WindowsFilteringPlatform/main.c
#include "common.h"

// Print help message
void printHelp(char* fileName) {
	wprintf(L"Usage: %s -e / -d  / --edr\n", fileName);
	wprintf(L"Options:\n");
	wprintf(L"   --edr          - Block traffic of blacklisted EDR processes\n");
	wprintf(L"   -e <PROCESS>   - Block traffic of specified process\n");
	wprintf(L"   -d             - Remove blocked firewall rules created by this tool\n");
	wprintf(L"   -h             - Display this help message\n");
}

int wmain(int argc, wchar_t** argv) {

	// If not enough arguments are supplied print the help function
	if (argc < 2) {
		printHelp(argv[0]);
		return EXIT_FAILURE;
	}

	if (_wcsicmp(argv[1], L"-h") == 0) {
		printHelp(argv[0]);
		return EXIT_FAILURE;
	}

	if (_wcsicmp(argv[1], L"--edr") == 0) {
		
		// Check if process is running in high integrity
		info("IsProcessHighIntegrity - Checking if current process is running in High Integrity");
		if (!IsProcessHighIntegrity()) {
			error("IsProcessHighIntegrity - Failed or not running in High Integrity");
			return EXIT_FAILURE;
		}
		okay("IsProcessHighIntegrity - Process running in High Integrity");
		printf("\n");
		
		// Call function to enable blocking of blacklisted processes using Windows Filtering Platform
		info("BlockEDRTraffic - Blocking traffic of listed processes using Windows Filtering Platform");
		if (!BlockEDRTraffic()) {
			error("BlockEDRTraffic - Failed to create all Windows Filtering Platform filters");
			return EXIT_FAILURE;
		}
		okay("BlockEDRTraffic - Windows Filtering Platform blocking filters for all processes have been created");

	}
	else if (_wcsicmp(argv[1], L"-e") == 0) {
		
		if (argc < 3) {
			error("Missing process name after -e");
			printHelp(argv[0]);
			return EXIT_FAILURE;
		}

		LPWSTR pwszProcessName = argv[2];
		LPWSTR pwszFullPath = NULL;

		// Check if process is running in high integrity
		info("IsProcessHighIntegrity - Checking if current process is running in High Integrity");
		if (!IsProcessHighIntegrity()) {
			error("IsProcessHighIntegrity - Failed or not running in High Integrity");
			return EXIT_FAILURE;
		}
		okay("IsProcessHighIntegrity - Process running in High Integrity");
		printf("\n");

		info("GetRemoteProcessFullPath - Retrieving full native path");
		if (!GetRemoteProcessFullPath(pwszProcessName, &pwszFullPath)) {
			error("GetRemoteProcessFullPath - Failed to get full path for process \"%ls\"", pwszProcessName);
			HeapFree(GetProcessHeap(), 0, pwszFullPath);
			return EXIT_FAILURE;
		}
		okayW("GetRemoteProcessFullPath - Retrieved full path: %s", pwszFullPath);

		// Call function to enable blocking of process using Windows Filtering Platform
		infoW("BlockTraffic - Blocking traffic of \"%ls\" using Windows Filtering Platform", pwszProcessName);
		if (!BlockTraffic(pwszProcessName, pwszFullPath)) {
			error("BlockTraffic - Failed to block process \"%ls\"", pwszProcessName);
			HeapFree(GetProcessHeap(), 0, pwszFullPath);
			return EXIT_FAILURE;
		}
		okay("BlockTraffic - Windows Filtering Platform blocking filters have been created");

		HeapFree(GetProcessHeap(), 0, pwszFullPath);

	}
	else if (_wcsicmp(argv[1], L"-d") == 0) {
		
		// Check if process is running in high integrity
		info("IsProcessHighIntegrity - Checking if current process is running in High Integrity");
		if (!IsProcessHighIntegrity()) {
			error("IsProcessHighIntegrity - Failed or not running in High Integrity");
			return EXIT_FAILURE;
		}
		okay("IsProcessHighIntegrity - Process running in High Integrity");
		printf("\n");

		// Call function to disable blocking of blacklisted processes, removing created rules
		infoW("UnblockTraffic - Removing all Windows Filtering Platform rules with custom filter name \"%ls\"", CUSTOM_FILTER_NAME);
		if (!UnblockTraffic()) {
			error("UnblockTraffic - Failed to delete Windows Filtering Platform filters");
			return EXIT_FAILURE;
		}
		okay("UnblockTraffic - Windows Filtering Platform filters have been removed");

	}
	else {
		errorW("Unknown option: %s", argv[1]);
		printHelp(argv[0]);
		return EXIT_FAILURE;
	}

	return EXIT_SUCCESS;

}