Commits

Billy O'Neal committed b1320ee

Something went wrong with that commit....

  • Participants
  • Parent commits 4220084

Comments (0)

Files changed (76)

+syntax: glob
+pevFind/Debug/*
+pevLib/Debug/*
+*.user
+Boost Software License - Version 1.0 - August 17th, 2003
+
+Permission is hereby granted, free of charge, to any person or organization
+obtaining a copy of the software and accompanying documentation covered by
+this license (the "Software") to use, reproduce, display, distribute,
+execute, and transmit the Software, and to prepare derivative works of the
+Software, and to permit third-parties to whom the Software is furnished to
+do so, all subject to the following:
+
+The copyright notices in the Software and this entire statement, including
+the above license grant, this restriction and the following disclaimer,
+must be included in all copies of the Software, in whole or in part, and
+all derivative works of the Software, unless such copies or derivative
+works are solely in the form of machine-executable object code generated by
+a source language processor.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE, TITLE AND NON-INFRINGEMENT. IN NO EVENT
+SHALL THE COPYRIGHT HOLDERS OR ANYONE DISTRIBUTING THE SOFTWARE BE LIABLE
+FOR ANY DAMAGES OR OTHER LIABILITY, WHETHER IN CONTRACT, TORT OR OTHERWISE,
+ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER
+DEALINGS IN THE SOFTWARE.
+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// pevFind.cpp -- Defines the main entry point for the executable. Bootstraps
+// associated subprograms.
+
+#include <iostream>
+#include <fstream>
+#include <boost/algorithm/string/predicate.hpp>
+#include <boost/algorithm/string/trim.hpp>
+#include <boost/scoped_array.hpp>
+#include "processManager.h"
+#include "utility.h"
+
+//Subprogram definitions
+#include "clsidCompressor.h"
+#include "procListers.h"
+#include "exec.h"
+#include "vFind.h"
+#include "link.h"
+#include "volumeEnumerate.h"
+#include "uZip.h"
+#include "times.h"
+#include "regImport.h"
+#include "rexport.h"
+#include "moveex.h"
+#include "serviceControl.h"
+#include "dosdev.h"
+#include "linkResolve.h"
+
+int __cdecl wmain(int argc, wchar_t* argv[])
+{
+	using namespace boost::algorithm;
+	int subArgC;
+	boost::scoped_array<wchar_t *> subArgV;
+	try {
+	if (argc < 2) throw std::runtime_error("Invalid number of arguments."); //We always require at least one option.
+	
+	if (iequals(argv[1], L"vfind")) //vFind is the default, and therefore we don't need to bother reallocating
+		return vFind::main(); //It's argument pointers and such.
+	
+	subArgC = argc - 1; //Remove subprogram option, and regenerate our list, with the subprogram selected removed.
+	subArgV.reset(new wchar_t * [subArgC]);
+	subArgV[0] = argv[0];
+	memcpy(subArgV.get() + 1, argv + 2, (subArgC - 1) * sizeof(wchar_t *));
+	
+	//When we use a single iterator_range for all the following comparisons, strlen is called much less often.
+	boost::iterator_range<wchar_t *> firstArgument(argv[1], argv[1] + wcslen(argv[1]));
+	
+	if      (iequals(firstArgument, L"CLSID"))
+		return clsidCompressor::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"EXEC"))
+		return exec::main();
+	else if (iequals(firstArgument, L"PLIST"))
+		return plist::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"CLIST"))
+		return clist::main();
+	else if (iequals(firstArgument, L"LINK"))
+		return link::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"VOLUME"))
+		return volumeEnumerate::main();
+	else if (iequals(firstArgument, L"UZIP"))
+		return uZip::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"TIME"))
+		return times::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"RIMPORT"))
+		return regImport::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"MOVEEX"))
+		return moveex::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"SC"))
+		return serviceControl::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"DDEV"))
+		return dosdev::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"LINKRESOLVE"))
+		return linkResolve::main(subArgC, subArgV.get());
+	else if (iequals(firstArgument, L"REXPORT"))
+		return rexport::main(subArgC, subArgV.get());
+	return vFind::main();
+	}
+#ifdef NDEBUG
+	catch(...)
+	{
+std::cerr << 
+"                         _____ _           _ \n"
+"        _ __   _____   _|  ___(_)_ __   __| |\n"
+"       | '_ \\ / _ \\ \\ / / |_  | | '_ \\ / _` |\n"
+"       | |_) |  __/\\ V /|  _| | | | | | (_| |\n"
+"       | .__/ \\___| \\_/ |_|   |_|_| |_|\\__,_|\n"
+"       |_|    by Billy Robert O'Neal III\n"
+"                      Version 1.5.5\n"
+"  Distributed under the Boost Software License, Version 1.0.\n"
+"         http://www.boost.org/LICENSE_1_0.txt\n"
+"pevFind contains some code from Info-ZIP, used with permission.\n"
+"  In accordance with Info-ZIP's License, it can be found at\n"
+"           http://billy-oneal.com/infozip.txt\n"
+"            Filename regular expressions library is\n"
+" Copyright (C)1997-1998 by David R. Tribble, all rights reserved.\n\n";
+	}
+#else
+	catch (std::exception& except)
+	{
+		std::cerr << except.what();
+	}
+#endif
+}

pevFind/pevFind.vcxproj

+<?xml version="1.0" encoding="utf-8"?>
+<Project DefaultTargets="Build" ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup Label="ProjectConfigurations">
+    <ProjectConfiguration Include="Debug|Win32">
+      <Configuration>Debug</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Debug|x64">
+      <Configuration>Debug</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|Win32">
+      <Configuration>Release</Configuration>
+      <Platform>Win32</Platform>
+    </ProjectConfiguration>
+    <ProjectConfiguration Include="Release|x64">
+      <Configuration>Release</Configuration>
+      <Platform>x64</Platform>
+    </ProjectConfiguration>
+  </ItemGroup>
+  <PropertyGroup Label="Globals">
+    <ProjectGuid>{65CF3E7A-9793-44C9-A1B7-735AA0C91F89}</ProjectGuid>
+    <RootNamespace>pevFind</RootNamespace>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <CharacterSet>Unicode</CharacterSet>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <PlatformToolset>v90</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v90</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <CharacterSet>Unicode</CharacterSet>
+    <WholeProgramOptimization>true</WholeProgramOptimization>
+    <PlatformToolset>v90</PlatformToolset>
+  </PropertyGroup>
+  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
+    <ConfigurationType>Application</ConfigurationType>
+    <CharacterSet>Unicode</CharacterSet>
+    <PlatformToolset>v90</PlatformToolset>
+  </PropertyGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
+  <ImportGroup Label="ExtensionSettings">
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <ImportGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="PropertySheets">
+    <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
+  </ImportGroup>
+  <PropertyGroup Label="UserMacros" />
+  <PropertyGroup>
+    <_ProjectFileVersion>10.0.30319.1</_ProjectFileVersion>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(SolutionDir)$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">$(Configuration)\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(SolutionDir)$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">$(Configuration)\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">$(Platform)\$(Configuration)\</IntDir>
+    <OutDir Condition="'$(Configuration)|$(Platform)'=='Release|x64'">$(SolutionDir)$(Platform)\$(Configuration)\</OutDir>
+    <IntDir Condition="'$(Configuration)|$(Platform)'=='Release|x64'">$(Platform)\$(Configuration)\</IntDir>
+  </PropertyGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>$(SolutionDir)pevLib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;_SCL_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>EditAndContinue</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>wintrust.lib;shlwapi.lib;Sfc.lib;Version.lib;Userenv.lib;cryptlib.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+    <PreBuildEvent>
+      <Command>
+      </Command>
+    </PreBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
+    <PreBuildEvent>
+      <Command>
+      </Command>
+    </PreBuildEvent>
+    <CustomBuildStep>
+      <Command>
+      </Command>
+    </CustomBuildStep>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <AdditionalIncludeDirectories>$(SolutionDir)pevLib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;_SCL_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <RuntimeTypeInfo>false</RuntimeTypeInfo>
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>wintrust.lib;shlwapi.lib;Sfc.lib;Version.lib;Userenv.lib;cryptlib.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+      <OptimizeReferences>true</OptimizeReferences>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <TargetMachine>MachineX86</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>Disabled</Optimization>
+      <AdditionalIncludeDirectories>$(SolutionDir)pevLib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>WIN32;_DEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;_SCL_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <MinimalRebuild>true</MinimalRebuild>
+      <BasicRuntimeChecks>EnableFastChecks</BasicRuntimeChecks>
+      <RuntimeLibrary>MultiThreadedDebug</RuntimeLibrary>
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>wintrust.lib;shlwapi.lib;Sfc.lib;Version.lib;Userenv.lib;cryptlibd.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
+      <GenerateDebugInformation>true</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+    <PreBuildEvent>
+      <Command>
+      </Command>
+    </PreBuildEvent>
+  </ItemDefinitionGroup>
+  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
+    <PreBuildEvent>
+      <Command>
+      </Command>
+    </PreBuildEvent>
+    <CustomBuildStep>
+      <Command>
+      </Command>
+    </CustomBuildStep>
+    <Midl>
+      <TargetEnvironment>X64</TargetEnvironment>
+    </Midl>
+    <ClCompile>
+      <Optimization>MaxSpeed</Optimization>
+      <IntrinsicFunctions>true</IntrinsicFunctions>
+      <AdditionalIncludeDirectories>$(SolutionDir)pevLib;%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <PreprocessorDefinitions>WIN32;NDEBUG;_CONSOLE;_CRT_SECURE_NO_WARNINGS;_SCL_SECURE_NO_WARNINGS;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <RuntimeLibrary>MultiThreaded</RuntimeLibrary>
+      <FunctionLevelLinking>true</FunctionLevelLinking>
+      <RuntimeTypeInfo>false</RuntimeTypeInfo>
+      <WarningLevel>Level3</WarningLevel>
+      <DebugInformationFormat>ProgramDatabase</DebugInformationFormat>
+    </ClCompile>
+    <Link>
+      <AdditionalDependencies>wintrust.lib;shlwapi.lib;Sfc.lib;Version.lib;Userenv.lib;cryptlib.lib;%(AdditionalDependencies)</AdditionalDependencies>
+      <UACExecutionLevel>RequireAdministrator</UACExecutionLevel>
+      <GenerateDebugInformation>false</GenerateDebugInformation>
+      <SubSystem>Console</SubSystem>
+      <OptimizeReferences>true</OptimizeReferences>
+      <EnableCOMDATFolding>true</EnableCOMDATFolding>
+      <TargetMachine>MachineX64</TargetMachine>
+    </Link>
+  </ItemDefinitionGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp" />
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="targetver.h" />
+  </ItemGroup>
+  <ItemGroup>
+    <ProjectReference Include="..\pevLib\pevLib.vcxproj">
+      <Project>{534d6a08-8fad-4f8e-8529-dee323a2ecdc}</Project>
+      <ReferenceOutputAssembly>false</ReferenceOutputAssembly>
+    </ProjectReference>
+  </ItemGroup>
+  <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <ImportGroup Label="ExtensionTargets">
+  </ImportGroup>
+</Project>

pevFind/pevFind.vcxproj.filters

+<?xml version="1.0" encoding="utf-8"?>
+<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
+  <ItemGroup>
+    <Filter Include="Source Files">
+      <UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
+      <Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
+    </Filter>
+    <Filter Include="Header Files">
+      <UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
+      <Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
+    </Filter>
+  </ItemGroup>
+  <ItemGroup>
+    <ClCompile Include="main.cpp">
+      <Filter>Source Files</Filter>
+    </ClCompile>
+  </ItemGroup>
+  <ItemGroup>
+    <ClInclude Include="targetver.h">
+      <Filter>Header Files</Filter>
+    </ClInclude>
+  </ItemGroup>
+</Project>

pevFind/targetver.h

+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// Defines version for pevFind with regard to the Windows API
+
+#pragma once
+
+// The following macros define the minimum required platform.  The minimum required platform
+// is the earliest version of Windows, Internet Explorer etc. that has the necessary features to run 
+// your application.  The macros work by enabling all features available on platform versions up to and 
+// including the version specified.
+
+// Modify the following defines if you have to target a platform prior to the ones specified below.
+// Refer to MSDN for the latest info on corresponding values for different platforms.
+#ifndef _WIN32_WINNT            // Specifies that the minimum required platform is Windows 2000.
+#define _WIN32_WINNT 0x0500
+#endif
+

pevLib/FILTER.cpp

+#include <string>
+#define WIN32_LEAN_AND_MEAN
+#include <windows.h>
+#include <Shlwapi.h>
+#include <boost/lexical_cast.hpp>
+#include <boost/algorithm/string/case_conv.hpp>
+#include "filter.h"
+#include "fileData.h"
+#include "utility.h"
+
+std::wstring sizeFilter::debugTreeInternal(const std::wstring& type) const
+{
+	return std::wstring(L"+ SIZEFILTER ").append(type).append(L" ").append(boost::lexical_cast<std::wstring>(size));
+}
+unsigned __int32 sizeFilter::getPriorityClass() const
+{
+	return PRIORITY_SLOW_FILTER;
+}
+sizeFilter::sizeFilter(unsigned __int64 createdSize) : size(createdSize)
+{}
+gtSizeFilter::gtSizeFilter(unsigned __int64 createdSize) : sizeFilter(createdSize)
+{}
+BOOL gtSizeFilter::include(FileData &file) const
+{
+	return file.getSize() > size;
+}
+std::wstring gtSizeFilter::debugTree() const
+{
+	return debugTreeInternal(L"GREATERTHAN");
+}
+ltSizeFilter::ltSizeFilter(unsigned __int64 createdSize) : sizeFilter(createdSize)
+{}
+BOOL ltSizeFilter::include(FileData &file) const
+{
+	return file.getSize() < size;
+}
+std::wstring ltSizeFilter::debugTree() const
+{
+	return debugTreeInternal(L"LESSTHAN");
+}
+notSizeFilter::notSizeFilter(unsigned __int64 createdSize) : sizeFilter(createdSize)
+{}
+BOOL notSizeFilter::include(FileData &file) const
+{
+	return file.getSize() != size;
+}
+std::wstring notSizeFilter::debugTree() const
+{
+	return debugTreeInternal(L"ISNOT");
+}
+isSizeFilter::isSizeFilter(unsigned __int64 createdSize) : sizeFilter(createdSize)
+{}
+BOOL isSizeFilter::include(FileData &file) const
+{
+	return file.getSize() == size;
+}
+std::wstring isSizeFilter::debugTree() const
+{
+	return debugTreeInternal(L"EQUALS");
+}
+unsigned __int32 dateFilter::getPriorityClass() const
+{
+	return PRIORITY_SLOW_FILTER;
+}
+dateFilter::dateFilter(const FILETIME &inDate) : date(inDate)
+{}
+accessLDate::accessLDate(const FILETIME &inDate) : dateFilter(inDate)
+{}
+std::wstring accessLDate::debugTree() const
+{
+	return L"ACCESS DATEFILTER LESSTHAN " + getDateAsString(date);
+}
+BOOL accessLDate::include(FileData &file) const
+{
+	return file.getLastAccessTime() < date;
+}
+accessGDate::accessGDate(const FILETIME &inDate) : dateFilter(inDate)
+{}
+std::wstring accessGDate::debugTree() const
+{
+	return L"ACCESS DATEFILTER GREATERTHAN " + getDateAsString(date);
+}
+BOOL accessGDate::include(FileData &file) const
+{
+	return date < file.getLastAccessTime();
+}
+modifiedLDate::modifiedLDate(const FILETIME &inDate) : dateFilter(inDate)
+{}
+std::wstring modifiedLDate::debugTree() const
+{
+	return L"MOD DATEFILTER LESSTHAN " + getDateAsString(date);
+}
+BOOL modifiedLDate::include(FileData &file) const
+{
+	return file.getLastModTime() < date;
+}
+modifiedGDate::modifiedGDate(const FILETIME &inDate) : dateFilter(inDate)
+{}
+std::wstring modifiedGDate::debugTree() const
+{
+	return L"MOD DATEFILTER GREATERTHAN " + getDateAsString(date);
+}
+BOOL modifiedGDate::include(FileData &file) const
+{
+	return date < file.getLastModTime();
+}
+createdLDate::createdLDate(const FILETIME &inDate) : dateFilter(inDate)
+{}
+std::wstring createdLDate::debugTree() const
+{
+	return L"CREATED DATEFILTER LESSTHAN " + getDateAsString(date);
+}
+BOOL createdLDate::include(FileData &file) const
+{
+	return file.getCreationTime() < date;
+}
+createdGDate::createdGDate(const FILETIME &inDate) : dateFilter(inDate)
+{}
+std::wstring createdGDate::debugTree() const
+{
+	return L"CREATED DATEFILTER GREATERTHAN " + getDateAsString(date);
+}
+BOOL createdGDate::include(FileData &file) const
+{
+	return date < file.getCreationTime();
+}
+unsigned __int32 fastFilter::getPriorityClass() const
+{
+	return PRIORITY_FAST_FILTER;
+}
+BOOL isArchive::include(FileData &file) const
+{
+	return file.isArchive();
+}
+std::wstring isArchive::debugTree() const
+{
+	return std::wstring(L"+ ISARCHIVE");
+}
+BOOL isCompressed::include(FileData &file) const
+{
+	return file.isCompressed();
+}
+std::wstring isCompressed::debugTree() const
+{
+	return std::wstring(L"+ ISCOMPRESSED");
+}
+BOOL isDirectory::include(FileData &file) const
+{
+	return file.isDirectory();
+}
+std::wstring isDirectory::debugTree() const
+{
+	return std::wstring(L"+ ISDIRECTORY");
+}
+BOOL isFile::include(FileData &file) const
+{
+	return file.isFile();
+}
+std::wstring isFile::debugTree() const
+{
+	return std::wstring(L"+ ISFILE");
+}
+BOOL isReparsePoint::include(FileData &file) const
+{
+	return file.isReparsePoint();
+}
+std::wstring isReparsePoint::debugTree() const
+{
+	return std::wstring(L"+ ISREPARSEPOINT");
+}
+BOOL isSFCProtected::include(FileData &file) const
+{
+	return file.isSfcProtected();
+}
+std::wstring isSFCProtected::debugTree() const
+{
+	return std::wstring(L"+ ISSFCPROTECTED");
+}
+BOOL isHidden::include(FileData &file) const
+{
+	return file.isHidden();
+}
+std::wstring isHidden::debugTree() const
+{
+	return std::wstring(L"+ ISHIDDEN");
+}
+BOOL isReadOnly::include(FileData &file) const
+{
+	return file.isReadOnly();
+}
+std::wstring isReadOnly::debugTree() const
+{
+	return std::wstring(L"+ ISREADONLY");
+}
+BOOL isSystem::include(FileData &file) const
+{
+	return file.isSystem();
+}
+std::wstring isSystem::debugTree() const
+{
+	return std::wstring(L"+ ISSYSTEM"); 
+}
+BOOL isVolumeLabel::include(FileData &file) const
+{
+	return file.isVolumeLabel();
+}
+std::wstring isVolumeLabel::debugTree() const
+{
+	return std::wstring(L"+ ISVOLLABEL");
+}
+BOOL isWritable::include(FileData &file) const
+{
+	return file.isWritable();
+}
+std::wstring isWritable::debugTree() const
+{
+	return std::wstring(L"+ ISWRITABLE");
+}
+BOOL isTemp::include(FileData &file) const
+{
+	return file.isTemporary();
+}
+std::wstring isTemp::debugTree() const
+{
+	return std::wstring(L"+ ISTEMP");
+}
+unsigned __int32 sigIsValid::getPriorityClass() const
+{
+	return PRIORITY_SIGCHECK;
+}
+BOOL sigIsValid::include(FileData &file) const
+{
+	return file.hasValidDigitalSignature();
+}
+std::wstring sigIsValid::debugTree() const
+{
+	return std::wstring(L"+ SIGVALID");
+}
+unsigned __int32 peFilter::getPriorityClass() const
+{
+	return PRIORITY_PE_DATA;
+}
+BOOL hasSig::include(FileData &file) const
+{
+	return file.hasAuthenticodeSignature();
+}
+std::wstring hasSig::debugTree() const
+{
+	return std::wstring(L"+ HASSIGNATURE");
+}
+BOOL isPEFile::include(FileData &file) const
+{
+	return file.isPE();
+}
+std::wstring isPEFile::debugTree() const
+{
+	return std::wstring(L"+ ISPORTABLEEXE");
+}
+BOOL timestampValid::include(FileData &file) const
+{
+	return file.peHeaderTimeIsValid();
+}
+std::wstring timestampValid::debugTree() const
+{
+	return std::wstring(L"+ PETIMESTAMPVALID");
+}
+BOOL checkSumValid::include(FileData &file) const
+{
+	return file.peHeaderChecksumIsValid(); 
+}
+std::wstring checkSumValid::debugTree() const
+{
+	return std::wstring(L"+ CHECKSUMVALID");
+}
+BOOL isDLLFile::include(FileData &file) const
+{
+	return file.isDLL();
+}
+std::wstring isDLLFile::debugTree() const
+{
+	return std::wstring(L"+ ISDLL");
+}
+unsigned __int32 hash::getPriorityClass() const
+{
+	return PRIORITY_HASH_CHECK;
+}
+BOOL md5Match::include(FileData &file) const
+{
+	return file.MD5() == md5Val;
+}
+std::wstring md5Match::debugTree() const
+{
+	return std::wstring(L"+ MD5 MATCHES ").append(md5Val);
+}
+md5Match::md5Match(std::wstring md5Value): md5Val(md5Value)
+{
+	boost::algorithm::to_upper(md5Val);
+}
+BOOL sha1Match::include(FileData &file) const
+{
+	return file.SHA1() == sha1Val;
+}
+std::wstring sha1Match::debugTree() const
+{
+	return std::wstring(L"+ SHA-1 MATCHES ").append(sha1Val);
+}
+sha1Match::sha1Match(std::wstring sha1Value): sha1Val(sha1Value)
+{
+	boost::algorithm::to_upper(sha1Val);
+}
+std::wstring hashList::listValues() const
+{
+	std::wstring retVal;
+	for( std::vector<std::wstring>::const_iterator it = values.begin(); it != values.end(); it++)
+		retVal.append(L"  ").append(*it).append(L"\r\n");
+	retVal.erase(retVal.end() - 2, retVal.end());
+	return retVal;
+}
+hashList::hashList(std::vector<std::wstring> hashes) : values(hashes)
+{
+	std::sort(values.begin(),values.end());
+	for(std::vector<std::wstring>::iterator it = hashes.begin(); it != hashes.end(); it++)
+	{
+		boost::algorithm::to_upper(*it);
+	}
+}
+BOOL md5List::include(FileData &file) const
+{
+	return std::binary_search(values.begin(),values.end(),file.MD5());
+}
+std::wstring md5List::debugTree() const
+{
+	return L"+ MD5 LIST:\r\n" + listValues();
+}
+md5List::md5List(std::vector<std::wstring> md5s): hashList(md5s)
+{}
+BOOL sha1List::include(FileData &file) const
+{
+	return std::binary_search(values.begin(),values.end(),file.SHA1());
+}
+std::wstring sha1List::debugTree() const
+{
+	return L"+ SHA-1 LIST:\r\n" + listValues();
+}
+sha1List::sha1List(std::vector<std::wstring> sha1s): hashList(sha1s)
+{}
+BOOL md5EList::include(FileData &file) const
+{
+	std::wstring calcHash = file.MD5();
+	if (calcHash[0] == L'!')
+		return true;
+	return std::binary_search(values.begin(),values.end(),calcHash);
+}
+std::wstring md5EList::debugTree() const
+{
+	return L"+ MD5 OR ERROR LIST:\r\n" + listValues();
+}
+md5EList::md5EList(std::vector<std::wstring> md5s): hashList(md5s)
+{}
+BOOL sha1EList::include(FileData &file) const
+{
+	std::wstring calcHash = file.SHA1();
+	if (calcHash[0] == L'!')
+		return true;
+	return std::binary_search(values.begin(),values.end(),calcHash);
+}
+std::wstring sha1EList::debugTree() const
+{
+	return L"+ SHA-1 OR ERROR LIST:\r\n" + listValues();
+}
+sha1EList::sha1EList(std::vector<std::wstring> sha1s): hashList(sha1s)
+{}
+unsigned __int32 skipper::getPriorityClass() const 
+{ 
+	return PRIORITY_FAST_FILTER; 
+}
+BOOL skipper::include(FileData & /*file*/) const
+{ 
+	return true; 
+}
+std::wstring skipper::debugTree() const 
+{ 
+	return L"SKIP " + _toSkip;
+}
+unsigned int skipper::directoryCheck(const std::wstring& directory)
+{
+	wchar_t relPath[MAX_PATH];
+	if (!PathRelativePathTo(relPath, _toSkip.c_str(), FILE_ATTRIBUTE_DIRECTORY, directory.c_str(), FILE_ATTRIBUTE_DIRECTORY))
+		return DIRECTORY_DONTCARE;
+	if (relPath[0] == L'.' && relPath[1] == NULL)
+		return DIRECTORY_EXCLUDE;
+	return DIRECTORY_DONTCARE;
+}
+skipper::skipper(const std::wstring& toSkip) : _toSkip(toSkip)
+{}
+
+BOOL isNEFile::include(FileData &file) const
+{
+	return file.isNE();
+}
+
+std::wstring isNEFile::debugTree() const
+{
+	return std::wstring(L"+ ISNEWEXE");
+}
+
+BOOL isLEFile::include(FileData &file) const
+{
+	return file.isLE();
+}
+
+std::wstring isLEFile::debugTree() const
+{
+	return std::wstring(L"+ ISLEFORMATEXE");
+}
+
+BOOL isMZFile::include(FileData &file) const
+{
+	return file.isMZ();
+}
+
+std::wstring isMZFile::debugTree() const
+{
+	return std::wstring(L"+ ISMZCOMPLIANTEXE");
+}
+
+BOOL is2ExecFile::include(FileData &file) const
+{
+	return file.isStrongExecutable();
+}
+
+std::wstring is2ExecFile::debugTree() const
+{
+	return std::wstring(L"+ ISSTRONGTYPEEXE");
+}
+
+unsigned __int32 headerLDate::getPriorityClass() const
+{
+	return PRIORITY_PE_DATA;
+}
+
+std::wstring headerLDate::debugTree() const
+{
+	return L"HEADER DATEFILTER LESSTHAN " + getDateAsString(date);
+}
+
+BOOL headerLDate::include(FileData &file) const
+{
+	if (!file.isPE())
+		return false;
+	return file.getPEHeaderTime() < date;
+}
+
+unsigned __int32 headerGDate::getPriorityClass() const
+{
+	return PRIORITY_PE_DATA;
+}
+
+std::wstring headerGDate::debugTree() const
+{
+	return L"HEADER DATEFILTER GREATERTHAN " + getDateAsString(date);
+}
+
+BOOL headerGDate::include(FileData &file) const
+{
+	if (!file.isPE())
+		return false;
+	return date < file.getPEHeaderTime();
+}
+
+BOOL isPEPlusFile::include( FileData &file ) const
+{
+	return file.isPEPlus();
+}
+
+std::wstring isPEPlusFile::debugTree() const
+{
+	return std::wstring(L"+ IS64BITPORTABLEEXE");
+}
+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// Filter.h -- defines filters which are used to show or
+//               hide a particular file.
+#pragma once
+#include <vector>
+#include <string>
+#include "criterion.h"
+
+class sizeFilter : public criterion
+{
+protected:
+	unsigned __int64 size;
+	std::wstring debugTreeInternal(const std::wstring& type) const;
+public:
+	unsigned __int32 getPriorityClass() const;
+	sizeFilter(unsigned __int64 createdSize);
+};
+
+struct gtSizeFilter : sizeFilter
+{
+	gtSizeFilter(unsigned __int64 createdSize);
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+
+struct ltSizeFilter : sizeFilter
+{
+	ltSizeFilter(unsigned __int64 createdSize);
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+
+struct notSizeFilter : sizeFilter
+{
+	notSizeFilter(unsigned __int64 createdSize);
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+
+struct isSizeFilter : sizeFilter
+{
+	isSizeFilter(unsigned __int64 createdSize);
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+
+class dateFilter : public criterion
+{
+protected:
+	FILETIME date;
+public:
+	virtual unsigned __int32 getPriorityClass() const;
+	dateFilter(const FILETIME &inDate);
+	
+};
+
+struct headerLDate : dateFilter
+{
+	unsigned __int32 getPriorityClass() const;
+	headerLDate(const FILETIME &inDate) : dateFilter(inDate) {};
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+struct headerGDate : dateFilter
+{
+	unsigned __int32 getPriorityClass() const;
+	headerGDate(const FILETIME &inDate) : dateFilter(inDate) {};
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+class accessLDate : public dateFilter
+{
+public:
+	accessLDate(const FILETIME &inDate);
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+class accessGDate : public dateFilter
+{
+public:
+	accessGDate(const FILETIME &inDate);
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+class modifiedLDate : public dateFilter
+{
+public:
+	modifiedLDate(const FILETIME &inDate);
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+class modifiedGDate : public dateFilter
+{
+public:
+	modifiedGDate(const FILETIME &inDate);
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+class createdLDate : public dateFilter
+{
+public:
+	createdLDate(const FILETIME &inDate);
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+class createdGDate : public dateFilter
+{
+public:
+	createdGDate(const FILETIME &inDate);
+	std::wstring debugTree() const;
+	BOOL include(FileData &file) const;
+};
+
+struct fastFilter : public criterion
+{
+	unsigned __int32 getPriorityClass() const;
+};
+
+struct isArchive : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isCompressed : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isDirectory : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isFile : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isReparsePoint : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isSFCProtected : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isHidden : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isReadOnly : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isSystem : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isVolumeLabel : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isWritable : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isTemp : public fastFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct sigIsValid : public criterion
+{
+	unsigned __int32 getPriorityClass() const;
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct peFilter : public criterion
+{
+	unsigned __int32 getPriorityClass() const;
+};
+struct hasSig : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isPEFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isPEPlusFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isNEFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isLEFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isMZFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct is2ExecFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct timestampValid : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct checkSumValid : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+struct isDLLFile : public peFilter
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+};
+
+struct hash : public criterion
+{
+	unsigned __int32 getPriorityClass() const;
+};
+
+class md5Match : public hash
+{
+	std::wstring md5Val;
+public:
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+	md5Match(std::wstring md5Value);
+};
+class sha1Match : public hash
+{
+	std::wstring sha1Val;
+public:
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+	sha1Match(std::wstring sha1Value);
+};
+class hashList : public hash
+{
+protected:
+	std::vector<std::wstring> values;
+	std::wstring listValues() const;
+public:
+	hashList(std::vector<std::wstring> hashes);
+};
+struct md5List : public hashList
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+	md5List(std::vector<std::wstring> md5s);
+};
+struct sha1List : public hashList
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+	sha1List(std::vector<std::wstring> sha1s);
+};
+struct md5EList : public hashList
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+	md5EList(std::vector<std::wstring> md5s);
+};
+struct sha1EList : public hashList
+{
+	BOOL include(FileData &file) const;
+	std::wstring debugTree() const;
+	sha1EList(std::vector<std::wstring> sha1s);
+};
+class skipper : public criterion
+{
+	std::wstring _toSkip;
+public:
+	unsigned __int32 getPriorityClass() const;
+	BOOL include(FileData & /*file*/) const;
+	std::wstring debugTree() const;
+	virtual unsigned int directoryCheck(const std::wstring& directory);
+	skipper(const std::wstring& toSkip);
+};

pevLib/OPSTRUCT.h

+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// Opstruct.h -- Defines structures which control analysis
+// flow inside pevFind's tree
+#ifndef _OPSTRUCT_H_INCLUDED
+#define _OPSTRUCT_H_INCLUDED
+#include <vector>
+#include <boost/shared_ptr.hpp>
+#include "criterion.h"
+
+class operation : public criterion
+{
+protected:
+	boost::shared_ptr<criterion> operandA;
+	boost::shared_ptr<criterion> operandB;
+	std::wstring debugTreeInternal(const std::wstring& curOp) const;
+public:
+	virtual void reorderTree();
+	unsigned __int32 getPriorityClass() const;
+	operation(boost::shared_ptr<criterion> a, boost::shared_ptr<criterion> b);
+	void makeNonRecursive();
+};
+
+class andAndClass : public operation
+{
+public:
+	BOOL include(FileData &file) const;
+	virtual unsigned int directoryCheck(const std::wstring& directory) const;
+	andAndClass(boost::shared_ptr<criterion> a, boost::shared_ptr<criterion> b);
+	std::wstring debugTree() const;
+};
+class orAndClass : public operation
+{
+public:
+	BOOL include(FileData &file) const;
+	virtual unsigned int directoryCheck(const std::wstring& directory) const;
+	orAndClass(boost::shared_ptr<criterion> a, boost::shared_ptr<criterion> b);
+	std::wstring debugTree() const;
+};
+class xorAndClass : public operation
+{
+public:
+	BOOL include(FileData &file) const;
+	virtual unsigned int directoryCheck(const std::wstring& directory) const;
+	xorAndClass(boost::shared_ptr<criterion> a, boost::shared_ptr<criterion> b);
+	std::wstring debugTree() const;
+};
+class notAndClass : public criterion
+{
+	boost::shared_ptr<criterion> operand;
+public:
+	virtual void reorderTree();
+	unsigned __int32 getPriorityClass() const;
+	BOOL include(FileData &file) const;
+	virtual unsigned int directoryCheck(const std::wstring& directory) const;
+	notAndClass(boost::shared_ptr<criterion> a);
+	std::wstring debugTree() const;
+	void makeNonRecursive();
+};
+class bracketClass : public criterion
+{
+	std::vector<boost::shared_ptr<criterion> > expr;
+public:
+	virtual void reorderTree();
+	unsigned __int32 getPriorityClass() const;
+	BOOL include(FileData &file) const;
+	virtual unsigned int directoryCheck(const std::wstring& directory);
+	bracketClass(std::vector<boost::shared_ptr<criterion> > exprA);
+	std::wstring debugTree() const;
+	void makeNonRecursive();
+};
+
+class ifClass : public criterion
+{
+	boost::shared_ptr<criterion> condVal;
+	boost::shared_ptr<criterion> tVal;
+	boost::shared_ptr<criterion> fVal;
+public:
+	virtual void reorderTree();
+	unsigned __int32 getPriorityClass() const;
+	BOOL include(FileData &file) const;
+	virtual unsigned int directoryCheck(const std::wstring& directory) const;
+	ifClass(boost::shared_ptr<criterion> condition,boost::shared_ptr<criterion> valueIfTrue,boost::shared_ptr<criterion> valueIfFalse = boost::shared_ptr<criterion>((criterion *)NULL));
+	std::wstring debugTree() const;
+	void makeNonRecursive();
+};
+
+#endif

pevLib/clsidCompressor.cpp

+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// clsidCompressor.cpp -- Implements the clsid compressor/decompressor.
+
+#include <exception>
+#include <vector>
+#include <windows.h>
+#include <boost/algorithm/string/split.hpp>
+#include <boost/algorithm/string/trim.hpp>
+#include <boost/algorithm/string/predicate.hpp>
+#include <boost/algorithm/string/case_conv.hpp>
+#include "clsidCompressor.h"
+#include "utility.h"
+
+namespace clsidCompressor {
+
+	typedef union _clsidStructure
+	{
+		BYTE bytes[16];
+		unsigned __int64 bigNums[2];
+	} clsidStructure;
+
+	const clsidStructure operator+(const clsidStructure& a, const clsidStructure& b);
+
+	const clsidStructure operator-(const clsidStructure& a, const clsidStructure& b);
+
+	int compress(const std::wstring& inFileName, const std::wstring& outFileName);
+	int decompress(const std::wstring& inFileName, const std::wstring& outFileName, const bool append);
+	clsidStructure createClsidFromString(const std::string& clsidString);
+	std::string createStringFromClsid(const clsidStructure& clsidStruct);
+	BYTE minLengthOfClsid(const clsidStructure& clsidStruct)
+	{
+		for(BYTE idx = 15; idx > 0; idx--)
+		{
+			if(clsidStruct.bytes[idx])
+				return idx+1;
+		}
+		return 1;
+	}
+
+int main(int argc, wchar_t* argv[])
+{
+	//Verify 4 Arguments
+	if (argc != 4)
+		throw std::invalid_argument("Usage: <OPTIONS> <INFILE> <OUTFILE>");
+	
+	std::wstring options(argv[1]);
+	std::wstring infile(argv[2]);
+	std::wstring outfile(argv[3]);
+
+	//Option: Compress
+	if (options.find_first_of(L"Cc") != options.npos)
+		return compress(infile, outfile);
+	//Option: Decompress
+	if (options.find_first_of(L"Dd") != options.npos)
+	{
+		if (options.find_first_of(L"Aa") == options.npos)
+		{
+			//Don't append to file
+			return decompress(infile,outfile,false);
+		} else
+		{
+			//Append to filee=
+			return decompress(infile,outfile,true);
+		}
+	}
+	throw std::invalid_argument("Invalid operation for CLSID Compressor.");
+}
+
+int compress(const std::wstring& inFileName, const std::wstring& outFileName)
+{
+	DWORD squat;
+	HANDLE hFile;
+	hFile = CreateFile(inFileName.c_str(),GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_DELETE|FILE_SHARE_WRITE,NULL,OPEN_EXISTING, 0,NULL);
+	if (hFile == INVALID_HANDLE_VALUE)
+		throw std::runtime_error("Could not open input file.");
+	DWORD bufferLength;
+	bufferLength = SetFilePointer(hFile,0,0,FILE_END);
+	SetFilePointer(hFile,0,0,FILE_BEGIN);
+	LPBYTE inputBuffer = new BYTE[bufferLength];
+	if (!ReadFile(hFile,inputBuffer,bufferLength,&squat,NULL))
+	{
+		throw std::runtime_error("Could not read input file.");
+	}
+	std::string rawFileString;
+	if (IsTextUnicode(inputBuffer, bufferLength, NULL))
+		rawFileString.assign(convertUnicode(std::wstring(reinterpret_cast<wchar_t *>(inputBuffer),bufferLength/sizeof(TCHAR))));
+	else
+		rawFileString.assign(std::string(reinterpret_cast<char *>(inputBuffer),bufferLength));
+	CloseHandle(hFile);
+	std::vector<std::string> clsidStrings;
+	boost::algorithm::split(clsidStrings,rawFileString,boost::algorithm::is_any_of(L"\r\n"));
+	for (std::vector<std::string>::iterator curLine = clsidStrings.begin(); curLine != clsidStrings.end(); curLine++)
+	{
+		boost::algorithm::to_upper(*curLine);
+		boost::algorithm::trim(*curLine);
+	}
+	std::sort(clsidStrings.begin(), clsidStrings.end());
+	std::vector<clsidStructure> convertedClsids;
+	std::string invalidClsids;
+	for (std::vector<std::string>::const_iterator it = clsidStrings.begin(); it != clsidStrings.end(); it++)
+	{
+		if (it->empty()) continue;
+		try
+		{
+			//Convert the clsid into a number
+			convertedClsids.push_back(createClsidFromString(*it));
+		} catch (...)
+		{
+			//Invalid CLSID number -- add to invalid list
+			invalidClsids.append(*it).append("\r\n");
+		}
+	}
+	clsidStrings.clear();
+	//Buffer for use to write later
+	std::vector<BYTE> compressedBytes;
+
+	//Length of invalid string plus length integer plus the size of the CLSID list.
+	compressedBytes.reserve(invalidClsids.length() + 4 + convertedClsids.size() * 16);
+
+	//Append length of invalid string
+	union {
+		DWORD dwordVal;
+		BYTE bytes[4];
+	} invalidLength;
+	invalidLength.dwordVal = (DWORD) invalidClsids.length();
+	compressedBytes.push_back((BYTE)  invalidLength.bytes[0]);
+	compressedBytes.push_back((BYTE)  invalidLength.bytes[1]);
+	compressedBytes.push_back((BYTE)  invalidLength.bytes[2]);
+	compressedBytes.push_back((BYTE)  invalidLength.bytes[3]);
+	//Append invalid string
+	for(register DWORD idx = 0; idx < invalidLength.dwordVal; idx++)
+	{
+		compressedBytes.push_back(invalidClsids[idx]);
+	}
+	invalidClsids.clear();
+
+	//Compress the 128 bit integers
+	clsidStructure differenceValA;
+	ZeroMemory(&differenceValA, sizeof(clsidStructure));
+	clsidStructure differenceValB;
+	ZeroMemory(&differenceValB, sizeof(clsidStructure));
+	clsidStructure previousClsid;
+	ZeroMemory(&previousClsid, sizeof(clsidStructure));
+	BYTE lengthByte = 0;
+	for (size_t idx = 0; idx < convertedClsids.size(); idx += 2)
+	{
+		//Calculate the differences
+		differenceValA = convertedClsids[idx] - previousClsid;
+		previousClsid = convertedClsids[idx];
+		if (idx+1 < convertedClsids.size())
+		{
+			differenceValB = convertedClsids[idx+1] - previousClsid;
+			previousClsid = convertedClsids[idx+1];
+		}
+
+		//Calculate the length byte
+		lengthByte = minLengthOfClsid(differenceValA);
+		if (idx+1 < convertedClsids.size())
+			lengthByte |= (minLengthOfClsid(differenceValB) << 4);
+
+		//Push the results onto our result stack.
+		compressedBytes.push_back(lengthByte);
+		for(BYTE clsidIdx = 0; clsidIdx < (lengthByte & 0x0F); clsidIdx++)
+		{
+			compressedBytes.push_back(differenceValA.bytes[clsidIdx]);
+		}
+		if (idx+1 < convertedClsids.size())
+			for(BYTE clsidIdx = 0; clsidIdx < (lengthByte >> 4); clsidIdx++)
+			{
+				compressedBytes.push_back(differenceValB.bytes[clsidIdx]);
+			};
+	}
+	convertedClsids.clear();
+	if (lengthByte & 0xF0  >> 4)
+		compressedBytes.push_back(0x00);
+
+	hFile = CreateFile(outFileName.c_str(),GENERIC_WRITE, 0,NULL,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
+	if (hFile == INVALID_HANDLE_VALUE)
+		throw std::runtime_error("Could not open output file.");
+	if (!WriteFile(hFile,&compressedBytes[0],compressedBytes.size(),&squat,NULL))
+		throw std::runtime_error("Could not write to output file.");
+	CloseHandle(hFile);
+
+	return 0;
+}
+
+#define WRITE_ERROR_MESSAGE std::runtime_error("Could not write to output file.")
+#define READ_ERROR_MESSAGE std::runtime_error("Could not read from input file.")
+
+int decompress(const std::wstring& inFileName, const std::wstring& outFileName, const bool append)
+{
+	HANDLE hInFile;
+	hInFile = CreateFile(inFileName.c_str(),GENERIC_READ,FILE_SHARE_READ|FILE_SHARE_DELETE|FILE_SHARE_WRITE,NULL,OPEN_EXISTING, 0,NULL);
+	if (hInFile == INVALID_HANDLE_VALUE)
+		throw std::runtime_error("Could not open input file.");
+	HANDLE hOutFile;
+	hOutFile = CreateFile(outFileName.c_str(),GENERIC_WRITE, 0,NULL,OPEN_ALWAYS, 0,NULL);
+	if (hOutFile == INVALID_HANDLE_VALUE)
+		throw std::runtime_error("Could not open output file.");
+
+	if (append)
+		SetFilePointer(hOutFile, 0, 0, FILE_END);
+	DWORD invalidLength;
+	DWORD bytesRead;
+	DWORD bytesWritten;
+
+	if (!ReadFile(hInFile,&invalidLength,4,&bytesRead,NULL))
+		throw READ_ERROR_MESSAGE;
+	if (bytesRead != 4)
+		throw READ_ERROR_MESSAGE;
+
+	LPBYTE invalids = new BYTE[invalidLength+1];
+	if (!ReadFile(hInFile,invalids,invalidLength,&bytesRead,NULL))
+		throw READ_ERROR_MESSAGE;
+	if (bytesRead != invalidLength)
+		throw READ_ERROR_MESSAGE;
+	if (!WriteFile(hOutFile,invalids,invalidLength,&bytesWritten,NULL))
+		throw WRITE_ERROR_MESSAGE;
+	if (invalidLength != bytesWritten)
+		throw WRITE_ERROR_MESSAGE;
+	delete [] invalids;
+
+	BYTE clsidLenByte, lengthA;
+	clsidStructure clsidStruct, prevClsid;
+	ZeroMemory(&prevClsid,sizeof(clsidStructure));
+	for (;;)
+	{
+		if (!ReadFile(hInFile,&clsidLenByte,1,&bytesRead,NULL))
+			throw READ_ERROR_MESSAGE;
+		if (!bytesRead)
+			throw READ_ERROR_MESSAGE;
+
+		lengthA = clsidLenByte & 0x0F;
+		clsidLenByte >>= 4;
+		if (!lengthA)
+			break;
+		ZeroMemory(&clsidStruct,sizeof(clsidStruct));
+		if (!ReadFile(hInFile,clsidStruct.bytes,lengthA,&bytesRead,NULL))
+			throw READ_ERROR_MESSAGE;
+		if (bytesRead != lengthA)
+			throw READ_ERROR_MESSAGE;
+		prevClsid = clsidStruct + prevClsid;
+		if (!WriteFile(hOutFile,
+			createStringFromClsid(prevClsid).c_str(),
+			40,&bytesWritten,NULL))
+			throw WRITE_ERROR_MESSAGE;
+		if (bytesWritten != 40)
+			throw WRITE_ERROR_MESSAGE;
+		if (!clsidLenByte)
+			break;
+		ZeroMemory(&clsidStruct,sizeof(clsidStruct));
+		if (!ReadFile(hInFile,clsidStruct.bytes,clsidLenByte,&bytesRead,NULL))
+			throw READ_ERROR_MESSAGE;
+		if (bytesRead != clsidLenByte)
+			throw READ_ERROR_MESSAGE;
+		prevClsid = clsidStruct + prevClsid;
+		if (!WriteFile(hOutFile,
+			createStringFromClsid(prevClsid).c_str(),
+			40,&bytesWritten,NULL))
+			throw WRITE_ERROR_MESSAGE;
+		if (bytesWritten != 40)
+			throw WRITE_ERROR_MESSAGE;
+	}
+	CloseHandle(hInFile);
+	CloseHandle(hOutFile);
+	return 0;
+}
+const char hexLetters[] = "0123456789ABCDEF";
+clsidStructure createClsidFromString(const std::string& clsidString)
+{
+	//Sanity check
+	if (
+		(clsidString.length() != 38) ||
+		clsidString[ 0] != '{' ||
+		clsidString[ 9] != '-' ||
+		clsidString[14] != '-' ||
+		clsidString[19] != '-' ||
+		clsidString[24] != '-' ||
+		clsidString[37] != '}'
+		)
+		throw std::invalid_argument("Invalid CLSID");
+	std::string workingClsidString(clsidString);
+
+	//Remove the -s and {}s
+	workingClsidString.erase(0,1);
+	workingClsidString.erase(8,1);
+	workingClsidString.erase(12,1);
+	workingClsidString.erase(16,1);
+	workingClsidString.erase(20,1);
+	workingClsidString.erase(32);
+
+	//Ensure all digits are in hex
+	for(register unsigned int idx = 0; idx < 32; idx++)
+	{
+		if (! ((workingClsidString[idx] >= '0' && workingClsidString[idx] <= '9') || (workingClsidString[idx] >= 'A' && workingClsidString[idx] <= 'F')))
+			throw std::invalid_argument("Invalid CLSID");
+	}
+
+	clsidStructure clsidStruct;
+
+	//Convert hex to bytes
+	for (register unsigned int idx = 0; idx < 16; idx++)
+	{
+		clsidStruct.bytes[15-idx] = (BYTE) (strchr(hexLetters,workingClsidString[idx*2]) - hexLetters);
+		clsidStruct.bytes[15-idx] <<= 4;
+		clsidStruct.bytes[15-idx] |= strchr(hexLetters,workingClsidString[idx*2+1]) - hexLetters;
+	}
+
+	return clsidStruct;
+}
+
+std::string createStringFromClsid(const clsidStructure& clsidStruct)
+{
+	std::string retVal("{",1);
+	retVal.reserve(40);
+	char temp[2];
+	for(register unsigned int idx=0; idx < 4; idx++)
+	{
+		temp[1] = *(hexLetters + (clsidStruct.bytes[15-idx] & 0x0F));
+		temp[0] = *(hexLetters + (clsidStruct.bytes[15-idx] >> 4));
+		retVal.append(temp,2);
+	}
+	retVal.append("-",1);
+	for(register unsigned int idx=4; idx < 6; idx++)
+	{
+		temp[1] = *(hexLetters + (clsidStruct.bytes[15-idx] & 0x0F));
+		temp[0] = *(hexLetters + (clsidStruct.bytes[15-idx] >> 4));
+		retVal.append(temp,2);
+	}
+	retVal.append("-",1);
+	for(register unsigned int idx=6; idx < 8; idx++)
+	{
+		temp[1] = *(hexLetters + (clsidStruct.bytes[15-idx] & 0x0F));
+		temp[0] = *(hexLetters + (clsidStruct.bytes[15-idx] >> 4));
+		retVal.append(temp,2);
+	}
+	retVal.append("-",1);
+	for(register unsigned int idx=8; idx < 10; idx++)
+	{
+		temp[1] = *(hexLetters + (clsidStruct.bytes[15-idx] & 0x0F));
+		temp[0] = *(hexLetters + (clsidStruct.bytes[15-idx] >> 4));
+		retVal.append(temp,2);
+	}
+	retVal.append("-",1);
+	for(register unsigned int idx=10; idx < 16; idx++)
+	{
+		temp[1] = *(hexLetters + (clsidStruct.bytes[15-idx] & 0x0F));
+		temp[0] = *(hexLetters + (clsidStruct.bytes[15-idx] >> 4));
+		retVal.append(temp,2);
+	}
+	retVal.append("}\r\n",3);
+	return retVal;
+}
+
+const clsidStructure operator-(const clsidStructure& a, const clsidStructure& b)
+{
+	clsidStructure ret(a);
+	ret.bigNums[0] -= b.bigNums[0];
+	ret.bigNums[1] -= b.bigNums[1];
+    if (ret.bigNums[0] > a.bigNums[0])
+        ret.bigNums[1]--;
+	return ret;
+}
+
+const clsidStructure operator+(const clsidStructure& a, const clsidStructure& b)
+{
+	clsidStructure ret(a);
+	ret.bigNums[0] += b.bigNums[0];
+	ret.bigNums[1] += b.bigNums[1];
+	if (ret.bigNums[0] < a.bigNums[0] || ret.bigNums[0] < b.bigNums[0])
+		ret.bigNums[1]++;
+	return ret;
+}
+
+} //namespace CLSIDCompressor

pevLib/clsidCompressor.h

+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// clsidCompressor.h -- This header defines the functions used
+// by the CLSID compressor and decompressor.
+
+namespace clsidCompressor {
+	int main(int argc, wchar_t* argv[]);
+}; //namespace clsidCompressor

pevLib/consoleParser.cpp

+//          Copyright Billy O'Neal 2011
+// Distributed under the Boost Software License, Version 1.0.
+//    (See accompanying file LICENSE_1_0.txt or copy at
+//          http://www.boost.org/LICENSE_1_0.txt)
+//
+// consoleParser.cpp -- Implements the class responsable for
+// processing pevFind's commandline. Implements the recursive
+// descent parser.
+
+#include <stdexcept>
+#ifndef NDEBUG
+#include <iostream> //These are used to print debugging info to disk.
+#include <fstream>
+#endif
+#include <boost/xpressive/xpressive_static.hpp>
+#include <boost/algorithm/string.hpp>
+#include "utility.h"
+#include "logger.h"
+#include "consoleParser.h"
+#include "globalOptions.h"
+#include "opstruct.h"
+#include "regex.h"
+#include "FILTER.h"
+
+//Entry point into the parser system
+boost::shared_ptr<criterion> consoleParser::parseCmdLine(const std::wstring& commandLine)
+{
+    tokenize(commandLine);
+    curToken++; //Skip past the program directory itself
+    if (boost::algorithm::iequals(curToken->argument, L"vfind"))
+        curToken++;
+    boost::shared_ptr<criterion> result(andParse());
+    if (curToken->type != END)
+        throw std::runtime_error("Commandline Syntax Error!!");
+    return result;
+}
+//Initial tokenizing function
+void consoleParser::tokenize(const std::wstring& commandLine)
+{
+    makeTokens(commandLine, tokens);
+    commandToken endCap;
+    endCap.type = END;
+    tokens.push_back(endCap);
+    curToken = tokens.begin();
+}
+//Inserts new tokens (--loadline) to the token stream
+void consoleParser::insertNewTokens(std::vector<commandToken>::iterator& position, const std::wstring& commandLine)
+{
+    std::vector<commandToken> newTokens;
+    makeTokens(commandLine, newTokens);
+    if (newTokens.size())
+    {
+        size_t pos = position - tokens.begin(); //Remember the position offset
+        tokens.insert(position + 1, newTokens.begin(), newTokens.end()); //Invalidates iterators
+        position = tokens.begin() + pos; //Use the position offset to make this iterator valid again
+    }
+}
+void consoleParser::makeTokens(const std::wstring& commandLine, std::vector<commandToken>& resultVec)
+{
+    using namespace boost::xpressive;
+    mark_tag argument(2), option(3);
+    wsregex tokenRegex =	(argument= as_xpr(L"{")) | (argument= as_xpr("}")) | as_xpr(L'"') >> (*as_xpr(L'-') >> (argument= as_xpr(L'-') >> +(~set[_s | (set= L'"', L'#', L'{', L'}') ])) >>
+        !(as_xpr(L'#') >> (option= +(as_xpr(L'#') >> set[range(L'A', L'Z') | range(L'a', L'z') | range(L'0', L'9')
+        | L'#' ]| ~set[L'#'])) >> L'#' | as_xpr(L'"') >> (option= +(L"\"\"" | ~set[L'"'])) >> L'"')) >> L'"' |
+                            as_xpr(L'"') >> (argument= +(L"\"\"" |~set[L'"'])) >> L'"' |
+                            (*as_xpr(L'-') >> (argument= as_xpr(L'-') >> +(~set[_s | (set= L'"', L'#', L'{', L'}') ])) >>
+        !(as_xpr(L'#') >> (option= +(as_xpr(L'#') >> set[range(L'A', L'Z') | range(L'a', L'z') | range(L'0', L'9')
+        | L'#' ]| ~set[L'#'])) >> L'#' | as_xpr(L'"') >> (option= +(L"\"\"" | ~set[L'"'])) >> L'"')) |
+                            (argument= +~_s);
+    wsregex_iterator tokenizedIterator(commandLine.begin(), commandLine.end(), tokenRegex);
+    wsregex_iterator end;
+    for(; tokenizedIterator != end; tokenizedIterator++)
+    {
+        commandToken madeTok;
+        wsmatch const &curMatch = *tokenizedIterator;
+        madeTok.argument = curMatch[argument];
+        madeTok.option = curMatch[option];
+        madeTok.type = makeTypeFromToken(curMatch[argument]);
+        madeTok.fullMatch = curMatch[0];
+        resultVec.push_back(madeTok);
+    }
+}
+consoleParser::tokenType consoleParser::makeTypeFromToken(const std::wstring& argument)
+{
+    if (argument == L"{")
+        return BRACKET;
+    if (argument == L"}")
+        return ENDBRACKET;
+    if (argument.length() == 2)
+    {
+        if    (((argument[0] == L'O') || (argument[0] == L'o'))
+            && ((argument[1] == L'R') || (argument[1] == L'r')))
+            return OR;
+        if    (((argument[0] == L'I') || (argument[0] == L'i'))
+            && ((argument[1] == L'F') || (argument[1] == L'f')))
+            return IFARG;
+    }
+    if (argument.length() == 3)
+    {
+        //And
+        if (   ((argument[0] == L'A') || (argument[0] == L'a'))
+            && ((argument[1] == L'N') || (argument[1] == L'n'))
+            && ((argument[2] == L'D') || (argument[2] == L'd')) )
+            return AND;
+        if (   ((argument[0] == L'N') || (argument[0] == L'n'))
+            && ((argument[1] == L'O') || (argument[1] == L'o'))
+            && ((argument[2] == L'T') || (argument[2] == L't')) )
+            return NOT;
+        //Xor
+        if (   ((argument[0] == L'X') || (argument[0] == L'x'))
+            && ((argument[1] == L'O') || (argument[1] == L'o'))
+            && ((argument[2] == L'R') || (argument[2] == L'r')) )
+            return XOR;
+    }
+    //Else
+    if ( argument.length() == 4
+        && ((argument[0] == L'E') || (argument[0] == L'e'))
+        && ((argument[1] == L'L') || (argument[1] == L'l'))
+        && ((argument[2] == L'S') || (argument[2] == L's'))
+        && ((argument[3] == L'E') || (argument[3] == L'e')) )
+        return ELSEARG;
+    if (argument[0] == L'-')
+        return MODIFIER;
+    return REGEX;
+}
+boost::shared_ptr<criterion> consoleParser::andParse()
+{
+    boost::shared_ptr<criterion> prev(orParse());
+    while (curToken->type == AND)
+    {
+        curToken++;
+        boost::shared_ptr<criterion> cur(orParse());
+        boost::shared_ptr<criterion> newNode(new andAndClass(cur, prev));
+        prev = newNode;
+    }
+    return prev;
+}
+boost::shared_ptr<criterion> consoleParser::orParse()
+{
+    boost::shared_ptr<criterion> prev(xorParse());
+    while (curToken->type == OR)
+    {
+        curToken++;
+        boost::shared_ptr<criterion> cur(xorParse());
+        boost::shared_ptr<criterion> newNode(new orAndClass(cur, prev));
+        prev = newNode;
+    }
+    return prev;
+}
+boost::shared_ptr<criterion> consoleParser::xorParse()
+{
+    boost::shared_ptr<criterion> prev(exprParse());
+    while (curToken->type == XOR)
+    {
+        curToken++;
+        boost::shared_ptr<criterion> cur(exprParse());
+        boost::shared_ptr<criterion> newNode(new xorAndClass(cur, prev));
+        prev = newNode;
+    }
+    return prev;
+}
+boost::shared_ptr<criterion> consoleParser::exprParse()
+{
+    std::vector<boost::shared_ptr<criterion> > results;
+    while (isExpressionArgumentType())
+    {
+        switch(curToken->type)
+        {
+        case NOT:
+            {
+                curToken++;
+                boost::shared_ptr<criterion> ptrVal(new notAndClass(exprParse()));
+                results.push_back(ptrVal);
+            }
+            break;
+        case BRACKET:
+            results.push_back(createBracket());
+            curToken++;
+            break;
+        case IFARG:
+            results.push_back(createIf());
+            curToken++;
+            break;
+        case REGEX:
+            {
+                boost::shared_ptr<regexClass> ptrVal(new vFindRegex(curToken->argument));
+                results.push_back(ptrVal);
+                globalOptions::regularExpressions.push_back(ptrVal);
+                curToken++;
+            }
+            break;
+        case MODIFIER:
+            createModifier(results);
+            curToken++;
+            break;
+        default:
+            throw std::runtime_error("Token unexpected. Check expression!");
+        }
+    }
+    switch(results.size())
+    {
+    case 0:
+        throw std::runtime_error("Expression resulted in zero qualifiers. Check expression.");
+    case 1:
+        return results[0];
+    default:
+        return boost::shared_ptr<criterion>( new bracketClass(results) );
+    }
+}
+boost::shared_ptr<criterion> consoleParser::createBracket()
+{
+    curToken++;
+    boost::shared_ptr<criterion> result = andParse();
+    if (curToken->type != ENDBRACKET)
+        throw std::runtime_error("Unbalanced {}s in your expression.");
+    return result;
+}
+boost::shared_ptr<criterion> consoleParser::createIf()
+{
+    curToken++;
+    boost::shared_ptr<criterion> condition(exprParse());
+    boost::shared_ptr<criterion> then(exprParse());
+    boost::shared_ptr<criterion> els((criterion *)NULL);
+    if (curToken->type == ELSEARG)
+    {
+        curToken++;
+        els = exprParse();
+    }
+    boost::shared_ptr<criterion> result(new ifClass(condition, then, els));
+    return result;
+}
+bool consoleParser::isExpressionArgumentType()
+{
+    switch(curToken->type)
+    {
+    case BRACKET:
+    case IFARG:
+    case REGEX:
+    case MODIFIER:
+    case NOT:
+        return true;
+    }
+    return false;
+}
+void consoleParser::createModifier(std::vector<boost::shared_ptr<criterion> > &results)
+{
+    using namespace boost::algorithm;
+    commandToken token = *curToken;
+    token.argument.erase(token.argument.begin(), token.argument.begin() + 1);
+    do {
+        if(      istarts_with(token.argument, L"custom"))
+        {
+            globalOptions::displaySpecification = token.option;	
+            return;
+        }
+        else if (istarts_with(token.argument, L"c"))
+        {
+            globalOptions::displaySpecification = token.option;
+            return;
+        }
+        else if (istarts_with(token.argument, L"debug"))
+        {
+            token.argument.erase(0, 5);
+            globalOptions::debug = true;
+        }
+        else if (istarts_with(token.argument, L"d"))
+            createDate(token, results);
+        else if (istarts_with(token.argument, L"encodingacp"))
+        {
+            token.argument.erase(0, 11);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_ACP;
+        }
+        else if (istarts_with(token.argument, L"encodingoem"))
+        {
+            token.argument.erase(0, 11);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_OEM;
+        }
+        else if (istarts_with(token.argument, L"encodingutf16"))
+        {
+            token.argument.erase(0, 13);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_UTF16;
+        }
+        else if (istarts_with(token.argument, L"encodingutf8"))
+        {
+            token.argument.erase(0, 12);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_UTF8;
+        }
+        else if (istarts_with(token.argument, L"enable-filesystem-redirector-64"))
+        {
+            token.argument.erase(0, 31);
+            globalOptions::disable64Redirector = false;
+        }
+        else if (istarts_with(token.argument, L"ea"))
+        {
+            token.argument.erase(0, 2);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_ACP;
+        }
+        else if (istarts_with(token.argument, L"eo"))
+        {
+            token.argument.erase(0, 2);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_OEM;
+        }
+        else if (istarts_with(token.argument, L"eu8"))
+        {
+            token.argument.erase(0, 3);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_UTF8;
+        }
+        else if (istarts_with(token.argument, L"eu16"))
+        {
+            token.argument.erase(0, 4);
+            globalOptions::encoding = globalOptions::ENCODING_TYPE_UTF16;
+        }
+        else if (istarts_with(token.argument, L"expand"))
+        {
+            token.argument.erase(0, 6);
+            globalOptions::expandRegex = true;
+        }
+        else if (istarts_with(token.argument, L"ex"))
+        {
+            token.argument.erase(0, 2);
+            globalOptions::expandRegex = true;
+        }
+        else if (istarts_with(token.argument, L"e"))
+        {
+            token.argument.erase(0, 1);
+            globalOptions::displaySpecification = L"[#p] #f";
+        }
+        else if (istarts_with(token.argument, L"filelook"))
+        {
+            token.argument.erase(0, 9);
+            globalOptions::displaySpecification = L"---- #f ----#nCompany: #d#nFile Description: #e#nFile Version: #g #nProduct Name: #i#nCopyright: #j#nOriginal file name: #k#nFile Size: #u#nCreated Time: #c #nModified Time: #m#nAccessed Time: #a#nMD5: #5#nSHA1: #1#nSHA224: #2#nSHA256: #3#nSHA384: #4#nSHA512: #6";
+        }
+        else if (istarts_with(token.argument, L"files"))
+        {
+            boost::shared_ptr<regexClass> it(new filesRegexPlaceHolder());
+            results.push_back(it);
+            globalOptions::regularExpressions.push_back(it);
+            processFilesArgument(token);
+        }
+        else if (istarts_with(token.argument, L"fs32"))
+        {
+            token.argument.erase(0, 4);
+            globalOptions::disable64Redirector = false;
+        }
+        else if (istarts_with(token.argument, L"full"))
+        {
+            token.argument.erase(0, 4);
+            globalOptions::fullPath = true;
+        }
+        else if (istarts_with(token.argument, L"f"))
+        {
+            token.argument.erase(0, 1);
+            globalOptions::fullPath = true;
+        }
+        else if (istarts_with(token.argument, L"k"))
+        {
+            token.argument.erase(0, 1);
+            globalOptions::killProc = true;
+        }
+        else if (istarts_with(token.argument, L"loadline"))
+            processLoadlineArgument(token);
+        else if (istarts_with(token.argument, L"limit"))
+        {
+            removeArgument(5, token.argument);
+            globalOptions::lineLimit = processUL(token);
+        }
+        else if (istarts_with(token.argument, L"long"))
+        {
+            token.argument.erase(0, 4);
+            if (!boost::algorithm::equals(globalOptions::displaySpecification, L"#8"))
+                globalOptions::displaySpecification = L"#t #s #m  #f";
+            else
+                globalOptions::displaySpecification = L"#t #s #m  #8";
+            globalOptions::summary = true;
+        }
+        else if (istarts_with(token.argument, L"l"))