1833 lines
62 KiB
Plaintext
1833 lines
62 KiB
Plaintext
{*******************************************************}
|
|
{ }
|
|
{ ManagerHook }
|
|
{ }
|
|
{ Copyright (C) 2022 kku }
|
|
{ }
|
|
{*******************************************************}
|
|
|
|
unit ManagerHook;
|
|
|
|
interface
|
|
|
|
uses
|
|
Tocsg.Obj, System.SysUtils, System.Classes, Winapi.Windows,
|
|
Tocsg.CommonData, Tocsg.Thread, Tocsg.Process, Winapi.Messages, GlobalDefine,
|
|
Tocsg.WndUtil, AppCtrlServer, System.SyncObjs, AppCtrlDefine,
|
|
System.Generics.Collections, Tocsg.Process.IPC, ManagerModel, DDispLogo, Tocsg.Win32;
|
|
|
|
{$IFDEF DEBUG}
|
|
// {$DEFINE _HOOK_TEST_}
|
|
{$ENDIF}
|
|
|
|
const
|
|
PIPE_NAME = 'BS1@230316';
|
|
// PIPE_NAME = 'BS1@260107';
|
|
|
|
BS1HOOK_IPCMESSAGE_STRING = 'ipcBs1MhCtrl';
|
|
|
|
type
|
|
PAppInfoEnt = ^TAppInfoEnt;
|
|
TAppInfoEnt = record
|
|
dwPid: DWORD;
|
|
hMain: HWND;
|
|
end;
|
|
TDcAppInfo = TDictionary<DWORD,PAppInfoEnt>;
|
|
|
|
TManagerHook = class(TTgObject)
|
|
private
|
|
CS_: TCriticalSection;
|
|
ThdAppMon_: TThdProcessWatch;
|
|
ThdWndMon_: TThdActiveWndMon;
|
|
ProcList_: TProcessEntList;
|
|
PidList_: TProcessIdList;
|
|
TgAppList_,
|
|
TgAppList_mad_,
|
|
TgAppExList_,
|
|
DrmAppList_,
|
|
WebAppList_,
|
|
PrintAppList_,
|
|
CaptureBlockApps_: TStringList;
|
|
sTgApps_,
|
|
sTgApps_mad_,
|
|
sConfDir_,
|
|
sLogPath_,
|
|
sHlpExe_,
|
|
sDllPath_,
|
|
sDll32Path_,
|
|
// sDllPathPdf_,
|
|
sPrtWaterSupportApp_: String;
|
|
bIsWow64_: Boolean;
|
|
DcApp_: TDcAppInfo;
|
|
|
|
// madCodeHook 관련
|
|
bUse_madCodeHook_: Boolean;
|
|
mtx_madCode_: TTgMutex;
|
|
|
|
Server_: TAppCtrlServer;
|
|
DefHookOpt_: TAppCtrlOpt;
|
|
|
|
procedure Lock;
|
|
procedure Unlock;
|
|
function IsTgApp(sPName: String): Boolean;
|
|
procedure DelTgApp(sPName: String);
|
|
function GetCtrlOpt(pEnt: PCMEnt): TAppCtrlOpt;
|
|
procedure OnSendCtrlOpt(pEnt: PCMEnt);
|
|
procedure OnAppNotify(aSender: TThdProcessWatch; pEnt: PPwEnt; aKind: TProcessWatchKind);
|
|
procedure OnWndNotify(aSender: TObject; hActiveWnd: HWND);
|
|
procedure SafeFreeClient;
|
|
procedure StopHookWatch;
|
|
procedure ClearHook(bMore: Boolean = false);
|
|
procedure FreeMon;
|
|
procedure OnAppInfoNotify(Sender: TObject; const Item: PAppInfoEnt; Action: TCollectionNotification);
|
|
procedure UpdatePreLoadInfo;
|
|
procedure SendWndCaptureBlock(hPipe: THandle; hTg: HWND; bVal: Boolean);
|
|
function IsAcrobat(sPName: String): Boolean;
|
|
|
|
function IsTgApp_mad(sPName: String): Boolean;
|
|
procedure AddPid(dwPid: DWORD);
|
|
function HasPid(dwPid: DWORD): Boolean;
|
|
procedure DelPid(dwPid: DWORD);
|
|
|
|
procedure Start_madCodeHookInjection;
|
|
procedure Stop_madCodeHookInjection;
|
|
public
|
|
DrmAccessKind,
|
|
DrmModifyKind: TDrmAccessKind;
|
|
bPrtCollect,
|
|
bPrintSecu,
|
|
bPrintWater,
|
|
bDrmAttachAble,
|
|
bFileApproval,
|
|
bIgrNetPathAB,
|
|
bOpenDetect,
|
|
bCaptureBlockApps: Boolean;
|
|
WebbAB,
|
|
OutlookAB,
|
|
EtcAppAB: TAttachBlockPolicy;
|
|
sEtcABApps,
|
|
sWaterExcepts,
|
|
sCaptureBlockApps,
|
|
CaptureBlockUrls: String;
|
|
CaptureBlockUrlKind: TBlockKind;
|
|
MtpBlockKind: TUsbBlockKind;
|
|
MtpRoExp,
|
|
PrtNameH: String;
|
|
PrtWaterCfg: TPrtWaterCfg;
|
|
ShFileCrMon: TShFileCrMon;
|
|
|
|
IntBtBlockNewFile,
|
|
IntUsbBlockNewFile,
|
|
IntCdromBlockNewFile,
|
|
IntMtpBlockNewFile,
|
|
IntUsbToUsbBlockNewFile: TIntBlockNewFile;
|
|
|
|
OutFileBlockMB,
|
|
WebFileBlockMB,
|
|
AppFileBlockMB: Integer;
|
|
|
|
Constructor Create;
|
|
Destructor Destroy; override;
|
|
|
|
function IsChangeHookPolicy(aPO: TPrefModel): Boolean;
|
|
function SetCaptureBlock(hTg: HWND; bVal: Boolean): Boolean;
|
|
|
|
procedure UpdateHookTarget;
|
|
procedure StartHookWatch;
|
|
end;
|
|
|
|
function RefinePrintHookAppList(aList: TStringList): Boolean;
|
|
|
|
implementation
|
|
|
|
uses
|
|
Tocsg.WinInfo, Tocsg.Path, ManagerService, Tocsg.Exception, Tocsg.Shell,
|
|
Tocsg.Strings, Condition, System.IniFiles,
|
|
Tocsg.Safe, Tocsg.Packet, Vcl.Forms, Tocsg.Json, Tocsg.Registry, Tocsg.Trace, madCodeHook, superobject;
|
|
|
|
function RefinePrintHookAppList(aList: TStringList): Boolean;
|
|
var
|
|
n: Integer;
|
|
sTemp: String;
|
|
begin
|
|
Result := false;
|
|
if IsHD then
|
|
begin
|
|
// 아래한글 프린트 워터마크는 다른 보안프로그램으로 처리하기 때문에 예외 요청함 23_1018 17:11:05 kku
|
|
n := aList.IndexOf('hwp.exe');
|
|
if n <> -1 then
|
|
begin
|
|
aList.Delete(n);
|
|
Result := true;
|
|
end;
|
|
end else begin
|
|
case CUSTOMER_TYPE of
|
|
CUSTOMER_WELFNI,
|
|
CUSTOMER_WELFND :
|
|
begin
|
|
n := aList.IndexOf('notepad.exe');
|
|
if n <> -1 then
|
|
begin
|
|
aList.Delete(n);
|
|
Result := true;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
sTemp := gMgSvc.PrefModel.PrtWaterAppHig;
|
|
if sTemp <> '' then
|
|
begin
|
|
var StrList: TStringList;
|
|
Guard(StrList, TStringList.Create);
|
|
SplitString(sTemp, '|', StrList, false, true);
|
|
var i: Integer;
|
|
for i := 0 to StrList.Count - 1 do
|
|
begin
|
|
n := aList.IndexOf(StrList[i]);
|
|
if n <> -1 then
|
|
begin
|
|
aList.Delete(n);
|
|
Result := true;
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
{ TManagerHook }
|
|
|
|
Constructor TManagerHook.Create;
|
|
var
|
|
// sTextOutDir,
|
|
sTextOutApp: String;
|
|
ini: TIniFile;
|
|
sPath, sTemp: String;
|
|
n: Integer;
|
|
begin
|
|
Inherited Create;
|
|
// _Trace('Create() ..');
|
|
|
|
CS_ := TCriticalSection.Create;
|
|
bUse_madCodeHook_ := IsUse_madCodeHook;
|
|
|
|
sDllPath_ := GetRunExePathDir + DIR_CONF + DLL_HOOK;
|
|
if not FileExists(sDllPath_) then
|
|
sDllPath_ := GetRunExePathDir + DLL_HOOK;
|
|
|
|
sDll32Path_ := GetRunExePathDir + DIR_CONF + DLL_HOOK32;
|
|
if not FileExists(sDll32Path_) then
|
|
sDll32Path_ := GetRunExePathDir + DLL_HOOK32;
|
|
|
|
// sDllPathPdf_ := GetRunExePathDir + DIR_CONF + DLL_HOOK_PDF;
|
|
// if not FileExists(sDllPathPdf_) then
|
|
// sDllPathPdf_ := GetRunExePathDir + DLL_HOOK_PDF;
|
|
|
|
Server_ := nil;
|
|
mtx_madCode_ := nil;
|
|
|
|
sLogPath_ := CutFileExt(GetRunExePath) + '.log';
|
|
sHlpExe_ := GetRunExePathDir + DIR_CONF + EXE_HP;
|
|
|
|
sConfDir_ := GetRunExePathDir + DIR_CONF;
|
|
sTgApps_ := '';
|
|
sTgApps_mad_ := '';
|
|
sCaptureBlockApps := '';
|
|
bCaptureBlockApps := false;
|
|
OutFileBlockMB := 0;
|
|
WebFileBlockMB := 0;
|
|
AppFileBlockMB := 0;
|
|
// sTextOutDir := '';
|
|
|
|
sTextOutApp := GetRunExePathDir + DIR_CONF + EXE_OCR;
|
|
if not FileExists(sTextOutApp) then
|
|
sTextOutApp := '';
|
|
|
|
ZeroMemory(@PrtWaterCfg, SizeOf(PrtWaterCfg));
|
|
ZeroMemory(@ShFileCrMon, SizeOf(ShFileCrMon));
|
|
|
|
sTemp := sLogPath_[1] + ':\ProgramData\HE\';
|
|
ZeroMemory(@DefHookOpt_, SizeOf(DefHookOpt_));
|
|
DefHookOpt_.hRcvWnd := gMgSvc.RcvHwnd;
|
|
DefHookOpt_.sTaskDir := sTemp + 'Desk\';
|
|
DefHookOpt_.dwCustomerType := CUSTOMER_TYPE;
|
|
DefHookOpt_.sDrmPass := GetMK(false);
|
|
|
|
// DefHookOpt_.sTextOutApp := sTextOutApp;
|
|
// DefHookOpt_.sTextOutDir := sTextOutDir;
|
|
DefHookOpt_.nFontSize := 175;
|
|
DefHookOpt_.nLineCount := 4;
|
|
ForceDirectories(DefHookOpt_.sTaskDir);
|
|
// DefHookOpt_.sPrintWaterTxt := gMgSvc.EmpNo + '/' + gMgSvc.NicService.GetIP + '/' + FormatDateTime('yyyy-mm-dd', Now);
|
|
|
|
DefHookOpt_.sAipPath := gMgSvc.GetAipPath;
|
|
// if IsPrintWaterBoth and not IsPrintWaterHookForce then
|
|
// DefHookOpt_.sPrintWaterImg := '*HB*|' + gMgSvc.PrefModel.PrtNameH;
|
|
if IsPrintWaterHook and not IsHD then
|
|
DefHookOpt_.sPrtEmfOutDir := sTemp + 'PrtCol\';
|
|
|
|
// if IsPrtSpl2Pdf then
|
|
// begin
|
|
// sPrtWaterSupportApp_ := '*' + EXE_HE;// + '|*' + EXE_CS;
|
|
// end else
|
|
begin
|
|
case CUSTOMER_TYPE of
|
|
CUSTOMER_GEC,
|
|
CUSTOMER_HDENG : sPrtWaterSupportApp_ := RPINT_SUPPORT_APPS_HEC;
|
|
else sPrtWaterSupportApp_ := PRINT_SUPPORT_APPS;
|
|
end;
|
|
|
|
sPath := GetProgramFilesDir + DIR_TG + INI_FORCEHE;
|
|
if FileExists(sPath) then
|
|
begin
|
|
try
|
|
Guard(ini, TIniFile.Create(sPath));
|
|
sPrtWaterSupportApp_ := sPrtWaterSupportApp_ + '|' + ini.ReadString('Force', 'PrtWaterApp', '');
|
|
// sTextOutDir := IncludeTrailingPathDelimiter(ini.ReadString('Test', 'HookOutDir', ''));
|
|
|
|
DefHookOpt_.fWmTran := ini.ReadFloat('Force', 'WmTran', 0.0);
|
|
except
|
|
// ..
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
if IsPrintWaterHookAppUp then
|
|
sPrtWaterSupportApp_ := sPrtWaterSupportApp_ + '|' + APP_WEB_BROWSERS;
|
|
sTemp := gMgSvc.PrefModel.PrtWaterAppH;
|
|
if sTemp <> '' then
|
|
sPrtWaterSupportApp_ := sPrtWaterSupportApp_ + '|' + sTemp;
|
|
|
|
ProcList_ := TProcessEntList.Create;;
|
|
ProcList_.DetailInfo := false;
|
|
PidList_ := TProcessIdList.Create;
|
|
DcApp_ := TDcAppInfo.Create;
|
|
DcApp_.OnValueNotify := OnAppInfoNotify;
|
|
|
|
TgAppList_ := TStringList.Create;
|
|
TgAppList_.CaseSensitive := false;
|
|
TgAppList_mad_ := TStringList.Create;
|
|
TgAppList_mad_.CaseSensitive := false;
|
|
TgAppExList_ := TStringList.Create;
|
|
TgAppExList_.CaseSensitive := false;
|
|
DrmAppList_ := TStringList.Create;
|
|
DrmAppList_.CaseSensitive := false;
|
|
{$IFNDEF _HOOK_TEST_}
|
|
if not NotUseDRM and not bUse_madCodeHook_ then
|
|
SplitString(DRM_SUPPORT_APPS, '|', DrmAppList_);
|
|
{$ENDIF}
|
|
WebAppList_ := TStringList.Create;
|
|
WebAppList_.CaseSensitive := false;
|
|
SplitString(WEB_BROWSERS, '|', WebAppList_);
|
|
PrintAppList_ := TStringList.Create;
|
|
PrintAppList_.CaseSensitive := false;
|
|
// if IsPrintWaterHook or IsPrintWaterBoth or IsPrtSpl2Pdf then // 프린트 마스킹도 필요 24_0524 10:06:27 kku
|
|
if IsPrintWaterHook then // 프린트 마스킹도 필요 24_0524 10:06:27 kku
|
|
SplitString(sPrtWaterSupportApp_, '|', PrintAppList_, false, true);
|
|
if RefinePrintHookAppList(PrintAppList_) then
|
|
sPrtWaterSupportApp_ := ListToDelimitedText(PrintAppList_, '|');
|
|
CaptureBlockApps_ := TStringList.Create;
|
|
CaptureBlockApps_.CaseSensitive := false;
|
|
|
|
ThdAppMon_ := nil;
|
|
ThdWndMon_ := nil;
|
|
bIsWow64_ := IsWow64;
|
|
end;
|
|
|
|
Destructor TManagerHook.Destroy;
|
|
begin
|
|
// _Trace('Destroy() ..');
|
|
StopHookWatch;
|
|
FreeAndNil(CaptureBlockApps_);
|
|
FreeAndNil(PrintAppList_);
|
|
FreeAndNil(WebAppList_);
|
|
FreeAndNil(DrmAppList_);
|
|
FreeAndNil(TgAppExList_);
|
|
FreeAndNil(TgAppList_mad_);
|
|
FreeAndNil(TgAppList_);
|
|
FreeAndNil(DcApp_);
|
|
FreeAndNil(PidList_);
|
|
FreeAndNil(ProcList_);
|
|
if Server_ <> nil then
|
|
FreeAndNil(Server_);
|
|
if mtx_madCode_ <> nil then
|
|
FreeAndNil(mtx_madCode_);
|
|
Inherited;
|
|
FreeAndNil(CS_);
|
|
end;
|
|
|
|
function TManagerHook.IsChangeHookPolicy(aPO: TPrefModel): Boolean;
|
|
var
|
|
PPO: TPrefModel;
|
|
|
|
function IsBlockNewFileChangePolicy():Boolean;
|
|
begin
|
|
// IntBtBlockNewFile,
|
|
// IntUsbBlockNewFile,
|
|
// IntUsbToUsbBlockNewFile,
|
|
// IntCdromBlockNewFile,
|
|
// IntMtpBlockNewFile: TIntBlockNewFile;
|
|
Result := (aPO.IntBtBlockNewFile.mode <> IntBtBlockNewFile.mode) or //bluetooth
|
|
(aPO.IntBtBlockNewFile.userAlert <> IntBtBlockNewFile.userAlert) or
|
|
(aPO.IntBtBlockNewFile.extList <> IntBtBlockNewFile.extList) or
|
|
(aPO.IntBtBlockNewFile.excList <> IntBtBlockNewFile.excList) or
|
|
(aPO.IntBtBlockNewFile.contentsFilter_use <> IntBtBlockNewFile.contentsFilter_use) or
|
|
(aPO.IntBtBlockNewFile.blockByFilename_use <> IntBtBlockNewFile.blockByFilename_use) or
|
|
(aPO.IntBtBlockNewFile.blockByFilename_list <> IntBtBlockNewFile.blockByFilename_list) or
|
|
(aPO.IntBtBlockNewFile.blockBySig_use <> IntBtBlockNewFile.blockBySig_use) or
|
|
(aPO.IntBtBlockNewFile.blockBySig_list <> IntBtBlockNewFile.blockBySig_list) or
|
|
(aPO.IntBtBlockNewFile.blockBySizeLimit_use <> IntBtBlockNewFile.blockBySizeLimit_use) or
|
|
(aPO.IntBtBlockNewFile.blockBySizeLimit_minMb <> IntBtBlockNewFile.blockBySizeLimit_minMb) or
|
|
(aPO.IntUsbBlockNewFile.mode <> IntUsbBlockNewFile.mode) or //usb
|
|
(aPO.IntUsbBlockNewFile.userAlert <> IntUsbBlockNewFile.userAlert) or
|
|
(aPO.IntUsbBlockNewFile.extList <> IntUsbBlockNewFile.extList) or
|
|
(aPO.IntUsbBlockNewFile.excList <> IntUsbBlockNewFile.excList) or
|
|
(aPO.IntUsbBlockNewFile.contentsFilter_use <> IntUsbBlockNewFile.contentsFilter_use) or
|
|
(aPO.IntUsbBlockNewFile.blockByFilename_use <> IntUsbBlockNewFile.blockByFilename_use) or
|
|
(aPO.IntUsbBlockNewFile.blockByFilename_list <> IntUsbBlockNewFile.blockByFilename_list) or
|
|
(aPO.IntUsbBlockNewFile.blockBySig_use <> IntUsbBlockNewFile.blockBySig_use) or
|
|
(aPO.IntUsbBlockNewFile.blockBySig_list <> IntUsbBlockNewFile.blockBySig_list) or
|
|
(aPO.IntUsbBlockNewFile.blockBySizeLimit_use <> IntUsbBlockNewFile.blockBySizeLimit_use) or
|
|
(aPO.IntUsbBlockNewFile.blockBySizeLimit_minMb <> IntUsbBlockNewFile.blockBySizeLimit_minMb) or
|
|
(aPO.IntUsbToUsbBlockNewFile.mode <> IntUsbToUsbBlockNewFile.mode) or //UsbtoUsb
|
|
(aPO.IntUsbToUsbBlockNewFile.userAlert <> IntUsbToUsbBlockNewFile.userAlert) or
|
|
(aPO.IntUsbToUsbBlockNewFile.extList <> IntUsbToUsbBlockNewFile.extList) or
|
|
(aPO.IntUsbToUsbBlockNewFile.excList <> IntUsbToUsbBlockNewFile.excList) or
|
|
(aPO.IntUsbToUsbBlockNewFile.contentsFilter_use <> IntUsbToUsbBlockNewFile.contentsFilter_use) or
|
|
(aPO.IntUsbToUsbBlockNewFile.blockByFilename_use <> IntUsbToUsbBlockNewFile.blockByFilename_use) or
|
|
(aPO.IntUsbToUsbBlockNewFile.blockByFilename_list <> IntUsbToUsbBlockNewFile.blockByFilename_list) or
|
|
(aPO.IntUsbToUsbBlockNewFile.blockBySig_use <> IntUsbToUsbBlockNewFile.blockBySig_use) or
|
|
(aPO.IntUsbToUsbBlockNewFile.blockBySig_list <> IntUsbToUsbBlockNewFile.blockBySig_list) or
|
|
(aPO.IntUsbToUsbBlockNewFile.blockBySizeLimit_use <> IntUsbToUsbBlockNewFile.blockBySizeLimit_use) or
|
|
(aPO.IntUsbToUsbBlockNewFile.blockBySizeLimit_minMb <> IntUsbToUsbBlockNewFile.blockBySizeLimit_minMb) or
|
|
(aPO.IntCdromBlockNewFile.mode <> IntCdromBlockNewFile.mode) or //cdrom
|
|
(aPO.IntCdromBlockNewFile.userAlert <> IntCdromBlockNewFile.userAlert) or
|
|
(aPO.IntCdromBlockNewFile.extList <> IntCdromBlockNewFile.extList) or
|
|
(aPO.IntCdromBlockNewFile.excList <> IntCdromBlockNewFile.excList) or
|
|
(aPO.IntCdromBlockNewFile.contentsFilter_use <> IntCdromBlockNewFile.contentsFilter_use) or
|
|
(aPO.IntCdromBlockNewFile.blockByFilename_use <> IntCdromBlockNewFile.blockByFilename_use) or
|
|
(aPO.IntCdromBlockNewFile.blockByFilename_list <> IntCdromBlockNewFile.blockByFilename_list) or
|
|
(aPO.IntCdromBlockNewFile.blockBySig_use <> IntCdromBlockNewFile.blockBySig_use) or
|
|
(aPO.IntCdromBlockNewFile.blockBySig_list <> IntCdromBlockNewFile.blockBySig_list) or
|
|
(aPO.IntCdromBlockNewFile.blockBySizeLimit_use <> IntCdromBlockNewFile.blockBySizeLimit_use) or
|
|
(aPO.IntCdromBlockNewFile.blockBySizeLimit_minMb <> IntCdromBlockNewFile.blockBySizeLimit_minMb) or
|
|
(aPO.IntMtpBlockNewFile.mode <> IntMtpBlockNewFile.mode) or //mtp
|
|
(aPO.IntMtpBlockNewFile.userAlert <> IntMtpBlockNewFile.userAlert) or
|
|
(aPO.IntMtpBlockNewFile.extList <> IntMtpBlockNewFile.extList) or
|
|
(aPO.IntMtpBlockNewFile.excList <> IntMtpBlockNewFile.excList) or
|
|
(aPO.IntMtpBlockNewFile.contentsFilter_use <> IntMtpBlockNewFile.contentsFilter_use) or
|
|
(aPO.IntMtpBlockNewFile.blockByFilename_use <> IntMtpBlockNewFile.blockByFilename_use) or
|
|
(aPO.IntMtpBlockNewFile.blockByFilename_list <> IntMtpBlockNewFile.blockByFilename_list) or
|
|
(aPO.IntMtpBlockNewFile.blockBySig_use <> IntMtpBlockNewFile.blockBySig_use) or
|
|
(aPO.IntMtpBlockNewFile.blockBySig_list <> IntMtpBlockNewFile.blockBySig_list) or
|
|
(aPO.IntMtpBlockNewFile.blockBySizeLimit_use <> IntMtpBlockNewFile.blockBySizeLimit_use) or
|
|
(aPO.IntMtpBlockNewFile.blockBySizeLimit_minMb <> IntMtpBlockNewFile.blockBySizeLimit_minMb);
|
|
end;
|
|
|
|
begin
|
|
PPO := gMgSvc.PrefModel;
|
|
Result := (aPO.DrmAccessKind <> DrmAccessKind) or
|
|
(aPO.DrmModifyKind <> DrmModifyKind) or
|
|
(aPO.IsDrmAttAble <> bDrmAttachAble) or
|
|
|
|
((aPO.Print.PrintKind <> pkNone) and not bPrintSecu) or
|
|
((aPO.Print.PrintKind = pkNone) and bPrintSecu) or
|
|
(IsPrintWaterHook and ((aPO.IsPrtCollectThum or IsApproveSupport) <> bPrtCollect)) or
|
|
((aPO.Print.PrintWater <> pwNone) and (aPO.Print.sWaterExcepts <> sWaterExcepts)) or
|
|
|
|
// ( (IsPrintWaterHook or not FileExists(sConfDir_ + EXE_SPL) or IsPrintWaterBoth or IsPrtSpl2Pdf) and
|
|
( (IsPrintWaterHook or not FileExists(sConfDir_ + EXE_SPL)) and
|
|
( ((aPO.Print.PrintWater <> pwNone) and not bPrintWater) or
|
|
((aPO.Print.PrintWater = pwNone) and bPrintWater) ) ) or
|
|
(aPO.Print.sWaterExcepts <> sWaterExcepts) or
|
|
|
|
(aPO.bCaptureBlockApps_ <> bCaptureBlockApps) or
|
|
(aPO.CaptureBlockApps <> sCaptureBlockApps) or
|
|
|
|
(aPO.OutFileBlockMB <> OutFileBlockMB) or
|
|
(aPO.WebFileBlockMB <> WebFileBlockMB) or
|
|
(aPO.AppFileBlockMB <> AppFileBlockMB) or
|
|
|
|
(aPO.EtcAB.Kind <> EtcAppAB.Kind) or
|
|
((aPO.EtcABApps + '|' + aPO.EtcAbLogList) <> sEtcABApps) or
|
|
(aPO.OutlookAB.Kind <> OutlookAB.Kind) or
|
|
(aPO.WebbAB.Kind <> WebbAB.Kind) or
|
|
|
|
(aPO.EtcAB.bPopup <> EtcAppAB.bPopup) or
|
|
(aPO.EtcAB.bReadBlock <> EtcAppAB.bReadBlock) or
|
|
(aPO.EtcAB.bWriteBlock <> EtcAppAB.bWriteBlock) or
|
|
(aPO.EtcAB.bCollectTxt <> EtcAppAB.bCollectTxt) or
|
|
(aPO.EtcAB.bCollectFile <> EtcAppAB.bCollectFile) or
|
|
(aPO.EtcAB.ContentFilter.bActive <> EtcAppAB.ContentFilter.bActive) or
|
|
(aPO.EtcAB.ContentFilter.sPatterns <> EtcAppAB.ContentFilter.sPatterns) or
|
|
(aPO.EtcAB.ContentFilter.nHitLimit <> EtcAppAB.ContentFilter.nHitLimit) or
|
|
(aPO.OutlookAB.bPopup <> OutlookAB.bPopup) or
|
|
(aPO.OutlookAB.bReadBlock <> OutlookAB.bReadBlock) or
|
|
(aPO.OutlookAB.bWriteBlock <> OutlookAB.bWriteBlock) or
|
|
(aPO.OutlookAB.bCollectTxt <> OutlookAB.bCollectTxt) or
|
|
(aPO.OutlookAB.bCollectFile <> OutlookAB.bCollectFile) or
|
|
(aPO.OutlookAB.ContentFilter.bActive <> OutlookAB.ContentFilter.bActive) or
|
|
(aPO.OutlookAB.ContentFilter.sPatterns <> OutlookAB.ContentFilter.sPatterns) or
|
|
(aPO.OutlookAB.ContentFilter.nHitLimit <> OutlookAB.ContentFilter.nHitLimit) or
|
|
(aPO.WebbAB.bPopup <> WebbAB.bPopup) or
|
|
(aPO.WebbAB.bReadBlock <> WebbAB.bReadBlock) or
|
|
(aPO.WebbAB.bWriteBlock <> WebbAB.bWriteBlock) or
|
|
(aPO.WebbAB.bCollectTxt <> WebbAB.bCollectTxt) or
|
|
(aPO.WebbAB.bCollectFile <> WebbAB.bCollectFile) or
|
|
(aPO.WebbAB.ContentFilter.bActive <> WebbAB.ContentFilter.bActive) or
|
|
(aPO.WebbAB.ContentFilter.sPatterns <> WebbAB.ContentFilter.sPatterns) or
|
|
(aPO.WebbAB.ContentFilter.nHitLimit <> WebbAB.ContentFilter.nHitLimit) or
|
|
((IsApproveSupport and aPO.ExFApproval) <> bFileApproval) or
|
|
(PPO.OpenDetect <> bOpenDetect) or
|
|
(PPO.IgrNetPathAB <> bIgrNetPathAB) or
|
|
|
|
(aPO.ShFileCrMon.nKind <> ShFileCrMon.nKind) or
|
|
(aPO.ShFileCrMon.sExpLst <> ShFileCrMon.sExpLst) or
|
|
|
|
(aPO.CaptureBlockUrlKind <> CaptureBlockUrlKind) or
|
|
(aPO.CaptureBlockUrls <> CaptureBlockUrls) or
|
|
|
|
( (aPO.MtpBlockKind <> MtpBlockKind) and
|
|
( (aPO.MtpBlockKind = ubkReadOnly) or (MtpBlockKind = ubkReadOnly) ) ) or
|
|
(MtpRoExp <> aPO.MtpExcept) or
|
|
(PrtNameH <> PPO.PrtNameH) or
|
|
not CompareMem(@PrtWaterCfg, @aPO.PrtWaterCfg, SizeOf(PrtWaterCfg)) or
|
|
IsBlockNewFileChangePolicy;
|
|
end;
|
|
|
|
procedure TManagerHook.SendWndCaptureBlock(hPipe: THandle; hTg: HWND; bVal: Boolean);
|
|
var
|
|
Send: ISendPacket;
|
|
begin
|
|
try
|
|
Send := TTgPacket.Create(ACC_SET_CAPTURE_BLOCK);
|
|
Send.Toss := hPipe;
|
|
Send.I['Wnd'] := hTg;
|
|
Send.B['Block'] := bVal;
|
|
Server_.SendPacket(Send);
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. SendWndCaptureBlock()');
|
|
end;
|
|
end;
|
|
|
|
function TManagerHook.IsAcrobat(sPName: String): Boolean;
|
|
begin
|
|
Result := (CompareText(sPName, 'Acrobat.exe') = 0) or
|
|
(CompareText(sPName, 'AcroCEF.exe') = 0) or
|
|
(CompareText(sPName, 'AcroRd32.exe') = 0)
|
|
end;
|
|
|
|
function TManagerHook.IsTgApp_mad(sPName: String): Boolean;
|
|
begin
|
|
Lock;
|
|
try
|
|
Result := TgAppList_mad_.IndexOf(sPName) <> -1;
|
|
finally
|
|
Unlock;
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.AddPid(dwPid: DWORD);
|
|
begin
|
|
Lock;
|
|
try
|
|
if PidList_.IndexOf(dwPid) = -1 then
|
|
PidList_.Add(dwPid);
|
|
finally
|
|
Unlock;
|
|
end;
|
|
end;
|
|
|
|
function TManagerHook.HasPid(dwPid: DWORD): Boolean;
|
|
begin
|
|
Lock;
|
|
try
|
|
Result := PidList_.IndexOf(dwPid) <> -1;
|
|
finally
|
|
Unlock;
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.DelPid(dwPid: DWORD);
|
|
var
|
|
i: Integer;
|
|
begin
|
|
Lock;
|
|
try
|
|
i := PidList_.IndexOf(dwPid);
|
|
if i <> -1 then
|
|
PidList_.Delete(i);
|
|
finally
|
|
Unlock;
|
|
end;
|
|
end;
|
|
|
|
function TManagerHook.SetCaptureBlock(hTg: HWND; bVal: Boolean): Boolean;
|
|
var
|
|
dwPid: DWORD;
|
|
pEnt: PCMEnt;
|
|
Send: ISendPacket;
|
|
begin
|
|
Result := false;
|
|
try
|
|
dwPid := GetProcessPIDFromWndHandle(hTg);
|
|
if dwPid = 0 then
|
|
exit;
|
|
|
|
if DcApp_.ContainsKey(dwPid) and (Server_ <> nil) and (Server_.Connected) then
|
|
begin
|
|
pEnt := Server_.GetCMEEntByPID(dwPid);
|
|
if pEnt = nil then
|
|
exit;
|
|
|
|
if pEnt.bCapBlock <> bVal then
|
|
begin
|
|
pEnt.bCapBlock := bVal;
|
|
Result := true;
|
|
|
|
SendWndCaptureBlock(pEnt.hPipe, hTg, bVal);
|
|
end;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. SetCaptureBlock()');
|
|
end;
|
|
end;
|
|
|
|
// DRM 등 DLL Injection 후 바로 인식해야 하는 정보를 모아서 미리 파일로 저장해서 공유
|
|
// TTgFileMapping 사용 안함 25_0205 16:20:06 kku
|
|
procedure TManagerHook.UpdatePreLoadInfo;
|
|
var
|
|
O, OEtc, OApp: ISuperObject;
|
|
PO: TPrefModel;
|
|
StrList: TStringList;
|
|
sAppName: string;
|
|
i: Integer;
|
|
|
|
begin
|
|
PO := gMgSvc.ModePolicy;
|
|
O := SO;
|
|
|
|
O.I['CT'] := CUSTOMER_TYPE;
|
|
O.I['RcvWnd'] := gMgSvc.RcvHwnd;
|
|
O.B['PrtSecu'] := bPrintSecu;
|
|
O.B['bPrtWater'] := bPrintWater;
|
|
O.B['PrtCol'] := bPrtCollect;
|
|
O.I['DAK'] := Integer(PO.DrmAccessKind);
|
|
O.I['DMK'] := Integer(PO.DrmModifyKind);
|
|
O.S['AS'] := GetMK(false);
|
|
O.S['EmpNo'] := gMgSvc.EmpNo;
|
|
O.S['UName'] := gMgSvc.UName;
|
|
if gMgSvc.DeptName <> '' then
|
|
O.S['Dept'] := gMgSvc.DeptName
|
|
else
|
|
O.S['Dept'] := PO.DeptName;
|
|
O.S['IP'] := gMgSvc.NicService.GetIP;
|
|
O.S['EmfDir'] := DefHookOpt_.sPrtEmfOutDir;
|
|
O.S['TskDir'] := DefHookOpt_.sTaskDir;
|
|
O.O['ShFileCrMon'] := TTgJson.ValueToJsonObject<TShFileCrMon>(PO.ShFileCrMon);
|
|
//mgkim madcodehook bluetooth fsqu.. 을 위한 추가 정책 저장
|
|
// EtcAB 설정을 담을 객체 생성
|
|
OEtc := SO;
|
|
if (PO.EtcAB.Kind <> abkNone) and (sEtcABApps <> '') then
|
|
begin
|
|
StrList := TStringList.Create;
|
|
try
|
|
StrList.CaseSensitive := False;
|
|
SplitString(sEtcABApps, '|', StrList); // 앱 목록 분리
|
|
|
|
for i := 0 to StrList.Count - 1 do
|
|
begin
|
|
sAppName := ChangeFileExt(StrList[i], '');
|
|
if sAppName = '' then Continue;
|
|
|
|
// 개별 앱의 정책을 담을 객체
|
|
OApp := SO;
|
|
|
|
// 해당 앱의 정책 결정 로직
|
|
case PO.EtcAB.Kind of
|
|
abkBlock: OApp.I['FileUseBlock'] := Integer(fubBlock);
|
|
abkLog: OApp.I['FileUseBlock'] := Integer(fubMonitor);
|
|
else
|
|
OApp.I['FileUseBlock'] := Integer(fubNone);
|
|
end;
|
|
|
|
// 예외 리스트(White-list) 체크: 차단 대상이지만 로그 목록에 있다면 모니터링으로 변경
|
|
if (OApp.I['FileUseBlock'] = Integer(fubBlock)) and
|
|
(Pos(UpperCase(sAppName), UpperCase(PO.EtcAbLogList)) > 0) then
|
|
begin
|
|
OApp.I['FileUseBlock'] := Integer(fubMonitor);
|
|
end;
|
|
|
|
// 세부 정책 하위 할당
|
|
OApp.B['bUseContentFilter'] := PO.EtcAB.ContentFilter.bActive;
|
|
OApp.B['bReadBlock'] := PO.EtcAB.bReadBlock;
|
|
OApp.B['bWriteBlock'] := PO.EtcAB.bWriteBlock;
|
|
OApp.I['nBlockSizeMB'] := AppFileBlockMB;
|
|
|
|
// 앱 이름을 Key로 하여 전체 리스트에 추가
|
|
OEtc.O[UpperCase(sAppName)] := OApp;
|
|
end;
|
|
finally
|
|
StrList.Free;
|
|
end;
|
|
end;
|
|
|
|
O.O['IntBtBlockNewFile'] := TTgJson.ValueToJsonObject<TIntBlockNewFile>(IntBtBlockNewFile);
|
|
O.O['IntUsbBlockNewFile'] := TTgJson.ValueToJsonObject<TIntBlockNewFile>(IntUsbBlockNewFile);
|
|
O.O['IntUsbToUsbBlockNewFile'] := TTgJson.ValueToJsonObject<TIntBlockNewFile>(IntUsbToUsbBlockNewFile);
|
|
O.O['IntCdromBlockNewFile'] := TTgJson.ValueToJsonObject<TIntBlockNewFile>(IntCdromBlockNewFile);
|
|
O.O['IntMtpBlockNewFile'] := TTgJson.ValueToJsonObject<TIntBlockNewFile>(IntMtpBlockNewFile);
|
|
O.O['EtcABApps'] := OEtc;
|
|
|
|
SaveJsonObjToFile(O, GetRunExePathDir + DIR_CONF + 'noenc_hpli.dat');
|
|
SaveJsonObjToEncFile(O, GetRunExePathDir + DIR_CONF + 'hpli.dat', '9live@u');
|
|
end;
|
|
|
|
procedure TManagerHook.Lock;
|
|
begin
|
|
CS_.Acquire;
|
|
end;
|
|
|
|
procedure TManagerHook.Unlock;
|
|
begin
|
|
CS_.Release;
|
|
end;
|
|
|
|
function TManagerHook.IsTgApp(sPName: String): Boolean;
|
|
begin
|
|
try
|
|
Lock;
|
|
try
|
|
Result := TgAppList_.IndexOf(sPName) <> -1;
|
|
finally
|
|
Unlock;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. IsTgApp()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.DelTgApp(sPName: String);
|
|
var
|
|
n: Integer;
|
|
begin
|
|
try
|
|
Lock;
|
|
try
|
|
n := TgAppList_.IndexOf(sPName);
|
|
if n <> -1 then
|
|
TgAppList_.Delete(n);
|
|
finally
|
|
Unlock;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. DelTgApp()');
|
|
end;
|
|
end;
|
|
|
|
function TManagerHook.GetCtrlOpt(pEnt: PCMEnt): TAppCtrlOpt;
|
|
var
|
|
PO: TPrefModel;
|
|
StrList: TStringList;
|
|
i: Integer;
|
|
begin
|
|
try
|
|
PO := gMgSvc.ModePolicy;
|
|
|
|
UpdatePreLoadInfo;
|
|
_Trace(Format('GetCtrlOpt, dwPid(%d)', [pEnt.dwPid]));
|
|
|
|
// 최신 정보로 업데이트 되도록 위치 이동 25_1126 14:55:52 kku
|
|
DefHookOpt_.sAccount := gMgSvc.Account;
|
|
DefHookOpt_.sAcName := GetUserNameFromReg;
|
|
DefHookOpt_.sAcSSid := gMgSvc.RecentUserSid;
|
|
DefHookOpt_.sUName := gMgSvc.UName;
|
|
DefHookOpt_.sEmpNo := gMgSvc.EmpNo; // 이름 변경되게 하면... 불안하다..
|
|
if gMgSvc.DeptName <> '' then
|
|
DefHookOpt_.sDeptName := ExtrLastDelimiterStr(gMgSvc.DeptName, ';')
|
|
else if gMgSvc.PrefModel.DeptName <> '' then
|
|
DefHookOpt_.sDeptName := ExtrLastDelimiterStr(gMgSvc.PrefModel.DeptName, ';');
|
|
|
|
Result := DefHookOpt_;
|
|
if DcApp_.ContainsKey(pEnt.dwPid) then
|
|
Result.hMainWnd := DcApp_[pEnt.dwPid].hMain;
|
|
|
|
// Result.sEmpNo := gMgSvc.EmpNo; // 이름 변경되게 하면... 불안하다..
|
|
// Result.sDeptName := ExtrLastDelimiterStr(ModePolicy.DeptName, ';');
|
|
if NotUseDRM then
|
|
begin
|
|
Result.DrmAccessKind := dakNone;
|
|
Result.DrmModifyKind := dakNone;
|
|
end else begin
|
|
Result.DrmAccessKind := DrmAccessKind;
|
|
Result.DrmModifyKind := DrmModifyKind;
|
|
end;
|
|
// if gClient <> nil then
|
|
// Result.hTagWnd := gClient.GetSelfWnd
|
|
// else
|
|
// Result.hTagWnd := 0;
|
|
Result.bDrmAttachAble := bDrmAttachAble;
|
|
Result.sIpAddr := gMgSvc.NicService.GetIP;
|
|
if PrintAppList_.IndexOf(pEnt.sPName) <> -1 then
|
|
begin
|
|
Result.bPrintSecu := bPrintSecu;
|
|
Result.bPrintWater := bPrintWater;
|
|
Result.bPrtCollect := bPrtCollect;
|
|
// Result.bPrintWaterExp := bprin
|
|
Result.bIsTest := true; // gMgSvc.IsHecDev; // todo : 정리 필요 23_1025 16:35:50 kku
|
|
if Result.bPrintWater then
|
|
begin
|
|
if IsHD then
|
|
Result.sPrintWaterExp := 'Adobe|' + sWaterExcepts // Adobe PDF Converter에서 워터마크 문제 발생 23_1220 10:34:40 kku
|
|
else
|
|
Result.sPrintWaterExp := sWaterExcepts;
|
|
end;
|
|
end;
|
|
|
|
if WebAppList_.IndexOf(pEnt.sPName) <> -1 then
|
|
begin
|
|
// 크롬, 엣지 등에서는 백그라운드 프로세스 때문에 꼬여서 제대로 동작하지 않는다..
|
|
// ThdWebUrl.pas 에서 처리 하도록 보완 25_0324 11:08:24 kku
|
|
// if Result.hMainWnd <> 0 then
|
|
// begin
|
|
// if ModePolicy.CaptureBlockUrlKind = bkAll then
|
|
// begin
|
|
// Result.hCltWnd := Result.hMainWnd;
|
|
// SendWndCaptureBlock(pEnt.hPipe, Result.hMainWnd, true);
|
|
// end else
|
|
// SendWndCaptureBlock(pEnt.hPipe, Result.hMainWnd, false);
|
|
// end else
|
|
// _Trace('WB : Not found main window', 4);
|
|
|
|
if (Result.hMainWnd <> 0) and
|
|
(PO.CaptureBlockUrlKind = bkNone) then
|
|
begin
|
|
pEnt.bCapBlock := false;
|
|
Result.hCltWnd := 0;
|
|
SendWndCaptureBlock(pEnt.hPipe, Result.hMainWnd, false);
|
|
end;
|
|
|
|
if PO.WebbAB.Kind <> abkNone then
|
|
begin
|
|
case PO.WebbAB.Kind of
|
|
abkNone : ;
|
|
abkBlock : Result.FileUseBlock := fubBlock;
|
|
// abkPopup,
|
|
abkLog : Result.FileUseBlock := fubMonitor;
|
|
abkUrlBlock,
|
|
abkUrlAllow :
|
|
begin
|
|
Result.FileUseBlock := fubBlock;
|
|
Result.bCheckUrl := true;
|
|
end;
|
|
end;
|
|
|
|
if Result.FileUseBlock <> fubNone then
|
|
begin
|
|
if not gMgSvc.IsNewApi and
|
|
(PO.WebbAB.Kind <> abkBlock) and
|
|
not PO.WebbAB.bPopup then
|
|
Result.FileUseBlock := fubMonitor;
|
|
|
|
Result.bUseContentFilter := PO.WebbAB.ContentFilter.bActive;
|
|
Result.bReadBlock := PO.WebbAB.bReadBlock;
|
|
Result.bWriteBlock := PO.WebbAB.bWriteBlock;
|
|
Result.nBlockSizeMB := WebFileBlockMB;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
// 아웃룩 첨부 차단은 후킹으로 사용하지 않음 24_0829 16:19:48 kku
|
|
// if (ModePolicy.OutlookAB.Kind <> abkNone) and (CompareText('Outlook.exe', pEnt.sPName) = 0) then
|
|
// begin
|
|
// case ModePolicy.OutlookAB.Kind of
|
|
// abkNone : Result.FileUseBlock := fubNone;
|
|
// abkBlock : Result.FileUseBlock := fubBlock;
|
|
//// abkPopup,
|
|
// abkLog :
|
|
// begin
|
|
// if IsOutlookABMonitorHook then
|
|
// Result.FileUseBlock := fubMonitor
|
|
// else
|
|
// Result.FileUseBlock := fubNone;//Result.FileUseBlock := fubMonitor; // 플러그인에서 처리하도록 한다 24_0326 15:09:10 kku
|
|
// end;
|
|
// end;
|
|
//
|
|
// if Result.FileUseBlock <> fubNone then
|
|
// begin
|
|
// Result.bUseContentFilter := ModePolicy.OutlookAB.ContentFilter.bActive;
|
|
// Result.bReadBlock := ModePolicy.OutlookAB.bReadBlock;
|
|
// Result.bWriteBlock := ModePolicy.OutlookAB.bWriteBlock;
|
|
// Result.nBlockSizeMB := OutFileBlockMB;
|
|
// end;
|
|
// end;
|
|
|
|
if (PO.EtcAB.Kind <> abkNone) and (sEtcABApps <> '') then
|
|
begin
|
|
Guard(StrList, TStringList.Create);
|
|
StrList.CaseSensitive := false;
|
|
SplitString(sEtcABApps, '|', StrList);
|
|
if (StrList.IndexOf(pEnt.sPName) <> -1) or (TgAppExList_.IndexOf(pEnt.sPName) <> -1) then
|
|
begin
|
|
case PO.EtcAB.Kind of
|
|
abkNone : ;
|
|
abkBlock : Result.FileUseBlock := fubBlock;
|
|
// abkPopup,
|
|
abkLog : Result.FileUseBlock := fubMonitor;
|
|
end;
|
|
|
|
if (Result.FileUseBlock = fubBlock) and
|
|
(Pos(UpperCase(pEnt.sPName), UpperCase(PO.EtcAbLogList)) > 0) then
|
|
Result.FileUseBlock := fubMonitor;
|
|
|
|
if Result.FileUseBlock <> fubNone then
|
|
begin
|
|
Result.bUseContentFilter := PO.EtcAB.ContentFilter.bActive;
|
|
Result.bReadBlock := PO.EtcAB.bReadBlock;
|
|
Result.bWriteBlock := PO.EtcAB.bWriteBlock;
|
|
Result.nBlockSizeMB := AppFileBlockMB;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
// 화면 캡쳐방지 프로그램 적용 추가 23_0327 14:38:41 kku
|
|
if bCaptureBlockApps and (CaptureBlockApps_.IndexOf(pEnt.sPName) <> -1) and DcApp_.ContainsKey(pEnt.dwPid) then
|
|
Result.hCltWnd := DcApp_[pEnt.dwPid].hMain
|
|
else
|
|
Result.hCltWnd := 0;
|
|
|
|
// {$IFDEF DEBUG}
|
|
// PrtWaterCfg.bActive := true;
|
|
// PrtWaterCfg.sTopText := 'top';
|
|
// PrtWaterCfg.sBotText := 'bottom';
|
|
// PrtWaterCfg.nTopSize := 20;
|
|
// PrtWaterCfg.nBotSize := 20;
|
|
// PrtWaterCfg.nTopPos := 2;
|
|
// PrtWaterCfg.nBotPos := 2;
|
|
// {$ENDIF}
|
|
Result.PrtWaterCfg := PrtWaterCfg;
|
|
Result.ShFileCrMon := ShFileCrMon;
|
|
|
|
// MTP 읽기만 기능 추가 24_0304 15:02:28 kku
|
|
Result.bMtpWB := (PO.MtpBlockKind = ubkReadOnly) and (CompareText('explorer.exe', pEnt.sPName) = 0);
|
|
Result.sMtpRoExp := MtpRoExp;
|
|
Result.bFileApproval := bFileApproval;
|
|
Result.bIgrNetPathAB := bIgrNetPathAB;
|
|
Result.bOpenDetect := bOpenDetect;
|
|
// if IsPrintWaterBoth and not IsPrintWaterHookForce then
|
|
// Result.sPrintWaterImg := '*HB*|' + PrtNameH
|
|
// else
|
|
Result.sPrintWaterImg := '' ;
|
|
Result.IntBtBlockNewFile := IntBtBlockNewFile;
|
|
Result.IntUsbBlockNewFile := IntUsbBlockNewFile;
|
|
Result.IntUsbToUsbBlockNewFile := IntUsbToUsbBlockNewFile;
|
|
Result.IntCdromBlockNewFile := IntCdromBlockNewFile;
|
|
Result.IntMtpBlockNewFile := IntMtpBlockNewFile;
|
|
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. GetCtrlOpt()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.OnSendCtrlOpt(pEnt: PCMEnt);
|
|
var
|
|
Send: ISendPacket;
|
|
Opt: TAppCtrlOpt;
|
|
bOldCapBlock: Boolean;
|
|
begin
|
|
try
|
|
AddPid(pEnt.dwPid);
|
|
|
|
bOldCapBlock := pEnt.bCapBlock;
|
|
Opt := GetCtrlOpt(pEnt);
|
|
pEnt.bCapBlock := Opt.hCltWnd <> 0;
|
|
|
|
if pEnt.bCapBlock <> bOldCapBlock then
|
|
begin
|
|
if pEnt.bCapBlock then
|
|
gMgSvc.SendEventLog(URI_USER_ACTION, PREVENT_CAPTURE_WINDOW, pEnt.sPName)
|
|
else
|
|
gMgSvc.SendEventLog(URI_USER_ACTION, RELEASE_CAPTURE_WINDOW, pEnt.sPName);
|
|
end;
|
|
|
|
Send := TTgPacket.Create(ACC_SET_POLICY);
|
|
Send.Toss := pEnt.hPipe;
|
|
Send.O['Opt'] := TTgJson.ValueToJsonObject<TAppCtrlOpt>(Opt);
|
|
Server_.SendPacket(Send);
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. OnSendCtrlOpt()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.OnAppNotify(aSender: TThdProcessWatch; pEnt: PPwEnt; aKind: TProcessWatchKind);
|
|
var
|
|
nIdx: Integer;
|
|
pApp: PAppInfoEnt;
|
|
sPPName: String;
|
|
begin
|
|
case aKind of
|
|
pwkUnknown : {$IFDEF DEBUG} ASSERT(false) {$ENDIF};
|
|
pwkInit,
|
|
pwkExecute :
|
|
begin
|
|
sPPName:= GetProcessNameByPid(pEnt.dwPPid);
|
|
if DrmAppList_.IndexOf(pEnt.sPName) <> -1 then
|
|
begin
|
|
if bUse_madCodeHook_ then
|
|
exit;
|
|
|
|
if NotUseDRM then
|
|
exit;
|
|
|
|
if DrmAccessKind = dakNone then // 열람 권한 없으면 무시 23_0503 08:06:03 kku
|
|
exit;
|
|
|
|
if (CompareText('excel.exe', pEnt.sPName) = 0) or
|
|
(CompareText('WINWORD.exe', pEnt.sPName) = 0) or
|
|
(CompareText('POWERPNT.exe', pEnt.sPName) = 0) then
|
|
begin
|
|
// 파워포인트등 외부 객체로 불러오는 경우 무시한다 (중소기업중앙회) 24_0503 09:22:23 kku
|
|
// 워드, 파워포인트에서 엑셀 차트 삽입할때도 무시 25_0723 17:37:27 kku
|
|
// 객체불로오기 일경우 아래의 부모프로세스로 부터 실행 되서 Hang 걸리는 현상 발생 (에스오에스랩) 251215 mgkim
|
|
if (CompareText('svchost.exe', sPPName) = 0) or
|
|
(CompareText('WINWORD.EXE', sPPName) = 0) or
|
|
(CompareText('POWERPNT.EXE', sPPName) = 0) or
|
|
(CompareText('excel.EXE', sPPName) = 0) then
|
|
begin
|
|
_Trace('InjectModule(2) ..object doc PName="%s", PID=%d, sPPName="%s"', [pEnt.sPName, pEnt.dwPid, sPPName], 3);
|
|
exit;
|
|
end;
|
|
end;
|
|
end else
|
|
if TgAppExList_.IndexOf(pEnt.sPName) = -1 then
|
|
exit;
|
|
|
|
if CompareText(pEnt.sPName, 'MSEDGEWEBVIEW2.EXE') = 0 then
|
|
begin
|
|
if sPPName = '' then
|
|
exit;
|
|
|
|
if (CompareText(sPPName, 'OLK.EXE') <> 0) and (CompareText(sPPName, 'MS-TEAMS.EXE') <> 0) then
|
|
exit;
|
|
|
|
if (CompareText(sPPName, 'MS-TEAMS.EXE') = 0) and not IsTgApp('MS-TEAMS.EXE') then
|
|
exit;
|
|
|
|
if (CompareText(sPPName, 'OLK.EXE') = 0) and not IsTgApp('OLK.EXE') then
|
|
exit;
|
|
end;
|
|
|
|
// if IsAcrobat(pEnt.sPName) then // 이거만 따로 처리 했는데 다시 원복. 나중에 안정화 확인 시 삭제 필요 25_1215 17:30:18 kku
|
|
// begin
|
|
// if InjectModule(pEnt.dwPid, sDllPathPdf_, @bIsWow64_) > 0 then
|
|
// begin
|
|
// _Trace('InjectModule(2) .. PName="%s", PID=%d', [pEnt.sPName, pEnt.dwPid], 3);
|
|
// end else begin
|
|
// if FileExists(sHlpExe_) then
|
|
// begin
|
|
// ExecutePath(sHlpExe_, Format('-hook2 %d', [pEnt.dwPid]));
|
|
// _Trace('InjectModule32(2) .. PName="%s", PID=%d', [pEnt.sPName, pEnt.dwPid], 3);
|
|
// end;
|
|
// end;
|
|
// end else
|
|
begin
|
|
if InjectModule(pEnt.dwPid, sDllPath_, @bIsWow64_) > 0 then
|
|
begin
|
|
//부모프로세스정보도 확인할 수 있게 로그 추가251215 mgkim
|
|
_Trace('InjectModule() .. PName="%s", PID=%d, sPPName="%s"', [pEnt.sPName, pEnt.dwPid, sPPName], 3);
|
|
//_Trace('InjectModule() .. PName="%s", PID=%d', [pEnt.sPName, pEnt.dwPid], 3);
|
|
end else begin
|
|
// Sleep(500);
|
|
if FileExists(sHlpExe_) then
|
|
begin
|
|
// ExecuteAppWaitUntilTerminate(sHlpExe, Format('-hook %d', [pEnt.dwPid]), 5000);
|
|
ExecutePath(sHlpExe_, Format('-hook %d', [pEnt.dwPid]));
|
|
_Trace('InjectModule32() .. PName="%s", PID=%d', [pEnt.sPName, pEnt.dwPid], 3);
|
|
end;
|
|
// _Trace('Fail .. InjectModule() .. PName="%s"', [pEnt.sPName], 3);
|
|
end;
|
|
end;
|
|
|
|
AddPid(pEnt.dwPid);
|
|
|
|
if not DcApp_.ContainsKey(pEnt.dwPid) then
|
|
begin
|
|
New(pApp);
|
|
pApp.dwPid := pEnt.dwPid;
|
|
pApp.hMain := 0;
|
|
DcApp_.Add(pEnt.dwPid, pApp);
|
|
end;
|
|
end;
|
|
pwkTerminated :
|
|
begin
|
|
DelPid(pEnt.dwPid);
|
|
|
|
if DcApp_.ContainsKey(pEnt.dwPid) then
|
|
DcApp_.Remove(pEnt.dwPid);
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.OnWndNotify(aSender: TObject; hActiveWnd: HWND);
|
|
var
|
|
dwPid: DWORD;
|
|
sPName: String;
|
|
pEnt: PProcessEntInfo;
|
|
StrList: TStringList;
|
|
pApp: PAppInfoEnt;
|
|
ArchKind: TExeArchitectKind;
|
|
|
|
procedure ProcessNextWork;
|
|
var
|
|
pCEnt: PCMEnt;
|
|
begin
|
|
if DcApp_.ContainsKey(pEnt.dwPid) then
|
|
begin
|
|
pApp := DcApp_[pEnt.dwPid];
|
|
// DRM 처리 프로세스는 여기로 옮 23_0327 15:21:22 kku
|
|
if pApp.hMain = 0 then
|
|
begin
|
|
pApp.hMain := hActiveWnd;
|
|
pCEnt := Server_.GetCMEEntByPID(pEnt.dwPid);
|
|
if pCEnt <> nil then
|
|
OnSendCtrlOpt(pCEnt);
|
|
end else
|
|
if pApp.hMain <> hActiveWnd then
|
|
begin
|
|
pCEnt := Server_.GetCMEEntByPID(pEnt.dwPid);
|
|
if (pCEnt <> nil) and pCEnt.bCapBlock then
|
|
begin
|
|
// 캡처 방지. 추가된 윈도우 처리 23_0511 10:17:08 kku
|
|
SendWndCaptureBlock(pCEnt.hPipe, hActiveWnd, true);
|
|
end;
|
|
end;
|
|
end else begin
|
|
New(pApp);
|
|
pApp.dwPid := pEnt.dwPid;
|
|
pApp.hMain := hActiveWnd;
|
|
DcApp_.Add(pEnt.dwPid, pApp);
|
|
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
// 뒤늣게 핸들이 구해지고 캡쳐 방지 상태면...
|
|
pCEnt := Server_.GetCMEEntByPID(dwPid);
|
|
if pCEnt <> nil then
|
|
begin
|
|
pCEnt.bCapBlock := bCaptureBlockApps and (CaptureBlockApps_.IndexOf(pCEnt.sPName) <> -1);
|
|
if pCEnt.bCapBlock then
|
|
SendWndCaptureBlock(pCEnt.hPipe, hActiveWnd, pCEnt.bCapBlock); // 많이 버벅여서 차단할때만 수행하는걸로
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
|
|
function Injecttion_madCodeHook(dwPid: DWORD; sDllPath: String): Boolean;
|
|
var
|
|
hProcess: THandle;
|
|
begin
|
|
Result := false;
|
|
|
|
hProcess := OpenProcess(PROCESS_ALL_ACCESS, false, dwPid);
|
|
if hProcess <> 0 then
|
|
begin
|
|
Result := InjectLibraryW(PChar(sDllPath), hProcess);
|
|
CloseHandle(hProcess);
|
|
end;
|
|
end;
|
|
|
|
begin
|
|
try
|
|
dwPid := GetProcessPIDFromWndHandle(hActiveWnd);
|
|
if dwPid = 0 then
|
|
exit;
|
|
|
|
if HasPid(dwPid) then
|
|
begin
|
|
pEnt := ProcList_.GetProcInfoByPid(dwPid);
|
|
if pEnt <> nil then
|
|
ProcessNextWork;
|
|
exit;
|
|
end;
|
|
|
|
ProcList_.UpdateProcessList;
|
|
pEnt := ProcList_.GetProcInfoByPid(dwPid);
|
|
if pEnt <> nil then
|
|
begin
|
|
sPName := ExtractFileName(pEnt.sModuleFileName);
|
|
if bUse_madCodeHook_ and IsTgApp_mad(sPName) then
|
|
exit;
|
|
|
|
if not IsTgApp(sPName) then
|
|
begin
|
|
// AddPid(dwPid);
|
|
exit;
|
|
end;
|
|
|
|
// if ForceDirectories(sTaskDir_) then
|
|
// begin
|
|
// var sPath: String := sTaskDir_ + 'vokee.$inf';
|
|
// if FileExists(sPath) then
|
|
// DeleteFile(PChar(sPath));
|
|
// Guard(StrList, TStringList.Create);
|
|
// StrList.Add(IntToStr(dwPid));
|
|
// StrList.Add(IntToStr(hActiveWnd));
|
|
// StrList.SaveToFile(sPath);
|
|
// end;
|
|
|
|
if CompareText('BizboxAMessenger.exe', sPName) = 0 then
|
|
begin
|
|
// 더존 메신저는 32비트 ProgramFiles에 설치되어 있고,
|
|
// ArchKind 값도 eak32 확인되는데... 64bit DLL을 붙여야 동작한다 25_1015 13:58:28 kku
|
|
ArchKind := eak64;
|
|
end else
|
|
ArchKind := GetExeFileArchitectFromePath(pEnt.sModuleFileName);
|
|
|
|
case ArchKind of
|
|
eakNoExe :
|
|
begin
|
|
// if IsAcrobat(sPName) then // 이거만 따로 처리 했는데 다시 원복. 나중에 안정화 확인 시 삭제 필요 25_1215 17:30:18 kku
|
|
// begin
|
|
// if InjectModule(dwPid, sDllPathPdf_, @bIsWow64_) > 0 then
|
|
// begin
|
|
// _Trace('InjectModule(2) .. PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
// AddPid(dwPid);
|
|
// end else begin
|
|
// if FileExists(sHlpExe_) then
|
|
// begin
|
|
// _Trace('InjectModule32(2) .. PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
// ExecutePath(sHlpExe_, Format('-hook2 %d', [dwPid]));
|
|
// AddPid(dwPid);
|
|
// end;
|
|
// _Trace('Fail .. InjectModule(2) .. PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
// end;
|
|
// end else
|
|
begin
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
if Injecttion_madCodeHook(dwPid, sDllPath_) then
|
|
begin
|
|
_Trace('InjectModule(mh) .... PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end else
|
|
if Injecttion_madCodeHook(dwPid, sDll32Path_) then
|
|
begin
|
|
_Trace('InjectModule32(mh) .... PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end;
|
|
end else begin
|
|
if InjectModule(dwPid, sDllPath_, @bIsWow64_) > 0 then
|
|
begin
|
|
_Trace('InjectModule() .. PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end else begin
|
|
if FileExists(sHlpExe_) then
|
|
begin
|
|
_Trace('InjectModule32() .. PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
ExecutePath(sHlpExe_, Format('-hook %d', [dwPid]));
|
|
AddPid(dwPid);
|
|
end;
|
|
_Trace('Fail .. InjectModule() .. PName="%s", PID=%d .. 1', [sPName, dwPid], 3);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
eak32 :
|
|
begin
|
|
if (IsUseEncOnlyAIP or gMgSvc.FirstAip) and (CompareText(sPName, 'MSIP.Viewer.exe') = 0) then
|
|
begin
|
|
// 얘는 왜 64bit인데 32로 잡히는지... 23_1019 15:23:07 kku
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
if Injecttion_madCodeHook(dwPid, sDllPath_) then
|
|
begin
|
|
_Trace('InjectModule(mh) .... PName="%s", PID=%d .. 2', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end;
|
|
end else begin
|
|
if InjectModule(dwPid, sDllPath_, @bIsWow64_) > 0 then
|
|
begin
|
|
_Trace('InjectModule() .... PName="%s", PID=%d .. 2', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end;
|
|
end;
|
|
end else
|
|
if FileExists(sHlpExe_) then
|
|
begin
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
if Injecttion_madCodeHook(dwPid, sDll32Path_) then
|
|
begin
|
|
_Trace('InjectModule32(mh) .... PName="%s", PID=%d .. 2', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end;
|
|
end else begin
|
|
if IsAcrobat(sPName) then
|
|
begin
|
|
_Trace('InjectModule32(2) ... PName="%s", PID=%d .. 2', [sPName, dwPid], 3);
|
|
ExecutePath(sHlpExe_, Format('-hook2 %d', [dwPid]));
|
|
end else begin
|
|
//_Trace('InjectModule32() ... PName="%s", PID=%d .. 2', [sPName, dwPid], 3);
|
|
ExecutePath(sHlpExe_, Format('-hook %d', [dwPid]));
|
|
end;
|
|
AddPid(dwPid);
|
|
end;
|
|
end;
|
|
// else
|
|
// _Trace('Fail .. Not found exe .. HlpExe="%s"', [sHlpExe_]);
|
|
end;
|
|
eak64 :
|
|
begin
|
|
// if IsAcrobat(sPName) then // 이거만 따로 처리 했는데 다시 원복. 나중에 안정화 확인 시 삭제 필요 25_1215 17:30:18 kku
|
|
// begin
|
|
// if InjectModule(dwPid, sDllPathPdf_, @bIsWow64_) >0 then
|
|
// begin
|
|
// _Trace('InjectModule(2) .. PName="%s", PID=%d .. 3', [sPName, dwPid], 3);
|
|
// AddPid(dwPid);
|
|
// end;
|
|
// end else
|
|
begin
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
if Injecttion_madCodeHook(dwPid, sDllPath_) then
|
|
begin
|
|
_Trace('InjectModule(mh) .... PName="%s", PID=%d .. 3', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end;
|
|
end else begin
|
|
if InjectModule(dwPid, sDllPath_, @bIsWow64_) >0 then
|
|
begin
|
|
_Trace('InjectModule() .. PName="%s", PID=%d .. 3', [sPName, dwPid], 3);
|
|
AddPid(dwPid);
|
|
end;
|
|
end;
|
|
end;
|
|
end;
|
|
// else
|
|
// _Trace('Fail .. InjectModule() ... PName="%s"', [sPName]);
|
|
end;
|
|
|
|
ProcessNextWork;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. OnWndNotify()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.FreeMon;
|
|
begin
|
|
try
|
|
if ThdAppMon_ <> nil then
|
|
begin
|
|
ThdAppMon_.OnProcessWatchNotify := nil;
|
|
FreeAndNil(ThdAppMon_);
|
|
end;
|
|
|
|
if ThdWndMon_ <> nil then
|
|
begin
|
|
ThdWndMon_.OnActiveWndNotify := nil;
|
|
FreeAndNil(ThdWndMon_);
|
|
end;
|
|
|
|
PidList_.Clear;
|
|
DcApp_.Clear;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. FreeMon()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.OnAppInfoNotify(Sender: TObject; const Item: PAppInfoEnt; Action: TCollectionNotification);
|
|
begin
|
|
if Action = cnRemoved then
|
|
Dispose(Item);
|
|
end;
|
|
|
|
procedure TManagerHook.UpdateHookTarget;
|
|
var
|
|
PPO, PO: TPrefModel;
|
|
sABApps: String;
|
|
EtcABl,
|
|
WebbABl,
|
|
OutlookABl: TAttachBlockPolicy;
|
|
enum: TEnumerator<PCMEnt>;
|
|
Send: ISendPacket;
|
|
begin
|
|
try
|
|
PPO := gMgSvc.PrefModel;
|
|
PO := gMgSvc.ModePolicy;
|
|
DrmAccessKind := PO.DrmAccessKind;
|
|
DrmModifyKind := PO.DrmModifyKind;
|
|
bPrintSecu := PO.Print.PrintKind <> pkNone;
|
|
bPrtCollect := IsPrintWaterHook and (PO.IsPrtCollectThum or IsApproveSupport);
|
|
// bPrintWater := (IsPrintWaterHook or not FileExists(sConfDir_ + EXE_SPL) or IsPrintWaterBoth or IsPrtSpl2Pdf ) and (ModePolicy.Print.PrintWater <> pwNone);
|
|
bPrintWater := (IsPrintWaterHook or not FileExists(sConfDir_ + EXE_SPL)) and (PO.Print.PrintWater <> pwNone);
|
|
sWaterExcepts := PO.Print.sWaterExcepts;
|
|
bDrmAttachAble := PO.IsDrmAttAble;
|
|
WebbAB := PO.WebbAB;
|
|
OutlookAB := PO.OutlookAB;
|
|
EtcAppAB := PO.EtcAB;
|
|
sEtcABApps := PO.EtcABApps + '|' + PO.EtcAbLogList;
|
|
CaptureBlockUrlKind := PO.CaptureBlockUrlKind;
|
|
CaptureBlockUrls := PO.CaptureBlockUrls;
|
|
MtpBlockKind := PO.MtpBlockKind;
|
|
MtpRoExp := PO.MtpExcept;
|
|
PrtNameH := PPO.PrtNameH;
|
|
PrtWaterCfg := PO.PrtWaterCfg;
|
|
ShFileCrMon := PO.ShFileCrMon;
|
|
bFileApproval := IsApproveSupport and PO.ExFApproval;
|
|
bIgrNetPathAB := PPO.IgrNetPathAB;
|
|
bOpenDetect := PPO.OpenDetect;
|
|
OutFileBlockMB := PO.OutFileBlockMB;
|
|
WebFileBlockMB := PO.WebFileBlockMB;
|
|
AppFileBlockMB := PO.AppFileBlockMB;
|
|
|
|
IntBtBlockNewFile := PO.IntBtBlockNewFile;
|
|
IntUsbBlockNewFile := PO.IntUsbBlockNewFile;
|
|
IntUsbToUsbBlockNewFile := PO.IntUsbToUsbBlockNewFile;
|
|
IntCdromBlockNewFile := PO.IntCdromBlockNewFile;
|
|
IntMtpBlockNewFile := PO.IntMtpBlockNewFile;
|
|
|
|
if DefHookOpt_.sTaskDir <> '' then
|
|
ForceDirectories(DefHookOpt_.sTaskDir);
|
|
|
|
// sABApps := DRM_SUPPORT_APPS + '|' + PRINT_SUPPERT_APPS;
|
|
// if IsPrintWaterHook or IsPrintWaterBoth or IsPrtSpl2Pdf then
|
|
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
sTgApps_mad_ := '';
|
|
if not NotUseDRM then
|
|
sTgApps_mad_ := DRM_SUPPORT_APPS;
|
|
|
|
sTgApps_mad_:= sTgApps_mad_ + '|FSQUIRT.exe|LINKENGKM.exe';
|
|
if IsPrintWaterHook then
|
|
begin
|
|
sABApps := sPrtWaterSupportApp_;
|
|
// if CUSTOMER_TYPE = CUSTOMER_SHCI then
|
|
// sABApps := StrsReplace(sABApps, ['excel.exe', 'winword.exe', 'POWERPNT.EXE'], ''); // madHook 적용 안되도록 빼준다.. 25_0122 19:57:16 kku
|
|
SumString(sTgApps_mad_, sABApps, '|');
|
|
end;
|
|
// if CUSTOMER_TYPE = CUSTOMER_SHCI then
|
|
// sABApps := 'EXCEL.EXE|WINWORD.EXE|POWERPNT.EXE' // 기존 방식으로 훅 되도록 여기에 추가
|
|
// else
|
|
sABApps := '';
|
|
end else
|
|
if IsPrintWaterHook then
|
|
sABApps := sPrtWaterSupportApp_
|
|
else
|
|
sABApps := '';
|
|
|
|
EtcABl := PO.EtcAB;
|
|
if (EtcABl.Kind <> abkNone) and (PO.EtcABApps <> '') then
|
|
SumString(sABApps, sEtcABApps, '|');
|
|
|
|
WebbABl := PO.WebbAB;
|
|
if (WebbABl.Kind <> abkNone) or (PO.CaptureBlockUrlKind <> bkNone) then
|
|
SumString(sABApps, WEB_BROWSERS, '|');
|
|
|
|
OutlookABl := PO.OutlookAB;
|
|
if (OutlookABl.Kind <> abkNone) and IsOutlookABMonitorHook then
|
|
SumString(sABApps, 'outlook.exe', '|');
|
|
|
|
if sCaptureBlockApps <> PO.CaptureBlockApps then
|
|
begin
|
|
sCaptureBlockApps := PO.CaptureBlockApps;
|
|
SplitString(sCaptureBlockApps, '|', CaptureBlockApps_);
|
|
end;
|
|
|
|
bCaptureBlockApps := PO.bCaptureBlockApps_;
|
|
if bCaptureBlockApps then
|
|
SumString(sABApps, sCaptureBlockApps, '|');
|
|
|
|
if (MtpBlockKind = ubkReadOnly) or
|
|
(ShFileCrMon.nKind <> 0) or
|
|
(IntUsbBlockNewFile.mode <> abkNone) or
|
|
(IntMtpBlockNewFile.mode <> abkNone) or
|
|
(IntCdromBlockNewFile.mode <> abkNone) then
|
|
SumString(sABApps, 'explorer.exe', '|');
|
|
|
|
_Trace(Format(' sABApps .. [%s]', [sABApps]), 1);
|
|
|
|
if sABApps <> sTgApps_ then
|
|
begin
|
|
TgAppExList_.Clear;
|
|
sTgApps_ := sABApps;
|
|
SplitString(sTgApps_, '|', TgAppList_, false, true);
|
|
SplitString(sTgApps_mad_, '|', TgAppList_mad_, false, true);
|
|
|
|
if CUSTOMER_TYPE = CUSTOMER_KBIZ then
|
|
DelTgApp('excel.exe');
|
|
|
|
// iexplore.exe는 Injection 하지 않음. 25_0808 13:20:16 kku
|
|
// 신한신용정보에서 iexplore.exe 을 Injection 하면 인트라넷망 로그인할때 인증 실패 현상 확인됨
|
|
DelTgApp('iexplore.exe');
|
|
|
|
DelTgApp('msedgewebview2.exe');
|
|
|
|
if (TgAppList_.IndexOf('olk.exe') <> -1) or (TgAppList_.IndexOf('ms-teams.exe') <> -1) then
|
|
TgAppExList_.Add('msedgewebview2.exe');
|
|
|
|
var i: Integer;
|
|
var sPName: String;
|
|
for i := TgAppList_.Count - 1 downto 0 do
|
|
if (TgAppList_[i].Length > 0) and (TgAppList_[i][1] = '*') then
|
|
begin
|
|
sPName := TgAppList_[i];
|
|
TgAppList_.Delete(i);
|
|
Delete(sPName, 1, 1);
|
|
if TgAppExList_.IndexOf(sPName) = -1 then
|
|
TgAppExList_.Add(sPName);
|
|
end;
|
|
end;
|
|
|
|
{$IFDEF _HOOK_TEST_}
|
|
TgAppList_.Clear;
|
|
TgAppList_.Add('msedge.exe');
|
|
{$ENDIF}
|
|
|
|
if Server_ <> nil then
|
|
begin
|
|
Guard(enum, Server_.GetCMEntEnumrator);
|
|
while enum.MoveNext do
|
|
begin
|
|
Send := TTgPacket.Create(ACC_SET_POLICY);
|
|
Send.Toss := enum.Current.hPipe;
|
|
Send.O['Opt'] := TTgJson.ValueToJsonObject<TAppCtrlOpt>(GetCtrlOpt(enum.Current));
|
|
Server_.SendPacket(Send);
|
|
end;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. UpdateHookTarget()');
|
|
end;
|
|
end;
|
|
|
|
procedure MadHookIpcMessageCallback(name: PAnsiChar; messageBuf: pointer; messageLen: dword; answerBuf: pointer; answerLen: dword; context: pointer); stdcall;
|
|
var
|
|
buf: string;
|
|
begin
|
|
SetString(buf, PAnsiChar(messageBuf), messageLen);
|
|
TTgTrace.T('[MH] %s', [buf], 1);
|
|
end;
|
|
|
|
procedure TManagerHook.Start_madCodeHookInjection;
|
|
var
|
|
bSuccess: Boolean;
|
|
sConfDir,
|
|
sDataDir: String;
|
|
begin
|
|
try
|
|
bSuccess := false;
|
|
try
|
|
if sTgApps_mad_ = '' then
|
|
begin
|
|
_Trace('Start_madCodeHookInjection() .. Fail .. GlobalHook 대상 프로세스를 찾을 수 없음 ..', 1);
|
|
exit;
|
|
end;
|
|
|
|
mtx_madCode_ := TTgMutex.Create(MUTEX_MH);
|
|
if mtx_madCode_.MutexState = msCreateOk then
|
|
begin
|
|
// if not CreateIpcQueue(PAnsiChar(BS1HOOK_IPCMESSAGE_STRING), MadHookIpcMessageCallback) then
|
|
// begin
|
|
// _Trace('[BS1HOOK] please don''t start me twice');
|
|
// exit;
|
|
// end;
|
|
|
|
if not LoadInjectionDriver(BS1HOOK_DRIVERTAG, BS1HOOK_DRIVERNAME32, BS1HOOK_DRIVERNAME64) then
|
|
begin
|
|
_Trace(Format('[BS1HOOK] loading driver failed error....(%d)', [GetLastError]));
|
|
DVLOG('loading driver failed error....(%d)', [GetLastError]);
|
|
end
|
|
else
|
|
begin
|
|
DVLOG(' %s loading driver success', [BS1HOOK_DRIVERTAG]);
|
|
end;
|
|
|
|
sConfDir := GetRunExePathDir + DIR_CONF;
|
|
{$IFDEF DEBUG}
|
|
sDataDir := sConfDir;
|
|
{$ELSE}
|
|
sDataDir := sConfDir[1] + ':\ProgramData\Tocsg\bs1\';
|
|
if not ForceDirectories(sDataDir) then
|
|
begin
|
|
_Trace('[BS1HOOK] Fail .. createDir');
|
|
exit;
|
|
end;
|
|
|
|
if not FileExists(sDataDir + DLL_HOOK32) then
|
|
begin
|
|
if not CopyFile(PChar(sConfDir + DLL_HOOK32), PChar(sDataDir + DLL_HOOK32), false) then
|
|
begin
|
|
_Trace('[BS1HOOK] Fail .. copyFile(1)');
|
|
DVLOG('Fail .. copyFile(1)....(%d)', [GetLastError]);
|
|
exit;
|
|
end
|
|
else
|
|
begin
|
|
DVLOG('copyFile(1)....ok', []);
|
|
end;
|
|
end;
|
|
|
|
if not FileExists(sDataDir + DLL_HOOK) then
|
|
begin
|
|
if not CopyFile(PChar(sConfDir + DLL_HOOK), PChar(sDataDir + DLL_HOOK), false) then
|
|
begin
|
|
_Trace('[BS1HOOK] Fail .. copyFile(2)');
|
|
DVLOG('Fail .. copyFile(2)....(%d)', [GetLastError]);
|
|
exit;
|
|
end
|
|
else
|
|
begin
|
|
DVLOG('copyFile(2)....ok', []);
|
|
end;
|
|
end;
|
|
|
|
if not FileExists(sDataDir + 'CI.bmp') and FileExists(sConfDir + 'CI.bmp') then
|
|
begin
|
|
if not CopyFile(PChar(sConfDir + 'CI.bmp'), PChar(sDataDir + 'CI.bmp'), false) then
|
|
begin
|
|
_Trace('[BS1HOOK] Fail .. copyFile(3)');
|
|
// exit;
|
|
end;
|
|
end;
|
|
{$ENDIF}
|
|
|
|
// if not InjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sDataDir + DLL_HOOK32), ALL_SESSIONS, INJECT_METRO_APPS, PChar(sTgApps_mad_), 'bds.exe|WinDbgX.exe|Dbgview.exe|werfault.exe|RuntimeBroker.exe|SystemSettings.exe') then
|
|
if not InjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sDataDir + DLL_HOOK32), ALL_SESSIONS, INJECT_METRO_APPS, PChar(sTgApps_mad_), nil) then
|
|
begin
|
|
_Trace(Format('[BS1HOOK] InjectLibrary fail DLL_NAME32 INJECT_METRO_APPS...(%d)', [GetLastError]));
|
|
exit;
|
|
end;
|
|
// if not InjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sDataDir + DLL_HOOK), ALL_SESSIONS, INJECT_METRO_APPS, PChar(sTgApps_mad_), EXE_HE + '|bds.exe|AppCtrl.exe|ShellExperienceHost.exe|backgroundTaskHost.exe|WinDbgX.exe|Dbgview.exe|werfault.exe|RuntimeBroker.exe|SystemSettings.exe') then
|
|
if not InjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sDataDir + DLL_HOOK), ALL_SESSIONS, INJECT_METRO_APPS, PChar(sTgApps_mad_), nil) then
|
|
begin
|
|
_Trace(Format('[BS1HOOK] InjectLibrary fail DLL_NAME64 INJECT_METRO_APPS...(%d)', [GetLastError]));
|
|
exit;
|
|
end;
|
|
bSuccess := true;
|
|
end;
|
|
finally
|
|
if not bSuccess then
|
|
begin
|
|
// DestroyIpcQueue(PAnsiChar(BS1HOOK_IPCMESSAGE_STRING));
|
|
if mtx_madCode_ <> nil then
|
|
FreeAndNil(mtx_madCode_);
|
|
_Trace('GlobalHook .. Fail', 1);
|
|
end else
|
|
_Trace('GlobalHook .. OK', 1)
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. Start_madCodeHookInjection()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.Stop_madCodeHookInjection;
|
|
var
|
|
sConfDir: String;
|
|
begin
|
|
try
|
|
if mtx_madCode_ <> nil then
|
|
begin
|
|
sConfDir := GetRunExePathDir + DIR_CONF;
|
|
// UninjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sConfDir + DLL_HOOK), ALL_SESSIONS, INJECT_METRO_APPS, 'notepad++.exe', EXE_HE + '|ShellExperienceHost.exe|backgroundTaskHost.exe|Taskmgr.exe|SystemInformer.exe|dbgview.exe|werfault.exe|RuntimeBroker.exe|SystemSettings.exe');
|
|
// UninjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sConfDir + DLL_HOOK32), ALL_SESSIONS, INJECT_METRO_APPS, 'notepad++.exe', '|AppCtrl.exe|Taskmgr.exe|SystemInformer.exe|dbgview.exe|werfault.exe|RuntimeBroker.exe|SystemSettings.exe');
|
|
|
|
// UninjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sConfDir + DLL_HOOK), ALL_SESSIONS, INJECT_METRO_APPS, nil, nil);
|
|
// UninjectLibraryW(BS1HOOK_DRIVERTAG, PChar(sConfDir + DLL_HOOK32), ALL_SESSIONS, INJECT_METRO_APPS, nil, nil);
|
|
|
|
// UninjectAllLibrariesW(BS1HOOK_DRIVERTAG);
|
|
|
|
// Sleep(3000);
|
|
|
|
// Log(Format('[BS1HOOK] StopInject...1. 0', []));
|
|
// finally unload the injection driver
|
|
if not StopInjectionDriver(BS1HOOK_DRIVERTAG) then
|
|
_Trace('[BS1HOOK] stopping driver failed...');
|
|
|
|
// DestroyIpcQueue(PAnsiChar(BS1HOOK_IPCMESSAGE_STRING));
|
|
FreeAndNil(mtx_madCode_);
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. Stop_madCodeHookInjection()');
|
|
end;
|
|
end;
|
|
|
|
procedure OffExcelDDE;
|
|
var
|
|
sVal: String;
|
|
begin
|
|
sVal := UpperCase(GetRegValueAsString(HKEY_CLASSES_ROOT, 'Excel.Sheet.12\shell\Open\command', ''));
|
|
if (sVal <> '') and sVal.ToUpper.Contains('/DDE') then
|
|
begin
|
|
sVal := StrsReplace(sVal, ['/dde'], '');
|
|
if Pos('"%1"', sVal) = 0 then
|
|
sVal := Trim(sVal) + ' "%1"';
|
|
|
|
SetRegValueString(HKEY_CLASSES_ROOT, 'Excel.Sheet.12\shell\Open\command', '', sVal);
|
|
DelRegValue(HKEY_CLASSES_ROOT, 'Excel.Sheet.12\shell\Open\command', 'command'); // 삭제, ZN=BV5!!!!4!!!!MKKSKEXCELFILES>]-Z5HW$L[8QEZZR4_X=$ 요렇게 이상한값 들었음
|
|
end;
|
|
|
|
sVal := UpperCase(GetRegValueAsString(HKEY_CLASSES_ROOT, 'Excel.Sheet.8\shell\Open\command', ''));
|
|
if (sVal <> '') and sVal.ToUpper.Contains('/DDE') then
|
|
begin
|
|
sVal := StrsReplace(sVal, ['/dde'], '');
|
|
if Pos('"%1"', sVal) = 0 then
|
|
sVal := Trim(sVal) + ' "%1"';
|
|
|
|
SetRegValueString(HKEY_CLASSES_ROOT, 'Excel.Sheet.8\shell\Open\command', '', sVal);
|
|
DelRegValue(HKEY_CLASSES_ROOT, 'Excel.Sheet.8\shell\Open\command', 'command'); // 삭제, ZN=BV5!!!!4!!!!MKKSKEXCELFILES>]-Z5HW$L[8QEZZR4_X=$ 요렇게 이상한값 들었음
|
|
end;
|
|
|
|
sVal := UpperCase(GetRegValueAsString(HKEY_CLASSES_ROOT, 'Excel.CSV\shell\Open\command', ''));
|
|
if (sVal <> '') and sVal.ToUpper.Contains('/DDE') then
|
|
begin
|
|
sVal := StrsReplace(sVal, ['/dde'], '');
|
|
if Pos('"%1"', sVal) = 0 then
|
|
sVal := Trim(sVal) + ' "%1"';
|
|
|
|
SetRegValueString(HKEY_CLASSES_ROOT, 'Excel.CSV\shell\Open\command', '', sVal);
|
|
DelRegValue(HKEY_CLASSES_ROOT, 'Excel.CSV\shell\Open\command', 'command'); // 삭제, ZN=BV5!!!!4!!!!MKKSKEXCELFILES>]-Z5HW$L[8QEZZR4_X=$ 요렇게 이상한값 들었음
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.StartHookWatch;
|
|
begin
|
|
try
|
|
if Server_ = nil then
|
|
begin
|
|
ClearHook;
|
|
|
|
Server_ := TAppCtrlServer.Create(gMgSvc.RcvHwnd);
|
|
Server_.OnSendCtrlOpt := OnSendCtrlOpt;
|
|
if Server_.ActiveNp(PIPE_NAME, true) then
|
|
begin
|
|
Server_.ConnectNp;
|
|
end;
|
|
|
|
UpdateHookTarget;
|
|
UpdatePreLoadInfo;
|
|
|
|
OffExcelDDE;
|
|
if bUse_madCodeHook_ then
|
|
Start_madCodeHookInjection;
|
|
|
|
ThdAppMon_ := TThdProcessWatch.Create(false);
|
|
ThdAppMon_.OnProcessWatchNotify := OnAppNotify;
|
|
ThdAppMon_.StartThread;
|
|
|
|
ThdWndMon_ := TThdActiveWndMon.Create(false);
|
|
ThdWndMon_.OnActiveWndNotify := OnWndNotify;
|
|
ThdWndMon_.StartThread;
|
|
|
|
// SetSharedData;
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. StartHookWatch()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.ClearHook(bMore: Boolean = false);
|
|
begin
|
|
// try
|
|
// if FileExists(sHlpExe_) then
|
|
// ExecutePath_hide(sHlpExe_, '-clearhook');
|
|
//
|
|
// EjectModuleFromPath(sDllPath_ + '|' + sDllPathPdf_);
|
|
// if bMore then
|
|
// begin
|
|
// Sleep(1000);
|
|
// EjectModuleFromPath(sDllPath_ + '|' + sDllPathPdf_);
|
|
// end;
|
|
// except
|
|
// on E: Exception do
|
|
// ETgException.TraceException(Self, E, 'Fail .. ClearHook()');
|
|
// end;
|
|
end;
|
|
|
|
procedure TManagerHook.SafeFreeClient;
|
|
var
|
|
nTO: Integer;
|
|
NpClient: TTgNpClient;
|
|
begin
|
|
try
|
|
if Server_ <> nil then
|
|
begin
|
|
if Server_.CountEnt = 0 then
|
|
begin
|
|
// 음... CreatePipeInstance() 이후에 한번도 연결되지 않고 파이프를 초기화 하면
|
|
// 프로그램이 크러쉬 되는 문제가 있다...
|
|
// 그래서 최소 한번은 연결될 수 있도록 조치함...23_0412 16:56:56 kku
|
|
Guard(NpClient, TTgNpClient.Create(PIPE_NAME));
|
|
if NpClient.Connect then
|
|
begin
|
|
// NpClient.Disconnect;
|
|
end;
|
|
end;
|
|
|
|
// 안전 제거를 위해 종료를 미리 알림 23_0315 14:02:46 kku
|
|
// Server_.SendPacket(TTgPacket.Create(ACC_SAFE_TERMINATE_CLIENT));
|
|
//
|
|
// nTO := 0;
|
|
// while (Server_.CountEnt > 0) and (nTO < 10) do
|
|
// begin
|
|
// Inc(nTO);
|
|
// Sleep(500);
|
|
// Application.ProcessMessages;
|
|
// end;
|
|
|
|
FreeAndNil(Server_);
|
|
end;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. SafeFreeClient()');
|
|
end;
|
|
end;
|
|
|
|
procedure TManagerHook.StopHookWatch;
|
|
var
|
|
enum: TEnumerator<PCMEnt>;
|
|
Send: ISendPacket;
|
|
hProcess: THandle;
|
|
begin
|
|
try
|
|
FreeMon;
|
|
if bUse_madCodeHook_ then
|
|
begin
|
|
// if Server_ <> nil then
|
|
// begin
|
|
// Guard(enum, Server_.GetCMEntEnumrator);
|
|
// while enum.MoveNext do
|
|
// begin
|
|
// Send := TTgPacket.Create(ACC_GOODBYE);
|
|
// Send.Toss := enum.Current.hPipe;
|
|
// Server_.SendPacket(Send);
|
|
// end;
|
|
// Sleep(1000);
|
|
// end;
|
|
|
|
Stop_madCodeHookInjection;
|
|
|
|
if Server_ <> nil then
|
|
FreeAndNil(Server_);
|
|
end else begin
|
|
ClearHook(true);
|
|
end;
|
|
SafeFreeClient;
|
|
except
|
|
on E: Exception do
|
|
ETgException.TraceException(Self, E, 'Fail .. StopHookWatch()');
|
|
end;
|
|
end;
|
|
|
|
end.
|