COMHijackDetector.cpp

/*
 * COMHijackDetector - Détecteur de hijacking COM/CLSID
 * Partie de WinToolsSuite v3.0
 *
 * Scanne le registre Windows pour détecter :
 * - Hijacking COM via HKCU overrides de HKLM CLSID
 * - InprocServer32/LocalServer32 suspects (paths non standard)
 * - DLL sideloading via répertoires suspects
 * - Vérification signatures digitales DLLs/EXEs
 */

#define UNICODE
#define _UNICODE
#define WIN32_LEAN_AND_MEAN
#define _WIN32_WINNT 0x0601

#include <windows.h>
#include <commctrl.h>
#include <wincrypt.h>
#include <softpub.h>
#include <shlwapi.h>
#include <vector>
#include <string>
#include <fstream>
#include <algorithm>

#pragma comment(lib, "comctl32.lib")
#pragma comment(lib, "advapi32.lib")
#pragma comment(lib, "wintrust.lib")
#pragma comment(lib, "crypt32.lib")
#pragma comment(lib, "shlwapi.lib")

// IDs des contrôles
#define IDC_LISTVIEW        1001
#define IDC_BTN_SCAN        1002
#define IDC_BTN_VERIFY      1003
#define IDC_BTN_DELETE      1004
#define IDC_BTN_EXPORT      1005
#define IDC_STATUS          1006

// Colonnes ListView
enum {
    COL_CLSID = 0,
    COL_NAME,
    COL_SERVER,
    COL_LOCATION,
    COL_SIGNED,
    COL_SUSPECT,
    COL_NOTES
};

// Structure pour un élément COM
struct COMItem {
    std::wstring clsid;
    std::wstring name;
    std::wstring server;
    std::wstring location;  // HKCU ou HKLM
    bool isSigned;
    bool suspect;
    std::wstring notes;
};

// Variables globales
HWND g_hListView = nullptr;
HWND g_hStatus = nullptr;
std::vector<COMItem> g_items;
HFONT g_hFont = nullptr;
volatile bool g_stopScan = false;

// Vérification signature digitale
bool IsFileSigned(const std::wstring& filePath) {
    if (filePath.empty() || !PathFileExistsW(filePath.c_str())) {
        return false;
    }

    WINTRUST_FILE_INFO fileInfo = {};
    fileInfo.cbStruct = sizeof(WINTRUST_FILE_INFO);
    fileInfo.pcwszFilePath = filePath.c_str();

    GUID actionGUID = WINTRUST_ACTION_GENERIC_VERIFY_V2;

    WINTRUST_DATA trustData = {};
    trustData.cbStruct = sizeof(WINTRUST_DATA);
    trustData.dwUIChoice = WTD_UI_NONE;
    trustData.fdwRevocationChecks = WTD_REVOKE_NONE;
    trustData.dwUnionChoice = WTD_CHOICE_FILE;
    trustData.pFile = &fileInfo;
    trustData.dwStateAction = WTD_STATEACTION_VERIFY;

    LONG status = WinVerifyTrust(nullptr, &actionGUID, &trustData);

    trustData.dwStateAction = WTD_STATEACTION_CLOSE;
    WinVerifyTrust(nullptr, &actionGUID, &trustData);

    return (status == ERROR_SUCCESS);
}

// Extraction du chemin du server depuis valeur registre
std::wstring ExtractServerPath(const std::wstring& serverValue) {
    // Format typique: "C:\Windows\System32\comsvcs.dll" ou avec arguments
    std::wstring path = serverValue;

    // Supprimer guillemets
    if (!path.empty() && path[0] == L'"') {
        size_t endQuote = path.find(L'"', 1);
        if (endQuote != std::wstring::npos) {
            path = path.substr(1, endQuote - 1);
        }
    } else {
        // Si pas de guillemets, prendre jusqu'au premier espace
        size_t space = path.find(L' ');
        if (space != std::wstring::npos) {
            path = path.substr(0, space);
        }
    }

    return path;
}

// Vérification path suspect
bool IsSuspiciousPath(const std::wstring& path, std::wstring& reason) {
    std::wstring pathLower = path;
    std::transform(pathLower.begin(), pathLower.end(), pathLower.begin(), ::tolower);

    // Paths suspects
    std::vector<std::pair<std::wstring, std::wstring>> suspiciousPaths = {
        {L"\\appdata\\", L"AppData directory"},
        {L"\\temp\\", L"Temp directory"},
        {L"\\tmp\\", L"Temp directory"},
        {L"\\users\\public\\", L"Public directory"},
        {L"\\programdata\\", L"ProgramData directory"},
        {L"c:\\windows\\temp\\", L"Windows Temp"},
        {L"c:\\$recycle.bin\\", L"Recycle Bin"},
        {L"\\downloads\\", L"Downloads folder"}
    };

    for (const auto& [pattern, desc] : suspiciousPaths) {
        if (pathLower.find(pattern) != std::wstring::npos) {
            reason = desc;
            return true;
        }
    }

    // Vérifier si fichier n'existe pas
    if (!PathFileExistsW(path.c_str())) {
        reason = L"File not found";
        return true;
    }

    return false;
}

// Lecture valeur registre string
std::wstring ReadRegString(HKEY hKey, LPCWSTR subKey, LPCWSTR valueName) {
    HKEY hSubKey;
    if (RegOpenKeyExW(hKey, subKey, 0, KEY_READ | KEY_WOW64_64KEY, &hSubKey) != ERROR_SUCCESS) {
        return L"";
    }

    wchar_t buffer[2048];
    DWORD bufSize = sizeof(buffer);
    DWORD type;

    LONG result = RegQueryValueExW(hSubKey, valueName, nullptr, &type, (LPBYTE)buffer, &bufSize);
    RegCloseKey(hSubKey);

    if (result == ERROR_SUCCESS && (type == REG_SZ || type == REG_EXPAND_SZ)) {
        if (type == REG_EXPAND_SZ) {
            wchar_t expanded[2048];
            ExpandEnvironmentStringsW(buffer, expanded, 2048);
            return std::wstring(expanded);
        }
        return std::wstring(buffer);
    }

    return L"";
}

// Scan d'un CLSID
void ScanCLSID(HKEY hRootKey, const std::wstring& clsidKey, const std::wstring& location) {
    // Nom du CLSID (valeur par défaut)
    std::wstring name = ReadRegString(hRootKey, clsidKey.c_str(), nullptr);
    if (name.empty()) {
        name = L"(sans nom)";
    }

    // Vérifier InprocServer32
    std::wstring inprocPath = clsidKey + L"\\InprocServer32";
    std::wstring inprocServer = ReadRegString(hRootKey, inprocPath.c_str(), nullptr);

    if (!inprocServer.empty()) {
        COMItem item;
        item.clsid = clsidKey.substr(clsidKey.find_last_of(L'\\') + 1);
        item.name = name;
        item.location = location;
        item.server = inprocServer;

        std::wstring serverPath = ExtractServerPath(inprocServer);
        item.isSigned = IsFileSigned(serverPath);

        std::wstring suspiciousReason;
        item.suspect = IsSuspiciousPath(serverPath, suspiciousReason);

        if (!item.isSigned && PathFileExistsW(serverPath.c_str())) {
            item.suspect = true;
            if (!suspiciousReason.empty()) suspiciousReason += L", ";
            suspiciousReason += L"Non signé";
        }

        if (location == L"HKCU") {
            // Vérifier si c'est un override de HKLM
            std::wstring hklmPath = L"SOFTWARE\\Classes\\CLSID\\" + item.clsid + L"\\InprocServer32";
            std::wstring hklmServer = ReadRegString(HKEY_LOCAL_MACHINE, hklmPath.c_str(), nullptr);
            if (!hklmServer.empty()) {
                item.suspect = true;
                if (!suspiciousReason.empty()) suspiciousReason += L", ";
                suspiciousReason += L"HKCU override HKLM";
            }
        }

        item.notes = suspiciousReason;
        g_items.push_back(item);
    }

    // Vérifier LocalServer32
    std::wstring localPath = clsidKey + L"\\LocalServer32";
    std::wstring localServer = ReadRegString(hRootKey, localPath.c_str(), nullptr);

    if (!localServer.empty()) {
        COMItem item;
        item.clsid = clsidKey.substr(clsidKey.find_last_of(L'\\') + 1);
        item.name = name;
        item.location = location;
        item.server = localServer;

        std::wstring serverPath = ExtractServerPath(localServer);
        item.isSigned = IsFileSigned(serverPath);

        std::wstring suspiciousReason;
        item.suspect = IsSuspiciousPath(serverPath, suspiciousReason);

        if (!item.isSigned && PathFileExistsW(serverPath.c_str())) {
            item.suspect = true;
            if (!suspiciousReason.empty()) suspiciousReason += L", ";
            suspiciousReason += L"Non signé";
        }

        if (location == L"HKCU") {
            std::wstring hklmPath = L"SOFTWARE\\Classes\\CLSID\\" + item.clsid + L"\\LocalServer32";
            std::wstring hklmServer = ReadRegString(HKEY_LOCAL_MACHINE, hklmPath.c_str(), nullptr);
            if (!hklmServer.empty()) {
                item.suspect = true;
                if (!suspiciousReason.empty()) suspiciousReason += L", ";
                suspiciousReason += L"HKCU override HKLM";
            }
        }

        item.notes = suspiciousReason;
        g_items.push_back(item);
    }
}

// Énumération CLSID d'une ruche
void EnumerateCLSIDs(HKEY hRootKey, const std::wstring& basePath, const std::wstring& location) {
    HKEY hKey;
    if (RegOpenKeyExW(hRootKey, basePath.c_str(), 0, KEY_READ | KEY_WOW64_64KEY, &hKey) != ERROR_SUCCESS) {
        return;
    }

    DWORD index = 0;
    wchar_t clsidName[256];
    DWORD clsidNameSize;

    while (!g_stopScan) {
        clsidNameSize = 256;
        LONG result = RegEnumKeyExW(hKey, index++, clsidName, &clsidNameSize,
                                     nullptr, nullptr, nullptr, nullptr);

        if (result == ERROR_NO_MORE_ITEMS) break;
        if (result != ERROR_SUCCESS) continue;

        // Scanner ce CLSID
        std::wstring fullPath = basePath + L"\\" + clsidName;
        ScanCLSID(hRootKey, fullPath, location);

        // Mise à jour UI tous les 100 CLSIDs
        if (index % 100 == 0) {
            wchar_t status[256];
            wsprintfW(status, L"Scan en cours: %lu CLSIDs analysés...", index);
            SetWindowTextW(g_hStatus, status);
        }
    }

    RegCloseKey(hKey);
}

// Thread de scan
DWORD WINAPI ScanThread(LPVOID lpParam) {
    g_stopScan = false;
    SetWindowTextW(g_hStatus, L"Initialisation du scan...");

    g_items.clear();
    ListView_DeleteAllItems(g_hListView);

    // Scan HKCU (priorité - hijacks user-level)
    SetWindowTextW(g_hStatus, L"Scan HKCU\\Software\\Classes\\CLSID...");
    EnumerateCLSIDs(HKEY_CURRENT_USER, L"Software\\Classes\\CLSID", L"HKCU");

    if (g_stopScan) {
        SetWindowTextW(g_hStatus, L"Scan interrompu par l'utilisateur");
        return 0;
    }

    // Scan HKLM (plus volumineux)
    SetWindowTextW(g_hStatus, L"Scan HKLM\\SOFTWARE\\Classes\\CLSID...");
    EnumerateCLSIDs(HKEY_LOCAL_MACHINE, L"SOFTWARE\\Classes\\CLSID", L"HKLM");

    // Affichage dans ListView
    for (size_t i = 0; i < g_items.size(); ++i) {
        const auto& item = g_items[i];

        LVITEMW lvi = {};
        lvi.mask = LVIF_TEXT;
        lvi.iItem = static_cast<int>(i);

        lvi.iSubItem = COL_CLSID;
        lvi.pszText = const_cast<LPWSTR>(item.clsid.c_str());
        ListView_InsertItem(g_hListView, &lvi);

        std::wstring nameShort = item.name.length() > 50 ?
            item.name.substr(0, 47) + L"..." : item.name;
        ListView_SetItemText(g_hListView, i, COL_NAME, const_cast<LPWSTR>(nameShort.c_str()));

        std::wstring serverShort = item.server.length() > 60 ?
            item.server.substr(0, 57) + L"..." : item.server;
        ListView_SetItemText(g_hListView, i, COL_SERVER, const_cast<LPWSTR>(serverShort.c_str()));

        ListView_SetItemText(g_hListView, i, COL_LOCATION, const_cast<LPWSTR>(item.location.c_str()));
        ListView_SetItemText(g_hListView, i, COL_SIGNED, item.isSigned ? L"Oui" : L"Non");
        ListView_SetItemText(g_hListView, i, COL_SUSPECT, item.suspect ? L"OUI" : L"Non");
        ListView_SetItemText(g_hListView, i, COL_NOTES, const_cast<LPWSTR>(item.notes.c_str()));
    }

    wchar_t status[256];
    wsprintfW(status, L"Scan terminé: %zu CLSID(s) avec serveur trouvé(s)", g_items.size());
    SetWindowTextW(g_hStatus, status);

    return 0;
}

// Export CSV
void ExportToCSV() {
    wchar_t szFile[MAX_PATH] = L"com_hijack_scan.csv";

    OPENFILENAMEW ofn = {};
    ofn.lStructSize = sizeof(ofn);
    ofn.hwndOwner = GetParent(g_hListView);
    ofn.lpstrFilter = L"CSV Files (*.csv)\0*.csv\0All Files (*.*)\0*.*\0";
    ofn.lpstrFile = szFile;
    ofn.nMaxFile = MAX_PATH;
    ofn.Flags = OFN_OVERWRITEPROMPT;
    ofn.lpstrDefExt = L"csv";

    if (!GetSaveFileNameW(&ofn)) return;

    std::wofstream file(szFile, std::ios::out | std::ios::binary);
    if (!file) {
        MessageBoxW(GetParent(g_hListView), L"Impossible de créer le fichier",
                    L"Erreur", MB_OK | MB_ICONERROR);
        return;
    }

    // BOM UTF-8
    file.put(0xEF);
    file.put(0xBB);
    file.put(0xBF);

    file.imbue(std::locale(std::locale(), new std::codecvt_utf8<wchar_t>));

    // En-tête
    file << L"CLSID,Nom,Server,Location,Signé,Suspect,Notes\n";

    // Données
    for (const auto& item : g_items) {
        file << L"\"" << item.clsid << L"\",";
        file << L"\"" << item.name << L"\",";
        file << L"\"" << item.server << L"\",";
        file << L"\"" << item.location << L"\",";
        file << (item.isSigned ? L"Oui" : L"Non") << L",";
        file << (item.suspect ? L"OUI" : L"Non") << L",";
        file << L"\"" << item.notes << L"\"\n";
    }

    file.close();

    SetWindowTextW(g_hStatus, L"Export CSV réussi");
    MessageBoxW(GetParent(g_hListView), L"Export réussi", L"Information", MB_OK | MB_ICONINFORMATION);
}

// Procédure fenêtre principale
LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
    switch (msg) {
        case WM_CREATE: {
            g_hFont = CreateFontW(-12, 0, 0, 0, FW_NORMAL, FALSE, FALSE, FALSE,
                DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
                CLEARTYPE_QUALITY, DEFAULT_PITCH | FF_DONTCARE, L"Segoe UI");

            g_hListView = CreateWindowExW(
                WS_EX_CLIENTEDGE,
                WC_LISTVIEWW,
                L"",
                WS_CHILD | WS_VISIBLE | LVS_REPORT | LVS_SINGLESEL,
                10, 10, 1360, 500,
                hwnd, (HMENU)IDC_LISTVIEW, GetModuleHandle(nullptr), nullptr
            );

            ListView_SetExtendedListViewStyle(g_hListView,
                LVS_EX_FULLROWSELECT | LVS_EX_GRIDLINES | LVS_EX_DOUBLEBUFFER);

            SendMessageW(g_hListView, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            // Colonnes
            LVCOLUMNW lvc = {};
            lvc.mask = LVCF_TEXT | LVCF_WIDTH;

            lvc.pszText = const_cast<LPWSTR>(L"CLSID");
            lvc.cx = 280;
            ListView_InsertColumn(g_hListView, COL_CLSID, &lvc);

            lvc.pszText = const_cast<LPWSTR>(L"Nom");
            lvc.cx = 180;
            ListView_InsertColumn(g_hListView, COL_NAME, &lvc);

            lvc.pszText = const_cast<LPWSTR>(L"Server (DLL/EXE)");
            lvc.cx = 300;
            ListView_InsertColumn(g_hListView, COL_SERVER, &lvc);

            lvc.pszText = const_cast<LPWSTR>(L"Location");
            lvc.cx = 80;
            ListView_InsertColumn(g_hListView, COL_LOCATION, &lvc);

            lvc.pszText = const_cast<LPWSTR>(L"Signé");
            lvc.cx = 60;
            ListView_InsertColumn(g_hListView, COL_SIGNED, &lvc);

            lvc.pszText = const_cast<LPWSTR>(L"Suspect");
            lvc.cx = 70;
            ListView_InsertColumn(g_hListView, COL_SUSPECT, &lvc);

            lvc.pszText = const_cast<LPWSTR>(L"Notes");
            lvc.cx = 360;
            ListView_InsertColumn(g_hListView, COL_NOTES, &lvc);

            // Boutons
            HWND hBtn = CreateWindowW(
                L"BUTTON", L"Scanner Hijacks",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                10, 520, 160, 30,
                hwnd, (HMENU)IDC_BTN_SCAN, GetModuleHandle(nullptr), nullptr
            );
            SendMessageW(hBtn, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            hBtn = CreateWindowW(
                L"BUTTON", L"Vérifier Signatures",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                180, 520, 170, 30,
                hwnd, (HMENU)IDC_BTN_VERIFY, GetModuleHandle(nullptr), nullptr
            );
            SendMessageW(hBtn, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            hBtn = CreateWindowW(
                L"BUTTON", L"Supprimer CLSID (Admin)",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                360, 520, 200, 30,
                hwnd, (HMENU)IDC_BTN_DELETE, GetModuleHandle(nullptr), nullptr
            );
            SendMessageW(hBtn, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            hBtn = CreateWindowW(
                L"BUTTON", L"Exporter CSV",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                570, 520, 150, 30,
                hwnd, (HMENU)IDC_BTN_EXPORT, GetModuleHandle(nullptr), nullptr
            );
            SendMessageW(hBtn, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            g_hStatus = CreateWindowExW(
                0, L"STATIC", L"Prêt - Cliquez sur 'Scanner Hijacks' (ATTENTION: opération longue)",
                WS_CHILD | WS_VISIBLE | SS_LEFT,
                10, 560, 1360, 20,
                hwnd, (HMENU)IDC_STATUS, GetModuleHandle(nullptr), nullptr
            );
            SendMessageW(g_hStatus, WM_SETFONT, (WPARAM)g_hFont, TRUE);

            return 0;
        }

        case WM_COMMAND: {
            switch (LOWORD(wParam)) {
                case IDC_BTN_SCAN:
                    CreateThread(nullptr, 0, ScanThread, nullptr, 0, nullptr);
                    break;

                case IDC_BTN_VERIFY:
                    MessageBoxW(hwnd,
                        L"Vérification signatures intégrée au scan.\n"
                        L"Les DLLs/EXEs non signées sont marquées 'Non' dans colonne 'Signé'.",
                        L"Information", MB_OK | MB_ICONINFORMATION);
                    break;

                case IDC_BTN_DELETE:
                    MessageBoxW(hwnd,
                        L"AVERTISSEMENT: Suppression manuelle recommandée\n\n"
                        L"PowerShell (Admin):\n"
                        L"Remove-Item -Path 'HKCU:\\Software\\Classes\\CLSID\\{GUID}' -Recurse",
                        L"Information", MB_OK | MB_ICONWARNING);
                    break;

                case IDC_BTN_EXPORT:
                    ExportToCSV();
                    break;
            }
            return 0;
        }

        case WM_DESTROY:
            g_stopScan = true;
            if (g_hFont) DeleteObject(g_hFont);
            PostQuitMessage(0);
            return 0;
    }

    return DefWindowProcW(hwnd, msg, wParam, lParam);
}

// Point d'entrée
int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE, LPWSTR, int nCmdShow) {
    INITCOMMONCONTROLSEX icc = {};
    icc.dwSize = sizeof(icc);
    icc.dwICC = ICC_LISTVIEW_CLASSES;
    InitCommonControlsEx(&icc);

    WNDCLASSEXW wc = {};
    wc.cbSize = sizeof(wc);
    wc.lpfnWndProc = WndProc;
    wc.hInstance = hInstance;
    wc.hCursor = LoadCursor(nullptr, IDC_ARROW);
    wc.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
    wc.lpszClassName = L"COMHijackDetectorClass";
    wc.hIcon = LoadIcon(nullptr, IDI_APPLICATION);
    wc.hIconSm = LoadIcon(nullptr, IDI_APPLICATION);

    if (!RegisterClassExW(&wc)) {
        MessageBoxW(nullptr, L"Échec RegisterClassExW", L"Erreur", MB_ICONERROR);
        return 1;
    }

    HWND hwnd = CreateWindowExW(
        0,
        wc.lpszClassName,
        L"COM Hijack Detector - WinToolsSuite v3.0",
        WS_OVERLAPPEDWINDOW,
        CW_USEDEFAULT, CW_USEDEFAULT, 1400, 640,
        nullptr, nullptr, hInstance, nullptr
    );

    if (!hwnd) {
        MessageBoxW(nullptr, L"Échec CreateWindowExW", L"Erreur", MB_ICONERROR);
        return 1;
    }

    ShowWindow(hwnd, nCmdShow);
    UpdateWindow(hwnd);

    MSG msg;
    while (GetMessageW(&msg, nullptr, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessageW(&msg);
    }

    return static_cast<int>(msg.wParam);
}