using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Runtime.InteropServices;
using Masuit.Tools.Files;
using Masuit.Tools.Systems;
namespace Masuit.Tools.Win32.AntiVirus;
public class WindowsDefenderScanService
{
public WindowsDefenderScanService()
{
if (!Directory.Exists(SystemParameter.WindowsDefenderPath))
{
throw new PlatformNotSupportedException("Windows Defender not found");
}
if (!File.Exists($"{SystemParameter.WindowsDefenderPath}\\{SystemParameter.WindowsDefenderExeName}"))
{
throw new PlatformNotSupportedException("Windows Defender not found");
}
}
///
/// 扫描文件流
///
///
public ScanResult ScanStream(Stream stream)
{
var temp = Path.Combine(Environment.GetEnvironmentVariable("temp"), SnowFlake.NewId);
stream.SaveFile(temp);
if (stream.CanSeek)
{
stream.Position = 0;
}
return ScanFile(temp);
}
///
/// 扫描文件
///
///
public ScanResult ScanFile(string filePath)
{
if (!File.Exists(filePath))
{
throw new FileNotFoundException();
}
try
{
//Scanning xxxxx found 1 threats.
//Scanning xxxxx found no threats.
var result = RunScanCommand(filePath);
if (result.Contains("found no threats"))
{
return new ScanResult
{
Result = ResultCode.NotDetected,
};
}
return new ScanResult
{
Result = ResultCode.Detected,
};
}
catch (Exception ex)
{
return new ScanResult
{
Result = ResultCode.Exception,
Msg = ex.Message
};
}
}
///
/// 扫描文件夹(不支持递文件夹嵌套文件夹的扫描)
///
///
/// 如有威胁文件,只返回文件夹中有威胁的文件
public ScanResult ScanDirectory(string directoryPath)
{
if (!Directory.Exists(directoryPath))
{
throw new DirectoryNotFoundException();
}
try
{
var files = Directory.GetFiles(directoryPath);
//文件夹扫描
var result = RunScanCommand(directoryPath);
if (result.Contains("found no threats"))
{
return new ScanResult
{
Result = ResultCode.NotDetected,
};
}
result = result.ToLower();
var detectedFile = (from file in files
let filePath = $"{file}\r\n"
where result.Contains(filePath.ToLower())
select file.Replace(directoryPath, "").Replace("\\", "")).ToList();
//解析文件,找到有威胁的文件
return new ScanResult
{
Result = ResultCode.Detected,
Msg = string.Join(";", detectedFile)
};
}
catch (Exception ex)
{
return new ScanResult
{
Result = ResultCode.Exception,
Msg = ex.Message
};
}
}
///
/// 运行命令
///
///
///
private string RunScanCommand(string path)
{
if (!RuntimeInformation.IsOSPlatform(OSPlatform.Windows))
{
throw new PlatformNotSupportedException();
}
var proc = new Process();
try
{
proc.StartInfo.FileName = "cmd.exe";
proc.StartInfo.UseShellExecute = false;
proc.StartInfo.RedirectStandardInput = true;
proc.StartInfo.RedirectStandardOutput = true;
proc.StartInfo.RedirectStandardError = true;
proc.StartInfo.CreateNoWindow = true;
proc.Start();
var command = $"\"{SystemParameter.WindowsDefenderPath}\\{SystemParameter.WindowsDefenderExeName}\" -Scan -ScanType 3 -File \"{path}\" -DisableRemediation";
proc.StandardInput.WriteLine(command);
proc.StandardInput.WriteLine("exit");
while (!proc.HasExited)
{
proc.WaitForExit(1000);
}
return proc.StandardOutput.ReadToEnd();
}
catch (Exception ex)
{
throw new WindowsDefenderScanException();
}
finally
{
proc.Close();
proc.Dispose();
}
}
}