hollows_hunter/CMakeLists.txt

cmake_minimum_required (VERSION 3.12)
project (hollows_hunter)

option(HH_BUILD_TESTING "Enable testing for HollowsHunter" ON)
option (PECONV_LIB_INSTALL OFF)
option( USE_ETW "Use ETW" ON )

if (MSVC)
	set(CMAKE_CXX_FLAGS_RELEASE "${CMAKE_CXX_FLAGS_RELEASE} /MT")
endif()

if(USE_ETW)
	add_compile_definitions(USE_ETW)

	set(CMAKE_CXX_STANDARD 17)
	set(CMAKE_CXX_STANDARD_REQUIRED ON)
	set(CMAKE_CXX_EXTENSIONS OFF)
endif()

# static linking for GNU compilers
if (CMAKE_CXX_COMPILER_ID STREQUAL "GNU")

	enable_language(RC)
	
	set(CMAKE_RC_COMPILE_OBJECT
		"<CMAKE_RC_COMPILER> <FLAGS> -O coff <DEFINES> -i <SOURCE> -o <OBJECT>")
		
	add_compile_definitions(
		_WIN32_WINNT=1536 # 0x600 aka Windows Vista required
	)
	if (LINK_STATICALLY)
		add_link_options(
			-static
			-static-libgcc
			-static-libstdc++
		)
	endif()

endif()

# modules:
set ( M_PESIEVE "pe-sieve" )
set ( M_PARAMKIT "paramkit" )


# modules paths:
set (PESIEVE_DIR "${PROJECT_SOURCE_DIR}/${M_PESIEVE}" CACHE PATH "PE-sieve main path")
include_directories ( ${PESIEVE_DIR}/include )

set (PARAMKIT_DIR "${CMAKE_SOURCE_DIR}/${M_PARAMKIT}/${M_PARAMKIT}" CACHE PATH "ParamKit main path" )
include_directories ( ${PARAMKIT_DIR}/include )

set (srcs
	main.cpp
	term_util.cpp
	hh_scanner.cpp
	hh_params.cpp
	hh_report.cpp
	params_info/pe_sieve_params_info.cpp
	util/suspend.cpp
	util/process_privilege.cpp
	util/time_util.cpp
	util/strings_util.cpp
)

set (hdrs
	term_util.h
	hh_scanner.h
	hh_params.h
	hh_report.h
	params_info/params.h
	params_info/pe_sieve_params_info.h
	util/suspend.h
	util/ntddk.h
	util/process_privilege.h
	util/time_util.h
	util/strings_util.h
	util/process_util.h
)

if(USE_ETW)
	set (srcs
		${srcs}
		etw_listener.cpp
		etw_settings.cpp
	)

	set (hdrs
		${hdrs}
		etw_listener.h
		etw_settings.h
		krabsetw/krabs/krabs.hpp
	)
endif()

set (rsrc
	resources.h
	hh_res.rc
	hh_ver_short.h
	hollows_hunter.manifest
)

# libs
set(HH_PESIEVE_LINK_MODE "STATIC" CACHE STRING "How HollowsHunter should build and link PE-sieve")
set_property(CACHE HH_PESIEVE_LINK_MODE PROPERTY STRINGS STATIC DLL)

if(NOT HH_PESIEVE_LINK_MODE STREQUAL "STATIC"
   AND NOT HH_PESIEVE_LINK_MODE STREQUAL "DLL")
	message(FATAL_ERROR
		"Invalid HH_PESIEVE_LINK_MODE '${HH_PESIEVE_LINK_MODE}'. Choose: STATIC DLL"
	)
endif()

if(HH_PESIEVE_LINK_MODE STREQUAL "STATIC")
	set(PESIEVE_BUILD_MODE "STATIC" CACHE INTERNAL "Build mode for PE-sieve" FORCE)
elseif(HH_PESIEVE_LINK_MODE STREQUAL "DLL")
	set(PESIEVE_BUILD_MODE "DLL" CACHE INTERNAL "Build mode for PE-sieve" FORCE)
endif()

add_subdirectory ( ${PESIEVE_DIR} )
set ( PESIEVE_LIB $<TARGET_FILE:pe-sieve> CACHE PATH "PE-sieve library path" )
add_subdirectory ( ${PARAMKIT_DIR} )
set ( PARAMKIT_LIB $<TARGET_FILE:paramkit> CACHE PATH "ParamKit library path" )

cmake_policy(SET CMP0015 NEW)
add_executable ( ${PROJECT_NAME} ${hdrs} ${srcs} ${rsrc} main.cpp )
target_link_libraries ( ${PROJECT_NAME} ${M_PESIEVE} ${M_PARAMKIT} "psapi.lib" "ntdll.lib")

# dependencies
add_dependencies( ${PROJECT_NAME} ${M_PESIEVE} ${M_PARAMKIT} )
target_compile_definitions(${PROJECT_NAME} PUBLIC -DUNICODE)
target_compile_definitions(${M_PARAMKIT} PUBLIC -DUNICODE)

if(CMAKE_CXX_COMPILER_ID MATCHES "MSVC")
	target_link_options( ${PROJECT_NAME} PRIVATE "/MANIFEST:NO")
endif()

#install
INSTALL( TARGETS ${PROJECT_NAME} DESTINATION ${CMAKE_INSTALL_PREFIX} COMPONENT ${PROJECT_NAME} )

# Setup testing
if(HH_BUILD_TESTING)
	enable_testing()
	
	# 0) does the application run
	add_test (TestRuns ${CMAKE_INSTALL_PREFIX}/hollows_hunter -?)
	set_tests_properties(TestRuns PROPERTIES PASS_REGULAR_EXPRESSION "HollowsHunter")
	
	# 1) false positives in a clean environment
	add_test (TestFalsePositives ${CMAKE_INSTALL_PREFIX}/hollows_hunter -json -dir scan_out)
	set_tests_properties(TestFalsePositives PROPERTIES PASS_REGULAR_EXPRESSION "\"suspicious_count\" : 0")

	# 2) test scan with caching
	add_test (TestCaching ${CMAKE_INSTALL_PREFIX}/hollows_hunter -json -dir scan_out -cache E)
	set_tests_properties(TestCaching PROPERTIES PASS_REGULAR_EXPRESSION "\"suspicious_count\" : 0")

	# 3) test scan IAT with caching
	add_test (TestIatScan ${CMAKE_INSTALL_PREFIX}/hollows_hunter -json -dir scan_out -cache E -iat 1)
	set_tests_properties(TestIatScan PROPERTIES PASS_REGULAR_EXPRESSION "\"suspicious_count\" : ")

	# 4) test scan hooks with caching
	add_test (TestHooksScan ${CMAKE_INSTALL_PREFIX}/hollows_hunter -json -dir scan_out -cache E -hooks)
	set_tests_properties(TestHooksScan PROPERTIES PASS_REGULAR_EXPRESSION "\"suspicious_count\" : ")

	# 5) test scan threads with caching
	add_test (TestThreadsScan ${CMAKE_INSTALL_PREFIX}/hollows_hunter -json -dir scan_out -cache E -threads)
	set_tests_properties(TestThreadsScan PROPERTIES PASS_REGULAR_EXPRESSION "\"suspicious_count\" : ")

	# 6) test scan code patterns with caching
	add_test (TestCodeScanNoDump ${CMAKE_INSTALL_PREFIX}/hollows_hunter -json -dir scan_out -cache E -shellc P -ofilter 2)
	set_tests_properties(TestCodeScanNoDump PROPERTIES PASS_REGULAR_EXPRESSION "\"suspicious_count\" : ")
endif()