diff --git a/AppControl Manager/AppControl Manager.csproj b/AppControl Manager/AppControl Manager.csproj index 57768cd46..4f55b3776 100644 --- a/AppControl Manager/AppControl Manager.csproj +++ b/AppControl Manager/AppControl Manager.csproj @@ -25,6 +25,7 @@ true enable + en-US @@ -57,8 +58,8 @@ false - @@ -243,6 +244,7 @@ + @@ -257,6 +259,9 @@ Always + + Always + Always diff --git a/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml b/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml index c29288d61..0c1830ec8 100644 --- a/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml +++ b/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml @@ -18,7 +18,7 @@ CornerRadius="8" Style="{ThemeResource DefaultContentDialogStyle}" BorderBrush="{ThemeResource AccentFillColorDefaultBrush}"> - + 2000 diff --git a/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml.cs b/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml.cs index b76f0d81d..a596462f7 100644 --- a/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml.cs +++ b/AppControl Manager/CustomUIElements/SigningDetailsDialogForRemoval.xaml.cs @@ -306,7 +306,7 @@ private async void VerifyButton_Click(object sender, RoutedEventArgs e) await Task.Run(() => { // Instantiate the selected XML policy file - policyObject = SiPolicy.Management.Initialize(policyPathFromUI); + policyObject = SiPolicy.Management.Initialize(policyPathFromUI, null); // See if the deployed base policy IDs contain the ID of the policy being removed // Only checking among base policies because supplemental policies can be removed normally whether they're signed or not diff --git a/AppControl Manager/IntelGathering/KernelModeDrivers.cs b/AppControl Manager/IntelGathering/KernelModeDrivers.cs index 94a7d1d6c..377622987 100644 --- a/AppControl Manager/IntelGathering/KernelModeDrivers.cs +++ b/AppControl Manager/IntelGathering/KernelModeDrivers.cs @@ -17,6 +17,13 @@ internal static class KernelModeDrivers private static readonly Guid CRYPT_SUBJTYPE_CATALOG_IMAGE = new("DE351A43-8E59-11d0-8C47-00C04FC295EE"); private static readonly Guid CRYPT_SUBJTYPE_CTL_IMAGE = new("9BA61D3F-E73A-11d0-8CD2-00C04FC295EE"); + // If any of these DLLs are found in the imports list, the file is (likely) a user-mode PE. + // When a binary (such as a .exe or .dll) imports any of these user-mode libraries, it indicates that the binary relies on user-space functions, which are designed for normal applications. + // E.g., functions like CreateFile, MessageBox, or CreateWindow etc. are provided by kernel32.dll and user32.dll for user-mode applications, not for code running in kernel mode. + // Kernel-mode components do not interact with these user-mode DLLs. Instead, they access the kernel directly through SysCalls and low-level APIs. + + private static readonly HashSet UserModeDlls = ["kernel32.dll", "kernelbase.dll", "mscoree.dll", "ntdll.dll", "user32.dll"]; + public struct IMAGE_IMPORT_DESCRIPTOR { public uint CharacteristicsOrOriginalFirstThunk; @@ -328,14 +335,7 @@ internal static KernelUserVerdict CheckKernelUserModeStatus(string filePath) } - - // If any of these DLLs are found in the imports list, the file is (likely) a user-mode PE. - // When a binary (such as a .exe or .dll) imports any of these user-mode libraries, it indicates that the binary relies on user-space functions, which are designed for normal applications. - // E.g., functions like CreateFile, MessageBox, or CreateWindow etc. are provided by kernel32.dll and user32.dll for user-mode applications, not for code running in kernel mode. - // Kernel-mode components do not interact with these user-mode DLLs. Instead, they access the kernel directly through SysCalls and low-level APIs. - List userModeDlls = ["kernel32.dll", "kernelbase.dll", "mscoree.dll", "ntdll.dll", "user32.dll"]; - - Verdict = importNames.Any(import => userModeDlls.Any(dll => string.Equals(import, dll, StringComparison.OrdinalIgnoreCase))) ? SSType.UserMode : SSType.KernelMode; + Verdict = importNames.Any(import => UserModeDlls.Any(dll => string.Equals(import, dll, StringComparison.OrdinalIgnoreCase))) ? SSType.UserMode : SSType.KernelMode; // Return the actual output which happens when no errors occurred before return new KernelUserVerdict diff --git a/AppControl Manager/IntelGathering/PrepareEmptyPolicy.cs b/AppControl Manager/IntelGathering/PrepareEmptyPolicy.cs index 0739eb16e..17e3bf358 100644 --- a/AppControl Manager/IntelGathering/PrepareEmptyPolicy.cs +++ b/AppControl Manager/IntelGathering/PrepareEmptyPolicy.cs @@ -1,30 +1,21 @@ using System.IO; using AppControlManager.Others; -using AppControlManager.XMLOps; namespace AppControlManager.IntelGathering; public static class PrepareEmptyPolicy { - /// - /// Copies one of the template Code Integrity policies to the directory it receives, empties it and returns its path + /// Copies the empty policy in app resources to the defined directory and returns its new path /// /// /// public static string Prepare(string directory) { - string pathToReturn = Path.Combine(directory, "EmptyPolicyFile.xml"); - Logger.Write("Copying the template policy to the staging area"); - - File.Copy(@"C:\Windows\schemas\CodeIntegrity\ExamplePolicies\AllowAll.xml", pathToReturn, true); - - Logger.Write("Emptying the policy file in preparation for the new data insertion"); - ClearCiPolicySemantic.Clear(pathToReturn); + File.Copy(GlobalVars.EmptyPolicyPath, pathToReturn, true); return pathToReturn; - } } diff --git a/AppControl Manager/Main/BasePolicyCreator.cs b/AppControl Manager/Main/BasePolicyCreator.cs index d5eca665d..f7f8ec9cc 100644 --- a/AppControl Manager/Main/BasePolicyCreator.cs +++ b/AppControl Manager/Main/BasePolicyCreator.cs @@ -349,15 +349,15 @@ internal static void GetDriversBlockRules(string StagingArea) driverBlockRulesXML.LoadXml(xmlContent); // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(null, driverBlockRulesXML); + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(null, driverBlockRulesXML); // Generate the path for the XML file string xmlPath = Path.Combine(StagingArea, $"{name}.xml"); // Save the XML content to a file - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, xmlPath); + SiPolicy.Management.SavePolicyToFile(policyObj, xmlPath); - CiRuleOptions.Set(filePath: xmlPath, rulesToRemove: [CiRuleOptions.PolicyRuleOptions.EnabledAuditMode]); + CiRuleOptions.Set(filePath: xmlPath, rulesToRemove: [SiPolicy.OptionType.EnabledAuditMode]); // The final path where the XML policy file will be located string savePathLocation = Path.Combine(GlobalVars.UserConfigDir, $"{name}.xml"); @@ -580,22 +580,21 @@ internal static void GetBlockRules(string StagingArea, bool deploy) throw new InvalidOperationException("No XML content found on the Microsoft GitHub source for Microsoft Recommended User Mode Block Rules."); } - // Load the XML content into an XmlDocument XmlDocument userModeBlockRulesXML = new(); userModeBlockRulesXML.LoadXml(xmlContent); // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(null, userModeBlockRulesXML); + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(null, userModeBlockRulesXML); // Paths only used during staging area processing string tempPolicyPath = Path.Combine(StagingArea, $"{policyName}.xml"); string tempPolicyCIPPath = Path.Combine(StagingArea, $"{policyName}.cip"); // Save the XML content to a file - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, tempPolicyPath); + SiPolicy.Management.SavePolicyToFile(policyObj, tempPolicyPath); - CiRuleOptions.Set(filePath: tempPolicyPath, rulesToAdd: [CiRuleOptions.PolicyRuleOptions.EnabledUpdatePolicyNoReboot, CiRuleOptions.PolicyRuleOptions.DisabledScriptEnforcement], rulesToRemove: [CiRuleOptions.PolicyRuleOptions.EnabledAuditMode, CiRuleOptions.PolicyRuleOptions.EnabledAdvancedBootOptionsMenu]); + CiRuleOptions.Set(filePath: tempPolicyPath, rulesToAdd: [SiPolicy.OptionType.EnabledUpdatePolicyNoReboot, SiPolicy.OptionType.DisabledScriptEnforcement], rulesToRemove: [SiPolicy.OptionType.EnabledAuditMode, SiPolicy.OptionType.EnabledAdvancedBootOptionsMenu]); Logger.Write("Assigning policy name and resetting policy ID"); @@ -621,7 +620,7 @@ internal static void GetBlockRules(string StagingArea, bool deploy) Logger.Write($"{policyName} policy is already deployed, updating it using the same GUID which is {CurrentlyDeployedBlockRulesGUID}."); // Swap the policyID in the current policy XML file with the one from the deployed policy - PolicyEditor.EditGuids(CurrentlyDeployedBlockRulesGUID, new FileInfo(tempPolicyPath)); + PolicyEditor.EditGuids(CurrentlyDeployedBlockRulesGUID, tempPolicyPath); } else { @@ -761,7 +760,7 @@ internal static void BuildStrictKernelMode(string StagingArea, bool IsAudit, boo if (IsAudit) { // Add the audit mode rule option to the policy - CiRuleOptions.Set(filePath: policyPath, rulesToAdd: [CiRuleOptions.PolicyRuleOptions.EnabledAuditMode]); + CiRuleOptions.Set(filePath: policyPath, rulesToAdd: [SiPolicy.OptionType.EnabledAuditMode]); } string policyID; diff --git a/AppControl Manager/Main/SetCiRuleOptions.cs b/AppControl Manager/Main/SetCiRuleOptions.cs index 2deef2b8f..f20459064 100644 --- a/AppControl Manager/Main/SetCiRuleOptions.cs +++ b/AppControl Manager/Main/SetCiRuleOptions.cs @@ -1,8 +1,8 @@ using System; using System.Collections.Generic; using System.Linq; -using System.Xml; using AppControlManager.Others; +using AppControlManager.SiPolicy; using AppControlManager.XMLOps; namespace AppControlManager.Main; @@ -18,178 +18,66 @@ internal enum PolicyTemplate Supplemental } - internal enum PolicyRuleOptions - { - EnabledUMCI = 0, - EnabledBootMenuProtection = 1, - RequiredWHQL = 2, - EnabledAuditMode = 3, - DisabledFlightSigning = 4, - EnabledInheritDefaultPolicy = 5, - EnabledUnsignedSystemIntegrityPolicy = 6, - RequiredEVSigners = 8, - EnabledAdvancedBootOptionsMenu = 9, - EnabledBootAuditOnFailure = 10, - DisabledScriptEnforcement = 11, - RequiredEnforceStoreApplications = 12, - EnabledManagedInstaller = 13, - EnabledIntelligentSecurityGraphAuthorization = 14, - EnabledInvalidateEAsOnReboot = 15, - EnabledUpdatePolicyNoReboot = 16, - EnabledAllowSupplementalPolicies = 17, - DisabledRuntimeFilePathRuleProtection = 18, - EnabledDynamicCodeSecurity = 19, - EnabledRevokedExpiredAsUnsigned = 20, - EnabledDeveloperModeDynamicCodeTrust = 100, - EnabledSecureSettingPolicy = 102, - EnabledConditionalWindowsLockdownPolicy = 103 - } - - - // Mapping enum values to custom string representations that match rule options in the policy XML file - // Since they include colons and spaces, cannot be included in the enum - internal static readonly Dictionary PolicyRuleOptionsActual = new() - { - { "Enabled:UMCI", (int)PolicyRuleOptions.EnabledUMCI }, - { "Enabled:Boot Menu Protection", (int)PolicyRuleOptions.EnabledBootMenuProtection }, - { "Required:WHQL", (int)PolicyRuleOptions.RequiredWHQL }, - { "Enabled:Audit Mode", (int)PolicyRuleOptions.EnabledAuditMode }, - { "Disabled:Flight Signing", (int)PolicyRuleOptions.DisabledFlightSigning }, - { "Enabled:Inherit Default Policy", (int)PolicyRuleOptions.EnabledInheritDefaultPolicy }, - { "Enabled:Unsigned System Integrity Policy", (int)PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy }, - { "Required:EV Signers", (int)PolicyRuleOptions.RequiredEVSigners }, - { "Enabled:Advanced Boot Options Menu", (int)PolicyRuleOptions.EnabledAdvancedBootOptionsMenu }, - { "Enabled:Boot Audit On Failure", (int)PolicyRuleOptions.EnabledBootAuditOnFailure }, - { "Disabled:Script Enforcement", (int)PolicyRuleOptions.DisabledScriptEnforcement }, - { "Required:Enforce Store Applications", (int)PolicyRuleOptions.RequiredEnforceStoreApplications }, - { "Enabled:Managed Installer", (int)PolicyRuleOptions.EnabledManagedInstaller }, - { "Enabled:Intelligent Security Graph Authorization", (int)PolicyRuleOptions.EnabledIntelligentSecurityGraphAuthorization }, - { "Enabled:Invalidate EAs on Reboot", (int)PolicyRuleOptions.EnabledInvalidateEAsOnReboot }, - { "Enabled:Update Policy No Reboot", (int)PolicyRuleOptions.EnabledUpdatePolicyNoReboot }, - { "Enabled:Allow Supplemental Policies", (int)PolicyRuleOptions.EnabledAllowSupplementalPolicies }, - { "Disabled:Runtime FilePath Rule Protection", (int)PolicyRuleOptions.DisabledRuntimeFilePathRuleProtection }, - { "Enabled:Dynamic Code Security", (int)PolicyRuleOptions.EnabledDynamicCodeSecurity }, - { "Enabled:Revoked Expired As Unsigned", (int)PolicyRuleOptions.EnabledRevokedExpiredAsUnsigned }, - { "Enabled:Developer Mode Dynamic Code Trust", (int)PolicyRuleOptions.EnabledDeveloperModeDynamicCodeTrust }, - { "Enabled:Secure Setting Policy", (int)PolicyRuleOptions.EnabledSecureSettingPolicy }, - { "Enabled:Conditional Windows Lockdown Policy", (int)PolicyRuleOptions.EnabledConditionalWindowsLockdownPolicy } - }; - - - private static readonly Dictionary PolicyRuleOptionsActualInverted = new() - { - { (int)PolicyRuleOptions.EnabledUMCI, "Enabled:UMCI" }, - { (int)PolicyRuleOptions.EnabledBootMenuProtection, "Enabled:Boot Menu Protection" }, - { (int)PolicyRuleOptions.RequiredWHQL, "Required:WHQL" }, - { (int)PolicyRuleOptions.EnabledAuditMode, "Enabled:Audit Mode" }, - { (int)PolicyRuleOptions.DisabledFlightSigning, "Disabled:Flight Signing" }, - { (int)PolicyRuleOptions.EnabledInheritDefaultPolicy, "Enabled:Inherit Default Policy" }, - { (int)PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy, "Enabled:Unsigned System Integrity Policy" }, - { (int)PolicyRuleOptions.RequiredEVSigners, "Required:EV Signers" }, - { (int)PolicyRuleOptions.EnabledAdvancedBootOptionsMenu, "Enabled:Advanced Boot Options Menu" }, - { (int)PolicyRuleOptions.EnabledBootAuditOnFailure, "Enabled:Boot Audit On Failure" }, - { (int)PolicyRuleOptions.DisabledScriptEnforcement, "Disabled:Script Enforcement" }, - { (int)PolicyRuleOptions.RequiredEnforceStoreApplications, "Required:Enforce Store Applications" }, - { (int)PolicyRuleOptions.EnabledManagedInstaller, "Enabled:Managed Installer" }, - { (int)PolicyRuleOptions.EnabledIntelligentSecurityGraphAuthorization, "Enabled:Intelligent Security Graph Authorization" }, - { (int)PolicyRuleOptions.EnabledInvalidateEAsOnReboot, "Enabled:Invalidate EAs on Reboot" }, - { (int)PolicyRuleOptions.EnabledUpdatePolicyNoReboot, "Enabled:Update Policy No Reboot" }, - { (int)PolicyRuleOptions.EnabledAllowSupplementalPolicies, "Enabled:Allow Supplemental Policies" }, - { (int)PolicyRuleOptions.DisabledRuntimeFilePathRuleProtection, "Disabled:Runtime FilePath Rule Protection" }, - { (int)PolicyRuleOptions.EnabledDynamicCodeSecurity, "Enabled:Dynamic Code Security" }, - { (int)PolicyRuleOptions.EnabledRevokedExpiredAsUnsigned, "Enabled:Revoked Expired As Unsigned" }, - { (int)PolicyRuleOptions.EnabledDeveloperModeDynamicCodeTrust, "Enabled:Developer Mode Dynamic Code Trust" }, - { (int)PolicyRuleOptions.EnabledSecureSettingPolicy, "Enabled:Secure Setting Policy" }, - { (int)PolicyRuleOptions.EnabledConditionalWindowsLockdownPolicy, "Enabled:Conditional Windows Lockdown Policy" } - }; - - - #region - // Defining the rule options for each policy type and scenario - - private static readonly HashSet BaseRules = [ - (int)PolicyRuleOptions.EnabledUMCI, - (int)PolicyRuleOptions.RequiredWHQL, - (int)PolicyRuleOptions.EnabledInheritDefaultPolicy, - (int)PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy, - (int)PolicyRuleOptions.DisabledScriptEnforcement, - (int)PolicyRuleOptions.RequiredEnforceStoreApplications, - (int)PolicyRuleOptions.EnabledUpdatePolicyNoReboot, - (int)PolicyRuleOptions.EnabledAllowSupplementalPolicies, - (int)PolicyRuleOptions.EnabledDynamicCodeSecurity, - (int)PolicyRuleOptions.EnabledRevokedExpiredAsUnsigned + #region Defining the rule options for each policy type and scenario + + private static readonly HashSet BaseRules = [ + OptionType.EnabledUMCI, + OptionType.RequiredWHQL, + OptionType.EnabledInheritDefaultPolicy, + OptionType.EnabledUnsignedSystemIntegrityPolicy, + OptionType.DisabledScriptEnforcement, + OptionType.RequiredEnforceStoreApplications, + OptionType.EnabledUpdatePolicyNoReboot, + OptionType.EnabledAllowSupplementalPolicies, + OptionType.EnabledDynamicCodeSecurity, + OptionType.EnabledRevokedExpiredAsUnsigned ]; - private static readonly HashSet BaseISGRules = [ - (int)PolicyRuleOptions.EnabledUMCI, - (int)PolicyRuleOptions.RequiredWHQL, - (int)PolicyRuleOptions.EnabledInheritDefaultPolicy, - (int)PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy, - (int)PolicyRuleOptions.DisabledScriptEnforcement, - (int)PolicyRuleOptions.RequiredEnforceStoreApplications, - (int)PolicyRuleOptions.EnabledIntelligentSecurityGraphAuthorization, - (int)PolicyRuleOptions.EnabledInvalidateEAsOnReboot, - (int)PolicyRuleOptions.EnabledUpdatePolicyNoReboot, - (int)PolicyRuleOptions.EnabledAllowSupplementalPolicies, - (int)PolicyRuleOptions.EnabledDynamicCodeSecurity, - (int)PolicyRuleOptions.EnabledRevokedExpiredAsUnsigned + private static readonly HashSet BaseISGRules = [ + OptionType.EnabledUMCI, + OptionType.RequiredWHQL, + OptionType.EnabledInheritDefaultPolicy, + OptionType.EnabledUnsignedSystemIntegrityPolicy, + OptionType.DisabledScriptEnforcement, + OptionType.RequiredEnforceStoreApplications, + OptionType.EnabledIntelligentSecurityGraphAuthorization, + OptionType.EnabledInvalidateEAsonReboot, + OptionType.EnabledUpdatePolicyNoReboot, + OptionType.EnabledAllowSupplementalPolicies, + OptionType.EnabledDynamicCodeSecurity, + OptionType.EnabledRevokedExpiredAsUnsigned ]; - private static readonly HashSet BaseKernelModeRules = [ - (int)PolicyRuleOptions.RequiredWHQL, - (int)PolicyRuleOptions.EnabledInheritDefaultPolicy, - (int)PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy, - (int)PolicyRuleOptions.EnabledUpdatePolicyNoReboot, - (int)PolicyRuleOptions.EnabledAllowSupplementalPolicies, - (int)PolicyRuleOptions.EnabledRevokedExpiredAsUnsigned + private static readonly HashSet BaseKernelModeRules = [ + OptionType.RequiredWHQL, + OptionType.EnabledInheritDefaultPolicy, + OptionType.EnabledUnsignedSystemIntegrityPolicy, + OptionType.EnabledUpdatePolicyNoReboot, + OptionType.EnabledAllowSupplementalPolicies, + OptionType.EnabledRevokedExpiredAsUnsigned ]; - private static readonly HashSet SupplementalRules = [ - (int)PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy - // (int)PolicyRuleOptions.DisabledRuntimeFilePathRuleProtection - Only add this if the Supplemental policy will have FilePath rules and user explicitly asks for allowing user-writable file paths + private static readonly HashSet SupplementalRules = [ + OptionType.EnabledUnsignedSystemIntegrityPolicy + // OptionType.DisabledRuntimeFilePathRuleProtection - Only add this if the Supplemental policy will have FilePath rules and user explicitly asks for allowing user-writable file paths ]; - private static readonly HashSet RequireWHQLRules = [(int)PolicyRuleOptions.RequiredWHQL]; - private static readonly HashSet EnableAuditModeRules = [(int)PolicyRuleOptions.EnabledAuditMode]; - private static readonly HashSet DisableFlightSigningRules = [(int)PolicyRuleOptions.DisabledFlightSigning]; - private static readonly HashSet RequireEVSignersRules = [(int)PolicyRuleOptions.RequiredEVSigners]; - private static readonly HashSet ScriptEnforcementRules = [(int)PolicyRuleOptions.DisabledScriptEnforcement]; - private static readonly HashSet TestModeRules = [(int)PolicyRuleOptions.EnabledAdvancedBootOptionsMenu, (int)PolicyRuleOptions.EnabledBootAuditOnFailure]; + private static readonly HashSet RequireWHQLRules = [OptionType.RequiredWHQL]; + private static readonly HashSet EnableAuditModeRules = [OptionType.EnabledAuditMode]; + private static readonly HashSet DisableFlightSigningRules = [OptionType.DisabledFlightSigning]; + private static readonly HashSet RequireEVSignersRules = [OptionType.RequiredEVSigners]; + private static readonly HashSet ScriptEnforcementRules = [OptionType.DisabledScriptEnforcement]; + private static readonly HashSet TestModeRules = [OptionType.EnabledAdvancedBootOptionsMenu, OptionType.EnabledBootAuditOnFailure]; #endregion - - /* - #region Policy Rule Options - // Fetches the latest policy rule options from the Schema file that exists on the system - - // Load the CI Schema content - XmlDocument schemaData = new(); - schemaData.Load(Path.Combine(AppControlManager.GlobalVars.CISchemaPath)); - - // Create a namespace manager to handle namespaces - XmlNamespaceManager nsManager = new(schemaData.NameTable); - nsManager.AddNamespace("xs", "http://www.w3.org/2001/XMLSchema"); - - // Define the XPath query to fetch enumeration values - string xpathQuery = "//xs:simpleType[@name='OptionType']/xs:restriction/xs:enumeration/@value"; - - // Create a new HashSet to store the valid policy rule options - HashSet validOptions = new(StringComparer.OrdinalIgnoreCase); - - // Fetch enumeration values from the schema - XmlNodeList? optionNodes = schemaData.SelectNodes(xpathQuery, nsManager) ?? throw new InvalidOperationException("No valid options found in the Code Integrity Schema."); - - foreach (XmlNode node in optionNodes) - { - if (node.Value is not null) - { - _ = validOptions.Add(node.Value); - } - } - #endregion - */ - + private static readonly HashSet SupplementalPolicyAllowedRuleOptions = [ + OptionType.DisabledRuntimeFilePathRuleProtection, + OptionType.EnabledIntelligentSecurityGraphAuthorization , + OptionType.EnabledManagedInstaller , + OptionType.EnabledInheritDefaultPolicy, + OptionType.EnabledUnsignedSystemIntegrityPolicy + ]; /// /// Configures the Policy rule options in a given XML file and sets the HVCI to Strict in the output XML file. @@ -212,8 +100,8 @@ internal enum PolicyRuleOptions internal static void Set( string filePath, PolicyTemplate? template = null, - PolicyRuleOptions[]? rulesToAdd = null, - PolicyRuleOptions[]? rulesToRemove = null, + OptionType[]? rulesToAdd = null, + OptionType[]? rulesToRemove = null, bool? RequireWHQL = null, bool? EnableAuditMode = null, bool? DisableFlightSigning = null, @@ -227,19 +115,13 @@ internal static void Set( Logger.Write($"Configuring the policy rule options for: {filePath}"); // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(filePath, null); + SiPolicy.SiPolicy policyObj = Management.Initialize(filePath, null); - // Store the type of the policy in a variable - string PolicyType = codeIntegrityPolicy.SiPolicyNode.Attributes?["PolicyType"]?.Value ?? throw new InvalidOperationException("Policy type attribute does not exist in the selected policy"); - - // Find the Rules Node - XmlNode? RulesNode = codeIntegrityPolicy.SiPolicyNode.SelectSingleNode("ns:Rules", codeIntegrityPolicy.NamespaceManager); - - // An empty dictionary to store the existing rule options in the XML policy file - Dictionary ExistingRuleOptions = []; + // To store the existing rule options in the XML policy file + HashSet ExistingRuleOptions = []; // The final rule options to implement which contains only unique values - HashSet RuleOptionsToImplement = []; + HashSet RuleOptionsToImplement = []; // A flag to determine whether to clear all the existing rules based on the input parameters bool ClearAllRules = false; @@ -249,46 +131,22 @@ internal static void Set( ClearAllRules = true; } - // To store the current policy rules nodes - XmlNodeList? currentPolicyRules = null; - - if (RulesNode is not null) + // Store the current policy rules + if (policyObj.Rules.Length > 0) { - // Get all of the current policy nodes in the node - currentPolicyRules = RulesNode.SelectNodes("ns:Rule", codeIntegrityPolicy.NamespaceManager); - } - - if (currentPolicyRules is not null) - { - // Iterating through each node in the supplied XML file - foreach (XmlNode rule in currentPolicyRules) + foreach (RuleType rule in policyObj.Rules) { - // Get the option text from the /// - private PolicyRuleOptions[] GetSelectedPolicyRuleOptions() + private List GetSelectedPolicyRuleOptions() { - List selectedRules = []; + List selectedRules = []; // Iterate through each SettingsCard in the PolicyRuleExpander foreach (var item in PolicyRuleExpander.Items) { if (item is SettingsCard settingsCard && settingsCard.Content is CheckBox checkBox && checkBox.IsChecked == true) { - // Get the content of the checkbox, which is the dictionary key - string? key = checkBox.Content?.ToString(); + // Get the tag of the checkbox + string? key = checkBox.Tag?.ToString(); - if (!string.IsNullOrEmpty(key) && PolicyRuleOptionsActual.TryGetValue(key, out int value)) + if (!string.IsNullOrEmpty(key)) { - // Convert to PolicyRuleOptions enum and add to the list - selectedRules.Add((PolicyRuleOptions)value); + selectedRules.Add(CustomDeserialization.ConvertStringToOptionType(key)); } } } - - return [.. selectedRules]; + return selectedRules; } @@ -368,7 +406,7 @@ private async void RefreshRuleOptionsState_Click(object sender, RoutedEventArgs else { MainTeachingTip.IsOpen = true; - MainTeachingTip.Subtitle = "Please select a policy file before retrieving its rule options status."; + MainTeachingTip.Subtitle = GlobalVars.Rizz.GetString("SelectPolicyFileBeforeRetrievingOptions"); return; } } diff --git a/AppControl Manager/Pages/CreateDenyPolicy.xaml.cs b/AppControl Manager/Pages/CreateDenyPolicy.xaml.cs index 5ef95779d..57bcae2ee 100644 --- a/AppControl Manager/Pages/CreateDenyPolicy.xaml.cs +++ b/AppControl Manager/Pages/CreateDenyPolicy.xaml.cs @@ -37,7 +37,7 @@ public CreateDenyPolicy() } // Public property to access the singleton instance from other classes - public static CreateDenyPolicy Instance => _instance ?? throw new InvalidOperationException("CreateDenyPolicy is not initialized."); + public static CreateDenyPolicy Instance => _instance ?? throw new InvalidOperationException(GlobalVars.Rizz.GetString("CreateDenyPolicyNotInitialized")); @@ -125,8 +125,8 @@ private async void CreateFilesAndFoldersDenyPolicyButton_Click(object sender, Ro if (filesAndFoldersFilePaths.Count == 0 && filesAndFoldersFolderPaths.Count == 0) { CreateDenyPolicyTeachingTip.IsOpen = true; - CreateDenyPolicyTeachingTip.Title = "Select files or folders"; - CreateDenyPolicyTeachingTip.Subtitle = "No files or folders were selected for Deny policy creation"; + CreateDenyPolicyTeachingTip.Title = GlobalVars.Rizz.GetString("SelectFilesOrFoldersTitle"); + CreateDenyPolicyTeachingTip.Subtitle = GlobalVars.Rizz.GetString("NoFilesOrFoldersSelected"); return; } @@ -135,8 +135,8 @@ private async void CreateFilesAndFoldersDenyPolicyButton_Click(object sender, Ro if (string.IsNullOrWhiteSpace(filesAndFoldersDenyPolicyName)) { CreateDenyPolicyTeachingTip.IsOpen = true; - CreateDenyPolicyTeachingTip.Title = "Choose Deny Policy Name"; - CreateDenyPolicyTeachingTip.Subtitle = "You need to provide a name for the Deny policy."; + CreateDenyPolicyTeachingTip.Title = GlobalVars.Rizz.GetString("ChooseDenyPolicyNameTitle"); + CreateDenyPolicyTeachingTip.Subtitle = GlobalVars.Rizz.GetString("ProvidePolicyName"); return; } @@ -159,7 +159,7 @@ private async void CreateFilesAndFoldersDenyPolicyButton_Click(object sender, Ro FilesAndFoldersInfoBar.IsOpen = true; FilesAndFoldersInfoBar.Severity = InfoBarSeverity.Informational; - string msg1 = $"You selected {filesAndFoldersFilePaths.Count} files and {filesAndFoldersFolderPaths.Count} folders."; + string msg1 = GlobalVars.Rizz.GetString("SelectedFilesAndFolders") + filesAndFoldersFilePaths.Count + GlobalVars.Rizz.GetString("FilesAnd") + filesAndFoldersFolderPaths.Count + GlobalVars.Rizz.GetString("Folders"); FilesAndFoldersInfoBar.Message = msg1; Logger.Write(msg1); @@ -201,8 +201,8 @@ await Task.Run(() => _ = DispatcherQueue.TryEnqueue(() => { CreateDenyPolicyTeachingTip.IsOpen = true; - CreateDenyPolicyTeachingTip.Title = "No compatible files detected"; - CreateDenyPolicyTeachingTip.Subtitle = "No AppControl compatible files have been detected in any of the files and folder paths you selected"; + CreateDenyPolicyTeachingTip.Title = GlobalVars.Rizz.GetString("NoCompatibleFilesTitle"); + CreateDenyPolicyTeachingTip.Subtitle = GlobalVars.Rizz.GetString("NoCompatibleFilesDetected"); errorsOccurred = true; FilesAndFoldersInfoBar.IsOpen = false; FilesAndFoldersInfoBar.Severity = InfoBarSeverity.Informational; @@ -213,7 +213,7 @@ await Task.Run(() => } - string msg2 = $"Scanning a total of {DetectedFilesInSelectedDirectories.Count} AppControl compatible files..."; + string msg2 = GlobalVars.Rizz.GetString("ScanningFiles") + DetectedFilesInSelectedDirectories.Count + GlobalVars.Rizz.GetString("AppControlCompatibleFiles"); Logger.Write(msg2); _ = DispatcherQueue.TryEnqueue(() => @@ -237,7 +237,7 @@ await Task.Run(() => } - string msg3 = "Scan completed, creating the Deny policy"; + string msg3 = GlobalVars.Rizz.GetString("ScanCompleted"); Logger.Write(msg3); @@ -279,7 +279,7 @@ await Task.Run(() => if (filesAndFoldersDeployButton) { - string msg4 = "Deploying the Deny policy on the system"; + string msg4 = GlobalVars.Rizz.GetString("DeployingDenyPolicy"); Logger.Write(msg4); @@ -303,7 +303,7 @@ await Task.Run(() => catch { FilesAndFoldersInfoBar.Severity = InfoBarSeverity.Error; - FilesAndFoldersInfoBar.Message = "An error occurred while creating the Deny policy"; + FilesAndFoldersInfoBar.Message = GlobalVars.Rizz.GetString("ErrorCreatingDenyPolicy"); errorsOccurred = true; @@ -314,7 +314,7 @@ await Task.Run(() => if (!errorsOccurred) { FilesAndFoldersInfoBar.Severity = InfoBarSeverity.Success; - FilesAndFoldersInfoBar.Message = $"Successfully created a Deny policy named '{filesAndFoldersDenyPolicyName}'"; + FilesAndFoldersInfoBar.Message = GlobalVars.Rizz.GetString("DenyPolicyCreatedSuccessfully") + filesAndFoldersDenyPolicyName + "'"; } FilesAndFoldersInfoBar.IsClosable = true; @@ -452,7 +452,8 @@ private void ScalabilityRadialGauge_ValueChanged(object sender, RangeBaseValueCh if (sender is RadialGauge gauge) { // Update the button content with the current value of the gauge - ScalabilityButton.Content = $"Scalability: {gauge.Value:N0}"; + ScalabilityButton.Content = GlobalVars.Rizz.GetString("Scalability") + gauge.Value; + } } @@ -476,7 +477,7 @@ private void ScanLevelComboBox_SelectionChanged(object sender, SelectionChangedE // Since the texts in the ComboBox have spaces in them for user friendliness, we remove the spaces here before parsing them as enum if (!Enum.TryParse(selectedText.Replace(" ", ""), out filesAndFoldersScanLevel)) { - throw new InvalidOperationException($"{selectedText} is not a valid Scan Level"); + throw new InvalidOperationException(GlobalVars.Rizz.GetString("InvalidScanLevel") + selectedText); } @@ -712,7 +713,7 @@ private void PFNRemoveSelectionAppsListButton_Click(object sender, RoutedEventAr private void PFNPackagedAppsListView_SelectionChanged(object sender, SelectionChangedEventArgs e) { int selectedCount = PFNPackagedAppsListView.SelectedItems.Count; - PFNSelectedItemsCount.Text = $"Selected Apps: {selectedCount}"; + PFNSelectedItemsCount.Text = GlobalVars.Rizz.GetString("SelectedApps") + selectedCount; } @@ -748,7 +749,7 @@ private void PFNAppFilteringTextBox_TextChanged(object sender, TextChangedEventA app.DisplayName.Contains(filterText, StringComparison.OrdinalIgnoreCase))) { Key = group.Key // Preserve the group key - }) + }) .Where(group => group.Any())]; // Update the ListView source with the filtered data @@ -804,16 +805,16 @@ private async void CreatePFNDenyPolicyButton_Click(object sender, RoutedEventArg if (PFNPackagedAppsListView.SelectedItems.Count is 0) { CreatePFNDenyPolicyTeachingTip.IsOpen = true; - CreatePFNDenyPolicyTeachingTip.Title = "PFN based Deny policy"; - CreatePFNDenyPolicyTeachingTip.Subtitle = "No app was selected to create a deny policy for"; + CreatePFNDenyPolicyTeachingTip.Title = GlobalVars.Rizz.GetString("PFNBasedDenyPolicyTitle"); + CreatePFNDenyPolicyTeachingTip.Subtitle = GlobalVars.Rizz.GetString("NoAppSelectedForDenyPolicy"); return; } if (string.IsNullOrWhiteSpace(PFNBasedDenyPolicyName)) { CreatePFNDenyPolicyTeachingTip.IsOpen = true; - CreatePFNDenyPolicyTeachingTip.Title = "PFN based Deny policy"; - CreatePFNDenyPolicyTeachingTip.Subtitle = "No policy name was selected for the deny policy"; + CreatePFNDenyPolicyTeachingTip.Title = GlobalVars.Rizz.GetString("PFNBasedDenyPolicyTitle"); + CreatePFNDenyPolicyTeachingTip.Subtitle = GlobalVars.Rizz.GetString("NoPolicyNameSelected"); return; } @@ -831,7 +832,7 @@ private async void CreatePFNDenyPolicyButton_Click(object sender, RoutedEventArg PFNInfoBar.IsClosable = false; PFNInfoBar.IsOpen = true; PFNInfoBar.Severity = InfoBarSeverity.Informational; - PFNInfoBar.Message = "Creating the deny policy based on Package Family Names"; + PFNInfoBar.Message = GlobalVars.Rizz.GetString("CreatingPFNBasedDenyPolicy"); PFNSettingsCard.IsExpanded = true; @@ -885,7 +886,7 @@ await Task.Run(() => if (shouldDeploy) { - string msg4 = "Deploying the Deny policy on the system"; + string msg4 = GlobalVars.Rizz.GetString("DeployingDenyPolicy"); Logger.Write(msg4); @@ -914,7 +915,7 @@ await Task.Run(() => ErrorsOccurred = true; PFNInfoBar.Severity = InfoBarSeverity.Error; - PFNInfoBar.Message = $"There was an error: {ex.Message}"; + PFNInfoBar.Message = GlobalVars.Rizz.GetString("ErrorOccurred") + ex.Message; throw; } @@ -924,7 +925,7 @@ await Task.Run(() => if (!ErrorsOccurred) { PFNInfoBar.Severity = InfoBarSeverity.Success; - PFNInfoBar.Message = "Successfully created the Deny policy"; + PFNInfoBar.Message = GlobalVars.Rizz.GetString("DenyPolicyCreated"); } CreatePFNDenyPolicyButton.IsEnabled = true; diff --git a/AppControl Manager/Pages/CreatePolicy.xaml.cs b/AppControl Manager/Pages/CreatePolicy.xaml.cs index e79a01049..e6ca776a9 100644 --- a/AppControl Manager/Pages/CreatePolicy.xaml.cs +++ b/AppControl Manager/Pages/CreatePolicy.xaml.cs @@ -321,7 +321,7 @@ private async Task AddDriverBlockRulesInfo() { Inlines = { - new Run { Text = "Version: ", FontWeight = FontWeights.Bold, Foreground = new SolidColorBrush(Colors.Violet) }, + new Run { Text = GlobalVars.Rizz.GetString("VersionLabel"), FontWeight = FontWeights.Bold, Foreground = new SolidColorBrush(Colors.Violet) }, new Run { Text = $"{driverBlockListInfo.Version}\n", Foreground = new SolidColorBrush(Colors.Violet) } } }; @@ -330,7 +330,7 @@ private async Task AddDriverBlockRulesInfo() { Inlines = { - new Run { Text = "Last Updated: ", FontWeight = FontWeights.Bold, Foreground = new SolidColorBrush(Colors.HotPink) }, + new Run { Text = GlobalVars.Rizz.GetString("LastUpdatedLabel"), FontWeight = FontWeights.Bold, Foreground = new SolidColorBrush(Colors.HotPink) }, new Run { Text = $"{driverBlockListInfo.LastUpdated:MMMM dd, yyyy}\n", Foreground = new SolidColorBrush(Colors.HotPink) } } }; @@ -345,7 +345,7 @@ private async Task AddDriverBlockRulesInfo() // Handle the case when driver block list info is null Run errorRun = new() { - Text = "Error retrieving driver block list information.", + Text = GlobalVars.Rizz.GetString("DriverBlockListError"), Foreground = new SolidColorBrush(Colors.Yellow) }; formattedTextBlock.Inlines.Add(errorRun); @@ -423,7 +423,7 @@ private async void RecommendedDriverBlockRulesScheduledAutoUpdate_Click(object s RecommendedDriverBlockRulesInfoBar.IsClosable = false; RecommendedDriverBlockRulesInfoBar.IsOpen = true; RecommendedDriverBlockRulesInfoBar.Severity = InfoBarSeverity.Informational; - RecommendedDriverBlockRulesInfoBar.Message = "Configuring Scheduled task for auto update"; + RecommendedDriverBlockRulesInfoBar.Message = GlobalVars.Rizz.GetString("ConfiguringAutoUpdate"); await Task.Run(BasePolicyCreator.SetAutoUpdateDriverBlockRules); } @@ -443,12 +443,12 @@ private async void RecommendedDriverBlockRulesScheduledAutoUpdate_Click(object s if (errorsOccurred) { RecommendedDriverBlockRulesInfoBar.Severity = InfoBarSeverity.Error; - RecommendedDriverBlockRulesInfoBar.Message = $"An error occurred."; + RecommendedDriverBlockRulesInfoBar.Message = GlobalVars.Rizz.GetString("AutoUpdateError"); } else { RecommendedDriverBlockRulesInfoBar.Severity = InfoBarSeverity.Success; - RecommendedDriverBlockRulesInfoBar.Message = "Successfully configured scheduled task to keep the Microsoft Drivers Block Rules up to date"; + RecommendedDriverBlockRulesInfoBar.Message = GlobalVars.Rizz.GetString("AutoUpdateConfigured"); } } @@ -520,8 +520,8 @@ private async void StrictKernelModePolicyCreateButton_Click(object sender, Route try { - StrictKernelModePolicyInfoBar.Message = "Creating the Strict Kernel-mode policy"; - Logger.Write("Creating the Strict Kernel-mode policy"); + StrictKernelModePolicyInfoBar.Message = GlobalVars.Rizz.GetString("CreatingPolicy"); + Logger.Write(GlobalVars.Rizz.GetString("CreatingPolicy")); StrictKernelModePolicyInfoBar.Severity = InfoBarSeverity.Informational; await Task.Run(() => @@ -535,7 +535,7 @@ await Task.Run(() => { StrictKernelModePolicyInfoBar.Severity = InfoBarSeverity.Error; - StrictKernelModePolicyInfoBar.Message = $"There was an error creating Strict Kernel-mode policy: {ex.Message}"; + StrictKernelModePolicyInfoBar.Message = GlobalVars.Rizz.GetString("PolicyCreationError") + ex.Message; errorsOccurred = true; @@ -546,8 +546,8 @@ await Task.Run(() => if (!errorsOccurred) { StrictKernelModePolicyInfoBar.Severity = InfoBarSeverity.Success; - StrictKernelModePolicyInfoBar.Message = "Successfully created the Strict Kernel-mode policy"; - Logger.Write("Successfully created the Strict Kernel-mode policy"); + StrictKernelModePolicyInfoBar.Message = GlobalVars.Rizz.GetString("PolicyCreatedSuccessfully"); + Logger.Write(GlobalVars.Rizz.GetString("PolicyCreatedSuccessfully")); } StrictKernelModePolicyInfoBar.IsClosable = true; diff --git a/AppControl Manager/Pages/CreateSupplementalPolicy.xaml.cs b/AppControl Manager/Pages/CreateSupplementalPolicy.xaml.cs index 4c575f8eb..d70bcdf3a 100644 --- a/AppControl Manager/Pages/CreateSupplementalPolicy.xaml.cs +++ b/AppControl Manager/Pages/CreateSupplementalPolicy.xaml.cs @@ -655,11 +655,11 @@ await Task.Run(() => string OutputPath = Path.Combine(GlobalVars.UserConfigDir, $"{filesAndFoldersSupplementalPolicyName}.xml"); - // Instantiate the user selected Base policy - To get its BasePolicyID - CodeIntegrityPolicy codeIntegrityPolicy = new(filesAndFoldersBasePolicyPath, null); + // Instantiate the user selected Base policy + SiPolicy.SiPolicy policyObj = Management.Initialize(filesAndFoldersBasePolicyPath, null); // Set the BasePolicyID of our new policy to the one from user selected policy - string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, filesAndFoldersSupplementalPolicyName, codeIntegrityPolicy.BasePolicyID, null); + string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, filesAndFoldersSupplementalPolicyName, policyObj.BasePolicyID, null); // Configure policy rule options CiRuleOptions.Set(filePath: EmptyPolicyPath, template: CiRuleOptions.PolicyTemplate.Supplemental); @@ -991,11 +991,11 @@ await Task.Run(() => string OutputPath = Path.Combine(GlobalVars.UserConfigDir, $"{CertificatesBasedSupplementalPolicyName}.xml"); - // Instantiate the user selected Base policy - To get its BasePolicyID - CodeIntegrityPolicy codeIntegrityPolicy = new(CertificatesBasedBasePolicyPath, null); + // Instantiate the user selected Base policy + SiPolicy.SiPolicy policyObj = Management.Initialize(CertificatesBasedBasePolicyPath, null); // Set the BasePolicyID of our new policy to the one from user selected policy - string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, CertificatesBasedSupplementalPolicyName, codeIntegrityPolicy.BasePolicyID, null); + string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, CertificatesBasedSupplementalPolicyName, policyObj.BasePolicyID, null); // Configure policy rule options CiRuleOptions.Set(filePath: EmptyPolicyPath, template: CiRuleOptions.PolicyTemplate.Supplemental); @@ -1152,10 +1152,10 @@ await Task.Run(() => string cipPath = Path.Combine(stagingArea.FullName, "ISGBasedSupplementalPolicy.cip"); // Instantiate the user-selected base policy - CodeIntegrityPolicy basePolicyObj = new(ISGBasedBasePolicyPath, null); + SiPolicy.SiPolicy basePolicyObj = Management.Initialize(ISGBasedBasePolicyPath, null); // Instantiate the supplemental policy - SiPolicy.SiPolicy supplementalPolicyObj = Management.Initialize(GlobalVars.ISGOnlySupplementalPolicyPath); + SiPolicy.SiPolicy supplementalPolicyObj = Management.Initialize(GlobalVars.ISGOnlySupplementalPolicyPath, null); // If policy name was provided by user if (!string.IsNullOrWhiteSpace(ISGBasedSupplementalPolicyName)) @@ -1564,10 +1564,10 @@ await Task.Run(() => string OutputPath = Path.Combine(GlobalVars.UserConfigDir, $"{policyNameChosenByUser}.xml"); // Instantiate the user selected Base policy - To get its BasePolicyID - CodeIntegrityPolicy codeIntegrityPolicy = new(StrictKernelModeBasePolicyPath, null); + SiPolicy.SiPolicy policyObj = Management.Initialize(StrictKernelModeBasePolicyPath, null); // Set the BasePolicyID of our new policy to the one from user selected policy - string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, policyNameChosenByUser, codeIntegrityPolicy.BasePolicyID, null); + string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, policyNameChosenByUser, policyObj.BasePolicyID, null); // Configure policy rule options CiRuleOptions.Set(filePath: EmptyPolicyPath, template: CiRuleOptions.PolicyTemplate.Supplemental); @@ -2177,11 +2177,11 @@ await Task.Run(() => string OutputPath = Path.Combine(GlobalVars.UserConfigDir, $"{PFNBasedSupplementalPolicyName}.xml"); - // Instantiate the user selected Base policy - To get its BasePolicyID - CodeIntegrityPolicy codeIntegrityPolicy = new(PFNBasePolicyPath, null); + // Instantiate the user selected Base policy + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(PFNBasePolicyPath, null); // Set the BasePolicyID of our new policy to the one from user selected policy - string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, PFNBasedSupplementalPolicyName, codeIntegrityPolicy.BasePolicyID, null); + string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, PFNBasedSupplementalPolicyName, policyObj.BasePolicyID, null); // Configure policy rule options CiRuleOptions.Set(filePath: EmptyPolicyPath, template: CiRuleOptions.PolicyTemplate.Supplemental); diff --git a/AppControl Manager/Pages/Deployment.xaml.cs b/AppControl Manager/Pages/Deployment.xaml.cs index 7f988f05d..0c46380fc 100644 --- a/AppControl Manager/Pages/Deployment.xaml.cs +++ b/AppControl Manager/Pages/Deployment.xaml.cs @@ -37,7 +37,7 @@ public Deployment() if (GlobalVars.IsOlderThan24H2) { DeploySignedXMLButton.IsEnabled = false; - DeploySignedXMLButtonContentTextBlock.Text = "Requires Windows 11 24H2 or later"; + DeploySignedXMLButtonContentTextBlock.Text = GlobalVars.Rizz.GetString("RequiresWindows1124H2"); } } @@ -63,8 +63,8 @@ public void SetVisibility(Visibility visibility, string? unsignedBasePolicyPath, if (visibility is Visibility.Visible) { // Assign sidebar buttons' content texts - button1.Content = "Deploy Unsigned Policy"; - button2.Content = "Deploy Signed Policy"; + button1.Content = GlobalVars.Rizz.GetString("DeployUnsignedPolicy"); + button2.Content = GlobalVars.Rizz.GetString("DeploySignedPolicy"); // Assign a local event handler to the sidebar button button1.Click += LightUp1; @@ -141,7 +141,7 @@ private async void DeployUnsignedXMLButton_Click(object sender, RoutedEventArgs StatusInfoBar.Visibility = Visibility.Visible; StatusInfoBar.IsOpen = true; - StatusInfoBar.Message = $"Deploying {XMLFiles.Count} unsigned XML files."; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeployingXMLFiles") + XMLFiles.Count + GlobalVars.Rizz.GetString("UnsignedXMLFiles"); StatusInfoBar.Severity = InfoBarSeverity.Informational; StatusInfoBar.IsClosable = false; @@ -158,11 +158,11 @@ await Task.Run(async () => { // Instantiate the policy - SiPolicy.SiPolicy policyObject = Management.Initialize(file); + SiPolicy.SiPolicy policyObject = Management.Initialize(file, null); if (policyObject.Rules is null || !policyObject.Rules.Any(rule => rule.Item is OptionType.EnabledUnsignedSystemIntegrityPolicy)) { - throw new InvalidOperationException($"The XML file '{file}' is a signed policy, use the signed policy deployment section instead!"); + throw new InvalidOperationException(GlobalVars.Rizz.GetString("SignedPolicyError") + file + "'"); } string randomString = GUIDGenerator.GenerateUniqueGUID(); @@ -173,7 +173,7 @@ await Task.Run(async () => _ = DispatcherQueue.TryEnqueue(() => { - StatusInfoBar.Message = $"Currently Deploying XML file: '{file}'"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeployingXMLFile") + file + "'"; }); // Convert the XML file to CIP @@ -221,7 +221,7 @@ await Task.Run(async () => errorsOccurred = true; StatusInfoBar.Severity = InfoBarSeverity.Error; - StatusInfoBar.Message = "There was an error deploying the selected XML files"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeploymentError"); throw; } @@ -230,7 +230,7 @@ await Task.Run(async () => if (!errorsOccurred) { StatusInfoBar.Severity = InfoBarSeverity.Success; - StatusInfoBar.Message = "Successfully deployed all of the selected XML files"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeploymentSuccess"); // Clear the lists at the end if no errors occurred XMLFiles.Clear(); @@ -305,7 +305,7 @@ private async void DeploySignedXMLButton_Click(object sender, RoutedEventArgs e) StatusInfoBar.Visibility = Visibility.Visible; StatusInfoBar.IsOpen = true; - StatusInfoBar.Message = $"Deploying {SignedXMLFiles.Count} Signed XML files."; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeployingSignedXMLFiles") + SignedXMLFiles.Count + GlobalVars.Rizz.GetString("SignedXMLFiles"); StatusInfoBar.Severity = InfoBarSeverity.Informational; StatusInfoBar.IsClosable = false; @@ -323,7 +323,7 @@ await Task.Run(async () => _ = DispatcherQueue.TryEnqueue(() => { - StatusInfoBar.Message = $"Currently Deploying XML file: '{file}'"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeployingXMLFile") + file + "'"; }); @@ -331,7 +331,7 @@ await Task.Run(async () => SiPolicy.SiPolicy policyObject = AddSigningDetails.Add(file, CertPath); // Remove the unsigned policy rule option from the policy - CiRuleOptions.Set(filePath: file, rulesToRemove: [CiRuleOptions.PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy]); + CiRuleOptions.Set(filePath: file, rulesToRemove: [SiPolicy.OptionType.EnabledUnsignedSystemIntegrityPolicy]); // Define the path for the CIP file string randomString = GUIDGenerator.GenerateUniqueGUID(); @@ -365,7 +365,7 @@ await Task.Run(async () => if (possibleAlreadyDeployedUnsignedVersion is not null) { - Logger.Write($"A policy with the same PolicyID {possibleAlreadyDeployedUnsignedVersion.PolicyID} is already deployed on the system in Unsigned version. Removing it before deployed the signed version to prevent boot failures."); + Logger.Write(GlobalVars.Rizz.GetString("PolicyConflictMessage") + possibleAlreadyDeployedUnsignedVersion.PolicyID + GlobalVars.Rizz.GetString("RemovingPolicy")); CiToolHelper.RemovePolicy(possibleAlreadyDeployedUnsignedVersion.PolicyID!); } @@ -400,7 +400,7 @@ await Task.Run(async () => errorsOccurred = true; StatusInfoBar.Severity = InfoBarSeverity.Error; - StatusInfoBar.Message = "There was an error deploying the selected XML files"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeploymentError"); throw; } @@ -409,7 +409,7 @@ await Task.Run(async () => if (!errorsOccurred) { StatusInfoBar.Severity = InfoBarSeverity.Success; - StatusInfoBar.Message = "Successfully deployed all of the selected XML files as Signed policies"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("SignedDeploymentSuccess"); // Clear the lists at the end if no errors occurred SignedXMLFiles.Clear(); @@ -454,7 +454,7 @@ private async void DeployCIPButton_Click(object sender, RoutedEventArgs e) StatusInfoBar.Visibility = Visibility.Visible; StatusInfoBar.IsOpen = true; - StatusInfoBar.Message = $"Deploying {CIPFiles.Count} CIP binary files."; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeployingCIPFiles") + CIPFiles.Count + GlobalVars.Rizz.GetString("CIPFiles"); StatusInfoBar.Severity = InfoBarSeverity.Informational; StatusInfoBar.IsClosable = false; @@ -467,7 +467,7 @@ await Task.Run(async () => { _ = DispatcherQueue.TryEnqueue(() => { - StatusInfoBar.Message = $"Currently Deploying CIP file: '{file}'"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeployingCIPFile") + file + "'"; }); string randomPolicyID = Guid.CreateVersion7().ToString().ToUpperInvariant(); @@ -491,7 +491,7 @@ await Task.Run(async () => errorsOccurred = true; StatusInfoBar.Severity = InfoBarSeverity.Error; - StatusInfoBar.Message = "There was an error deploying the selected CIP files"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("DeploymentError"); throw; } @@ -500,7 +500,7 @@ await Task.Run(async () => if (!errorsOccurred) { StatusInfoBar.Severity = InfoBarSeverity.Success; - StatusInfoBar.Message = "Successfully deployed all of the selected CIP files"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("CIPDeploymentSuccess"); // Clear the list at the end if no errors occurred CIPFiles.Clear(); @@ -642,7 +642,7 @@ private async void IntuneSignInButton_Click(object sender, RoutedEventArgs e) { StatusInfoBar.Visibility = Visibility.Visible; StatusInfoBar.IsOpen = true; - StatusInfoBar.Message = "Signing into Intune"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("SigningIntoIntune"); StatusInfoBar.Severity = InfoBarSeverity.Informational; StatusInfoBar.IsClosable = false; @@ -652,12 +652,12 @@ private async void IntuneSignInButton_Click(object sender, RoutedEventArgs e) await MicrosoftGraph.SignIn(MicrosoftGraph.AuthenticationContext.Intune); - StatusInfoBar.Message = "Successfully signed into Intune"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("IntuneSignInSuccess"); StatusInfoBar.Severity = InfoBarSeverity.Success; deployToIntune = true; - LocalIntuneStatusTextBox.Text = "Cloud Deployment is Currently Active"; + LocalIntuneStatusTextBox.Text = GlobalVars.Rizz.GetString("CloudDeploymentActive"); // Enable the sign out button IntuneSignOutButton.IsEnabled = true; @@ -671,14 +671,14 @@ private async void IntuneSignInButton_Click(object sender, RoutedEventArgs e) catch (OperationCanceledException) { signInSuccessful = false; - Logger.Write("Sign in to Intune was cancelled by the user"); - StatusInfoBar.Message = "Sign in to Intune was cancelled by the user"; + Logger.Write(GlobalVars.Rizz.GetString("IntuneSignInCancelled")); + StatusInfoBar.Message = GlobalVars.Rizz.GetString("IntuneSignInCancelledMessage"); StatusInfoBar.Severity = InfoBarSeverity.Warning; } catch (Exception ex) { - StatusInfoBar.Message = $"There was an error signing into Intune: {ex.Message}"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("IntuneSignInError") + ex.Message; StatusInfoBar.Severity = InfoBarSeverity.Error; throw; @@ -709,7 +709,7 @@ private async void IntuneSignOutButton_Click(object sender, RoutedEventArgs e) { StatusInfoBar.Visibility = Visibility.Visible; StatusInfoBar.IsOpen = true; - StatusInfoBar.Message = "Signing out of Intune"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("SigningOutOfIntune"); StatusInfoBar.Severity = InfoBarSeverity.Informational; StatusInfoBar.IsClosable = false; @@ -722,18 +722,18 @@ private async void IntuneSignOutButton_Click(object sender, RoutedEventArgs e) // Enable the Sign in button IntuneSignInButton.IsEnabled = true; - StatusInfoBar.Message = "Successfully signed out of Intune"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("IntuneSignOutSuccess"); StatusInfoBar.Severity = InfoBarSeverity.Success; deployToIntune = false; IntuneGroupsComboBox.IsEnabled = false; RefreshIntuneGroupsButton.IsEnabled = false; - LocalIntuneStatusTextBox.Text = "Local Deployment is Currently Active"; + LocalIntuneStatusTextBox.Text = GlobalVars.Rizz.GetString("LocalDeploymentActive"); } catch (Exception ex) { - StatusInfoBar.Message = $"There was an error signing out of Intune: {ex.Message}"; + StatusInfoBar.Message = GlobalVars.Rizz.GetString("IntuneSignOutError") + ex.Message; StatusInfoBar.Severity = InfoBarSeverity.Error; throw; @@ -781,7 +781,7 @@ await Task.Run(() => if (xmlFile is not null) { - SiPolicy.SiPolicy policyObj = Management.Initialize(xmlFile); + SiPolicy.SiPolicy policyObj = Management.Initialize(xmlFile, null); // Finding the policy name in the settings Setting? nameSetting = policyObj.Settings.FirstOrDefault(x => diff --git a/AppControl Manager/Pages/EventLogsPolicyCreation.xaml.cs b/AppControl Manager/Pages/EventLogsPolicyCreation.xaml.cs index 842689c01..4e9ed3d1d 100644 --- a/AppControl Manager/Pages/EventLogsPolicyCreation.xaml.cs +++ b/AppControl Manager/Pages/EventLogsPolicyCreation.xaml.cs @@ -868,11 +868,11 @@ await Task.Run(() => { string OutputPath = Path.Combine(GlobalVars.UserConfigDir, $"{policyName}.xml"); - // Instantiate the user selected Base policy - To get its BasePolicyID - CodeIntegrityPolicy codeIntegrityPolicy = new(BasePolicyXMLFile, null); + // Instantiate the user selected Base policy + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(BasePolicyXMLFile, null); // Set the BasePolicyID of our new policy to the one from user selected policy - string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, policyName, codeIntegrityPolicy.BasePolicyID, null); + string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, policyName, policyObj.BasePolicyID, null); // Configure policy rule options CiRuleOptions.Set(filePath: EmptyPolicyPath, template: CiRuleOptions.PolicyTemplate.Supplemental); diff --git a/AppControl Manager/Pages/GetSecurePolicySettings.xaml.cs b/AppControl Manager/Pages/GetSecurePolicySettings.xaml.cs index 186ad7e16..d5f7a24dd 100644 --- a/AppControl Manager/Pages/GetSecurePolicySettings.xaml.cs +++ b/AppControl Manager/Pages/GetSecurePolicySettings.xaml.cs @@ -1,5 +1,6 @@ using System.Globalization; using AppControlManager.Main; +using AppControlManager.Others; using Microsoft.UI.Xaml; using Microsoft.UI.Xaml.Controls; using Microsoft.UI.Xaml.Navigation; @@ -27,9 +28,9 @@ private void InvokeButton_Click(object sender, RoutedEventArgs e) // Check if all fields are filled if (string.IsNullOrWhiteSpace(provider) || string.IsNullOrWhiteSpace(key) || string.IsNullOrWhiteSpace(valueName)) { - InfoBar.Message = "Please fill in all three fields."; + InfoBar.Message = GlobalVars.Rizz.GetString("GetSecurePolicySettings_FillAllFields"); InfoBar.Severity = InfoBarSeverity.Warning; - InfoBar.Title = "Input Required"; + InfoBar.Title = GlobalVars.Rizz.GetString("GetSecurePolicySettings_InputRequired"); InfoBar.IsOpen = true; return; } @@ -39,16 +40,16 @@ private void InvokeButton_Click(object sender, RoutedEventArgs e) if (result.StatusCode is not 0) { - InfoBar.Message = "There is no policy deployed on the system that contains the selected secure setting."; + InfoBar.Message = GlobalVars.Rizz.GetString("GetSecurePolicySettings_NoPolicyMessage"); InfoBar.Severity = InfoBarSeverity.Informational; - InfoBar.Title = "Policy not found"; + InfoBar.Title = GlobalVars.Rizz.GetString("GetSecurePolicySettings_PolicyNotFound"); InfoBar.IsOpen = true; } else { - InfoBar.Message = "A policy with the selected secure setting details is currently deployed on the system."; + InfoBar.Message = GlobalVars.Rizz.GetString("GetSecurePolicySettings_PolicyFoundMessage"); InfoBar.Severity = InfoBarSeverity.Success; - InfoBar.Title = "Policy found"; + InfoBar.Title = GlobalVars.Rizz.GetString("GetSecurePolicySettings_PolicyFound"); InfoBar.IsOpen = true; } diff --git a/AppControl Manager/Pages/Logs.xaml b/AppControl Manager/Pages/Logs.xaml index f8ad948fd..f357fcef6 100644 --- a/AppControl Manager/Pages/Logs.xaml +++ b/AppControl Manager/Pages/Logs.xaml @@ -65,4 +65,3 @@ - \ No newline at end of file diff --git a/AppControl Manager/Pages/MDEAHPolicyCreation.xaml b/AppControl Manager/Pages/MDEAHPolicyCreation.xaml index 8f871e79e..a5ac642a7 100644 --- a/AppControl Manager/Pages/MDEAHPolicyCreation.xaml +++ b/AppControl Manager/Pages/MDEAHPolicyCreation.xaml @@ -165,12 +165,12 @@ - diff --git a/AppControl Manager/Pages/MDEAHPolicyCreation.xaml.cs b/AppControl Manager/Pages/MDEAHPolicyCreation.xaml.cs index 9819c8ded..852c80a16 100644 --- a/AppControl Manager/Pages/MDEAHPolicyCreation.xaml.cs +++ b/AppControl Manager/Pages/MDEAHPolicyCreation.xaml.cs @@ -911,11 +911,11 @@ await Task.Run(() => { string OutputPath = Path.Combine(GlobalVars.UserConfigDir, $"{policyName}.xml"); - // Instantiate the user selected Base policy - To get its BasePolicyID - CodeIntegrityPolicy codeIntegrityPolicy = new(BasePolicyXMLFile, null); + // Instantiate the user selected Base policy + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(BasePolicyXMLFile, null); // Set the BasePolicyID of our new policy to the one from user selected policy - string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, policyName, codeIntegrityPolicy.BasePolicyID, null); + string supplementalPolicyID = SetCiPolicyInfo.Set(EmptyPolicyPath, true, policyName, policyObj.BasePolicyID, null); // Configure policy rule options CiRuleOptions.Set(filePath: EmptyPolicyPath, template: CiRuleOptions.PolicyTemplate.Supplemental); diff --git a/AppControl Manager/Pages/MergePolicies.xaml.cs b/AppControl Manager/Pages/MergePolicies.xaml.cs index 07e380994..20e887422 100644 --- a/AppControl Manager/Pages/MergePolicies.xaml.cs +++ b/AppControl Manager/Pages/MergePolicies.xaml.cs @@ -43,16 +43,16 @@ private async void MergeButton_Click(object sender, RoutedEventArgs e) if (string.IsNullOrWhiteSpace(mainPolicy)) { MergeButtonTeachingTip.IsOpen = true; - MergeButtonTeachingTip.Title = "Select main policy XML"; - MergeButtonTeachingTip.Subtitle = "You need to select an XML file as the main policy"; + MergeButtonTeachingTip.Title = GlobalVars.Rizz.GetString("MergePolicies_SelectMainPolicyXML"); + MergeButtonTeachingTip.Subtitle = GlobalVars.Rizz.GetString("MergePolicies_SelectMainPolicySubtitle"); return; } if (otherPolicies.Count is 0) { MergeButtonTeachingTip.IsOpen = true; - MergeButtonTeachingTip.Title = "Select other policies"; - MergeButtonTeachingTip.Subtitle = "You need to select at least one more policy to merge with the main policy"; + MergeButtonTeachingTip.Title = GlobalVars.Rizz.GetString("MergePolicies_SelectOtherPolicies"); + MergeButtonTeachingTip.Subtitle = GlobalVars.Rizz.GetString("MergePolicies_SelectOtherPoliciesSubtitle"); return; } @@ -66,7 +66,7 @@ private async void MergeButton_Click(object sender, RoutedEventArgs e) PolicyMergerInfoBar.IsOpen = true; - PolicyMergerInfoBar.Message = "Merging the policies"; + PolicyMergerInfoBar.Message = GlobalVars.Rizz.GetString("MergePolicies_MergingMessage"); MergeProgressRing.Visibility = Visibility.Visible; @@ -84,12 +84,12 @@ await Task.Run(() => _ = DispatcherQueue.TryEnqueue(() => { - PolicyMergerInfoBar.Message = "Deploying the main policy after merge."; + PolicyMergerInfoBar.Message = GlobalVars.Rizz.GetString("MergePolicies_DeployingMessage"); }); - string stagingArea = StagingArea.NewStagingArea("PolicyMerger").FullName; + string stagingArea = StagingArea.NewStagingArea(GlobalVars.Rizz.GetString("MergePolicies_StagingAreaName")).FullName; - string CIPPath = Path.Combine(stagingArea, "MergedPolicy.cip"); + string CIPPath = Path.Combine(stagingArea, GlobalVars.Rizz.GetString("MergePolicies_MergedPolicyFileName")); PolicyToCIPConverter.Convert(mainPolicy, CIPPath); @@ -109,12 +109,12 @@ await Task.Run(() => if (errorsOccurred) { PolicyMergerInfoBar.Severity = InfoBarSeverity.Error; - PolicyMergerInfoBar.Message = "An error occurred during the merge process"; + PolicyMergerInfoBar.Message = GlobalVars.Rizz.GetString("MergePolicies_ErrorMessage"); } else { PolicyMergerInfoBar.Severity = InfoBarSeverity.Success; - PolicyMergerInfoBar.Message = "Policies have been merged successfully"; + PolicyMergerInfoBar.Message = GlobalVars.Rizz.GetString("MergePolicies_SuccessMessage"); } PolicyMergerInfoBar.IsClosable = true; diff --git a/AppControl Manager/Pages/SystemInformation/ViewCurrentPolicies.xaml.cs b/AppControl Manager/Pages/SystemInformation/ViewCurrentPolicies.xaml.cs index da28a87b8..b0f4a4b2c 100644 --- a/AppControl Manager/Pages/SystemInformation/ViewCurrentPolicies.xaml.cs +++ b/AppControl Manager/Pages/SystemInformation/ViewCurrentPolicies.xaml.cs @@ -121,7 +121,7 @@ private async void RetrievePolicies() } // Update the UI once the task completes - PoliciesCountTextBlock.Text = $"Number of Policies: {policies.Count}"; + PoliciesCountTextBlock.Text = GlobalVars.Rizz.GetString("NumberOfPolicies") + policies.Count; DeployedPolicies.ItemsSource = AllPolicies; } @@ -165,7 +165,7 @@ private void SearchBox_TextChanged(object sender, TextChangedEventArgs e) } // Update the policies count text - PoliciesCountTextBlock.Text = $"Number of Policies: {filteredResults.Count}"; + PoliciesCountTextBlock.Text = GlobalVars.Rizz.GetString("NumberOfPolicies") + filteredResults.Count; } @@ -269,12 +269,12 @@ await Task.Run(() => // Create and display a ContentDialog with Yes and No options ContentDialog dialog = new() { - Title = "WARNING", - Content = $"The policy '{GlobalVars.AppControlManagerSpecialPolicyName}' must not be manually removed because you WILL NOT BE ABLE TO USE APPCONTROL MANAGER AGAIN. It is automatically removed when its corresponding base policy is removed from the system. Are you sure you still want to remove it manually?", - PrimaryButtonText = "Yes", + Title = GlobalVars.Rizz.GetString("WarningTitle"), + Content = GlobalVars.Rizz.GetString("ManualRemovalWarning") + GlobalVars.AppControlManagerSpecialPolicyName + "' " + GlobalVars.Rizz.GetString("ManualRemovalWarningEnd"), + PrimaryButtonText = GlobalVars.Rizz.GetString("Yes"), BorderBrush = Application.Current.Resources["AccentFillColorDefaultBrush"] as Brush ?? new SolidColorBrush(Colors.Transparent), BorderThickness = new Thickness(1), - CloseButtonText = "No", + CloseButtonText = GlobalVars.Rizz.GetString("No"), XamlRoot = this.XamlRoot // Set XamlRoot to the current page's XamlRoot }; @@ -356,9 +356,9 @@ await Task.Run(() => // Create and display a ContentDialog ContentDialog dialog = new() { - Title = "Warning", - Content = $"Before you can safely remove the signed policy named '{policy.FriendlyName}' with the ID '{policy.PolicyID}', you must restart your system.", - PrimaryButtonText = "I Understand", + Title = GlobalVars.Rizz.GetString("WarningTitle"), + Content = GlobalVars.Rizz.GetString("RestartRequired") + policy.FriendlyName + "' " + GlobalVars.Rizz.GetString("RestartRequiredEnd") + policy.PolicyID + "')", + PrimaryButtonText = GlobalVars.Rizz.GetString("Understand"), BorderBrush = Application.Current.Resources["AccentFillColorDefaultBrush"] as Brush ?? new SolidColorBrush(Colors.Transparent), BorderThickness = new Thickness(1), XamlRoot = this.XamlRoot // Set XamlRoot to the current page's XamlRoot @@ -410,7 +410,7 @@ await Task.Run(() => #endregion // Add the unsigned policy rule option to the policy - CiRuleOptions.Set(filePath: XMLPolicyPath, rulesToAdd: [CiRuleOptions.PolicyRuleOptions.EnabledUnsignedSystemIntegrityPolicy]); + CiRuleOptions.Set(filePath: XMLPolicyPath, rulesToAdd: [SiPolicy.OptionType.EnabledUnsignedSystemIntegrityPolicy]); // Making sure SupplementalPolicySigners do not exist in the XML policy CiPolicyHandler.RemoveSupplementalSigners(XMLPolicyPath); @@ -434,7 +434,7 @@ await Task.Run(() => // Deploy the signed CIP file CiToolHelper.UpdatePolicy(CIPFilePath); - SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(XMLPolicyPath); + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(XMLPolicyPath, null); // The time of first stage of the signed policy removal // Since policy object has the full ID, in upper case with curly brackets, @@ -566,16 +566,16 @@ private void DeployedPoliciesDataGrid_Loaded(object sender, RoutedEventArgs e) // Create a dictionary to map headers to their specific click event methods Dictionary copyActions = new() { - { "Policy ID", CopyPolicyID_Click }, - { "Base Policy ID", CopyBasePolicyID_Click }, - { "Friendly Name", CopyFriendlyName_Click }, - { "Version", CopyVersion_Click }, - { "Is Authorized", CopyIsAuthorized_Click }, - { "Is Enforced", CopyIsEnforced_Click }, - { "Is On Disk", CopyIsOnDisk_Click }, - { "Is Signed Policy", CopyIsSignedPolicy_Click }, - { "Is System Policy", CopyIsSystemPolicy_Click }, - { "Policy Options", CopyPolicyOptionsDisplay_Click } + { GlobalVars.Rizz.GetString("PolicyIDHeader"), CopyPolicyID_Click }, + { GlobalVars.Rizz.GetString("BasePolicyIDHeader"), CopyBasePolicyID_Click }, + { GlobalVars.Rizz.GetString("FriendlyNameHeader"), CopyFriendlyName_Click }, + { GlobalVars.Rizz.GetString("VersionHeader"), CopyVersion_Click }, + { GlobalVars.Rizz.GetString("IsAuthorizedHeader"), CopyIsAuthorized_Click }, + { GlobalVars.Rizz.GetString("IsEnforcedHeader"), CopyIsEnforced_Click }, + { GlobalVars.Rizz.GetString("IsOnDiskHeader"), CopyIsOnDisk_Click }, + { GlobalVars.Rizz.GetString("IsSignedPolicyHeader"), CopyIsSignedPolicy_Click }, + { GlobalVars.Rizz.GetString("IsSystemPolicyHeader"), CopyIsSystemPolicy_Click }, + { GlobalVars.Rizz.GetString("PolicyOptionsHeader"), CopyPolicyOptionsDisplay_Click } }; // Add menu items with specific click events for each column @@ -586,7 +586,7 @@ private void DeployedPoliciesDataGrid_Loaded(object sender, RoutedEventArgs e) if (copyActions.TryGetValue(headerText, out RoutedEventHandler? value)) { // Create a new MenuFlyout Item - MenuFlyoutItem menuItem = new() { Text = $"Copy {headerText}" }; + MenuFlyoutItem menuItem = new() { Text = GlobalVars.Rizz.GetString("Copy") + headerText }; // Set the click event for the menu item menuItem.Click += value; @@ -670,16 +670,16 @@ private static string ConvertRowToText(CiPolicyInfo row) { // Use StringBuilder to format each property with its label for easy reading return new StringBuilder() - .AppendLine($"Policy ID: {row.PolicyID}") - .AppendLine($"Base Policy ID: {row.BasePolicyID}") - .AppendLine($"Friendly Name: {row.FriendlyName}") - .AppendLine($"Version: {row.Version}") - .AppendLine($"Is Authorized: {row.IsAuthorized}") - .AppendLine($"Is Enforced: {row.IsEnforced}") - .AppendLine($"Is On Disk: {row.IsOnDisk}") - .AppendLine($"Is Signed Policy: {row.IsSignedPolicy}") - .AppendLine($"Is System Policy: {row.IsSystemPolicy}") - .AppendLine($"Policy Options: {row.PolicyOptionsDisplay}") + .AppendLine(GlobalVars.Rizz.GetString("PolicyIDLabel") + row.PolicyID) + .AppendLine(GlobalVars.Rizz.GetString("BasePolicyIDLabel") + row.BasePolicyID) + .AppendLine(GlobalVars.Rizz.GetString("FriendlyNameLabel") + row.FriendlyName) + .AppendLine(GlobalVars.Rizz.GetString("VersionLabel") + row.Version) + .AppendLine(GlobalVars.Rizz.GetString("IsAuthorizedLabel") + row.IsAuthorized) + .AppendLine(GlobalVars.Rizz.GetString("IsEnforcedLabel") + row.IsEnforced) + .AppendLine(GlobalVars.Rizz.GetString("IsOnDiskLabel") + row.IsOnDisk) + .AppendLine(GlobalVars.Rizz.GetString("IsSignedPolicyLabel") + row.IsSignedPolicy) + .AppendLine(GlobalVars.Rizz.GetString("IsSystemPolicyLabel") + row.IsSystemPolicy) + .AppendLine(GlobalVars.Rizz.GetString("PolicyOptionsLabel") + row.PolicyOptionsDisplay) .ToString(); } @@ -712,18 +712,18 @@ private static bool VerifyRemovalEligibility(string policyID) // When system was last reboot DateTime lastRebootTimeUtc = DateTime.UtcNow - TimeSpan.FromMilliseconds(Environment.TickCount64); - Logger.Write($"System's last reboot was {lastRebootTimeUtc} (UTC)"); + Logger.Write(GlobalVars.Rizz.GetString("LastRebootTime") + lastRebootTimeUtc + " (UTC)"); // When the policy's 1st stage was completed DateTime? stage1RemovalTime = UserConfiguration.QuerySignedPolicyStage1RemovalTime(policyID); if (stage1RemovalTime is not null) { - Logger.Write($"Signed policy with the ID '{policyID}' completed its 1st stage at {stage1RemovalTime} (UTC)"); + Logger.Write(GlobalVars.Rizz.GetString("PolicyStage1Completed") + policyID + "' " + GlobalVars.Rizz.GetString("CompletedAt") + stage1RemovalTime + " (UTC)"); if (stage1RemovalTime < lastRebootTimeUtc) { - Logger.Write("Signed policy is safe to be removed because system was restarted after 1st stage"); + Logger.Write(GlobalVars.Rizz.GetString("PolicySafeToRemove")); return true; } @@ -767,10 +767,10 @@ private async void SwapPolicyComboBox_SelectionChanged(object sender, SelectionC SolidColorBrush hotPinkBrush = new(Colors.HotPink); // Create normal text runs - Run normalText1 = new() { Text = "The selected policy with the name " }; - Run normalText2 = new() { Text = " and ID " }; - Run normalText3 = new() { Text = " will be changed to the type " }; - Run normalText4 = new() { Text = "It will be re-deployed on the system with the same Policy ID and Base Policy ID. If it's currently in Audit Mode, it will be in Enforced Mode after this operation is completed." }; + Run normalText1 = new() { Text = GlobalVars.Rizz.GetString("SelectedPolicyName") }; + Run normalText2 = new() { Text = GlobalVars.Rizz.GetString("AndID") }; + Run normalText3 = new() { Text = GlobalVars.Rizz.GetString("WillBeChangedTo") }; + Run normalText4 = new() { Text = GlobalVars.Rizz.GetString("PolicyRedeployInfo") }; // Create colored runs Run accentPolicyName = new() { Text = selectedPolicy.FriendlyName, Foreground = violetBrush }; @@ -779,7 +779,7 @@ private async void SwapPolicyComboBox_SelectionChanged(object sender, SelectionC // Create bold text run Bold boldText = new(); - boldText.Inlines.Add(new Run() { Text = "Any existing Supplemental policy will continue to work." }); + boldText.Inlines.Add(new Run() { Text = GlobalVars.Rizz.GetString("SupplementalPolicyContinues") }); // Add runs to the TextBlock formattedTextBlock.Inlines.Add(normalText1); @@ -798,12 +798,12 @@ private async void SwapPolicyComboBox_SelectionChanged(object sender, SelectionC // Create and display a ContentDialog with styled TextBlock ContentDialog dialog = new() { - Title = "Swapping Policy", + Title = GlobalVars.Rizz.GetString("SwappingPolicyTitle"), Content = formattedTextBlock, - PrimaryButtonText = "OK", + PrimaryButtonText = GlobalVars.Rizz.GetString("OK"), BorderBrush = Application.Current.Resources["AccentFillColorDefaultBrush"] as Brush ?? new SolidColorBrush(Colors.Transparent), BorderThickness = new Thickness(1), - CloseButtonText = "Cancel", + CloseButtonText = GlobalVars.Rizz.GetString("Cancel"), XamlRoot = this.XamlRoot // Set XamlRoot to the current page's XamlRoot }; diff --git a/AppControl Manager/Pages/Update.xaml.cs b/AppControl Manager/Pages/Update.xaml.cs index a972ba89e..2f7725233 100644 --- a/AppControl Manager/Pages/Update.xaml.cs +++ b/AppControl Manager/Pages/Update.xaml.cs @@ -58,7 +58,7 @@ public Update() // Public property to access the singleton instance from other classes - public static Update Instance => _instance ?? throw new InvalidOperationException("Update is not initialized."); + public static Update Instance => _instance ?? throw new InvalidOperationException(GlobalVars.Rizz.GetString("UpdateNotInitialized")); // Event handler for check for update button @@ -79,7 +79,7 @@ private async void CheckForUpdateButton_Click(object sender, RoutedEventArgs e) // If user did not provide custom MSIXBundle path, start checking for update if (!useCustomMSIXBundlePath) { - UpdateStatusInfoBar.Message = "Checking for update"; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("CheckingForUpdate"); // Check for update asynchronously using the AppUpdate class's singleton instance updateCheckResult = await Task.Run(AppUpdate.Instance.Check); } @@ -91,11 +91,11 @@ private async void CheckForUpdateButton_Click(object sender, RoutedEventArgs e) if (useCustomMSIXBundlePath) { - msg1 = $"Installing the MSIXBundle path that you selected: {customMSIXBundlePath}"; + msg1 = GlobalVars.Rizz.GetString("InstallingCustomPath") + customMSIXBundlePath; } else { - msg1 = $"The current version is {App.currentAppVersion} while the online version is {updateCheckResult?.OnlineVersion}, updating the application..."; + msg1 = GlobalVars.Rizz.GetString("VersionComparison") + App.currentAppVersion + GlobalVars.Rizz.GetString("WhileOnlineVersion") + updateCheckResult?.OnlineVersion + GlobalVars.Rizz.GetString("UpdatingApplication"); } Logger.Write(msg1); @@ -126,7 +126,7 @@ private async void CheckForUpdateButton_Click(object sender, RoutedEventArgs e) AppControlManagerSavePath = Path.Combine(stagingArea, "AppControlManager.msixbundle"); - UpdateStatusInfoBar.Message = "Downloading the AppControl Manager MSIXBundle package..."; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("DownloadingPackage"); using (HttpClient client = new SecHttpClient()) @@ -191,23 +191,23 @@ private async void CheckForUpdateButton_Click(object sender, RoutedEventArgs e) } - Logger.Write($"The AppControl Manager MSIXBundle package has been successfully downloaded to {AppControlManagerSavePath}"); + Logger.Write(GlobalVars.Rizz.GetString("DownloadSuccess") + AppControlManagerSavePath); } else { // Use the user-supplied MSIXBundle file path for installation source - AppControlManagerSavePath = customMSIXBundlePath ?? throw new InvalidOperationException("No MSIXBundle path was selected"); + AppControlManagerSavePath = customMSIXBundlePath ?? throw new InvalidOperationException(GlobalVars.Rizz.GetString("NoMSIXBundlePath")); } DownloadProgressRingForMSIXFile.IsIndeterminate = true; - UpdateStatusInfoBar.Message = "Detecting/Downloading the SignTool.exe from the Microsoft servers"; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("DetectingSignTool"); // First check if SignTool path is registered in the user configurations, else attempt to detect or download it string signToolPath = UserConfiguration.Get().SignToolCustomPath ?? await Task.Run(() => SignToolHelper.GetSignToolPath()); - UpdateStatusInfoBar.Message = "All Downloads finished, installing the new AppControl Manager version"; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("DownloadsFinished"); await Task.Run(() => { @@ -286,13 +286,13 @@ await Task.Run(() => } catch (Exception ex) { - Logger.Write($"An error occurred while trying to remove the ASR rule exclusions which you can safely ignore: {ex.Message}"); + Logger.Write(GlobalVars.Rizz.GetString("ASRError") + ex.Message); } PackageManager packageManager = new(); - Logger.Write("Installing the AppControl Manager MSIXBundle package"); + Logger.Write(GlobalVars.Rizz.GetString("InstallingPackage")); // https://learn.microsoft.com/en-us/uwp/api/windows.management.deployment.addpackageoptions AddPackageOptions options = new() @@ -316,19 +316,19 @@ await Task.Run(() => if (deploymentOperation.Status == AsyncStatus.Error) { DeploymentResult deploymentResult = deploymentOperation.GetResults(); - throw new InvalidOperationException($"Error installing The AppControl Manager. Error code: {deploymentOperation.ErrorCode} - Error text: {deploymentResult.ErrorText}"); + throw new InvalidOperationException(GlobalVars.Rizz.GetString("InstallationError") + deploymentOperation.ErrorCode + GlobalVars.Rizz.GetString("InstallationErrorText") + deploymentResult.ErrorText); } else if (deploymentOperation.Status == AsyncStatus.Canceled) { - Logger.Write("The AppControl Manager Installation canceled"); + Logger.Write(GlobalVars.Rizz.GetString("InstallationCanceled")); } else if (deploymentOperation.Status == AsyncStatus.Completed) { - Logger.Write("The AppControl Manager Installation succeeded"); + Logger.Write(GlobalVars.Rizz.GetString("InstallationSucceeded")); } else { - throw new InvalidOperationException("There was an unknown problem installing the AppControl Manager"); + throw new InvalidOperationException(GlobalVars.Rizz.GetString("UnknownInstallationIssue")); } @@ -361,16 +361,16 @@ await Task.Run(() => } catch (Exception ex) { - Logger.Write($"An error occurred while trying to add the ASR rule exclusions which you can safely ignore: {ex.Message}"); + Logger.Write(GlobalVars.Rizz.GetString("ASRAddError") + ex.Message); } }); - UpdateStatusInfoBar.Message = "Update has been successful. When you close and reopen the AppControl Manager, you will be automatically using the new version."; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("UpdateSuccess"); UpdateStatusInfoBar.Severity = InfoBarSeverity.Success; - GlobalVars.updateButtonTextOnTheUpdatePage = "Updates installed"; + GlobalVars.updateButtonTextOnTheUpdatePage = GlobalVars.Rizz.GetString("UpdatesInstalled"); // Keep the CheckForUpdate button disabled since the update has been installed at this point // And all that's required is for the app to be restarted by the user @@ -378,7 +378,7 @@ await Task.Run(() => else { - UpdateStatusInfoBar.Message = "The current version is already up to date."; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("AlreadyUpdated"); UpdateStatusInfoBar.Severity = InfoBarSeverity.Success; CheckForUpdateButton.IsEnabled = true; } @@ -387,7 +387,7 @@ await Task.Run(() => catch { UpdateStatusInfoBar.Severity = InfoBarSeverity.Error; - UpdateStatusInfoBar.Message = "An error occurred while checking for update."; + UpdateStatusInfoBar.Message = GlobalVars.Rizz.GetString("UpdateCheckError"); DownloadProgressRingForMSIXFile.Value = 0; @@ -485,5 +485,4 @@ private void CheckForUpdate_Click(object sender, RoutedEventArgs e) { MainWindow.Instance.NavView_Navigate(typeof(UpdatePageCustomMSIXPath), null); } - } diff --git a/AppControl Manager/Pages/UpdatePageCustomMSIXPath.xaml b/AppControl Manager/Pages/UpdatePageCustomMSIXPath.xaml index 624ad5613..4d9f1d9df 100644 --- a/AppControl Manager/Pages/UpdatePageCustomMSIXPath.xaml +++ b/AppControl Manager/Pages/UpdatePageCustomMSIXPath.xaml @@ -10,7 +10,7 @@ xmlns:controls="using:CommunityToolkit.WinUI.Controls" xmlns:win="http://schemas.microsoft.com/winfx/2006/xaml/presentation" mc:Ignorable="d"> - + diff --git a/AppControl Manager/Resources/AppControlManagerSupplementalPolicy.xml b/AppControl Manager/Resources/AppControlManagerSupplementalPolicy.xml index 8d03c4f5b..51565ee98 100644 --- a/AppControl Manager/Resources/AppControlManagerSupplementalPolicy.xml +++ b/AppControl Manager/Resources/AppControlManagerSupplementalPolicy.xml @@ -9,32 +9,32 @@ - + - - + + - - - + + + - + - + - - + + 2 @@ -42,5 +42,10 @@ AppControlManagerSupplementalPolicy + + + 129660 + + \ No newline at end of file diff --git a/AppControl Manager/Resources/EmptyPolicy.xml b/AppControl Manager/Resources/EmptyPolicy.xml new file mode 100644 index 000000000..4a7343d9f --- /dev/null +++ b/AppControl Manager/Resources/EmptyPolicy.xml @@ -0,0 +1,39 @@ + + + 1.0.0.0 + {7AE40A06-9CFC-47E7-A74C-0B6BC71E3B93} + {7AE40A06-9CFC-47E7-A74C-0B6BC71E3B93} + {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} + + + + + + + + + + + + + + + 2 + + + + true + + + + + Empty Policy + + + + + 129661 + + + + \ No newline at end of file diff --git a/AppControl Manager/Resources/ISGBasedSupplementalPolicy.xml b/AppControl Manager/Resources/ISGBasedSupplementalPolicy.xml index 3bbf2b945..4e96381a9 100644 --- a/AppControl Manager/Resources/ISGBasedSupplementalPolicy.xml +++ b/AppControl Manager/Resources/ISGBasedSupplementalPolicy.xml @@ -35,5 +35,10 @@ ISG Based Supplemental Policy + + + 129659 + + \ No newline at end of file diff --git a/AppControl Manager/Resources/StrictKernelMode.xml b/AppControl Manager/Resources/StrictKernelMode.xml index 4632d583a..5f9fabe39 100644 --- a/AppControl Manager/Resources/StrictKernelMode.xml +++ b/AppControl Manager/Resources/StrictKernelMode.xml @@ -73,5 +73,10 @@ StrictKernelMode + + + 129657 + + \ No newline at end of file diff --git a/AppControl Manager/Resources/StrictKernelMode_NoFlightRoots.xml b/AppControl Manager/Resources/StrictKernelMode_NoFlightRoots.xml index fa27ba9c5..7ab4a0acc 100644 --- a/AppControl Manager/Resources/StrictKernelMode_NoFlightRoots.xml +++ b/AppControl Manager/Resources/StrictKernelMode_NoFlightRoots.xml @@ -61,5 +61,10 @@ StrictKernelMode NoFlightRoots + + + 129658 + + \ No newline at end of file diff --git a/AppControl Manager/SiPolicy/CustomDeserialization.cs b/AppControl Manager/SiPolicy/CustomDeserialization.cs index 16ae49048..e5da52396 100644 --- a/AppControl Manager/SiPolicy/CustomDeserialization.cs +++ b/AppControl Manager/SiPolicy/CustomDeserialization.cs @@ -3,6 +3,7 @@ using System.Globalization; using System.Linq; using System.Xml; +using AppControlManager.Main; using AppControlManager.Others; namespace AppControlManager.SiPolicy; @@ -10,27 +11,56 @@ namespace AppControlManager.SiPolicy; internal static class CustomDeserialization { - internal static SiPolicy DeserializeSiPolicy(string filePath) + internal static SiPolicy DeserializeSiPolicy(string? filePath, XmlDocument? Xml) { - XmlDocument xmlDoc = new(); - xmlDoc.Load(filePath); - XmlElement? root = xmlDoc.DocumentElement ?? throw new InvalidOperationException("Invalid XML: Missing root element."); + + XmlElement? root; + + if (!string.IsNullOrEmpty(filePath)) + { + XmlDocument xmlDoc = new(); + xmlDoc.Load(filePath); + root = xmlDoc.DocumentElement ?? throw new InvalidOperationException("Invalid XML: Missing root element."); + + // Make sure the policy file is valid + _ = CiPolicyTest.TestCiPolicy(filePath); + } + else if (Xml is not null) + { + root = Xml.DocumentElement ?? throw new InvalidOperationException("Invalid XML: Missing root element."); + } + else + { + throw new InvalidOperationException("file path or XML document must be provided for deserialization"); + } + SiPolicy policy = new(); - // Read root attributes + // Friendly Name if (root.HasAttribute("FriendlyName")) policy.FriendlyName = root.GetAttribute("FriendlyName"); - if (root.HasAttribute("PolicyType")) - { - policy.PolicyType = ConvertStringToPolicyType(root.GetAttribute("PolicyType")); - policy.PolicyTypeSpecified = true; - } + + // Policy Type - if missing, Base policy type is assigned + policy.PolicyTypeSpecified = true; + policy.PolicyType = root.HasAttribute("PolicyType") ? ConvertStringToPolicyType(root.GetAttribute("PolicyType")) : PolicyType.BasePolicy; + + // Generate a new GUID + Guid newRandomGUID = Guid.CreateVersion7(); + // Convert it to string + string newRandomGUIDString = $"{{{newRandomGUID.ToString().ToUpperInvariant()}}}"; // Read basic text elements - policy.VersionEx = GetElementText(root, "VersionEx"); - policy.PolicyID = GetElementText(root, "PolicyID"); - policy.BasePolicyID = GetElementText(root, "BasePolicyID"); - policy.PlatformID = GetElementText(root, "PlatformID"); + string version = GetElementText(root, "VersionEx"); + policy.VersionEx = string.IsNullOrEmpty(version) ? "1.0.0.0" : version; + + string policyID = GetElementText(root, "PolicyID"); + policy.PolicyID = string.IsNullOrEmpty(policyID) ? newRandomGUIDString : policyID; + + string basePolicyID = GetElementText(root, "BasePolicyID"); + policy.BasePolicyID = string.IsNullOrEmpty(basePolicyID) ? newRandomGUIDString : basePolicyID; + + string platformID = GetElementText(root, "PlatformID"); + policy.PlatformID = string.IsNullOrEmpty(platformID) ? "{2E07F7E4-194C-4D20-B7C9-6F44A6C5A234}" : platformID; // Deserialize Rules XmlElement? rulesElement = root["Rules", GlobalVars.SiPolicyNamespace]; @@ -236,36 +266,38 @@ private static byte[] ConvertHexStringToByteArray(string hex) return bytes; } + + private static readonly Dictionary PolicyRuleOptionsActual = new() + { + { "Enabled:UMCI", OptionType.EnabledUMCI }, + { "Enabled:Boot Menu Protection", OptionType.EnabledBootMenuProtection }, + { "Required:WHQL", OptionType.RequiredWHQL }, + { "Enabled:Audit Mode", OptionType.EnabledAuditMode }, + { "Disabled:Flight Signing", OptionType.DisabledFlightSigning }, + { "Enabled:Inherit Default Policy", OptionType.EnabledInheritDefaultPolicy }, + { "Enabled:Unsigned System Integrity Policy", OptionType.EnabledUnsignedSystemIntegrityPolicy }, + { "Required:EV Signers", OptionType.RequiredEVSigners }, + { "Enabled:Advanced Boot Options Menu", OptionType.EnabledAdvancedBootOptionsMenu }, + { "Enabled:Boot Audit On Failure", OptionType.EnabledBootAuditOnFailure }, + { "Disabled:Script Enforcement", OptionType.DisabledScriptEnforcement }, + { "Required:Enforce Store Applications", OptionType.RequiredEnforceStoreApplications }, + { "Enabled:Managed Installer", OptionType.EnabledManagedInstaller }, + { "Enabled:Intelligent Security Graph Authorization", OptionType.EnabledIntelligentSecurityGraphAuthorization }, + { "Enabled:Invalidate EAs on Reboot", OptionType.EnabledInvalidateEAsonReboot }, + { "Enabled:Update Policy No Reboot", OptionType.EnabledUpdatePolicyNoReboot }, + { "Enabled:Allow Supplemental Policies", OptionType.EnabledAllowSupplementalPolicies }, + { "Disabled:Runtime FilePath Rule Protection", OptionType.DisabledRuntimeFilePathRuleProtection }, + { "Enabled:Dynamic Code Security", OptionType.EnabledDynamicCodeSecurity }, + { "Enabled:Revoked Expired As Unsigned", OptionType.EnabledRevokedExpiredAsUnsigned }, + { "Enabled:Developer Mode Dynamic Code Trust", OptionType.EnabledDeveloperModeDynamicCodeTrust }, + { "Enabled:Secure Setting Policy", OptionType.EnabledSecureSettingPolicy }, + { "Enabled:Conditional Windows Lockdown Policy", OptionType.EnabledConditionalWindowsLockdownPolicy } + }; + // Conversion methods for enums. - private static OptionType ConvertStringToOptionType(string s) + internal static OptionType ConvertStringToOptionType(string s) { - return s switch - { - "Enabled:UMCI" => OptionType.EnabledUMCI, - "Enabled:Boot Menu Protection" => OptionType.EnabledBootMenuProtection, - "Enabled:Intelligent Security Graph Authorization" => OptionType.EnabledIntelligentSecurityGraphAuthorization, - "Enabled:Invalidate EAs on Reboot" => OptionType.EnabledInvalidateEAsonReboot, - "Required:WHQL" => OptionType.RequiredWHQL, - "Enabled:Developer Mode Dynamic Code Trust" => OptionType.EnabledDeveloperModeDynamicCodeTrust, - "Enabled:Allow Supplemental Policies" => OptionType.EnabledAllowSupplementalPolicies, - "Disabled:Runtime FilePath Rule Protection" => OptionType.DisabledRuntimeFilePathRuleProtection, - "Enabled:Revoked Expired As Unsigned" => OptionType.EnabledRevokedExpiredAsUnsigned, - "Enabled:Audit Mode" => OptionType.EnabledAuditMode, - "Disabled:Flight Signing" => OptionType.DisabledFlightSigning, - "Enabled:Inherit Default Policy" => OptionType.EnabledInheritDefaultPolicy, - "Enabled:Unsigned System Integrity Policy" => OptionType.EnabledUnsignedSystemIntegrityPolicy, - "Enabled:Dynamic Code Security" => OptionType.EnabledDynamicCodeSecurity, - "Required:EV Signers" => OptionType.RequiredEVSigners, - "Enabled:Boot Audit On Failure" => OptionType.EnabledBootAuditOnFailure, - "Enabled:Advanced Boot Options Menu" => OptionType.EnabledAdvancedBootOptionsMenu, - "Disabled:Script Enforcement" => OptionType.DisabledScriptEnforcement, - "Required:Enforce Store Applications" => OptionType.RequiredEnforceStoreApplications, - "Enabled:Secure Setting Policy" => OptionType.EnabledSecureSettingPolicy, - "Enabled:Managed Installer" => OptionType.EnabledManagedInstaller, - "Enabled:Update Policy No Reboot" => OptionType.EnabledUpdatePolicyNoReboot, - "Enabled:Conditional Windows Lockdown Policy" => OptionType.EnabledConditionalWindowsLockdownPolicy, - _ => throw new InvalidOperationException("Unknown OptionType: " + s) - }; + return PolicyRuleOptionsActual[s]; } private static PolicyType ConvertStringToPolicyType(string s) diff --git a/AppControl Manager/SiPolicy/CustomSerialization.cs b/AppControl Manager/SiPolicy/CustomSerialization.cs index 2f495f452..e41173574 100644 --- a/AppControl Manager/SiPolicy/CustomSerialization.cs +++ b/AppControl Manager/SiPolicy/CustomSerialization.cs @@ -706,7 +706,7 @@ private static void AppendAttributeElement(XmlDocument doc, XmlElement parent, s } } - private static string ConvertByteArrayToHex(byte[]? data) + internal static string ConvertByteArrayToHex(byte[]? data) { return data is not null ? string.Concat(data.Select(x => x.ToString("X2"))) : string.Empty; } diff --git a/AppControl Manager/SiPolicy/Management.cs b/AppControl Manager/SiPolicy/Management.cs index 339c1f6fc..cd5dbb95f 100644 --- a/AppControl Manager/SiPolicy/Management.cs +++ b/AppControl Manager/SiPolicy/Management.cs @@ -19,9 +19,9 @@ internal static class Management /// /// /// - internal static SiPolicy Initialize(string xmlFilePath) + internal static SiPolicy Initialize(string? xmlFilePath, XmlDocument? XmlObj) { - if (!CiPolicyTest.TestCiPolicy(xmlFilePath)) + if (!string.IsNullOrEmpty(xmlFilePath) && !CiPolicyTest.TestCiPolicy(xmlFilePath)) { throw new InvalidOperationException($"The XML file '{xmlFilePath}' is not compliant with the CI policy schema"); } @@ -49,7 +49,7 @@ internal static SiPolicy Initialize(string xmlFilePath) */ - return CustomDeserialization.DeserializeSiPolicy(xmlFilePath); + return CustomDeserialization.DeserializeSiPolicy(xmlFilePath, XmlObj); } diff --git a/AppControl Manager/SiPolicy/Merger.cs b/AppControl Manager/SiPolicy/Merger.cs index 29807d0c1..4ca74f304 100644 --- a/AppControl Manager/SiPolicy/Merger.cs +++ b/AppControl Manager/SiPolicy/Merger.cs @@ -50,11 +50,11 @@ internal static void Merge(string mainXmlFilePath, HashSet otherXmlFileP { CloseEmptyXmlNodesSemantic.Close(item); - allPolicies.Add(Management.Initialize(item)); + allPolicies.Add(Management.Initialize(item, null)); } // Instantiate the main policy - SiPolicy mainXML = Management.Initialize(mainXmlFilePath); + SiPolicy mainXML = Management.Initialize(mainXmlFilePath, null); // Add the main policy to the mix allPolicies.Add(mainXML); diff --git a/AppControl Manager/SiPolicyIntel/AddSigningDetails.cs b/AppControl Manager/SiPolicyIntel/AddSigningDetails.cs index af175d993..3b238f6fc 100644 --- a/AppControl Manager/SiPolicyIntel/AddSigningDetails.cs +++ b/AppControl Manager/SiPolicyIntel/AddSigningDetails.cs @@ -27,7 +27,7 @@ internal static SiPolicy.SiPolicy Add(string xmlPolicyFile, string certificateFi // Get the Common Name of the certificate string CertCommonName = CryptoAPI.GetNameString(CertObject.Handle, CryptoAPI.CERT_NAME_SIMPLE_DISPLAY_TYPE, null, false); - SiPolicy.SiPolicy policyObject = Management.Initialize(xmlPolicyFile); + SiPolicy.SiPolicy policyObject = Management.Initialize(xmlPolicyFile, null); // Create a Cert root object that will be used by signers CertRoot certRoot = new() diff --git a/AppControl Manager/SimulationMethods/GetSignerInfo.cs b/AppControl Manager/SimulationMethods/GetSignerInfo.cs index a4eeccccd..ae847ba27 100644 --- a/AppControl Manager/SimulationMethods/GetSignerInfo.cs +++ b/AppControl Manager/SimulationMethods/GetSignerInfo.cs @@ -1,7 +1,9 @@ using System; using System.Collections.Generic; +using System.Linq; using System.Xml; using AppControlManager.Others; +using AppControlManager.SiPolicy; namespace AppControlManager.SimulationMethods; @@ -17,15 +19,39 @@ internal static class GetSignerInfo internal static List Get(XmlDocument xmlContent) { // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(null, xmlContent); + SiPolicy.SiPolicy policyObj = Management.Initialize(null, xmlContent); - // Get User Mode Signers IDs - HashSet allowedUMCISigners = GetSignerIds(codeIntegrityPolicy.SiPolicyNode, codeIntegrityPolicy.NamespaceManager, "12", "AllowedSigners"); - HashSet deniedUMCISigners = GetSignerIds(codeIntegrityPolicy.SiPolicyNode, codeIntegrityPolicy.NamespaceManager, "12", "DeniedSigners"); + SigningScenario? UMCI = policyObj.SigningScenarios.FirstOrDefault(x => string.Equals(x.ID, "12", StringComparison.OrdinalIgnoreCase)); + SigningScenario? KMCI = policyObj.SigningScenarios.FirstOrDefault(x => string.Equals(x.ID, "131", StringComparison.OrdinalIgnoreCase)); - // Get Kernel Mode Signers IDs - HashSet allowedKMCISigners = GetSignerIds(codeIntegrityPolicy.SiPolicyNode, codeIntegrityPolicy.NamespaceManager, "131", "AllowedSigners"); - HashSet deniedKMCISigners = GetSignerIds(codeIntegrityPolicy.SiPolicyNode, codeIntegrityPolicy.NamespaceManager, "131", "DeniedSigners"); + HashSet allowedUMCISigners = []; + HashSet deniedUMCISigners = []; + HashSet allowedKMCISigners = []; + HashSet deniedKMCISigners = []; + + if (UMCI is not null) + { + foreach (AllowedSigner item in UMCI.ProductSigners.AllowedSigners.AllowedSigner) + { + _ = allowedUMCISigners.Add(item.SignerId); + } + foreach (DeniedSigner item in UMCI.ProductSigners.DeniedSigners.DeniedSigner) + { + _ = deniedUMCISigners.Add(item.SignerId); + } + } + + if (KMCI is not null) + { + foreach (AllowedSigner item in KMCI.ProductSigners.AllowedSigners.AllowedSigner) + { + _ = allowedKMCISigners.Add(item.SignerId); + } + foreach (DeniedSigner item in KMCI.ProductSigners.DeniedSigners.DeniedSigner) + { + _ = deniedKMCISigners.Add(item.SignerId); + } + } // Unique IDs of all Allowed Signers HashSet allAllowedSigners = new(allowedUMCISigners, StringComparer.OrdinalIgnoreCase); @@ -49,379 +75,266 @@ internal static List Get(XmlDocument xmlContent) #region - // Storing all the FileAttrib nodes in the node, in a list - XmlNodeList? fileAttributes = codeIntegrityPolicy.SiPolicyNode.SelectNodes("ns:FileRules/ns:FileAttrib", codeIntegrityPolicy.NamespaceManager); + // Storing all the FileAttribs in a list + IEnumerable fileAttributes = policyObj.FileRules.OfType(); // Dictionary to store the FileAttrib(s) by their ID for fast lookups // It's created only once and used by all signers in the XML file - Dictionary fileAttribDictionary = []; + Dictionary fileAttribDictionary = []; - if (fileAttributes is not null) + // Populate the dictionary with FileAttrib nodes, using their ID as the key + foreach (FileAttrib fileAttrib in fileAttributes) { - // Populate the dictionary with FileAttrib nodes, using their ID as the key - foreach (XmlNode fileAttrib in fileAttributes) - { - string? id = fileAttrib.Attributes?["ID"]?.Value; - - if (!string.IsNullOrWhiteSpace(id)) - { - fileAttribDictionary[id] = fileAttrib; - } - } + fileAttribDictionary[fileAttrib.ID] = fileAttrib; } #endregion #region - // Select all the EKU nodes in the XML file, if they exist - XmlNodeList? ekuNodes = codeIntegrityPolicy.SiPolicyNode.SelectNodes("ns:EKUs/ns:EKU", codeIntegrityPolicy.NamespaceManager); // A dictionary to store the correlation between the EKU IDs and their values // Keys are EKU IDs // Values are EKU values Dictionary EKUAndValuesCorrelation = []; - if (ekuNodes is not null) + // Add the EKU IDs and their values to the dictionary + foreach (EKU Eku in policyObj.EKUs) { - // Add the EKU IDs and their values to the dictionary - foreach (XmlNode Eku in ekuNodes) - { - string? EkuID = Eku.Attributes?["ID"]?.Value; - string? EkuValue = Eku.Attributes?["Value"]?.Value; - - if (EkuID is not null && EkuValue is not null) - { - EKUAndValuesCorrelation.Add(EkuID, EkuValue); - } - } + EKUAndValuesCorrelation.Add(Eku.ID, CustomSerialization.ConvertByteArrayToHex(Eku.Value)); } - #endregion - // Get all of the Signer nodes in the Signers node - XmlNodeList? signerNodes = codeIntegrityPolicy.SiPolicyNode.SelectNodes("ns:Signers/ns:Signer", codeIntegrityPolicy.NamespaceManager); + #endregion - if (signerNodes is not null) + // Loop through each Signer node and extract all of their information + foreach (Signer signer in policyObj.Signers) { - // Loop through each Signer node and extract all of their information - foreach (XmlNode signer in signerNodes) + + // Determine if the signer is Allowed or Denied + bool isAllowed; + if (allAllowedSigners.Contains(signer.ID)) + { + isAllowed = true; + } + else if (allDeniedSigners.Contains(signer.ID)) { + isAllowed = false; + } + else + { + // Skip if the current signer is neither an allowed nor a denied signer, meaning it can either be UpdatePolicySigner or SupplementalPolicySigner which we don't need for simulation + continue; + } - // Get the ID of the current Signer - string signerId = signer.Attributes?["ID"]?.Value!; + // Replacing Wellknown root IDs with their corresponding TBS values and Names (Common Names) + // These are all root certificates, they have no leaf or intermediate certificates in their chains, that's why they're called Trusted Roots - // Get the name of the current Signer - string signerName = signer.Attributes?["Name"]?.Value!; + // Get the CertRoot node of the current Signer + string? certRootValue = CustomSerialization.ConvertByteArrayToHex(signer.CertRoot.Value); - // Determine if the signer is Allowed or Denied - bool isAllowed; - if (allAllowedSigners.Contains(signerId)) - { - isAllowed = true; - } - else if (allDeniedSigners.Contains(signerId)) - { - isAllowed = false; - } - else + if (certRootValue is not null && wellKnownIDs.Contains(certRootValue)) + { + switch (certRootValue) { - // Skip if the current signer is neither an allowed nor a denied signer, meaning it can either be UpdatePolicySigner or SupplementalPolicySigner which we don't need for simulation - continue; + case "03": + certRootValue = "D67576F5521D1CCAB52E9215E0F9F743"; + signer.Name = "Microsoft Authenticode(tm) Root Authority"; + break; + case "04": + certRootValue = "8B3C3087B7056F5EC5DDBA91A1B901F0"; + signer.Name = "Microsoft Root Authority"; + break; + case "05": + certRootValue = "391BE92883D52509155BFEAE27B9BD340170B76B"; + signer.Name = "Microsoft Root Certificate Authority"; + break; + case "06": + certRootValue = "08FBA831C08544208F5208686B991CA1B2CFC510E7301784DDF1EB5BF0393239"; + signer.Name = "Microsoft Root Certificate Authority 2010"; + break; + case "07": + certRootValue = "279CD652C4E252BFBE5217AC722205D7729BA409148CFA9E6D9E5B1CB94EAFF1"; + signer.Name = "Microsoft Root Certificate Authority 2011"; + break; + case "09": + certRootValue = "09CBAFBD98E81B4D6BAAAB32B8B2F5D7"; + signer.Name = "Microsoft Test Root Authority"; + break; + case "0A": + certRootValue = "7A4D9890B0F9006A6F77472D50D83CA54975FCC2B7EA0563490134E19B78782A"; + signer.Name = "Microsoft Testing Root Certificate Authority 2010"; + break; + case "0E": + certRootValue = "ED55F82E1444F79CA9DCE826846FDC4E0EA3859E3D26EFEF412D2FFF0C7C8E6C"; + signer.Name = "Microsoft Development Root Certificate Authority 2014"; + break; + case "0G": + certRootValue = "68D221D720E975DB5CD14B24F2970F86A5B8605A2A1BC784A17B83F7CF500A70EB177CE228273B8540A800178F23EAC8"; + signer.Name = "Microsoft ECC Testing Root Certificate Authority 2017"; + break; + case "0H": + certRootValue = "214592CB01B59104195F80AF2886DBF85771AF42A3821D104BF18F415158C49CBC233511672CD6C432351AC9228E3E75"; + signer.Name = "Microsoft ECC Development Root Certificate Authority 2018"; + break; + case "0I": + certRootValue = "32991981BF1575A1A5303BB93A381723EA346B9EC130FDB596A75BA1D7CE0B0A06570BB985D25841E23BE944E8FF118F"; + signer.Name = "Microsoft ECC Product Root Certificate Authority 2018"; + break; + default: + break; } + } - // Replacing Wellknown root IDs with their corresponding TBS values and Names (Common Names) - // These are all root certificates, they have no leaf or intermediate certificates in their chains, that's why they're called Trusted Roots - - // Get the CertRoot node of the current Signer - XmlNode? certRootNode = signer.SelectSingleNode("ns:CertRoot", codeIntegrityPolicy.NamespaceManager); + // Determine the scope of the signer + string signerScope = allowedUMCISigners.Contains(signer.ID) ? "UserMode" : "KernelMode"; - string? certRootValue = null; + // Find all the FileAttribRef nodes within the current signer + List ruleIds = []; - if (certRootNode is not null) - { - // Get the Value of the CertRoot - certRootValue = certRootNode.Attributes?["Value"]?.Value; - } + // Extract the RuleID of all of the FileAttribRef nodes + foreach (FileAttribRef FileAttribRefNode in signer.FileAttribRef) + { + ruleIds.Add(FileAttribRefNode.RuleID); + } - if (certRootNode is not null && certRootValue is not null && wellKnownIDs.Contains(certRootValue)) - { - switch (certRootValue) - { - case "03": - certRootValue = "D67576F5521D1CCAB52E9215E0F9F743"; - signerName = "Microsoft Authenticode(tm) Root Authority"; - break; - case "04": - certRootValue = "8B3C3087B7056F5EC5DDBA91A1B901F0"; - signerName = "Microsoft Root Authority"; - break; - case "05": - certRootValue = "391BE92883D52509155BFEAE27B9BD340170B76B"; - signerName = "Microsoft Root Certificate Authority"; - break; - case "06": - certRootValue = "08FBA831C08544208F5208686B991CA1B2CFC510E7301784DDF1EB5BF0393239"; - signerName = "Microsoft Root Certificate Authority 2010"; - break; - case "07": - certRootValue = "279CD652C4E252BFBE5217AC722205D7729BA409148CFA9E6D9E5B1CB94EAFF1"; - signerName = "Microsoft Root Certificate Authority 2011"; - break; - case "09": - certRootValue = "09CBAFBD98E81B4D6BAAAB32B8B2F5D7"; - signerName = "Microsoft Test Root Authority"; - break; - case "0A": - certRootValue = "7A4D9890B0F9006A6F77472D50D83CA54975FCC2B7EA0563490134E19B78782A"; - signerName = "Microsoft Testing Root Certificate Authority 2010"; - break; - case "0E": - certRootValue = "ED55F82E1444F79CA9DCE826846FDC4E0EA3859E3D26EFEF412D2FFF0C7C8E6C"; - signerName = "Microsoft Development Root Certificate Authority 2014"; - break; - case "0G": - certRootValue = "68D221D720E975DB5CD14B24F2970F86A5B8605A2A1BC784A17B83F7CF500A70EB177CE228273B8540A800178F23EAC8"; - signerName = "Microsoft ECC Testing Root Certificate Authority 2017"; - break; - case "0H": - certRootValue = "214592CB01B59104195F80AF2886DBF85771AF42A3821D104BF18F415158C49CBC233511672CD6C432351AC9228E3E75"; - signerName = "Microsoft ECC Development Root Certificate Authority 2018"; - break; - case "0I": - certRootValue = "32991981BF1575A1A5303BB93A381723EA346B9EC130FDB596A75BA1D7CE0B0A06570BB985D25841E23BE944E8FF118F"; - signerName = "Microsoft ECC Product Root Certificate Authority 2018"; - break; - default: - break; - } - } + #region Region File Attributes Processing - // Determine the scope of the signer - string signerScope = allowedUMCISigners.Contains(signerId) ? "UserMode" : "KernelMode"; + // The File Attributes property that will be added to the Signer object + // It contains details of all File Attributes associated with the Signer + Dictionary> SignerFileAttributesProperty = []; - // Find all the FileAttribRef nodes within the current signer - XmlNodeList? FileAttribRefNodes = signer.SelectNodes("ns:FileAttribRef", codeIntegrityPolicy.NamespaceManager); + // Determine whether the signer has a FileAttribRef, if it points to a file + if (ruleIds.Count > 0) + { - List ruleIds = []; + // Create a list to store matching file attributes + List FileAttribsAssociatedWithTheSigner = []; - if (FileAttribRefNodes is not null) + // Iterate through the rule IDs and find matching FileAttrib nodes in the dictionary that holds the FileAttrib nodes in the node + // Get all the FileAttribs associated with the signer + foreach (string id in ruleIds) { - // Extract the RuleID of all of the FileAttribRef nodes - foreach (XmlNode FileAttribRefNode in FileAttribRefNodes) + if (fileAttribDictionary.TryGetValue(id, out FileAttrib? matchingFileAttrib)) { - ruleIds.Add(FileAttribRefNode!.Attributes?["RuleID"]?.Value!); + FileAttribsAssociatedWithTheSigner.Add(matchingFileAttrib); } } - // Determine whether the signer has a FileAttribRef, if it points to a file - #region Region File Attributes Processing - - // The File Attributes property that will be added to the Signer object - // It contains details of all File Attributes associated with the Signer - Dictionary> SignerFileAttributesProperty = []; - - if (ruleIds.Count > 0) + // Loop over each FileAttribute associated with the Signer + foreach (FileAttrib item in FileAttribsAssociatedWithTheSigner) { - // Create a list to store matching file attributes - List FileAttribsAssociatedWithTheSigner = []; + // a temp dictionary to store the current FileAttribute details + Dictionary temp = []; + + string? FileName = item.FileName; + string? FileDescription = item.FileDescription; + string? InternalName = item.InternalName; + string? ProductName = item.ProductName; - // Iterate through the rule IDs and find matching FileAttrib nodes in the dictionary that holds the FileAttrib nodes in the node - // Get all the FileAttribs associated with the signer - foreach (string id in ruleIds) + if (FileName is not null) { - if (fileAttribDictionary.TryGetValue(id, out XmlNode? matchingFileAttrib)) - { - FileAttribsAssociatedWithTheSigner.Add(matchingFileAttrib); - } + temp.Add("OriginalFileName", FileName); + temp.Add("SpecificFileNameLevel", "OriginalFileName"); } - - - // Loop over each FileAttribute associated with the Signer - foreach (XmlNode item in FileAttribsAssociatedWithTheSigner) + else if (FileDescription is not null) { - - // a temp dictionary to store the current FileAttribute details - Dictionary temp = []; - - string? FileName = item.Attributes?["FileName"]?.Value; - string? FileDescription = item.Attributes?["FileDescription"]?.Value; - string? InternalName = item.Attributes?["InternalName"]?.Value; - string? ProductName = item.Attributes?["ProductName"]?.Value; - - if (FileName is not null) - { - temp.Add("OriginalFileName", FileName); - temp.Add("SpecificFileNameLevel", "OriginalFileName"); - } - else if (FileDescription is not null) - { - temp.Add("FileDescription", FileDescription); - temp.Add("SpecificFileNameLevel", "FileDescription"); - } - else if (InternalName is not null) - { - temp.Add("InternalName", InternalName); - temp.Add("SpecificFileNameLevel", "InternalName"); - } - else if (ProductName is not null) - { - temp.Add("ProductName", ProductName); - temp.Add("SpecificFileNameLevel", "ProductName"); - } - - string? MinimumFileVersion = item.Attributes?["MinimumFileVersion"]?.Value; - string? MaximumFileVersion = item.Attributes?["MaximumFileVersion"]?.Value; - - - if (MinimumFileVersion is not null) - { - temp.Add("MinimumFileVersion", MinimumFileVersion); - } - - if (MaximumFileVersion is not null) - { - temp.Add("MaximumFileVersion", MaximumFileVersion); - } - - SignerFileAttributesProperty.Add(item.Attributes?["ID"]?.Value!, temp); - + temp.Add("FileDescription", FileDescription); + temp.Add("SpecificFileNameLevel", "FileDescription"); } - - } - - #endregion - - - #region Region EKU Processing - - bool HasEKU = false; - bool IsWHQL = false; - - // Convert all of the EKUs that apply to the signer to their OID values and store them with the Signer info - - // This list stores only the IDs of the EKUs - List CertEKUIDs = []; - - // This list stores the OID of the current signer's EKUs - List CertEKUs = []; - - // Select all of the nodes in the current signer - XmlNodeList? CertEKU = signer.SelectNodes("ns:CertEKU", codeIntegrityPolicy.NamespaceManager); - - if (CertEKU is not null) - { - foreach (XmlNode EKU in CertEKU) + else if (InternalName is not null) { - string? EKUId = EKU.Attributes?["ID"]?.Value; - if (EKUId is not null) - { - CertEKUIDs.Add(EKUId); - } + temp.Add("InternalName", InternalName); + temp.Add("SpecificFileNameLevel", "InternalName"); + } + else if (ProductName is not null) + { + temp.Add("ProductName", ProductName); + temp.Add("SpecificFileNameLevel", "ProductName"); } - } + string? MinimumFileVersion = item.MinimumFileVersion; + string? MaximumFileVersion = item.MaximumFileVersion; - foreach (string EkuID in CertEKUIDs) - { - _ = EKUAndValuesCorrelation.TryGetValue(EkuID, out string? EkuValue); + if (MinimumFileVersion is not null) + { + temp.Add("MinimumFileVersion", MinimumFileVersion); + } - if (EkuValue is not null) + if (MaximumFileVersion is not null) { - // Check if the current EKU of the signer is WHQL - if (string.Equals(EkuValue, whqlEKUHex, StringComparison.OrdinalIgnoreCase)) - { - IsWHQL = true; - } + temp.Add("MaximumFileVersion", MaximumFileVersion); + } - // The signer has at least one EKU, so set this to true - HasEKU = true; + SignerFileAttributesProperty.Add(item.ID, temp); - CertEKUs.Add(CertificateHelper.ConvertHexToOID(EkuValue)); - } } + } - #endregion + #endregion - // Get the signer's cert publisher - XmlNode? signerCertPublisher = signer.SelectSingleNode("ns:CertPublisher", codeIntegrityPolicy.NamespaceManager); - string? certPublisher = null; - if (signerCertPublisher is not null) - { - certPublisher = signerCertPublisher.Attributes?["Value"]?.Value; - } + #region Region EKU Processing - // Get the signer's cert Issuer - XmlNode? signerCertCertIssuer = signer.SelectSingleNode("ns:CertIssuer", codeIntegrityPolicy.NamespaceManager); - string? certIssuer = null; - if (signerCertCertIssuer is not null) - { - certIssuer = signerCertCertIssuer.Attributes?["Value"]?.Value; - } + bool HasEKU = false; + bool IsWHQL = false; + // Convert all of the EKUs that apply to the signer to their OID values and store them with the Signer info - // Get the signer's CertOemID - XmlNode? signerCertOemID = signer.SelectSingleNode("ns:CertOemID", codeIntegrityPolicy.NamespaceManager); - string? CertOemID = null; - if (signerCertOemID is not null) - { - CertOemID = signerCertOemID.Attributes?["Value"]?.Value; - } + // This list stores only the IDs of the EKUs + List CertEKUIDs = []; + // This list stores the OID of the current signer's EKUs + List CertEKUs = []; - // Add the current signer's info to the output array - output.Add( - new SignerX( - id: signerId, - name: signerName, - certRoot: certRootValue!, - certPublisher: certPublisher, - certIssuer: certIssuer, - certEKU: [.. CertEKUs], - certOemID: CertOemID, - fileAttribRef: [.. ruleIds], - fileAttrib: SignerFileAttributesProperty, - signerScope: signerScope, - isWHQL: IsWHQL, - isAllowed: isAllowed, - hasEKU: HasEKU - ) - ); - + // Select all of the nodes in the current signer + foreach (CertEKU EKU in signer.CertEKU) + { + CertEKUIDs.Add(EKU.ID); } - } - return output; - } + foreach (string EkuID in CertEKUIDs) + { + _ = EKUAndValuesCorrelation.TryGetValue(EkuID, out string? EkuValue); - private static HashSet GetSignerIds(XmlNode siPolicyNode, XmlNamespaceManager namespaceManager, string scenarioValue, string signerType) - { - HashSet signerIds = []; - XmlNodeList? signerNodes = siPolicyNode.SelectNodes($"ns:SigningScenarios/ns:SigningScenario[@Value='{scenarioValue}']/ns:ProductSigners/ns:{signerType}/ns:Signer", namespaceManager); + if (EkuValue is not null) + { + // Check if the current EKU of the signer is WHQL + if (string.Equals(EkuValue, whqlEKUHex, StringComparison.OrdinalIgnoreCase)) + { + IsWHQL = true; + } - if (string.Equals(signerType, "AllowedSigners", StringComparison.OrdinalIgnoreCase)) - { - signerNodes = siPolicyNode.SelectNodes($"ns:SigningScenarios/ns:SigningScenario[@Value='{scenarioValue}']/ns:ProductSigners/ns:AllowedSigners/ns:AllowedSigner", namespaceManager); - } - else if (string.Equals(signerType, "DeniedSigners", StringComparison.OrdinalIgnoreCase)) - { - signerNodes = siPolicyNode.SelectNodes($"ns:SigningScenarios/ns:SigningScenario[@Value='{scenarioValue}']/ns:ProductSigners/ns:DeniedSigners/ns:DeniedSigner", namespaceManager); - } + // The signer has at least one EKU, so set this to true + HasEKU = true; - if (signerNodes is not null) - { - foreach (XmlNode signerNode in signerNodes) - { - string signerId = signerNode.Attributes?["SignerId"]?.Value ?? string.Empty; - if (!string.IsNullOrEmpty(signerId)) - { - _ = signerIds.Add(signerId); + CertEKUs.Add(CertificateHelper.ConvertHexToOID(EkuValue)); } } + + #endregion + + // Add the current signer's info to the output array + output.Add( + new SignerX( + id: signer.ID, + name: signer.Name, + certRoot: certRootValue!, + certPublisher: signer.CertPublisher.Value, + certIssuer: signer.CertIssuer.Value, + certEKU: [.. CertEKUs], + certOemID: signer.CertOemID.Value, + fileAttribRef: [.. ruleIds], + fileAttrib: SignerFileAttributesProperty, + signerScope: signerScope, + isWHQL: IsWHQL, + isAllowed: isAllowed, + hasEKU: HasEKU + ) + ); } - return signerIds; - } + return output; + } } diff --git a/AppControl Manager/Strings/en-US/Resources.resw b/AppControl Manager/Strings/en-US/Resources.resw index 738d48186..f9029695a 100644 --- a/AppControl Manager/Strings/en-US/Resources.resw +++ b/AppControl Manager/Strings/en-US/Resources.resw @@ -1,5 +1,6 @@  - - + - + - - - - + + + + - - + + - - + + - - - - + + + + - + - + @@ -254,7 +255,7 @@ Deploy after Creation - Toggling this button means the policy will be deployed on the system after it's been created + Toggling this button means the policy will be deployed on the system after it's been created Create Supplemental Policy @@ -278,13 +279,13 @@ Create Deny policy by scanning files and folders - Create a Deny policy based on an app's Package Family Name (PFN) + Create a Deny policy based on an app's Package Family Name (PFN) Package Family Name - Create a Deny policy based on an app's Package Family Name (PFN) + Create a Deny policy based on an app's Package Family Name (PFN) Indicates that the created/deployed policy will have (Enabled:Audit Mode) policy rule option and will generate audit logs instead of blocking files. @@ -398,7 +399,7 @@ Deploy after Creation - Toggling this button means the policy will be deployed on the system after it's been created + Toggling this button means the policy will be deployed on the system after it's been created Search the data... @@ -518,7 +519,7 @@ Select the required info such as a deployed policy XML file and a name for the Supplemental policy that will be created - Now install your new app or run a pre-installed app that was being blocked. You can optionally browse for folders to scan such as the location where the app is installed. Once you're done, use the button below to go to Step 3. + Now install your new app or run a pre-installed app that was being blocked. You can optionally browse for folders to scan such as the location where the app is installed. Once you're done, use the button below to go to Step 3. Use the Event logs and local files tab to confirm or select the detected files in order to include them in the final Supplemental policy. @@ -590,7 +591,7 @@ Refresh - Fetches the latest certificate common names from the User's personal certificate store + Fetches the latest certificate common names from the User's personal certificate store Customize the App Background Style @@ -608,7 +609,7 @@ Icons Style - Pick a style for the main navigation's icons. + Pick a style for the main navigation's icons. Customize the Theme @@ -644,7 +645,7 @@ Darker Background - It will remove the extra light shadow from the background, giving an overall darker look to the AppControl Manager's appearance. + It will remove the extra light shadow from the background, giving an overall darker look to the AppControl Manager's appearance. User Configurations @@ -685,4 +686,541 @@ Scan the system or the selected EVTX files for Code Integrity/AppLocker logs + + App Control policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. + + + This option isn't currently supported. + + + By default, kernel drivers that aren't Windows Hardware Quality Labs (WHQL) signed are allowed to run. Enabling this rule requires that every driver is WHQL signed and removes legacy driver support. Kernel drivers built for Windows 10 should be WHQL certified. + + + Instructs App Control to log information about applications, binaries, and scripts that would have been blocked, if the policy was enforced. You can use this option to identify the potential impact of your App Control policy, and use the audit events to refine the policy before enforcement. To enforce an App Control policy, delete this option. + + + If enabled, binaries from Windows Insider builds aren't trusted. This option is useful for organizations that only want to run released binaries, not prerelease Windows builds. + + + This option is reserved for future use and currently has no effect. + + + Allows the policy to remain unsigned. When this option is removed, the policy must be signed and any supplemental policies must also be signed. The certificates that are trusted for future policy updates must be identified in the UpdatePolicySigners section. Certificates that are trusted for supplemental policies must be identified in the SupplementalPolicySigners section. + + + This option isn't currently supported. + + + The F8 preboot menu is disabled by default for all App Control policies. Setting this rule option allows the F8 menu to appear to physically present users. + + + Used when the App Control policy is in enforcement mode. When a boot-critical driver fails during startup, the App Control policy is placed in audit mode so that Windows loads. Administrators can validate the reason for the failure in the CodeIntegrity event log. + + + This option disables script enforcement options, covering PowerShell, Windows Based Script Host (wscript.exe), Windows Console Based Script Host (cscript.exe), HTA files run in Microsoft HTML Application Host (mshta.exe), and MSXML. Some script hosts may behave differently even when your policy is in audit mode. For more information on script enforcement, see Script enforcement with App Control. +NOTE: This option isn't supported on Windows Server 2016 or Windows 10 1607 LTSB and shouldn't be used on those operating systems. + + + If this rule option is enabled, App Control policies also apply to Universal Windows applications. + + + Use this option to automatically allow applications installed by a managed installer. For more information, see Authorize apps deployed with an App Control managed installer. + + + Use this option to automatically allow applications with "known good" reputation as defined by Microsoft's Intelligent Security Graph (ISG). + + + When the Intelligent Security Graph option is used, App Control sets an extended file attribute that indicates that the file was authorized to run. This option causes App Control to periodically revalidate the reputation for files previously authorized by the ISG. + + + Use this option to allow future App Control policy updates to apply without requiring a system reboot. +NOTE: This option is only supported on Windows 10, version 1709 and later, or Windows Server 2019 and later. + + + Use this option on a base policy to allow supplemental policies to expand it. +NOTE: This option is only supported on Windows 10, version 1903 and later, or Windows Server 2022 and later. + + + This option disables the default runtime check that only allows FilePath rules for paths that are only writable by an administrator. +NOTE: This option is only supported on Windows 10, version 1903 and later, or Windows Server 2022 and later. + + + Enables policy enforcement for .NET applications and dynamically loaded libraries. +NOTE: This option is only supported on Windows 10, version 1803 and later, or Windows Server 2019 and later. +NOTE: This option is always enforced if any App Control UMCI policy enables it. There's no audit mode for .NET dynamic code security hardening. + + + Use this option to treat binaries signed with revoked certificates, or expired certificates with the Lifetime Signing EKU on the signature, as "Unsigned binaries" for user-mode process/components, under enterprise signing scenarios. + + + Use this option to trust UWP apps that are debugged in Visual Studio or deployed through device portal when Developer Mode is enabled on the system. + + + It is currently undocumented. + + + It's used by the Smart App Control policy only. + + + Configure Policy Rule Options + + + Please select a policy file before adding options. + + + Please select a policy file before setting a template. + + + Please select a policy template from the dropdown. + + + Invalid policy template selected. Please choose a valid option. + + + Please select a policy file before retrieving its rule options status. + + + Please fill in all three fields. + + + Input Required + + + There is no policy deployed on the system that contains the selected secure setting. + + + Policy not found + + + A policy with the selected secure setting details is currently deployed on the system. + + + Policy found + + + Select main policy XML + + + You need to select an XML file as the main policy + + + Select other policies + + + You need to select at least one more policy to merge with the main policy + + + Merging the policies + + + Deploying the main policy after merge. + + + PolicyMerger + + + MergedPolicy.cip + + + An error occurred during the merge process + + + Policies have been merged successfully + + + Update is not initialized. + + + Checking for update + + + Installing the MSIXBundle path that you selected: + + + The current version is + + + while the online version is + + + , updating the application... + + + Downloading the AppControl Manager MSIXBundle package... + + + The AppControl Manager MSIXBundle package has been successfully downloaded to + + + No MSIXBundle path was selected + + + Detecting/Downloading the SignTool.exe from the Microsoft servers + + + All Downloads finished, installing the new AppControl Manager version + + + An error occurred while trying to remove the ASR rule exclusions which you can safely ignore: + + + Installing the AppControl Manager MSIXBundle package + + + Error installing The AppControl Manager. Error code: + + + - Error text: + + + The AppControl Manager Installation canceled + + + The AppControl Manager Installation succeeded + + + There was an unknown problem installing the AppControl Manager + + + An error occurred while trying to add the ASR rule exclusions which you can safely ignore: + + + Update has been successful. When you close and reopen the AppControl Manager, you will be automatically using the new version. + + + Updates installed + + + The current version is already up to date. + + + An error occurred while checking for update. + + + Requires Windows 11 24H2 or later + + + Deploy Unsigned Policy + + + Deploy Signed Policy + + + Deploying + + + unsigned XML files. + + + Currently Deploying XML file: ' + + + The XML file ' + + + There was an error deploying the selected XML files + + + Successfully deployed all of the selected XML files + + + Deploying + + + Signed XML files. + + + A policy with the same PolicyID + + + is already deployed on the system in Unsigned version. Removing it before deployed the signed version to prevent boot failures. + + + Successfully deployed all of the selected XML files as Signed policies + + + Deploying + + + CIP binary files. + + + Currently Deploying CIP file: ' + + + Successfully deployed all of the selected CIP files + + + Signing into Intune + + + Successfully signed into Intune + + + Cloud Deployment is Currently Active + + + Sign in to Intune was cancelled by the user + + + Sign in to Intune was cancelled by the user + + + There was an error signing into Intune: + + + Signing out of Intune + + + Successfully signed out of Intune + + + Local Deployment is Currently Active + + + There was an error signing out of Intune: + + + Processing + + + Building the certificate... + + + Error + + + Errors occurred while building the certificate + + + Success + + + Successfully generated the certificate with the selected details. The certificate's thumbprint is: ' + + + CreateDenyPolicy is not initialized. + + + Select files or folders + + + No files or folders were selected for Deny policy creation + + + Choose Deny Policy Name + + + You need to provide a name for the Deny policy. + + + You selected + + + files and + + + folders. + + + No compatible files detected + + + No AppControl compatible files have been detected in any of the files and folder paths you selected + + + Scanning a total of + + + AppControl compatible files... + + + Scan completed, creating the Deny policy + + + Deploying the Deny policy on the system + + + An error occurred while creating the Deny policy + + + Successfully created a Deny policy named ' + + + Scalability: + + + is not a valid Scan Level + + + PFN based Deny policy + + + No app was selected to create a deny policy for + + + No policy name was selected for the deny policy + + + Creating the deny policy based on Package Family Names + + + Selected Apps: + + + There was an error: + + + Successfully created the Deny policy + + + Number of Policies: + + + WARNING + + + The policy ' + + + must not be manually removed because you WILL NOT BE ABLE TO USE APPCONTROL MANAGER AGAIN. It is automatically removed when its corresponding base policy is removed from the system. Are you sure you still want to remove it manually? + + + Yes + + + No + + + Before you can safely remove the signed policy named ' + + + with the ID ' + + + I Understand + + + Policy ID + + + Base Policy ID + + + Friendly Name + + + Version + + + Is Authorized + + + Is Enforced + + + Is On Disk + + + Is Signed Policy + + + Is System Policy + + + Policy Options + + + Copy + + + Policy ID: + + + Base Policy ID: + + + Friendly Name: + + + Version: + + + Is Authorized: + + + Is Enforced: + + + Is On Disk: + + + Is Signed Policy: + + + Is System Policy: + + + Policy Options: + + + System's last reboot was + + + Signed policy with the ID ' + + + completed its 1st stage at + + + Signed policy is safe to be removed because system was restarted after 1st stage + + + The selected policy with the name + + + and ID + + + will be changed to the type + + + It will be re-deployed on the system with the same Policy ID and Base Policy ID. If it's currently in Audit Mode, it will be in Enforced Mode after this operation is completed. + + + Any existing Supplemental policy will continue to work. + + + Swapping Policy + + + OK + + + Cancel + + + Last Updated: + + + Error retrieving driver block list information. + + + Configuring Scheduled task for auto update + + + An error occurred. + + + Successfully configured scheduled task to keep the Microsoft Drivers Block Rules up to date + + + Creating the Strict Kernel-mode policy + + + There was an error creating Strict Kernel-mode policy: + + + Successfully created the Strict Kernel-mode policy + \ No newline at end of file diff --git a/AppControl Manager/XMLOps/ClearCiPolicySemantic.cs b/AppControl Manager/XMLOps/ClearCiPolicySemantic.cs deleted file mode 100644 index fc95352b6..000000000 --- a/AppControl Manager/XMLOps/ClearCiPolicySemantic.cs +++ /dev/null @@ -1,68 +0,0 @@ -using System.Collections.Generic; -using System.Xml; -using AppControlManager.Others; - -namespace AppControlManager.XMLOps; - -internal static class ClearCiPolicySemantic -{ - /// - /// Clears the CI Policy XML file from all nodes except the base nodes - /// According to the CI Schema - /// - /// - internal static void Clear(string xmlFilePath) - { - // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); - - #region Defining the Nodes to keep and clear, according to the CI Schema - - List baseNodes = []; - baseNodes.Add(codeIntegrityPolicy.SiPolicyNode.SelectSingleNode("ns:EKUs", codeIntegrityPolicy.NamespaceManager)!); - baseNodes.Add(codeIntegrityPolicy.FileRulesNode); - baseNodes.Add(codeIntegrityPolicy.SignersNode); - - baseNodes.Add(codeIntegrityPolicy.UMCI_ProductSignersNode); - baseNodes.Add(codeIntegrityPolicy.KMCI_ProductSignersNode); - - baseNodes.Add(codeIntegrityPolicy.UMCI_ProductSigners_FileRulesRef_Node); - baseNodes.Add(codeIntegrityPolicy.KMCI_ProductSigners_FileRulesRef_Node); - - XmlNode? updatePolicySigners = codeIntegrityPolicy.SiPolicyNode.SelectSingleNode("ns:UpdatePolicySigners", codeIntegrityPolicy.NamespaceManager); - - if (updatePolicySigners is not null) - { - baseNodes.Add(updatePolicySigners); - } - baseNodes.Add(codeIntegrityPolicy.CiSignersNode); - - #endregion - - // Remove node completely since it can't be left empty and it's not a base node - XmlNode? macros = codeIntegrityPolicy.SiPolicyNode.SelectSingleNode("ns:Macros", codeIntegrityPolicy.NamespaceManager); - if (macros is not null) - { - _ = codeIntegrityPolicy.SiPolicyNode.RemoveChild(macros); - } - - // Loop over each base node - foreach (XmlNode node in baseNodes) - { - // Remove all child nodes - while (node.HasChildNodes) - { - _ = node.RemoveChild(node.FirstChild!); - } - - // Set the node/element to be serialized in the short tag format - // https://learn.microsoft.com/en-us/dotnet/api/system.xml.xmlelement.isempty - if (node is XmlElement element) - { - element.IsEmpty = true; - } - } - - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, xmlFilePath); - } -} diff --git a/AppControl Manager/XMLOps/EditGUIDs.cs b/AppControl Manager/XMLOps/EditGUIDs.cs index d4b3a5d22..a55a3f252 100644 --- a/AppControl Manager/XMLOps/EditGUIDs.cs +++ b/AppControl Manager/XMLOps/EditGUIDs.cs @@ -1,5 +1,4 @@ -using System.IO; -using AppControlManager.Others; +using System; namespace AppControlManager.XMLOps; @@ -7,21 +6,25 @@ internal static class PolicyEditor { /// /// Swaps the PolicyID and BasePolicyID GUIDs in an App Control for Business policy XML file for Base policies. - /// Shouldn't be used for supplemental policies. /// /// /// - internal static void EditGuids(string policyIdInput, FileInfo policyFilePathInput) + internal static void EditGuids(string policyIdInput, string policyFilePathInput) { // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(policyFilePathInput.FullName, null); + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(policyFilePathInput, null); + + if (policyObj.PolicyType is SiPolicy.PolicyType.SupplementalPolicy) + { + throw new InvalidOperationException("Don't use this method for Supplemental policies"); + } string policyId = "{" + policyIdInput + "}"; - codeIntegrityPolicy.PolicyIDNode.InnerText = policyId; - codeIntegrityPolicy.BasePolicyIDNode.InnerText = policyId; + policyObj.BasePolicyID = policyId; + policyObj.PolicyID = policyId; - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, policyFilePathInput.FullName); + SiPolicy.Management.SavePolicyToFile(policyObj, policyFilePathInput); } } diff --git a/AppControl Manager/XMLOps/NewCertificateSignerRules.cs b/AppControl Manager/XMLOps/NewCertificateSignerRules.cs index 1f8771884..830b8752f 100644 --- a/AppControl Manager/XMLOps/NewCertificateSignerRules.cs +++ b/AppControl Manager/XMLOps/NewCertificateSignerRules.cs @@ -23,7 +23,7 @@ internal static void CreateAllow(string xmlFilePath, List data) } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); Logger.Write($"NewFilePathRules: There are {data.Count} FilePath rules to be added to the XML file '{xmlFilePath}'"); @@ -81,7 +81,7 @@ internal static void CreateDeny(string xmlFilePath, List data) } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); Logger.Write($"NewFilePathRules: There are {data.Count} FilePath rules to be added to the XML file '{xmlFilePath}'"); diff --git a/AppControl Manager/XMLOps/NewFilePublisherLevelRules.cs b/AppControl Manager/XMLOps/NewFilePublisherLevelRules.cs index 2dbea7821..9a3c44f53 100644 --- a/AppControl Manager/XMLOps/NewFilePublisherLevelRules.cs +++ b/AppControl Manager/XMLOps/NewFilePublisherLevelRules.cs @@ -25,7 +25,7 @@ internal static void CreateAllow(string xmlFilePath, List hashes) } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); Logger.Write($"NewHashLevelRules: There are {hashes.Count} Hash rules to be added to the XML file '{xmlFilePath}'"); @@ -114,7 +114,7 @@ internal static void CreateDeny(string xmlFilePath, List hashes) } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); Logger.Write($"NewHashLevelRules: There are {hashes.Count} Hash rules to be added to the XML file '{xmlFilePath}'"); diff --git a/AppControl Manager/XMLOps/NewPFNLevelRules.cs b/AppControl Manager/XMLOps/NewPFNLevelRules.cs index 4224ec237..852ddec5d 100644 --- a/AppControl Manager/XMLOps/NewPFNLevelRules.cs +++ b/AppControl Manager/XMLOps/NewPFNLevelRules.cs @@ -23,7 +23,7 @@ internal static void CreateAllow(string xmlFilePath, List PFNDat } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); foreach (PFNRuleCreator PFN in PFNData) { @@ -70,7 +70,7 @@ internal static void CreateDeny(string xmlFilePath, List PFNData } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); foreach (PFNRuleCreator PFN in PFNData) { diff --git a/AppControl Manager/XMLOps/NewPublisherLevelRules.cs b/AppControl Manager/XMLOps/NewPublisherLevelRules.cs index 62ca937b4..217a07460 100644 --- a/AppControl Manager/XMLOps/NewPublisherLevelRules.cs +++ b/AppControl Manager/XMLOps/NewPublisherLevelRules.cs @@ -25,7 +25,7 @@ internal static void CreateAllow(string xmlFilePath, List } // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath, null); + CodeIntegrityPolicy codeIntegrityPolicy = new(xmlFilePath); Logger.Write($"NewPublisherLevelRules: There are {publisherSigners.Count} Publisher Signers to be added to the XML file '{xmlFilePath}'"); diff --git a/AppControl Manager/XMLOps/SetCiPolicyInfo.cs b/AppControl Manager/XMLOps/SetCiPolicyInfo.cs index 76bb4180b..8b28c6c79 100644 --- a/AppControl Manager/XMLOps/SetCiPolicyInfo.cs +++ b/AppControl Manager/XMLOps/SetCiPolicyInfo.cs @@ -1,6 +1,5 @@ using System; -using System.Xml; -using AppControlManager.Main; +using System.Collections.Generic; using AppControlManager.Others; namespace AppControlManager.XMLOps; @@ -40,95 +39,47 @@ internal static string Set(string filePath, bool? resetPolicyID, string? policyN { // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(filePath, null); - - XmlNode? SettingsNode = codeIntegrityPolicy.SiPolicyNode.SelectSingleNode("ns:Settings", codeIntegrityPolicy.NamespaceManager); - XmlNodeList? SettingNodes; - string? CurrentPolicyName; - - string PolicyType = codeIntegrityPolicy.SiPolicyNode.Attributes?["PolicyType"]?.Value!; + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(filePath, null); #region PolicyName Processing - // Check if Settings node exists, if not, create it - if (SettingsNode is null) + if (!string.IsNullOrEmpty(policyName)) { - SettingsNode = codeIntegrityPolicy.XmlDocument.CreateElement("Settings", GlobalVars.SiPolicyNamespace); - _ = codeIntegrityPolicy.SiPolicyNode.AppendChild(SettingsNode); - } - // Get the list of Setting nodes - SettingNodes = SettingsNode.SelectNodes("ns:Setting", codeIntegrityPolicy.NamespaceManager); + bool nameSettingFound = false; - // Find the specific Setting node with ValueName="Name" and extract its string value or create it if not found - - // nameSettingNode that will be used to assign the policy name - XmlNode? nameSettingNode = null; - - if (SettingNodes is not null) - { - foreach (XmlNode setting in SettingNodes) + foreach (SiPolicy.Setting item in policyObj.Settings) { - // Check if the "ValueName" attribute is present and equals "Name" - if (string.Equals(setting.Attributes?["ValueName"]?.Value, "Name", StringComparison.OrdinalIgnoreCase)) + if (string.Equals(item.ValueName, "Name", StringComparison.OrdinalIgnoreCase)) { - nameSettingNode = setting; - break; + item.Value.Item = policyName; + + nameSettingFound = true; } } - } - - // If the Setting node with ValueName="Name" does not exist, create it - if (nameSettingNode is null) - { - nameSettingNode = codeIntegrityPolicy.XmlDocument.CreateElement("Setting", GlobalVars.SiPolicyNamespace); - - XmlAttribute providerAttr = codeIntegrityPolicy.XmlDocument.CreateAttribute("Provider"); - providerAttr.Value = "PolicyInfo"; - _ = nameSettingNode.Attributes!.Append(providerAttr); - - XmlAttribute keyAttr = codeIntegrityPolicy.XmlDocument.CreateAttribute("Key"); - keyAttr.Value = "Information"; - _ = nameSettingNode.Attributes.Append(keyAttr); - XmlAttribute valueNameAttr = codeIntegrityPolicy.XmlDocument.CreateAttribute("ValueName"); - valueNameAttr.Value = "Name"; - _ = nameSettingNode.Attributes.Append(valueNameAttr); - - // Append the new Setting node to Settings - _ = SettingsNode.AppendChild(nameSettingNode); - } - - // Now check if the Value node with the inner String node exists, and create if not - XmlNode? valueNode = nameSettingNode.SelectSingleNode("ns:Value/ns:String", codeIntegrityPolicy.NamespaceManager); - - if (valueNode is null) - { - // Create Value node - XmlNode newValueNode = codeIntegrityPolicy.XmlDocument.CreateElement("Value", GlobalVars.SiPolicyNamespace); - XmlNode newStringNode = codeIntegrityPolicy.XmlDocument.CreateElement("String", GlobalVars.SiPolicyNamespace); - - _ = newValueNode.AppendChild(newStringNode); - _ = nameSettingNode.AppendChild(newValueNode); - - valueNode = newStringNode; - } - - // Update the policy name or assign default value if not provided - if (!string.IsNullOrWhiteSpace(policyName)) - { - valueNode.InnerText = policyName; - CurrentPolicyName = policyName; - } - else - { - // If policyName was not provided, retain the current name - CurrentPolicyName = valueNode.InnerText; + // If the Setting node with ValueName="Name" does not exist, create it + if (!nameSettingFound) + { + SiPolicy.Setting newNameSetting = new() + { + Provider = "PolicyInfo", + Key = "Information", + ValueName = "Name", + Value = new SiPolicy.SettingValueType() + { + Item = policyName + } + }; + + List settings = [.. policyObj.Settings]; + settings.Add(newNameSetting); + policyObj.Settings = [.. settings]; + } } #endregion - #region resetPolicyID processing // If the resetPolicyID is true, then assign a new GUID to the PolicyID and BasePolicyID @@ -140,13 +91,12 @@ internal static string Set(string filePath, bool? resetPolicyID, string? policyN // Convert it to string string newRandomGUIDString = $"{{{newRandomGUID.ToString().ToUpperInvariant()}}}"; - codeIntegrityPolicy.PolicyIDNode.InnerText = newRandomGUIDString; - codeIntegrityPolicy.BasePolicyIDNode.InnerText = newRandomGUIDString; + policyObj.BasePolicyID = newRandomGUIDString; + policyObj.PolicyID = newRandomGUIDString; } #endregion - #region basePolicyID processing if (!string.IsNullOrWhiteSpace(basePolicyID)) @@ -163,81 +113,52 @@ internal static string Set(string filePath, bool? resetPolicyID, string? policyN string tempVar = $"{{{basePolicyID.ToUpperInvariant()}}}"; // Set the BasePolicyID of the policy file to the user provided one - codeIntegrityPolicy.BasePolicyIDNode.InnerText = tempVar; + policyObj.BasePolicyID = tempVar; } #endregion - #region basePolicyToSupplementPath processing if (!string.IsNullOrWhiteSpace(basePolicyToSupplementPath)) { - - XmlDocument xmlDocument2 = new(); - xmlDocument2.Load(basePolicyToSupplementPath); - - // Create namespace manager and add the default namespace with a prefix - XmlNamespaceManager namespaceManager2 = new(xmlDocument2.NameTable); - namespaceManager2.AddNamespace("ns", GlobalVars.SiPolicyNamespace); - - // Get SiPolicy node - XmlNode siPolicyNode2 = xmlDocument2.SelectSingleNode("ns:SiPolicy", namespaceManager2) - ?? throw new InvalidOperationException("Invalid XML structure, SiPolicy node not found"); - - // Get the PolicyID node which is an immediate node under SiPolicy node - XmlNode CurrentPolicyIDNode2 = siPolicyNode2.SelectSingleNode("ns:PolicyID", namespaceManager2) ?? throw new InvalidOperationException($"PolicyID was not found in {basePolicyToSupplementPath}"); - - // Set the BasePolicyID of the policy file to the PolicyID of the method's 1st parameter XML file - codeIntegrityPolicy.BasePolicyIDNode.InnerText = CurrentPolicyIDNode2.InnerText; + SiPolicy.SiPolicy policyObj2 = SiPolicy.Management.Initialize(basePolicyToSupplementPath, null); + policyObj.BasePolicyID = policyObj2.PolicyID; } #endregion - #region Checking Policy Type - if (string.Equals(PolicyType, "Supplemental Policy", StringComparison.OrdinalIgnoreCase)) + if (policyObj.PolicyType is SiPolicy.PolicyType.SupplementalPolicy) { - if (string.Equals(codeIntegrityPolicy.BasePolicyIDNode.InnerText, codeIntegrityPolicy.PolicyIDNode.InnerText, StringComparison.OrdinalIgnoreCase)) + if (string.Equals(policyObj.PolicyID, policyObj.BasePolicyID, StringComparison.OrdinalIgnoreCase)) { Logger.Write("The selected XML policy file is a Supplemental policy but its BasePolicyID and PolicyID are the same, indicating it is a Base policy, changing the type."); - - codeIntegrityPolicy.SiPolicyNode.Attributes!["PolicyType"]!.Value = "Base Policy"; - // Set this variable to the updated type for the type check that happens later - PolicyType = "Base Policy"; + policyObj.PolicyType = SiPolicy.PolicyType.BasePolicy; } } - if (string.Equals(PolicyType, "Base Policy", StringComparison.OrdinalIgnoreCase)) + if (policyObj.PolicyType is SiPolicy.PolicyType.BasePolicy) { - if (!string.Equals(codeIntegrityPolicy.BasePolicyIDNode.InnerText, codeIntegrityPolicy.PolicyIDNode.InnerText, StringComparison.OrdinalIgnoreCase)) + if (!string.Equals(policyObj.PolicyID, policyObj.BasePolicyID, StringComparison.OrdinalIgnoreCase)) { Logger.Write("The selected XML policy file is a Base policy but its BasePolicyID and PolicyID are not the same, indicating it is a Supplemental policy, changing the type."); - codeIntegrityPolicy.SiPolicyNode.Attributes!["PolicyType"]!.Value = "Supplemental Policy"; - // Set this variable to the updated type for the type check that happens later - PolicyType = "Supplemental Policy"; + policyObj.PolicyType = SiPolicy.PolicyType.SupplementalPolicy; } } #endregion - // Save the changes to the XML file - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, filePath); - - // Validate the XML file at the end - if (!CiPolicyTest.TestCiPolicy(filePath)) - { - throw new InvalidOperationException("SetCiPolicyInfo.Set: The XML file created at the end is not compliant with the CI policy schema"); - } + SiPolicy.Management.SavePolicyToFile(policyObj, filePath); - Logger.Write($"Successfully configured the policy at '{filePath}'. Now it has the Name '{CurrentPolicyName}', Type '{PolicyType}', BasePolicyID '{codeIntegrityPolicy.BasePolicyIDNode.InnerText}' and PolicyID '{codeIntegrityPolicy.PolicyIDNode.InnerText}'."); + Logger.Write($"Successfully configured the policy at '{filePath}'. Now it has the Type '{policyObj.PolicyType}', BasePolicyID '{policyObj.BasePolicyID}' and PolicyID '{policyObj.PolicyID}'."); - return codeIntegrityPolicy.PolicyIDNode.InnerText; + return policyObj.PolicyID; } @@ -253,13 +174,13 @@ internal static void Set(string filePath, Version version, string? ID = null) { // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(filePath, null); + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(filePath, null); // save the current XML policy version to a variable prior to modifying it - string OriginalXMLPolicyVersion = codeIntegrityPolicy.VersionExNode.InnerText; + string OriginalXMLPolicyVersion = policyObj.VersionEx; // Set the user provided version to the policy - codeIntegrityPolicy.VersionExNode.InnerText = version.ToString(); + policyObj.VersionEx = version.ToString(); // If the ID parameter was provided if (ID is not null) @@ -275,25 +196,16 @@ internal static void Set(string filePath, Version version, string? ID = null) string tempVar = $"{{{AdjustedID.ToUpperInvariant()}}}"; // Set the BasePolicyID of the policy file to the user provided one - codeIntegrityPolicy.BasePolicyIDNode.InnerText = tempVar; + policyObj.BasePolicyID = tempVar; // Set the PolicyID of the policy file to the user provided one - codeIntegrityPolicy.PolicyIDNode.InnerText = tempVar; + policyObj.PolicyID = tempVar; } // Save the changes to the XML file - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, filePath); - - // Validate the XML file at the end - if (!CiPolicyTest.TestCiPolicy(filePath)) - { - throw new InvalidOperationException("SetCiPolicyInfo.Set: The XML file created at the end is not compliant with the CI policy schema"); - } + SiPolicy.Management.SavePolicyToFile(policyObj, filePath); Logger.Write($"Successfully set the version of the policy file at '{filePath}' from '{OriginalXMLPolicyVersion}' to '{version}'."); - } - - } diff --git a/AppControl Manager/XMLOps/UpdateHvciOptions.cs b/AppControl Manager/XMLOps/UpdateHvciOptions.cs index 90a4866fd..e6b9bc822 100644 --- a/AppControl Manager/XMLOps/UpdateHvciOptions.cs +++ b/AppControl Manager/XMLOps/UpdateHvciOptions.cs @@ -1,6 +1,4 @@ using System; -using System.Xml; -using AppControlManager.Main; using AppControlManager.Others; namespace AppControlManager.XMLOps; @@ -9,47 +7,19 @@ internal static class UpdateHvciOptions { /// /// Sets the HVCI option to Strict or (2) in a policy XML file - /// It checks if node exists, and if its value is anything other than 2, it sets it to 2. - /// If node does not exists, it creates and inserts it after the node. /// /// /// internal static void Update(string filePath) { // Instantiate the policy - CodeIntegrityPolicy codeIntegrityPolicy = new(filePath, null); + SiPolicy.SiPolicy policyObj = SiPolicy.Management.Initialize(filePath, null); - // Select the HvciOptions node - XmlNode? hvciOptionsNode = codeIntegrityPolicy.SiPolicyNode.SelectSingleNode("ns:HvciOptions", codeIntegrityPolicy.NamespaceManager); - - // If HvciOptions node exists - if (hvciOptionsNode is not null) - { - // Ensure the value is "2" - if (!string.Equals(hvciOptionsNode.InnerText, "2", StringComparison.OrdinalIgnoreCase)) - { - hvciOptionsNode.InnerText = "2"; - } - } - else - { - // Create the HvciOptions node if it doesn't exist - hvciOptionsNode = codeIntegrityPolicy.XmlDocument.CreateElement("HvciOptions", GlobalVars.SiPolicyNamespace); - hvciOptionsNode.InnerText = "2"; - - // Insert it after CiSigners node - _ = codeIntegrityPolicy.SiPolicyNode.InsertAfter(hvciOptionsNode, codeIntegrityPolicy.CiSignersNode); - - } + policyObj.HvciOptionsSpecified = true; + policyObj.HvciOptions = 2; // Save the modified XML document - CodeIntegrityPolicy.Save(codeIntegrityPolicy.XmlDocument, filePath); - - // Validate the XML file at the end - if (!CiPolicyTest.TestCiPolicy(filePath)) - { - throw new InvalidOperationException("UpdateHvciOptions: The XML file created at the end is not compliant with the CI policy schema"); - } + SiPolicy.Management.SavePolicyToFile(policyObj, filePath); Logger.Write($"Successfully set the HVCI in the policy file '{filePath}' to Strict."); } diff --git a/Wiki posts/App Control for Business/WDAC Notes.md b/Wiki posts/App Control for Business/WDAC Notes.md index da05df678..538f046a6 100644 --- a/Wiki posts/App Control for Business/WDAC Notes.md +++ b/Wiki posts/App Control for Business/WDAC Notes.md @@ -597,6 +597,26 @@ If you deploy an App Control policy that has the `Disabled:Flight Signing` rule
+## Assign an ID Setting to Policies So Events Generated By Them Show Full Details + +Ensure all of your App Control policies have an ID Setting + +```xml + + + 123456 + + +``` + +If a policy lacks that setting, the resulting Code Integrity event logs—for instance, those generated when a file is blocked—will not include specific details, such as the name of the policy responsible for the event. + +
+ +horizontal super thin rainbow RGB line + +
+ ## Continue Reading about BYOVD using App Control for Business [Continue reading about BYOVD protection with App Control for Business](#-continue-reading-about-byovd-protection-with-wdac) #### [App Control policy](https://github.com/HotCakeX/Harden-Windows-Security/wiki/WDAC-policy-for-BYOVD-Kernel-mode-only-protection) for BYOVD Kernel mode only protection