使用示例

示例一：同步拦截场景

演示进程启动同步拦截场景

class MonitorCallback : public IMonitorCallback
{
public:
	void OnCallback(IMonitorMessage* Message) override
	{
		if (Message->GetType() != emMSGProcessCreate)
			return;

		cxMSGProcessCreate* msg = (cxMSGProcessCreate*)Message;

		//
		// 禁止进程名 cmd.exe 的进程启动
		//

		if (msg->IsMatchPath(L"*\\cmd.exe")) {
			msg->SetBlock();
		}
		
		//
		// 异步处理：挂起后，插入到其他线程处理，可以用于弹窗或者并发场景
		//
		if (msg->Pending()) {
		    g_Looper->PostRunnable([](msg){
		    	if (msg->IsMatchPath(L"*\\async.exe")) {
			        msg->SetBlock();
		        }
		        msg->CompletePending();
		    });
		}
	}
};

int main()
{
	MonitorManager manager;
	MonitorCallback callback;

	HRESULT hr = manager.Start(&callback);

	if (hr != S_OK) {
		printf("start failed = %08X\n", hr);
		return 0;
	}

	cxMSGUserSetMSGConfig config;
	config.Config[emMSGProcessCreate] = emMSGConfigSend;
	manager.InControl(config);

	WaitForExit("同步防御演示");

	return 0;
}

示例二：异步采集场景

实现一个类似sysmon的行为采集器

class MonitorCallback : public IMonitorCallback
{
public:
	void OnCallback(IMonitorMessage* msg) override
	{
		printf("%S ==> %S\n", msg->GetTypeName(), msg->GetFormatedString(emMSGFieldCurrentProcessPath));

		for (ULONG i = emMSGFieldCurrentProcessCommandline; i < msg->GetFieldCount(); i++) {
			printf("\t%30S : %-30S\n", msg->GetFieldName(i), msg->GetFormatedString(i));
		}
	}
};

int main()
{
	MonitorManager manager;
	MonitorCallback callback;

	HRESULT hr = manager.Start(&callback);

	if (hr != S_OK) {
		printf("start failed = %08X\n", hr);
		return 0;
	}

	cxMSGUserSetMSGConfig config;
	for (int i = 0; i < emMSGMax; i++) {
		config.Config[i] = emMSGConfigPost;
	}
	manager.InControl(config);

	WaitForExit("");

	return 0;
}

示例三：流量代理场景

上网行为管理，可以拦截所有HTTP、HTTPS请求（详细参考http_access_control例子）

示例四：注入场景

支持在任意时刻对进程注入动态库，这里演示常见的在进程启动加载Kernel32的时候注入动态库

class MonitorCallback : public IMonitorCallback
{
public:
	void OnCallback(IMonitorMessage* Message) override
	{
		if (Message->GetType() != emMSGImageLoad)
			return;

		cxMSGImageLoad* msg = (cxMSGImageLoad*)Message;

		if (!msg->IsMatchCurrentProcessName(L"notepad.exe"))
			return;

		if (msg->IsMatchPath(L"*\\kernel32.dll")) {
			msg->SetInjectDll(L"D:\\test.dll");
		}
	}
};

int main()
{
	MonitorManager manager;
	MonitorCallback callback;

	HRESULT hr = manager.Start(&callback);

	CheckSignError(hr);

	if (hr != S_OK) {
		printf("start failed = %08X\n", hr);
		return 1;
	}

	manager.InControl(cxMSGUserSetGlobalConfig());

	cxMSGUserSetMSGConfig config;
	config.Config[emMSGImageLoad] = emMSGConfigSend;
	manager.InControl(config);

	WaitForExit("模块注入：在notepad.exe启动加载kernel32.dll过程中，让其强制加载D:\\test.dll");

	return 0;
}

示例五：内核规则引擎

演示内核规则引擎的使用，可以设置规则到驱动，直接拦截某些行为

std::string InitRules(void)
{
	return R"(
{
    "name" : "default",
    "description" : "default rule group",
    "rules" : [
        {
            "name" : "Block the execution of notepad",
            "action" : 1,
            "event" : "ProcessCreate",
            "matcher" : {
                "or" : [
                    {"match" : ["Path", "*\\notepad.exe"]},
                    {"match" : ["Path", "*\\notepad++.exe"]}
                ]
            }
        }
    ]
}
)";
}

int main()
{
	MonitorManager manager;
	MonitorCallback callback;

	HRESULT hr = manager.Start(&callback);

	CheckSignError(hr);

	if (hr != S_OK) {
		printf("start failed = %08X\n", hr);
		return 0;
	}

	std::string rules = InitRules();
	manager.SetRules(emUserSetMSGRules, rules.c_str());

	WaitForExit("设置内核规则：禁止notepad的进程启动。\n"
				"\t注意：此功能是设置，设置完成要恢复需要移除规则！\n"
				"\t按任意键移除规则并退出。");

	manager.InControl(cxMSGUserRemoveMSGRules());

	return 0;
}

示例六：能力扩展

演示字段扩展能力，动态注入字段，可以用于扩充规则引擎的能力等，实现更加灵活的功能

class MonitorCallback : public IMonitorCallback
{
public:
	const MonitorExtensionFieldTable& GetExtensionFieldTable(void)
	{
		static MonitorExtensionField fields[] = {
			{ MONITOR_SUPPORT_ALL_MESSAGE, L"FileExtension", nullptr, GetFileExtension },
			{ emMSGProcessCreate, L"IsVirus", IsVirus, nullptr },
		};

		static MonitorExtensionFieldTable table = {
			_countof(fields),
			fields,
		};

		return table;
	}

	void OnConfig(GlobalConfig& Config)
	{
		Config.ExtensionFieldTable = GetExtensionFieldTable();
	}

	void OnCallback(IMonitorMessage* Message) override
	{
		auto is_virus = Message->GetNumber(L"IsVirus");
		auto file_ext = Message->GetString(L"FileExtension");

		printf("FileExtension = %S\n", file_ext);
	}

	static CString GetFileExtension(IMonitorMessage* Message)
	{
		return PathFindExtension(Message->GetString(emMSGFieldPath));
	}

	static ULONGLONG IsVirus(IMonitorMessage* Message)
	{
		return FALSE;
	}
};

int main()
{
	MonitorManager manager;
	MonitorCallback callback;

	HRESULT hr = manager.Start(&callback);

	CheckSignError(hr);

	if (hr != S_OK) {
		printf("start failed = %08X\n", hr);
		return 0;
	}

	manager.InControl(cxMSGUserSetGlobalConfig());

	cxMSGUserSetMSGConfig config;
	config.Config[emMSGProcessCreate] = emMSGConfigPost;
	manager.InControl(config);

	WaitForExit("演示扩展能力：可以为IMonitorMessage扩展更多的字段，这些字段同时也可以用于规则引擎。");

	return 0;
}