Version 1.0 released. See first post for snapshots, download and howto.
;--------------------------------------------
;FireWall Log Analyzer
;
;My first AutoIT project and first programming, with a little help of my friends (AutoIT Forum)
;PTRex started 29/06/05
;
;Completed:
;# Lines Selection
;Auto Refresh
;Check status FW On or Off using WMI techniques
;Show Exception Apps & Open Ports
;Included hyperlink
;Drag&Drop columns + Sort columns header
;Check on Domain or Local Profile registry settings
;Include IE Object browser
;Include Whois function
;
;To Do :
;Correct bugs
;---------------------------------------------
;Includes
#include <GuiConstants.au3>
#include <Array.au3>
#include <GuiListView.au3>
#include <GuiTab.au3>
#NoTrayIcon
;Declare Vars
Dim $Font ="Arial Bold"
Dim $OS = @OSVersion
Dim $SP = @OSServicePack
Dim $aArray
Dim $avArray[14]
Dim $datacol
Dim $combo2Item
Dim $button_ON, $Label_ON, $Status
Dim $IP, $Line
Dim $DataListApps, $DataListPorts, $Browser, $HTTP
Dim $objFirewall, $objPolicy
;Main GUI
;---------
$Gui = GuiCreate("Firewall Log Analyser for XP v1.0", 968, 571,(@DesktopWidth-797)/2, (@DesktopHeight-571)/2 , _
$WS_OVERLAPPEDWINDOW + $WS_VISIBLE + $WS_CLIPSIBLINGS)
$Tab=GUICtrlCreateTab (8,30, 958,520)
GUICtrlSetResizing ($Tab,$GUI_DOCKAUTO)
;Tab1
$Tab1=GUICtrlCreateTabitem ("LogData")
$ListView = GUICtrlCreateListView("date|time|action| protocol| src-ip| dst-ip| _
src-port| dst-port| size| tcpflags|tcpsyn| tcpack| tcpwin| icmptype", 10, 60, 952, 474,-1,$LVS_EX_HEADERDRAGDROP);Drag&Drop Columns
GUICtrlSetResizing ($Listview,$GUI_DOCKAUTO)
GUICtrlSetState($ListView,$GUI_FOCUS)
GUICtrlSetImage ($ListView, "xpsp2res.dll",73) ;Set Icons for records
_GUICtrlListViewSetColumnWidth ($listview, 0,90) ;Set Column with
$Tab1combo=GUICtrlCreateCombo ("# Lines", 10,8,60,40)
GUICtrlSetData(-1,"100|150|300|500|1000|2000|3000|4000", "100") ;Set default 100
GUICtrlCreateLabel("Select # of lines",80,12)
$Tab2combo=GUICtrlCreateCombo ("Auto Refresh ", 200,8,100)
GUICtrlSetData(-1,"1|5|10|20|30") ;Set default none
$Refrech = GuiCtrlCreateButton("Refresh", 852, 10, 90, 30)
$Button_ON = GUICtrlCreateButton ("FW Status ", 380,5,40,40, $BS_ICON)
Status() ;Check status of FW & set Icon and Label
Label() ;Create Label with variable data
$Whois = GuiCtrlCreateButton("Whois", 650, 10, 90, 30)
;Tab2
$Tab2=GUICtrlCreateTabitem ( "Whois ")
$oIE = ObjCreate("Shell.Explorer.2") ;Include Embedded IE Object
$GUIActiveX = GUICtrlCreateObj ($oIE, 10, 60 , 952 , 486)
GUICtrlSetStyle ( $GUIActiveX, $WS_VISIBLE ) ;Show IE Object on tab3
GUICtrlSetResizing ($GUIActiveX,$GUI_DOCKAUTO)
$oIE.navigate("<a href='http://www.ripe.net' class='bbc_url' title='External link' rel='nofollow external'>http://www.ripe.net"</a>)
;Tab3
$Tab3=GUICtrlCreateTabitem ( "Firewall Config ")
$Listbox1 = GUICtrlCreateList("", 10, 70, 930, 225)
GUICtrlSetResizing ($Listview,$GUI_DOCKAUTO)
GUICtrlCreateLabel("Applications allowed : ",15,55)
GUICtrlSetColor(-1,0xff0000) ;Set Red color
GUICtrlSetFont (-1,7.5, 100, 4, $font) ;Set Font
Open_apps()
$Listbox2 = GUICtrlCreateList("", 10, 300, 930, 225)
GUICtrlSetResizing ($Listview,$GUI_DOCKAUTO)
GUICtrlCreateLabel("Open Ports : ",15,285)
GUICtrlSetColor(-1,0xff0000)
GUICtrlSetFont (-1,7.5, 100, 4, $font)
Open_ports()
$Link = GuiCtrlCreateLabel("Click here for more info : Port Database", 120, 285, 290, 12)
GUICtrlSetColor ( -1, 0x0000ff) ;Set Blue color
GUICtrlSetFont (-1, 7.5 , 100 , 4 ) ;Set Font
GUICtrlSetCursor ( -1, 0 ) ;Activate Hyperlink function
GetBrowser()
;Error checking : Test OS = XP/SP2
;----------------------------------
If $OS <> "Win_XP" Then
MsgBox (0, "Your OS is not XP : ", $OS, 3)
ElseIf $SP <> "Service Pack 2" Then
MsgBox (0, "Your OS is not on SP2 : ", $SP, 3)
Else
$filename = "C:\WINDOWS\pfirewall.log" ;Open the file and read data
EndIf
Getdata()
;GUI handling
;------------
GuiSetState()
Dim $B_DESCENDING[_GUICtrlListViewGetSubItemsCount ($listview)] ;Used by Sort CLick Header
While 1
$msg = GuiGetMsg()
Select
Case $msg = $GUI_EVENT_CLOSE
ExitLoop
Case $msg = $Tab1Combo ;Read Combodata
GUICtrlRead($Tab1Combo)
Case $msg = $Tab2Combo
Do
AutoRefresh() ;Run AutoRefresh per second
sleep ($Combo2Item * 1000)
DeleteList()
Getdata()
Until $Combo2Item = 0 Or $msg = $GUI_EVENT_CLOSE
Case $msg = $Button_ON ;Read Firewall On/Off
Status()
Case $msg = $Whois
ReadLine()
Case $msg = $Listview ;Sort the list by the column header clicked on
_GUICtrlListViewSort($listview, $B_DESCENDING, GUICtrlGetState($Listview))
Case $msg= $Link ;Active Hyperlink
run($HTTP,"",@SW_MAXIMIZE)
Case else
If $msg = $Refrech Then
DeleteList()
Getdata()
Status()
EndIf
EndSelect
WEnd
Exit
;Functions
;----------
Func Label()
GUICtrlSetResizing ($Button_ON,$GUI_DOCKHEIGHT+$GUI_DOCKWIDTH)
Opt("GUICoordMode",1) ;Opt. Coordinate mode relative to $Button_ON
GUICtrlDelete($status)
$Status= GUICtrlCreateLabel("Your firewall is " & $Label_ON ,440,12,$SS_SUNKEN)
EndFunc
Func Getdata()
$file = FileOpen($filename,0)
If $file = -1 Then ;Check if file is opened for reading, OK
MsgBox(0, "Error", "Unable to open file. Make sure that your Firewall Logging is turned on !!")
Exit
EndIf
$combo1Item=Number(GUICtrlRead($Tab1combo)) ;Get # of lines selected
$aArray = StringSplit(FileRead($file,FileGetSize($filename)),@LF);Read lines of text until the EOF is reached
for $i = (UBound($aArray) - 2) to $i+1-$combo1Item Step -1 ;Ubound read lines bottom up, to # of lines
$string = StringSplit($aArray[$i], " ", 0) ;Split lines in 17 dimensions
For $a=0 To 12 ;Assign each 13 dimensions to a new Array
$avArray[$a]=$string[$a]
next ;Create string for displaying in ListView
$data=$avArray[1]&"|"&$avArray[2]&"|"&$avArray[3]&"|"&$avArray[4]&"|"&$avArray[5]&"|"_
&$avArray[6]&"|"&$avArray[7]&"|"&$avArray[8]&"|"&$avArray[9]&$avArray[10]&"|"&$avArray[11]&"|"&$avArray[12]&"|"&$avArray[13]
$dataCol=GUICtrlCreateListViewItem($data,$listview)
Next
FileClose($file)
EndFunc
Func DeleteList()
_GUICtrlListViewDeleteAllItems ($listview)
EndFunc
Func AutoRefresh()
$combo2Item=Number(GUICtrlRead($Tab2combo)) ;Read # of seconds
EndFunc
Func Status() ;Check Firewell status using WMI
$objFirewall = ObjCreate("HNetCfg.FwMgr")
$objPolicy = $objFirewall.LocalPolicy.CurrentProfile
$on_off = $objPolicy.FirewallEnabled
If $on_off = -1 Then
GUICtrlSetImage ($button_ON, "xpsp2res.dll",71)
$label_ON = "enabled"
Else
GUICtrlSetImage ($button_ON, "xpsp2res.dll",72)
$label_ON = "disabled"
Endif
Label()
EndFunc
Func GetBrowser() ;Get Default Browser Registry setting
$Browser = StringSplit(RegRead("HKLM\SOFTWARE\Classes\HTTP\shell\open\command",""),"%")
$HTTP = $Browser[1] & " " & "www.portsdb.org/bin/portsdb.cgi"
EndFunc
Func ReadLine() ;Read Selected IP Address from ListView
If $line = $LV_ERR Then
MsgBox(0, "Retry Again", "Nothing Selected",5)
Elseif (Not IsArray($line)) Then
MsgBox(0, "Retry Again", "Nothing Selected, Click an item in the first column",5)
EndIf
$line = _GUICtrlListViewGetItemTextArray ($listview)
For $ii = 1 To $line[0]
Next
$IP = $Line[5]
MsgBox(0, "Source IP Selected", $IP,5)
RipeWhois()
EndFunc
Func Open_Apps()
$i = 1
Do
$Apps = RegEnumVal("HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List", $i)
$i = $i + 1
$DataListApps = $DatalistApps & $Apps & "|"
Until $Apps =""
GUICtrlSetData($listbox1,$DataListApps)
EndFunc
Func Open_Ports()
$i = 1
Do
$Ports = RegEnumVal("HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List", $i)
$i = $i + 1
$DataListPorts = $datalistPorts & $Ports & "|"
Until $Ports =""
GUICtrlSetData($Listbox2,$DataListPorts)
EndFunc
Func RipeWhois()
$URL = "<a href='http://www.ripe.net/whois?form_type=simple&full_query_string=&searchtext=%22&$IP&%22&do_search=Search' class='bbc_url' title='External link' rel='nofollow external'>http://www.ripe.net/whois?form_type=simple&full_query_string=&searchtext="&$IP&"&do_search=Search"</a>
$oIE.navigate($URL)
GUICtrlSetState($tab2,$GUI_SHOW) ;Jump and Show Tab3
Endfunc
Firewall_Log_Analyzer.au3 12.59KB
1353 downloads
