Implemented online file reputation verification in the Harden Windows Security moulde

Harden-Windows-Security Module/Harden Windows Security.csproj

@@ -60,6 +60,7 @@
   </ItemGroup>
 
   <ItemGroup>
+    <Page Remove="Main files\Resources\XAML\FileReputation.xaml" />
     <Page Remove="Main files\Resources\XAML\OptionalFeatures.xaml" />
   </ItemGroup>
 
@@ -92,6 +93,9 @@
   </ItemGroup>
 
   <ItemGroup>
+    <Content Update="Main files\Resources\XAML\FileReputation.xaml">
+      <Generator>MSBuild:Compile</Generator>
+    </Content>
     <Content Update="Main files\Resources\XAML\OptionalFeatures.xaml">
       <Generator>MSBuild:Compile</Generator>
     </Content>

Harden-Windows-Security Module/Main files/C#/GUI/FileReputation/Variables.cs

@@ -0,0 +1,36 @@
+using System;
+using System.Runtime.InteropServices;
+using System.Windows.Controls;
+
+namespace HardenWindowsSecurity;
+
+public static class GUIFileReputation
+{
+	internal static UserControl? View;
+
+	internal static Grid? ParentGrid;
+
+	internal static string? selectedFilePath;
+
+	// Enum representing different trust levels of a file
+	internal enum TrustScore
+	{
+		PotentiallyUnwantedApplication = -3,
+		Malicious = -2,
+		Unknown = -1,
+		Good = 0,
+		HighTrust = 1
+	}
+
+	// Structure to hold extra info about the file trust
+	[StructLayout(LayoutKind.Sequential)]
+	internal struct MpFileTrustExtraInfo
+	{
+		internal uint First;             // First extra info field
+		internal uint Second;            // Second extra info field
+		internal uint DataSize;          // Size of the data
+		internal uint AlignmentPadding;  // Padding for memory alignment
+		internal IntPtr Data;            // Pointer to extra data
+	}
+
+}

Harden-Windows-Security Module/Main files/C#/GUI/FileReputation/View.cs

@@ -0,0 +1,139 @@
+using System;
+using System.IO;
+using System.Threading.Tasks;
+using System.Windows.Controls;
+using System.Windows.Markup;
+using Microsoft.Win32;
+
+namespace HardenWindowsSecurity;
+
+public partial class GUIMain
+{
+
+	// Partial class definition for handling navigation and view models
+	public partial class NavigationVM : ViewModelBase
+	{
+
+		// Method to handle the FileReputation view, including loading
+		private void FileReputationView(object obj)
+		{
+
+			// Check if the view is already cached
+			if (_viewCache.TryGetValue("FileReputationView", out var cachedView))
+			{
+				CurrentView = cachedView;
+				return;
+			}
+
+			// Construct the file path for the FileReputation view XAML
+			string xamlPath = Path.Combine(GlobalVars.path, "Resources", "XAML", "FileReputation.xaml");
+
+			// Read the XAML content from the file
+			string xamlContent = File.ReadAllText(xamlPath);
+
+			// Parse the XAML content to create a UserControl
+			GUIFileReputation.View = (UserControl)XamlReader.Parse(xamlContent);
+
+			// Find the Parent Grid
+			GUIFileReputation.ParentGrid = (Grid)GUIFileReputation.View.FindName("ParentGrid");
+
+			#region finding elements
+
+			Button BrowseForFileButton = GUIFileReputation.ParentGrid.FindName("BrowseForFileButton") as Button ?? throw new InvalidOperationException("BrowseForFileButton could not be found in the FileReputation view");
+			TextBox FileReputationTextBlock = GUIFileReputation.ParentGrid.FindName("FileReputationTextBlock") as TextBox ?? throw new InvalidOperationException("FileReputationTextBlock could not be found in the FileReputation view");
+			TextBox ReputationSourceTextBlock = GUIFileReputation.ParentGrid.FindName("ReputationSourceTextBlock") as TextBox ?? throw new InvalidOperationException("ReputationSourceTextBlock could not be found in the FileReputation view");
+			TextBox ValidityDurationTextBlock = GUIFileReputation.ParentGrid.FindName("ValidityDurationTextBlock") as TextBox ?? throw new InvalidOperationException("ValidityDurationTextBlock could not be found in the FileReputation view");
+			TextBox FileHandleTextBlock = GUIFileReputation.ParentGrid.FindName("FileHandleTextBlock") as TextBox ?? throw new InvalidOperationException("FileHandleTextBlock could not be found in the FileReputation view");
+			TextBox FilePathTextBlock = GUIFileReputation.ParentGrid.FindName("FilePathTextBlock") as TextBox ?? throw new InvalidOperationException("FilePathTextBlock could not be found in the FileReputation view");
+
+
+			#endregion
+
+			// Register the elements that will be enabled/disabled based on current activity
+			ActivityTracker.RegisterUIElement(BrowseForFileButton);
+
+
+			// Event handler for Retrieve ASR Status Button
+			BrowseForFileButton.Click += async (sender, e) =>
+			{
+				// Only continue if there is no activity other places
+				if (ActivityTracker.IsActive)
+				{
+					return;
+				}
+
+				// mark as activity started
+				ActivityTracker.IsActive = true;
+
+				FileReputationTextBlock.Text = null;
+				ReputationSourceTextBlock.Text = null;
+				ValidityDurationTextBlock.Text = null;
+				FileHandleTextBlock.Text = null;
+				FilePathTextBlock.Text = null;
+
+				try
+				{
+
+					GUIFileReputation.selectedFilePath = null;
+
+					// Create OpenFileDialog instance
+					OpenFileDialog openFileDialog = new()
+					{
+						// Set the title of the dialog
+						Title = "Select a file to verify its reputation",
+
+						// Allow single file selection only
+						Multiselect = false,
+
+						// Show all files
+						Filter = "Any file (*.*)|*.*"
+					};
+
+					// Show the dialog and check if the user selected file
+					if (openFileDialog.ShowDialog() == true)
+					{
+						// Retrieve selected file path
+						GUIFileReputation.selectedFilePath = openFileDialog.FileName;
+
+						Logger.LogMessage($"Selected file path: {GUIFileReputation.selectedFilePath}", LogTypeIntel.Information);
+
+						FileTrustChecker.FileTrustResult? result = null;
+
+						await Task.Run(() =>
+						{
+							try
+							{
+
+								result = FileTrustChecker.CheckFileTrust(GUIFileReputation.selectedFilePath);
+							}
+							catch (Exception ex)
+							{
+								Logger.LogMessage($"Error occurred while checking file trust: {ex.Message}", LogTypeIntel.Error);
+							}
+						});
+
+						// Assign the results to the UI text blocks
+						FileReputationTextBlock.Text = result?.Reputation;
+						ReputationSourceTextBlock.Text = result?.Source.ToString();
+						ValidityDurationTextBlock.Text = result?.Duration;
+						FileHandleTextBlock.Text = result?.Handle;
+						FilePathTextBlock.Text = GUIFileReputation.selectedFilePath;
+					}
+				}
+				finally
+				{
+					// mark as activity completed
+					ActivityTracker.IsActive = false;
+				}
+
+			};
+
+
+			// Cache the view before setting it as the CurrentView
+			_viewCache["FileReputationView"] = GUIFileReputation.View;
+
+			// Set the CurrentView to the Protect view
+			CurrentView = GUIFileReputation.View;
+		}
+	}
+}

Harden-Windows-Security Module/Main files/C#/GUI/Main/GUI.cs

@@ -144,6 +144,7 @@ public object CurrentView
 		public ICommand BitLockerCommand { get; set; }
 		public ICommand LogsCommand { get; set; }
 		public ICommand OptionalFeaturesCommand { get; set; }
+		public ICommand FileReputationCommand { get; set; }
 
 		// Dictionary to cache views by their identifiers
 		private readonly Dictionary<string, object> _viewCache = [];
@@ -160,6 +161,7 @@ public NavigationVM()
 			BitLockerCommand = new RelayCommand(BitLockerView); // Command to handle the BitLocker action
 			LogsCommand = new RelayCommand(LogsView); // Command to handle the Logs action
 			OptionalFeaturesCommand = new RelayCommand(OptionalFeaturesView); // Command to handle the OptionalFeatures action
+			FileReputationCommand = new RelayCommand(FileReputationView); // Command to handle the FileReputation action
 
 			// Load the Logs view initially to make it ready for logs to be written to it
 			LogsView(null);
@@ -501,13 +503,23 @@ Harden Windows Security operation log end
 
 		// OptionalFeatures button icon
 		Grid OptionalFeaturesButtonGrid = SidebarGrid.FindName("OptionalFeaturesButtonGrid") as Grid;
-		Image OptionalFeaturesButtonIcon = LogsButtonGrid.FindName("OptionalFeaturesButtonIcon") as Image;
+		Image OptionalFeaturesButtonIcon = OptionalFeaturesButtonGrid.FindName("OptionalFeaturesButtonIcon") as Image;
 		BitmapImage OptionalFeaturesButtonImage = new();
 		OptionalFeaturesButtonImage.BeginInit();
 		OptionalFeaturesButtonImage.UriSource = new Uri(Path.Combine(GlobalVars.path, "Resources", "Media", "OptionalFeaturesMenuButtonIcon.png"));
 		OptionalFeaturesButtonImage.CacheOption = BitmapCacheOption.OnLoad; // Load the image data into memory
 		OptionalFeaturesButtonImage.EndInit();
 		OptionalFeaturesButtonIcon.Source = OptionalFeaturesButtonImage;
+
+		// FileReputation button icon
+		Grid FileReputationButtonGrid = SidebarGrid.FindName("FileReputationButtonGrid") as Grid;
+		Image FileReputationButtonIcon = FileReputationButtonGrid.FindName("FileReputationButtonIcon") as Image;
+		BitmapImage FileReputationButtonImage = new();
+		FileReputationButtonImage.BeginInit();
+		FileReputationButtonImage.UriSource = new Uri(Path.Combine(GlobalVars.path, "Resources", "Media", "FileReputationMenuButton.png"));
+		FileReputationButtonImage.CacheOption = BitmapCacheOption.OnLoad; // Load the image data into memory
+		FileReputationButtonImage.EndInit();
+		FileReputationButtonIcon.Source = FileReputationButtonImage;
 		#endregion
 
 	}

Harden-Windows-Security Module/Main files/C#/GUI/OptionalFeatures/View.cs

@@ -32,6 +32,14 @@ private void OptionalFeaturesView(object obj)
 				return;
 			}
 
+			// if Admin privileges are not available, return and do not proceed any further
+			// Will prevent the page from being loaded since the CurrentView won't be set/changed
+			if (!UserPrivCheck.IsAdmin())
+			{
+				Logger.LogMessage("Optional Features and Apps page can only be used when running the Harden Windows Security Application with Administrator privileges", LogTypeIntel.ErrorInteractionRequired);
+				return;
+			}
+
 			// Construct the file path for the OptionalFeatures view XAML
 			string xamlPath = Path.Combine(GlobalVars.path, "Resources", "XAML", "OptionalFeatures.xaml");
 
@@ -719,7 +727,7 @@ await Task.Run(() =>
 
 								await Task.Run(() =>
 								   {
-
+									   // Remove the app
 									   IAsyncOperationWithProgress<DeploymentResult, DeploymentProgress> deploymentOperation = GUIOptionalFeatures.packageMgr.RemovePackageAsync(fullName, RemovalOptions.RemoveForAllUsers);
 
 									   // This event is signaled when the operation completes
@@ -784,6 +792,9 @@ await Task.Run(() =>
 			#endregion
 
 
+			// Retrieve the removable apps on the system once the view is loaded
+			_ = _RetrieveRemovableApps();
+
 			// Cache the view before setting it as the CurrentView
 			_viewCache["OptionalFeaturesView"] = GUIOptionalFeatures.View;