utils.c

一个驱动上实现 无进程 无端口 无服务的简单rootkit

///
//	uty@uaty
///
#include "utils.h"

VOID wtoA(WCHAR* source,CHAR* dest)
{
	ULONG i;
	for (i = 0;i<wcslen(source)+1;i++){
		dest[i] = (CHAR)source[i];
	}
}
//--------------------------------------------------------------------
VOID Atow(CHAR* source,WCHAR* dest)
{
	ULONG	i;
	memset(dest,0,wcslen(dest));
	for(i = 0;i < strlen(source);i++){
		dest[i] = source[i];
	}
}
//--------------------------------------------------------------------
VOID GetArg(CHAR* commAndline,ULONG* Argc,CHAR* Argv[],ULONG	mAxArgc)
{
	ULONG	length;
	ULONG	i = 0;
	ULONG	index = 0;
	length = strlen(commAndline);
	Argv[index] = commAndline;
	index++;
	for(i = 0;i < length;i++){
		if(commAndline[i] == ' ' && commAndline[i+1] != ' ' && commAndline[i+1] != '\0'){
			commAndline[i] = '\0';//breAk up
			i++;
			while(commAndline[i] == ' ' && i<length){
				i++;
			}
			if(index < mAxArgc){				//////////////处理最大参数个数 只取前mAxArgc个参数
				Argv[index] = commAndline + i;
				index ++;
			}									////////////////////////
			if(commAndline[i] == '"'){   /////////////////////这段是对"的处理
				commAndline[i] = '\0';
				Argv[index-1] = (CHAR*)Argv[index-1]+1;
				while(commAndline[i] != '"' && i<length){
					i++;
				}
				if (commAndline[i] == '"'){
					commAndline[i] = '\0';
					i--;
				}
			}//if                                //////////////
		}
				
	}
	*Argc = index;
}
//--------------------------------------------------------------------