OrcCommand: fix partially ignored /Computer, /FullComputer, /SystemType

Related to internal [78]
DFIR-ORC · Nov 13, 2020 · 7232a64 · 7232a64
1 parent c3e893d
commit 7232a64
Show file tree

Hide file tree

Showing 3 changed files with 97 additions and 25 deletions.
diff --git a/src/OrcCommand/UtilitiesMain.cpp b/src/OrcCommand/UtilitiesMain.cpp
@@ -12,8 +12,9 @@
 #include <filesystem>
 #include <set>
 
-#include <Psapi.h>
+#include <psapi.h>
 
+#include <boost/algorithm/string/case_conv.hpp>
 #include <boost/algorithm/string/join.hpp>
 #include <boost/algorithm/string/split.hpp>
 #include <boost/algorithm/string/classification.hpp>
@@ -634,14 +635,53 @@ bool UtilitiesMain::IgnoreConfigOptions(LPCWSTR szArg)
     return false;
 }
 
+bool UtilitiesMain::IgnoreEarlyOptions(LPCWSTR szArg)
+{
+    const std::vector<std::wstring_view> kIgnoredList = {L"computer", L"fullcomputer", L"systemtype"};
+
+    std::wstring arg(szArg);
+
+    const auto pos = arg.find_first_of(L'=');
+    if (pos != std::wstring::npos)
+    {
+        arg.resize(pos);
+    }
+
+    boost::algorithm::to_lower(arg);
+
+    for (const auto& ignored : kIgnoredList)
+    {
+        if (ignored == arg)
+        {
+            return true;
+        }
+    }
+
+    return false;
+}
+
 bool UtilitiesMain::IgnoreCommonOptions(LPCWSTR szArg)
 {
     if (IgnoreWaitForDebuggerOption(szArg))
+    {
         return true;
+    }
+
     if (IgnoreConfigOptions(szArg))
+    {
         return true;
+    }
+
     if (IgnoreLoggingOptions(szArg))
+    {
         return true;
+    }
+
+    if (IgnoreEarlyOptions(szArg))
+    {
+        return true;
+    }
+
     return false;
 }
 

diff --git a/src/OrcCommand/UtilitiesMain.h b/src/OrcCommand/UtilitiesMain.h
@@ -441,7 +441,61 @@ class ORCLIB_API UtilitiesMain
     HRESULT LoadEvtLibrary();
     HRESULT LoadPSAPI();
 
-    auto Configure(int argc, const wchar_t* argv[]) { return m_logging.Configure(argc, argv); }
+    auto Configure(int argc, const wchar_t* argv[])
+    {
+        m_logging.Configure(argc, argv);
+
+        // FIX: Some arguments must be processed very early as others depends
+        // on their value. This is not a clean fix but a more global refactor is
+        // required on options handling...
+        std::wstring computerName;
+        std::wstring fullComputerName;
+        std::wstring systemType;
+
+        for (int i = 0; i < argc; i++)
+        {
+
+            switch (argv[i][0])
+            {
+                case L'/':
+                case L'-':
+                    if (ParameterOption(argv[i] + 1, L"Computer", computerName))
+                        ;
+                    else if (ParameterOption(argv[i] + 1, L"FullComputer", fullComputerName))
+                        ;
+                    else if (ParameterOption(argv[i] + 1, L"SystemType", systemType))
+                        ;
+                    break;
+                default:
+                    break;
+            }
+        }
+
+        if (computerName.empty() && !fullComputerName.empty())
+        {
+            computerName = fullComputerName;
+        }
+
+        if (fullComputerName.empty() && !computerName.empty())
+        {
+            fullComputerName = computerName;
+        }
+
+        if (!computerName.empty())
+        {
+            SystemDetails::SetOrcComputerName(computerName);
+        }
+
+        if (!fullComputerName.empty())
+        {
+            SystemDetails::SetOrcFullComputerName(fullComputerName);
+        }
+
+        if (!systemType.empty())
+        {
+            SystemDetails::SetSystemType(systemType);
+        }
+    }
 
     template <typename T>
     void PrintCommonParameters(Orc::Text::Tree<T>& root)
@@ -687,6 +741,7 @@ class ORCLIB_API UtilitiesMain
     bool IgnoreLoggingOptions(LPCWSTR szArg);
     bool IgnoreConfigOptions(LPCWSTR szArg);
     bool IgnoreCommonOptions(LPCWSTR szArg);
+    bool IgnoreEarlyOptions(LPCWSTR szArg);
 
 public:
     UtilitiesMain();

diff --git a/src/OrcCommand/WolfLauncher_Config.cpp b/src/OrcCommand/WolfLauncher_Config.cpp
@@ -436,9 +436,6 @@ HRESULT Main::GetConfigurationFromArgcArgv(int argc, LPCWSTR argv[])
         bool bDump = false;
         bool bFromDump = false;
 
-        std::wstring strComputerName;
-        std::wstring strFullComputerName;
-        std::wstring strSystemType;
         std::wstring strTags;
 
         for (int i = 0; i < argc; i++)
@@ -493,12 +490,6 @@ HRESULT Main::GetConfigurationFromArgcArgv(int argc, LPCWSTR argv[])
                         ;
                     else if (AltitudeOption(argv[i] + 1, L"Altitude", config.DefaultAltitude))
                         ;
-                    else if (ParameterOption(argv[i] + 1, L"Computer", strComputerName))
-                        ;
-                    else if (ParameterOption(argv[i] + 1, L"FullComputer", strFullComputerName))
-                        ;
-                    else if (ParameterOption(argv[i] + 1, L"SystemType", strSystemType))
-                        ;
                     else if (ParameterOption(argv[i] + 1, L"Tags", strTags))
                         ;
                     else if (ParameterOption(argv[i] + 1, L"Offline", config.strOfflineLocation))
@@ -543,20 +534,6 @@ HRESULT Main::GetConfigurationFromArgcArgv(int argc, LPCWSTR argv[])
             }
         }
 
-        if (strComputerName.empty() && !strFullComputerName.empty())
-        {
-            strComputerName = strFullComputerName;
-        }
-        if (strFullComputerName.empty() && !strComputerName.empty())
-        {
-            strFullComputerName = strComputerName;
-        }
-        if (!strComputerName.empty())
-            SystemDetails::SetOrcComputerName(strComputerName);
-        if (!strFullComputerName.empty())
-            SystemDetails::SetOrcFullComputerName(strFullComputerName);
-        if (!strSystemType.empty())
-            SystemDetails::SetSystemType(strSystemType);
         if (!strTags.empty())
         {
             using tokenizer =