helpers.cpp

#include "stdafx.h"

// ============================================
// EtwTi-FluctuationMonitor v2.0
// 辅助函数实现
// ============================================

// 内存保护属性转字符串
const char* ProtectionString(DWORD Protection) {
    switch (Protection) {
    case PAGE_NOACCESS:
        return "---";
    case PAGE_READONLY:
        return "R--";
    case PAGE_READWRITE:
        return "RW-";
    case PAGE_WRITECOPY:
        return "RC-";
    case PAGE_EXECUTE:
        return "--X";
    case PAGE_EXECUTE_READ:
        return "R-X";
    case PAGE_EXECUTE_READWRITE:
        return "RWX";
    case PAGE_EXECUTE_WRITECOPY:
        return "RCX";
    case PAGE_GUARD:
        return "G--";
    case PAGE_NOCACHE:
        return "NC-";
    case PAGE_WRITECOMBINE:
        return "WC-";
    }
    return "???";
}

// 根据进程ID获取进程名
std::wstring ProcessName(DWORD processId) {
    std::wstring buffer;
    buffer.resize(32768);

    HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, processId);
    if (hProcess) {
        DWORD dwSize = (DWORD)buffer.size();
        if (QueryFullProcessImageNameW(hProcess, 0, &buffer[0], &dwSize))
        {
            buffer = std::filesystem::path(buffer).filename();
        }
        CloseHandle(hProcess);
    }

    if (buffer.empty()) {
        wsprintf(&buffer[0], L"pid:%d", processId);
    }

    return buffer;
}

// 获取当前时间戳字符串
std::string GetCurrentTimestamp() {
    auto now = std::chrono::system_clock::now();
    auto time = std::chrono::system_clock::to_time_t(now);
    auto ms = std::chrono::duration_cast<std::chrono::milliseconds>(
        now.time_since_epoch()) % 1000;

    std::stringstream ss;
    struct tm buf;
    localtime_s(&buf, &time);
    ss << std::put_time(&buf, "%Y-%m-%d %H:%M:%S");
    ss << '.' << std::setfill('0') << std::setw(3) << ms.count();
    return ss.str();
}

// 根据事件ID获取事件类型
EventType GetEventType(USHORT eventId) {
    switch (eventId) {
    case EVENT_ALLOCVM_LOCAL:
    case EVENT_ALLOCVM_REMOTE:
    case EVENT_ALLOCVM_LOCAL_KERNEL:
    case EVENT_ALLOCVM_REMOTE_KERNEL:
        return EventType::ALLOCVM;

    case EVENT_PROTECTVM_LOCAL:
    case EVENT_PROTECTVM_REMOTE:
    case EVENT_PROTECTVM_LOCAL_KERNEL:
    case EVENT_PROTECTVM_REMOTE_KERNEL:
        return EventType::PROTECTVM;

    case EVENT_MAPVIEW_LOCAL:
    case EVENT_MAPVIEW_REMOTE:
    case EVENT_MAPVIEW_LOCAL_KERNEL:
    case EVENT_MAPVIEW_REMOTE_KERNEL:
        return EventType::MAPVIEW;

    case EVENT_QUEUEUSERAPC_REMOTE:
    case EVENT_QUEUEUSERAPC_REMOTE_KERNEL:
        return EventType::QUEUEUSERAPC;

    case EVENT_SETTHREADCONTEXT_REMOTE:
    case EVENT_SETTHREADCONTEXT_REMOTE_KERNEL:
        return EventType::SETTHREADCONTEXT;

    case EVENT_READVM_LOCAL:
    case EVENT_READVM_REMOTE:
        return EventType::READVM;

    case EVENT_WRITEVM_LOCAL:
    case EVENT_WRITEVM_REMOTE:
        return EventType::WRITEVM;

    case EVENT_SUSPEND_THREAD:
        return EventType::SUSPEND_THREAD;

    case EVENT_RESUME_THREAD:
        return EventType::RESUME_THREAD;

    case EVENT_SUSPEND_PROCESS:
        return EventType::SUSPEND_PROCESS;

    case EVENT_RESUME_PROCESS:
        return EventType::RESUME_PROCESS;

    case EVENT_FREEZE_PROCESS:
        return EventType::FREEZE_PROCESS;

    case EVENT_THAW_PROCESS:
        return EventType::THAW_PROCESS;

    case EVENT_DRIVER_LOAD:
        return EventType::DRIVER_LOAD;

    case EVENT_DRIVER_UNLOAD:
        return EventType::DRIVER_UNLOAD;

    case EVENT_DEVICE_CREATE:
        return EventType::DEVICE_CREATE;

    case EVENT_DEVICE_CLOSE:
        return EventType::DEVICE_CLOSE;

    default:
        return EventType::UNKNOWN;
    }
}

// 根据事件ID判断行为类型（本地/跨进程）
BehaviorType GetBehaviorType(USHORT eventId) {
    switch (eventId) {
    // 本地行为事件（进程操作自己的内存）
    case EVENT_ALLOCVM_LOCAL:
    case EVENT_PROTECTVM_LOCAL:
    case EVENT_MAPVIEW_LOCAL:
    case EVENT_READVM_LOCAL:
    case EVENT_WRITEVM_LOCAL:
        return BehaviorType::LOCAL;

    // 跨进程行为事件（进程操作其他进程的内存）
    case EVENT_ALLOCVM_REMOTE:
    case EVENT_PROTECTVM_REMOTE:
    case EVENT_MAPVIEW_REMOTE:
    case EVENT_QUEUEUSERAPC_REMOTE:
    case EVENT_SETTHREADCONTEXT_REMOTE:
    case EVENT_READVM_REMOTE:
    case EVENT_WRITEVM_REMOTE:
        return BehaviorType::REMOTE;

    // 内核调用本地行为事件
    case EVENT_ALLOCVM_LOCAL_KERNEL:
    case EVENT_PROTECTVM_LOCAL_KERNEL:
    case EVENT_MAPVIEW_LOCAL_KERNEL:
        return BehaviorType::LOCAL;

    // 内核调用跨进程行为事件
    case EVENT_ALLOCVM_REMOTE_KERNEL:
    case EVENT_PROTECTVM_REMOTE_KERNEL:
    case EVENT_MAPVIEW_REMOTE_KERNEL:
    case EVENT_QUEUEUSERAPC_REMOTE_KERNEL:
    case EVENT_SETTHREADCONTEXT_REMOTE_KERNEL:
        return BehaviorType::REMOTE;

    // 线程/进程操作
    case EVENT_SUSPEND_THREAD:
    case EVENT_RESUME_THREAD:
    case EVENT_SUSPEND_PROCESS:
    case EVENT_RESUME_PROCESS:
    case EVENT_FREEZE_PROCESS:
    case EVENT_THAW_PROCESS:
        return BehaviorType::LOCAL;

    // 驱动/设备事件
    case EVENT_DRIVER_LOAD:
    case EVENT_DRIVER_UNLOAD:
    case EVENT_DEVICE_CREATE:
    case EVENT_DEVICE_CLOSE:
        return BehaviorType::KERNEL;

    default:
        return BehaviorType::LOCAL;
    }
}

// 事件类型转字符串
std::string EventTypeToString(EventType type) {
    switch (type) {
    case EventType::ALLOCVM:
        return "ALLOCVM";
    case EventType::PROTECTVM:
        return "PROTECTVM";
    case EventType::MAPVIEW:
        return "MAPVIEW";
    case EventType::QUEUEUSERAPC:
        return "QUEUEUSERAPC";
    case EventType::SETTHREADCONTEXT:
        return "SETTHREADCONTEXT";
    case EventType::READVM:
        return "READVM";
    case EventType::WRITEVM:
        return "WRITEVM";
    case EventType::SUSPEND_THREAD:
        return "SUSPEND_THREAD";
    case EventType::RESUME_THREAD:
        return "RESUME_THREAD";
    case EventType::SUSPEND_PROCESS:
        return "SUSPEND_PROCESS";
    case EventType::RESUME_PROCESS:
        return "RESUME_PROCESS";
    case EventType::FREEZE_PROCESS:
        return "FREEZE_PROCESS";
    case EventType::THAW_PROCESS:
        return "THAW_PROCESS";
    case EventType::DRIVER_LOAD:
        return "DRIVER_LOAD";
    case EventType::DRIVER_UNLOAD:
        return "DRIVER_UNLOAD";
    case EventType::DEVICE_CREATE:
        return "DEVICE_CREATE";
    case EventType::DEVICE_CLOSE:
        return "DEVICE_CLOSE";
    default:
        return "UNKNOWN";
    }
}

// 行为类型转字符串
std::string BehaviorTypeToString(BehaviorType type) {
    switch (type) {
    case BehaviorType::LOCAL:
        return "LOCAL";
    case BehaviorType::REMOTE:
        return "REMOTE";
    case BehaviorType::KERNEL:
        return "KERNEL";
    default:
        return "UNKNOWN";
    }
}