netero1010 / EDRSilencer

A tool uses Windows Filtering Platform (WFP) to block Endpoint Detection and Response (EDR) agents from reporting security events to the server.
MIT License
1.46k stars 185 forks source link

Compilation failure #4

Closed 10cks closed 1 week ago

10cks commented 10 months ago

GCC version:

> x86_64-w64-mingw32-gcc --version                                          
x86_64-w64-mingw32-gcc (GCC) 9.3-win32 20200320
Copyright (C) 2019 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

Error log:

EDRSilencer.c: In function ‘BlockEdrProcessTraffic’:
EDRSilencer.c:106:5: warning: implicit declaration of function ‘FwpmEngineOpen0’ [-Wimplicit-function-declaration]
  106 |     FwpmEngineOpen0(NULL, RPC_C_AUTHN_DEFAULT, NULL, NULL, &hEngine);
      |     ^~~~~~~~~~~~~~~
EDRSilencer.c:137:17: warning: implicit declaration of function ‘QueryFullProcessImageNameW’ [-Wimplicit-function-declaration]
  137 |                 QueryFullProcessImageNameW(hProcess, 0, fullPath, &size);
      |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c:138:17: error: unknown type name ‘FWPM_FILTER_CONDITION0’
  138 |                 FWPM_FILTER_CONDITION0 cond;
      |                 ^~~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c:139:17: error: unknown type name ‘FWPM_FILTER0’
  139 |                 FWPM_FILTER0 filter = {0};
      |                 ^~~~~~~~~~~~
EDRSilencer.c:142:21: warning: implicit declaration of function ‘FwpmGetAppIdFromFileName0’ [-Wimplicit-function-declaration]
  142 |                 if (FwpmGetAppIdFromFileName0(fullPath, &appId) != ERROR_SUCCESS) {
      |                     ^~~~~~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c:149:23: error: request for member ‘displayData’ in something not a structure or union
  149 |                 filter.displayData.name = filterName;
      |                       ^
EDRSilencer.c:150:23: error: request for member ‘flags’ in something not a structure or union
  150 |                 filter.flags = FWPM_FILTER_FLAG_PERSISTENT;
      |                       ^
EDRSilencer.c:151:23: error: request for member ‘layerKey’ in something not a structure or union
  151 |                 filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
      |                       ^
EDRSilencer.c:152:23: error: request for member ‘action’ in something not a structure or union
  152 |                 filter.action.type = FWP_ACTION_BLOCK;
      |                       ^
EDRSilencer.c:153:21: error: request for member ‘fieldKey’ in something not a structure or union
  153 |                 cond.fieldKey = FWPM_CONDITION_ALE_APP_ID;
      |                     ^
EDRSilencer.c:154:21: error: request for member ‘matchType’ in something not a structure or union
  154 |                 cond.matchType = FWP_MATCH_EQUAL;
      |                     ^
EDRSilencer.c:155:21: error: request for member ‘conditionValue’ in something not a structure or union
  155 |                 cond.conditionValue.type = FWP_BYTE_BLOB_TYPE;
      |                     ^
EDRSilencer.c:156:21: error: request for member ‘conditionValue’ in something not a structure or union
  156 |                 cond.conditionValue.byteBlob = appId;
      |                     ^
EDRSilencer.c:157:23: error: request for member ‘filterCondition’ in something not a structure or union
  157 |                 filter.filterCondition = &cond;
      |                       ^
EDRSilencer.c:158:23: error: request for member ‘numFilterConditions’ in something not a structure or union
  158 |                 filter.numFilterConditions = 1;
      |                       ^
EDRSilencer.c:164:26: warning: implicit declaration of function ‘FwpmFilterAdd0’ [-Wimplicit-function-declaration]
  164 |                 result = FwpmFilterAdd0(hEngine, &filter, NULL, &filterId);
      |                          ^~~~~~~~~~~~~~
EDRSilencer.c:171:23: error: request for member ‘layerKey’ in something not a structure or union
  171 |                 filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
      |                       ^
EDRSilencer.c:179:17: warning: implicit declaration of function ‘FwpmFreeMemory0’ [-Wimplicit-function-declaration]
  179 |                 FwpmFreeMemory0((void**)&appId);
      |                 ^~~~~~~~~~~~~~~
EDRSilencer.c:191:5: warning: implicit declaration of function ‘FwpmEngineClose0’ [-Wimplicit-function-declaration]
  191 |     FwpmEngineClose0(hEngine);
      |     ^~~~~~~~~~~~~~~~
EDRSilencer.c: In function ‘BlockProcessTraffic’:
EDRSilencer.c:203:5: error: unknown type name ‘FWPM_FILTER_CONDITION0’
  203 |     FWPM_FILTER_CONDITION0 cond;
      |     ^~~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c:204:5: error: unknown type name ‘FWPM_FILTER0’
  204 |     FWPM_FILTER0 filter = {0};
      |     ^~~~~~~~~~~~
EDRSilencer.c:214:11: error: request for member ‘displayData’ in something not a structure or union
  214 |     filter.displayData.name = filterName;
      |           ^
EDRSilencer.c:215:11: error: request for member ‘flags’ in something not a structure or union
  215 |     filter.flags = FWPM_FILTER_FLAG_PERSISTENT;
      |           ^
EDRSilencer.c:216:11: error: request for member ‘layerKey’ in something not a structure or union
  216 |     filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
      |           ^
EDRSilencer.c:217:11: error: request for member ‘action’ in something not a structure or union
  217 |     filter.action.type = FWP_ACTION_BLOCK;
      |           ^
EDRSilencer.c:218:9: error: request for member ‘fieldKey’ in something not a structure or union
  218 |     cond.fieldKey = FWPM_CONDITION_ALE_APP_ID;
      |         ^
EDRSilencer.c:219:9: error: request for member ‘matchType’ in something not a structure or union
  219 |     cond.matchType = FWP_MATCH_EQUAL;
      |         ^
EDRSilencer.c:220:9: error: request for member ‘conditionValue’ in something not a structure or union
  220 |     cond.conditionValue.type = FWP_BYTE_BLOB_TYPE;
      |         ^
EDRSilencer.c:221:9: error: request for member ‘conditionValue’ in something not a structure or union
  221 |     cond.conditionValue.byteBlob = appId;
      |         ^
EDRSilencer.c:222:11: error: request for member ‘filterCondition’ in something not a structure or union
  222 |     filter.filterCondition = &cond;
      |           ^
EDRSilencer.c:223:11: error: request for member ‘numFilterConditions’ in something not a structure or union
  223 |     filter.numFilterConditions = 1;
      |           ^
EDRSilencer.c:236:11: error: request for member ‘layerKey’ in something not a structure or union
  236 |     filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V6;
      |           ^
EDRSilencer.c: In function ‘UnblockAllWfpFilters’:
EDRSilencer.c:254:5: error: unknown type name ‘FWPM_FILTER0’
  254 |     FWPM_FILTER0** filters;
      |     ^~~~~~~~~~~~
EDRSilencer.c:263:14: warning: implicit declaration of function ‘FwpmFilterCreateEnumHandle0’ [-Wimplicit-function-declaration]
  263 |     result = FwpmFilterCreateEnumHandle0(hEngine, NULL, &enumHandle);
      |              ^~~~~~~~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c:270:18: warning: implicit declaration of function ‘FwpmFilterEnum0’ [-Wimplicit-function-declaration]
  270 |         result = FwpmFilterEnum0(hEngine, enumHandle, 1, &filters, &numFilters);
      |                  ^~~~~~~~~~~~~~~
EDRSilencer.c:274:13: warning: implicit declaration of function ‘FwpmFilterDestroyEnumHandle0’ [-Wimplicit-function-declaration]
  274 |             FwpmFilterDestroyEnumHandle0(hEngine, enumHandle);
      |             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c:283:9: error: unknown type name ‘FWPM_DISPLAY_DATA0’
  283 |         FWPM_DISPLAY_DATA0 *data = &filters[0]->displayData;
      |         ^~~~~~~~~~~~~~~~~~
EDRSilencer.c:283:47: error: request for member ‘displayData’ in something not a structure or union
  283 |         FWPM_DISPLAY_DATA0 *data = &filters[0]->displayData;
      |                                               ^~
EDRSilencer.c:284:40: error: request for member ‘name’ in something not a structure or union
  284 |         WCHAR* currentFilterName = data->name;
      |                                        ^~
EDRSilencer.c:287:41: error: request for member ‘filterId’ in something not a structure or union
  287 |             UINT64 filterId = filters[0]->filterId;
      |                                         ^~
EDRSilencer.c:288:22: warning: implicit declaration of function ‘FwpmFilterDeleteById0’ [-Wimplicit-function-declaration]
  288 |             result = FwpmFilterDeleteById0(hEngine, filterId);
      |                      ^~~~~~~~~~~~~~~~~~~~~
EDRSilencer.c: In function ‘UnblockWfpFilter’:
EDRSilencer.c:320:24: error: ‘FWP_E_FILTER_NOT_FOUND’ undeclared (first use in this function); did you mean ‘ERROR_FILE_NOT_FOUND’?
  320 |     else if (result == FWP_E_FILTER_NOT_FOUND) {
      |                        ^~~~~~~~~~~~~~~~~~~~~~
      |                        ERROR_FILE_NOT_FOUND
EDRSilencer.c:320:24: note: each undeclared identifier is reported only once for each function it appears in
netero1010 commented 10 months ago

The definition of WFP APIs and structures referred to the "fwpmu.h" header. Your error message means the "fwpmu.h" included in your header file did not have those WFP APIs and structures defined .

Would you mind to double confirm if the "fwpmu.h" file used by your GCC compiler has proper definition of those WFP related APIs and structures? or you may try to re-install with more latest GCC version and see if it can be solved.

Tw1sm commented 6 months ago

I ran into this exact error as well, found that I had to include -D_WIN32_WINNT=0x0600 when compiling to specify Vista and above

x86_64-w64-mingw32-gcc -D_WIN32_WINNT=0x0600 EDRSilencer.c utils.c -o EDRSilencer.exe -lfwpuclnt