Changeset 1765

Show
Ignore:
Timestamp:
08/25/08 16:39:01 (3 months ago)
Author:
xkovah
Message:

confirmed that CaptureSoapServer::onRegistryEvent is getting notified when there is a registy event

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • capture-mod/trunk/Analyzer.cpp

    r1764 r1765  
    11#include "Analyzer.h" 
    22 
    3 Analyzer::Analyzer(Visitor* v, Server* s) 
    4 { 
    5     processMonitor = new ProcessMonitor(); 
    6     registryMonitor = new RegistryMonitor(); 
    7     fileMonitor = new FileMonitor(); 
     3Analyzer::Analyzer(Visitor* v, Server* s, ProcessMonitor * p, RegistryMonitor * r, FileMonitor * f) 
     4{ 
     5    processMonitor = p; 
     6    registryMonitor = r; 
     7    fileMonitor = f; 
    88    collectModifiedFiles = false; 
    99    captureNetworkPackets = false; 

  • capture-mod/trunk/Analyzer.h

    r1586 r1765  
    5656{ 
    5757public: 
    58     Analyzer(Visitor* v, Server* s); 
     58    Analyzer(Visitor* v, Server* s, ProcessMonitor * p, RegistryMonitor * r, FileMonitor * f); 
    5959    ~Analyzer(void); 
    6060 

  • capture-mod/trunk/CaptureClient.cpp

    r1726 r1765  
    6161        /* Start running the Capture Client */ 
    6262        visitor = new Visitor(); 
     63        //Moved these out of Analyzer, so that the soap server could access the same ones. 
     64        ProcessMonitor * p = new ProcessMonitor(); 
     65        RegistryMonitor * r = new RegistryMonitor(); 
     66        FileMonitor * f = new FileMonitor(); 
    6367        //Set up the standalone SOAP server 
    64         CaptureSoapServer a = CaptureSoapServer(visitor); 
    65         analyzer = new Analyzer(visitor, server); 
     68        soapSrv = new CaptureSoapServer(visitor, r); 
     69        analyzer = new Analyzer(visitor, server, p, r, f); 
    6670        Thread* captureClientThread = new Thread(this); 
    6771        captureClientThread->start("CaptureClient"); 
    …… 
    7680        delete visitor; 
    7781        delete server; 
    78          
     82        delete soapSrv; 
    7983         
    8084        Logger::getInstance()->closeLogFile(); 
    …… 
    258262    Visitor* visitor; 
    259263    Analyzer* analyzer; 
     264    CaptureSoapServer * soapSrv; 
    260265 
    261266    boost::signals::connection onServerConnectEventConnection; 

  • capture-mod/trunk/CaptureSoapServer.cpp

    r1764 r1765  
    1 /*This file can be renamed later, but just plain "soapserver.cpp" 
    2 **is already created automatically by the soapcpp2 tool 
     1/* 
    32**Created by Xeno Kovah of the MITRE HoneyClient Project 5/20/2008 
    43*/ 
    54 
    65#include "CaptureSoapServer.h" 
    7 #include "soapH.h"  
     6#include "soapH.h" 
    87#include "capture.nsmap"  
    98#include "Visitor.h" 
    109#include "b64.h" //nice small 3rd party lib for base64 encode/decode 
    1110 
    12 CaptureSoapServer::CaptureSoapServer(Visitor* v){ 
     11struct soap soap; 
     12 
     13CaptureSoapServer::CaptureSoapServer(Visitor* v, RegistryMonitor *r){ 
     14    registryMonitor = r; 
    1315    CaptureSoapServerThread = new Thread(this); 
    1416    CaptureSoapServerThread->start("CaptureSoapServer"); 
    1517} 
    1618 
    17 CaptureSoapServer::~CaptureSoapServer(){} 
     19CaptureSoapServer::~CaptureSoapServer(){ 
     20    //FIXME: I have no idea if these are appropriate here 
     21    soap_destroy(&soap); 
     22    soap_end(&soap); 
     23    soap_done(&soap); 
     24} 
    1825 
    1926void 
    …… 
    2128 
    2229    char debug = 0; 
    23     //The below code is taken verbatim from the gsoap standalone server example page 
    24    struct soap soap; 
    2530   SOCKET m, s; // master and slave sockets 
    2631 
     32   onRegistryEventConnection = registryMonitor->connect_onRegistryEvent(boost::bind(&CaptureSoapServer::onRegistryEvent, this, _1, _2, _3, _4, _5)); 
     33 
     34   //The below code is taken mostly from the gsoap standalone server example page 
    2735   soap_init(&soap); 
    28    //TODO: This needs to be configurable 
     36   //FIXME TODO: This needs to be configurable 
    2937   m = soap_bind(&soap, "192.168.0.131", 1234, 100); 
    3038   if (m < 0) 
    …… 
    5361} 
    5462 
     63void CaptureSoapServer::onRegistryEvent (wstring registryEventType, wstring time,  
     64                                        wstring processPath, wstring registryEventPath,  
     65                                        vector<wstring> extra) 
     66{ 
     67    wprintf(L"CaptureSoapServer::onRegistryEvent got an event for time = %hs\n", time); 
     68} 
     69 
     70 
    5571int ns__ping(struct soap *soap, char * a, char ** result)  
    5672{  
    …… 
    6177} 
    6278 
     79//Give it a url to browse to 
    6380int ns__visitURL(struct soap *soap, char * url, char ** result){ 
    6481    wchar_t xURL[1024]; 
    6582    wsprintf(xURL, L"%hs", url); 
    66     //Build my own new-fangled Element to pass to Visitor:onServerEvent which I think will open  
     83    //Build my own new-fangled Element to pass to Visitor:onServerEvent 
    6784    typedef boost::signal<void (Element*)> signal_serverEvent; 
    6885    Attribute att; 
    6986    att.name = L"url"; 
    70     att.value = xURL; //Now expecting you to pass the URL 
     87    att.value = xURL; 
    7188    Element e; 
    7289    e.name = L"visit"; 

  • capture-mod/trunk/CaptureSoapServer.h

    r1764 r1765  
    66#include "CaptureGlobal.h" //This needs to be first, due to a macro it defines 
    77#include "Visitor.h" 
     8#include "RegistryMonitor.h" 
    89 
    910using namespace std; 
    …… 
    1415public: 
    1516    typedef boost::signal<void (DWORD, DWORD, wstring, wstring)> signal_visitEvent; 
     17    boost::signals::connection onRegistryEventConnection; 
    1618 
    17     CaptureSoapServer(Visitor *); 
     19    CaptureSoapServer(Visitor *, RegistryMonitor *); 
    1820    ~CaptureSoapServer(); 
     21    void run(); 
     22    void onRegistryEvent (wstring registryEventType, wstring time, wstring processPath,  
     23                        wstring registryEventPath, vector<wstring> extra); 
    1924 
    20     void run(); 
    2125    Thread * CaptureSoapServerThread; 
    2226    static Visitor * myVisitor; 
    23  
     27    RegistryMonitor* registryMonitor; 
    2428};