CRITICAL_SECTION *p

)

{

if (p == NULL) {

fprintf(stderr, "InitializeCriticalSection invalid params\n");

return;

}

pthread_mutexattr_t a;

if ( pthread_mutexattr_init( &a ) != 0 ) {

fprintf( stderr, "Cannot init mutex attr\n" );

return;

}

if ( pthread_mutexattr_settype( &a, PTHREAD_MUTEX_RECURSIVE ) != 0 ) {

pthread_mutexattr_destroy( &a );

fprintf( stderr, "Cannot set mutex attr type\n" );

return;

}

if ( pthread_mutex_init( p, &a ) != 0 ) {

fprintf( stderr, "Cannot init mutex\n" );

}

pthread_mutexattr_destroy( &a );

if (p == NULL) {

fprintf(stderr, "EnterCriticalSection invalid params\n");

return;

}

pthread_mutex_lock( p );

if (p == NULL) {

fprintf(stderr, "TryEnterCriticalSection invalid params\n");

return false;

}

return pthread_mutex_trylock( p ) == 0;

if (p == NULL) {

fprintf(stderr, "LeaveCriticalSection invalid params\n");

return;

}

pthread_mutex_unlock( p );

if (p == NULL) {

fprintf(stderr, "DeleteCriticalSection invalid params\n");

return;

}

// The user is responsible with preventing further access to the mutex

pthread_mutex_destroy( p );

PSYSMON_EVENT_HEADER Process,

size_t Len,

ULONG ProcessId

)

{

PSYSMON_PROCESS_CREATE pc = NULL;

FILE *fp = NULL;

char pathFile[32];

ssize_t numRead = 0;

char imagePath[PATH_MAX];

char cwd[PATH_MAX];

char cmdline[128 * 1024];

size_t dataSize = 0;

unsigned int imagePathLen = 0;

unsigned int cwdLen = 0;

unsigned int cmdlineLen = 0;

PCHAR ptr = NULL;

unsigned int uid = 0;

unsigned int pts = 0;

struct stat st;

if (Process == NULL) {

return false;

}

pc = &Process->m_EventBody.m_ProcessCreateEvent;

//

// Get command line, image and working directory

//

snprintf( pathFile, 32, "/proc/%d/cmdline", ProcessId );

fp = fopen( pathFile, "rb" );

if (fp == NULL) {

return false;

}

numRead = fread( cmdline, 1, (128 * 1024) - 1, fp );

fclose( fp );

if (numRead > 0) {

// terminate cmdline

if (cmdline[numRead - 1] != 0x00) {

cmdline[numRead] = 0x00;

numRead++;

}

// convert nulls to spaces

for (int i=0; i<numRead - 1; i++) {

if (cmdline[i] == 0x00) {

cmdline[i] = ' ';

}

}

} else {

cmdline[0] = 0x00;

}

snprintf( pathFile, 32, "/proc/%d/exe", ProcessId );

numRead = readlink( pathFile, imagePath, PATH_MAX-1 );

if (numRead > 0) {

if (imagePath[numRead - 1] != 0x00) {

imagePath[numRead] = 0x00;

}

} else {

imagePath[0] = 0x00;

}

snprintf( pathFile, 32, "/proc/%d/cwd", ProcessId );

numRead = readlink( pathFile, cwd, PATH_MAX-1 );

if (numRead > 0) {

if (cwd[numRead - 1] != 0x00) {

cwd[numRead] = 0x00;

}

} else {

cwd[0] = 0x00;

}

uid = -1;

snprintf( pathFile, 32, "/proc/%d", ProcessId );

if (stat( pathFile, &st ) == 0) {

uid = st.st_uid;

}

imagePathLen = strlen( imagePath ) + 1;

cwdLen = strlen( cwd ) + 1;

cmdlineLen = strlen( cmdline ) + 1;

// calculate extension sizes and total data size

dataSize = sizeof( *Process ) + sizeof(uint64_t);

if ( dataSize + imagePathLen > Len ) {

imagePathLen = 0;

cwdLen = 0;

cmdlineLen = 0;

} else {

dataSize += imagePathLen;

if (dataSize + cwdLen > Len ) {

cwdLen = 0;

cmdlineLen = 0;

} else {

dataSize += cwdLen;

if ( dataSize + cmdlineLen > Len ) {

cmdlineLen = Len - dataSize;

}

dataSize += cmdlineLen;

}

}

Process->m_EventSize = dataSize;

Process->m_EventType = ProcessCreate;

Process->m_FieldFiltered = false;

Process->m_PreFiltered = false;

pc->m_ProcessId = ProcessId;

GetProcessInfo( &pc->m_CreateTime.QuadPart, &pts, &pc->m_ParentProcessId,

&pc->m_SessionId, &pc->m_ProcessKey, ProcessId );

pc->m_AuthenticationId.LowPart = uid;

pc->m_AuthenticationId.HighPart = pts;

memset( pc->m_Extensions, 0, sizeof(pc->m_Extensions) );

pc->m_Extensions[PC_Sid] = sizeof(uint64_t);

pc->m_Extensions[PC_ImagePath] = imagePathLen;

pc->m_Extensions[PC_CommandLine] = cmdlineLen;

pc->m_Extensions[PC_CurrentDirectory] = cwdLen;

ptr = (PCHAR)(pc + 1);

*(uint64_t *)ptr = uid;

ptr += sizeof(uint64_t);

#pragma GCC diagnostic push

#pragma GCC diagnostic ignored "-Wformat-truncation"

#pragma GCC diagnostic ignored "-Wstringop-overflow"

if (imagePathLen > 0) {

//snprintf( ptr, Len, "%s", imagePath );

memcpy(ptr, imagePath, sizeof(CHAR) * imagePathLen);

ptr += imagePathLen;

}

if (cmdlineLen > 0) {

//snprintf( ptr, cmdlineLen, "%s", cmdline );

memcpy(ptr, cmdline, sizeof(CHAR) * cmdlineLen);

ptr += cmdlineLen;

}

if (cwdLen > 0) {

//snprintf( ptr, cwdLen, "%s", cwd );

memcpy(ptr, cwd, sizeof(CHAR) * cwdLen);

}

#pragma GCC diagnostic pop

return true;

{

FILE *fp = NULL;

double uptimeF = 0.0;

char machineIdStr[9];

struct timeval tv;

fp = fopen( "/proc/uptime", "r" );

if (fp != NULL) {

if(fscanf(fp, "%lf", &uptimeF) == EOF) {

fclose(fp);

return;

}

gettimeofday(&tv, NULL);

g_bootSecSinceEpoch = (double)tv.tv_sec + ((double)tv.tv_usec / (1000 * 1000)) - uptimeF;

fclose(fp);

} else {

g_bootSecSinceEpoch = 0.0;

}

g_clkTck = sysconf( _SC_CLK_TCK );

// if error, set it to the default of 100

if (g_clkTck <= 0) {

g_clkTck = 100;

}

// get passwd entry size, or guess at 4K if not

g_pwEntrySize = sysconf( _SC_GETPW_R_SIZE_MAX );

if (g_pwEntrySize == (size_t)-1) {

g_pwEntrySize = 4096;

}

// get the machineId

machineId = 0;

fp = fopen( "/etc/machine-id", "r" );

if (fp != NULL) {

if (fread( machineIdStr, 1, 8, fp ) == 8) {

machineIdStr[8] = 0x00;

machineId = strtol( machineIdStr, NULL, 16 );

}

fclose( fp );

}

LONGLONG* StartTime,

ULONG* Pts,

ULONG* Ppid,

ULONG* Sessionid,

ULONGLONG* ProcessKey,

ULONG Pid

)

{

if (StartTime == NULL || Pts == NULL || Ppid == NULL || Sessionid == NULL

|| ProcessKey == NULL) {

fprintf(stderr, "GetProcessInfo invalid params\n");

return FALSE;

}

char statFile[32];

FILE *fp = NULL;

char buf[2048];

size_t numRead = 0;

char *ptr = NULL;

double clkTcks = 0;

ULONG ppid = 0;

ULONG pts = 0;

ULONGLONG endData;

if (Pid <= 0) {

return FALSE;

}

snprintf(statFile, 32, "/proc/%d/stat", Pid);

fp = fopen(statFile, "r");

if (fp == NULL) {

return FALSE;

}

numRead = fread(buf, 1, 2048, fp);

buf[numRead] = 0x00;

fclose(fp);

//

// extract known fields from /proc/[pid]/stat

//

ptr = strrchr(buf, ')');

if (ptr == NULL) {

return FALSE;

}

ptr++;

for (int i=0; i<24; i++) {

ptr = strchr(ptr+1, ' ');

if (ptr == NULL) {

return FALSE;

}

if (i==0) {

sscanf(ptr, "%d", &ppid);

} else if (i==3) {

sscanf(ptr, "%d", &pts);

} else if (i==18) {

sscanf(ptr, "%lf", &clkTcks);

}

}

sscanf(ptr, "%ld", &endData);

snprintf(statFile, 32, "/proc/%d/sessionid", Pid);

fp = fopen(statFile, "r");

*Sessionid = -1;

if (fp != NULL) {

if(fscanf(fp, "%d", Sessionid) == EOF) {

fclose(fp);

return FALSE;

}

fclose(fp);

}

*ProcessKey = endData;

*Pts = pts & 0xff;

*Ppid = ppid;

*StartTime = (LONGLONG)round(((clkTcks / g_clkTck) + g_bootSecSinceEpoch) * 1000 * 1000 * 10);

return TRUE;

char* ProcName,

unsigned int Len,

pid_t Pid

)

{

if (ProcName == NULL) {

fprintf(stderr, "GetProcessName invalid params\n");

return FALSE;

}

char processPath[PATH_MAX];

char *argvPtr = NULL;

FILE *fp = NULL;

size_t numRead = 0;

char cmdlineFile[32] = "/proc/self/cmdline";

char exeFile[32] = "/proc/self/exe";

if (Len > 1) {

*ProcName = 0x00;

} else {

return FALSE;

}

if (Pid > 0) {

snprintf(cmdlineFile, 32, "/proc/%d/cmdline", Pid);

snprintf(exeFile, 32, "/proc/%d/exe", Pid);

}

fp = fopen(cmdlineFile, "rb");

if (fp != NULL) {

numRead = fread(processPath, 1, PATH_MAX-1, fp);

processPath[numRead] = 0x00;

fclose(fp);

}

if (numRead <= 1) {

numRead = readlink(exeFile, processPath, PATH_MAX-1);

if ((int64_t)numRead <= 0) {

return FALSE;

}

processPath[numRead] = 0x00;

}

argvPtr = strrchr(processPath, '/');

if (argvPtr != NULL) {

while (*argvPtr == '/') {

argvPtr++;

}

if (*argvPtr == 0x00) {

return FALSE;

}

} else {

argvPtr = processPath;

}

snprintf(ProcName, Len, "%s", argvPtr);

return TRUE;

const char *s

)

{

if (s == NULL || *s == 0x00) {

return false;

}

while (*s != 0x00) {

if (!isdigit(*s)) {

return false;

}

s++;

}

return true;

PDWORD lpidProcess,

DWORD cb,

PDWORD lpcbNeeded

)

{

if (lpidProcess == NULL || lpcbNeeded == NULL) {

fprintf(stderr, "EnumProcesses invalid params\n");

return false;

}

DIR *directory;

struct dirent *entry;

DWORD count = 0;

*lpcbNeeded = 0;

directory = opendir("/proc");

if (directory == NULL) {

return false;

}

while ((entry = readdir( directory )) != NULL && *lpcbNeeded < cb) {

if (entry->d_type == DT_DIR && StrIsNum(entry->d_name)) {

lpidProcess[count++] = atoi(entry->d_name);

(*lpcbNeeded) += sizeof(DWORD);

}

}

closedir(directory);

return true;

const GUID guid,

PCHAR lpsz,

int cchMax

)

{

if (lpsz == NULL) {

fprintf(stderr, "STringFromGUID2 invalid params\n");

return 0;

}

// target string size includes enclosing braces, hyphens, and null terminator

int size = (sizeof(guid.Data1) + sizeof(guid.Data2) + sizeof(guid.Data3) +

sizeof(guid.Data4)) * 2 + 2 + 4 + 1;

if (cchMax < size) {

return 0;

}

return 1 + snprintf(lpsz, cchMax, "{%08x-%04hx-%04hx-%02hhx%02hhx-%02hhx%02hhx%02hhx%02hhx%02hhx%02hhx}",

guid.Data1, guid.Data2, guid.Data3, guid.Data4[0], guid.Data4[1],

guid.Data4[2], guid.Data4[3], guid.Data4[4], guid.Data4[5],

guid.Data4[6], guid.Data4[7]);

CONST LUID* user_luid

)

{

LARGE_INTEGER result = {{0}};

if (user_luid == NULL) {

fprintf(stderr, "GetLogonTime invalid params\n");

return result;

}

struct passwd pwd;

struct passwd *entry = NULL;

char buf[g_pwEntrySize];

struct utmpx *r;

struct utmpx s;

getpwuid_r( user_luid->LowPart, &pwd, buf, g_pwEntrySize, &entry );

if (entry == NULL) {

return result;

}

snprintf( s.ut_line, UT_LINESIZE, "pts/%d", user_luid->HighPart );

setutxent();

while ((r = getutxline(&s)) != (struct utmpx *)NULL) {

if (strncmp(r->ut_user, pwd.pw_name, __UT_NAMESIZE) == 0) {

// time since epoch in 100ns intervals

result.QuadPart = ((uint64_t)r->ut_tv.tv_sec * 1000 * 1000 * 10) + ((uint64_t)r->ut_tv.tv_usec * 10);

break;

}

}

endutxent();

return result;

CONST PSID pUserSid,

PTCHAR Buffer,

SIZE_T Size

)

{

if (Buffer != NULL) {

*Buffer = 0x00;

}

if (pUserSid == NULL || Buffer == NULL) {

return;

}

struct passwd pwd;

struct passwd *entry = NULL;

char buf[g_pwEntrySize];

getpwuid_r( (uid_t)*pUserSid, &pwd, buf, g_pwEntrySize, &entry );

if (entry == NULL) {

return;

}

snprintf(Buffer, Size, "%s", pwd.pw_name);

_In_ PEVENT_DATA_DESCRIPTOR EventDataDescriptor,

_In_ const PVOID DataPtr,

_In_ ULONG DataSize

)

{

if (EventDataDescriptor == NULL || DataPtr == NULL) {

return;

}

EventDataDescriptor->Ptr = (ULONGLONG)strdup((PCHAR)DataPtr);

EventDataDescriptor->Size = DataSize;

EventDataDescriptor->Reserved = 1;

PLARGE_INTEGER timestamp

)

{

if (timestamp == NULL) {

fprintf(stderr, "GetSystemTimeAsLargeInteger invalid params\n");

return;

}

struct timeval tv;

gettimeofday(&tv, NULL);

// time in 100ns intervals since epoch

timestamp->QuadPart = (tv.tv_sec * 1000 * 1000 * 10) + (tv.tv_usec * 10);

CONST PLARGE_INTEGER timestamp

)

{

if (timestamp == NULL) {

fprintf(stderr, "LargeTimeToSeconds invalid params\n");

return (time_t)0;

}

return (time_t)(timestamp->QuadPart / (1000 * 1000 * 10));

CONST PLARGE_INTEGER timestamp

)

{

if (timestamp == NULL) {

fprintf(stderr, "LargeTimeMilliseconds invalid params\n");

return 0;

}

return (unsigned int)((timestamp->QuadPart / (1000 * 10)) % 1000);

CONST PLARGE_INTEGER timestamp

)

{

if (timestamp == NULL) {

fprintf(stderr, "LargeTimeNanoseconds invalid params\n");

return 0;

}

return (unsigned int)((timestamp->QuadPart % (1000 * 1000 * 10)) * 100);

PLARGE_INTEGER timestamp,

const my_statx_timestamp *filetime

)

{

if (timestamp != NULL) {

timestamp->QuadPart = 0;

}

if (timestamp == NULL || filetime == NULL) {

fprintf(stderr, "LinuxFileTimeToLargeInteger invalid params\n");

return;

}

timestamp->QuadPart = (filetime->tv_sec * 1000 * 1000 * 10) + (filetime->tv_nsec / 100);

char *s,

size_t sLen,

CONST PLARGE_INTEGER timestamp

)

{

if (s != NULL) {

*s = 0x00;

}

if (s == NULL || timestamp == NULL) {

fprintf(stderr, "LargeIntegerToSystemTimeString invalid params\n");

return;

}

// time in 100ns intervals since epoch

struct tm timeFields;

time_t fileTime = LargeTimeToSeconds( timestamp );

if ( gmtime_r(&fileTime, &timeFields) ) {

snprintf( s, sLen, "%04u-%02u-%02uT%02u:%02u:%02u.%09uZ",

timeFields.tm_year + 1900, timeFields.tm_mon + 1, timeFields.tm_mday,

timeFields.tm_hour, timeFields.tm_min, timeFields.tm_sec,

LargeTimeNanoseconds( timestamp ));

} else {

snprintf( s, sLen, "Incorrect filetime: 0x%" PRIx64,

timestamp->QuadPart );

}

{

unsigned char tmpReadBuffer[4096] = {};

unsigned char tmpHashBuffer[ALGO_MAX][256] = {};

unsigned char tmpHashPrefixBuffer[16] = {};

unsigned char tmpStringBuffer[256] = {};

char hashSeparator[] = ",";

char hashPrefix[3][8] = {"SHA1=", "MD5=", "SHA256="};

unsigned int hashSize[ALGO_MAX] = {};

unsigned int hashFlag[ALGO_MAX] = {};

size_t n;

FILE *filePtr;

EVP_MD_CTX *sha1_ctx, *md5_ctx, *sha256_ctx;

// Allocate digests context

sha1_ctx = EVP_MD_CTX_new();

md5_ctx = EVP_MD_CTX_new();

sha256_ctx = EVP_MD_CTX_new();

if ( !sha1_ctx || !md5_ctx || !sha256_ctx ) {

if(!sha1_ctx) EVP_MD_CTX_free(sha1_ctx);

if(!md5_ctx) EVP_MD_CTX_free(md5_ctx);

if(!sha256_ctx) EVP_MD_CTX_free(sha256_ctx);

return;

}

EVP_DigestInit(sha1_ctx , EVP_sha1());

EVP_DigestInit(md5_ctx , EVP_md5());

EVP_DigestInit(sha256_ctx, EVP_sha256());

hashFlag[ALGO_SHA1] = (((hashType>>(ALGO_SHA1-1))&1) && (hashType & ALGO_MULTIPLE)) || (hashType == ALGO_SHA1);

hashFlag[ALGO_MD5] = (((hashType>>(ALGO_MD5-1))&1) && (hashType & ALGO_MULTIPLE)) || (hashType == ALGO_MD5);

hashFlag[ALGO_SHA256] = (((hashType>>(ALGO_SHA256-1))&1) && (hashType & ALGO_MULTIPLE)) || (hashType == ALGO_SHA256);

filePtr = fopen(imagePath, "rb");

if( !filePtr ) {

EVP_MD_CTX_free(sha1_ctx);

EVP_MD_CTX_free(md5_ctx);

EVP_MD_CTX_free(sha256_ctx);

return;

}

// Read and hash image

while((n = fread(tmpReadBuffer, 1, sizeof(tmpReadBuffer), filePtr))){

if( hashFlag[ALGO_SHA1] ){

if (!EVP_DigestUpdate(sha1_ctx, tmpReadBuffer, n)){

fclose(filePtr);

EVP_MD_CTX_free(sha1_ctx);

EVP_MD_CTX_free(md5_ctx);

EVP_MD_CTX_free(sha256_ctx);

return;

}

if ( !(hashType & ALGO_MULTIPLE) ) continue;

}

if( hashFlag[ALGO_MD5] ){

if (!EVP_DigestUpdate(md5_ctx, tmpReadBuffer, n)){

fclose(filePtr);

EVP_MD_CTX_free(sha1_ctx);

EVP_MD_CTX_free(md5_ctx);

EVP_MD_CTX_free(sha256_ctx);

return;

}

if ( !(hashType & ALGO_MULTIPLE) ) continue;

}

if( hashFlag[ALGO_SHA256] ){

if (!EVP_DigestUpdate(sha256_ctx, tmpReadBuffer, n)){

fclose(filePtr);

EVP_MD_CTX_free(sha1_ctx);

EVP_MD_CTX_free(md5_ctx);

EVP_MD_CTX_free(sha256_ctx);

return;

}

if ( !(hashType & ALGO_MULTIPLE) ) continue;

}

}

fclose(filePtr);

// Retrieve digest and cleanup

EVP_DigestFinal(sha1_ctx , tmpHashBuffer[ALGO_SHA1] , &hashSize[ALGO_SHA1]);

EVP_DigestFinal(md5_ctx , tmpHashBuffer[ALGO_MD5] , &hashSize[ALGO_MD5]);

EVP_DigestFinal(sha256_ctx, tmpHashBuffer[ALGO_SHA256], &hashSize[ALGO_SHA256]);

memset(tmpStringBuffer, 0, sizeof(tmpStringBuffer));

memset(tmpHashPrefixBuffer, 0, sizeof(tmpHashPrefixBuffer));

for(unsigned int algo=0;algo<ALGO_MAX;algo++){

if( hashFlag[algo] ){

// Add seperator if multiple hashes

if( *tmpStringBuffer ){

memset(tmpStringBuffer, 0, sizeof(tmpStringBuffer));

memset(tmpHashPrefixBuffer, 0, sizeof(tmpHashPrefixBuffer));

strcat((char *)tmpHashPrefixBuffer, hashSeparator);

}

// Add hash prefix "SHA1=", "MD5=" or "SHA256="

switch(algo){

case ALGO_SHA1:

strcat((char *)tmpHashPrefixBuffer, hashPrefix[ALGO_SHA1-1]);

break;

case ALGO_MD5:

strcat((char *)tmpHashPrefixBuffer, hashPrefix[ALGO_MD5-1]);

break;

case ALGO_SHA256:

strcat((char *)tmpHashPrefixBuffer, hashPrefix[ALGO_SHA256-1]);

break;

}

// Digest to hex

for(unsigned int i=0;i<hashSize[algo];i++){

snprintf((char *)tmpStringBuffer+i*2, sizeof(tmpStringBuffer), "%02x", tmpHashBuffer[algo][i]);

}