Jimmy-Hu · Jimmy-Hu · Dec 23, 2020 · Dec 22, 2020
diff --git a/ports/mmloader/CONTROL b/ports/mmloader/CONTROL
diff --git a/ports/mmloader/fix_c_and_cxx_flags.patch b/ports/mmloader/fix_c_and_cxx_flags.patch
@@ -0,0 +1,32 @@
+diff --git a/CMakeLists.txt b/CMakeLists.txt
+index 7a22b56..2ce1bd8 100644
+--- a/CMakeLists.txt
++++ b/CMakeLists.txt
+@@ -47,24 +47,11 @@ set(CMAKE_CXX_STANDARD 11)
+ set(CMAKE_CONFIGURATION_TYPES Debug Release)
+
+ # Default compile flags
+-set(CMAKE_CXX_FLAGS 
+-    "/DWIN32 /D_WINDOWS /W3 /WX /GR /GS- /Gy /FAcs /Z7 /DEBUG"
++set(CMAKE_CXX_FLAGS "${CMAKE_CXX_FLAGS} /GS-"
+     CACHE STRING "default C++ compile flags" FORCE)
+-set(CMAKE_CXX_FLAGS_DEBUG 
+-    "/MTd /Ob0 /Od" 
+-    CACHE STRING "default C++ compile flags for debug build" FORCE)
+-set(CMAKE_CXX_FLAGS_RELEASE 
+-    "/MT /O2 /Ob2 /DNDEBUG" 
+-    CACHE STRING "default C++ compile flags for release build" FORCE)
+-set(CMAKE_C_FLAGS 
+-    "/DWIN32 /D_WINDOWS /W3 /WX /GR /GS- /Gy /FAcs /Z7 /DEBUG"
++set(CMAKE_C_FLAGS
++    "${CMAKE_C_FLAGS} /GS-"
+     CACHE STRING "default C++ compile flags" FORCE)
+-set(CMAKE_C_FLAGS_DEBUG
+-    "/MTd /Ob0 /Od" 
+-    CACHE STRING "default C++ compile flags for debug build" FORCE)
+-set(CMAKE_C_FLAGS_RELEASE 
+-    "/MT /O2 /Ob2 /DNDEBUG" 
+-    CACHE STRING "default C++ compile flags for release build" FORCE)
+
+ message(STATUS "CMAKE_CXX_FLAGS=" ${CMAKE_CXX_FLAGS})
+ message(STATUS "CMAKE_CXX_FLAGS_DEBUG=" ${CMAKE_CXX_FLAGS_DEBUG})
diff --git a/ports/mmloader/portfile.cmake b/ports/mmloader/portfile.cmake
@@ -1,4 +1,3 @@
-
 # fail early for unsupported triplets
 vcpkg_fail_port_install(
     MESSAGE "mmLoader supports only x86/x64-windows-static triplets"
@@ -15,6 +14,8 @@ vcpkg_from_github(
     REF 1.0.0
     SHA512 ceb2ab4b60d74209fa46d198cde6fd87a97d911abb875ac35383288a67828d0420bb38ff8d2f17dd4a3f46ba3abf554152d1246eeb05215258e8af64ac4a39de
     HEAD_REF master
+    PATCHES
+        fix_c_and_cxx_flags.patch
 )
 
 # feature
@@ -30,13 +31,13 @@ vcpkg_configure_cmake(
 )
 
 # pre-clean
-file(REMOVE_RECURSE ${SOURCE_PATH}/output)
+file(REMOVE_RECURSE "${SOURCE_PATH}/output")
 
 # build and install
 vcpkg_install_cmake(DISABLE_PARALLEL)
 
 # remove the debug/include directory
-file(REMOVE_RECURSE ${CURRENT_PACKAGES_DIR}/debug/include)
+file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include")
 
 # collect license files
-file(INSTALL ${SOURCE_PATH}/License DESTINATION ${CURRENT_PACKAGES_DIR}/share/${PORT} RENAME copyright)
+file(INSTALL "${SOURCE_PATH}/License" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}" RENAME copyright)
diff --git a/ports/mmloader/vcpkg.json b/ports/mmloader/vcpkg.json
@@ -0,0 +1,13 @@
+{
+  "name": "mmloader",
+  "version-string": "2020-05-15",
+  "port-version": 1,
+  "description": "A library for loading dll module bypassing windows PE loader from memory (x86/x64)",
+  "homepage": "http://tishion.github.io/mmLoader/",
+  "supports": "(x86 | x64) & windows & static",
+  "features": {
+    "shellcode": {
+      "description": "Generate mmLoader shell code headers"
+    }
+  }
+}
diff --git a/ports/opentracing/CONTROL b/ports/opentracing/CONTROL
diff --git a/ports/opentracing/portfile.cmake b/ports/opentracing/portfile.cmake
@@ -1,9 +1,7 @@
-if(VCPKG_CMAKE_SYSTEM_NAME STREQUAL WindowsStore)
-    message(FATAL_ERROR "Error: UWP build is not supported.")
-endif()
+vcpkg_fail_port_install(ON_TARGET uwp)
 
 if(VCPKG_LIBRARY_LINKAGE STREQUAL "dynamic")
-    set( LOCAL_OPTIONS
+    set(LOCAL_OPTIONS
         -DBUILD_STATIC_LIBS=OFF
     )
 else()
@@ -16,13 +14,15 @@ vcpkg_from_github(
     REPO opentracing/opentracing-cpp
     REF 4bb431f7728eaf383a07e86f9754a5b67575dab0 # v1.6.0
     SHA512 1c69ff4cfd5f6037a48815367d3026c1bf06c3c49ebf232a64c43167385fb62e444c3b3224fc38f68ef0fdb378e3736db6ee6ba57160e6e578c87c09e92e527e
+    PATCHES
+        repair_mojibake.patch
 )
 
 vcpkg_configure_cmake(
-    SOURCE_PATH ${SOURCE_PATH}
+    SOURCE_PATH "${SOURCE_PATH}"
     PREFER_NINJA
     OPTIONS
-        ${OPTIONS}
+        -DENABLE_LINTING=OFF
         ${LOCAL_OPTIONS}
 )
 
@@ -54,7 +54,7 @@ if(VCPKG_CMAKE_SYSTEM_NAME STREQUAL "WindowsStore" OR NOT VCPKG_CMAKE_SYSTEM_NAM
 endif()
 
 # Handle copyright
-file(INSTALL ${SOURCE_PATH}/LICENSE DESTINATION ${CURRENT_PACKAGES_DIR}/share/opentracing RENAME copyright)
+file(INSTALL "${SOURCE_PATH}/LICENSE" DESTINATION "${CURRENT_PACKAGES_DIR}/share/${PORT}" RENAME copyright)
 
 # Remove duplicate headers
-file(REMOVE_RECURSE ${CURRENT_PACKAGES_DIR}/debug/include)
+file(REMOVE_RECURSE "${CURRENT_PACKAGES_DIR}/debug/include")
diff --git a/ports/opentracing/repair_mojibake.patch b/ports/opentracing/repair_mojibake.patch
@@ -0,0 +1,59 @@
+From 31c92781ac953cb83963cfe5ac30324579fa7b2d Mon Sep 17 00:00:00 2001
+From: Billy Robert O'Neal III <bion@microsoft.com>
+Date: Fri, 18 Dec 2020 10:07:02 -0800
+Subject: [PATCH] Repair mojibake in expected.hpp
+
+The affected characters herein triggered warnings
+C:\Dev\vcpkg\buildtrees\opentracing\src\b67575dab0-0250653c81.clean\3rd_party\include\opentracing/expected/expected.hpp(1): warning C4828: The file contains a character starting at offset 0x4a77 that is illegal in the current source character set (codepage 65001).
+---
+ 3rd_party/include/opentracing/expected/expected.hpp | 12 ++++++------
+ 1 file changed, 6 insertions(+), 6 deletions(-)
+
+diff --git a/3rd_party/include/opentracing/expected/expected.hpp b/3rd_party/include/opentracing/expected/expected.hpp
+index 8283a77..0d21d43 100644
+--- a/3rd_party/include/opentracing/expected/expected.hpp
++++ b/3rd_party/include/opentracing/expected/expected.hpp
+@@ -778,13 +778,13 @@ class expected
+ //  expected<decltype(func(declval<T>())),E> map(F&& func) ;
+
+ //  template <typename F>
+-//  �see below� bind(F&& func);
++//  'see below' bind(F&& func);
+
+ //  template <typename F>
+ //  expected<T,E> catch_error(F&& f);
+
+ //  template <typename F>
+-//  �see below� then(F&& func);
++//  'see below' then(F&& func);
+
+ private:
+     bool has_value_;
+@@ -955,9 +955,9 @@ class expected<void, E>
+         return ! has_value() && std::is_base_of< Ex, decltype( get_unexpected().value() ) >::value;
+     }
+
+-//  template constexpr �see below� unwrap() const&;
++//  template constexpr 'see below' unwrap() const&;
+ //
+-//  template �see below� unwrap() &&;
++//  template 'see below' unwrap() &&;
+
+     // factories
+
+@@ -968,13 +968,13 @@ class expected<void, E>
+ //  expected<decltype(func()), E> map(F&& func) ;
+ //
+ //  template <typename F>
+-//  �see below� bind(F&& func) ;
++//  'see below' bind(F&& func) ;
+ //
+ //  template <typename F>
+ //  expected<void,E> catch_error(F&& f);
+ //
+ //  template <typename F>
+-//  �see below� then(F&& func);
++//  'see below' then(F&& func);
+
+ private:
+     bool has_value_;
diff --git a/ports/opentracing/vcpkg.json b/ports/opentracing/vcpkg.json
@@ -0,0 +1,8 @@
+{
+  "name": "opentracing",
+  "version-string": "1.6.0",
+  "port-version": 1,
+  "description": "C++ implementation of the OpenTracing API",
+  "homepage": "https://opentracing.io",
+  "supports": "!uwp"
+}
diff --git a/scripts/azure-pipelines/azure-pipelines.yml b/scripts/azure-pipelines/azure-pipelines.yml
@@ -2,8 +2,8 @@
 # SPDX-License-Identifier: MIT
 #
 variables:
-  windows-pool: 'PrWin-2020-08-12'
-  linux-pool: 'PrLin-2020-08-12'
+  windows-pool: 'PrWin-2020-12-17'
+  linux-pool: 'PrLin-2020-12-16'
   osx-pool: 'PrOsx-2020-09-28'
 
 stages:

diff --git a/scripts/azure-pipelines/linux/azure-pipelines.yml b/scripts/azure-pipelines/linux/azure-pipelines.yml
@@ -41,7 +41,7 @@ jobs:
     inputs:
       failOnStderr: true
       filePath: 'scripts/azure-pipelines/test-modified-ports.ps1'
-      arguments: '-Triplet x64-linux -BuildReason $(Build.Reason) -ArchivesRoot /archives -WorkingRoot ${{ variables.WORKING_ROOT }} -ArtifactStagingDirectory $(Build.ArtifactStagingDirectory)'
+      arguments: '-Triplet x64-linux -BuildReason $(Build.Reason) -UseEnvironmentSasToken -WorkingRoot ${{ variables.WORKING_ROOT }} -ArtifactStagingDirectory $(Build.ArtifactStagingDirectory)'
   - bash: |
       df -h
     displayName: 'Report on Disk Space After Build'

diff --git a/scripts/azure-pipelines/linux/create-vmss.ps1 b/scripts/azure-pipelines/linux/create-vmss.ps1
@@ -64,7 +64,9 @@ Write-Progress `
   -Status 'Creating virtual network' `
   -PercentComplete (100 / $TotalProgress * $CurrentProgress++)
 
-$allowHttp = New-AzNetworkSecurityRuleConfig `
+$allFirewallRules = @()
+
+$allFirewallRules += New-AzNetworkSecurityRuleConfig `
   -Name AllowHTTP `
   -Description 'Allow HTTP(S)' `
   -Access Allow `
@@ -76,49 +78,49 @@ $allowHttp = New-AzNetworkSecurityRuleConfig `
   -DestinationAddressPrefix * `
   -DestinationPortRange @(80, 443)
 
-$allowDns = New-AzNetworkSecurityRuleConfig `
+$allFirewallRules += New-AzNetworkSecurityRuleConfig `
+  -Name AllowSFTP `
+  -Description 'Allow (S)FTP' `
+  -Access Allow `
+  -Protocol Tcp `
+  -Direction Outbound `
+  -Priority 1009 `
+  -SourceAddressPrefix * `
+  -SourcePortRange * `
+  -DestinationAddressPrefix * `
+  -DestinationPortRange @(21, 22)
+
+$allFirewallRules += New-AzNetworkSecurityRuleConfig `
   -Name AllowDNS `
   -Description 'Allow DNS' `
   -Access Allow `
   -Protocol * `
   -Direction Outbound `
-  -Priority 1009 `
+  -Priority 1010 `
   -SourceAddressPrefix * `
   -SourcePortRange * `
   -DestinationAddressPrefix * `
   -DestinationPortRange 53
 
-$allowGit = New-AzNetworkSecurityRuleConfig `
+$allFirewallRules += New-AzNetworkSecurityRuleConfig `
   -Name AllowGit `
   -Description 'Allow git' `
   -Access Allow `
   -Protocol Tcp `
   -Direction Outbound `
-  -Priority 1010 `
+  -Priority 1011 `
   -SourceAddressPrefix * `
   -SourcePortRange * `
   -DestinationAddressPrefix * `
   -DestinationPortRange 9418
 
-$allowStorage = New-AzNetworkSecurityRuleConfig `
-  -Name AllowStorage `
-  -Description 'Allow Storage' `
-  -Access Allow `
-  -Protocol * `
-  -Direction Outbound `
-  -Priority 1011 `
-  -SourceAddressPrefix VirtualNetwork `
-  -SourcePortRange * `
-  -DestinationAddressPrefix Storage `
-  -DestinationPortRange *
-
-$denyEverythingElse = New-AzNetworkSecurityRuleConfig `
+$allFirewallRules += New-AzNetworkSecurityRuleConfig `
   -Name DenyElse `
   -Description 'Deny everything else' `
   -Access Deny `
   -Protocol * `
   -Direction Outbound `
-  -Priority 1012 `
+  -Priority 1013 `
   -SourceAddressPrefix * `
   -SourcePortRange * `
   -DestinationAddressPrefix * `
@@ -129,13 +131,14 @@ $NetworkSecurityGroup = New-AzNetworkSecurityGroup `
   -Name $NetworkSecurityGroupName `
   -ResourceGroupName $ResourceGroupName `
   -Location $Location `
-  -SecurityRules @($allowHttp, $allowDns, $allowGit, $allowStorage, $denyEverythingElse)
+  -SecurityRules $allFirewallRules
 
 $SubnetName = $ResourceGroupName + 'Subnet'
 $Subnet = New-AzVirtualNetworkSubnetConfig `
   -Name $SubnetName `
   -AddressPrefix "10.0.0.0/16" `
-  -NetworkSecurityGroup $NetworkSecurityGroup
+  -NetworkSecurityGroup $NetworkSecurityGroup `
+  -ServiceEndpoint "Microsoft.Storage"
 
 $VirtualNetworkName = $ResourceGroupName + 'Network'
 $VirtualNetwork = New-AzVirtualNetwork `
@@ -170,8 +173,31 @@ $StorageContext = New-AzStorageContext `
   -StorageAccountName $StorageAccountName `
   -StorageAccountKey $StorageAccountKey
 
-New-AzStorageShare -Name 'archives' -Context $StorageContext
-Set-AzStorageShareQuota -ShareName 'archives' -Context $StorageContext -Quota 1024
+New-AzStorageContainer -Name archives -Context $StorageContext -Permission Off
+$StartTime = [DateTime]::Now
+$ExpiryTime = $StartTime.AddMonths(6)
+
+$SasToken = New-AzStorageAccountSASToken `
+  -Service Blob `
+  -Permission "racwdlup" `
+  -Context $StorageContext `
+  -StartTime $StartTime `
+  -ExpiryTime $ExpiryTime `
+  -ResourceType Service,Container,Object `
+  -Protocol HttpsOnly
+
+$SasToken = $SasToken.Substring(1) # strip leading ?
+
+# Note that we put the storage account into the firewall after creating the above SAS token or we
+# would be denied since the person running this script isn't one of the VMs we're creating here.
+Set-AzStorageAccount `
+  -ResourceGroupName $ResourceGroupName `
+  -AccountName $StorageAccountName `
+  -NetworkRuleSet ( `
+    @{bypass="AzureServices"; `
+    virtualNetworkRules=( `
+      @{VirtualNetworkResourceId=$VirtualNetwork.Subnets[0].Id;Action="allow"}); `
+    defaultAction="Deny"})
 
 ####################################################################################################
 Write-Progress `
@@ -220,15 +246,23 @@ Write-Progress `
   -Status 'Running provisioning script provision-image.sh in VM' `
   -PercentComplete (100 / $TotalProgress * $CurrentProgress++)
 
-$ProvisionImageResult = Invoke-AzVMRunCommand `
-  -ResourceGroupName $ResourceGroupName `
-  -VMName $ProtoVMName `
-  -CommandId 'RunShellScript' `
-  -ScriptPath "$PSScriptRoot\provision-image.sh" `
-  -Parameter @{StorageAccountName=$StorageAccountName; `
-    StorageAccountKey=$StorageAccountKey;}
-
-Write-Host "provision-image.sh output: $($ProvisionImageResult.value.Message)"
+$tempScript = [System.IO.Path]::GetTempPath() + [System.IO.Path]::GetRandomFileName() + ".sh"
+try {
+  $script = Get-Content "$PSScriptRoot\provision-image.sh" -Encoding utf8NoBOM
+  $script += "echo `"PROVISIONED_AZURE_STORAGE_NAME=\`"$StorageAccountName\`"`" | sudo tee -a /etc/environment"
+  $script += "echo `"PROVISIONED_AZURE_STORAGE_SAS_TOKEN=\`"$SasToken\`"`" | sudo tee -a /etc/environment"
+  Set-Content -Path $tempScript -Value $script -Encoding utf8NoBOM
+
+  $ProvisionImageResult = Invoke-AzVMRunCommand `
+    -ResourceGroupName $ResourceGroupName `
+    -VMName $ProtoVMName `
+    -CommandId 'RunShellScript' `
+    -ScriptPath $tempScript
+
+  Write-Host "provision-image.sh output: $($ProvisionImageResult.value.Message)"
+} finally {
+  Remove-Item $tempScript -Recurse -Force
+}
 
 ####################################################################################################
 Write-Progress `