bool ListenSink::OnConnect(const tchar* service, const tchar* topic)
{
m_out << TXT("XTYP_CONNECT: '")
<< service << TXT("', '")
<< topic << TXT("'")
<< std::endl;
// if (m_delay != 0)
// ::Sleep(m_delay);
return ( (tstricmp(service, m_server.c_str()) == 0)
&& ( (m_topic.empty()) || (tstricmp(topic, m_topic.c_str()) == 0) )
);
}
INT compareRegInfo( const VOID* arg1,const VOID* arg2)
{
const _RegisterInfo* reg1 = (_RegisterInfo*)arg1;
const _RegisterInfo* reg2 = (_RegisterInfo*)arg2;
return tstricmp(reg1->funcname,reg2->funcname);
}
void cEventHandlerHeurKillAV::OnKillService(cEvent& event, tcstring service)
{
for (size_t i=0; i<countof(arrAntiViruses); i++)
{
if(arrAntiViruses[i].service_name == NULL)
continue;
if (0 == tstricmp(service, arrAntiViruses[i].service_name))
return m_pEventMgr->OnAntiAV(event, arrAntiViruses[i].id);
}
return;
}
int CMembersView::CompareRows(CRow& oRow1, CRow& oRow2)
{
const tchar* pszValue1;
const tchar* pszValue2;
int nResult;
// First compare surnames.
pszValue1 = oRow1[CMembers::SURNAME];
pszValue2 = oRow2[CMembers::SURNAME];
nResult = tstricmp(pszValue1, pszValue2);
// Not equal?
if (nResult != 0)
return nResult;
// If equal, compare forenames.
pszValue1 = oRow1[CMembers::FORENAME];
pszValue2 = oRow2[CMembers::FORENAME];
nResult = tstricmp(pszValue1, pszValue2);
return nResult;
}
void cEventHandlerHeurKillAV::OnProcessCreatePost(cEvent& event, tPid new_proc_pid, cFile& image_path, cPath& working_folder, tcstring cmd_line, uint32_t creation_flags)
{
cProcess pProcess = m_pProcessList->FindProcess(new_proc_pid);
if (!pProcess)
return;
if (pProcess->m_argc < 3)
return;
if (0 != tstricmp(pProcess->m_argv[1], _T("stop")) && 0 != tstricmp(pProcess->m_argv[1], _T("delete")))
return;
size_t i;
for (i=0; i<countof(arrAntiViruses); i++)
{
if(arrAntiViruses[i].service_name == NULL)
continue;
if (0 == tstricmp(pProcess->m_argv[2], arrAntiViruses[i].service_name))
break;
}
if (i >= countof(arrAntiViruses))
return;
pProcess.release();
return m_pEventMgr->OnKillService(event, arrAntiViruses[i].service_name);
}
void cEventHandlerHeurKillAV::OnProcessTerminatePre(cEvent& event, tPid dest_pid)
{
if (event.m_pid == dest_pid)
return;
cProcess pProcessDest = m_pProcessList->FindProcess(dest_pid);
if (!pProcessDest)
return;
tcstring filename = pProcessDest->m_image.getFilename();
if (!filename)
return;
size_t i;
for (i=0; i<countof(arrAntiViruses); i++)
{
if (0 == tstricmp(filename, arrAntiViruses[i].file_name))
break;
}
if (i >= countof(arrAntiViruses))
return;
pProcessDest.release();
return m_pEventMgr->OnAntiAV(event, arrAntiViruses[i].id);
}
INT compare( const VOID *arg1, const VOID *arg2 )
{
return tstricmp( (CHAR*)arg1, (CHAR*)arg2 );
}
bool operator()(const std::pair<tstring, TestSetFn>& rhs)
{
return (tstricmp(m_value.c_str(), rhs.first.c_str()) == 0);
}
