From a3be164055e770a68d6504ce18cba71e22fd06a0 Mon Sep 17 00:00:00 2001
From: Eviatar Gerzi <evyatar575@gmail.com>
Date: Fri, 4 Nov 2022 14:26:43 +0200
Subject: [PATCH] Add requirement to run RPCMon as Administrator

---
 .gitignore                        |  6 +++
 RPCMon/Form1.cs                   | 24 +++++++++-
 RPCMon/Properties/AssemblyInfo.cs |  4 +-
 RPCMon/RPCMon.csproj              | 32 +++++++++++++
 RPCMon/RPCMon.csproj.user         | 13 ++++++
 RPCMon/app.manifest               | 76 +++++++++++++++++++++++++++++++
 6 files changed, 151 insertions(+), 4 deletions(-)
 create mode 100644 .gitignore
 create mode 100644 RPCMon/RPCMon.csproj.user
 create mode 100644 RPCMon/app.manifest

diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..e7e9dbb
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,6 @@
+
+RPCMon/bin/
+
+RPCMon/obj/
+
+.vs/
diff --git a/RPCMon/Form1.cs b/RPCMon/Form1.cs
index de695af..8a29dc4 100644
--- a/RPCMon/Form1.cs
+++ b/RPCMon/Form1.cs
@@ -16,6 +16,7 @@ using Newtonsoft.Json;
 using Microsoft.Diagnostics.Tracing.Parsers.MicrosoftWindowsRPC;
 using RPCMon.Control;
 using System.Reflection;
+using System.Security.Principal;
 
 namespace RPCMon
 {
@@ -38,10 +39,13 @@ namespace RPCMon
         private ListView m_LastListViewColumnFilter = new ListView();
         private ListView m_LastListViewHighlighFilter = new ListView();
         int m_CurrentRowIndexRightClick, m_CurrentColumnIndexRightClick;
+        bool m_IsElevated = false;
 
         public Form1()
         {
             InitializeComponent();
+            configureFormBasedPrivileges();
+
 
             this.m_RPCDBPath = getDBFromCurrentFolder();
             this.toolStripStatusLabelDBPath.Text = "DB File: " + Path.GetFileName(this.m_RPCDBPath);
@@ -84,6 +88,22 @@ namespace RPCMon
                new object[] { true });
         }
 
+        private void configureFormBasedPrivileges()
+        {
+            bool isElevated;
+            using (WindowsIdentity identity = WindowsIdentity.GetCurrent())
+            {
+                WindowsPrincipal principal = new WindowsPrincipal(identity);
+                isElevated = principal.IsInRole(WindowsBuiltInRole.Administrator);
+                m_IsElevated = isElevated;
+                if (isElevated)
+                {
+                    this.Text = "RPCMon - RPC Monitor Based Windows Events (Administrator)";
+                }
+            }
+        }
+
+
         private void checkIdDBGHelpExist()
         {
             if (!File.Exists(Engine.DbgHelpFilePath))
@@ -307,6 +327,7 @@ namespace RPCMon
 
         private void toolStripButtonStart_Click(object sender, EventArgs e)
         {
+
             if (!m_IsCaptureButtonPressed)
             {
                 toolStripButtonStart.Image = global::RPCMon.Properties.Resources.pause_button;
@@ -324,7 +345,6 @@ namespace RPCMon
                 m_TraceSession.Dispose();
                 m_CaptureThread.Abort();
             }
-
         }
 
         /*private void toolStripButtonStop_Click(object sender, EventArgs e)
@@ -845,7 +865,7 @@ namespace RPCMon
 
         private void aboutToolStripMenuItem_Click(object sender, EventArgs e)
         {
-            MessageBox.Show("Authors: Eviatar Gerzi (@g3rzi) and Yaniv Yakobovich\nVersion: 1.0\n\nCopyright (c) 2022 CyberArk Software Ltd. All rights reserved", "About");
+            MessageBox.Show("Authors: Eviatar Gerzi (@g3rzi) and Yaniv Yakobovich\nVersion: 1.1\n\nCopyright (c) 2022 CyberArk Software Ltd. All rights reserved", "About");
         }
 
         private void toolStripButtonFind_Click(object sender, EventArgs e)
diff --git a/RPCMon/Properties/AssemblyInfo.cs b/RPCMon/Properties/AssemblyInfo.cs
index 884a165..ee0587f 100644
--- a/RPCMon/Properties/AssemblyInfo.cs
+++ b/RPCMon/Properties/AssemblyInfo.cs
@@ -32,5 +32,5 @@ using System.Runtime.InteropServices;
 // You can specify all the values or you can default the Build and Revision Numbers
 // by using the '*' as shown below:
 // [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.0.0.0")]
+[assembly: AssemblyVersion("1.1.0.0")]
+[assembly: AssemblyFileVersion("1.1.0.0")]
diff --git a/RPCMon/RPCMon.csproj b/RPCMon/RPCMon.csproj
index a54f9b8..e605539 100644
--- a/RPCMon/RPCMon.csproj
+++ b/RPCMon/RPCMon.csproj
@@ -12,6 +12,21 @@
     <FileAlignment>512</FileAlignment>
     <AutoGenerateBindingRedirects>true</AutoGenerateBindingRedirects>
     <Deterministic>true</Deterministic>
+    <PublishUrl>publish\</PublishUrl>
+    <Install>true</Install>
+    <InstallFrom>Disk</InstallFrom>
+    <UpdateEnabled>false</UpdateEnabled>
+    <UpdateMode>Foreground</UpdateMode>
+    <UpdateInterval>7</UpdateInterval>
+    <UpdateIntervalUnits>Days</UpdateIntervalUnits>
+    <UpdatePeriodically>false</UpdatePeriodically>
+    <UpdateRequired>false</UpdateRequired>
+    <MapFileExtensions>true</MapFileExtensions>
+    <ApplicationRevision>0</ApplicationRevision>
+    <ApplicationVersion>1.1.0.%2a</ApplicationVersion>
+    <IsWebBootstrapper>false</IsWebBootstrapper>
+    <UseApplicationTrust>false</UseApplicationTrust>
+    <BootstrapperEnabled>true</BootstrapperEnabled>
   </PropertyGroup>
   <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
     <PlatformTarget>x64</PlatformTarget>
@@ -33,6 +48,10 @@
     <ErrorReport>prompt</ErrorReport>
     <WarningLevel>4</WarningLevel>
   </PropertyGroup>
+  <PropertyGroup />
+  <PropertyGroup>
+    <ApplicationManifest>app.manifest</ApplicationManifest>
+  </PropertyGroup>
   <ItemGroup>
     <Reference Include="Microsoft.Diagnostics.Tracing.TraceEvent">
       <HintPath>..\Packages\Microsoft.Diagnostics.Tracing.TraceEvent.2.0.42\lib\net45\Microsoft.Diagnostics.Tracing.TraceEvent.dll</HintPath>
@@ -130,6 +149,7 @@
       <DependentUpon>Resources.resx</DependentUpon>
       <DesignTime>True</DesignTime>
     </Compile>
+    <None Include="app.manifest" />
     <None Include="packages.config" />
     <None Include="Properties\Settings.settings">
       <Generator>SettingsSingleFileGenerator</Generator>
@@ -181,5 +201,17 @@
   <ItemGroup>
     <None Include="Resources\duplicate-disable.png" />
   </ItemGroup>
+  <ItemGroup>
+    <BootstrapperPackage Include=".NETFramework,Version=v4.6.1">
+      <Visible>False</Visible>
+      <ProductName>Microsoft .NET Framework 4.6.1 %28x86 and x64%29</ProductName>
+      <Install>true</Install>
+    </BootstrapperPackage>
+    <BootstrapperPackage Include="Microsoft.Net.Framework.3.5.SP1">
+      <Visible>False</Visible>
+      <ProductName>.NET Framework 3.5 SP1</ProductName>
+      <Install>false</Install>
+    </BootstrapperPackage>
+  </ItemGroup>
   <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
 </Project>
\ No newline at end of file
diff --git a/RPCMon/RPCMon.csproj.user b/RPCMon/RPCMon.csproj.user
new file mode 100644
index 0000000..7937b01
--- /dev/null
+++ b/RPCMon/RPCMon.csproj.user
@@ -0,0 +1,13 @@
+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <PropertyGroup>
+    <PublishUrlHistory>publish\</PublishUrlHistory>
+    <InstallUrlHistory />
+    <SupportUrlHistory />
+    <UpdateUrlHistory />
+    <BootstrapperUrlHistory />
+    <ErrorReportUrlHistory />
+    <FallbackCulture>en-US</FallbackCulture>
+    <VerifyUploadedFiles>false</VerifyUploadedFiles>
+  </PropertyGroup>
+</Project>
\ No newline at end of file
diff --git a/RPCMon/app.manifest b/RPCMon/app.manifest
new file mode 100644
index 0000000..d72e750
--- /dev/null
+++ b/RPCMon/app.manifest
@@ -0,0 +1,76 @@
+<?xml version="1.0" encoding="utf-8"?>
+<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">
+  <assemblyIdentity version="1.0.0.0" name="MyApplication.app"/>
+  <trustInfo xmlns="urn:schemas-microsoft-com:asm.v2">
+    <security>
+      <requestedPrivileges xmlns="urn:schemas-microsoft-com:asm.v3">
+        <!-- UAC Manifest Options
+             If you want to change the Windows User Account Control level replace the 
+             requestedExecutionLevel node with one of the following.
+
+        <requestedExecutionLevel  level="asInvoker" uiAccess="false" />
+        <requestedExecutionLevel  level="requireAdministrator" uiAccess="false" />
+        <requestedExecutionLevel  level="highestAvailable" uiAccess="false" />
+
+            Specifying requestedExecutionLevel element will disable file and registry virtualization. 
+            Remove this element if your application requires this virtualization for backwards
+            compatibility.
+        -->
+        <requestedExecutionLevel level="requireAdministrator" uiAccess="false" />
+      </requestedPrivileges>
+    </security>
+  </trustInfo>
+
+  <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">
+    <application>
+      <!-- A list of the Windows versions that this application has been tested on
+           and is designed to work with. Uncomment the appropriate elements
+           and Windows will automatically select the most compatible environment. -->
+
+      <!-- Windows Vista -->
+      <!--<supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}" />-->
+
+      <!-- Windows 7 -->
+      <!--<supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}" />-->
+
+      <!-- Windows 8 -->
+      <!--<supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}" />-->
+
+      <!-- Windows 8.1 -->
+      <!--<supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}" />-->
+
+      <!-- Windows 10 -->
+      <!--<supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}" />-->
+
+    </application>
+  </compatibility>
+
+  <!-- Indicates that the application is DPI-aware and will not be automatically scaled by Windows at higher
+       DPIs. Windows Presentation Foundation (WPF) applications are automatically DPI-aware and do not need 
+       to opt in. Windows Forms applications targeting .NET Framework 4.6 that opt into this setting, should 
+       also set the 'EnableWindowsFormsHighDpiAutoResizing' setting to 'true' in their app.config. -->
+  <!--
+  <application xmlns="urn:schemas-microsoft-com:asm.v3">
+    <windowsSettings>
+      <dpiAware xmlns="http://schemas.microsoft.com/SMI/2005/WindowsSettings">true</dpiAware>
+    </windowsSettings>
+  </application>
+  -->
+
+  <!-- Enable themes for Windows common controls and dialogs (Windows XP and later) -->
+  <!--
+  <dependency>
+    <dependentAssembly>
+      <assemblyIdentity
+          type="win32"
+          name="Microsoft.Windows.Common-Controls"
+          version="6.0.0.0"
+          processorArchitecture="*"
+          publicKeyToken="6595b64144ccf1df"
+          language="*"
+        />
+    </dependentAssembly>
+  </dependency>
+  -->
+
+</assembly>