OrcCommand: GetThis: add support for 'log' option

DFIR-ORC · Feb 11, 2021 · e050309 · e050309
1 parent b92174a
commit e050309
Show file tree

Hide file tree

Showing 3 changed files with 26 additions and 6 deletions.
diff --git a/src/OrcCommand/ConfigFile_GetThis.cpp b/src/OrcCommand/ConfigFile_GetThis.cpp
@@ -11,6 +11,8 @@
 // GETTHIS
 #include "ConfigFile_GetThis.h"
 
+#include "Log/UtilitiesLoggerConfiguration.h"
+
 using namespace Orc::Config::Common;
 
 HRESULT Orc::Config::GetThis::root(ConfigItem& item)
@@ -30,8 +32,11 @@ HRESULT Orc::Config::GetThis::root(ConfigItem& item)
         return hr;
     if (FAILED(hr = item.AddChild(samples, GETTHIS_SAMPLES)))
         return hr;
+    // Deprecated: for compatibility with 10.0.x (was always ignored)
     if (FAILED(hr = item.AddChild(logging, GETTHIS_LOGGING)))
         return hr;
+    if (FAILED(hr = item.AddChild(Orc::Command::UtilitiesLoggerConfiguration::Register, GETTHIS_LOG)))
+        return hr;
     if (FAILED(hr = item.AddAttribute(L"flushregistry", GETTHIS_FLUSHREGISTRY, ConfigItem::OPTION)))
         return hr;
     if (FAILED(hr = item.AddAttribute(L"nolimits", GETTHIS_NOLIMITS, ConfigItem::OPTION)))

diff --git a/src/OrcCommand/ConfigFile_GetThis.h b/src/OrcCommand/ConfigFile_GetThis.h
@@ -19,12 +19,13 @@ constexpr auto GETTHIS_LOCATION = 1L;
 constexpr auto GETTHIS_KNOWNLOCATIONS = 2L;
 constexpr auto GETTHIS_SAMPLES = 3L;
 constexpr auto GETTHIS_LOGGING = 4L;
-constexpr auto GETTHIS_FLUSHREGISTRY = 5L;
-constexpr auto GETTHIS_NOLIMITS = 6L;
-constexpr auto GETTHIS_REPORTALL = 7L;
-constexpr auto GETTHIS_HASH = 8L;
-constexpr auto GETTHIS_FUZZYHASH = 9L;
-constexpr auto GETTHIS_YARA = 10L;
+constexpr auto GETTHIS_LOG = 5L;
+constexpr auto GETTHIS_FLUSHREGISTRY = 6L;
+constexpr auto GETTHIS_NOLIMITS = 7L;
+constexpr auto GETTHIS_REPORTALL = 8L;
+constexpr auto GETTHIS_HASH = 9L;
+constexpr auto GETTHIS_FUZZYHASH = 10L;
+constexpr auto GETTHIS_YARA = 11L;
 
 constexpr auto GETTHIS_GETTHIS = 0L;
 

diff --git a/src/OrcCommand/GetThis_Config.cpp b/src/OrcCommand/GetThis_Config.cpp
@@ -101,6 +101,16 @@ HRESULT Main::GetConfigurationFromConfig(const ConfigItem& configitem)
 
     ConfigFile reader;
 
+    if (configitem[GETTHIS_LOGGING])
+    {
+        Log::Warn(L"The '<logging> configuration element is deprecated, please use '<log>' instead");
+    }
+
+    if (configitem[GETTHIS_LOG])
+    {
+        UtilitiesLoggerConfiguration::Parse(configitem[GETTHIS_LOG], m_utilitiesConfig.log);
+    }
+
     if (FAILED(
             hr = config.Output.Configure(
                 static_cast<OutputSpec::Kind>(OutputSpec::Kind::Archive | OutputSpec::Kind::Directory),
@@ -301,6 +311,8 @@ HRESULT Main::GetConfigurationFromArgcArgv(int argc, LPCWSTR argv[])
 
     try
     {
+        UtilitiesLoggerConfiguration::Parse(argc, argv, m_utilitiesConfig.log);
+
         for (int i = 0; i < argc; i++)
         {
             switch (argv[i][0])
@@ -404,6 +416,8 @@ HRESULT Main::CheckConfiguration()
 {
     HRESULT hr = E_FAIL;
 
+    UtilitiesLoggerConfiguration::Apply(m_logging, m_utilitiesConfig.log);
+
     if (boost::logic::indeterminate(config.bAddShadows))
         config.bAddShadows = false;