Fix: Repair task actions and harden machine management
Scheduled task actions never worked end to end: the server built task packets with Unicode-style lengths in a MultiByte build, the client had no dispatch for the run/stop/delete/create commands, and the directory column was derived by replacing every occurrence of the task name, which misplaced tasks whose name also appeared in a parent folder. Packets are now assembled with narrow strings, the four commands are routed to RunOrStopTask/DelTask/CreateTask, and the folder is taken from the task path suffix only. The task list reply is trimmed to its real length instead of sending the whole 32 KB scratch buffer. On the client side, thawing a process resumed a single thread, the inject output path was copied from a narrow string using a wide-character length, and an empty window list dereferenced a NULL buffer. The service list leaked its enumeration block and one service handle per skipped entry, and the description was copied without a bound. Service start and stop now validate every handle, initialize the status structure, and stop synchronously before the start that follows a restart request, which previously always failed because the service was still in STOP_PENDING. Deleting a process used to test only the low byte of the PID and leaked the process handle on early exits, and a failed path conversion kept the previous process image name. The IE history timestamp wrote minutes and seconds in the wrong order, the favorites reader queried and closed an uninitialized registry key, software enumeration never closed its subkeys, and the task scheduler objects were not released after use. The network state list now frees the module, snapshot, and extended tables on every exit path, uses HeapFree for tables allocated on the process heap, and no longer calls an export that may be missing. Growth failures everywhere keep the original buffer instead of overwriting the pointer, the hosts reader rejects an invalid file size, and the COM task walk releases definitions and folders. Co-Authored-By: deepseek-flash
This commit is contained in:
yuanyuanxianganddeepseek-flash committed
1 parent
c208b7368e
commit
6c8336b497
3 files changed
+435
-127
No files matched your search
@@ -721,8 +721,19 @@ void CMachineDlg::ShowTaskList()
|
||||
continue;
|
||||
m_list.InsertItem(i, str);
|
||||
|
||||
// 目录列：只去掉末尾“\任务名”。不能用 Replace 全量替换——任务名也可能出现在父目录里，
|
||||
// 那样算出的目录是错的，执行/停止/删除任务会定位到错误的文件夹。
|
||||
str = taskpath;
|
||||
str.Replace(taskname, _T(""));
|
||||
{
|
||||
CString tail = _T("\\");
|
||||
tail += taskname;
|
||||
if (str.GetLength() >= tail.GetLength() &&
|
||||
str.Right(tail.GetLength()).CompareNoCase(tail) == 0) {
|
||||
str = str.Left(str.GetLength() - tail.GetLength());
|
||||
if (str.IsEmpty())
|
||||
str = _T("\\");
|
||||
}
|
||||
}
|
||||
// 任务名/目录/程序路径来自客户端 BSTRToUTF8，为 UTF-8；状态为 GBK 字面量（运行中/已禁用…）
|
||||
SetMachineItemText(m_list, i, 1, str.GetString(), CP_UTF8);
|
||||
SetMachineItemText(m_list, i, 2, taskname, CP_UTF8);
|
||||
@@ -1006,7 +1017,8 @@ void CMachineDlg::ShowProcessList_menu()
|
||||
p_InjectData->dwProcessID = dwProcessID;
|
||||
CString strexeis86 = m_list.GetItemText(nItem, 9);
|
||||
strexeis86 == _T("x86") ? p_InjectData->ExeIsx86 = 1 : p_InjectData->ExeIsx86 = 0;
|
||||
memcpy(p_InjectData->strpath, dlg.Str_remote, dlg.Str_remote.GetLength() * 2 + 2);
|
||||
// Str_remote 是窄字符串、strpath 是 char[1024]：按字符数+1 拷贝；超长时截断，避免堆溢出
|
||||
strncpy_s(p_InjectData->strpath, sizeof(p_InjectData->strpath), dlg.Str_remote, _TRUNCATE);
|
||||
//读取文件
|
||||
BYTE* lpBuffer = NULL;
|
||||
HANDLE hFile = CreateFile(dlg.Str_loacal, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
|
||||
@@ -1412,16 +1424,18 @@ void CMachineDlg::ShowTaskList_menu()
|
||||
taskpath = m_list.GetItemText(nItem, 1);
|
||||
taskname = m_list.GetItemText(nItem, 2);
|
||||
|
||||
int nPacketLength = lstrlen(taskpath.GetBuffer()) * 2 + lstrlen(taskname.GetBuffer()) * 2 + 5;
|
||||
// 服务端是 MultiByte 工程：按窄字符拼接，包长 = 1(令牌) + (目录+1) + (任务名+1)
|
||||
int nPacketLength = lstrlen(taskpath.GetBuffer()) + lstrlen(taskname.GetBuffer()) + 3;
|
||||
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
|
||||
if (!lpBuffer) return;
|
||||
lpBuffer[0] = COMMAND_TASKSTART;
|
||||
offset++;
|
||||
|
||||
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(taskpath.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) + 1);
|
||||
offset += lstrlen(taskpath.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(taskname.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) + 1);
|
||||
offset += lstrlen(taskname.GetBuffer()) + 1;
|
||||
|
||||
m_ContextObject->Send2Client(lpBuffer, nPacketLength);
|
||||
|
||||
@@ -1440,16 +1454,18 @@ void CMachineDlg::ShowTaskList_menu()
|
||||
taskpath = m_list.GetItemText(nItem, 1);
|
||||
taskname = m_list.GetItemText(nItem, 2);
|
||||
|
||||
int nPacketLength = lstrlen(taskpath.GetBuffer()) * 2 + lstrlen(taskname.GetBuffer()) * 2 + 5;
|
||||
// 服务端是 MultiByte 工程：按窄字符拼接，包长 = 1(令牌) + (目录+1) + (任务名+1)
|
||||
int nPacketLength = lstrlen(taskpath.GetBuffer()) + lstrlen(taskname.GetBuffer()) + 3;
|
||||
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
|
||||
if (!lpBuffer) return;
|
||||
lpBuffer[0] = COMMAND_TASKSTOP;
|
||||
offset++;
|
||||
|
||||
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(taskpath.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) + 1);
|
||||
offset += lstrlen(taskpath.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(taskname.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) + 1);
|
||||
offset += lstrlen(taskname.GetBuffer()) + 1;
|
||||
|
||||
m_ContextObject->Send2Client(lpBuffer, nPacketLength);
|
||||
|
||||
@@ -1468,16 +1484,18 @@ void CMachineDlg::ShowTaskList_menu()
|
||||
taskpath = m_list.GetItemText(nItem, 1);
|
||||
taskname = m_list.GetItemText(nItem, 2);
|
||||
|
||||
int nPacketLength = lstrlen(taskpath.GetBuffer()) * 2 + lstrlen(taskname.GetBuffer()) * 2 + 5;
|
||||
// 服务端是 MultiByte 工程：按窄字符拼接，包长 = 1(令牌) + (目录+1) + (任务名+1)
|
||||
int nPacketLength = lstrlen(taskpath.GetBuffer()) + lstrlen(taskname.GetBuffer()) + 3;
|
||||
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
|
||||
if (!lpBuffer) return;
|
||||
lpBuffer[0] = COMMAND_TASKDEL;
|
||||
offset++;
|
||||
|
||||
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(taskpath.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) + 1);
|
||||
offset += lstrlen(taskpath.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(taskname.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) + 1);
|
||||
offset += lstrlen(taskname.GetBuffer()) + 1;
|
||||
|
||||
m_ContextObject->Send2Client(lpBuffer, nPacketLength);
|
||||
|
||||
@@ -1489,28 +1507,28 @@ void CMachineDlg::ShowTaskList_menu()
|
||||
DWORD offset = 0;
|
||||
CCreateTaskDlg* dlg = new CCreateTaskDlg(this);
|
||||
if (IDOK == dlg->DoModal()) {
|
||||
// 计算字符串长度
|
||||
len = lstrlen(dlg->m_TaskPath.GetBuffer()) * 2 + lstrlen(dlg->m_TaskNames.GetBuffer()) * 2 + lstrlen(dlg->m_ExePath.GetBuffer()) *
|
||||
2 + lstrlen(dlg->m_Author.GetBuffer()) * 2 + lstrlen(dlg->m_Description.GetBuffer()) * 2 + 12;
|
||||
// 服务端是 MultiByte 工程：5 个窄字符串各带 1 字节结束符，再加 1 字节令牌
|
||||
len = lstrlen(dlg->m_TaskPath.GetBuffer()) + lstrlen(dlg->m_TaskNames.GetBuffer()) + lstrlen(dlg->m_ExePath.GetBuffer()) +
|
||||
lstrlen(dlg->m_Author.GetBuffer()) + lstrlen(dlg->m_Description.GetBuffer()) + 6;
|
||||
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, len);
|
||||
if (lpBuffer) {
|
||||
lpBuffer[0] = COMMAND_TASKCREAT;
|
||||
offset++;
|
||||
|
||||
memcpy(lpBuffer + offset, dlg->m_TaskPath.GetBuffer(), lstrlen(dlg->m_TaskPath.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(dlg->m_TaskPath.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, dlg->m_TaskPath.GetBuffer(), lstrlen(dlg->m_TaskPath.GetBuffer()) + 1);
|
||||
offset += lstrlen(dlg->m_TaskPath.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, dlg->m_TaskNames.GetBuffer(), lstrlen(dlg->m_TaskNames.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(dlg->m_TaskNames.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, dlg->m_TaskNames.GetBuffer(), lstrlen(dlg->m_TaskNames.GetBuffer()) + 1);
|
||||
offset += lstrlen(dlg->m_TaskNames.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, dlg->m_ExePath.GetBuffer(), lstrlen(dlg->m_ExePath.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(dlg->m_ExePath.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, dlg->m_ExePath.GetBuffer(), lstrlen(dlg->m_ExePath.GetBuffer()) + 1);
|
||||
offset += lstrlen(dlg->m_ExePath.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, dlg->m_Author.GetBuffer(), lstrlen(dlg->m_Author.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(dlg->m_Author.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, dlg->m_Author.GetBuffer(), lstrlen(dlg->m_Author.GetBuffer()) + 1);
|
||||
offset += lstrlen(dlg->m_Author.GetBuffer()) + 1;
|
||||
|
||||
memcpy(lpBuffer + offset, dlg->m_Description.GetBuffer(), lstrlen(dlg->m_Description.GetBuffer()) * 2 + 2);
|
||||
offset += lstrlen(dlg->m_Description.GetBuffer()) * 2 + 2;
|
||||
memcpy(lpBuffer + offset, dlg->m_Description.GetBuffer(), lstrlen(dlg->m_Description.GetBuffer()) + 1);
|
||||
offset += lstrlen(dlg->m_Description.GetBuffer()) + 1;
|
||||
m_ContextObject->Send2Client(lpBuffer, len);
|
||||
|
||||
LocalFree(lpBuffer);
|
||||
|
||||
Reference in new issue
Block a user