DNSTunnelDetector.cpp

// DNSTunnelDetector.cpp - Détection tunneling DNS et exfiltration via DNS
// Analyse requêtes DNS (longueur, entropie, fréquence), détection C2 beaconing
// Partie de WinToolsSuite - forensics.malware-analysis.windows-internals
// Unicode, Win32 GUI, Threading, UI Français, RAII, CSV UTF-8, Logging

#define UNICODE
#define _UNICODE
#define _WIN32_WINNT 0x0601
#include <windows.h>
#include <commctrl.h>
#include <winevt.h>
#include <vector>
#include <string>
#include <fstream>
#include <sstream>
#include <iomanip>
#include <map>
#include <cmath>
#include <algorithm>

#pragma comment(lib, "comctl32.lib")
#pragma comment(lib, "wevtapi.lib")
#pragma comment(linker, "\"/manifestdependency:type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publickeytoken='6595b64144ccf1df' language='*'\"")

// === RAII Wrappers ===
class EvtHandle {
    EVT_HANDLE h = nullptr;
public:
    explicit EvtHandle(EVT_HANDLE handle) : h(handle) {}
    ~EvtHandle() { if (h) EvtClose(h); }
    EVT_HANDLE Get() const { return h; }
    bool IsValid() const { return h != nullptr; }
};

class FileHandle {
    HANDLE h = INVALID_HANDLE_VALUE;
public:
    explicit FileHandle(HANDLE handle) : h(handle) {}
    ~FileHandle() { if (h != INVALID_HANDLE_VALUE) CloseHandle(h); }
    HANDLE Get() const { return h; }
    bool IsValid() const { return h != INVALID_HANDLE_VALUE; }
};

// === Structures ===
struct DNSQueryInfo {
    std::wstring timestamp;
    std::wstring fqdn;
    std::wstring queryType;
    double entropy;
    int maxLabelLength;
    int frequency;
    bool suspect;
    std::wstring notes;
};

// === Globals ===
HWND g_hMainWnd = nullptr;
HWND g_hListView = nullptr;
HWND g_hStatusBar = nullptr;
HWND g_hBtnAnalyze = nullptr;
HWND g_hBtnFilter = nullptr;
HWND g_hBtnBlacklist = nullptr;
HWND g_hBtnExport = nullptr;
HINSTANCE g_hInst = nullptr;
std::vector<DNSQueryInfo> g_Queries;
std::map<std::wstring, int> g_FrequencyMap;
HANDLE g_hAnalyzeThread = nullptr;
std::wstring g_LogFile = L"DNSTunnelDetector_log.txt";

// === Logging ===
void Log(const std::wstring& msg) {
    SYSTEMTIME st;
    GetLocalTime(&st);

    std::wofstream log(g_LogFile, std::ios::app);
    if (log.is_open()) {
        log << L"[" << st.wYear << L"-"
            << std::setw(2) << std::setfill(L'0') << st.wMonth << L"-"
            << std::setw(2) << std::setfill(L'0') << st.wDay << L" "
            << std::setw(2) << std::setfill(L'0') << st.wHour << L":"
            << std::setw(2) << std::setfill(L'0') << st.wMinute << L":"
            << std::setw(2) << std::setfill(L'0') << st.wSecond << L"] "
            << msg << L"\n";
    }
}

void StatusBar(const std::wstring& msg) {
    if (g_hStatusBar) {
        SendMessageW(g_hStatusBar, SB_SETTEXTW, 0, (LPARAM)msg.c_str());
    }
    Log(msg);
}

// === Helper Functions ===
double CalculateShannonEntropy(const std::wstring& str) {
    if (str.empty()) return 0.0;

    std::map<wchar_t, int> freq;
    for (wchar_t c : str) {
        freq[towlower(c)]++;
    }

    double entropy = 0.0;
    int len = (int)str.length();

    for (const auto& pair : freq) {
        double p = (double)pair.second / len;
        entropy -= p * log2(p);
    }

    return entropy;
}

int GetMaxLabelLength(const std::wstring& fqdn) {
    int maxLen = 0;
    int currentLen = 0;

    for (wchar_t c : fqdn) {
        if (c == L'.') {
            if (currentLen > maxLen) maxLen = currentLen;
            currentLen = 0;
        } else {
            currentLen++;
        }
    }

    if (currentLen > maxLen) maxLen = currentLen;
    return maxLen;
}

bool IsSuspectQuery(const DNSQueryInfo& query, std::wstring& notes) {
    bool suspect = false;

    // 1. Entropie élevée (> 4.0 = encodage base64/hex)
    if (query.entropy > 4.0) {
        suspect = true;
        notes += L"Entropie élevée (encodage suspect) | ";
    }

    // 2. Label très long (> 50 caractères)
    if (query.maxLabelLength > 50) {
        suspect = true;
        notes += L"Label anormalement long | ";
    }

    // 3. Fréquence très élevée (beaconing C2 > 20 requêtes)
    if (query.frequency > 20) {
        suspect = true;
        notes += L"Beaconing C2 (fréquence élevée) | ";
    }

    // 4. Type TXT (peut contenir données exfiltrées)
    if (query.queryType == L"TXT" || query.queryType == L"16") {
        if (query.maxLabelLength > 30) {
            suspect = true;
            notes += L"TXT record volumineux (exfiltration) | ";
        }
    }

    // 5. Sous-domaines multiples (data.subdomain.domain.com)
    int dotCount = 0;
    for (wchar_t c : query.fqdn) {
        if (c == L'.') dotCount++;
    }
    if (dotCount > 4) {
        suspect = true;
        notes += L"Trop de sous-domaines | ";
    }

    // Remove trailing " | "
    if (!notes.empty() && notes.size() > 3) {
        notes = notes.substr(0, notes.size() - 3);
    }

    return suspect;
}

std::wstring GetEventProperty(EVT_HANDLE hEvent, const std::wstring& xpath) {
    EVT_HANDLE hContext = EvtCreateRenderContext(0, nullptr, EvtRenderContextSystem);
    if (!hContext) return L"";

    EvtHandle ctxHandle(hContext);

    DWORD bufferSize = 0;
    DWORD bufferUsed = 0;
    DWORD propertyCount = 0;

    EvtRender(hContext, hEvent, EvtRenderEventValues, 0, nullptr, &bufferUsed, &propertyCount);

    std::vector<BYTE> buffer(bufferUsed);
    if (!EvtRender(hContext, hEvent, EvtRenderEventValues, bufferUsed, buffer.data(), &bufferUsed, &propertyCount)) {
        return L"";
    }

    PEVT_VARIANT values = (PEVT_VARIANT)buffer.data();

    // Event ID 3008: QueryName is typically in Data[0], QueryType in Data[1]
    if (xpath == L"QueryName" && propertyCount > 0 && values[0].Type == EvtVarTypeString) {
        return values[0].StringVal ? values[0].StringVal : L"";
    }
    if (xpath == L"QueryType" && propertyCount > 1) {
        if (values[1].Type == EvtVarTypeUInt16) {
            return std::to_wstring(values[1].UInt16Val);
        } else if (values[1].Type == EvtVarTypeString) {
            return values[1].StringVal ? values[1].StringVal : L"";
        }
    }

    return L"";
}

std::wstring GetEventTimestamp(EVT_HANDLE hEvent) {
    DWORD bufferSize = 0;
    DWORD bufferUsed = 0;
    DWORD propertyCount = 0;

    EVT_HANDLE hContext = EvtCreateRenderContext(0, nullptr, EvtRenderContextSystem);
    if (!hContext) return L"";

    EvtHandle ctxHandle(hContext);

    EvtRender(hContext, hEvent, EvtRenderEventValues, 0, nullptr, &bufferUsed, &propertyCount);

    std::vector<BYTE> buffer(bufferUsed);
    if (!EvtRender(hContext, hEvent, EvtRenderEventValues, bufferUsed, buffer.data(), &bufferUsed, &propertyCount)) {
        return L"";
    }

    PEVT_VARIANT values = (PEVT_VARIANT)buffer.data();

    // TimeCreated is usually at index 7 in System context
    if (propertyCount > 7 && values[7].Type == EvtVarTypeFileTime) {
        FILETIME ft = *(FILETIME*)&values[7].FileTimeVal;
        SYSTEMTIME st;
        FileTimeToSystemTime(&ft, &st);

        wchar_t buf[64];
        swprintf_s(buf, L"%04d-%02d-%02d %02d:%02d:%02d",
                   st.wYear, st.wMonth, st.wDay, st.wHour, st.wMinute, st.wSecond);
        return buf;
    }

    return L"";
}

// === DNS Log Analysis ===
void AnalyzeDNSLogs() {
    g_Queries.clear();
    g_FrequencyMap.clear();

    // Query DNS Client Event Log (Microsoft-Windows-DNS-Client/Operational)
    // Event ID 3008 = DNS query
    const wchar_t* channel = L"Microsoft-Windows-DNS-Client/Operational";
    const wchar_t* query = L"*[System/EventID=3008]";

    EVT_HANDLE hResults = EvtQuery(nullptr, channel, query, EvtQueryChannelPath | EvtQueryReverseDirection);
    if (!hResults) {
        DWORD err = GetLastError();
        if (err == ERROR_EVT_CHANNEL_NOT_FOUND) {
            StatusBar(L"Erreur: Canal DNS Client introuvable (activer dans Event Viewer)");
        } else {
            StatusBar(L"Erreur: EvtQuery échoué (code " + std::to_wstring(err) + L")");
        }
        return;
    }

    EvtHandle resultsHandle(hResults);

    EVT_HANDLE hEvent = nullptr;
    DWORD returned = 0;
    int totalQueries = 0;

    while (EvtNext(hResults, 1, &hEvent, INFINITE, 0, &returned) && returned > 0) {
        EvtHandle eventHandle(hEvent);

        // Extract event data
        std::wstring timestamp = GetEventTimestamp(hEvent);

        // Get XML rendering for detailed data extraction
        DWORD bufferSize = 0;
        DWORD bufferUsed = 0;
        EvtRender(nullptr, hEvent, EvtRenderEventXml, 0, nullptr, &bufferUsed, nullptr);

        std::vector<wchar_t> xmlBuffer(bufferUsed / sizeof(wchar_t) + 1);
        if (EvtRender(nullptr, hEvent, EvtRenderEventXml, bufferUsed, xmlBuffer.data(), &bufferUsed, nullptr)) {
            std::wstring xml = xmlBuffer.data();

            // Parse QueryName and QueryType from XML (simple extraction)
            std::wstring fqdn, queryType;

            size_t posQuery = xml.find(L"<Data Name='QueryName'>");
            if (posQuery != std::wstring::npos) {
                posQuery += 23;
                size_t endPos = xml.find(L"</Data>", posQuery);
                if (endPos != std::wstring::npos) {
                    fqdn = xml.substr(posQuery, endPos - posQuery);
                }
            }

            size_t posType = xml.find(L"<Data Name='QueryType'>");
            if (posType != std::wstring::npos) {
                posType += 23;
                size_t endPos = xml.find(L"</Data>", posType);
                if (endPos != std::wstring::npos) {
                    queryType = xml.substr(posType, endPos - posType);
                }
            }

            if (!fqdn.empty()) {
                // Count frequency
                g_FrequencyMap[fqdn]++;

                DNSQueryInfo info;
                info.timestamp = timestamp;
                info.fqdn = fqdn;
                info.queryType = queryType;
                info.entropy = CalculateShannonEntropy(fqdn);
                info.maxLabelLength = GetMaxLabelLength(fqdn);
                info.frequency = g_FrequencyMap[fqdn];

                std::wstring notes;
                info.suspect = IsSuspectQuery(info, notes);
                info.notes = notes;

                g_Queries.push_back(info);
                totalQueries++;
            }
        }

        hEvent = nullptr;

        // Limit to 1000 events to avoid UI freeze
        if (totalQueries >= 1000) break;
    }

    // Update frequency counts for all queries
    for (auto& q : g_Queries) {
        q.frequency = g_FrequencyMap[q.fqdn];
    }
}

// === ListView Functions ===
void InitListView() {
    LVCOLUMNW lvc = {0};
    lvc.mask = LVCF_TEXT | LVCF_WIDTH;

    lvc.cx = 140; lvc.pszText = (LPWSTR)L"Timestamp"; ListView_InsertColumn(g_hListView, 0, &lvc);
    lvc.cx = 280; lvc.pszText = (LPWSTR)L"FQDN"; ListView_InsertColumn(g_hListView, 1, &lvc);
    lvc.cx = 80; lvc.pszText = (LPWSTR)L"Type"; ListView_InsertColumn(g_hListView, 2, &lvc);
    lvc.cx = 80; lvc.pszText = (LPWSTR)L"Entropie"; ListView_InsertColumn(g_hListView, 3, &lvc);
    lvc.cx = 100; lvc.pszText = (LPWSTR)L"Long. Max"; ListView_InsertColumn(g_hListView, 4, &lvc);
    lvc.cx = 80; lvc.pszText = (LPWSTR)L"Fréquence"; ListView_InsertColumn(g_hListView, 5, &lvc);
    lvc.cx = 80; lvc.pszText = (LPWSTR)L"Suspect"; ListView_InsertColumn(g_hListView, 6, &lvc);
    lvc.cx = 280; lvc.pszText = (LPWSTR)L"Notes"; ListView_InsertColumn(g_hListView, 7, &lvc);

    ListView_SetExtendedListViewStyle(g_hListView, LVS_EX_FULLROWSELECT | LVS_EX_GRIDLINES | LVS_EX_DOUBLEBUFFER);
}

void PopulateListView(bool suspectOnly = false) {
    ListView_DeleteAllItems(g_hListView);

    LVITEMW lvi = {0};
    lvi.mask = LVIF_TEXT;

    int idx = 0;
    for (size_t i = 0; i < g_Queries.size(); i++) {
        const auto& q = g_Queries[i];

        if (suspectOnly && !q.suspect) continue;

        lvi.iItem = idx++;
        lvi.iSubItem = 0; lvi.pszText = (LPWSTR)q.timestamp.c_str(); ListView_InsertItem(g_hListView, &lvi);
        lvi.iSubItem = 1; lvi.pszText = (LPWSTR)q.fqdn.c_str(); ListView_SetItem(g_hListView, &lvi);
        lvi.iSubItem = 2; lvi.pszText = (LPWSTR)q.queryType.c_str(); ListView_SetItem(g_hListView, &lvi);

        wchar_t entBuf[16];
        swprintf_s(entBuf, L"%.2f", q.entropy);
        lvi.iSubItem = 3; lvi.pszText = entBuf; ListView_SetItem(g_hListView, &lvi);

        std::wstring lenStr = std::to_wstring(q.maxLabelLength);
        lvi.iSubItem = 4; lvi.pszText = (LPWSTR)lenStr.c_str(); ListView_SetItem(g_hListView, &lvi);

        std::wstring freqStr = std::to_wstring(q.frequency);
        lvi.iSubItem = 5; lvi.pszText = (LPWSTR)freqStr.c_str(); ListView_SetItem(g_hListView, &lvi);

        lvi.iSubItem = 6; lvi.pszText = (LPWSTR)(q.suspect ? L"OUI" : L""); ListView_SetItem(g_hListView, &lvi);
        lvi.iSubItem = 7; lvi.pszText = (LPWSTR)q.notes.c_str(); ListView_SetItem(g_hListView, &lvi);
    }
}

// === CSV Export ===
void ExportToCSV(const std::wstring& filename) {
    FileHandle hFile(CreateFileW(filename.c_str(), GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, nullptr));
    if (!hFile.IsValid()) {
        StatusBar(L"Erreur: Impossible de créer le fichier CSV");
        return;
    }

    // BOM UTF-8
    const unsigned char bom[] = {0xEF, 0xBB, 0xBF};
    DWORD written;
    WriteFile(hFile.Get(), bom, 3, &written, nullptr);

    std::wstringstream ss;
    ss << L"Timestamp,FQDN,Type,Entropie,LongueurMax,Fréquence,Suspect,Notes\n";

    for (const auto& q : g_Queries) {
        ss << L"\"" << q.timestamp << L"\",";
        ss << L"\"" << q.fqdn << L"\",";
        ss << L"\"" << q.queryType << L"\",";
        ss << std::fixed << std::setprecision(2) << q.entropy << L",";
        ss << q.maxLabelLength << L",";
        ss << q.frequency << L",";
        ss << (q.suspect ? L"OUI" : L"NON") << L",";
        ss << L"\"" << q.notes << L"\"\n";
    }

    std::wstring data = ss.str();
    int len = WideCharToMultiByte(CP_UTF8, 0, data.c_str(), -1, nullptr, 0, nullptr, nullptr);
    if (len > 0) {
        std::vector<char> utf8(len);
        WideCharToMultiByte(CP_UTF8, 0, data.c_str(), -1, utf8.data(), len, nullptr, nullptr);
        WriteFile(hFile.Get(), utf8.data(), len - 1, &written, nullptr);
    }

    StatusBar(L"Requêtes DNS exportées: " + filename);
}

// === Thread Analyze ===
DWORD WINAPI AnalyzeThread(LPVOID param) {
    StatusBar(L"Analyse des logs DNS en cours...");
    EnableWindow(g_hBtnAnalyze, FALSE);
    EnableWindow(g_hBtnFilter, FALSE);

    AnalyzeDNSLogs();
    PopulateListView();

    int suspects = 0;
    for (const auto& q : g_Queries) {
        if (q.suspect) suspects++;
    }

    std::wstringstream ss;
    ss << g_Queries.size() << L" requêtes DNS analysées, " << suspects << L" suspectes";
    StatusBar(ss.str());

    EnableWindow(g_hBtnAnalyze, TRUE);
    EnableWindow(g_hBtnFilter, TRUE);
    return 0;
}

// === Window Procedure ===
LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
    static bool g_FilterSuspect = false;

    switch (msg) {
        case WM_CREATE: {
            // ListView
            g_hListView = CreateWindowExW(0, WC_LISTVIEWW, nullptr,
                WS_CHILD | WS_VISIBLE | WS_BORDER | LVS_REPORT | LVS_SINGLESEL,
                10, 10, 1180, 500, hwnd, (HMENU)1, g_hInst, nullptr);
            InitListView();

            // Buttons
            g_hBtnAnalyze = CreateWindowW(L"BUTTON", L"Analyser Logs DNS",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                10, 520, 140, 30, hwnd, (HMENU)2, g_hInst, nullptr);

            g_hBtnFilter = CreateWindowW(L"BUTTON", L"Filtrer Suspects",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                160, 520, 140, 30, hwnd, (HMENU)3, g_hInst, nullptr);

            g_hBtnBlacklist = CreateWindowW(L"BUTTON", L"Blacklist Domaine",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                310, 520, 150, 30, hwnd, (HMENU)4, g_hInst, nullptr);

            g_hBtnExport = CreateWindowW(L"BUTTON", L"Exporter CSV",
                WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
                470, 520, 120, 30, hwnd, (HMENU)5, g_hInst, nullptr);

            // StatusBar
            g_hStatusBar = CreateWindowExW(0, STATUSCLASSNAMEW, nullptr,
                WS_CHILD | WS_VISIBLE | SBARS_SIZEGRIP,
                0, 0, 0, 0, hwnd, nullptr, g_hInst, nullptr);

            StatusBar(L"DNSTunnelDetector v1.0 - Prêt (activer DNS Client Operational log)");
            break;
        }

        case WM_COMMAND: {
            int id = LOWORD(wParam);

            if (id == 2) { // Analyser
                if (g_hAnalyzeThread) CloseHandle(g_hAnalyzeThread);
                g_hAnalyzeThread = CreateThread(nullptr, 0, AnalyzeThread, nullptr, 0, nullptr);
            }
            else if (id == 3) { // Filtrer suspects
                g_FilterSuspect = !g_FilterSuspect;
                PopulateListView(g_FilterSuspect);

                if (g_FilterSuspect) {
                    SetWindowTextW(g_hBtnFilter, L"Afficher Tous");
                    int suspects = 0;
                    for (const auto& q : g_Queries) if (q.suspect) suspects++;
                    StatusBar(L"Affichage uniquement suspects: " + std::to_wstring(suspects));
                } else {
                    SetWindowTextW(g_hBtnFilter, L"Filtrer Suspects");
                    StatusBar(L"Affichage toutes requêtes: " + std::to_wstring(g_Queries.size()));
                }
            }
            else if (id == 4) { // Blacklist domaine
                int sel = ListView_GetNextItem(g_hListView, -1, LVNI_SELECTED);
                if (sel == -1) {
                    StatusBar(L"Sélectionnez un domaine à blacklister");
                    break;
                }

                MessageBoxW(hwnd,
                    L"Fonctionnalité 'Blacklist Domaine' requiert modification DNS local ou firewall.\n"
                    L"Implémentation: Ajout à hosts file (127.0.0.1) ou règle WFP.\n"
                    L"Pas implémenté (sécurité - éviter blocage accidentel).",
                    L"Information", MB_ICONINFORMATION);
            }
            else if (id == 5) { // Exporter CSV
                if (g_Queries.empty()) {
                    StatusBar(L"Aucune requête à exporter");
                    break;
                }

                wchar_t path[MAX_PATH];
                GetModuleFileNameW(nullptr, path, MAX_PATH);
                wcsrchr(path, L'\\')[1] = 0;
                wcscat_s(path, L"dns_queries.csv");

                ExportToCSV(path);
            }
            break;
        }

        case WM_SIZE: {
            int width = LOWORD(lParam);
            int height = HIWORD(lParam);

            MoveWindow(g_hListView, 10, 10, width - 20, height - 100, TRUE);
            MoveWindow(g_hBtnAnalyze, 10, height - 80, 140, 30, TRUE);
            MoveWindow(g_hBtnFilter, 160, height - 80, 140, 30, TRUE);
            MoveWindow(g_hBtnBlacklist, 310, height - 80, 150, 30, TRUE);
            MoveWindow(g_hBtnExport, 470, height - 80, 120, 30, TRUE);
            SendMessage(g_hStatusBar, WM_SIZE, 0, 0);
            break;
        }

        case WM_DESTROY:
            if (g_hAnalyzeThread) {
                WaitForSingleObject(g_hAnalyzeThread, 2000);
                CloseHandle(g_hAnalyzeThread);
            }
            PostQuitMessage(0);
            break;

        default:
            return DefWindowProcW(hwnd, msg, wParam, lParam);
    }
    return 0;
}

// === Entry Point ===
int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE, LPWSTR, int nCmdShow) {
    g_hInst = hInstance;

    INITCOMMONCONTROLSEX icex = {0};
    icex.dwSize = sizeof(INITCOMMONCONTROLSEX);
    icex.dwICC = ICC_LISTVIEW_CLASSES | ICC_BAR_CLASSES;
    InitCommonControlsEx(&icex);

    WNDCLASSEXW wc = {0};
    wc.cbSize = sizeof(WNDCLASSEXW);
    wc.lpfnWndProc = WndProc;
    wc.hInstance = hInstance;
    wc.hCursor = LoadCursor(nullptr, IDC_ARROW);
    wc.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
    wc.lpszClassName = L"DNSTunnelDetectorClass";
    wc.hIcon = LoadIcon(nullptr, IDI_SHIELD);
    wc.hIconSm = LoadIcon(nullptr, IDI_SHIELD);

    RegisterClassExW(&wc);

    g_hMainWnd = CreateWindowExW(0, L"DNSTunnelDetectorClass",
        L"DNSTunnelDetector v1.0 - Détection Tunneling DNS & Exfiltration | WinToolsSuite",
        WS_OVERLAPPEDWINDOW,
        CW_USEDEFAULT, CW_USEDEFAULT, 1220, 640,
        nullptr, nullptr, hInstance, nullptr);

    ShowWindow(g_hMainWnd, nCmdShow);
    UpdateWindow(g_hMainWnd);

    MSG msg;
    while (GetMessage(&msg, nullptr, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }

    return (int)msg.wParam;
}