VSSIntegrityWatcher.cpp

// VSSIntegrityWatcher.cpp
// Ayi NEDJIMI Consultants - WinToolsSuite
// Outil de monitoring du service Volume Shadow Copy (VSS)

#define UNICODE
#define _UNICODE
#define WIN32_LEAN_AND_MEAN

#include <windows.h>
#include <commctrl.h>
#include <commdlg.h>
#include <vss.h>
#include <vswriter.h>
#include <vsbackup.h>
#include <winevt.h>
#include <string>
#include <vector>
#include <thread>
#include <mutex>
#include <sstream>
#include <iomanip>
#include <fstream>

#pragma comment(lib, "comctl32.lib")
#pragma comment(lib, "vssapi.lib")
#pragma comment(lib, "ole32.lib")
#pragma comment(lib, "oleaut32.lib")
#pragma comment(lib, "wevtapi.lib")
#pragma comment(linker, "/manifestdependency:\"type='win32' name='Microsoft.Windows.Common-Controls' version='6.0.0.0' processorArchitecture='*' publicKeyToken='6595b64144ccf1df' language='*'\"")

// ===== RAII AutoHandle =====
class AutoHandle {
    HANDLE h;
public:
    AutoHandle(HANDLE handle = nullptr) : h(handle) {}
    ~AutoHandle() { if (h && h != INVALID_HANDLE_VALUE) CloseHandle(h); }
    operator HANDLE() const { return h; }
    HANDLE* operator&() { return &h; }
    AutoHandle(const AutoHandle&) = delete;
    AutoHandle& operator=(const AutoHandle&) = delete;
};

// ===== Structures =====
struct VSSSnapshot {
    std::wstring snapshotID;
    std::wstring volume;
    std::wstring creation;
    std::wstring taille;
    std::wstring provider;
    std::wstring etat;
};

// ===== Globales =====
HWND g_hMainWnd = nullptr;
HWND g_hListView = nullptr;
HWND g_hStatusBar = nullptr;
HWND g_hBtnList = nullptr;
HWND g_hBtnMonitor = nullptr;
HWND g_hBtnProviders = nullptr;
HWND g_hBtnExport = nullptr;

std::vector<VSSSnapshot> g_snapshots;
std::mutex g_dataMutex;
std::wstring g_logFilePath;

constexpr int ID_BTN_LIST = 1001;
constexpr int ID_BTN_MONITOR = 1002;
constexpr int ID_BTN_PROVIDERS = 1003;
constexpr int ID_BTN_EXPORT = 1004;
constexpr int ID_LISTVIEW = 2001;
constexpr int ID_STATUSBAR = 3001;

// ===== Logging =====
void InitLog() {
    wchar_t tempPath[MAX_PATH];
    GetTempPathW(MAX_PATH, tempPath);
    g_logFilePath = std::wstring(tempPath) + L"WinTools_VSSIntegrityWatcher_log.txt";
}

void Log(const std::wstring& message) {
    SYSTEMTIME st;
    GetLocalTime(&st);

    std::wofstream logFile(g_logFilePath, std::ios::app);
    if (logFile.is_open()) {
        logFile << std::setfill(L'0')
                << std::setw(4) << st.wYear << L"-"
                << std::setw(2) << st.wMonth << L"-"
                << std::setw(2) << st.wDay << L" "
                << std::setw(2) << st.wHour << L":"
                << std::setw(2) << st.wMinute << L":"
                << std::setw(2) << st.wSecond << L" | "
                << message << std::endl;
        logFile.close();
    }
}

// ===== Utilitaires =====
std::wstring GUIDToString(const GUID& guid) {
    wchar_t buffer[128];
    StringFromGUID2(guid, buffer, 128);
    return std::wstring(buffer);
}

std::wstring FileTimeToString(const FILETIME& ft) {
    SYSTEMTIME st;
    FileTimeToSystemTime(&ft, &st);

    std::wstringstream ss;
    ss << std::setfill(L'0')
       << std::setw(4) << st.wYear << L"-"
       << std::setw(2) << st.wMonth << L"-"
       << std::setw(2) << st.wDay << L" "
       << std::setw(2) << st.wHour << L":"
       << std::setw(2) << st.wMinute << L":"
       << std::setw(2) << st.wSecond;

    return ss.str();
}

std::wstring HumanizeVSSError(HRESULT hr) {
    switch (hr) {
    case VSS_E_BAD_STATE:
        return L"VSS_E_BAD_STATE: Service dans un état incorrect";
    case VSS_E_PROVIDER_NOT_REGISTERED:
        return L"VSS_E_PROVIDER_NOT_REGISTERED: Provider non enregistré";
    case VSS_E_PROVIDER_VETO:
        return L"VSS_E_PROVIDER_VETO: Provider a refusé l'opération";
    case VSS_E_OBJECT_NOT_FOUND:
        return L"VSS_E_OBJECT_NOT_FOUND: Objet VSS introuvable";
    case VSS_E_VOLUME_NOT_SUPPORTED:
        return L"VSS_E_VOLUME_NOT_SUPPORTED: Volume non supporté";
    case VSS_E_VOLUME_NOT_SUPPORTED_BY_PROVIDER:
        return L"VSS_E_VOLUME_NOT_SUPPORTED_BY_PROVIDER: Volume non supporté par provider";
    case VSS_E_UNEXPECTED:
        return L"VSS_E_UNEXPECTED: Erreur inattendue";
    case VSS_E_INSUFFICIENT_STORAGE:
        return L"VSS_E_INSUFFICIENT_STORAGE: Espace de stockage insuffisant";
    case E_ACCESSDENIED:
        return L"E_ACCESSDENIED: Accès refusé (privilèges insuffisants)";
    default:
        wchar_t buffer[32];
        swprintf_s(buffer, L"HRESULT: 0x%08X", hr);
        return buffer;
    }
}

// ===== ListView =====
void InitListView() {
    LVCOLUMNW lvc = {0};
    lvc.mask = LVCF_TEXT | LVCF_WIDTH | LVCF_FMT;
    lvc.fmt = LVCFMT_LEFT;

    lvc.pszText = (LPWSTR)L"Snapshot ID";
    lvc.cx = 280;
    ListView_InsertColumn(g_hListView, 0, &lvc);

    lvc.pszText = (LPWSTR)L"Volume";
    lvc.cx = 100;
    ListView_InsertColumn(g_hListView, 1, &lvc);

    lvc.pszText = (LPWSTR)L"Création";
    lvc.cx = 150;
    ListView_InsertColumn(g_hListView, 2, &lvc);

    lvc.pszText = (LPWSTR)L"Taille";
    lvc.cx = 100;
    ListView_InsertColumn(g_hListView, 3, &lvc);

    lvc.pszText = (LPWSTR)L"Provider";
    lvc.cx = 150;
    ListView_InsertColumn(g_hListView, 4, &lvc);

    lvc.pszText = (LPWSTR)L"État";
    lvc.cx = 150;
    ListView_InsertColumn(g_hListView, 5, &lvc);

    ListView_SetExtendedListViewStyle(g_hListView, LVS_EX_FULLROWSELECT | LVS_EX_GRIDLINES | LVS_EX_DOUBLEBUFFER);
}

void UpdateListView() {
    std::lock_guard<std::mutex> lock(g_dataMutex);

    ListView_DeleteAllItems(g_hListView);

    for (size_t i = 0; i < g_snapshots.size(); ++i) {
        LVITEMW lvi = {0};
        lvi.mask = LVIF_TEXT;
        lvi.iItem = (int)i;

        lvi.iSubItem = 0;
        lvi.pszText = (LPWSTR)g_snapshots[i].snapshotID.c_str();
        ListView_InsertItem(g_hListView, &lvi);

        ListView_SetItemText(g_hListView, (int)i, 1, (LPWSTR)g_snapshots[i].volume.c_str());
        ListView_SetItemText(g_hListView, (int)i, 2, (LPWSTR)g_snapshots[i].creation.c_str());
        ListView_SetItemText(g_hListView, (int)i, 3, (LPWSTR)g_snapshots[i].taille.c_str());
        ListView_SetItemText(g_hListView, (int)i, 4, (LPWSTR)g_snapshots[i].provider.c_str());
        ListView_SetItemText(g_hListView, (int)i, 5, (LPWSTR)g_snapshots[i].etat.c_str());
    }

    std::wstring status = L"Snapshots listés: " + std::to_wstring(g_snapshots.size());
    SendMessageW(g_hStatusBar, SB_SETTEXTW, 0, (LPARAM)status.c_str());
}

// ===== Lister Snapshots =====
void ListSnapshots() {
    Log(L"Début listage snapshots VSS");

    std::vector<VSSSnapshot> snapshots;

    HRESULT hr = CoInitializeEx(nullptr, COINIT_MULTITHREADED);
    if (FAILED(hr) && hr != RPC_E_CHANGED_MODE) {
        Log(L"Erreur CoInitialize: " + HumanizeVSSError(hr));
        MessageBoxW(g_hMainWnd, L"Impossible d'initialiser COM.", L"Erreur", MB_ICONERROR);
        return;
    }

    IVssBackupComponents* pBackup = nullptr;
    hr = CreateVssBackupComponents(&pBackup);
    if (FAILED(hr)) {
        Log(L"Erreur CreateVssBackupComponents: " + HumanizeVSSError(hr));
        MessageBoxW(g_hMainWnd, (L"Erreur VSS: " + HumanizeVSSError(hr)).c_str(), L"Erreur", MB_ICONERROR);
        CoUninitialize();
        return;
    }

    hr = pBackup->InitializeForBackup();
    if (FAILED(hr)) {
        Log(L"Erreur InitializeForBackup: " + HumanizeVSSError(hr));
        pBackup->Release();
        CoUninitialize();
        return;
    }

    hr = pBackup->SetContext(VSS_CTX_ALL);
    if (FAILED(hr)) {
        Log(L"Erreur SetContext: " + HumanizeVSSError(hr));
    }

    IVssEnumObject* pEnum = nullptr;
    hr = pBackup->Query(GUID_NULL, VSS_OBJECT_NONE, VSS_OBJECT_SNAPSHOT, &pEnum);
    if (FAILED(hr)) {
        Log(L"Erreur Query snapshots: " + HumanizeVSSError(hr));
        pBackup->Release();
        CoUninitialize();
        return;
    }

    VSS_OBJECT_PROP prop;
    ULONG fetched = 0;

    while (pEnum->Next(1, &prop, &fetched) == S_OK && fetched > 0) {
        if (prop.Type == VSS_OBJECT_SNAPSHOT) {
            VSSSnapshot snap;
            snap.snapshotID = GUIDToString(prop.Obj.Snap.m_SnapshotId);
            snap.volume = prop.Obj.Snap.m_pwszOriginalVolumeName ? prop.Obj.Snap.m_pwszOriginalVolumeName : L"N/A";

            FILETIME ft;
            ft.dwLowDateTime = prop.Obj.Snap.m_tsCreationTimestamp & 0xFFFFFFFF;
            ft.dwHighDateTime = prop.Obj.Snap.m_tsCreationTimestamp >> 32;
            snap.creation = FileTimeToString(ft);

            snap.taille = L"N/A"; // VSS ne fournit pas la taille directement
            snap.provider = GUIDToString(prop.Obj.Snap.m_ProviderId);

            switch (prop.Obj.Snap.m_eStatus) {
            case VSS_SS_CREATED:
                snap.etat = L"Créé";
                break;
            case VSS_SS_PREPARING:
                snap.etat = L"Préparation";
                break;
            case VSS_SS_PROCESSING_PREPARE:
                snap.etat = L"Traitement préparation";
                break;
            case VSS_SS_PREPARED:
                snap.etat = L"Préparé";
                break;
            case VSS_SS_PROCESSING_PRECOMMIT:
                snap.etat = L"Traitement pré-commit";
                break;
            case VSS_SS_PRECOMMITTED:
                snap.etat = L"Pré-commité";
                break;
            case VSS_SS_PROCESSING_COMMIT:
                snap.etat = L"Traitement commit";
                break;
            case VSS_SS_COMMITTED:
                snap.etat = L"Commité";
                break;
            case VSS_SS_PROCESSING_POSTCOMMIT:
                snap.etat = L"Traitement post-commit";
                break;
            case VSS_SS_PROCESSING_PREFINALCOMMIT:
                snap.etat = L"Traitement pré-final";
                break;
            case VSS_SS_PREFINALCOMMITTED:
                snap.etat = L"Pré-final commité";
                break;
            case VSS_SS_PROCESSING_POSTFINALCOMMIT:
                snap.etat = L"Traitement post-final";
                break;
            default:
                snap.etat = L"Inconnu";
            }

            snapshots.push_back(snap);
        }

        VssFreeSnapshotProperties(&prop.Obj.Snap);
    }

    pEnum->Release();
    pBackup->Release();
    CoUninitialize();

    if (snapshots.empty()) {
        VSSSnapshot snap;
        snap.snapshotID = L"Aucun snapshot trouvé";
        snap.volume = L"-";
        snap.creation = L"-";
        snap.taille = L"-";
        snap.provider = L"-";
        snap.etat = L"-";
        snapshots.push_back(snap);
    }

    {
        std::lock_guard<std::mutex> lock(g_dataMutex);
        g_snapshots = snapshots;
    }

    Log(L"Snapshots listés: " + std::to_wstring(snapshots.size()));

    PostMessageW(g_hMainWnd, WM_USER + 1, 0, 0);
}

// ===== Lister Providers =====
void ListProviders() {
    Log(L"Début listage providers VSS");

    std::vector<VSSSnapshot> providers;

    HRESULT hr = CoInitializeEx(nullptr, COINIT_MULTITHREADED);
    if (FAILED(hr) && hr != RPC_E_CHANGED_MODE) {
        Log(L"Erreur CoInitialize: " + HumanizeVSSError(hr));
        MessageBoxW(g_hMainWnd, L"Impossible d'initialiser COM.", L"Erreur", MB_ICONERROR);
        return;
    }

    IVssBackupComponents* pBackup = nullptr;
    hr = CreateVssBackupComponents(&pBackup);
    if (FAILED(hr)) {
        Log(L"Erreur CreateVssBackupComponents: " + HumanizeVSSError(hr));
        MessageBoxW(g_hMainWnd, (L"Erreur VSS: " + HumanizeVSSError(hr)).c_str(), L"Erreur", MB_ICONERROR);
        CoUninitialize();
        return;
    }

    hr = pBackup->InitializeForBackup();
    if (FAILED(hr)) {
        Log(L"Erreur InitializeForBackup: " + HumanizeVSSError(hr));
        pBackup->Release();
        CoUninitialize();
        return;
    }

    IVssEnumObject* pEnum = nullptr;
    hr = pBackup->Query(GUID_NULL, VSS_OBJECT_NONE, VSS_OBJECT_PROVIDER, &pEnum);
    if (FAILED(hr)) {
        Log(L"Erreur Query providers: " + HumanizeVSSError(hr));
        pBackup->Release();
        CoUninitialize();
        return;
    }

    VSS_OBJECT_PROP prop;
    ULONG fetched = 0;

    while (pEnum->Next(1, &prop, &fetched) == S_OK && fetched > 0) {
        if (prop.Type == VSS_OBJECT_PROVIDER) {
            VSSSnapshot prov;
            prov.snapshotID = GUIDToString(prop.Obj.Prov.m_ProviderId);
            prov.volume = prop.Obj.Prov.m_pwszProviderName ? prop.Obj.Prov.m_pwszProviderName : L"N/A";
            prov.creation = prop.Obj.Prov.m_pwszProviderVersion ? prop.Obj.Prov.m_pwszProviderVersion : L"N/A";

            switch (prop.Obj.Prov.m_eProviderType) {
            case VSS_PROV_SYSTEM:
                prov.taille = L"System";
                break;
            case VSS_PROV_SOFTWARE:
                prov.taille = L"Software";
                break;
            case VSS_PROV_HARDWARE:
                prov.taille = L"Hardware";
                break;
            default:
                prov.taille = L"Inconnu";
            }

            prov.provider = L"Provider VSS";
            prov.etat = L"Enregistré";

            providers.push_back(prov);
        }

        CoTaskMemFree(prop.Obj.Prov.m_pwszProviderName);
        CoTaskMemFree(prop.Obj.Prov.m_pwszProviderVersion);
    }

    pEnum->Release();
    pBackup->Release();
    CoUninitialize();

    if (providers.empty()) {
        VSSSnapshot prov;
        prov.snapshotID = L"Aucun provider trouvé";
        prov.volume = L"-";
        prov.creation = L"-";
        prov.taille = L"-";
        prov.provider = L"-";
        prov.etat = L"-";
        providers.push_back(prov);
    }

    {
        std::lock_guard<std::mutex> lock(g_dataMutex);
        g_snapshots = providers;
    }

    Log(L"Providers listés: " + std::to_wstring(providers.size()));

    PostMessageW(g_hMainWnd, WM_USER + 1, 0, 0);
}

// ===== Monitor événements VSS =====
void MonitorVSSEvents() {
    Log(L"Début monitoring événements VSS");

    std::vector<VSSSnapshot> events;

    // Query System Event Log pour VSS errors
    // Event ID 8193, 8194 (Volume Shadow Copy Service)
    std::wstring query = L"*[System[Provider[@Name='volsnap'] and (EventID=8193 or EventID=8194 or EventID=36)]]";

    EVT_HANDLE hResults = EvtQuery(nullptr, L"System", query.c_str(),
                                   EvtQueryChannelPath | EvtQueryReverseDirection);

    if (!hResults) {
        Log(L"Impossible de lire Event Log System");
        MessageBoxW(g_hMainWnd, L"Impossible de lire les événements système.", L"Erreur", MB_ICONERROR);
        return;
    }

    EVT_HANDLE hEvent = nullptr;
    DWORD returned = 0;
    int eventCount = 0;

    while (EvtNext(hResults, 1, &hEvent, INFINITE, 0, &returned) && eventCount < 20) {
        DWORD bufferSize = 0;
        DWORD bufferUsed = 0;
        DWORD propertyCount = 0;

        EvtRender(nullptr, hEvent, EvtRenderEventXml, bufferSize, nullptr, &bufferUsed, &propertyCount);

        if (bufferUsed > 0) {
            std::vector<wchar_t> buffer(bufferUsed / sizeof(wchar_t) + 1);
            if (EvtRender(nullptr, hEvent, EvtRenderEventXml, bufferUsed, buffer.data(), &bufferUsed, &propertyCount)) {
                std::wstring eventXml(buffer.data());

                VSSSnapshot evt;
                evt.snapshotID = L"Event VSS";

                // Extraire EventID
                size_t idPos = eventXml.find(L"<EventID>");
                if (idPos != std::wstring::npos) {
                    idPos += 9;
                    size_t idEnd = eventXml.find(L"</EventID>", idPos);
                    evt.volume = L"ID: " + eventXml.substr(idPos, idEnd - idPos);
                }

                // Extraire TimeCreated
                size_t timePos = eventXml.find(L"SystemTime='");
                if (timePos != std::wstring::npos) {
                    timePos += 12;
                    size_t timeEnd = eventXml.find(L"'", timePos);
                    evt.creation = eventXml.substr(timePos, timeEnd - timePos);
                }

                evt.taille = L"Erreur VSS";
                evt.provider = L"volsnap";
                evt.etat = L"Voir Event Log pour détails";

                events.push_back(evt);
            }
        }

        EvtClose(hEvent);
        eventCount++;
    }

    EvtClose(hResults);

    if (events.empty()) {
        VSSSnapshot evt;
        evt.snapshotID = L"Aucune erreur VSS récente";
        evt.volume = L"-";
        evt.creation = L"-";
        evt.taille = L"-";
        evt.provider = L"-";
        evt.etat = L"Système sain";
        events.push_back(evt);
    }

    {
        std::lock_guard<std::mutex> lock(g_dataMutex);
        g_snapshots = events;
    }

    Log(L"Événements VSS analysés: " + std::to_wstring(events.size()));

    PostMessageW(g_hMainWnd, WM_USER + 1, 0, 0);
}

// ===== Export CSV =====
void ExportToCSV() {
    OPENFILENAMEW ofn = {0};
    wchar_t szFile[MAX_PATH] = L"VSSSnapshots.csv";

    ofn.lStructSize = sizeof(ofn);
    ofn.hwndOwner = g_hMainWnd;
    ofn.lpstrFile = szFile;
    ofn.nMaxFile = MAX_PATH;
    ofn.lpstrFilter = L"CSV Files (*.csv)\0*.csv\0All Files (*.*)\0*.*\0";
    ofn.lpstrTitle = L"Exporter les snapshots VSS";
    ofn.Flags = OFN_OVERWRITEPROMPT | OFN_PATHMUSTEXIST;
    ofn.lpstrDefExt = L"csv";

    if (!GetSaveFileNameW(&ofn)) return;

    std::ofstream csvFile(szFile, std::ios::binary);
    if (!csvFile.is_open()) {
        MessageBoxW(g_hMainWnd, L"Impossible d'ouvrir le fichier pour l'export.", L"Erreur", MB_ICONERROR);
        return;
    }

    // BOM UTF-8
    csvFile << "\xEF\xBB\xBF";

    // En-têtes
    csvFile << "Snapshot ID;Volume;Création;Taille;Provider;État\n";

    std::lock_guard<std::mutex> lock(g_dataMutex);
    for (const auto& snap : g_snapshots) {
        std::wstring line = snap.snapshotID + L";" +
                           snap.volume + L";" +
                           snap.creation + L";" +
                           snap.taille + L";" +
                           snap.provider + L";" +
                           snap.etat + L"\n";

        int len = WideCharToMultiByte(CP_UTF8, 0, line.c_str(), -1, nullptr, 0, nullptr, nullptr);
        char* utf8 = new char[len];
        WideCharToMultiByte(CP_UTF8, 0, line.c_str(), -1, utf8, len, nullptr, nullptr);
        csvFile << utf8;
        delete[] utf8;
    }

    csvFile.close();

    Log(L"Export CSV: " + std::wstring(szFile));
    MessageBoxW(g_hMainWnd, L"Export terminé avec succès.", L"Information", MB_ICONINFORMATION);
}

// ===== Window Procedure =====
LRESULT CALLBACK WndProc(HWND hWnd, UINT message, WPARAM wParam, LPARAM lParam) {
    switch (message) {
    case WM_CREATE: {
        HFONT hFont = CreateFontW(16, 0, 0, 0, FW_NORMAL, FALSE, FALSE, FALSE,
            DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
            DEFAULT_QUALITY, DEFAULT_PITCH | FF_DONTCARE, L"Segoe UI");

        g_hListView = CreateWindowExW(0, WC_LISTVIEWW, L"",
            WS_CHILD | WS_VISIBLE | LVS_REPORT | LVS_SINGLESEL | WS_BORDER,
            10, 10, 960, 450, hWnd, (HMENU)ID_LISTVIEW, GetModuleHandle(nullptr), nullptr);
        SendMessageW(g_hListView, WM_SETFONT, (WPARAM)hFont, TRUE);
        InitListView();

        g_hBtnList = CreateWindowExW(0, L"BUTTON", L"Lister Snapshots",
            WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
            10, 470, 180, 35, hWnd, (HMENU)ID_BTN_LIST, GetModuleHandle(nullptr), nullptr);
        SendMessageW(g_hBtnList, WM_SETFONT, (WPARAM)hFont, TRUE);

        g_hBtnMonitor = CreateWindowExW(0, L"BUTTON", L"Monitorer Événements",
            WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
            200, 470, 180, 35, hWnd, (HMENU)ID_BTN_MONITOR, GetModuleHandle(nullptr), nullptr);
        SendMessageW(g_hBtnMonitor, WM_SETFONT, (WPARAM)hFont, TRUE);

        g_hBtnProviders = CreateWindowExW(0, L"BUTTON", L"Vérifier Providers",
            WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
            390, 470, 180, 35, hWnd, (HMENU)ID_BTN_PROVIDERS, GetModuleHandle(nullptr), nullptr);
        SendMessageW(g_hBtnProviders, WM_SETFONT, (WPARAM)hFont, TRUE);

        g_hBtnExport = CreateWindowExW(0, L"BUTTON", L"Exporter",
            WS_CHILD | WS_VISIBLE | BS_PUSHBUTTON,
            580, 470, 180, 35, hWnd, (HMENU)ID_BTN_EXPORT, GetModuleHandle(nullptr), nullptr);
        SendMessageW(g_hBtnExport, WM_SETFONT, (WPARAM)hFont, TRUE);

        g_hStatusBar = CreateWindowExW(0, STATUSCLASSNAMEW, nullptr,
            WS_CHILD | WS_VISIBLE | SBARS_SIZEGRIP,
            0, 0, 0, 0, hWnd, (HMENU)ID_STATUSBAR, GetModuleHandle(nullptr), nullptr);
        SendMessageW(g_hStatusBar, WM_SETFONT, (WPARAM)hFont, TRUE);
        SendMessageW(g_hStatusBar, SB_SETTEXTW, 0, (LPARAM)L"Prêt - Ayi NEDJIMI Consultants");

        return 0;
    }

    case WM_SIZE: {
        int width = LOWORD(lParam);
        int height = HIWORD(lParam);

        MoveWindow(g_hListView, 10, 10, width - 20, height - 120, TRUE);
        MoveWindow(g_hBtnList, 10, height - 100, 180, 35, TRUE);
        MoveWindow(g_hBtnMonitor, 200, height - 100, 180, 35, TRUE);
        MoveWindow(g_hBtnProviders, 390, height - 100, 180, 35, TRUE);
        MoveWindow(g_hBtnExport, 580, height - 100, 180, 35, TRUE);
        SendMessageW(g_hStatusBar, WM_SIZE, 0, 0);
        return 0;
    }

    case WM_COMMAND: {
        switch (LOWORD(wParam)) {
        case ID_BTN_LIST:
            EnableWindow(g_hBtnList, FALSE);
            SendMessageW(g_hStatusBar, SB_SETTEXTW, 0, (LPARAM)L"Listage des snapshots...");
            std::thread([]() {
                ListSnapshots();
                EnableWindow(g_hBtnList, TRUE);
            }).detach();
            break;

        case ID_BTN_MONITOR:
            EnableWindow(g_hBtnMonitor, FALSE);
            SendMessageW(g_hStatusBar, SB_SETTEXTW, 0, (LPARAM)L"Analyse des événements VSS...");
            std::thread([]() {
                MonitorVSSEvents();
                EnableWindow(g_hBtnMonitor, TRUE);
            }).detach();
            break;

        case ID_BTN_PROVIDERS:
            EnableWindow(g_hBtnProviders, FALSE);
            SendMessageW(g_hStatusBar, SB_SETTEXTW, 0, (LPARAM)L"Vérification des providers...");
            std::thread([]() {
                ListProviders();
                EnableWindow(g_hBtnProviders, TRUE);
            }).detach();
            break;

        case ID_BTN_EXPORT:
            ExportToCSV();
            break;
        }
        return 0;
    }

    case WM_USER + 1:
        UpdateListView();
        return 0;

    case WM_DESTROY:
        PostQuitMessage(0);
        return 0;
    }

    return DefWindowProcW(hWnd, message, wParam, lParam);
}

// ===== WinMain =====
int WINAPI wWinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPWSTR lpCmdLine, int nCmdShow) {
    InitLog();
    Log(L"=== VSSIntegrityWatcher démarré ===");

    INITCOMMONCONTROLSEX icex = {0};
    icex.dwSize = sizeof(icex);
    icex.dwICC = ICC_LISTVIEW_CLASSES | ICC_BAR_CLASSES;
    InitCommonControlsEx(&icex);

    WNDCLASSEXW wcex = {0};
    wcex.cbSize = sizeof(wcex);
    wcex.style = CS_HREDRAW | CS_VREDRAW;
    wcex.lpfnWndProc = WndProc;
    wcex.hInstance = hInstance;
    wcex.hCursor = LoadCursor(nullptr, IDC_ARROW);
    wcex.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
    wcex.lpszClassName = L"VSSIntegrityWatcherClass";
    wcex.hIcon = LoadIcon(nullptr, IDI_APPLICATION);
    wcex.hIconSm = LoadIcon(nullptr, IDI_APPLICATION);

    RegisterClassExW(&wcex);

    g_hMainWnd = CreateWindowExW(0, L"VSSIntegrityWatcherClass",
        L"VSSIntegrityWatcher - Ayi NEDJIMI Consultants",
        WS_OVERLAPPEDWINDOW,
        CW_USEDEFAULT, CW_USEDEFAULT, 1000, 600,
        nullptr, nullptr, hInstance, nullptr);

    if (!g_hMainWnd) return 1;

    ShowWindow(g_hMainWnd, nCmdShow);
    UpdateWindow(g_hMainWnd);

    MSG msg;
    while (GetMessageW(&msg, nullptr, 0, 0)) {
        TranslateMessage(&msg);
        DispatchMessageW(&msg);
    }

    Log(L"=== VSSIntegrityWatcher arrêté ===");
    return (int)msg.wParam;
}