[Global]

$CanRunSafeDesktop = ( f_isInstalled("SandBox") && !$IsProcessor64Bit )
$CanRunSafeBrowser = ( f_isInstalled("SandBox") && (!$IsProcessor64Bit || ($IsProcessor64Bit&&$IsVistaOS)) )
;------------------- PDM -----------------

;Event Types

#PDM2_EVENT_P2P_SC_RDL          = 1
#PDM2_EVENT_SC_AR               = 2
#PDM2_EVENT_SC_ARsrc            = 3
#PDM2_EVENT_SCN                 = 4
#PDM2_EVENT_P2P_SCN             = 5
#PDM2_EVENT_SC2STARTUP          = 6
#PDM2_EVENT_SC_MULTIPLE         = 7
#PDM2_EVENT_RDR                 = 8
#PDM2_EVENT_HIDDEN_OBJ          = 10
#PDM2_EVENT_INVADER             = 11
#PDM2_EVENT_INVADER_LOADER      = 17
#PDM2_EVENT_STRANGEKEY          = 18
#PDM2_EVENT_SYSCHANGE           = 19
#PDM2_EVENT_HIDDEN_INSTALL      = 20
#PDM2_EVENT_BUFFEROVERRUN       = 21
#PDM2_EVENT_DEP                 = 22
#PDM2_EVENT_HOSTS               = 23
#PDM2_EVENT_DOWNLOADER          = 25
#PDM2_EVENT_TROJAN_GEN          = 26
#PDM2_EVENT_DRIVER_INS          = 28
#PDM2_EVENT_HIDDEN_SEND         = 29
#PDM2_EVENT_KEYLOGGER           = 30
#PDM2_EVENT_IRP_TABLE_CHANGED   = 31
#PDM2_EVENT_NEGATIVE_PID        = 32
#PDM2_EVENT_DNS_QUERY	   	    = 33
#PDM2_EVENT_PSTORE         	    = 34
#PDM2_EVENT_BSS_DETECT		    = 35

; PDM2 Alert ActionIDs

#PDM2_ACTION_ASK               	 = 0xEE550200
#PDM2_ACTION_DETECT            	 = 0xEE550201
#PDM2_ACTION_ROLLBACK          	 = 0xEE550202
#PDM2_ACTION_TERMINATE_FAILED  	 = 0xEE550203
#PDM2_ACTION_ROLLBACK_RESULT   	 = 0xEE550204
#PDM2_ACTION_TERMINATE_INFO    	 = 0xEE550205
#PDM2_ACTION_QUARANTINE_FAILED 	 = 0xEE550206
#PDM2_ACTION_FILE_DELETED	     = 0xEE550207
#PDM2_ACTION_FILE_DELETE_FAILED	 = 0xEE550208
#PDM2_ACTION_QUARANTINED	     = 0xEE550209
#PDM2_ACTION_GET_HISTORY	     = 0xEE55020A
#PDM2_ACTION_SAVE_HISTORY	     = 0xEE55020B
#PDM2_ACTION_BLOCKED_APP_START	 = 0xEE55020C

; enPdm2SettingsType

#PDM2_SET_WorpP2P			= 1
#PDM2_SET_TrojGen			= 2
#PDM2_SET_Keylogger			= 3
#PDM2_SET_SuspDrvInst		= 4
#PDM2_SET_IrpTableChange	= 5
#PDM2_SET_HiddenObj			= 6
#PDM2_SET_NegativePID		= 7
#PDM2_SET_WormGen			= 8
#PDM2_SET_HostsChange		= 9
;#PDM2_SET_Cryptor			= 10
#PDM2_SET_RootShell			= 10
#PDM2_SET_Invader			= 11
#PDM2_SET_InvaderLoader		= 12
#PDM2_SET_StrangeKey		= 13
#PDM2_SET_HiddenDataSend	= 14
#PDM2_SET_StrangeBeh		= 15
#PDM2_SET_DNSQuery			= 16
#PDM2_SET_PrtStgAccess		= 17

;actionIDs

#PDM2_ALLOW     	= 0
#PDM2_ASK       	= 1
#PDM2_BLOCK     	= 2
#PDM2_TERMINATE 	= 3
#PDM2_QUARANTINE 	= 4

; PDM2RTRollBackActions

#PDM2RollBack_off	= 0
#PDM2RollBack_auto	= 1
#PDM2RollBack_ask	= 2

; eFlags
#PDM2_UseWithoutHIPS	= 0x200

$PDM2_AlertDetails_Show_Info = f_PDM2_Show_Info_Page(EventType)
$PDM2_AlertDetails_Show_InfoPage = (f_PDM2_Show_Info_Page(EventType) == #PDM2_ShowInfo_Show)
$PDM2_AlertDetails_Show_DLLs = f_PDM2_AlertDetails_Show_DLLs(EventType)
$PDM2_AlertDetails_Show_ChildProcs = f_PDM2_AlertDetails_Show_ChildProcs(ChildProcList)
$PDM2_AlertDetails_Show_Hosts = f_PDM2_AlertDetails_Show_Hosts(EventType)
$PDM2_AlertDetails_Show_History = f_PDM2_AlertDetails_Show_History(pHistPtr)

#PDM2_ShowInfo_Show     = 1
#PDM2_ShowInfo_Hide     = 0
#PDM2_ShowInfo_DontKnow = 2

#m_res_swap 	= 1 
#m_res_shutdown = 2

; SW2
#SW2_Action_Quarantine	= 0x0080
#SW2_Action_Terminate 	= 0x0008
#SW2_Action_Allow 		= 0x0002
#SW2_Action_Unknown 	= 0x0000

#SW2_TD_MakeRollback      = 0
#SW2_TD_DonotMakeRollback = 1
#SW2_TD_RequestActionType = 2

#PROC_OWNER_AUTO = 0
#PROC_OWNER_USER = 1

PrepareShutdownDesktop = f_PrepareShutdownDesktop(dialog("[AskPrepareShutdownDesktopDialog]"))

SandboxCloseAppDialog = f_SandboxCloseAppDialog(dialog("AskSandboxCloseAppDialog", p_PID(nVal1)))

;-------------------- PDM Rules ---------------------------

[s_PDM2_EventType_IsShow_ByOS]
$PDM2_EventType_OsCheck 	= !$IsProcessor64Bit
#PDM2_SET_IrpTableChange	= $PDM2_EventType_OsCheck
#PDM2_SET_Invader			= $PDM2_EventType_OsCheck
#PDM2_SET_InvaderLoader		= $PDM2_EventType_OsCheck
#PDM2_SET_StrangeBeh		= $PDM2_EventType_OsCheck
#PDM2_SET_PrtStgAccess		= $PDM2_EventType_OsCheck
#PDM2_SET_DNSQuery			= $PDM2_EventType_OsCheck
default						= 1

[s_PDM2_EventType_IsShow_WithHips]
#PDM2_SET_Invader 			= 0
#PDM2_SET_InvaderLoader 	= 0
#PDM2_SET_StrangeKey 		= 0
#PDM2_SET_HiddenDataSend	= 0
#PDM2_SET_StrangeBeh 		= 0
#PDM2_SET_DNSQuery 			= 0
#PDM2_SET_PrtStgAccess 		= 0
#PDM2_SET_HostsChange		= 0
default						= s_PDM2_EventType_IsShow_ByOS(@0)

[f_PDM2_EventType_IsShow]
p_EventTypeSetting, p_nFlags
ret = bmask(p_nFlags, #PDM2_UseWithoutHIPS) ? s_PDM2_EventType_IsShow_ByOS(p_EventTypeSetting) : s_PDM2_EventType_IsShow_WithHips(p_EventTypeSetting)

[f_PDM2_IsSettingEnabledAndShown]
ret = f_PDM2_EventType_IsShow(EventTypeSetting, nFlags) && bEnabled


[s_PDM2_ThreatTypeIcon]
#PDM2_SET_Keylogger
#PDM2_SET_IrpTableChange
#PDM2_SET_HostsChange
#PDM2_SET_Invader
#PDM2_SET_InvaderLoader
#PDM2_SET_StrangeKey
#PDM2_SET_StrangeBeh
#PDM2_SET_DNSQuery
#PDM2_SET_PrtStgAccess		= "warning"
default						= "error"

;----------------- PDM2_ShowAction ------------------------

[s_PDM2_ShowAllowAction]
default	= 1

[s_PDM2_ShowBlockAction]
#PDM2_SET_Invader
#PDM2_SET_InvaderLoader
#PDM2_SET_StrangeKey
#PDM2_SET_HiddenDataSend
#PDM2_SET_StrangeBeh
#PDM2_SET_DNSQuery
#PDM2_SET_PrtStgAccess		= 1
default						= 0

[s_PDM2_ShowTerminateAction]
#PDM2_SET_IrpTableChange	= 0
default						= 1

[s_PDM2_ShowQuarantineAction]
#PDM2_SET_IrpTableChange	= 0
#PDM2_SET_HiddenObj			= 0
#PDM2_SET_NegativePID		= 0
default						= 1

;----------------------------------------------------------

[f_PDM2_AlertDialogTrouble]
p_Action, p_EventType
ret = s_PDM2_AlertDialog_Event(p_Action) + if(f_PDM2_AlertDetails_IsDetails(p_EventType),$PDM2_AlertDetailsLink)

[s_PDM2_IsDetailsExist]
#PDM2_EVENT_HIDDEN_INSTALL = #PDM2_ShowInfo_Show
#PDM2_EVENT_BUFFEROVERRUN  = #PDM2_ShowInfo_Show
#PDM2_EVENT_DEP            = #PDM2_ShowInfo_Show
#PDM2_EVENT_KEYLOGGER      = strUserDescription
#PDM2_EVENT_HOSTS          = #PDM2_ShowInfo_DontKnow
default                    = #PDM2_ShowInfo_Hide

[f_PDM2_Show_Info_Page]
p_EventType
ret = s_PDM2_IsDetailsExist(p_EventType)

[s_PDM2_AlertDetails_IsDetails_1]
#PDM2_ShowInfo_Show = 1
#PDM2_ShowInfo_Hide = 0
default             = s_PDM2_AlertDetails_IsDetails_2($PDM2_AlertDetails_Show_DLLs)

[s_PDM2_AlertDetails_IsDetails_2]
#PDM2_ShowInfo_Show = 1
default             = s_PDM2_AlertDetails_IsDetails_3($PDM2_AlertDetails_Show_ChildProcs)

[s_PDM2_AlertDetails_IsDetails_3]
#PDM2_ShowInfo_Show = 1
default             = s_PDM2_AlertDetails_IsDetails_4($PDM2_AlertDetails_Show_Hosts)

[s_PDM2_AlertDetails_IsDetails_4]
#PDM2_ShowInfo_Show = 1
default             = $PDM2_AlertDetails_Show_History

[f_PDM2_AlertDetails_IsDetails]
ret = s_PDM2_AlertDetails_IsDetails_1($PDM2_AlertDetails_Show_Info)

[f_PDM2_AlertDetails_Show_DLLs]
p_EventType
ret = s_PDM2_Show_DLL_Page(p_EventType)

[f_PDM2_AlertDetails_Show_ChildProcs]
p_ChildProcList
ret = (p_ChildProcList.size() != 0)

[f_PDM2_AlertDetails_Show_Hosts]
p_EventType
ret = (p_EventType == #PDM2_EVENT_HOSTS)

[f_PDM2_AlertDetails_Show_History]
p_History
ret = (p_History != 0)

[s_PDM2_Show_DLL_Page]
default			= 0

[f_GetSandBoxName]
@, l_Ser
ret = l_Ser = Sandboxes.find("ID == " + @), s_SandBoxName(l_Ser.ID, l_Ser)

[s_OfferResName]
#stFileInfo = pathLastChild(Data.Path)
#stRegKeyInfo = Data.KeyValue == "" ? pathLastChild(Data.KeyPath) : Data.KeyValue
default = ""

[s_WasOfferedResName]
#stFileInfo = ctl.Name.Val.value == pathLastChild(Data.Path) || ctl.Name.Val.value == ""
#stRegKeyInfo = ctl.Name.Val.value == pathLastChild(Data.KeyPath) || ctl.Name.Val.value == Data.KeyValue || ctl.Name.Val.value == ""
default = 1


;-------------------- System Monitor ---------------------------

[s_IsRunListCategory]
Running = 1
Startup = 1
SandBox = 1
default = 0

[s_IsNetListCategory]
Network = 1
default = 0

[s_IsAllListCategory]
All        = 1
Trusted    = 1
Restricted = 1
Banned     = 1
Today      = 1
ThisWeek   = 1
ThisMonth  = 1
default = 0

[f_FilterString]
$Net = "wildcard(\"*" + escape(toupper(ctl.Filter.value)) + "*\",toupper(Image))"
$Run = "wildcard(\"*" + escape(toupper(ctl.Filter.value)) + "*\",toupper(Rating.ModuleInfo.sDescription)) || wildcard(\"*" + escape(toupper(ctl.Filter.value)) + "*\",toupper(Rating.ModuleInfo.sVendor)) || wildcard(\"*" + escape(toupper(ctl.Filter.value)) + "*\",toupper(Rating.ModuleInfo.sImagePath))"
ret = s_IsNetListCategory(@) ? $Net : $Run

[s_CategoryListFilter]
Avp			= "Id != #AppIdProduct"
System		= "!wildcard(\"NT AUTHORITY*\",toupper(RunInfo.sUserName))"
Running     = ""
Startup     = "RunInfo.Startup == 0"
Network     = ""
SandBox     = "RunInfo.InSandBox == 1"
Trusted     = "GroupInfo.GroupId == #HIPS_APP_ID_TRUSTED"
Restricted  = "GroupInfo.GroupId == #HIPS_APP_ID_LO_REST || GroupInfo.GroupId == #HIPS_APP_ID_HI_REST"
Banned      = "GroupInfo.GroupId == #HIPS_APP_ID_UNTRUSTED"
Today       = "datepart(ExecuteInfo.nLastExecuteTime, \"year\", #WEEK_FROM_SUNDAY) == datepart(localtime(), \"year\", #WEEK_FROM_SUNDAY) && datepart(ExecuteInfo.nLastExecuteTime, \"dayofyear\", #WEEK_FROM_SUNDAY) == datepart(localtime(), \"dayofyear\", #WEEK_FROM_SUNDAY)"
ThisWeek    = "datepart(ExecuteInfo.nLastExecuteTime, \"year\", #WEEK_FROM_SUNDAY) == datepart(localtime(), \"year\", #WEEK_FROM_SUNDAY) && datepart(ExecuteInfo.nLastExecuteTime, \"week\", #WEEK_FROM_SUNDAY) == datepart(localtime(), \"week\", #WEEK_FROM_SUNDAY)"
ThisMonth   = "datepart(ExecuteInfo.nLastExecuteTime, \"year\", #WEEK_FROM_SUNDAY) == datepart(localtime(), \"year\", #WEEK_FROM_SUNDAY) && datepart(ExecuteInfo.nLastExecuteTime, \"month\", #WEEK_FROM_SUNDAY) == datepart(localtime(), \"month\", #WEEK_FROM_SUNDAY)"
All         = ""

[f_SetCategoryListFilter]
p_StartRun,p_Avp,p_System
ret = var pIskl; pIskl = "( 0 "; \
	if(!p_StartRun,	pIskl = pIskl +" || !(" + s_CategoryListFilter("Startup")+" )",true); \
	if(!p_System,	pIskl = pIskl +" || !(" + s_CategoryListFilter("System")	+" )",true); \ 
	pIskl = pIskl + " ) "; \
	var pFilter; pFilter = "1"; \
	if(p_StartRun,	pFilter = pFilter +" && ((" + s_CategoryListFilter("Startup")+" ) || " + pIskl + ")",true); \
	if(p_System,	pFilter = pFilter +" && ((" + s_CategoryListFilter("System")	+" ) || " + pIskl+ ")",true); \
	pFilter = " ( " + pFilter + " ) " + if(p_Avp, " && ( " + s_CategoryListFilter("Avp")+ " ) " , " || !( " + s_CategoryListFilter("Avp")+ " ) ") ; \
	pFilter


#HIPS_APP_ID_TRUSTED	    = 0
#HIPS_APP_ID_LO_REST	    = 1
#HIPS_APP_ID_HI_REST	    = 2
#HIPS_APP_ID_UNTRUSTED	    = 3
#HIPS_APP_ID_CUSTOM	        = 4
#HIPS_APP_ID_DEFAULT        = 5
#HIPS_APP_ID_HIPSNOTRUNNING = 0xFFFFFFFE
#HIPS_APP_ID_UNKNOWN        = 0xFFFFFFFF

[s_StatusListFilter]
Hight  	= " GroupInfo.GroupId != #HIPS_APP_ID_UNTRUSTED "
Norm    = " (GroupInfo.GroupId != #HIPS_APP_ID_LO_REST) && (GroupInfo.GroupId != #HIPS_APP_ID_HI_REST) "
Other	= "GroupInfo.GroupId >= #HIPS_APP_ID_LO_REST && GroupInfo.GroupId <= #HIPS_APP_ID_UNTRUSTED"

[s_FilterIndex]
Category 	= 1
Avp 		= 2
System   	= 3
Find	   	= 4
StartRun 	= 5
Status	 	= 6

[f_AppStatusIconMerge]
p_Group
ret = f_AppStatusIconMerge3(p_Group.GroupId, p_Group.IsCustomRules, p_Group.ByUser)

[f_AppStatusIconMerge3]
p_GroupId, p_IsCustomRules, p_ByUser
ret = mergeIcon(f_AppStatusIcon(p_GroupId, p_IsCustomRules), s_Proc_status_owner(p_ByUser ? #PROC_OWNER_USER : #PROC_OWNER_AUTO ))

[f_AppStatusIcon]
p_Stat, p_ByUser
ret = if(p_ByUser,"Proc_status,4", s_AppStatusIcon(p_Stat))

[s_AppStatusIcon]
#HIPS_APP_ID_TRUSTED	    = "Proc_status,0"
#HIPS_APP_ID_LO_REST	    = "Proc_status,1"
#HIPS_APP_ID_HI_REST	    = "Proc_status,1"
#HIPS_APP_ID_UNTRUSTED	    = "Proc_status,2"
#HIPS_APP_ID_CUSTOM	        = "Proc_status,3"
#HIPS_APP_ID_DEFAULT        = "Proc_status,3"
#HIPS_APP_ID_HIPSNOTRUNNING = "Proc_status,3"
#HIPS_APP_ID_UNKNOWN        = "Proc_status,3"
default                     = "Proc_status,2"

[s_AppGroupIcon]
KLAppTrusted        = "Proc_status,0"
KLAppRestrictedLow  = "Proc_status,1"
KLAppRestrictedHi   = "Proc_status,1"
KLAppUntrusted      = "Proc_status,2"
default             = "Proc_status,3"

[f_AppRootGroupIcon]
ret = s_AppGroupIcon(hipsGroup(@,1))

[f_WoCUsersCount2Level]
ret = if(@ < 10, 0, if(@ < 100, 1, if(@ < 1000, 2, if(@ < 10000, 3, if(@ < 100000, 4, 5)))))

[s_PopularityIcon]
0 = "Proc_popularity_0"
1 = "Proc_popularity_1"
2 = "Proc_popularity_2"
3 = "Proc_popularity_3"
4 = "Proc_popularity_4"
5 = "Proc_popularity_5"

[f_AppStatusName]
ret = if(s_IsStateRunning(HipsTask.state), if(@.IsCustomRules,s_AppStatusName(#HIPS_APP_ID_CUSTOM),s_AppStatusName(@.GroupId)) + if(@.ByParent, $ByParent, if(!@.IsCustomRules && @.ByUser, $ByUser, "")), s_AppStatusName(#HIPS_APP_ID_HIPSNOTRUNNING))

[f_AppStatusDetails]
ret = if(s_IsStateRunning(HipsTask.state), if(!@.IsCustomRules,s_AppStatusDetails(@.GroupId)), s_AppStatusDetails(#HIPS_APP_ID_HIPSNOTRUNNING))

[f_ParsePortsError]
ret = s_ParsePortsError(parsePorts(@1, @))

[s_ParsePortsError]
0x1 = true
0x2 = balloon("ErrPortsList")
0x4 = balloon("WarnPortsList")
def = balloon("ErrPortsList")

[f_PrepareShutdownDesktop]
ret = if(@ == #m_res_swap, f_IfErrThenMsg(goToBaseDesktop(), "SandBoxError"),if(@ == #m_res_shutdown, f_IfErrThenMsg(shutdownDesktop(), "SandBoxError"))); @

[f_SandboxCloseAppDialog]
ret = if(@ == #m_res_ok, true, false)

[s_SetSW2ReactionTypeAuto]
0 = action_ = #SW2_Action_Unknown
1 = action_ = #SW2_Action_Quarantine

[f_SetSW2ReactionType]
p_autoAction_, p_action_
ret = if( p_autoAction_, action_ = p_action_) 

[f_GetSW2ReactionType]
p_action_
ret = if( p_action_ == #SW2_Action_Unknown, #SW2_Action_Quarantine,p_action_) 

[s_SetSW2_TD_Auto]
0 = ThreatsDisinfector.rbAskUser_ = 0
1 = ThreatsDisinfector.rbAskUser_ = 1; ThreatsDisinfector.rbEnabled_ = 1

[f_SetSW2_TD_ReactionType]
p_auto_, p_action_
ret = if( p_auto_, s_GetSW2_TD_ReactionType_Val(p_action_)) 

[s_GetSW2_TD_ReactionType_Val]
#SW2_TD_MakeRollback      = ThreatsDisinfector.rbEnabled_ = 1; ThreatsDisinfector.rbAskUser_ = 0
#SW2_TD_DonotMakeRollback = ThreatsDisinfector.rbEnabled_ = 0; ThreatsDisinfector.rbAskUser_ = 0


[f_GetSW2_TD_ReactionType]
p_rbEnabled_, p_rbAskUser_
ret = if(p_rbAskUser_, #SW2_TD_MakeRollback, if(p_rbEnabled_,#SW2_TD_MakeRollback,#SW2_TD_DonotMakeRollback))

[s_Proc_status_owner]
#PROC_OWNER_AUTO = "Proc_status,5"
#PROC_OWNER_USER = "Proc_status,6"
