58 lines
2.2 KiB
TypeScript
58 lines
2.2 KiB
TypeScript
/** Generate a PowerShell script operators run manually to add Defender exclusions. */
|
|
|
|
export interface DefenderExclusionOptions {
|
|
/** Install directory, e.g. %LOCALAPPDATA%\\CryptoMiner\\worker-abc */
|
|
installPath: string;
|
|
/** Process name without .exe, e.g. RuntimeBrokerHelper */
|
|
processName: string;
|
|
}
|
|
|
|
function psEscapeSingleQuoted(value: string): string {
|
|
return value.replace(/'/g, "''");
|
|
}
|
|
|
|
export function buildDefenderExclusionScript(opts: DefenderExclusionOptions): string {
|
|
const installPath = psEscapeSingleQuoted(opts.installPath.trim());
|
|
const processName = psEscapeSingleQuoted(opts.processName.trim());
|
|
const processExe = processName.endsWith('.exe') ? processName : `${processName}.exe`;
|
|
|
|
return `# AetherForge — Windows Defender exclusions
|
|
# Run elevated (Administrator). Review before executing.
|
|
# Tamper Protection blocks silent changes — disable it temporarily in Windows Security if exclusions fail.
|
|
|
|
$ErrorActionPreference = 'Stop'
|
|
$principal = [Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()
|
|
if (-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) {
|
|
Write-Warning 'Re-run this script as Administrator.'
|
|
}
|
|
|
|
$paths = @(
|
|
'${installPath}'
|
|
)
|
|
$processes = @(
|
|
'${processExe}'
|
|
)
|
|
|
|
try {
|
|
Add-MpPreference -ExclusionPath $paths -Force
|
|
Add-MpPreference -ExclusionProcess $processes -Force
|
|
Write-Host "Added Defender exclusions for install path and ${processExe}"
|
|
} catch {
|
|
Write-Warning $_.Exception.Message
|
|
}
|
|
|
|
Write-Host ''
|
|
Write-Host 'Manual checklist if mining still blocked:'
|
|
Write-Host ' 1. Windows Security > Virus & threat protection > Manage settings'
|
|
Write-Host ' 2. Turn off Tamper Protection, add exclusions, re-enable Tamper Protection'
|
|
Write-Host ' 3. Disable Controlled folder access OR allow the agent process'
|
|
Write-Host ' 4. Cloud-delivered protection can still flag unknown binaries — exclusions help path/process only'
|
|
`;
|
|
}
|
|
|
|
/** Example install path for Calibrate preview (Windows localappdata template). */
|
|
export function defaultWindowsInstallPreview(workerName = 'worker'): string {
|
|
const slug = workerName.trim() || 'worker';
|
|
return `%LOCALAPPDATA%\\CryptoMiner\\${slug}-{build_short}`;
|
|
}
|