static public ProgramID AdjustProgID(ProgramID progID)
{
/*
* Windows Internals Edition 6 / Chapter 4 / Service Tags:
*
* "Windows implements a service attribute called the service tag, ... The attribute is simply an
* index identifying the service. The service tag is stored in the SubProcessTag field of the
* thread environment block (TEB) of each thread (see Chapter 5, ...) and is propagated across all
* threads that a main service thread creates (except threads created indirectly by thread-pool APIs).
* ... the TCP/IP stack saves the service tag of the threads that create TCP/IP end points ..."
*
* Well isn't that "great" in the end we can not really relay on the Service Tags :/
* A workable workaround to this issue is imho to ignore the Service Tags all together
* for all services which are not hosted in svchost.exe as those should have unique binaries anyways.
*/
if (progID.Type == ProgramID.Types.Service && progID.Path.Length > 0) // if its a service
{
if (System.IO.Path.GetFileName(progID.Path).Equals("svchost.exe", StringComparison.OrdinalIgnoreCase) == false) // and NOT hosted in svchost.exe
{
progID = ProgramID.NewProgID(progID.Path); // handle it as just a normal program
}
}
return(progID);
}
public static ProgramID GetIdFromRule(FirewallRule rule)
{
ProgramID progID;
string fullPath = rule.BinaryPath != null?Environment.ExpandEnvironmentVariables(rule.BinaryPath) : null;
if (rule.BinaryPath != null && rule.BinaryPath.Equals("System", StringComparison.OrdinalIgnoreCase))
{
progID = ProgramID.NewID(ProgramID.Types.System);
}
// Win 8+
else if (rule.AppSID != null)
{
if (rule.ServiceTag != null)
{
AppLog.Debug("Firewall paremeter conflict in rule: {0}", rule.Name);
}
progID = ProgramID.NewAppID(rule.AppSID, fullPath);
}
//
else if (rule.ServiceTag != null)
{
progID = ProgramID.NewSvcID(rule.ServiceTag, fullPath);
}
else if (rule.BinaryPath != null)
{
progID = ProgramID.NewProgID(fullPath);
}
else // if nothing is configured than its a global roule
{
progID = ProgramID.NewID(ProgramID.Types.Global);
}
return(AdjustProgID(progID));
}