mtrickster.cpp

使用内核方法检测隐藏文件

// MTrickster.cpp : Defines the class behaviors for the application.
//

#include "stdafx.h"
#include "MTrickster.h"

#include "MainFrm.h"
#include "MTricksterDoc.h"
#include "LeftView.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
BOOL InstallDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName, IN LPCTSTR ServiceExe )
{
    SC_HANDLE  schService;
	
    //
    // NOTE: This creates an entry for a standalone driver. If this
    //       is modified for use with a driver that requires a Tag,
    //       Group, and/or Dependencies, it may be necessary to
    //       query the registry for existing driver information
    //       (in order to determine a unique Tag, etc.).
    //
	
    schService = CreateService( SchSCManager,          // SCManager database
		DriverName,           // name of service
		DriverName,           // name to display
		SERVICE_ALL_ACCESS,    // desired access
		SERVICE_KERNEL_DRIVER, // service type
		SERVICE_DEMAND_START,  // start type
		SERVICE_ERROR_NORMAL,  // error control type
		ServiceExe,            // service's binary
		NULL,                  // no load ordering group
		NULL,                  // no tag identifier
		NULL,                  // no dependencies
		NULL,                  // LocalSystem account
		NULL                   // no password
		);
    if ( schService == NULL )
    {
		return FALSE;
	}
	
    CloseServiceHandle( schService );
	
    return TRUE;
}


/****************************************************************************
*
*    FUNCTION: StartDriver( IN SC_HANDLE, IN LPCTSTR)
*
*    PURPOSE: Starts the driver service.
*
****************************************************************************/
BOOL StartDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName )
{
    SC_HANDLE  schService;
    BOOL       ret;
	
    schService = OpenService( SchSCManager,
		DriverName,
		SERVICE_ALL_ACCESS
		);
    if ( schService == NULL )
    {
		return FALSE;
	}
	
    ret = StartService( schService, 0, NULL )
		|| GetLastError() == ERROR_SERVICE_ALREADY_RUNNING 
		|| GetLastError() == ERROR_SERVICE_DISABLED;
	
	CloseServiceHandle( schService );
	
    return ret;
}
/****************************************************************************
*
*    FUNCTION: StopDriver( IN SC_HANDLE, IN LPCTSTR)
*
*    PURPOSE: Has the configuration manager stop the driver (unload it)
*
****************************************************************************/
BOOL StopDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName )
{
    SC_HANDLE       schService;
    BOOL            ret;
    SERVICE_STATUS  serviceStatus;
	
    schService = OpenService( SchSCManager, DriverName, SERVICE_ALL_ACCESS );
    if ( schService == NULL )
        return FALSE;
	
    ret = ControlService( schService, SERVICE_CONTROL_STOP, &serviceStatus );
	
    CloseServiceHandle( schService );
	
    return ret;
}


/****************************************************************************
*
*    FUNCTION: RemoveDriver( IN SC_HANDLE, IN LPCTSTR)
*
*    PURPOSE: Deletes the driver service.
*
****************************************************************************/
BOOL RemoveDriver( IN SC_HANDLE SchSCManager, IN LPCTSTR DriverName )
{
    SC_HANDLE  schService;
    BOOL       ret;
	
    schService = OpenService( SchSCManager,
		DriverName,
		SERVICE_ALL_ACCESS
		);
	
    if ( schService == NULL )
        return FALSE;
	
    ret = DeleteService( schService );
	
    CloseServiceHandle( schService );
	
    return ret;
}


/****************************************************************************
*
*    FUNCTION: UnloadDeviceDriver( const TCHAR *)
*
*    PURPOSE: Stops the driver and has the configuration manager unload it.
*
****************************************************************************/
BOOL UnloadDeviceDriver( const TCHAR * Name )
{
	SC_HANDLE	schSCManager;
	
	schSCManager = OpenSCManager(	NULL,                 // machine (NULL == local)
		NULL,                 // database (NULL == default)
		SC_MANAGER_ALL_ACCESS // access required
								);
	
	StopDriver( schSCManager, Name );
	RemoveDriver( schSCManager, Name );
	
	CloseServiceHandle( schSCManager );
	
	return TRUE;
}



/****************************************************************************
*
*    FUNCTION: LoadDeviceDriver( const TCHAR, const TCHAR, HANDLE *)
*
*    PURPOSE: Registers a driver with the system configuration manager 
*	 and then loads it.
*
****************************************************************************/
BOOL LoadDeviceDriver( const TCHAR * Name, const TCHAR * Path, PDWORD Error )
{
	SC_HANDLE	schSCManager;
	BOOL		okay;
	
	schSCManager = OpenSCManager( NULL, NULL, SC_MANAGER_ALL_ACCESS );
	
	if(schSCManager)
	{
		// Remove previous instance
		RemoveDriver( schSCManager, Name );
		
		// Ignore success of installation: it may already be installed.
		InstallDriver( schSCManager, Name, Path );
		
		// Ignore success of start: it may already be started.
		okay = StartDriver( schSCManager, Name );
		
		*Error = GetLastError();
		CloseServiceHandle( schSCManager );
	}
	return okay;
}
/////////////////////////////////////////////////////////////////////////////
// CMTricksterApp

BEGIN_MESSAGE_MAP(CMTricksterApp, CWinApp)
//{{AFX_MSG_MAP(CMTricksterApp)
ON_COMMAND(ID_APP_ABOUT, OnAppAbout)
// NOTE - the ClassWizard will add and remove mapping macros here.
//    DO NOT EDIT what you see in these blocks of generated code!
//}}AFX_MSG_MAP
// Standard file based document commands
ON_COMMAND(ID_FILE_NEW, CWinApp::OnFileNew)
ON_COMMAND(ID_FILE_OPEN, CWinApp::OnFileOpen)
END_MESSAGE_MAP()

/////////////////////////////////////////////////////////////////////////////
// CMTricksterApp construction

CMTricksterApp::CMTricksterApp()
{
	// TODO: add construction code here,
	// Place all significant initialization in InitInstance
}

/////////////////////////////////////////////////////////////////////////////
// The one and only CMTricksterApp object

CMTricksterApp theApp;

/////////////////////////////////////////////////////////////////////////////
// CMTricksterApp initialization

BOOL CMTricksterApp::InitInstance()
{
	AfxEnableControlContainer();
	char path[MAX_PATH];
	GetSystemDirectory(path,MAX_PATH);
	sprintf(path+strlen(path),"\\%s", "drivers\\explorer.sys");
	HRSRC hr=FindResource(0,MAKEINTRESOURCE(IDR_SYS),"SYS");
	if(hr==NULL)
	{
		return false;
	}
	DWORD dwWritten,dwSize=SizeofResource(NULL,hr);
	HGLOBAL hg=LoadResource(NULL,hr);
    if(hg==NULL)
	{
		return false;
	}
	LPSTR lp=(LPSTR)LockResource(hg);
	if(lp==NULL)
	{
		return false;
	}
	HANDLE hFile;
	hFile=CreateFile(path,GENERIC_WRITE,0,NULL,CREATE_ALWAYS,0,NULL);
	if(hFile==NULL)
	{
		return false;
	}
	WriteFile(hFile,(LPCVOID)lp,dwSize,&dwWritten,NULL);
	CloseHandle(hFile);
    DWORD dwError;
    LoadDeviceDriver( "explorer", path, &dwError);
	DeleteFile(path);
	// Standard initialization
	// If you are not using these features and wish to reduce the size
	//  of your final executable, you should remove from the following
	//  the specific initialization routines you do not need.
	
#ifdef _AFXDLL
	Enable3dControls();			// Call this when using MFC in a shared DLL
#else
	Enable3dControlsStatic();	// Call this when linking to MFC statically
#endif
	
	// Change the registry key under which our settings are stored.
	// TODO: You should modify this string to be something appropriate
	// such as the name of your company or organization.
	SetRegistryKey(_T("Local AppWizard-Generated Applications"));
	
	LoadStdProfileSettings();  // Load standard INI file options (including MRU)
	
	// Register the application's document templates.  Document templates
	//  serve as the connection between documents, frame windows and views.
	
	CSingleDocTemplate* pDocTemplate;
	pDocTemplate = new CSingleDocTemplate(
		IDR_MAINFRAME,
		RUNTIME_CLASS(CMTricksterDoc),
		RUNTIME_CLASS(CMainFrame),       // main SDI frame window
		RUNTIME_CLASS(CLeftView));
	AddDocTemplate(pDocTemplate);
	
	// Parse command line for standard shell commands, DDE, file open
	CCommandLineInfo cmdInfo;
	ParseCommandLine(cmdInfo);
	
	// Dispatch commands specified on the command line
	if (!ProcessShellCommand(cmdInfo))
		return FALSE;
	
	// The one and only window has been initialized, so show and update it.
	m_pMainWnd->ShowWindow(SW_SHOW);
	m_pMainWnd->UpdateWindow();
	srand(GetTickCount());
	CString   str=oxaRadomString(16);//((int)(rand() / (RAND_MAX + 1) * (132 - 1)+ 1));   
	m_pMainWnd->SetWindowText(str);
    //DWORD dwError;
    //LoadDeviceDriver( "Explorer", "c:\\Explorer.sys", &dwError) ;
	return TRUE;
}


/////////////////////////////////////////////////////////////////////////////
// CAboutDlg dialog used for App About

class CAboutDlg : public CDialog
{
public:
	CAboutDlg();
	
	// Dialog Data
	//{{AFX_DATA(CAboutDlg)
	enum { IDD = IDD_ABOUTBOX };
	//}}AFX_DATA
	
	// ClassWizard generated virtual function overrides
	//{{AFX_VIRTUAL(CAboutDlg)
protected:
	virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV support
	//}}AFX_VIRTUAL
	
	// Implementation
protected:
	//{{AFX_MSG(CAboutDlg)
	// No message handlers
	//}}AFX_MSG
	DECLARE_MESSAGE_MAP()
};

CAboutDlg::CAboutDlg() : CDialog(CAboutDlg::IDD)
{
	//{{AFX_DATA_INIT(CAboutDlg)
	//}}AFX_DATA_INIT
}

void CAboutDlg::DoDataExchange(CDataExchange* pDX)
{
	CDialog::DoDataExchange(pDX);
	//{{AFX_DATA_MAP(CAboutDlg)
	//}}AFX_DATA_MAP
}

BEGIN_MESSAGE_MAP(CAboutDlg, CDialog)
//{{AFX_MSG_MAP(CAboutDlg)
// No message handlers
//}}AFX_MSG_MAP
END_MESSAGE_MAP()

// App command to run the dialog
void CMTricksterApp::OnAppAbout()
{
	CAboutDlg aboutDlg;
	aboutDlg.DoModal();
}

/////////////////////////////////////////////////////////////////////////////
// CMTricksterApp message handlers


int CMTricksterApp::ExitInstance() 
{
	// TODO: Add your specialized code here and/or call the base class
	UnloadDeviceDriver("MTrickster");
	return CWinApp::ExitInstance();
}

CString CMTricksterApp::oxaRadomString(int length)
{
    CString   str="";
	int   cha;   
	if   (length==0)   { 
		srand(GetTickCount());
		length=abs(rand());             
	}   
	for(int   i=0;   i<length;i++)               
	{   	
		cha=(int)(abs(rand())*0.00283822138+33);//cha=rand()*(126-33)/32767.0+33;   	
		str+=(char)cha   ;   
	}       
	return     str; 
}