yuanyuanxiang/SimpleRemoter
0
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

Fix: Repair task actions and harden machine management

Browse Source 
Scheduled task actions never worked end to end: the server built task
packets with Unicode-style lengths in a MultiByte build, the client had
no dispatch for the run/stop/delete/create commands, and the directory
column was derived by replacing every occurrence of the task name, which
misplaced tasks whose name also appeared in a parent folder. Packets are
now assembled with narrow strings, the four commands are routed to
RunOrStopTask/DelTask/CreateTask, and the folder is taken from the task
path suffix only. The task list reply is trimmed to its real length
instead of sending the whole 32 KB scratch buffer.

On the client side, thawing a process resumed a single thread, the
inject output path was copied from a narrow string using a wide-character
length, and an empty window list dereferenced a NULL buffer. The service
list leaked its enumeration block and one service handle per skipped
entry, and the description was copied without a bound. Service start and
stop now validate every handle, initialize the status structure, and stop
synchronously before the start that follows a restart request, which
previously always failed because the service was still in STOP_PENDING.
Deleting a process used to test only the low byte of the PID and leaked
the process handle on early exits, and a failed path conversion kept the
previous process image name. The IE history timestamp wrote minutes and
seconds in the wrong order, the favorites reader queried and closed an
uninitialized registry key, software enumeration never closed its subkeys,
and the task scheduler objects were not released after use.

The network state list now frees the module, snapshot, and extended
tables on every exit path, uses HeapFree for tables allocated on the
process heap, and no longer calls an export that may be missing. Growth
failures everywhere keep the original buffer instead of overwriting the
pointer, the hosts reader rejects an invalid file size, and the COM task
walk releases definitions and folders.

Co-Authored-By: deepseek-flash
This commit is contained in:
yuanyuanxianganddeepseek-flash committed 2026-10-20 21:48:13 +02:00
1 parent c208b7368e
commit 6c8336b497
3 files changed
+435 -127
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

server/2015Remote/sys/MachineDlg.cpp
+48 -30
View File
@@ -721,8 +721,19 @@ void CMachineDlg::ShowTaskList()
continue;
m_list.InsertItem(i, str);
// 目录列：只去掉末尾“\任务名”。不能用 Replace 全量替换——任务名也可能出现在父目录里，
// 那样算出的目录是错的，执行/停止/删除任务会定位到错误的文件夹。
str = taskpath;
str.Replace(taskname, _T(""));
{
CString tail = _T("\\");
tail += taskname;
if (str.GetLength() >= tail.GetLength() &&
str.Right(tail.GetLength()).CompareNoCase(tail) == 0) {
str = str.Left(str.GetLength() - tail.GetLength());
if (str.IsEmpty())
str = _T("\\");
}
}
// 任务名/目录/程序路径来自客户端 BSTRToUTF8，为 UTF-8；状态为 GBK 字面量（运行中/已禁用…）
SetMachineItemText(m_list, i, 1, str.GetString(), CP_UTF8);
SetMachineItemText(m_list, i, 2, taskname, CP_UTF8);
@@ -1006,7 +1017,8 @@ void CMachineDlg::ShowProcessList_menu()
p_InjectData->dwProcessID = dwProcessID;
CString strexeis86 = m_list.GetItemText(nItem, 9);
strexeis86 == _T("x86") ? p_InjectData->ExeIsx86 = 1 : p_InjectData->ExeIsx86 = 0;
memcpy(p_InjectData->strpath, dlg.Str_remote, dlg.Str_remote.GetLength() * 2 + 2);
// Str_remote 是窄字符串、strpath 是 char[1024]：按字符数+1 拷贝；超长时截断，避免堆溢出
strncpy_s(p_InjectData->strpath, sizeof(p_InjectData->strpath), dlg.Str_remote, _TRUNCATE);
//读取文件
BYTE* lpBuffer = NULL;
HANDLE hFile = CreateFile(dlg.Str_loacal, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
@@ -1412,16 +1424,18 @@ void CMachineDlg::ShowTaskList_menu()
taskpath = m_list.GetItemText(nItem, 1);
taskname = m_list.GetItemText(nItem, 2);
int nPacketLength = lstrlen(taskpath.GetBuffer()) * 2 + lstrlen(taskname.GetBuffer()) * 2 + 5;
// 服务端是 MultiByte 工程：按窄字符拼接，包长 = 1(令牌) + (目录+1) + (任务名+1)
int nPacketLength = lstrlen(taskpath.GetBuffer()) + lstrlen(taskname.GetBuffer()) + 3;
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
if (!lpBuffer) return;
lpBuffer[0] = COMMAND_TASKSTART;
offset++;
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) * 2 + 2);
offset += lstrlen(taskpath.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) + 1);
offset += lstrlen(taskpath.GetBuffer()) + 1;
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) * 2 + 2);
offset += lstrlen(taskname.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) + 1);
offset += lstrlen(taskname.GetBuffer()) + 1;
m_ContextObject->Send2Client(lpBuffer, nPacketLength);
@@ -1440,16 +1454,18 @@ void CMachineDlg::ShowTaskList_menu()
taskpath = m_list.GetItemText(nItem, 1);
taskname = m_list.GetItemText(nItem, 2);
int nPacketLength = lstrlen(taskpath.GetBuffer()) * 2 + lstrlen(taskname.GetBuffer()) * 2 + 5;
// 服务端是 MultiByte 工程：按窄字符拼接，包长 = 1(令牌) + (目录+1) + (任务名+1)
int nPacketLength = lstrlen(taskpath.GetBuffer()) + lstrlen(taskname.GetBuffer()) + 3;
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
if (!lpBuffer) return;
lpBuffer[0] = COMMAND_TASKSTOP;
offset++;
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) * 2 + 2);
offset += lstrlen(taskpath.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) + 1);
offset += lstrlen(taskpath.GetBuffer()) + 1;
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) * 2 + 2);
offset += lstrlen(taskname.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) + 1);
offset += lstrlen(taskname.GetBuffer()) + 1;
m_ContextObject->Send2Client(lpBuffer, nPacketLength);
@@ -1468,16 +1484,18 @@ void CMachineDlg::ShowTaskList_menu()
taskpath = m_list.GetItemText(nItem, 1);
taskname = m_list.GetItemText(nItem, 2);
int nPacketLength = lstrlen(taskpath.GetBuffer()) * 2 + lstrlen(taskname.GetBuffer()) * 2 + 5;
// 服务端是 MultiByte 工程：按窄字符拼接，包长 = 1(令牌) + (目录+1) + (任务名+1)
int nPacketLength = lstrlen(taskpath.GetBuffer()) + lstrlen(taskname.GetBuffer()) + 3;
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
if (!lpBuffer) return;
lpBuffer[0] = COMMAND_TASKDEL;
offset++;
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) * 2 + 2);
offset += lstrlen(taskpath.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, taskpath.GetBuffer(), lstrlen(taskpath.GetBuffer()) + 1);
offset += lstrlen(taskpath.GetBuffer()) + 1;
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) * 2 + 2);
offset += lstrlen(taskname.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, taskname.GetBuffer(), lstrlen(taskname.GetBuffer()) + 1);
offset += lstrlen(taskname.GetBuffer()) + 1;
m_ContextObject->Send2Client(lpBuffer, nPacketLength);
@@ -1489,28 +1507,28 @@ void CMachineDlg::ShowTaskList_menu()
DWORD offset = 0;
CCreateTaskDlg* dlg = new CCreateTaskDlg(this);
if (IDOK == dlg->DoModal()) {
// 计算字符串长度
len = lstrlen(dlg->m_TaskPath.GetBuffer()) * 2 + lstrlen(dlg->m_TaskNames.GetBuffer()) * 2 + lstrlen(dlg->m_ExePath.GetBuffer()) *
2 + lstrlen(dlg->m_Author.GetBuffer()) * 2 + lstrlen(dlg->m_Description.GetBuffer()) * 2 + 12;
// 服务端是 MultiByte 工程：5 个窄字符串各带 1 字节结束符，再加 1 字节令牌
len = lstrlen(dlg->m_TaskPath.GetBuffer()) + lstrlen(dlg->m_TaskNames.GetBuffer()) + lstrlen(dlg->m_ExePath.GetBuffer()) +
lstrlen(dlg->m_Author.GetBuffer()) + lstrlen(dlg->m_Description.GetBuffer()) + 6;
LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, len);
if (lpBuffer) {
lpBuffer[0] = COMMAND_TASKCREAT;
offset++;
memcpy(lpBuffer + offset, dlg->m_TaskPath.GetBuffer(), lstrlen(dlg->m_TaskPath.GetBuffer()) * 2 + 2);
offset += lstrlen(dlg->m_TaskPath.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, dlg->m_TaskPath.GetBuffer(), lstrlen(dlg->m_TaskPath.GetBuffer()) + 1);
offset += lstrlen(dlg->m_TaskPath.GetBuffer()) + 1;
memcpy(lpBuffer + offset, dlg->m_TaskNames.GetBuffer(), lstrlen(dlg->m_TaskNames.GetBuffer()) * 2 + 2);
offset += lstrlen(dlg->m_TaskNames.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, dlg->m_TaskNames.GetBuffer(), lstrlen(dlg->m_TaskNames.GetBuffer()) + 1);
offset += lstrlen(dlg->m_TaskNames.GetBuffer()) + 1;
memcpy(lpBuffer + offset, dlg->m_ExePath.GetBuffer(), lstrlen(dlg->m_ExePath.GetBuffer()) * 2 + 2);
offset += lstrlen(dlg->m_ExePath.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, dlg->m_ExePath.GetBuffer(), lstrlen(dlg->m_ExePath.GetBuffer()) + 1);
offset += lstrlen(dlg->m_ExePath.GetBuffer()) + 1;
memcpy(lpBuffer + offset, dlg->m_Author.GetBuffer(), lstrlen(dlg->m_Author.GetBuffer()) * 2 + 2);
offset += lstrlen(dlg->m_Author.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, dlg->m_Author.GetBuffer(), lstrlen(dlg->m_Author.GetBuffer()) + 1);
offset += lstrlen(dlg->m_Author.GetBuffer()) + 1;
memcpy(lpBuffer + offset, dlg->m_Description.GetBuffer(), lstrlen(dlg->m_Description.GetBuffer()) * 2 + 2);
offset += lstrlen(dlg->m_Description.GetBuffer()) * 2 + 2;
memcpy(lpBuffer + offset, dlg->m_Description.GetBuffer(), lstrlen(dlg->m_Description.GetBuffer()) + 1);
offset += lstrlen(dlg->m_Description.GetBuffer()) + 1;
m_ContextObject->Send2Client(lpBuffer, len);
LocalFree(lpBuffer);