#include "ca~~lculator~~.nsmap"
	9	#include "capture.nsmap"
10	10
11	11	#include "Visitor.h"
…	…
83	83	*result = "pong";
84	84
	85	wchar_t xURL[1024];
	86	wsprintf(xURL, L"%hs", a);
85	87	//Build my own new-fangled Element to pass to Visitor:onServerEvent which I think will open
86	88	typedef boost::signal<void (Element*)> signal_serverEvent;
87	89	Attribute att;
88	90	att.name = L"url";
89		att.value = ~~L"http://slashdot.org";~~
	91	att.value = xURL; //Now expecting you to pass the URL
90	92	Element e;
91	93	e.name = L"visit";
…	…
95	97	printf("trying with notifyListeners\n");
96	98	EventController::getInstance()->notifyListeners(&e);
97		printf("trying with globVisitor\n");
	99	// printf("trying with globVisitor\n");
98	100	// globVisitor->onServerEvent(&e);
99	101
…	…
107	109	return SOAP_OK;
108	110	}
	111
	112	/*
	113	int ns__junks(char * a, ns__myStruct2 &result)
	114	{
	115	printf("in ns__struct\n");
	116	ns__myStruct2 bob;
	117	bob.first = "bob";
	118	bob.last = "dole";
	119	result = &bob;
	120
	121	return SOAP_OK;
	122	}
	123	*/
109	124
110	125	void

capture-mod/trunk/Visitor.cpp

r1644	r1724
8	8
9	9	hQueueNotEmpty = CreateEvent(NULL, FALSE, FALSE, NULL);
10		~~printf("Visitor: boost that sucka\n");~~
11	10	onServerVisitEventConnection=EventController::getInstance()->connect_onServerEvent(L"visit", boost::bind(&Visitor::onServerEvent, this, _1));
12	11

capture-mod/trunk/captureGSOAP.h

r1644	r1724
7	7	//gsoap ns service port: http://192.168.0.131:1234
8	8	//gsoap ns service namespace: capture
	9
	10	/*
	11	typedef struct ms2{
	12	char * first;
	13	char * last;
	14	} ns__myStruct2;
	15
	16	int ns__junks(char * a, ns__myStruct2 &result);
	17	*/
	18
9	19	int ns__add(int a, int b, int &result);
10		int ns__ping(char * a, char ** result);
	20	int ns__ping(char * a, char ** result);
11	21	int ns__sub(double a, double b, double &result);

capture-mod/trunk/install/FileMonitor.exl

r1248	r1724
9	9	+ Delete C:\\program Files\\capture\\captureclient\.exe C:\\program files\\capture\\.+\.zip
10	10	#Prefetch
11		+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\Prefetch\\.+
	11	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\Prefetch.*
	12	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\Prefetch.*
12	13	+ Write System C:\\WINDOWS\\Prefetch\\.+
13	14	#NTFS Metadata
…	…
50	51	+ Write C:\\WINDOWS\\system32\\services\.exe C:\\WINDOWS\\system32\\config\\SecEvent\.Evt
51	52	#Mapping
52		+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\wbem~~\\.+~~
	53	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\wbem.*
53	54	#Cataloging
54	55	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\CatRoot2\\.+
…	…
73	74	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\Documents and Settings\\.+\\Local Settings\\Temp\\.+tmp
74	75	# History
75		+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History.IE5\\.+
76		+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History.IE5\\.+
	76	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5\\.+
	77	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5\\.+
	78	+ Write C:\\WINDOWS\\explorer\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5\\.+
	79	+ Delete C:\\WINDOWS\\explorer\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5\\.+
77	80	# IE Cookies
78	81	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\Documents and Settings\\.+\\Cookies\\.+
…	…
94	97	+ Write C:\\Program Files\\Messenger\\msmsgs\.exe C:\\Documents and Settings\\.+\\NTUSER.DAT.LOG
95	98	+ Delete C:\\Program Files\\Messenger\\msmsgs\.exe C:\\Documents and Settings\\.+\\NTUSER.DAT.LOG
96		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\$LogFile
97		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\$Directory
98		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\$Mft
99		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe F:\$LogFile
	99	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\\$LogFile
	100	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\\$Directory
	101	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\\$Mft
	102	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe F:\\\$LogFile
100	103
101	104	###################################################
…	…
125	128	###################################################
126	129	# Alert about executables or scripts that are written to disk
127		- Write .* .+\.bat
128		- Write .* .+\.cmd
129		- Write .* .+\.exe
130		- Write .* .+\.inf
131		- Write .* .+\.lnk
132		- Write .* .+\.msi
133		- Write .* .+\.msp
134		- Write .* .+\.pif
135		- Write .* .+\.reg
136		- Write .* .+\.sct
137		- Write .* .+\.shs
138		- Write .* .+\.scr
139		- Write .* .+\.wsc
140		- Write .* .+\.wsf
141		- Write .* .+\.wsh
	130	#XENO: I recommend commenting out all blacklist entries until this has some way to
	131	#deal with the fact that these will always be written to the tmp file if you visit
	132	#a link to one of these directly...If we could add whitelist entries back in AFTER
	133	#these, pointing at the tmp file dir, signifying that we don't care as long as it
	134	#is in that dir, but care about everything else, then this would be usable...but until
	135	#then...not so much.
	136	#I tested adding a + entry for the temp downloads file after the - entry. It seemed
	137	#to work for .vb files, but not .exe files, which is what we care about much more.
	138	#- Write .* .+\.bat
	139	#- Write .* .+\.cmd
	140	#commented out for VMwareService.exe, since it writes .inf files.
	141	#- Write .* .+\.inf
	142	#- Write .* .+\.lnk
	143	#- Write .* .+\.msi
	144	#- Write .* .+\.msp
	145	#- Write .* .+\.pif
	146	#- Write .* .+\.reg
	147	#- Write .* .+\.sct
	148	#- Write .* .+\.shs
	149	#commented out for sites that download \.scr into the temp files folder.
	150	#- Write .* .+\.scr
	151	#- Write .* .+\.wsc
	152	#- Write .* .+\.wsf
	153	#- Write .* .+\.wsh
142	154	#commented out for IE because \.com cache files and \.vb script files are very common
143	155	#- Write .* .+\.vb
144	156	#- Write .* .+\.com
	157	#commented out for IE because .exe downloads to the cache dir are very common
	158	#- Write .* .+\.exe
145	159	# Alert about modifications to startup locations
146	160	- Write .* C:\\Documents and Settings\\.+\\Start Menu\\Programs\\Startup.+
…	…
154	168	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
155	169	+ Delete C:\\WINDOWS\\system32\\defrag\.exe C:\\.*\.tmp
156		+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\$ReplaceAttribute
157		+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\$ReplaceAttribute
158		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\$LogFile
159		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\$Directory
160		+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\$Mft
	170	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\\$ReplaceAttribute
	171	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\\$ReplaceAttribute
	172	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\\$LogFile
	173	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\\$Directory
	174	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\\$Mft
161	175	#### HONEYCLIENT manual
162	176	+ Write C:\\WINDOWS\\system32\\dwwin\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temp\\.*
…	…
166	180	+ Delete C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe C:\\WINDOWS\\system32\\wbem\\Performance\\WmiApRpl\.h
167	181	+ Delete C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe C:\\WINDOWS\\system32\\PerfStringBackup\.TMP
	182	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS
	183	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\AppPatch
	184	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\system32
	185	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\system32\\config
	186	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\system32\\config\\systemprofile
	187	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\system32\\wbem
	188	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\system32\\wbem\\Repository\\FS
	189	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\system32\\Prefetch
	190	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR
	191	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Config
	192	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR\\PackageStore
	193	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\
	194	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\Prefetch
	195	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries
	196	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR\\DataColl
	197	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe E:\\
	198	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\WinSxS
	199	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\WinSxS\\MANIFESTS
	200	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\WinSxS\\Policies
	201	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\REGISTRATION
	202	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\WINDOWS\\WinSxS\\Policies\\.*
	203	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\Documents and Settings
	204	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\Documents and Settings\\Default User
	205	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\Documents and Settings\\ALL USERS
	206	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\Documents and Settings\\Default User\\Start Menu\\Programs
	207	+ Write C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe C:\\Documents and Settings\\All Users\\START MENU
	208
	209	#### Honeyclient manual add - helpsvc.exe
	210	+ Write C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpsvc\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR\\DataColl\\.*
	211	+ Delete C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpsvc\.exe C:\\WINDOWS\\PCHEALTH\\HELPCTR\\DataColl\\.*
	212
	213	#### Honeyclient manual add - dfrgntfs.exe - ticket #143
	214	+ Write C:\\WINDOWS\\system32\\dfrgntfs\.exe .*
	215
	216	#### Honeyclient manual add - iexplore.exe - ticket #142
	217	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\Cab.*\.tmp
	218	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\Cab.*\.tmp
	219	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\Tar.*\.tmp
	220	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\Tar.*\.tmp
	221
	222	#### Honeyclient manual add - iexplore.exe - ticket #144 (windows update services)
	223	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\WindowsUpdate.log
	224	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\system32\\wuweb\.dll
	225	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\system32\\wuweb\.dll
	226	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp
	227	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp\\wuweb\.dll
	228	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp\\wuweb\.dll
	229	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp\\wuweb\.inf
	230	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp\\wuweb\.inf
	231	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp\\wuweb\.cat
	232	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\ICD.?.?\.tmp\\wuweb\.cat
	233	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\system32\\CatRoot2\\dberr\.txt
	234	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\LastGood\\TMP.*\.tmp
	235	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\system32\\SET.*\.tmp
	236	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\system32\\SET.*\.tmp
	237	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\Downloaded Program Files\\SET.*\.tmp
	238	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\Downloaded Program Files\\SET.*\.tmp
	239	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WuRedir\\9482F4B4-E343-43B6-B170-9A65BC822C77\\wuredir\.cab\.bak
	240	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WuRedir\\9482F4B4-E343-43B6-B170-9A65BC822C77\\wuredir\.cab\.bak
	241	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WuRedir\\9482F4B4-E343-43B6-B170-9A65BC822C77\\wuredir\.xml
	242	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WuRedir\\9482F4B4-E343-43B6-B170-9A65BC822C77\\wuredir\.cab
	243	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wuident\.txt
	244	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wuident\.txt
	245	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wuident\.cab
	246	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wuident\.cab
	247	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wsus3setup\.cab
	248	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wsus3setup\.cab
	249	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wsus3setup\.inf
	250	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wsus3setup\.inf
	251	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wsus3setup\.cat
	252	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\SoftwareDistribution\\WebSetup\\wsus3setup\.cat
	253	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\CatRoot2\\tmp\.edb
	254	+ Write C:\\WINDOWS\\system32\\winlogon\.exe C:\\WINDOWS\\system32\\dllcache\\wuweb\.dll\.new
	255
	256	#### Honeyclient manual add - iexplore.exe - ticket #136 (flash)
	257	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\fla.*\.tmp
	258	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\fla.*\.tmp
	259	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\fla.*\.tmp
	260	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\fla.*\.tmp
	261
	262	#### Honeyclient manual add - iexplore.exe - ticket #152
	263	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\VGX.*\.tmp
	264
	265	#### Honeyclient manual add - iexplore.exe
	266	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\wbk.*\.tmp
	267
	268	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates
	269	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS
	270	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\SoftwareDistribution\\DataStore\\Logs
	271	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32
	272	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\repair
	273	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\SoftwareDistribution
	274	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Cookies
	275	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Cookies\\index.dat
	276	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5.*
	277	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5.*
	278	+ Write C:\\WINDOWS\\system32\\WgaTray\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5.*
	279	+ Delete C:\\WINDOWS\\system32\\WgaTray\.exe C:\\Documents and Settings\\.+\\Local Settings\\History\\History\.IE5.*
	280	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\cygwin.*
	281	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Desktop
	282	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Desktop\\%USERPROFILE%\\Local Settings\\Application Data\\Microsoft\\Feeds Cache
	283	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files.*
	284	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files\\Content\.IE5\\.*
	285	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator
	286	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Desktop\\%USERPROFILE%\\Local Settings\\Application Data\\Microsoft\\Feeds Cache\\index\.dat
	287	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Internet Explorer\\MSIMGSIZ\.DAT
	288	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings
	289	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files\\AntiPhishing\\.+
	290	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Program Files\\Internet Explorer
	291	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temporary Internet Files\\Content\.IE5
	292	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\Macromed\\Flash
	293	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Feeds Cache
	294	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Program Files
	295	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Favorites
	296	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Program Files\\Messenger
	297	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Application Data\\Microsoft\\Feeds Cache\\index\.dat
	298	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\Microsoft\.NET\\Framework.*
	299	+ Write C:\\WINDOWS\\system32\\WgaTray\.exe C:\\Documents and Settings\\.+\\Local Settings\\Temporary Internet Files\\.*
	300	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Cookies\\.+
	301	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Cookies\\index.dat
	302	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Cookies\\.+
	303	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Cookies\\index.dat
	304	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\WinSxS\\Policies\\.*
	305	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\WinSxS
	306	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\
	307	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\Temp
	308
	309	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	310	#No guarantees that the % will be interpreted literally by the regex processing...but this is what it spit out
	311	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\Administrator\\Desktop\\%USERPROFILE%\\UserData\\index\.dat
	312
	313	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	314	+ Write C:\\WINDOWS\\system32\\lsass\.exe C:\\Documents and Settings\\Administrator\\Application Data\\Microsoft\\Protect\\.*
	315
	316
	317	###Stuff that got accidentally removed in r 1511
	318
	319	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\Temp\\WGANotify\.settings
	320	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\config
	321	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Application Data.*
	322	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Application Data.*
	323	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\.+\\Application Data\\Microsoft\\CryptnetUrlCache.*
	324	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\All Users
	325	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\SoftwareDistribution\\Download
	326	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\SoftwareDistribution\\Download.*
	327	+ Delete C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\SoftwareDistribution\\Download.*
	328	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\wbem
	329
	330	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - IE7 accessing live.com
	331	+ Write C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe C:\\WINDOWS\\system32\\config\\system\.LOG
	332	+ Write C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe C:\\WINDOWS\\system32\\config\\system
	333	+ Write C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe C:\\WINDOWS\\system32\\config
	334
	335	# IE7 - Exclusion
	336	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\Documents and Settings\\LocalService
	337	+ Write C:\\WINDOWS\\system32\\svchost\.exe C:\\WINDOWS\\system32\\config\\SysEvent\.Evt
	338
	339	# VMware Tools
	340	+ Write C:\\Program Files\\VMware\\VMware Tools\\VMwareUser\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temp.*
	341	+ Delete C:\\Program Files\\VMware\\VMware Tools\\VMwareUser\.exe C:\\Documents and Settings\\Administrator\\Local Settings\\Temp.*
	342
	343	# IE - Active Scripting Printing
	344	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+htm
	345	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+html
	346	+ Delete C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+tmp
	347	+ Write C:\\Program Files\\Internet Explorer\\iexplore\.exe C:\\WINDOWS\\.+tmp
	348
	349	# System Log Files - IE7
	350	+ Write C:\\WINDOWS\\system32\\services\.exe C:\\WINDOWS\\Debug\\UserMode\\userenv\.log
	351
	352	# IE6 Crashing
	353	+ Write C:\\WINDOWS\\system32\\drwtsn32\.exe C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Dr Watson\\.*

capture-mod/trunk/install/ProcessMonitor.exl

r1248	r1724
15	15	### Microsoft Internet Explorer 6.0 ###
16	16	###################################################
17		+ iexplore.exe .* C:\\Program Files\\Internet Explorer\\iexplore.exe
	17	+ iexplore.exe .* C:\\Program Files\\Internet Explorer\\iexplore\.exe
18	18	#agent server is an activeX control that starts upon displaying multimedia content
19		+ agentsvr.exe .* C:\\WINDOWS\\msagent\\agentsvr.exe
	19	+ agentsvr.exe .* C:\\WINDOWS\\msagent\\agentsvr\.exe
20	20	#messenger activeX
21		+ msmsgs.exe .* C:\\Program Files\\Messenger\\msmsgs.exe
	21	+ msmsgs.exe .* C:\\Program Files\\Messenger\\msmsgs\.exe
22	22	###################################################
23	23	### Honeyclient added/specific? ###
24	24	###################################################
25		#FIXME: Xeno - ~~Does specifying a parent process even work? I tried~~
	25	#FIXME: Xeno - specifying a parent process doesn't work - this is a known bug
26	26	+ bash.exe .* C:\\cygwin\\bin\\bash\.exe
27	27	+ perl.exe .* C:\\cygwin\\bin\\perl\.exe
…	…
33	33	+ WgaTray.exe .* C:\\WINDOWS\\system32\\WgaTray\.exe
34	34	+ alg.exe .* C:\\WINDOWS\\system32\\alg\.exe
35		+ firefox.exe .* C:\\Program Files\\Mozilla Firefox\\firefox\.exe#### HONEYCLIENT AUTO EXCLUDE SCRIPT
36		+ setup_wm.exe .* C:\\Program Files\\Windows Media Player\\setup_wm.exe
37		+ wmplayer.exe .* C:\\Program Files\\Windows Media Player\\wmplayer.exe
	35	+ firefox.exe .* C:\\Program Files\\Mozilla Firefox\\firefox\.exe
	36
	37	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	38	+ setup_wm.exe .* C:\\Program Files\\Windows Media Player\\setup_wm\.exe
	39	+ wmplayer.exe .* C:\\Program Files\\Windows Media Player\\wmplayer\.exe
	40
	41	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates
	42	+ verclsid.exe .* C:\\WINDOWS\\system32\\verclsid\.exe
	43	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	44	#This is related to the language bar...I just installed updates, and it was newly activated
	45	#thus I consider it something valid to add
	46	+ ctfmon.exe .* C:\\WINDOWS\\system32\\ctfmon\.exe
	47
	48	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - IE7 accessing live.com
	49	+ infocard.exe .* C:\\WINDOWS\\Microsoft.NET\\Framework\\v3.0\\Windows Communication Foundation\\infocard\.exe
	50
	51	# IE - Active Scripting Printing
	52	+ rundll32.exe .* C:\\WINDOWS\\system32\\rundll32\.exe
	53
	54	# IE - Random Crashing Due To Poor Application Coding
	55	+ drwtsn32.exe .* C:\\WINDOWS\\system32\\drwtsn32\.exe

capture-mod/trunk/install/RegistryMonitor.exl

r1248	r1724
14	14	+ SetValueKey .* HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\.+
15	15	+ SetValueKey .* HKLM\\SOFTWARE\\Microsoft\\Cryptography\\RNG\\Seed.*
16		+ SetValueKey C:\\WINDOWS\\explorer.exe HKCU\\SessionInformation\\.+
17		+ SetValueKey C:\\WINDOWS\\explorer.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
18		+ SetValueKey C:\\WINDOWS\\explorer.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
19		+ SetValueKey C:\\WINDOWS\\explorer.exe HKU\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
20		+ SetValueKey C:\\WINDOWS\\system32\\winlogon.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\.+
21		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe \\REGISTRY\\USER\\.+
22		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKU\\.+
	16	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\SessionInformation\\.+
	17	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
	18	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
	19	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKU\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
	20	+ SetValueKey C:\\WINDOWS\\system32\\winlogon\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\.+
	21	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe \\REGISTRY\\USER\\.+
	22	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKU\\.+
23	23	+ SetValueKey C:\\WINDOWS\\system32\\WgaTray\.exe HKCU\\SOFTWARE\\Microsoft\\SystemCertificates\\.+
24		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKCU\\Software\\Microsoft\\SystemCertificates\\Root\\.+
25		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\.+
26		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\.+
27		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\.+
28		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\.+
29		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\.+
30		+ SetValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SYSTEM\\ControlSet001\\.+
31		+ SetValueKey C:\\WINDOWS\\system32\\services.exe HKLM\\SYSTEM\\ControlSet001\\.+
32		+ SetValueKey C:\\WINDOWS\\system32\\lsass.exe HKLM\\SECURITY\\.+
33		+ SetValueKey C:\\WINDOWS\\system32\\lsass.exe HKCU\\Software\\Microsoft\\Protected Storage System Provider\\.+
34		+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\.+
35		+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap.exe HKLM\\SYSTEM\\ControlSet001\\Services\\WmiApRpl\\Performance\\.+
36		+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\.+
37		+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\WDM\\.+
	24	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKCU\\Software\\Microsoft\\SystemCertificates\\Root\\.+
	25	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\.+
	26	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\.+
	27	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\.+
	28	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\.+
	29	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\.+
	30	+ SetValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SYSTEM\\ControlSet001\\.+
	31	+ SetValueKey C:\\WINDOWS\\system32\\services\.exe HKLM\\SYSTEM\\ControlSet001\\.+
	32	+ SetValueKey C:\\WINDOWS\\system32\\lsass\.exe HKLM\\SECURITY\\.+
	33	+ SetValueKey C:\\WINDOWS\\system32\\lsass\.exe HKCU\\Software\\Microsoft\\Protected Storage System Provider\\.+
	34	+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\.+
	35	+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe HKLM\\SYSTEM\\ControlSet001\\Services\\WmiApRpl\\Performance\\.+
	36	+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\.+
	37	+ SetValueKey C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\WDM\\.+
38	38	+ DeleteValueKey .* HKU\\.+\\SessionInformation\\ProgramCount
39	39	+ DeleteValueKey .* HKCU\\Software\\Microsoft\\Windows\\ShellNoRoam.*
40	40	+ DeleteValueKey .* HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Installer\\UserData\\.+
41	41	+ DeleteValueKey .* HKLM\\SOFTWARE\\Microsoft\\Cryptography\\RNG\\Seed.*
42		+ DeleteValueKey C:\\WINDOWS\\explorer.exe HKCU\\SessionInformation\\.+
43		+ DeleteValueKey C:\\WINDOWS\\explorer.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
44		+ DeleteValueKey C:\\WINDOWS\\explorer.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
45		+ DeleteValueKey C:\\WINDOWS\\explorer.exe HKU\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
46		+ DeleteValueKey C:\\WINDOWS\\system32\\winlogon.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\.+
47		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe \\REGISTRY\\USER\\.+
48		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKU\\.+
	42	+ DeleteValueKey C:\\WINDOWS\\explorer\.exe HKCU\\SessionInformation\\.+
	43	+ DeleteValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
	44	+ DeleteValueKey C:\\WINDOWS\\explorer\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
	45	+ DeleteValueKey C:\\WINDOWS\\explorer\.exe HKU\\.+\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\.+
	46	+ DeleteValueKey C:\\WINDOWS\\system32\\winlogon\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Group Policy\\State\\.+
	47	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe \\REGISTRY\\USER\\.+
	48	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKU\\.+
49	49	+ DeleteValueKey C:\\WINDOWS\\system32\\WgaTray\.exe HKCU\\SOFTWARE\\Microsoft\\SystemCertificates\\.+
50		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKCU\\Software\\Microsoft\\SystemCertificates\\Root\\.+
51		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\.+
52		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\.+
53		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\.+
54		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\.+
55		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\.+
56		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKCU\\Software\\Microsoft\\SystemCertificates\\Root\\.+
57		+ DeleteValueKey C:\\WINDOWS\\system32\\svchost.exe HKLM\\SYSTEM\\ControlSet001\\.+
58		+ DeleteValueKey C:\\WINDOWS\\system32\\services.exe HKLM\\SYSTEM\\ControlSet001\\.+
59		+ DeleteValueKey C:\\WINDOWS\\system32\\lsass.exe HKLM\\SECURITY\\.+
60		+ DeleteValueKey C:\\WINDOWS\\system32\\lsass.exe HKCU\\Software\\Microsoft\\Protected Storage System Provider\\.+
61		+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\.+
62		+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap.exe HKLM\\SYSTEM\\ControlSet001\\Services\\WmiApRpl\\Performance\\.+
63		+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\.+
64		+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiprvse.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\WDM\\.+
	50	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKCU\\Software\\Microsoft\\SystemCertificates\\Root\\.+
	51	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\SystemCertificates\\AuthRoot\\.+
	52	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\.+
	53	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\.+
	54	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\.+
	55	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\.+
	56	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKCU\\Software\\Microsoft\\SystemCertificates\\Root\\.+
	57	+ DeleteValueKey C:\\WINDOWS\\system32\\svchost\.exe HKLM\\SYSTEM\\ControlSet001\\.+
	58	+ DeleteValueKey C:\\WINDOWS\\system32\\services\.exe HKLM\\SYSTEM\\ControlSet001\\.+
	59	+ DeleteValueKey C:\\WINDOWS\\system32\\lsass\.exe HKLM\\SECURITY\\.+
	60	+ DeleteValueKey C:\\WINDOWS\\system32\\lsass\.exe HKCU\\Software\\Microsoft\\Protected Storage System Provider\\.+
	61	+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\.+
	62	+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe HKLM\\SYSTEM\\ControlSet001\\Services\\WmiApRpl\\Performance\\.+
	63	+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiadap\.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Perflib\\.+
	64	+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe HKLM\\SOFTWARE\\Microsoft\\WBEM\\WDM\\.+
65	65	#defrag
66		+ SetValueKey C:\\WINDOWS\\system32\\dfrgntfs.exe HKLM\\SOFTWARE\\Microsoft\\Dfrg.*
67		+ DeleteValueKey C:\\WINDOWS\\system32\\dfrgntfs.exe HKLM\\SOFTWARE\\Microsoft\\Dfrg.*
	66	+ SetValueKey C:\\WINDOWS\\system32\\dfrgntfs\.exe HKLM\\SOFTWARE\\Microsoft\\Dfrg.*
	67	+ DeleteValueKey C:\\WINDOWS\\system32\\dfrgntfs\.exe HKLM\\SOFTWARE\\Microsoft\\Dfrg.*
68	68	#windows update
69		+ SetValueKey C:\\WINDOWS\\system32\\wuauclt.exe HKLM\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application\\ESENT\\.+
70		+ DeleteValueKey C:\\WINDOWS\\system32\\wuauclt.exe HKLM\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application\\ESENT\\.+
	69	+ SetValueKey C:\\WINDOWS\\system32\\wuauclt\.exe HKLM\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application\\ESENT\\.+
	70	+ DeleteValueKey C:\\WINDOWS\\system32\\wuauclt\.exe HKLM\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application\\ESENT\\.+
71	71	###################################################
72	72	### Internet Explorer 6.0 SP2 ###
…	…
114	114	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.+
115	115	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache.+
116		+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Passport~~\\.+~~
	116	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Passport.*
117	117	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\.+
118	118	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Direct3D.+
…	…
160	160	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\5.0\\Cache.+
161	161	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Cache.+
162		+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Passport~~\\.+~~
	162	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Passport.*
163	163	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders\\.+
164	164	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Direct3D.+
…	…
312	312	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKLM\\SYSTEM\\ControlSet001\\Control\\Print\\Printers
313	313	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKLM\\SYSTEM\\ControlSet001\\Control\\Print\\Providers
	314
	315	#### Honeyclient manual add - helpsvc.exe
	316	+ SetValueKey C:\\WINDOWS\\PCHEALTH\\HELPCTR\\Binaries\\helpsvc.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\.+
	317
	318	#### Honeyclient manual add - iexplore.exe - ticket #144 (windows update services)
	319	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\ModuleUsage\\C:\/WINDOWS\/System32\/wuweb\.dll
	320	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\SharedDLLs
	321	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\\{6414512B-B978-451D-A0D8-FCFDF33E833C\}
	322	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\\{6414512B-B978-451D-A0D8-FCFDF33E833C\}\\DownloadInformation
	323	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\\{6414512B-B978-451D-A0D8-FCFDF33E833C\}\\InstalledVersion
	324	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Code Store Database\\Distribution Units\\\{6414512B-B978-451D-A0D8-FCFDF33E833C\}\\Contains\\Files
	325	+ SetValueKey C:\\WINDOWS\\system32\\winlogon.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon
	326
	327	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates
	328	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing\\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F
	329	+ DeleteValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	330	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows
	331	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows
	332	+ DeleteValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\S.+\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	333	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\S.+\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	334	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	335	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\LowRegistry
	336	+ DeleteValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\S.+\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	337	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Zoom
	338	+ DeleteValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	339	+ DeleteValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	340	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\CTF\\TIP\\\{1188450c-fdab-47ae-80d8-c9633f71be64\}\\LanguageProfile\\0x00000000\\\{63800dac-e7ca-4df9-9a5c-20765055488d\}
	341	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Ports
	342	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\S.+\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows
	343	+ DeleteValueKey C:\\WINDOWS\\system32\\userinit\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	344	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\S.+\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	345	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	346	+ DeleteValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	347	+ DeleteValueKey C:\\WINDOWS\\system32\\userinit\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Devices
	348	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	349	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached
	350	+ SetValueKey C:\\WINDOWS\\system32\\spoolsv\.exe HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\PrinterPorts
	351	+ SetValueKey C:\\WINDOWS\\system32\\userinit\.exe HKCU\\Printers
	352	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\PhishingFilter
	353
	354	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	355	+ SetValueKey C:\\Program Files\\Windows Media Player\\wmpnscfg\.exe HKLM\\SOFTWARE\\Microsoft\\Windows Media Player NSS\\.*
	356	+ SetValueKey C:\\Program Files\\Windows Media Player\\wmpnetwk\.exe HKLM\\SOFTWARE\\Microsoft\\Windows Media Player NSS\\.*
	357
	358	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - Internet Explorer 7 Updates
	359	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\Shell\\Bag.+
	360	#The above should cover the below 2 cases...but it didn't...why?
	361	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\Shell\\Bags\\1\\Desktop
	362	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\Shell\\BagMRU
	363	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	364	+ SetValueKey C:\\Program Files\\Internet Explorer\\IEXPLORE\.EXE HKCU\\Software\\Microsoft\\Internet Explorer\\International
	365
	366	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	367	#After installing updates, the language bar was newly activated, these are related to that, and thus seem reasonable to add
	368	+ SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\CTF\\Sapilayr
	369	+ DeleteValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
	370	+ SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\CTF\\TIP\\.+\\LanguageProfile\\.*
	371	+ SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
	372	+ SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\CTF\\LangBar
	373
	374	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\SearchScopes\\.*
	375	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\LowRegistry\\Extensions\\CmdMapping
	376	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\SearchUrl
	377	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Clients\\StartMenuInternet\\IEXPLORE\.EXE\\DefaultIcon
	378	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar\\WebBrowser
	379	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Internet Explorer\\Setup\\7\.0
	380	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Shell Extensions\\Cached
	381	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\SearchScopes
	382	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Active Setup\\Installed Components
	383	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Security\\AntiPhishing\\.+\\Smart Screen DAT file
	384	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\ShellExecuteHooks
	385
	386	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\CTF\\LangBar
	387
	388	#NOTE: looks like a likely bug value (translation not getting done)
	389	+ DeleteValueKey C:\\WINDOWS\\system32\\wbem\\wmiprvse\.exe \\REGIS
	390
	391	#### HONEYCLIENT AUTO EXCLUDE SCRIPT
	392	+ DeleteValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
	393	+ SetValueKey C:\\WINDOWS\\system32\\ctfmon\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
	394
	395	#### HONEYCLIENT AUTO EXCLUDE SCRIPT - IE7 accessing live.com
	396	+ SetValueKey C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe HKU\\\.DEFAULT\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders
	397	+ SetValueKey C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe HKLM\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application
	398	+ SetValueKey C:\\WINDOWS\\Microsoft\.NET\\Framework\\v3\.0\\Windows Communication Foundation\\infocard\.exe HKLM\\SYSTEM\\ControlSet001\\Services\\Eventlog\\Application\\idsvc
	399	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Main
	400
	401	# IE7 - accessing multimedia pages
	402	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\MPEG2Demultiplexer
	403
	404	# IE - Active Scripting Printing
	405	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\PageSetup
	406
	407	# IE - Random Crashing Due To Poor Application Coding
	408	+ SetValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\.*
	409	+ DeleteValueKey C:\\Program Files\\Internet Explorer\\iexplore\.exe HKLM\\SOFTWARE\\Microsoft\\PCHealth\\ErrorReporting\\.*
	410
	411	# IE - Dr Watson IE 6 Crashing
	412	+ SetValueKey C:\\WINDOWS\\system32\\drwtsn32\.exe HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders.*
	413	+ SetValueKey C:\\WINDOWS\\system32\\drwtsn32\.exe HKLM\\SOFTWARE\\Microsoft\\DrWatson.*
	414
	415	# Benign Explorer Activity
	416	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Internet Explorer\\Toolbar.*
	417	+ SetValueKey C:\\WINDOWS\\explorer\.exe HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.*

capture-mod/trunk/soapC.cpp

r1644	r1724
8	8	#include "soapH.h"
9	9
10		SOAP_SOURCE_STAMP("@(#) soapC.cpp ver 2.7.10 2008-0~~6-27 05:00:35~~ GMT")
	10	SOAP_SOURCE_STAMP("@(#) soapC.cpp ver 2.7.10 2008-08-12 07:24:58 GMT")
11	11
12	12
…	…
162	162	case SOAP_TYPE_double:
163	163	return soap_in_double(soap, NULL, NULL, "xsd:double");
	164	case SOAP_TYPE_ns__junks:
	165	return soap_in_ns__junks(soap, NULL, NULL, "ns:junks");
164	166	case SOAP_TYPE_ns__sub:
165	167	return soap_in_ns__sub(soap, NULL, NULL, "ns:sub");
…	…
174	176	case SOAP_TYPE_ns__addResponse:
175	177	return soap_in_ns__addResponse(soap, NULL, NULL, "ns:addResponse");
	178	case SOAP_TYPE_ns__myStruct2:
	179	return soap_in_ns__myStruct2(soap, NULL, NULL, "ns:myStruct2");
	180	case SOAP_TYPE_ms2:
	181	return soap_in_ms2(soap, NULL, NULL, "ms2");
176	182	case SOAP_TYPE_PointerTostring:
177	183	return soap_in_PointerTostring(soap, NULL, NULL, "xsd:string");
…	…
197	203	return soap_in_double(soap, NULL, NULL, NULL);
198	204	}
	205	if (!soap_match_tag(soap, t, "ns:junks"))
	206	{ *type = SOAP_TYPE_ns__junks;
	207	return soap_in_ns__junks(soap, NULL, NULL, NULL);
	208	}
199	209	if (!soap_match_tag(soap, t, "ns:sub"))
200	210	{ *type = SOAP_TYPE_ns__sub;
…	…
220	230	{ *type = SOAP_TYPE_ns__addResponse;
221	231	return soap_in_ns__addResponse(soap, NULL, NULL, NULL);
	232	}
	233	if (!soap_match_tag(soap, t, "ns:myStruct2"))
	234	{ *type = SOAP_TYPE_ns__myStruct2;
	235	return soap_in_ns__myStruct2(soap, NULL, NULL, NULL);
	236	}
	237	if (!soap_match_tag(soap, t, "ms2"))
	238	{ *type = SOAP_TYPE_ms2;
	239	return soap_in_ms2(soap, NULL, NULL, NULL);
222	240	}
223	241	if (!soap_match_tag(soap, t, "xsd:string"))
…	…
305	323	case SOAP_TYPE_double:
306	324	return soap_out_double(soap, tag, id, (const double *)ptr, "xsd:double");
	325	case SOAP_TYPE_ns__junks:
	326	return soap_out_ns__junks(soap, tag, id, (const struct ns__junks *)ptr, "ns:junks");
307	327	case SOAP_TYPE_ns__sub:
308	328	return soap_out_ns__sub(soap, tag, id, (const struct ns__sub *)ptr, "ns:sub");
…	…
317	337	case SOAP_TYPE_ns__addResponse:
318	338	return soap_out_ns__addResponse(soap, tag, id, (const struct ns__addResponse *)ptr, "ns:addResponse");
	339	case SOAP_TYPE_ns__myStruct2:
	340	return soap_out_ns__myStruct2(soap, tag, id, (const struct ms2 *)ptr, "ns:myStruct2");
	341	case SOAP_TYPE_ms2:
	342	return soap_out_ms2(soap, tag, id, (const struct ms2 *)ptr, "ms2");
319	343	case SOAP_TYPE_PointerTostring:
320	344	return soap_out_PointerTostring(soap, tag, id, (char *const)ptr, "xsd:string");
…	…
342	366	switch (type)
343	367	{
	368	case SOAP_TYPE_ns__junks:
	369	soap_serialize_ns__junks(soap, (const struct ns__junks *)ptr);
	370	break;
344	371	case SOAP_TYPE_ns__sub:
345	372	soap_serialize_ns__sub(soap, (const struct ns__sub *)ptr);
…	…
360	387	soap_serialize_ns__addResponse(soap, (const struct ns__addResponse *)ptr);
361	388	break;
	389	case SOAP_TYPE_ns__myStruct2:
	390	soap_serialize_ns__myStruct2(soap, (const struct ms2 *)ptr);
	391	break;
	392	case SOAP_TYPE_ms2:
	393	soap_serialize_ms2(soap, (const struct ms2 *)ptr);
	394	break;
362	395	case SOAP_TYPE_PointerTostring:
363	396	soap_serialize_PointerTostring(soap, (char *const)ptr);
…	…
381	414	switch (t)
382	415	{
	416	case SOAP_TYPE_ms2:
	417	return (void*)soap_instantiate_ms2(soap, -1, type, arrayType, n);
383	418	case SOAP_TYPE_ns__addResponse:
384	419	return (void*)soap_instantiate_ns__addResponse(soap, -1, type, arrayType, n);
…	…
393	428	case SOAP_TYPE_ns__sub:
394	429	return (void*)soap_instantiate_ns__sub(soap, -1, type, arrayType, n);
	430	case SOAP_TYPE_ns__junks:
	431	return (void*)soap_instantiate_ns__junks(soap, -1, type, arrayType, n);
395	432	#ifndef WITH_NOGLOBAL
396	433	case SOAP_TYPE_SOAP_ENV__Header:
…	…
413	450	return (void*)soap_instantiate_SOAP_ENV__Fault(soap, -1, type, arrayType, n);
414	451	#endif
	452	case SOAP_TYPE_ns__myStruct2:
	453	return (void*)soap_instantiate_ns__myStruct2(soap, -1, type, arrayType, n);