refactor: Rename SAS IPC event name to be more specific

This commit is contained in:
Nick Bolton
2025-03-10 12:26:09 +00:00
committed by Chris Rizzitello
parent 3344644d2e
commit 5b091dee56
3 changed files with 7 additions and 6 deletions

View File

@ -46,6 +46,7 @@ enum
namespace deskflow::common {
const auto kCloseEventName = "Global\\DeskflowClose";
const auto kSendSasEventName = "Global\\DeskflowSendSAS";
}
} // namespace deskflow::common
#endif

View File

@ -760,11 +760,11 @@ bool MSWindowsKeyState::fakeCtrlAltDel()
// History: It used to be possible to use `PostMessage` to send `MOD_CONTROL | MOD_ALT, VK_DELETE`
// as a backup but this ability was removed by Microsoft for security in favor of requiring the
// `SendSAS` event to be used, which makes DoS and social engineering attacks more difficult.
HANDLE hEvtSendSas = OpenEvent(EVENT_MODIFY_STATE, FALSE, "Global\\SendSAS");
if (hEvtSendSas) {
HANDLE hSendSasEvent = OpenEvent(EVENT_MODIFY_STATE, FALSE, deskflow::common::kSendSasEventName);
if (hSendSasEvent) {
LOG_DEBUG("found SendSAS event, simulating ctrl+alt+del");
SetEvent(hEvtSendSas);
CloseHandle(hEvtSendSas);
SetEvent(hSendSasEvent);
CloseHandle(hSendSasEvent);
return true;
} else {
LOG_ERR("couldn't find SendSAS event, unable to simulate ctrl+alt+del");

View File

@ -567,7 +567,7 @@ void MSWindowsWatchdog::sendSas() const
throw XArch("SendSAS function not initialized");
}
HANDLE sendSasEvent = CreateEvent(nullptr, FALSE, FALSE, "Global\\SendSAS");
HANDLE sendSasEvent = CreateEvent(nullptr, FALSE, FALSE, deskflow::common::kSendSasEventName);
if (sendSasEvent == nullptr) {
LOG_ERR("could not create SendSAS event");
throw XArch(new XArchEvalWindows());