Feat/protobuf log format

.github/workflows/msbuild.yml

@@ -5,6 +5,7 @@ on:
     branches: [ "capemon" ]
   pull_request:
     branches: [ "capemon" ]
+  workflow_dispatch:  # Allow manual trigger
 
 env:  
   BUILD_CONFIGURATION: Release

.github/workflows/pr-build-test.yml

@@ -0,0 +1,74 @@
+name: PR Build Test
+
+on:
+  workflow_dispatch:  # Manual trigger
+    inputs:
+      pr_number:
+        description: 'PR number to test'
+        required: true
+        type: number
+  pull_request:
+    branches: [ "capemon" ]
+
+env:
+  BUILD_CONFIGURATION: Release
+  SOLUTION_FILE_PATH: capemon.sln
+
+jobs:
+  build:
+    runs-on: windows-2019
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - arch: x86
+            platform: Win32
+          - arch: x64
+            platform: x64
+
+    steps:
+    - uses: actions/checkout@v3
+
+    - name: Add MSBuild to PATH
+      uses: microsoft/setup-msbuild@v1.1
+      with:
+       msbuild-architecture: ${{ matrix.arch }}
+
+    - name: Restore NuGet packages
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: nuget restore ${{env.SOLUTION_FILE_PATH}}
+
+    - name: Build
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: msbuild /m /p:Configuration=${{env.BUILD_CONFIGURATION}} /p:Platform=${{ matrix.platform }} ${{env.SOLUTION_FILE_PATH}}
+
+    - name: Build Tests
+      working-directory: ${{env.GITHUB_WORKSPACE}}
+      run: |
+        cd tests
+        make test-tls-logging.exe
+        make test-pluggable-serialization.exe
+      shell: bash
+      continue-on-error: true
+
+    - uses: actions/upload-artifact@v3
+      with:
+        name: capemon_test_${{ matrix.arch }}_pr${{ github.event.inputs.pr_number || github.event.pull_request.number }}
+        path: |
+          Release/capemon.dll
+          x64/Release/capemon_x64.dll
+          tests/*.exe
+        if-no-files-found: ignore
+
+    - name: Comment Build Status
+      if: github.event.pull_request.number
+      uses: actions/github-script@v6
+      with:
+        script: |
+          github.rest.issues.createComment({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.name,
+            body: '✅ Build succeeded for ${{ matrix.platform }}! Artifacts available in workflow run.'
+          })
+      continue-on-error: true

capemon.c

@@ -690,6 +690,10 @@ BOOL APIENTRY DllMain(HANDLE hModule, DWORD dwReason, LPVOID lpReserved)
 		if (!g_config.tlsdump && !g_config.interactive)
 			notify_successful_load();
 	}
+	else if (dwReason == DLL_THREAD_DETACH) {
+		extern void TlsThreadCleanup(void);
+		TlsThreadCleanup();
+	}
 	else if(dwReason == DLL_PROCESS_DETACH) {
 		// in production, we shouldn't ever get called in this way since we
 		// unlink ourselves from the module list in the PEB

capemon.filters

@@ -39,6 +39,21 @@
     <ClCompile Include="config.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="protobuf_wrapper.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="schema.pb.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="nanopb\pb_common.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="nanopb\pb_decode.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="nanopb\pb_encode.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="hook_file.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -305,6 +320,27 @@
     <ClInclude Include="ignore.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="protobuf_wrapper.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="schema.pb.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="log_serializer.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb_common.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb_decode.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb_encode.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="log.h">
       <Filter>Header Files</Filter>
     </ClInclude>

capemon.vcxproj

@@ -236,6 +236,11 @@
     <ClCompile Include="CAPE\Unpacker.c" />
     <ClCompile Include="CAPE\YaraHarness.c" />
     <ClCompile Include="config.c" />
+    <ClCompile Include="protobuf_wrapper.c" />
+    <ClCompile Include="schema.pb.c" />
+    <ClCompile Include="nanopb\pb_common.c" />
+    <ClCompile Include="nanopb\pb_decode.c" />
+    <ClCompile Include="nanopb\pb_encode.c" />
     <ClCompile Include="capemon.c" />
     <ClCompile Include="distorm\src\decoder.c" />
     <ClCompile Include="distorm\src\distorm.c" />
@@ -473,6 +478,13 @@
     <ClInclude Include="hook_sleep.h" />
     <ClInclude Include="hook_trace.h" />
     <ClInclude Include="ignore.h" />
+    <ClInclude Include="protobuf_wrapper.h" />
+    <ClInclude Include="schema.pb.h" />
+    <ClInclude Include="log_serializer.h" />
+    <ClInclude Include="nanopb\pb.h" />
+    <ClInclude Include="nanopb\pb_common.h" />
+    <ClInclude Include="nanopb\pb_decode.h" />
+    <ClInclude Include="nanopb\pb_encode.h" />
     <ClInclude Include="log.h" />
     <ClInclude Include="lookup.h" />
     <ClInclude Include="misc.h" />

capemon.vcxproj.filters

@@ -36,6 +36,21 @@
     <ClCompile Include="config.c">
       <Filter>Source Files</Filter>
     </ClCompile>
+    <ClCompile Include="protobuf_wrapper.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="schema.pb.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="nanopb\pb_common.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="nanopb\pb_decode.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+    <ClCompile Include="nanopb\pb_encode.c">
+      <Filter>Source Files</Filter>
+    </ClCompile>
     <ClCompile Include="hook_file.c">
       <Filter>Source Files</Filter>
     </ClCompile>
@@ -329,6 +344,27 @@
     <ClInclude Include="ignore.h">
       <Filter>Header Files</Filter>
     </ClInclude>
+    <ClInclude Include="protobuf_wrapper.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="schema.pb.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="log_serializer.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb_common.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb_decode.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+    <ClInclude Include="nanopb\pb_encode.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
     <ClInclude Include="log.h">
       <Filter>Header Files</Filter>
     </ClInclude>

config.c

@@ -21,6 +21,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 #include "config.h"
 #include "misc.h"
 #include "log.h"
+#include "log_serializer.h"
 #include "hooking.h"
 #include "hook_sleep.h"
 #include "unhook.h"
@@ -1457,6 +1458,13 @@ void parse_config_line(char* line)
 			g_config.sleep_skip_seconds = (int)strtoul(value, NULL, 10);
 			DebugOutput("Config: Sleep skip seconds set to %d.\n", g_config.sleep_skip_seconds);
 		}
+		else if (!stricmp(key, "log-format")) {
+			g_config.log_format = (int)strtoul(value, NULL, 10);
+			if (g_config.log_format == LOG_FORMAT_PROTOBUF)
+				DebugOutput("Config: Log format set to Protocol Buffers.\n");
+			else
+				DebugOutput("Config: Log format set to BSON.\n");
+		}
 		else if (!stricmp(key, "monitor")) {
 			DWORD pid = (unsigned int)strtoul(value, NULL, 10);
 			if (!pid && !stricmp(value, "explorer"))

config.h

@@ -337,6 +337,7 @@ struct _g_config {
 	char *trace_into_api[EXCLUSION_MAX];
 	int hook_watch;
 	int sleep_skip_seconds;
+	int log_format;
 };
 
 extern struct _g_config g_config;