550 lines
25 KiB
C#
550 lines
25 KiB
C#
using System;
|
||
using System.Collections.Generic;
|
||
using System.Collections.ObjectModel;
|
||
using System.Globalization;
|
||
using System.Linq;
|
||
using System.Threading;
|
||
using System.Threading.Tasks;
|
||
using System.Windows;
|
||
using System.Windows.Data;
|
||
using Microsoft.Win32;
|
||
using MemScanEDR.Models;
|
||
using MemScanEDR.Services;
|
||
|
||
namespace MemScanEDR;
|
||
|
||
// ─── Value Converter: List<string> → comma-separated string ───
|
||
public class ListToStringConverter : IValueConverter
|
||
{
|
||
public object Convert(object value, Type targetType, object parameter, CultureInfo culture) =>
|
||
value is List<string> list && list.Count > 0 ? string.Join(", ", list) : "—";
|
||
|
||
public object ConvertBack(object value, Type targetType, object parameter, CultureInfo culture) =>
|
||
throw new NotSupportedException();
|
||
}
|
||
|
||
// ─── Simple language helper ──────────────────────────────────
|
||
public static class Lang
|
||
{
|
||
private static bool _isChinese = true;
|
||
public static bool IsChinese => _isChinese;
|
||
|
||
public static void SetChinese(bool zh) => _isChinese = zh;
|
||
|
||
public static string T(string zh, string en) => _isChinese ? zh : en;
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════════
|
||
// MAIN WINDOW
|
||
// ═══════════════════════════════════════════════════════════════
|
||
public partial class MainWindow : Window
|
||
{
|
||
// ── Services ───────────────────────────────────────────────
|
||
private readonly ProcessCollector _processCollector = new();
|
||
private readonly MemoryScanner _memoryScanner = new();
|
||
private readonly CeMcpManager _ceMcp = new();
|
||
private AIAnalyzer? _aiAnalyzer;
|
||
|
||
// ── Application state ──────────────────────────────────────
|
||
private AppSettings _settings = null!;
|
||
private readonly ObservableCollection<ScanResult> _results = new();
|
||
private readonly ObservableCollection<string> _scanLog = new();
|
||
private List<Signature> _signatures = new();
|
||
private CancellationTokenSource? _cts;
|
||
private bool _isScanning;
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// CONSTRUCTOR
|
||
// ═══════════════════════════════════════════════════════════
|
||
public MainWindow()
|
||
{
|
||
try
|
||
{
|
||
InitializeComponent();
|
||
|
||
// Bind observable collections to DataGrids / ListBox
|
||
DgAlerts.ItemsSource = _results;
|
||
DgProcesses.ItemsSource = _results;
|
||
LstScanLog.ItemsSource = _scanLog;
|
||
|
||
// Load settings & initialize AI analyzer
|
||
_settings = AppSettings.Load();
|
||
_aiAnalyzer = new AIAnalyzer(_settings.AI);
|
||
|
||
// Load signature database
|
||
_signatures = _memoryScanner.LoadSignatures(_settings.RulesDir);
|
||
|
||
// Apply saved settings to the Settings view
|
||
LoadSettingsToUI();
|
||
ApplyLanguage();
|
||
|
||
AddLog(Lang.T("[init] MemScan-EDR 控制台已加载", "[init] MemScan-EDR console loaded"));
|
||
|
||
// Start CE-MCP server at launch (background)
|
||
Task.Run(() =>
|
||
{
|
||
if (_settings.CeMcpPath != "disabled")
|
||
{
|
||
Dispatcher.Invoke(() => AddLog(Lang.T("[mcp] 正在启动 CE-MCP 服务器...", "[mcp] Starting CE-MCP server...")));
|
||
var ok = _ceMcp.Start(_settings.CeMcpCommand, _settings.CeMcpPath == "auto" ? null : _settings.CeMcpPath);
|
||
if (ok)
|
||
{
|
||
Thread.Sleep(1500);
|
||
Dispatcher.Invoke(() => AddLog(Lang.T("[mcp] CE-MCP 服务器已启动", "[mcp] CE-MCP server started")));
|
||
}
|
||
else
|
||
{
|
||
Dispatcher.Invoke(() => AddLog(Lang.T("[mcp] CE-MCP 服务器未找到，将跳过", "[mcp] CE-MCP server not found — skipped")));
|
||
}
|
||
}
|
||
});
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
System.IO.File.AppendAllText(
|
||
System.IO.Path.Combine(AppDomain.CurrentDomain.BaseDirectory, "crash.log"),
|
||
$"[{DateTime.Now:yyyy-MM-dd HH:mm:ss}] MainWindow init error\n{ex}\n\n");
|
||
System.Windows.MessageBox.Show($"Init error (see crash.log):\n\n{ex.Message}", "MemScan-EDR",
|
||
MessageBoxButton.OK, MessageBoxImage.Error);
|
||
}
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// LANGUAGE TOGGLE
|
||
// ═══════════════════════════════════════════════════════════
|
||
private void BtnLangToggle_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
Lang.SetChinese(!Lang.IsChinese);
|
||
ApplyLanguage();
|
||
}
|
||
|
||
private void ApplyLanguage()
|
||
{
|
||
// Title bar
|
||
BtnLang.Content = Lang.T("EN", "中");
|
||
|
||
// Sidebar
|
||
TbMonHeader.Text = Lang.T("监控", "MONITORING");
|
||
TbSysHeader.Text = Lang.T("系统", "SYSTEM");
|
||
TbNavDashboard.Text = Lang.T("仪表盘", "Dashboard");
|
||
TbNavProcess.Text = Lang.T("进程列表", "Processes");
|
||
TbNavScan.Text = Lang.T("扫描进度", "Scan Progress");
|
||
TbNavSettings.Text = Lang.T("设置", "Settings");
|
||
TbQuickScan.Text = Lang.T("快速扫描", "Quick Scan");
|
||
TbQuickScanDesc.Text = Lang.T("立即扫描所有进程", "Scan all processes now");
|
||
BtnStartScan.Content = Lang.T("开始扫描", "Start Scan");
|
||
|
||
// Dashboard
|
||
TbDashboardTitle.Text = Lang.T("安全仪表盘", "Security Dashboard");
|
||
TbStatTotal.Text = Lang.T("已扫描", "TOTAL SCANNED");
|
||
TbStatTotalDesc.Text = Lang.T("进程", "Processes");
|
||
TbStatHigh.Text = Lang.T("高风险", "HIGH RISK");
|
||
TbStatHighDesc.Text = Lang.T("严重告警", "Critical Alerts");
|
||
TbStatSusp.Text = Lang.T("可疑", "SUSPICIOUS");
|
||
TbStatSuspDesc.Text = Lang.T("警告", "Warnings");
|
||
TbStatSafe.Text = Lang.T("安全", "SAFE");
|
||
TbStatSafeDesc.Text = Lang.T("正常", "Clean");
|
||
TbRecentAlerts.Text = Lang.T("最近告警", "Recent Alerts");
|
||
|
||
// Scan view
|
||
TbScanTitle.Text = Lang.T("扫描进度", "Scan Progress");
|
||
BtnStopScan.Content = Lang.T("停止扫描", "Stop Scan");
|
||
TbScanLog.Text = Lang.T("扫描日志", "Scan Log");
|
||
|
||
// Process view
|
||
TbProcTitle.Text = Lang.T("扫描进程", "Scanned Processes");
|
||
|
||
// Settings
|
||
TbSettingsTitle.Text = Lang.T("设置", "Settings");
|
||
TbAiConfig.Text = Lang.T("AI 配置", "AI Configuration");
|
||
TbAiProvider.Text = Lang.T("AI 提供商", "AI Provider");
|
||
TbBaseUrl.Text = Lang.T("API 地址", "API Base URL");
|
||
TbApiKey.Text = Lang.T("API 密钥", "API Key");
|
||
TbModel.Text = Lang.T("模型名称", "Model Name");
|
||
TbPathConfig.Text = Lang.T("路径配置", "Path Configuration");
|
||
TbCeMcpPath.Text = Lang.T("CE-MCP 服务器路径", "CE-MCP Server Path");
|
||
TbRulesDir.Text = Lang.T("扫描规则目录", "Scan Rules Directory");
|
||
TbLogDir.Text = Lang.T("日志目录", "Log Directory");
|
||
TbScanProfile.Text = Lang.T("扫描配置", "Scan Profile");
|
||
BtnSaveSettings.Content = Lang.T("保存设置", "Save Settings");
|
||
|
||
// ComboBox items
|
||
CmbAIProvider.Items[0] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("启发式规则 (无需 API)", "Heuristic (rule-based, no API)"), Tag = "Heuristic" };
|
||
CmbAIProvider.Items[1] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("OpenAI 兼容 (OpenAI / DeepSeek / 通义等)", "OpenAI-Compatible (OpenAI / DeepSeek / etc.)"), Tag = "OpenAICompatible" };
|
||
CmbAIProvider.Items[2] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("Claude (Anthropic API)", "Claude (Anthropic API)"), Tag = "Claude" };
|
||
CmbAIProvider.Items[3] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("本地模型 (Ollama / LM Studio 等)", "Local (Ollama / LM Studio / etc.)"), Tag = "Local" };
|
||
|
||
CmbScanProfile.Items[0] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("快速 - 简单扫描", "fast - Quick scan"), Tag = "fast" };
|
||
CmbScanProfile.Items[1] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("平衡 - 默认扫描深度", "balanced - Default scan depth"), Tag = "balanced" };
|
||
CmbScanProfile.Items[2] = new System.Windows.Controls.ComboBoxItem { Content = Lang.T("深度 - 完整内存 + AI 分析", "deep - Full memory + AI analysis"), Tag = "deep" };
|
||
|
||
// Restore selected index
|
||
LoadSettingsToUI();
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// SIDEBAR NAVIGATION
|
||
// ═══════════════════════════════════════════════════════════
|
||
private void NavChanged(object sender, RoutedEventArgs e)
|
||
{
|
||
if (DashboardView == null || ProcessView == null || ScanView == null || SettingsView == null)
|
||
return;
|
||
|
||
DashboardView.Visibility = Visibility.Collapsed;
|
||
ProcessView.Visibility = Visibility.Collapsed;
|
||
ScanView.Visibility = Visibility.Collapsed;
|
||
SettingsView.Visibility = Visibility.Collapsed;
|
||
|
||
if (sender == NavDashboard) DashboardView.Visibility = Visibility.Visible;
|
||
else if (sender == NavProcess) ProcessView.Visibility = Visibility.Visible;
|
||
else if (sender == NavScan) ScanView.Visibility = Visibility.Visible;
|
||
else if (sender == NavSettings) SettingsView.Visibility = Visibility.Visible;
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// WINDOW CHROME BUTTONS
|
||
// ═══════════════════════════════════════════════════════════
|
||
private void TitleBar_MouseLeftButtonDown(object sender, System.Windows.Input.MouseButtonEventArgs e)
|
||
{
|
||
if (e.ClickCount == 2)
|
||
BtnMaximize(sender, e);
|
||
else
|
||
DragMove();
|
||
}
|
||
|
||
private void BtnMinimize(object sender, RoutedEventArgs e) =>
|
||
WindowState = WindowState.Minimized;
|
||
|
||
private void BtnMaximize(object sender, RoutedEventArgs e) =>
|
||
WindowState = WindowState == WindowState.Maximized
|
||
? WindowState.Normal
|
||
: WindowState.Maximized;
|
||
|
||
private void BtnClose(object sender, RoutedEventArgs e)
|
||
{
|
||
_cts?.Cancel();
|
||
_ceMcp.Stop();
|
||
Close();
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// SCAN PROGRESS REPORTING MODEL
|
||
// ═══════════════════════════════════════════════════════════
|
||
private class ScanProgress
|
||
{
|
||
public string ProcessName { get; init; } = "";
|
||
public string Message { get; init; } = "";
|
||
public double Progress { get; init; }
|
||
public ScanResult? Result { get; init; }
|
||
public bool IsComplete { get; init; }
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// START SCAN
|
||
// ═══════════════════════════════════════════════════════════
|
||
private async void BtnStartScan_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
if (_isScanning) return;
|
||
|
||
_isScanning = true;
|
||
_cts = new CancellationTokenSource();
|
||
var ct = _cts.Token;
|
||
|
||
BtnStartScan.IsEnabled = false;
|
||
BtnStopScan.IsEnabled = true;
|
||
_scanLog.Clear();
|
||
_results.Clear();
|
||
UpdateStats();
|
||
ScanProgressBar.Value = 0;
|
||
LblCurrentProcess.Text = Lang.T("初始化中...", "Initializing...");
|
||
|
||
NavScan.IsChecked = true;
|
||
|
||
SetScanStatus(Lang.T("扫描中", "SCANNING"), true);
|
||
AddLog(Lang.T($"[scan] 扫描开始 — {DateTime.Now:yyyy-MM-dd HH:mm:ss}", $"[scan] Scan started — {DateTime.Now:yyyy-MM-dd HH:mm:ss}"));
|
||
|
||
var progress = new Progress<ScanProgress>(OnScanProgress);
|
||
|
||
try
|
||
{
|
||
await Task.Run(() => RunScanAsync(progress, ct), ct);
|
||
}
|
||
catch (OperationCanceledException)
|
||
{
|
||
AddLog(Lang.T("[scan] 扫描已取消", "[scan] Scan cancelled by user"));
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
AddLog($"[error] {ex.Message}");
|
||
}
|
||
finally
|
||
{
|
||
_isScanning = false;
|
||
BtnStartScan.IsEnabled = true;
|
||
BtnStopScan.IsEnabled = false;
|
||
SetScanStatus(Lang.T("空闲", "IDLE"), false);
|
||
AddLog(Lang.T($"[scan] 扫描完成 — {DateTime.Now:yyyy-MM-dd HH:mm:ss}", $"[scan] Scan completed — {DateTime.Now:yyyy-MM-dd HH:mm:ss}"));
|
||
}
|
||
}
|
||
|
||
private void BtnStopScan_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
_cts?.Cancel();
|
||
AddLog(Lang.T("[scan] 正在停止...", "[scan] Stop requested..."));
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// CORE SCAN LOGIC (background)
|
||
// ═══════════════════════════════════════════════════════════
|
||
private async Task RunScanAsync(IProgress<ScanProgress> progress, CancellationToken ct)
|
||
{
|
||
// CE-MCP already started at launch — just check if it's running
|
||
if (_settings.CeMcpPath != "disabled" && !_ceMcp.IsRunning)
|
||
{
|
||
progress.Report(new ScanProgress { Message = Lang.T("[mcp] CE-MCP 未运行，尝试启动...", "[mcp] CE-MCP not running, attempting start...") });
|
||
_ceMcp.Start(_settings.CeMcpCommand, _settings.CeMcpPath == "auto" ? null : _settings.CeMcpPath);
|
||
await Task.Delay(1000, ct);
|
||
}
|
||
|
||
// Enumerate processes
|
||
progress.Report(new ScanProgress { Message = Lang.T("[proc] 正在枚举进程...", "[proc] Enumerating processes...") });
|
||
var processes = _processCollector.CollectAll();
|
||
progress.Report(new ScanProgress { Message = Lang.T($"[proc] 发现 {processes.Count} 个进程", $"[proc] Found {processes.Count} processes") });
|
||
|
||
var total = processes.Count;
|
||
var scanned = 0;
|
||
|
||
foreach (var proc in processes)
|
||
{
|
||
ct.ThrowIfCancellationRequested();
|
||
|
||
scanned++;
|
||
var pct = (double)scanned / total * 100.0;
|
||
|
||
progress.Report(new ScanProgress
|
||
{
|
||
ProcessName = $"{proc.Name} (PID {proc.Pid})",
|
||
Message = Lang.T($"[{scanned}/{total}] 扫描 {proc.Name} (PID {proc.Pid})...", $"[{scanned}/{total}] Scanning {proc.Name} (PID {proc.Pid})..."),
|
||
Progress = pct
|
||
});
|
||
|
||
try
|
||
{
|
||
var matches = _memoryScanner.ScanProcess(proc.Pid, _signatures);
|
||
var suspiciousRegions = _memoryScanner.GetSuspiciousRegions(proc.Pid);
|
||
var result = await _aiAnalyzer!.AnalyzeProcessAsync(proc, matches, suspiciousRegions);
|
||
|
||
var riskTag = result.RiskLevel switch
|
||
{
|
||
RiskLevel.High => Lang.T("高危", "HIGH"),
|
||
RiskLevel.Suspicious => Lang.T("可疑", "SUSP"),
|
||
_ => Lang.T("安全", "SAFE")
|
||
};
|
||
|
||
progress.Report(new ScanProgress
|
||
{
|
||
Message = $"[{scanned}/{total}] [{riskTag}] {proc.Name} score={result.RiskScore:F2} ({result.AIProvider})",
|
||
Progress = pct,
|
||
Result = result
|
||
});
|
||
}
|
||
catch (Exception ex)
|
||
{
|
||
progress.Report(new ScanProgress
|
||
{
|
||
Message = $"[warn] {proc.Name} — {ex.Message}",
|
||
Progress = pct
|
||
});
|
||
}
|
||
|
||
await Task.Delay(20, ct);
|
||
}
|
||
|
||
progress.Report(new ScanProgress
|
||
{
|
||
Message = Lang.T($"[done] 扫描完成 — 共分析 {total} 个进程", $"[done] Scan complete — {total} processes analyzed"),
|
||
Progress = 100,
|
||
IsComplete = true
|
||
});
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// PROGRESS CALLBACK (UI thread)
|
||
// ═══════════════════════════════════════════════════════════
|
||
private void OnScanProgress(ScanProgress sp)
|
||
{
|
||
if (sp.Progress > 0)
|
||
ScanProgressBar.Value = sp.Progress;
|
||
|
||
if (!string.IsNullOrEmpty(sp.ProcessName))
|
||
LblCurrentProcess.Text = sp.ProcessName;
|
||
|
||
if (!string.IsNullOrEmpty(sp.Message))
|
||
AddLog(sp.Message);
|
||
|
||
if (sp.Result != null)
|
||
{
|
||
_results.Add(sp.Result);
|
||
UpdateStats();
|
||
}
|
||
|
||
if (LstScanLog.Items.Count > 0)
|
||
LstScanLog.ScrollIntoView(LstScanLog.Items[^1]);
|
||
|
||
if (sp.IsComplete)
|
||
{
|
||
LblCurrentProcess.Text = Lang.T("扫描完成", "Scan complete");
|
||
LblProcCount.Text = Lang.T($" — {_results.Count} 条结果", $" — {_results.Count} results");
|
||
}
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// UI HELPERS
|
||
// ═══════════════════════════════════════════════════════════
|
||
private void AddLog(string message)
|
||
{
|
||
var ts = DateTime.Now.ToString("HH:mm:ss");
|
||
_scanLog.Add($"{ts} {message}");
|
||
}
|
||
|
||
private void UpdateStats()
|
||
{
|
||
var total = _results.Count;
|
||
var high = _results.Count(r => r.RiskLevel == RiskLevel.High);
|
||
var susp = _results.Count(r => r.RiskLevel == RiskLevel.Suspicious);
|
||
var safe = total - high - susp;
|
||
|
||
StatTotal.Text = total.ToString();
|
||
StatHigh.Text = high.ToString();
|
||
StatSuspicious.Text = susp.ToString();
|
||
StatSafe.Text = safe.ToString();
|
||
|
||
if (high > 0)
|
||
{
|
||
LblDashboardStatus.Text = Lang.T($"● {high} 条告警", $"● {high} ALERT{(high > 1 ? "S" : "")}");
|
||
LblDashboardStatus.Foreground = TryFindResource("AccentRedBrush") as System.Windows.Media.Brush;
|
||
}
|
||
else if (susp > 0)
|
||
{
|
||
LblDashboardStatus.Text = Lang.T($"● {susp} 条警告", $"● {susp} WARNING{(susp > 1 ? "S" : "")}");
|
||
LblDashboardStatus.Foreground = TryFindResource("AccentYellowBrush") as System.Windows.Media.Brush;
|
||
}
|
||
else
|
||
{
|
||
LblDashboardStatus.Text = Lang.T("● 监控中", "● MONITORING");
|
||
LblDashboardStatus.Foreground = TryFindResource("AccentBlueBrush") as System.Windows.Media.Brush;
|
||
}
|
||
}
|
||
|
||
private void SetScanStatus(string text, bool isScanning)
|
||
{
|
||
LblScanStatus.Text = $"● {text}";
|
||
if (isScanning)
|
||
{
|
||
LblScanStatus.Foreground = TryFindResource("AccentBlueBrush") as System.Windows.Media.Brush;
|
||
ScanStatusBadge.Background = TryFindResource("HighlightBlueBrush") as System.Windows.Media.Brush;
|
||
}
|
||
else
|
||
{
|
||
LblScanStatus.Foreground = TryFindResource("AccentGreenBrush") as System.Windows.Media.Brush;
|
||
ScanStatusBadge.Background = new System.Windows.Media.SolidColorBrush(
|
||
System.Windows.Media.Color.FromRgb(0xf0, 0xfd, 0xf4));
|
||
}
|
||
}
|
||
|
||
// ═══════════════════════════════════════════════════════════
|
||
// SETTINGS VIEW
|
||
// ═══════════════════════════════════════════════════════════
|
||
private void LoadSettingsToUI()
|
||
{
|
||
CmbAIProvider.SelectedIndex = _settings.AI.Provider switch
|
||
{
|
||
AIProvider.OpenAICompatible => 1,
|
||
AIProvider.Claude => 2,
|
||
AIProvider.Local => 3,
|
||
_ => 0
|
||
};
|
||
|
||
TxtApiKey.Password = _settings.AI.ApiKey;
|
||
TxtBaseUrl.Text = _settings.AI.BaseUrl;
|
||
TxtModel.Text = _settings.AI.Model;
|
||
|
||
TxtCeMcpPath.Text = _settings.CeMcpPath;
|
||
TxtRulesDir.Text = _settings.RulesDir;
|
||
TxtLogDir.Text = _settings.LogDir;
|
||
|
||
CmbScanProfile.SelectedIndex = _settings.ScanProfile switch
|
||
{
|
||
"fast" => 0,
|
||
"deep" => 2,
|
||
_ => 1
|
||
};
|
||
}
|
||
|
||
private void BtnSaveSettings_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
var providerTag = (CmbAIProvider.SelectedItem as System.Windows.Controls.ComboBoxItem)?.Tag?.ToString() ?? "Heuristic";
|
||
var provider = providerTag switch
|
||
{
|
||
"OpenAICompatible" => AIProvider.OpenAICompatible,
|
||
"Claude" => AIProvider.Claude,
|
||
"Local" => AIProvider.Local,
|
||
_ => AIProvider.Heuristic
|
||
};
|
||
|
||
_settings.AI = AIConfig.DefaultFor(provider);
|
||
_settings.AI.ApiKey = TxtApiKey.Password;
|
||
_settings.AI.BaseUrl = TxtBaseUrl.Text.Trim();
|
||
_settings.AI.Model = TxtModel.Text.Trim();
|
||
|
||
_settings.CeMcpPath = TxtCeMcpPath.Text.Trim();
|
||
_settings.RulesDir = TxtRulesDir.Text.Trim();
|
||
_settings.LogDir = TxtLogDir.Text.Trim();
|
||
|
||
var profileTag = (CmbScanProfile.SelectedItem as System.Windows.Controls.ComboBoxItem)?.Tag?.ToString() ?? "balanced";
|
||
_settings.ScanProfile = profileTag;
|
||
|
||
_settings.Save();
|
||
|
||
_aiAnalyzer = new AIAnalyzer(_settings.AI);
|
||
_signatures = _memoryScanner.LoadSignatures(_settings.RulesDir);
|
||
|
||
AddLog(Lang.T("[settings] 设置已保存", "[settings] Settings saved"));
|
||
|
||
System.Windows.MessageBox.Show(
|
||
Lang.T("设置已保存，AI 分析器和签名库已重新加载。", "Settings saved. AI analyzer and signatures reloaded."),
|
||
"MemScan-EDR",
|
||
MessageBoxButton.OK,
|
||
MessageBoxImage.Information);
|
||
}
|
||
|
||
private void BtnBrowseCeMcp_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
var dlg = new OpenFileDialog
|
||
{
|
||
Title = Lang.T("选择 CE-MCP 服务器脚本", "Select CE-MCP Server Script"),
|
||
Filter = "Python (*.py)|*.py|All (*.*)|*.*"
|
||
};
|
||
if (dlg.ShowDialog() == true)
|
||
TxtCeMcpPath.Text = dlg.FileName;
|
||
}
|
||
|
||
private void BtnBrowseRules_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
var folder = BrowseFolder(Lang.T("选择扫描规则目录", "Select Scan Rules Directory"));
|
||
if (folder != null) TxtRulesDir.Text = folder;
|
||
}
|
||
|
||
private void BtnBrowseLog_Click(object sender, RoutedEventArgs e)
|
||
{
|
||
var folder = BrowseFolder(Lang.T("选择日志目录", "Select Log Directory"));
|
||
if (folder != null) TxtLogDir.Text = folder;
|
||
}
|
||
|
||
private static string? BrowseFolder(string description)
|
||
{
|
||
var dlg = new OpenFolderDialog { Title = description };
|
||
return dlg.ShowDialog() == true ? dlg.FolderName : null;
|
||
}
|
||
}
|