WindowsDefenderFirewall/main.c
#include "common.h"

// Print help message
void printHelp(char* fileName) {
	printf("Usage: %s -e / -d \n", fileName);
	printf("Options:\n");
	printf("   -e Enable  - Block blacklisted EDR processes\n");
	printf("   -d Disable - Remove blocked firewall rules created by this tool\n");
	printf("   -h         - Display this help message\n");
}

int main(int argc, char** argv) {

	// If not enough arguments are supplied print the help function
	if (argc < 2) {
		printHelp(argv[0]);
		return EXIT_FAILURE;
	}

	if (strcmp(argv[1], "-h") == 0) {
		printHelp(argv[0]);
		return EXIT_FAILURE;
	}

	// Check if process is running in high integrity
	info("IsProcessHighIntegrity - Checking if current process is running in High Integrity");
	if (!IsProcessHighIntegrity()) {
		error("IsProcessHighIntegrity - Failed or not running in High Integrity");
		return EXIT_FAILURE;
	}
	okay("IsProcessHighIntegrity - Process running in High Integrity");
	printf("\n");

	// Check the status of the firewall
	info("CheckFirewallStatus - Checking Windows Defender Firewall status");
	if (!CheckFirewallStatus()) {
		error("CheckFirewallStatus - Windows Defender Firewall is disabled, can't block traffic if Windows Defender Firewall isn't active");
		return EXIT_FAILURE;
	}
	info("CheckFirewallStatus - Windows Defender Firewall is active");
	printf("\n");

	if (strcmp(argv[1], "-e") == 0) {
		// Call function to enable blocking of blacklisted processes using Windows Defender Firewall
		info("BlockTraffic - Blocking traffic of listed processes using Windows Defender Firewall");
		if (!BlockTraffic()) {
			error("BlockTraffic - Failed to create all firewall rules");
			return EXIT_FAILURE;
		}
		okay("BlockTraffic - All Windows Defender Firewall rules for all processes have been created");
	}
	else if (strcmp(argv[1], "-d") == 0) {
		// Call function to disable blocking of blacklisted processes, removing created rules
		infoW("UnblockTraffic - Removing all Windows Defender Firewall rules prefixed with \"%ls\"", FIREWALL_RULE_PREFIX);
		if (!UnblockTraffic()) {
			error("UnblockTraffic - Failed to delete Windows Defender Firewall rules");
			return EXIT_FAILURE;
		}
		okay("UnblockTraffic - All Windows Defender Firewall rules have been removed");
	}
	else {
		error("Unknown option: %s", argv[1]);
		printHelp(argv[0]);
		return EXIT_FAILURE;
	}

	return EXIT_SUCCESS;

}