Add process protection levels (--protect-high by default but --protect-medium and...

diff --git a/FFFTP_Eng_Release/FFFTP.exe b/FFFTP_Eng_Release/FFFTP.exe
index 5015e5d..c143e3b 100644 (file)
Binary files a/FFFTP_Eng_Release/FFFTP.exe and b/FFFTP_Eng_Release/FFFTP.exe differ

diff --git a/Release/FFFTP.exe b/Release/FFFTP.exe
index 9464ad9..5c4620c 100644 (file)
Binary files a/Release/FFFTP.exe and b/Release/FFFTP.exe differ

diff --git a/main.c b/main.c
index 2f3eacb..3f949c9 100644 (file)
--- a/main.c
+++ b/main.c
@@ -234,21 +234,37 @@ int PASCAL WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpszCmdLi
 \r
        // プロセス保護\r
 #ifdef ENABLE_PROCESS_PROTECTION\r
-       BOOL bProtect;\r
+       DWORD ProtectLevel;\r
        char* pCommand;\r
        char Option[FMAX_PATH+1];\r
-       bProtect = FALSE;\r
+       ProtectLevel = PROCESS_PROTECTION_NONE;\r
        pCommand = lpszCmdLine;\r
        while(pCommand = GetToken(pCommand, Option))\r
        {\r
                if(strcmp(Option, "--protect") == 0)\r
                {\r
-                       bProtect = TRUE;\r
+                       ProtectLevel = PROCESS_PROTECTION_DEFAULT;\r
+                       break;\r
+               }\r
+               else if(strcmp(Option, "--protect-high") == 0)\r
+               {\r
+                       ProtectLevel = PROCESS_PROTECTION_HIGH;\r
+                       break;\r
+               }\r
+               else if(strcmp(Option, "--protect-medium") == 0)\r
+               {\r
+                       ProtectLevel = PROCESS_PROTECTION_MEDIUM;\r
+                       break;\r
+               }\r
+               else if(strcmp(Option, "--protect-low") == 0)\r
+               {\r
+                       ProtectLevel = PROCESS_PROTECTION_LOW;\r
                        break;\r
                }\r
        }\r
-       if(bProtect)\r
+       if(ProtectLevel != PROCESS_PROTECTION_NONE)\r
        {\r
+               SetProcessProtectionLevel(ProtectLevel);\r
                if(!InitializeLoadLibraryHook())\r
                {\r
                        MessageBox(NULL, MSGJPN321, "FFFTP", MB_OK | MB_ICONERROR);\r
@@ -1755,6 +1771,15 @@ static int AnalyzeComLine(char *Str, int *AutoConnect, int *CmdOption, char *unc
                        else if(strcmp(Tmp, "--protect") == 0)\r
                        {\r
                        }\r
+                       else if(strcmp(Tmp, "--protect-high") == 0)\r
+                       {\r
+                       }\r
+                       else if(strcmp(Tmp, "--protect-medium") == 0)\r
+                       {\r
+                       }\r
+                       else if(strcmp(Tmp, "--protect-low") == 0)\r
+                       {\r
+                       }\r
 #endif\r
                        else\r
                        {\r

diff --git a/protectprocess.c b/protectprocess.c
index 6865912..928f1b5 100644 (file)
--- a/protectprocess.c
+++ b/protectprocess.c
@@ -55,7 +55,7 @@ BOOL HookFunctionInCode(void* pOriginal, void* pNew, void* pBackupCode, BOOL bRe
 BOOL HookFunctionInIAT(void* pOriginal, void* pNew);
 #endif
 HANDLE LockExistingFile(LPCWSTR Filename);
-BOOL FindTrustedModuleMD5Hash(void* pHash);
+BOOL FindTrustedModuleSHA1Hash(void* pHash);
 BOOL VerifyFileSignature(LPCWSTR Filename);
 BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename);
 BOOL GetSHA1HashOfModule(LPCWSTR Filename, void* pHash);
@@ -96,9 +96,10 @@ _CryptCATAdminCalcHashFromFileHandle p_CryptCATAdminCalcHashFromFileHandle;
 #define MAX_TRUSTED_FILENAME_TABLE 16
 #define MAX_TRUSTED_MD5_HASH_TABLE 16
 
+DWORD g_ProcessProtectionLevel;
 DWORD g_LockedThread[MAX_LOCKED_THREAD];
 WCHAR* g_pTrustedFilenameTable[MAX_TRUSTED_FILENAME_TABLE];
-BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][16];
+BYTE g_TrustedMD5HashTable[MAX_TRUSTED_MD5_HASH_TABLE][20];
 
 // \88È\89º\83t\83b\83N\8aÖ\90\94
 // \83t\83b\83N\91Î\8fÛ\82ð\8cÄ\82Ñ\8fo\82·\8fê\8d\87\82Í\91O\8cã\82ÅSTART_HOOK_FUNCTION\82ÆEND_HOOK_FUNCTION\82ð\8eÀ\8ds\82·\82é\95K\97v\82ª\82 \82é
@@ -169,19 +170,15 @@ HMODULE WINAPI h_LoadLibraryExW(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFla
                        hLock = LockExistingFile(lpLibFileName);
                        FreeLibrary(hModule);
                }
-               if(GetModuleHandleW(lpLibFileName))
+               if((g_ProcessProtectionLevel & PROCESS_PROTECTION_LOADED) && GetModuleHandleW(lpLibFileName))
                        bTrusted = TRUE;
        }
        if(!bTrusted)
        {
-               if(LockThreadLock())
+               if(hLock)
                {
-                       if(hLock)
-                       {
-                               if(IsModuleTrusted(lpLibFileName))
-                                       bTrusted = TRUE;
-                       }
-                       UnlockThreadLock();
+                       if(IsModuleTrusted(lpLibFileName))
+                               bTrusted = TRUE;
                }
        }
        if(bTrusted)
@@ -370,7 +367,7 @@ HANDLE LockExistingFile(LPCWSTR Filename)
 }
 
 // DLL\82Ì\83n\83b\83V\83\85\82ð\8c\9f\8dõ
-BOOL FindTrustedModuleMD5Hash(void* pHash)
+BOOL FindTrustedModuleSHA1Hash(void* pHash)
 {
        BOOL bResult;
        int i;
@@ -378,7 +375,7 @@ BOOL FindTrustedModuleMD5Hash(void* pHash)
        i = 0;
        while(i < MAX_TRUSTED_MD5_HASH_TABLE)
        {
-               if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
+               if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
                {
                        bResult = TRUE;
                        break;
@@ -395,6 +392,7 @@ BOOL VerifyFileSignature(LPCWSTR Filename)
        GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
        WINTRUST_FILE_INFO wfi;
        WINTRUST_DATA wd;
+       LONG Error;
        bResult = FALSE;
        ZeroMemory(&wfi, sizeof(WINTRUST_FILE_INFO));
        wfi.cbStruct = sizeof(WINTRUST_FILE_INFO);
@@ -404,7 +402,12 @@ BOOL VerifyFileSignature(LPCWSTR Filename)
        wd.dwUIChoice = WTD_UI_NONE;
        wd.dwUnionChoice = WTD_CHOICE_FILE;
        wd.pFile = &wfi;
-       if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
+       Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
+       if(Error == ERROR_SUCCESS)
+               bResult = TRUE;
+       else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
+               bResult = TRUE;
+       else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
                bResult = TRUE;
        return bResult;
 }
@@ -416,6 +419,7 @@ BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
        GUID g = WINTRUST_ACTION_GENERIC_VERIFY_V2;
        WINTRUST_CATALOG_INFO wci;
        WINTRUST_DATA wd;
+       LONG Error;
        bResult = FALSE;
        if(VerifyFileSignature(Catalog))
        {
@@ -435,7 +439,12 @@ BOOL VerifyFileSignatureInCatalog(LPCWSTR Catalog, LPCWSTR Filename)
                                        wd.dwUIChoice = WTD_UI_NONE;
                                        wd.dwUnionChoice = WTD_CHOICE_CATALOG;
                                        wd.pCatalog = &wci;
-                                       if(WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd) == ERROR_SUCCESS)
+                                       Error = WinVerifyTrust((HWND)INVALID_HANDLE_VALUE, &g, &wd);
+                                       if(Error == ERROR_SUCCESS)
+                                               bResult = TRUE;
+                                       else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_EXPIRED) && Error == CERT_E_EXPIRED)
+                                               bResult = TRUE;
+                                       else if((g_ProcessProtectionLevel & PROCESS_PROTECTION_UNAUTHORIZED) && (Error == CERT_E_UNTRUSTEDROOT || Error == CERT_E_UNTRUSTEDCA))
                                                bResult = TRUE;
                                }
                                free(wci.pbCalculatedFileHash);
@@ -635,31 +644,34 @@ BOOL IsSxsModuleTrusted(LPCWSTR Filename)
 }
 
 // DLL\82ð\8am\94F
-// \83n\83b\83V\83\85\82ª\93o\98^\82³\82ê\82Ä\82¢\82é\81AAuthenticode\8f\90\96¼\82ª\82³\82ê\82Ä\82¢\82é\81A\82Ü\82½\82ÍWFP\82É\82æ\82é\95Û\8cì\89º\82É\82 \82é\82±\82Æ\82ð\8am\94F
 BOOL IsModuleTrusted(LPCWSTR Filename)
 {
        BOOL bResult;
-       BYTE Hash[16];
+       BYTE Hash[20];
        bResult = FALSE;
-       if(GetMD5HashOfFile(Filename, &Hash))
+       if(LockThreadLock())
        {
-               if(FindTrustedModuleMD5Hash(&Hash))
-                       bResult = TRUE;
-       }
-       if(!bResult)
-       {
-               if(VerifyFileSignature(Filename))
-                       bResult = TRUE;
-       }
-       if(!bResult)
-       {
-               if(IsSxsModuleTrusted(Filename))
-                       bResult = TRUE;
-       }
-       if(!bResult)
-       {
-               if(SfcIsFileProtected(NULL, Filename))
-                       bResult = TRUE;
+               if(GetSHA1HashOfFile(Filename, &Hash))
+               {
+                       if(FindTrustedModuleSHA1Hash(&Hash))
+                               bResult = TRUE;
+               }
+               if(!bResult)
+               {
+                       if((g_ProcessProtectionLevel & PROCESS_PROTECTION_BUILTIN) && VerifyFileSignature(Filename))
+                               bResult = TRUE;
+               }
+               if(!bResult)
+               {
+                       if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SIDE_BY_SIDE) && IsSxsModuleTrusted(Filename))
+                               bResult = TRUE;
+               }
+               if(!bResult)
+               {
+                       if((g_ProcessProtectionLevel & PROCESS_PROTECTION_SYSTEM_FILE) && SfcIsFileProtected(NULL, Filename))
+                               bResult = TRUE;
+               }
+               UnlockThreadLock();
        }
        return bResult;
 }
@@ -739,8 +751,13 @@ HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags)
        return r;
 }
 
-// \83t\83@\83C\83\8b\82ÌMD5\83n\83b\83V\83\85\82ð\8eæ\93¾
-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
+void SetProcessProtectionLevel(DWORD Level)
+{
+       g_ProcessProtectionLevel = Level;
+}
+
+// \83t\83@\83C\83\8b\82ÌSHA1\83n\83b\83V\83\85\82ð\8eæ\93¾
+BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash)
 {
        BOOL bResult;
        HCRYPTPROV hProv;
@@ -752,7 +769,7 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
        bResult = FALSE;
        if(CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, 0) || CryptAcquireContextW(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_NEWKEYSET))
        {
-               if(CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash))
+               if(CryptCreateHash(hProv, CALG_SHA1, 0, 0, &hHash))
                {
                        if((hFile = CreateFileW(Filename, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL)) != INVALID_HANDLE_VALUE)
                        {
@@ -764,7 +781,7 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
                                        {
                                                if(CryptHashData(hHash, (BYTE*)pData, Size, 0))
                                                {
-                                                       dw = 16;
+                                                       dw = 20;
                                                        if(CryptGetHashParam(hHash, HP_HASHVAL, (BYTE*)pHash, &dw, 0))
                                                                bResult = TRUE;
                                                }
@@ -782,22 +799,22 @@ BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash)
 }
 
 // DLL\82Ì\83n\83b\83V\83\85\82ð\93o\98^
-BOOL RegisterTrustedModuleMD5Hash(void* pHash)
+BOOL RegisterTrustedModuleSHA1Hash(void* pHash)
 {
        BOOL bResult;
-       BYTE NullHash[16] = {0};
+       BYTE NullHash[20] = {0};
        int i;
        bResult = FALSE;
-       if(FindTrustedModuleMD5Hash(pHash))
+       if(FindTrustedModuleSHA1Hash(pHash))
                bResult = TRUE;
        else
        {
                i = 0;
                while(i < MAX_TRUSTED_MD5_HASH_TABLE)
                {
-                       if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 16) == 0)
+                       if(memcmp(&g_TrustedMD5HashTable[i], &NullHash, 20) == 0)
                        {
-                               memcpy(&g_TrustedMD5HashTable[i], pHash, 16);
+                               memcpy(&g_TrustedMD5HashTable[i], pHash, 20);
                                bResult = TRUE;
                                break;
                        }
@@ -808,18 +825,18 @@ BOOL RegisterTrustedModuleMD5Hash(void* pHash)
 }
 
 // DLL\82Ì\83n\83b\83V\83\85\82Ì\93o\98^\82ð\89ð\8f\9c
-BOOL UnregisterTrustedModuleMD5Hash(void* pHash)
+BOOL UnregisterTrustedModuleSHA1Hash(void* pHash)
 {
        BOOL bResult;
-       BYTE NullHash[16] = {0};
+       BYTE NullHash[20] = {0};
        int i;
        bResult = FALSE;
        i = 0;
        while(i < MAX_TRUSTED_MD5_HASH_TABLE)
        {
-               if(memcmp(&g_TrustedMD5HashTable[i], pHash, 16) == 0)
+               if(memcmp(&g_TrustedMD5HashTable[i], pHash, 20) == 0)
                {
-                       memcpy(&g_TrustedMD5HashTable[i], &NullHash, 16);
+                       memcpy(&g_TrustedMD5HashTable[i], &NullHash, 20);
                        bResult = TRUE;
                        break;
                }

diff --git a/protectprocess.h b/protectprocess.h
index fe6b4ef..fcaa546 100644 (file)
--- a/protectprocess.h
+++ b/protectprocess.h
@@ -44,10 +44,30 @@ EXTERN_HOOK_FUNCTION_VAR(LoadLibraryExW)
 
 #endif
 
+// \83\8d\81[\83h\8dÏ\82Ý\82Ì\83\82\83W\83\85\81[\83\8b\82Í\8c\9f\8d¸\82ð\83p\83X
+#define PROCESS_PROTECTION_LOADED 0x00000001
+// \83\82\83W\83\85\81[\83\8b\82É\96\84\82ß\8d\9e\82Ü\82ê\82½Authenticode\8f\90\96¼\82ð\8c\9f\8d¸
+#define PROCESS_PROTECTION_BUILTIN 0x00000002
+// \83T\83C\83h\83o\83C\83T\83C\83h\82ÌAuthenticode\8f\90\96¼\82ð\8c\9f\8d¸
+#define PROCESS_PROTECTION_SIDE_BY_SIDE 0x00000004
+// WFP\82É\82æ\82é\95Û\8cì\89º\82É\82 \82é\82©\82ð\8c\9f\8d¸
+#define PROCESS_PROTECTION_SYSTEM_FILE 0x00000008
+// Authenticode\8f\90\96¼\82Ì\97L\8cø\8aú\8cÀ\82ð\96³\8e\8b
+#define PROCESS_PROTECTION_EXPIRED 0x00000010
+// Authenticode\8f\90\96¼\82Ì\94­\8ds\8c³\82ð\96³\8e\8b
+#define PROCESS_PROTECTION_UNAUTHORIZED 0x00000020
+
+#define PROCESS_PROTECTION_NONE 0
+#define PROCESS_PROTECTION_DEFAULT PROCESS_PROTECTION_HIGH
+#define PROCESS_PROTECTION_HIGH (PROCESS_PROTECTION_BUILTIN | PROCESS_PROTECTION_SIDE_BY_SIDE | PROCESS_PROTECTION_SYSTEM_FILE)
+#define PROCESS_PROTECTION_MEDIUM (PROCESS_PROTECTION_HIGH | PROCESS_PROTECTION_LOADED | PROCESS_PROTECTION_EXPIRED)
+#define PROCESS_PROTECTION_LOW (PROCESS_PROTECTION_MEDIUM | PROCESS_PROTECTION_UNAUTHORIZED)
+
 HMODULE System_LoadLibrary(LPCWSTR lpLibFileName, HANDLE hFile, DWORD dwFlags);
-BOOL GetMD5HashOfFile(LPCWSTR Filename, void* pHash);
-BOOL RegisterTrustedModuleMD5Hash(void* pHash);
-BOOL UnregisterTrustedModuleMD5Hash(void* pHash);
+void SetProcessProtectionLevel(DWORD Level);
+BOOL GetSHA1HashOfFile(LPCWSTR Filename, void* pHash);
+BOOL RegisterTrustedModuleSHA1Hash(void* pHash);
+BOOL UnregisterTrustedModuleSHA1Hash(void* pHash);
 BOOL UnloadUntrustedModule();
 BOOL InitializeLoadLibraryHook();
 BOOL EnableLoadLibraryHook(BOOL bEnable);

diff --git a/socketwrapper.c b/socketwrapper.c
index a819e26..c4c7603 100644 (file)
--- a/socketwrapper.c
+++ b/socketwrapper.c
@@ -67,11 +67,12 @@ BOOL LoadOpenSSL()
        if(g_bOpenSSLLoaded)
                return FALSE;
 #ifdef ENABLE_PROCESS_PROTECTION
+       // 同梱するOpenSSLのバージョンに合わせてSHA1ハッシュ値を変更すること
        // ssleay32.dll 1.0.0e
        // libssl32.dll 1.0.0e
-       RegisterTrustedModuleMD5Hash("\x8B\xA3\xB7\xB3\xCE\x2E\x4F\x07\x8C\xB8\x93\x7D\x77\xE1\x09\x3A");
+       RegisterTrustedModuleSHA1Hash("\x4E\xB7\xA0\x22\x14\x4B\x58\x6D\xBC\xF5\x21\x0D\x96\x78\x0D\x79\x7D\x66\xB2\xB0");
        // libeay32.dll 1.0.0e
-       RegisterTrustedModuleMD5Hash("\xA6\x4C\xAF\x9E\xF3\xDC\xFC\x68\xAE\xCA\xCC\x61\xD2\xF6\x70\x8B");
+       RegisterTrustedModuleSHA1Hash("\x01\x32\x7A\xAE\x69\x26\xE6\x58\xC7\x63\x22\x1E\x53\x5A\x78\xBC\x61\xC7\xB5\xC1");
 #endif
        g_hOpenSSL = LoadLibrary("ssleay32.dll");
        if(!g_hOpenSSL)