Update private master program code

2025-06-08 15:38:41 +08:00
parent 15e03bd18a
commit 46f7dc1790
40 changed files with 5380 additions and 435 deletions
--- a/ReadMe.md
+++ b/ReadMe.md
@@ -1,4 +1,10 @@
-# 项目简介
+# 🌐 语言 | Language
+
+**[🇨🇳 中文](./ReadMe.md) | [🇺🇸 English](./ReadMe_EN.md)**
+
+---
+
+# 项目简介

 **原始来源：** [zibility](https://github.com/zibility/Remote)

@@ -98,6 +104,8 @@
 注意：自[v1.0.8](https://github.com/yuanyuanxiang/SimpleRemoter/releases/tag/v1.0.0.8)起，
 `TestRun.exe`将采取内存加载DLL运行方式，向主控程序请求DLL并在内存中执行，这有利于代码的热更新。

+---
+
 # 更新日志

 2025年以前的变更记录参看：[history](./history.md)
@@ -116,53 +124,54 @@

 **2025.04.05**

-Release v1.0.7, mainly fix or add new feature:
- 
- Update third-party libraries and switch zlib to zstd, old version v1.0.6 is compatible;
- Support compile with Win64;
- Fix buges and make the program more stable;
- Improve remote control efficiency and support more bitmap compressing method;
- Some code reorganization.
+发布 v1.0.7，主要修复或新增以下功能：
+
+- 更新第三方库，将压缩算法从 zlib 更换为 zstd，旧版本 v1.0.6 仍兼容；
+- 支持编译为 Win64；
+- 修复若干 Bug，提高程序稳定性；
+- 提升远程控制效率，新增更多位图压缩方式；
+- 对部分代码结构进行了重构。

 **2025.04.12**

-Since v1.0.7 released in April 5:
+自 v1.0.7 于 4 月 5 日发布以来：

- Improvement: Make sure that the input command is always at the end of `Shelldlg`, and build a **simple Linux client**;
- Fix bugs: #62, #74, #75 ;
- Change the flag 0x1234567 to a more readable string; and improve building service and allow chosing other files to build;
- Showing the user's activities and monitoring specified software;
- Clean up global variables and make it easy to create multiple clients in one program, which is useful for testing the master's capacity;
- Implement loading DLL in memory, make it easy to update client program;
+- 功能改进：确保 `Shelldlg` 输入命令始终定位在末尾，并构建了一个**简易的 Linux 客户端**；
+- 修复 Bug：#62、#74、#75；
+- 将原标志位 0x1234567 更改为更具可读性的字符串；改进构建服务功能，允许选择其他文件进行构建；
+- 增加展示用户活动和监控指定软件的功能；
+- 清理全局变量，使得一个程序中可以轻松创建多个客户端，便于测试主控端的负载能力；
+- 实现内存加载 DLL，便于客户端程序热更新。

 **2025.04.21**

-Release v1.0.8:
+发布 v1.0.8：

- Support to share online host with other masters;
- Implement service-generated authorization capability, and add a serial number generation menu;
- Add `HPSocket` libraries which may be used in the future, and add static ffmpeg libraries to build Win64 master;
- Implement a memory DLL runner: the `TestRun` program request DLL from master and execute in memory.
+- 支持与其他主控共享在线主机；
+- 实现服务端生成授权的能力，增加序列号生成菜单；
+- 引入 `HPSocket` 库，为未来使用做准备，并引入静态 ffmpeg 库以支持构建 Win64 主控端；
+- 实现内存中运行 DLL：`TestRun` 程序从主控请求 DLL 并在内存中执行。

 **2025.04.30**

-Release v1.0.9：
+发布 v1.0.9：

- Update client building feature / All in one; The master will only accept the clients built by itself.
- Improve authorization feature.
+- 更新客户端构建功能 / 一体化生成；主控仅接受由自身构建的客户端连接；
+- 优化授权功能。

 **2025.06.01**

-Release v1.1.0:
+发布 v1.1.0：

-* fix: IOCPClient clear buffer when disconnect
-* Implement SOCKS proxy feature
-* Add menus and modify list style, add log
-* feature: Add a C program to execute shell code
-* feature: Encrypt for server address
-* feat: Support virtual remote desktop monitoring
-* feature: Add command to execute DLL
+- 修复：IOCPClient 断开连接时清空缓冲区；
+- 实现 SOCKS 代理功能；
+- 增加菜单项，修改列表样式，添加日志记录；
+- 新增功能：增加一个用于执行 Shellcode 的 C 程序；
+- 新增功能：对服务器地址进行加密；
+- 新增特性：支持虚拟远程桌面监控；
+- 新增命令：支持执行代码（64位 DLL）。

+---

 # 其他项目

@@ -170,6 +179,7 @@ Release v1.1.0:
 - [BGW RAT](https://github.com/yuanyuanxiang/BGW_RAT): 一款功能全面的远程控制程序，即大灰狼9.5.
 - [Gh0st](https://github.com/yuanyuanxiang/Gh0st): 也是一款基于Gh0st的远程控制程序。

+---

 # 沟通反馈

@@ -184,4 +194,4 @@ QQ：962914132
 赞助方式 / Sponsor：该项目的研究出自技术学习和兴趣爱好，本人视业余情况不定期更新项目。
 **如果该项目对你有益，请通过赞助图标对本项目进行支持。**
 如果你希望采用其他方式（如微信、支付宝）对本项目进行赞助，请点击
-[这里](https://github.com/yuanyuanxiang/yuanyuanxiang/blob/main/images/QR_Codes.jpg)。
+[这里](https://github.com/yuanyuanxiang/yuanyuanxiang/blob/main/images/QR_Codes.jpg)。
--- a/ReadMe_EN.md
+++ b/ReadMe_EN.md
@@ -0,0 +1,218 @@
+# 🌐 Language | 语言
+
+**[🇺🇸 English](./ReadMe_EN.md) | [🇨🇳 中文](./ReadMe.md)**
+
+---
+
+# Project Overview
+
+**Original Source:** [zibility](https://github.com/zibility/Remote)
+
+**Feature Summary:**  
+A remote controller based on Gh0st, implementing functionalities including terminal management, process management, window management, desktop control, file transfer, voice management, video monitoring, service management, registry viewer, keylogging, SOCKS proxy, virtual desktop, code execution, and more.
+
+If you're interested in control programs and enjoy this project, please consider starring it. Forks, watches, issue submissions, and pull requests are all welcome.  
+The author will fix reported issues as time permits.
+
+[![Star History Chart](https://api.star-history.com/svg?repos=yuanyuanxiang/SimpleRemoter&type=Date)](https://star-history.com/#yuanyuanxiang/SimpleRemoter&Date)
+
+<span style="color:#FF5722; font-weight:bold;">*This software is intended for learning and technical communication only. Users are responsible for any consequences resulting from its use.*</span>
+
+**Project Start Date:** January 1, 2019
+
+## Disclaimer
+
+This software is provided "as is" without any warranty. Use of this software is at your own risk.  
+We are not responsible for any illegal or malicious use resulting from this software.  
+Users should comply with relevant laws and regulations and use this software responsibly.  
+The developer assumes no liability for any damage arising from the use of this software.
+
+## Controller (Server)
+
+The main controller is **YAMA.exe**, which functions as the server. It is based on IOCP communication and supports tens of thousands of concurrent connections. Only one instance can run per machine in the Release version.
+
+Below are interface previews of the controller program. All features are stable and functional.  
+Note: Some features require the client (controlled program) to run with administrator privileges.
+
+![Main Interface](./images/Yama.jpg)
+
+The main window displays a list of connected clients.  
+Select a client to perform remote operations such as editing notes, setting up proxy mappings, or executing code.
+
+![Terminal Management](./images/Console.jpg)
+
+**Terminal Management** opens a command line interface to execute remote commands.  
+A [minimal version](./linux/main.cpp) is available with Linux client support for research purposes.
+
+![Process Management](./images/Process.jpg)
+
+**Process Management** shows all running processes on the remote machine.  
+You can start or stop regular processes (not high-privileged ones).
+
+![Window Management](./images/Window.jpg)
+
+**Window Management** displays currently open windows or programs on the remote machine, allowing you to hide or show them.
+
+![Desktop Control](./images/Remote.jpg)  
+![Desktop Settings](./images/RemoteSet.jpg)
+
+**Desktop Control** functions as "Remote Desktop" for controlling the remote machine.  
+You can configure screenshot capture methods (GDI, DXGI, or VIRTUAL) and compression algorithms (grayscale, screen-diff, H264).  
+"VIRTUAL" enables a virtual desktop running in the background, improving smoothness.  
+Additionally, it supports reporting the active window and detecting specific software.
+
+![File Management](./images/FileManage.jpg)
+
+**File Management** handles file transfer between the local and remote machine.
+
+![Voice Management](./images/Voice.jpg)
+
+**Voice Management** allows you to listen to the remote machine’s audio or send audio if a device is available.
+
+![Video Management](./images/Video.jpg)
+
+**Video Management** enables webcam access on the remote machine.  
+If enabled in settings, the controller will show whether a webcam is present.
+
+![Service Management](./images/Service.jpg)
+
+**Service Management** lists services on the remote machine.  
+If permitted, you can start, stop, or manage services.
+
+![Registry Management](./images/Register.jpg)
+
+**Registry Management** provides view-only access to the remote machine's registry.
+
+## Linux Client
+
+![LinuxClient](./images/LinuxClient.png)
+
+A Linux client is available under the [v1.0.8](./Releases/v1.0.8/ghost) directory, currently supporting only terminal commands.
+
+![Build Dialog](./images/BuildDlg.jpg)
+
+Compile the client under a Linux environment, then use the server build dialog to select the file and set connection info for generating a Linux version.
+
+## Licensing & Authorization
+
+![Auth Dialog](./images/AuthDlg.jpg)  
+![Password Generator](./images/PasswordGen.jpg)
+
+Starting from v1.0.8, operating the controller requires authorization.  
+Newly compiled programs have a 14-day trial period. After expiration, generating clients requires a **serial number** to obtain an **authorization token**.  
+
+To bypass the authorization logic, refer to the `OnOnlineBuildClient` function and recompile the program. See issue:  
+[#91](https://github.com/yuanyuanxiang/SimpleRemoter/issues/91)  
+The token includes the authorization period and enforces one-machine-one-code rules.  
+The logic also detects date tampering. Token generation requires a password.
+
+## Controlled Program (Client)
+
+![Main Interface](./images/TestRun.jpg)
+
+The controlled program acts as the **Client**, with two available formats:
+
+1. A standalone program `ghost.exe`  
+2. A combo format `TestRun.exe + ServerDll.dll`
+
+- Format (1) is self-contained with no external dependencies.  
+- Format (2) runs the EXE, which invokes a core DLL.
+
+Note: Since [v1.0.8](https://github.com/yuanyuanxiang/SimpleRemoter/releases/tag/v1.0.0.8), `TestRun.exe` loads DLLs into memory on demand from the controller, which supports hot code updates.
+
+---
+
+# Changelog
+
+For changes before 2025, see: [history](./history.md)
+
+**2025.01.12**  
+Fixed two potential remote desktop issues (#28, #29).  
+Added sorting for the controller’s list windows (#26, #27), making it easier to locate windows, services, or processes.
+
+Released version **v1.0.6**, noted for high stability.  
+This version does **not** support older Windows XP systems  
+(note: VS2019 and later have dropped support for XP toolchains; use older Visual Studio versions if needed).  
+Download the latest release from GitHub or clone the repo.  
+If antivirus software flags it as a virus, this is expected due to the nature of the software — feel free to compile it yourself for verification.
+
+**2025.02.01**  
+Inspired by [Gh0st](https://github.com/yuanyuanxiang/Gh0st/pull/2), added **keylogging** support, implemented by copying four core files:
+
+*KeyboardManager.h、KeyboardManager.cpp、KeyBoardDlg.h、KeyBoardDlg.cpp*
+
+**2025.04.05**
+
+Release v1.0.7, mainly fix or add new feature:
+ 
+- Update third-party libraries and switch zlib to zstd, old version v1.0.6 is compatible;
+- Support compile with Win64;
+- Fix buges and make the program more stable;
+- Improve remote control efficiency and support more bitmap compressing method;
+- Some code reorganization.
+
+**2025.04.12**
+
+Since v1.0.7 released in April 5:
+
+- Improvement: Make sure that the input command is always at the end of `Shelldlg`, and build a **simple Linux client**;
+- Fix bugs: #62, #74, #75 ;
+- Change the flag 0x1234567 to a more readable string; and improve building service and allow chosing other files to build;
+- Showing the user's activities and monitoring specified software;
+- Clean up global variables and make it easy to create multiple clients in one program, which is useful for testing the master's capacity;
+- Implement loading DLL in memory, make it easy to update client program;
+
+**2025.04.21**
+
+Release v1.0.8:
+
+- Support to share online host with other masters;
+- Implement service-generated authorization capability, and add a serial number generation menu;
+- Add `HPSocket` libraries which may be used in the future, and add static ffmpeg libraries to build Win64 master;
+- Implement a memory DLL runner: the `TestRun` program request DLL from master and execute in memory.
+
+**2025.04.30**
+
+Release v1.0.9：
+
+- Update client building feature / All in one; The master will only accept the clients built by itself.
+- Improve authorization feature.
+
+**2025.06.01**
+
+Release v1.1.0:
+
+* fix: IOCPClient clear buffer when disconnect
+* Implement SOCKS proxy feature
+* Add menus and modify list style, add log
+* feature: Add a C program to execute shell code
+* feature: Encrypt for server address
+* feat: Support virtual remote desktop monitoring
+* feature: Add command to execute DLL
+
+---
+
+# Other Projects
+
+- [HoldingHands](https://github.com/yuanyuanxiang/HoldingHands): A remote control program with a fully English interface and a different architectural design.
+- [BGW RAT](https://github.com/yuanyuanxiang/BGW_RAT): A fully featured remote access tool, also known as Big Grey Wolf 9.5.
+- [Gh0st](https://github.com/yuanyuanxiang/Gh0st): Another remote controller based on the original Gh0st RAT.
+
+---
+
+# Feedback & Contact
+
+QQ: 962914132
+
+Contact: [Telegram](https://t.me/doge_grandfather), [Email](mailto:yuanyuanxiang163@gmail.com), [LinkedIn](https://www.linkedin.com/in/wishyuanqi)
+
+Issue Reporting: [Issues](https://github.com/yuanyuanxiang/SimpleRemoter/issues)
+
+Contributions welcome: [Merge requests](https://github.com/yuanyuanxiang/SimpleRemoter/pulls)
+
+## Sponsorship
+
+This project stems from technical exploration and personal interest. Updates are made on a non-regular basis, depending on available spare time.  
+**If you find this project useful, please consider supporting it via the sponsor icon.**  
+If you'd prefer to sponsor using other methods (e.g., WeChat, Alipay or PayPal), please click  
+[here](https://github.com/yuanyuanxiang/yuanyuanxiang/blob/main/images/QR_Codes.jpg).
--- a/client/SystemManager.cpp
+++ b/client/SystemManager.cpp
@@ -179,7 +179,7 @@ VOID  CSystemManager::OnReceive(PBYTE szBuffer, ULONG ulLength)
 			break;
 		}

-	case COMMAND_WINDOW_CLOSE:
+	case CMD_WINDOW_CLOSE:
 		{
 			HWND hWnd = *((HWND*)(szBuffer+1));

--- a/common/aes.c
+++ b/common/aes.c
@@ -0,0 +1,571 @@
+/*
+
+This is an implementation of the AES algorithm, specifically ECB, CTR and CBC mode.
+Block size can be chosen in aes.h - available choices are AES128, AES192, AES256.
+
+The implementation is verified against the test vectors in:
+  National Institute of Standards and Technology Special Publication 800-38A 2001 ED
+
+ECB-AES128
+----------
+
+  plain-text:
+    6bc1bee22e409f96e93d7e117393172a
+    ae2d8a571e03ac9c9eb76fac45af8e51
+    30c81c46a35ce411e5fbc1191a0a52ef
+    f69f2445df4f9b17ad2b417be66c3710
+
+  key:
+    2b7e151628aed2a6abf7158809cf4f3c
+
+  resulting cipher
+    3ad77bb40d7a3660a89ecaf32466ef97 
+    f5d3d58503b9699de785895a96fdbaaf 
+    43b1cd7f598ece23881b00e3ed030688 
+    7b0c785e27e8ad3f8223207104725dd4 
+
+
+NOTE:   String length must be evenly divisible by 16byte (str_len % 16 == 0)
+        You should pad the end of the string with zeros if this is not the case.
+        For AES192/256 the key size is proportionally larger.
+
+*/
+
+/*****************************************************************************/
+/* Includes:                                                                 */
+/*****************************************************************************/
+#include <string.h> // CBC mode, for memset
+#include "aes.h"
+
+/*****************************************************************************/
+/* Defines:                                                                  */
+/*****************************************************************************/
+// The number of columns comprising a state in AES. This is a constant in AES. Value=4
+#define Nb 4
+
+#if defined(AES256) && (AES256 == 1)
+    #define Nk 8
+    #define Nr 14
+#elif defined(AES192) && (AES192 == 1)
+    #define Nk 6
+    #define Nr 12
+#else
+    #define Nk 4        // The number of 32 bit words in a key.
+    #define Nr 10       // The number of rounds in AES Cipher.
+#endif
+
+// jcallan@github points out that declaring Multiply as a function 
+// reduces code size considerably with the Keil ARM compiler.
+// See this link for more information: https://github.com/kokke/tiny-AES-C/pull/3
+#ifndef MULTIPLY_AS_A_FUNCTION
+  #define MULTIPLY_AS_A_FUNCTION 0
+#endif
+
+
+
+
+/*****************************************************************************/
+/* Private variables:                                                        */
+/*****************************************************************************/
+// state - array holding the intermediate results during decryption.
+typedef uint8_t state_t[4][4];
+
+
+
+// The lookup-tables are marked const so they can be placed in read-only storage instead of RAM
+// The numbers below can be computed dynamically trading ROM for RAM - 
+// This can be useful in (embedded) bootloader applications, where ROM is often limited.
+static const uint8_t sbox[256] = {
+  //0     1    2      3     4    5     6     7      8    9     A      B    C     D     E     F
+  0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,
+  0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,
+  0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,
+  0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,
+  0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,
+  0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,
+  0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,
+  0x51, 0xa3, 0x40, 0x8f, 0x92, 0x9d, 0x38, 0xf5, 0xbc, 0xb6, 0xda, 0x21, 0x10, 0xff, 0xf3, 0xd2,
+  0xcd, 0x0c, 0x13, 0xec, 0x5f, 0x97, 0x44, 0x17, 0xc4, 0xa7, 0x7e, 0x3d, 0x64, 0x5d, 0x19, 0x73,
+  0x60, 0x81, 0x4f, 0xdc, 0x22, 0x2a, 0x90, 0x88, 0x46, 0xee, 0xb8, 0x14, 0xde, 0x5e, 0x0b, 0xdb,
+  0xe0, 0x32, 0x3a, 0x0a, 0x49, 0x06, 0x24, 0x5c, 0xc2, 0xd3, 0xac, 0x62, 0x91, 0x95, 0xe4, 0x79,
+  0xe7, 0xc8, 0x37, 0x6d, 0x8d, 0xd5, 0x4e, 0xa9, 0x6c, 0x56, 0xf4, 0xea, 0x65, 0x7a, 0xae, 0x08,
+  0xba, 0x78, 0x25, 0x2e, 0x1c, 0xa6, 0xb4, 0xc6, 0xe8, 0xdd, 0x74, 0x1f, 0x4b, 0xbd, 0x8b, 0x8a,
+  0x70, 0x3e, 0xb5, 0x66, 0x48, 0x03, 0xf6, 0x0e, 0x61, 0x35, 0x57, 0xb9, 0x86, 0xc1, 0x1d, 0x9e,
+  0xe1, 0xf8, 0x98, 0x11, 0x69, 0xd9, 0x8e, 0x94, 0x9b, 0x1e, 0x87, 0xe9, 0xce, 0x55, 0x28, 0xdf,
+  0x8c, 0xa1, 0x89, 0x0d, 0xbf, 0xe6, 0x42, 0x68, 0x41, 0x99, 0x2d, 0x0f, 0xb0, 0x54, 0xbb, 0x16 };
+
+#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+static const uint8_t rsbox[256] = {
+  0x52, 0x09, 0x6a, 0xd5, 0x30, 0x36, 0xa5, 0x38, 0xbf, 0x40, 0xa3, 0x9e, 0x81, 0xf3, 0xd7, 0xfb,
+  0x7c, 0xe3, 0x39, 0x82, 0x9b, 0x2f, 0xff, 0x87, 0x34, 0x8e, 0x43, 0x44, 0xc4, 0xde, 0xe9, 0xcb,
+  0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e,
+  0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25,
+  0x72, 0xf8, 0xf6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xd4, 0xa4, 0x5c, 0xcc, 0x5d, 0x65, 0xb6, 0x92,
+  0x6c, 0x70, 0x48, 0x50, 0xfd, 0xed, 0xb9, 0xda, 0x5e, 0x15, 0x46, 0x57, 0xa7, 0x8d, 0x9d, 0x84,
+  0x90, 0xd8, 0xab, 0x00, 0x8c, 0xbc, 0xd3, 0x0a, 0xf7, 0xe4, 0x58, 0x05, 0xb8, 0xb3, 0x45, 0x06,
+  0xd0, 0x2c, 0x1e, 0x8f, 0xca, 0x3f, 0x0f, 0x02, 0xc1, 0xaf, 0xbd, 0x03, 0x01, 0x13, 0x8a, 0x6b,
+  0x3a, 0x91, 0x11, 0x41, 0x4f, 0x67, 0xdc, 0xea, 0x97, 0xf2, 0xcf, 0xce, 0xf0, 0xb4, 0xe6, 0x73,
+  0x96, 0xac, 0x74, 0x22, 0xe7, 0xad, 0x35, 0x85, 0xe2, 0xf9, 0x37, 0xe8, 0x1c, 0x75, 0xdf, 0x6e,
+  0x47, 0xf1, 0x1a, 0x71, 0x1d, 0x29, 0xc5, 0x89, 0x6f, 0xb7, 0x62, 0x0e, 0xaa, 0x18, 0xbe, 0x1b,
+  0xfc, 0x56, 0x3e, 0x4b, 0xc6, 0xd2, 0x79, 0x20, 0x9a, 0xdb, 0xc0, 0xfe, 0x78, 0xcd, 0x5a, 0xf4,
+  0x1f, 0xdd, 0xa8, 0x33, 0x88, 0x07, 0xc7, 0x31, 0xb1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xec, 0x5f,
+  0x60, 0x51, 0x7f, 0xa9, 0x19, 0xb5, 0x4a, 0x0d, 0x2d, 0xe5, 0x7a, 0x9f, 0x93, 0xc9, 0x9c, 0xef,
+  0xa0, 0xe0, 0x3b, 0x4d, 0xae, 0x2a, 0xf5, 0xb0, 0xc8, 0xeb, 0xbb, 0x3c, 0x83, 0x53, 0x99, 0x61,
+  0x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d };
+#endif
+
+// The round constant word array, Rcon[i], contains the values given by 
+// x to the power (i-1) being powers of x (x is denoted as {02}) in the field GF(2^8)
+static const uint8_t Rcon[11] = {
+  0x8d, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1b, 0x36 };
+
+/*
+ * Jordan Goulder points out in PR #12 (https://github.com/kokke/tiny-AES-C/pull/12),
+ * that you can remove most of the elements in the Rcon array, because they are unused.
+ *
+ * From Wikipedia's article on the Rijndael key schedule @ https://en.wikipedia.org/wiki/Rijndael_key_schedule#Rcon
+ * 
+ * "Only the first some of these constants are actually used – up to rcon[10] for AES-128 (as 11 round keys are needed), 
+ *  up to rcon[8] for AES-192, up to rcon[7] for AES-256. rcon[0] is not used in AES algorithm."
+ */
+
+
+/*****************************************************************************/
+/* Private functions:                                                        */
+/*****************************************************************************/
+/*
+static uint8_t getSBoxValue(uint8_t num)
+{
+  return sbox[num];
+}
+*/
+#define getSBoxValue(num) (sbox[(num)])
+
+// This function produces Nb(Nr+1) round keys. The round keys are used in each round to decrypt the states. 
+static void KeyExpansion(uint8_t* RoundKey, const uint8_t* Key)
+{
+  unsigned i, j, k;
+  uint8_t tempa[4]; // Used for the column/row operations
+  
+  // The first round key is the key itself.
+  for (i = 0; i < Nk; ++i)
+  {
+    RoundKey[(i * 4) + 0] = Key[(i * 4) + 0];
+    RoundKey[(i * 4) + 1] = Key[(i * 4) + 1];
+    RoundKey[(i * 4) + 2] = Key[(i * 4) + 2];
+    RoundKey[(i * 4) + 3] = Key[(i * 4) + 3];
+  }
+
+  // All other round keys are found from the previous round keys.
+  for (i = Nk; i < Nb * (Nr + 1); ++i)
+  {
+    {
+      k = (i - 1) * 4;
+      tempa[0]=RoundKey[k + 0];
+      tempa[1]=RoundKey[k + 1];
+      tempa[2]=RoundKey[k + 2];
+      tempa[3]=RoundKey[k + 3];
+
+    }
+
+    if (i % Nk == 0)
+    {
+      // This function shifts the 4 bytes in a word to the left once.
+      // [a0,a1,a2,a3] becomes [a1,a2,a3,a0]
+
+      // Function RotWord()
+      {
+        const uint8_t u8tmp = tempa[0];
+        tempa[0] = tempa[1];
+        tempa[1] = tempa[2];
+        tempa[2] = tempa[3];
+        tempa[3] = u8tmp;
+      }
+
+      // SubWord() is a function that takes a four-byte input word and 
+      // applies the S-box to each of the four bytes to produce an output word.
+
+      // Function Subword()
+      {
+        tempa[0] = getSBoxValue(tempa[0]);
+        tempa[1] = getSBoxValue(tempa[1]);
+        tempa[2] = getSBoxValue(tempa[2]);
+        tempa[3] = getSBoxValue(tempa[3]);
+      }
+
+      tempa[0] = tempa[0] ^ Rcon[i/Nk];
+    }
+#if defined(AES256) && (AES256 == 1)
+    if (i % Nk == 4)
+    {
+      // Function Subword()
+      {
+        tempa[0] = getSBoxValue(tempa[0]);
+        tempa[1] = getSBoxValue(tempa[1]);
+        tempa[2] = getSBoxValue(tempa[2]);
+        tempa[3] = getSBoxValue(tempa[3]);
+      }
+    }
+#endif
+    j = i * 4; k=(i - Nk) * 4;
+    RoundKey[j + 0] = RoundKey[k + 0] ^ tempa[0];
+    RoundKey[j + 1] = RoundKey[k + 1] ^ tempa[1];
+    RoundKey[j + 2] = RoundKey[k + 2] ^ tempa[2];
+    RoundKey[j + 3] = RoundKey[k + 3] ^ tempa[3];
+  }
+}
+
+void AES_init_ctx(struct AES_ctx* ctx, const uint8_t* key)
+{
+  KeyExpansion(ctx->RoundKey, key);
+}
+#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
+void AES_init_ctx_iv(struct AES_ctx* ctx, const uint8_t* key, const uint8_t* iv)
+{
+  KeyExpansion(ctx->RoundKey, key);
+  memcpy (ctx->Iv, iv, AES_BLOCKLEN);
+}
+void AES_ctx_set_iv(struct AES_ctx* ctx, const uint8_t* iv)
+{
+  memcpy (ctx->Iv, iv, AES_BLOCKLEN);
+}
+#endif
+
+// This function adds the round key to state.
+// The round key is added to the state by an XOR function.
+static void AddRoundKey(uint8_t round, state_t* state, const uint8_t* RoundKey)
+{
+  uint8_t i,j;
+  for (i = 0; i < 4; ++i)
+  {
+    for (j = 0; j < 4; ++j)
+    {
+      (*state)[i][j] ^= RoundKey[(round * Nb * 4) + (i * Nb) + j];
+    }
+  }
+}
+
+// The SubBytes Function Substitutes the values in the
+// state matrix with values in an S-box.
+static void SubBytes(state_t* state)
+{
+  uint8_t i, j;
+  for (i = 0; i < 4; ++i)
+  {
+    for (j = 0; j < 4; ++j)
+    {
+      (*state)[j][i] = getSBoxValue((*state)[j][i]);
+    }
+  }
+}
+
+// The ShiftRows() function shifts the rows in the state to the left.
+// Each row is shifted with different offset.
+// Offset = Row number. So the first row is not shifted.
+static void ShiftRows(state_t* state)
+{
+  uint8_t temp;
+
+  // Rotate first row 1 columns to left  
+  temp           = (*state)[0][1];
+  (*state)[0][1] = (*state)[1][1];
+  (*state)[1][1] = (*state)[2][1];
+  (*state)[2][1] = (*state)[3][1];
+  (*state)[3][1] = temp;
+
+  // Rotate second row 2 columns to left  
+  temp           = (*state)[0][2];
+  (*state)[0][2] = (*state)[2][2];
+  (*state)[2][2] = temp;
+
+  temp           = (*state)[1][2];
+  (*state)[1][2] = (*state)[3][2];
+  (*state)[3][2] = temp;
+
+  // Rotate third row 3 columns to left
+  temp           = (*state)[0][3];
+  (*state)[0][3] = (*state)[3][3];
+  (*state)[3][3] = (*state)[2][3];
+  (*state)[2][3] = (*state)[1][3];
+  (*state)[1][3] = temp;
+}
+
+static uint8_t xtime(uint8_t x)
+{
+  return ((x<<1) ^ (((x>>7) & 1) * 0x1b));
+}
+
+// MixColumns function mixes the columns of the state matrix
+static void MixColumns(state_t* state)
+{
+  uint8_t i;
+  uint8_t Tmp, Tm, t;
+  for (i = 0; i < 4; ++i)
+  {  
+    t   = (*state)[i][0];
+    Tmp = (*state)[i][0] ^ (*state)[i][1] ^ (*state)[i][2] ^ (*state)[i][3] ;
+    Tm  = (*state)[i][0] ^ (*state)[i][1] ; Tm = xtime(Tm);  (*state)[i][0] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][1] ^ (*state)[i][2] ; Tm = xtime(Tm);  (*state)[i][1] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][2] ^ (*state)[i][3] ; Tm = xtime(Tm);  (*state)[i][2] ^= Tm ^ Tmp ;
+    Tm  = (*state)[i][3] ^ t ;              Tm = xtime(Tm);  (*state)[i][3] ^= Tm ^ Tmp ;
+  }
+}
+
+// Multiply is used to multiply numbers in the field GF(2^8)
+// Note: The last call to xtime() is unneeded, but often ends up generating a smaller binary
+//       The compiler seems to be able to vectorize the operation better this way.
+//       See https://github.com/kokke/tiny-AES-c/pull/34
+#if MULTIPLY_AS_A_FUNCTION
+static uint8_t Multiply(uint8_t x, uint8_t y)
+{
+  return (((y & 1) * x) ^
+       ((y>>1 & 1) * xtime(x)) ^
+       ((y>>2 & 1) * xtime(xtime(x))) ^
+       ((y>>3 & 1) * xtime(xtime(xtime(x)))) ^
+       ((y>>4 & 1) * xtime(xtime(xtime(xtime(x)))))); /* this last call to xtime() can be omitted */
+  }
+#else
+#define Multiply(x, y)                                \
+      (  ((y & 1) * x) ^                              \
+      ((y>>1 & 1) * xtime(x)) ^                       \
+      ((y>>2 & 1) * xtime(xtime(x))) ^                \
+      ((y>>3 & 1) * xtime(xtime(xtime(x)))) ^         \
+      ((y>>4 & 1) * xtime(xtime(xtime(xtime(x))))))   \
+
+#endif
+
+#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+/*
+static uint8_t getSBoxInvert(uint8_t num)
+{
+  return rsbox[num];
+}
+*/
+#define getSBoxInvert(num) (rsbox[(num)])
+
+// MixColumns function mixes the columns of the state matrix.
+// The method used to multiply may be difficult to understand for the inexperienced.
+// Please use the references to gain more information.
+static void InvMixColumns(state_t* state)
+{
+  int i;
+  uint8_t a, b, c, d;
+  for (i = 0; i < 4; ++i)
+  { 
+    a = (*state)[i][0];
+    b = (*state)[i][1];
+    c = (*state)[i][2];
+    d = (*state)[i][3];
+
+    (*state)[i][0] = Multiply(a, 0x0e) ^ Multiply(b, 0x0b) ^ Multiply(c, 0x0d) ^ Multiply(d, 0x09);
+    (*state)[i][1] = Multiply(a, 0x09) ^ Multiply(b, 0x0e) ^ Multiply(c, 0x0b) ^ Multiply(d, 0x0d);
+    (*state)[i][2] = Multiply(a, 0x0d) ^ Multiply(b, 0x09) ^ Multiply(c, 0x0e) ^ Multiply(d, 0x0b);
+    (*state)[i][3] = Multiply(a, 0x0b) ^ Multiply(b, 0x0d) ^ Multiply(c, 0x09) ^ Multiply(d, 0x0e);
+  }
+}
+
+
+// The SubBytes Function Substitutes the values in the
+// state matrix with values in an S-box.
+static void InvSubBytes(state_t* state)
+{
+  uint8_t i, j;
+  for (i = 0; i < 4; ++i)
+  {
+    for (j = 0; j < 4; ++j)
+    {
+      (*state)[j][i] = getSBoxInvert((*state)[j][i]);
+    }
+  }
+}
+
+static void InvShiftRows(state_t* state)
+{
+  uint8_t temp;
+
+  // Rotate first row 1 columns to right  
+  temp = (*state)[3][1];
+  (*state)[3][1] = (*state)[2][1];
+  (*state)[2][1] = (*state)[1][1];
+  (*state)[1][1] = (*state)[0][1];
+  (*state)[0][1] = temp;
+
+  // Rotate second row 2 columns to right 
+  temp = (*state)[0][2];
+  (*state)[0][2] = (*state)[2][2];
+  (*state)[2][2] = temp;
+
+  temp = (*state)[1][2];
+  (*state)[1][2] = (*state)[3][2];
+  (*state)[3][2] = temp;
+
+  // Rotate third row 3 columns to right
+  temp = (*state)[0][3];
+  (*state)[0][3] = (*state)[1][3];
+  (*state)[1][3] = (*state)[2][3];
+  (*state)[2][3] = (*state)[3][3];
+  (*state)[3][3] = temp;
+}
+#endif // #if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+
+// Cipher is the main function that encrypts the PlainText.
+static void Cipher(state_t* state, const uint8_t* RoundKey)
+{
+  uint8_t round = 0;
+
+  // Add the First round key to the state before starting the rounds.
+  AddRoundKey(0, state, RoundKey);
+
+  // There will be Nr rounds.
+  // The first Nr-1 rounds are identical.
+  // These Nr rounds are executed in the loop below.
+  // Last one without MixColumns()
+  for (round = 1; ; ++round)
+  {
+    SubBytes(state);
+    ShiftRows(state);
+    if (round == Nr) {
+      break;
+    }
+    MixColumns(state);
+    AddRoundKey(round, state, RoundKey);
+  }
+  // Add round key to last round
+  AddRoundKey(Nr, state, RoundKey);
+}
+
+#if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+static void InvCipher(state_t* state, const uint8_t* RoundKey)
+{
+  uint8_t round = 0;
+
+  // Add the First round key to the state before starting the rounds.
+  AddRoundKey(Nr, state, RoundKey);
+
+  // There will be Nr rounds.
+  // The first Nr-1 rounds are identical.
+  // These Nr rounds are executed in the loop below.
+  // Last one without InvMixColumn()
+  for (round = (Nr - 1); ; --round)
+  {
+    InvShiftRows(state);
+    InvSubBytes(state);
+    AddRoundKey(round, state, RoundKey);
+    if (round == 0) {
+      break;
+    }
+    InvMixColumns(state);
+  }
+
+}
+#endif // #if (defined(CBC) && CBC == 1) || (defined(ECB) && ECB == 1)
+
+/*****************************************************************************/
+/* Public functions:                                                         */
+/*****************************************************************************/
+#if defined(ECB) && (ECB == 1)
+
+
+void AES_ECB_encrypt(const struct AES_ctx* ctx, uint8_t* buf)
+{
+  // The next function call encrypts the PlainText with the Key using AES algorithm.
+  Cipher((state_t*)buf, ctx->RoundKey);
+}
+
+void AES_ECB_decrypt(const struct AES_ctx* ctx, uint8_t* buf)
+{
+  // The next function call decrypts the PlainText with the Key using AES algorithm.
+  InvCipher((state_t*)buf, ctx->RoundKey);
+}
+
+
+#endif // #if defined(ECB) && (ECB == 1)
+
+
+
+
+
+#if defined(CBC) && (CBC == 1)
+
+
+static void XorWithIv(uint8_t* buf, const uint8_t* Iv)
+{
+  uint8_t i;
+  for (i = 0; i < AES_BLOCKLEN; ++i) // The block in AES is always 128bit no matter the key size
+  {
+    buf[i] ^= Iv[i];
+  }
+}
+
+void AES_CBC_encrypt_buffer(struct AES_ctx *ctx, uint8_t* buf, size_t length)
+{
+  size_t i;
+  uint8_t *Iv = ctx->Iv;
+  for (i = 0; i < length; i += AES_BLOCKLEN)
+  {
+    XorWithIv(buf, Iv);
+    Cipher((state_t*)buf, ctx->RoundKey);
+    Iv = buf;
+    buf += AES_BLOCKLEN;
+  }
+  /* store Iv in ctx for next call */
+  memcpy(ctx->Iv, Iv, AES_BLOCKLEN);
+}
+
+void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length)
+{
+  size_t i;
+  uint8_t storeNextIv[AES_BLOCKLEN];
+  for (i = 0; i < length; i += AES_BLOCKLEN)
+  {
+    memcpy(storeNextIv, buf, AES_BLOCKLEN);
+    InvCipher((state_t*)buf, ctx->RoundKey);
+    XorWithIv(buf, ctx->Iv);
+    memcpy(ctx->Iv, storeNextIv, AES_BLOCKLEN);
+    buf += AES_BLOCKLEN;
+  }
+
+}
+
+#endif // #if defined(CBC) && (CBC == 1)
+
+
+
+#if defined(CTR) && (CTR == 1)
+
+/* Symmetrical operation: same function for encrypting as for decrypting. Note any IV/nonce should never be reused with the same key */
+void AES_CTR_xcrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length)
+{
+  uint8_t buffer[AES_BLOCKLEN];
+  
+  size_t i;
+  int bi;
+  for (i = 0, bi = AES_BLOCKLEN; i < length; ++i, ++bi)
+  {
+    if (bi == AES_BLOCKLEN) /* we need to regen xor compliment in buffer */
+    {
+      
+      memcpy(buffer, ctx->Iv, AES_BLOCKLEN);
+      Cipher((state_t*)buffer,ctx->RoundKey);
+
+      /* Increment Iv and handle overflow */
+      for (bi = (AES_BLOCKLEN - 1); bi >= 0; --bi)
+      {
+	/* inc will overflow */
+        if (ctx->Iv[bi] == 255)
+	{
+          ctx->Iv[bi] = 0;
+          continue;
+        } 
+        ctx->Iv[bi] += 1;
+        break;   
+      }
+      bi = 0;
+    }
+
+    buf[i] = (buf[i] ^ buffer[bi]);
+  }
+}
+
+#endif // #if defined(CTR) && (CTR == 1)
+
--- a/common/aes.h
+++ b/common/aes.h
@@ -0,0 +1,91 @@
+#ifndef _AES_H_
+#define _AES_H_
+
+#include <stdint.h>
+#include <stddef.h>
+
+// #define the macros below to 1/0 to enable/disable the mode of operation.
+//
+// CBC enables AES encryption in CBC-mode of operation.
+// CTR enables encryption in counter-mode.
+// ECB enables the basic ECB 16-byte block algorithm. All can be enabled simultaneously.
+
+// The #ifndef-guard allows it to be configured before #include'ing or at compile time.
+#ifndef CBC
+  #define CBC 1
+#endif
+
+#ifndef ECB
+  #define ECB 1
+#endif
+
+#ifndef CTR
+  #define CTR 1
+#endif
+
+
+#define AES128 1
+//#define AES192 1
+//#define AES256 1
+
+#define AES_BLOCKLEN 16 // Block length in bytes - AES is 128b block only
+
+#if defined(AES256) && (AES256 == 1)
+    #define AES_KEYLEN 32
+    #define AES_keyExpSize 240
+#elif defined(AES192) && (AES192 == 1)
+    #define AES_KEYLEN 24
+    #define AES_keyExpSize 208
+#else
+    #define AES_KEYLEN 16   // Key length in bytes
+    #define AES_keyExpSize 176
+#endif
+
+struct AES_ctx
+{
+  uint8_t RoundKey[AES_keyExpSize];
+#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
+  uint8_t Iv[AES_BLOCKLEN];
+#endif
+};
+
+void AES_init_ctx(struct AES_ctx* ctx, const uint8_t* key);
+#if (defined(CBC) && (CBC == 1)) || (defined(CTR) && (CTR == 1))
+void AES_init_ctx_iv(struct AES_ctx* ctx, const uint8_t* key, const uint8_t* iv);
+void AES_ctx_set_iv(struct AES_ctx* ctx, const uint8_t* iv);
+#endif
+
+#if defined(ECB) && (ECB == 1)
+// buffer size is exactly AES_BLOCKLEN bytes; 
+// you need only AES_init_ctx as IV is not used in ECB 
+// NB: ECB is considered insecure for most uses
+void AES_ECB_encrypt(const struct AES_ctx* ctx, uint8_t* buf);
+void AES_ECB_decrypt(const struct AES_ctx* ctx, uint8_t* buf);
+
+#endif // #if defined(ECB) && (ECB == !)
+
+
+#if defined(CBC) && (CBC == 1)
+// buffer size MUST be mutile of AES_BLOCKLEN;
+// Suggest https://en.wikipedia.org/wiki/Padding_(cryptography)#PKCS7 for padding scheme
+// NOTES: you need to set IV in ctx via AES_init_ctx_iv() or AES_ctx_set_iv()
+//        no IV should ever be reused with the same key 
+void AES_CBC_encrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length);
+void AES_CBC_decrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length);
+
+#endif // #if defined(CBC) && (CBC == 1)
+
+
+#if defined(CTR) && (CTR == 1)
+
+// Same function for encrypting as for decrypting. 
+// IV is incremented for every block, and used after encryption as XOR-compliment for output
+// Suggesting https://en.wikipedia.org/wiki/Padding_(cryptography)#PKCS7 for padding scheme
+// NOTES: you need to set IV in ctx with AES_init_ctx_iv() or AES_ctx_set_iv()
+//        no IV should ever be reused with the same key 
+void AES_CTR_xcrypt_buffer(struct AES_ctx* ctx, uint8_t* buf, size_t length);
+
+#endif // #if defined(CTR) && (CTR == 1)
+
+
+#endif // _AES_H_
--- a/common/encrypt.h
+++ b/common/encrypt.h
@@ -0,0 +1,124 @@
+#pragma once
+// This file implements a serial of data encoding methods.
+#include <vector>
+extern "C" {
+#include "aes.h"
+}
+
+#define ALIGN16(n)  ( (( (n) + 15) / 16) * 16 )
+
+// Encoder interface. The default encoder will do nothing.
+class Encoder {
+public:
+	virtual ~Encoder() {}
+	// Encode data before compress.
+	virtual void Encode(unsigned char* data, int len, unsigned char* param = 0) {}
+	// Decode data after uncompress.
+	virtual void Decode(unsigned char* data, int len, unsigned char* param = 0) {}
+};
+
+// XOR Encoder implementation.
+class XOREncoder : public Encoder {
+private:
+	std::vector<char> Keys;
+
+public:
+	XOREncoder(const std::vector<char>& keys = { 0 }) : Keys(keys) {}
+
+	virtual void Encode(unsigned char* data, int len, unsigned char* param = 0) {
+		XOR(data, len, Keys);
+	}
+
+	virtual void Decode(unsigned char* data, int len, unsigned char* param = 0) {
+		static std::vector<char> reversed(Keys.rbegin(), Keys.rend());
+		XOR(data, len, reversed);
+	}
+
+protected:
+	void XOR(unsigned char* data, int len, const std::vector<char>& keys) const {
+		for (char key : keys) {
+			for (int i = 0; i < len; ++i) {
+				data[i] ^= key;
+			}
+		}
+	}
+};
+
+// XOREncoder16 A simple Encoder for the TCP body. It's using for `HELL` protocol.
+// This method is provided by ChatGPT. Encode data according to the 6th and 7th elem.
+class XOREncoder16 : public Encoder {
+private:
+	static uint16_t pseudo_random(uint16_t seed, int index) {
+		return ((seed ^ (index * 251 + 97)) * 733) ^ (seed >> 3);
+	}
+
+	void encrypt_internal(unsigned char* data, int len, unsigned char k1, unsigned char k2) const {
+		uint16_t key = ((k1 << 8) | k2);
+		for (int i = 0; i < len; ++i) {
+			data[i] ^= (k1 + i * 13) ^ (k2 ^ (i << 1));
+		}
+
+		// Two rounds of pseudo-random swaps
+		for (int round = 0; round < 2; ++round) {
+			for (int i = 0; i < len; ++i) {
+				int j = pseudo_random(key, i + round * 100) % len;
+				std::swap(data[i], data[j]);
+			}
+		}
+	}
+
+	void decrypt_internal(unsigned char* data, int len, unsigned char k1, unsigned char k2) const {
+		uint16_t key = ((k1 << 8) | k2);
+		for (int round = 1; round >= 0; --round) {
+			for (int i = len - 1; i >= 0; --i) {
+				int j = pseudo_random(key, i + round * 100) % len;
+				std::swap(data[i], data[j]);
+			}
+		}
+
+		for (int i = 0; i < len; ++i) {
+			data[i] ^= (k1 + i * 13) ^ (k2 ^ (i << 1));
+		}
+	}
+
+#ifndef NO_AES
+	void aes_encrypt(unsigned char* data, int len, const unsigned char* key, const unsigned char* iv) {
+		if (!data || !key || !iv || len <= 0 || len % 16 != 0) {
+			return; // AES CBC requires data length to be multiple of 16
+		}
+
+		struct AES_ctx ctx;
+		AES_init_ctx_iv(&ctx, key, iv);
+		AES_CBC_encrypt_buffer(&ctx, data, len);
+	}
+
+	void aes_decrypt(unsigned char* data, int len, const unsigned char* key, const unsigned char* iv) {
+		if (!data || !key || !iv || len <= 0 || len % 16 != 0)
+			return;
+
+		struct AES_ctx ctx;
+		AES_init_ctx_iv(&ctx, key, iv);
+		AES_CBC_decrypt_buffer(&ctx, data, len);
+	}
+#endif
+
+public:
+	XOREncoder16() {}
+
+	void Encode(unsigned char* data, int len, unsigned char* param) override {
+		if (param[6] == 0 && param[7] == 0) return;
+		if (param[7] == 1) {
+#ifndef NO_AES
+			static const unsigned char aes_key[16] = {
+				0x5A, 0xC3, 0x17, 0xF0,	0x89, 0xB6, 0x4E, 0x7D,	0x1A, 0x22, 0x9F, 0xC8,	0xD3, 0xE6, 0x73, 0xB1 };
+			return aes_encrypt(data, len, aes_key, param + 8);
+#endif
+		}
+		encrypt_internal(data, len, param[6], param[7]);
+	}
+
+	void Decode(unsigned char* data, int len, unsigned char* param) override {
+		if (param[6] == 0 && param[7] == 0) return;
+		decrypt_internal(data, len, param[6], param[7]);
+	}
+};
--- a/common/header.h
+++ b/common/header.h
@@ -0,0 +1,172 @@
+#pragma once
+// This file implements a serial of data header encoding methods.
+#include <cstring>
+#include <common/skCrypter.h>
+
+#define MSG_HEADER "HELL"
+
+enum HeaderEncType {
+	HeaderEncUnknown = -1,
+	HeaderEncNone,
+	HeaderEncV1,
+};
+
+// <20><><EFBFBD>ݱ<EFBFBD><DDB1><EFBFBD><EFBFBD><EFBFBD>ʽ<EFBFBD><CABD><EFBFBD><EFBFBD>ʶ<EFBFBD><CAB6> + <20><><EFBFBD><EFBFBD><EFBFBD>󳤶<EFBFBD>(4<>ֽ<EFBFBD>) + <20><><EFBFBD><EFBFBD><EFBFBD>󳤶<EFBFBD>(4<>ֽ<EFBFBD>)
+const int FLAG_COMPLEN = 4;
+const int FLAG_LENGTH = 8;
+const int HDR_LENGTH = FLAG_LENGTH + 2 * sizeof(unsigned int);
+const int MIN_COMLEN = 8;
+
+typedef void (*EncFun)(unsigned char* data, size_t length, unsigned char key);
+typedef void (*DecFun)(unsigned char* data, size_t length, unsigned char key);
+inline void default_encrypt(unsigned char* data, size_t length, unsigned char key) {
+	data[FLAG_LENGTH - 2] = data[FLAG_LENGTH - 1] = 0;
+}
+inline void default_decrypt(unsigned char* data, size_t length, unsigned char key) {
+}
+
+// <20><><EFBFBD>ܺ<EFBFBD><DCBA><EFBFBD>
+inline void encrypt(unsigned char* data, size_t length, unsigned char key) {
+	if (key == 0) return;
+	for (size_t i = 0; i < length; ++i) {
+		unsigned char k = static_cast<unsigned char>(key ^ (i * 31));  // <20><>̬<EFBFBD>Ŷ<EFBFBD> key
+		int value = static_cast<int>(data[i]);
+		switch (i % 4) {
+		case 0:
+			value += k;
+			break;
+		case 1:
+			value = value ^ k;
+			break;
+		case 2:
+			value -= k;
+			break;
+		case 3:
+			value = ~(value ^ k);  // <20>ಽ<EFBFBD>任<EFBFBD><E4BBBB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȡ<EFBFBD><C8A1>
+			break;
+		}
+		data[i] = static_cast<unsigned char>(value & 0xFF);
+	}
+}
+
+// <20><><EFBFBD>ܺ<EFBFBD><DCBA><EFBFBD>
+inline void decrypt(unsigned char* data, size_t length, unsigned char key) {
+	if (key == 0) return;
+	for (size_t i = 0; i < length; ++i) {
+		unsigned char k = static_cast<unsigned char>(key ^ (i * 31));
+		int value = static_cast<int>(data[i]);
+		switch (i % 4) {
+		case 0:
+			value -= k;
+			break;
+		case 1:
+			value = value ^ k;
+			break;
+		case 2:
+			value += k;
+			break;
+		case 3:
+			value = ~(value) ^ k;  // <20>⿪<EFBFBD><E2BFAA><EFBFBD><EFBFBD>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+			break;
+		}
+		data[i] = static_cast<unsigned char>(value & 0xFF);
+	}
+}
+
+inline EncFun GetHeaderEncoder(HeaderEncType type) {
+	switch (type)
+	{
+	case HeaderEncNone:
+		return default_encrypt;
+	case HeaderEncV1:
+		return encrypt;
+	default:
+		return NULL;
+	}
+}
+
+typedef struct HeaderFlag {
+	char Data[FLAG_LENGTH + 1];
+	HeaderFlag(const char header[FLAG_LENGTH + 1]) {
+		memcpy(Data, header, sizeof(Data));
+	}
+	char& operator[](int i) {
+		return Data[i];
+	}
+	const char operator[](int i) const {
+		return Data[i];
+	}
+	const char* data() const {
+		return Data;
+	}
+}HeaderFlag;
+
+// д<><D0B4><EFBFBD><EFBFBD><EFBFBD>ݰ<EFBFBD><DDB0><EFBFBD>ͷ
+inline HeaderFlag GetHead(EncFun enc) {
+	char header[FLAG_LENGTH + 1] = { 'H','E','L','L', 0 };
+	HeaderFlag H(header);
+	unsigned char key = time(0) % 256;
+	H[FLAG_LENGTH - 2] = key;
+	H[FLAG_LENGTH - 1] = ~key;
+	enc((unsigned char*)H.data(), FLAG_COMPLEN, H[FLAG_LENGTH - 2]);
+	return H;
+}
+
+enum FlagType {
+	FLAG_UNKNOWN = 0,
+	FLAG_SHINE = 1,
+	FLAG_FUCK = 2,
+	FLAG_HELLO = 3,
+	FLAG_HELL = 4,
+};
+
+inline int compare(const char *flag, const char *magic, int len, DecFun dec, unsigned char key){
+	unsigned char buf[32] = {};
+	memcpy(buf, flag, MIN_COMLEN);
+	dec(buf, len, key);
+	if (memcmp(buf, magic, len) == 0) {
+		memcpy((void*)flag, buf, MIN_COMLEN);
+		return 0;
+	}
+	return -1;
+}
+
+// <20>ȶ<EFBFBD><C8B6><EFBFBD><EFBFBD>ݰ<EFBFBD>ǰ<EFBFBD><C7B0><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD>
+// <20><><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8><EFBFBD>Ľ<EFBFBD><C4BD>ܺ<EFBFBD><DCBA><EFBFBD><EFBFBD>ȶ<EFBFBD><C8B6><EFBFBD><EFBFBD>ݰ<EFBFBD>ͷ<EFBFBD><CDB7><EFBFBD>н<EFBFBD><D0BD>ܣ<EFBFBD><DCA3><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>бȶ<D0B1>
+inline FlagType CheckHead(const char* flag, DecFun dec) {
+	FlagType type = FLAG_UNKNOWN;
+	if (compare(flag, skCrypt(MSG_HEADER), FLAG_COMPLEN, dec, flag[6]) == 0) {
+		type = FLAG_HELL;
+	}
+	else if (compare(flag, skCrypt("Shine"), 5, dec, 0) == 0) {
+		type = FLAG_SHINE;
+	}
+	else if (compare(flag, skCrypt("<<FUCK>>"), 8, dec, 0) == 0) {
+		type = FLAG_FUCK;
+	}
+	else if (compare(flag, skCrypt("Hello?"), 6, dec, flag[6]) == 0) {
+		type = FLAG_HELLO;
+	}
+	else {
+		type = FLAG_UNKNOWN;
+	}
+	return type;
+}
+
+// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD>Զ<EFBFBD><D4B6>ַ<EFBFBD><D6B7><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ա<EFBFBD><D4B1>ܼ<EFBFBD><DCBC><EFBFBD><EFBFBD>ϰ汾ͨѶЭ<D1B6><D0AD>
+inline FlagType CheckHead(char* flag, HeaderEncType& funcHit) {
+	static const DecFun methods[] = { default_decrypt, decrypt };
+	static const int methodNum = sizeof(methods) / sizeof(DecFun);
+	char buffer[FLAG_LENGTH + 1] = {};
+	for (int i = 0; i < methodNum; ++i) {
+		memcpy(buffer, flag, FLAG_LENGTH);
+		FlagType type = CheckHead(buffer, methods[i]);
+		if (type != FLAG_UNKNOWN) {
+			memcpy(flag, buffer, FLAG_LENGTH);
+			funcHit = HeaderEncType(i);
+			return type;
+		}
+	}
+	funcHit = HeaderEncUnknown;
+	return FLAG_UNKNOWN;
+}
--- a/common/md5.h
+++ b/common/md5.h
@@ -0,0 +1,42 @@
+#pragma once
+
+#include <wincrypt.h>
+
+inline std::string CalcMD5FromBytes(const BYTE* data, DWORD length) {
+	HCRYPTPROV hProv = 0;
+	HCRYPTHASH hHash = 0;
+	BYTE hash[16]; // MD5 <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> 16 <20>ֽ<EFBFBD>
+	DWORD hashLen = sizeof(hash);
+	std::ostringstream oss;
+
+	if (!CryptAcquireContext(&hProv, NULL, NULL, PROV_RSA_FULL, CRYPT_VERIFYCONTEXT)) {
+		return "";
+	}
+
+	if (!CryptCreateHash(hProv, CALG_MD5, 0, 0, &hHash)) {
+		CryptReleaseContext(hProv, 0);
+		return "";
+	}
+
+	if (!CryptHashData(hHash, data, length, 0)) {
+		CryptDestroyHash(hHash);
+		CryptReleaseContext(hProv, 0);
+		return "";
+	}
+
+	if (!CryptGetHashParam(hHash, HP_HASHVAL, hash, &hashLen, 0)) {
+		CryptDestroyHash(hHash);
+		CryptReleaseContext(hProv, 0);
+		return "";
+	}
+
+	// ת<><D7AA>Ϊʮ<CEAA><CAAE><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ַ<EFBFBD><D6B7><EFBFBD>
+	for (DWORD i = 0; i < hashLen; ++i) {
+		oss << std::hex << std::setw(2) << std::setfill('0') << (int)hash[i];
+	}
+
+	CryptDestroyHash(hHash);
+	CryptReleaseContext(hProv, 0);
+
+	return oss.str();
+}
--- a/server/2015Remote/2015Remote.cpp
+++ b/server/2015Remote/2015Remote.cpp
@@ -66,6 +66,8 @@ CMy2015RemoteApp::CMy2015RemoteApp()
 	m_Mutex = NULL;

 	m_iocpServer = new IOCPServer();
+
+	srand(static_cast<unsigned int>(time(0)));
 }


--- a/server/2015Remote/2015Remote.rc
+++ b/server/2015Remote/2015Remote.rc
--- a/server/2015Remote/2015RemoteDlg.cpp
+++ b/server/2015Remote/2015RemoteDlg.cpp
--- a/server/2015Remote/2015RemoteDlg.h
+++ b/server/2015Remote/2015RemoteDlg.h
@@ -222,7 +222,8 @@ public:
 	afx_msg LRESULT OnOpenVideoDialog(WPARAM wParam, LPARAM lParam);
 	afx_msg LRESULT OnHandleMessage(WPARAM wParam, LPARAM lParam);
 	afx_msg LRESULT OnOpenKeyboardDialog(WPARAM wParam, LPARAM lParam);
-
+	afx_msg LRESULT OnOpenHideScreenDialog(WPARAM wParam, LPARAM lParam);
+	afx_msg LRESULT OnOpenMachineManagerDialog(WPARAM wParam, LPARAM lParam);
 	afx_msg LRESULT OnOpenProxyDialog(WPARAM wParam, LPARAM lParam);
 	afx_msg LRESULT UPXProcResult(WPARAM wParam, LPARAM lParam);
 	afx_msg BOOL OnHelpInfo(HELPINFO* pHelpInfo);
--- a/server/2015Remote/2015Remote_vs2015.vcxproj
+++ b/server/2015Remote/2015Remote_vs2015.vcxproj
@@ -75,21 +75,21 @@
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
    <LinkIncremental>true</LinkIncremental>
    <IncludePath>$(WindowsSDK_IncludePath);$(VLDPATH)\include\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter;$(ProjectDir);$(SolutionDir)common;$(IncludePath)</IncludePath>
-    <LibraryPath>$(VLDPATH)\lib\Win32\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(LibraryPath)</LibraryPath>
+    <LibraryPath>$(VLDPATH)\lib\Win32\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(SolutionDir)..\SimpleRemoter;$(LibraryPath)</LibraryPath>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
    <LinkIncremental>true</LinkIncremental>
    <IncludePath>$(WindowsSDK_IncludePath);$(VLDPATH)\include\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter;$(ProjectDir);$(SolutionDir)common;$(IncludePath)</IncludePath>
-    <LibraryPath>$(VLDPATH)\lib\Win64\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(LibraryPath)</LibraryPath>
+    <LibraryPath>$(VLDPATH)\lib\Win64\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(SolutionDir)..\SimpleRemoter;$(LibraryPath)</LibraryPath>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
    <LinkIncremental>false</LinkIncremental>
-    <LibraryPath>$(VLDPATH)\lib\Win32\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(LibraryPath)</LibraryPath>
+    <LibraryPath>$(VLDPATH)\lib\Win32\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(SolutionDir)..\SimpleRemoter;$(LibraryPath)</LibraryPath>
    <IncludePath>$(WindowsSDK_IncludePath);$(VLDPATH)\include\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter;$(ProjectDir);$(SolutionDir)common;$(IncludePath)</IncludePath>
  </PropertyGroup>
  <PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
    <LinkIncremental>false</LinkIncremental>
-    <LibraryPath>$(VLDPATH)\lib\Win64\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(LibraryPath)</LibraryPath>
+    <LibraryPath>$(VLDPATH)\lib\Win64\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter\lib;$(SolutionDir);$(SolutionDir)..\SimpleRemoter;$(LibraryPath)</LibraryPath>
    <IncludePath>$(WindowsSDK_IncludePath);$(VLDPATH)\include\;$(SolutionDir)..\SimpleRemoter\compress;$(SolutionDir)..\SimpleRemoter;$(ProjectDir);$(SolutionDir)common;$(IncludePath)</IncludePath>
  </PropertyGroup>
  <ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">
@@ -97,10 +97,11 @@
      <PrecompiledHeader>Use</PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_WINDOWS;_DEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_WINDOWS;_DEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;CBC;_WIN32_WINNT=0x0602;WINVER=0x0602;NTDDI_VERSION=0x06020000;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <MultiProcessorCompilation>true</MultiProcessorCompilation>
      <MinimalRebuild>false</MinimalRebuild>
      <AdditionalIncludeDirectories>$(SolutionDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <OpenMPSupport>false</OpenMPSupport>
    </ClCompile>
    <Link>
      <SubSystem>Windows</SubSystem>
@@ -108,6 +109,7 @@
      <AdditionalDependencies>zlib\zlib.lib;%(AdditionalDependencies)</AdditionalDependencies>
      <IgnoreSpecificDefaultLibraries>LIBCMT.lib;%(IgnoreSpecificDefaultLibraries)</IgnoreSpecificDefaultLibraries>
      <OutputFile>$(SolutionDir)Bin\$(TargetName)_x86d$(TargetExt)</OutputFile>
+      <ImageHasSafeExceptionHandlers>true</ImageHasSafeExceptionHandlers>
    </Link>
    <Midl>
      <MkTypLibCompatible>false</MkTypLibCompatible>
@@ -125,10 +127,11 @@
      <PrecompiledHeader>Use</PrecompiledHeader>
      <WarningLevel>Level3</WarningLevel>
      <Optimization>Disabled</Optimization>
-      <PreprocessorDefinitions>WIN32;_WINDOWS;_DEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_WINDOWS;_DEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;CBC;_WIN32_WINNT=0x0602;WINVER=0x0602;NTDDI_VERSION=0x06020000;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <MultiProcessorCompilation>true</MultiProcessorCompilation>
      <MinimalRebuild>false</MinimalRebuild>
      <AdditionalIncludeDirectories>$(SolutionDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <OpenMPSupport>false</OpenMPSupport>
    </ClCompile>
    <Link>
      <SubSystem>Windows</SubSystem>
@@ -153,11 +156,12 @@
      <PrecompiledHeader>Use</PrecompiledHeader>
      <Optimization>MinSpace</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PreprocessorDefinitions>WIN32;_WINDOWS;NDEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_WINDOWS;NDEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;CBC;_WIN32_WINNT=0x0602;WINVER=0x0602;NTDDI_VERSION=0x06020000;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <MultiProcessorCompilation>true</MultiProcessorCompilation>
      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
      <StringPooling>true</StringPooling>
      <AdditionalIncludeDirectories>$(SolutionDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <OpenMPSupport>false</OpenMPSupport>
    </ClCompile>
    <Link>
      <SubSystem>Windows</SubSystem>
@@ -185,11 +189,12 @@
      <PrecompiledHeader>Use</PrecompiledHeader>
      <Optimization>MinSpace</Optimization>
      <FunctionLevelLinking>true</FunctionLevelLinking>
-      <PreprocessorDefinitions>WIN32;_WINDOWS;NDEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;%(PreprocessorDefinitions)</PreprocessorDefinitions>
+      <PreprocessorDefinitions>WIN32;_WINDOWS;NDEBUG;_CRT_SECURE_NO_WARNINGS;ZLIB_WINAPI;HPSOCKET_STATIC_LIB;CBC;_WIN32_WINNT=0x0602;WINVER=0x0602;NTDDI_VERSION=0x06020000;%(PreprocessorDefinitions)</PreprocessorDefinitions>
      <MultiProcessorCompilation>true</MultiProcessorCompilation>
      <FavorSizeOrSpeed>Size</FavorSizeOrSpeed>
      <StringPooling>true</StringPooling>
      <AdditionalIncludeDirectories>$(SolutionDir);%(AdditionalIncludeDirectories)</AdditionalIncludeDirectories>
+      <OpenMPSupport>false</OpenMPSupport>
    </ClCompile>
    <Link>
      <SubSystem>Windows</SubSystem>
@@ -243,6 +248,8 @@
  </ItemGroup>
  <ItemGroup>
    <ClInclude Include="..\..\client\Audio.h" />
+    <ClInclude Include="..\..\common\aes.h" />
+    <ClInclude Include="..\..\common\encrypt.h" />
    <ClInclude Include="2015Remote.h" />
    <ClInclude Include="2015RemoteDlg.h" />
    <ClInclude Include="AudioDlg.h" />
@@ -250,10 +257,12 @@
    <ClInclude Include="BuildDlg.h" />
    <ClInclude Include="CPasswordDlg.h" />
    <ClInclude Include="CpuUseage.h" />
+    <ClInclude Include="CTextDlg.h" />
    <ClInclude Include="DateVerify.h" />
    <ClInclude Include="EditDialog.h" />
    <ClInclude Include="FileManagerDlg.h" />
    <ClInclude Include="FileTransferModeDlg.h" />
+    <ClInclude Include="HideScreenSpyDlg.h" />
    <ClInclude Include="iniFile.h" />
    <ClInclude Include="InputDlg.h" />
    <ClInclude Include="IOCPServer.h" />
@@ -273,6 +282,10 @@
    <ClInclude Include="ShellDlg.h" />
    <ClInclude Include="stdafx.h" />
    <ClInclude Include="SystemDlg.h" />
+    <ClInclude Include="sys\CCreateTaskDlg.h" />
+    <ClInclude Include="sys\CInjectCodeDlg.h" />
+    <ClInclude Include="sys\MachineDlg.h" />
+    <ClInclude Include="sys\ServiceInfoDlg.h" />
    <ClInclude Include="TalkDlg.h" />
    <ClInclude Include="targetver.h" />
    <ClInclude Include="TrueColorToolBar.h" />
@@ -282,11 +295,11 @@
  </ItemGroup>
  <ItemGroup>
    <ClCompile Include="..\..\client\Audio.cpp" />
-    <ClCompile Include="..\..\client\Loader.cpp">
-      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">NotUsing</PrecompiledHeader>
+    <ClCompile Include="..\..\common\aes.c">
      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">NotUsing</PrecompiledHeader>
-      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">NotUsing</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">NotUsing</PrecompiledHeader>
      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">NotUsing</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">NotUsing</PrecompiledHeader>
    </ClCompile>
    <ClCompile Include="2015Remote.cpp" />
    <ClCompile Include="2015RemoteDlg.cpp" />
@@ -295,13 +308,21 @@
    <ClCompile Include="BuildDlg.cpp" />
    <ClCompile Include="CPasswordDlg.cpp" />
    <ClCompile Include="CpuUseage.cpp" />
+    <ClCompile Include="CTextDlg.cpp" />
    <ClCompile Include="EditDialog.cpp" />
    <ClCompile Include="FileManagerDlg.cpp" />
    <ClCompile Include="FileTransferModeDlg.cpp" />
+    <ClCompile Include="HideScreenSpyDlg.cpp" />
    <ClCompile Include="iniFile.cpp" />
    <ClCompile Include="InputDlg.cpp" />
    <ClCompile Include="IOCPServer.cpp" />
    <ClCompile Include="KeyBoardDlg.cpp" />
+    <ClCompile Include="Loader.c">
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">NotUsing</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">NotUsing</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">NotUsing</PrecompiledHeader>
+      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Debug|Win32'">NotUsing</PrecompiledHeader>
+    </ClCompile>
    <ClCompile Include="parse_ip.cpp" />
    <ClCompile Include="proxy\ProxyConnectServer.cpp" />
    <ClCompile Include="proxy\ProxyMapDlg.cpp" />
@@ -318,6 +339,10 @@
      <PrecompiledHeader Condition="'$(Configuration)|$(Platform)'=='Release|x64'">Create</PrecompiledHeader>
    </ClCompile>
    <ClCompile Include="SystemDlg.cpp" />
+    <ClCompile Include="sys\CCreateTaskDlg.cpp" />
+    <ClCompile Include="sys\CInjectCodeDlg.cpp" />
+    <ClCompile Include="sys\MachineDlg.cpp" />
+    <ClCompile Include="sys\ServiceInfoDlg.cpp" />
    <ClCompile Include="TalkDlg.cpp" />
    <ClCompile Include="TrueColorToolBar.cpp" />
    <ClCompile Include="VideoDlg.cpp" />
@@ -335,10 +360,14 @@
    <Image Include="res\Bitmap_4.bmp" />
    <Image Include="res\Bitmap_5.bmp" />
    <Image Include="res\delete.bmp" />
+    <Image Include="res\icon2.ico" />
    <Image Include="res\keyboard.ico" />
+    <Image Include="res\machine.ico" />
    <Image Include="res\password.ico" />
    <Image Include="res\proxifler.ico" />
    <Image Include="res\proxy.ico" />
+    <Image Include="res\screen.ico" />
+    <Image Include="res\system.ico" />
    <Image Include="res\toolbar1.bmp" />
    <Image Include="res\toolbar2.bmp" />
    <Image Include="res\update.bmp" />
--- a/server/2015Remote/Buffer.cpp
+++ b/server/2015Remote/Buffer.cpp
@@ -47,7 +47,7 @@ ULONG CBuffer::RemoveCompletedBuffer(ULONG ulLength)

 	if (ulLength)
 	{
-		MoveMemory(m_Base,m_Base+ulLength, m_ulMaxLength - ulLength);   //<2F><><EFBFBD><EFBFBD>ǰ<EFBFBD><C7B0>  [Shinexxxx??]
+		MoveMemory(m_Base,m_Base+ulLength, m_ulMaxLength - ulLength);

 		m_Ptr -= ulLength;
 	}
@@ -126,7 +126,7 @@ BOOL CBuffer::WriteBuffer(PBYTE Buffer, ULONG ulLength)
 		return false;
 	}

-	CopyMemory(m_Ptr,Buffer,ulLength);//Hello 5
+	CopyMemory(m_Ptr,Buffer,ulLength);

 	m_Ptr+=ulLength;
 	LeaveCriticalSection(&m_cs);
--- a/server/2015Remote/Buffer.h
+++ b/server/2015Remote/Buffer.h
@@ -7,6 +7,8 @@ class Buffer {
 private:
 	PBYTE buf;
 	ULONG len;
+	ULONG padding;
+	std::string md5;
 	ULONG *ref;
 	void AddRef() {
 		(*ref)++;
@@ -30,10 +32,11 @@ public:
 			ref = NULL;
 		}
 	}
-	Buffer():buf(NULL), len(0), ref(new ULONG(1)) {
+	Buffer():buf(NULL), len(0), ref(new ULONG(1)), padding(0) {

 	}
-	Buffer(const BYTE * b, int n):len(n), ref(new ULONG(1)){
+	Buffer(const BYTE * b, int n, int padding=0, const std::string& md5="") :
+		len(n), ref(new ULONG(1)), padding(padding), md5(md5){
 		buf = new BYTE[n];
 		memcpy(buf, b, n);
 	}
@@ -53,8 +56,11 @@ public:
 	char* c_str() const {
 		return (char*)buf;
 	}
-	ULONG length()const {
-		return len;
+	ULONG length(bool noPadding=false)const {
+		return noPadding ? len - padding : len;
+	}
+	std::string MD5() const {
+		return md5;
 	}
 };

@@ -66,10 +72,11 @@ public:

 	ULONG ReadBuffer(PBYTE Buffer, ULONG ulLength);
 	ULONG GetBufferLength(); // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ч<EFBFBD><D0A7><EFBFBD>ݳ<EFBFBD><DDB3><EFBFBD>
+	ULONG GetBufferLen() { return GetBufferLength(); }
 	VOID ClearBuffer();
 	BOOL WriteBuffer(PBYTE Buffer, ULONG ulLength);
 	BOOL Write(PBYTE Buffer, ULONG ulLength) { return WriteBuffer(Buffer, ulLength); }
-	LPBYTE GetBuffer(ULONG ulPos);
+	LPBYTE GetBuffer(ULONG ulPos=0);
 	Buffer GetMyBuffer(ULONG ulPos);
 	BYTE GetBYTE(ULONG ulPos);
 	BOOL CopyBuffer(PVOID pDst, ULONG nLen, ULONG ulPos);
--- a/server/2015Remote/BuildDlg.cpp
+++ b/server/2015Remote/BuildDlg.cpp
@@ -144,7 +144,7 @@ void CBuildDlg::OnBnClickedOk()
 		return;
 	}
 	//////////<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϣ//////////////////////
-	CONNECT_ADDRESS g_ConnectAddress = { FLAG_FINDEN, "127.0.0.1", "", typ, false, DLL_VERSION, 0, startup };
+	CONNECT_ADDRESS g_ConnectAddress = { FLAG_FINDEN, "127.0.0.1", "", typ, false, DLL_VERSION, 0, startup, HeaderEncV1 };
 	g_ConnectAddress.SetServer(m_strIP, atoi(m_strPort));

 	if (!g_ConnectAddress.IsValid()) {
--- a/server/2015Remote/CTextDlg.cpp
+++ b/server/2015Remote/CTextDlg.cpp
@@ -0,0 +1,51 @@
+// CTextDlg.cpp: ʵ<><CAB5><EFBFBD>ļ<EFBFBD>
+//
+
+#include "stdafx.h"
+#include "2015Remote.h"
+#include "CTextDlg.h"
+#include "afxdialogex.h"
+
+#ifdef _DEBUG
+#define new DEBUG_NEW
+#endif
+
+// CTextDlg <20>Ի<EFBFBD><D4BB><EFBFBD>
+
+IMPLEMENT_DYNAMIC(CTextDlg, CDialog)
+
+CTextDlg::CTextDlg(CWnd* pParent /*=nullptr*/)
+    : CDialog(IDD_TEXT, pParent)
+    , nowstr(_T(""))
+    , cmeline(_T(""))
+    , oldstr(_T(""))
+{
+}
+
+CTextDlg::~CTextDlg()
+{
+}
+
+void CTextDlg::DoDataExchange(CDataExchange* pDX)
+{
+    CDialog::DoDataExchange(pDX);
+    DDX_Text(pDX, IDC_EDIT1, oldstr);
+    DDX_Text(pDX, IDC_EDIT2, nowstr);
+    DDX_Text(pDX, IDC_EDIT3, cmeline);
+}
+
+
+BEGIN_MESSAGE_MAP(CTextDlg, CDialog)
+    ON_BN_CLICKED(IDOK, &CTextDlg::OnBnClickedOk)
+
+END_MESSAGE_MAP()
+
+
+// CTextDlg <20><>Ϣ<EFBFBD><CFA2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+
+
+void CTextDlg::OnBnClickedOk()
+{
+    UpdateData(TRUE);
+    CDialog::OnOK();
+}
--- a/server/2015Remote/CTextDlg.h
+++ b/server/2015Remote/CTextDlg.h
@@ -0,0 +1,27 @@
+#pragma once
+
+
+// CTextDlg <20>Ի<EFBFBD><D4BB><EFBFBD>
+
+class CTextDlg : public CDialog
+{
+    DECLARE_DYNAMIC(CTextDlg)
+
+public:
+    CTextDlg(CWnd* pParent = nullptr);   // <20><>׼<EFBFBD><D7BC><EFBFBD>캯<EFBFBD><ECBAAF>
+    virtual ~CTextDlg();
+    CString	oldstr;
+    CString nowstr;
+    CString cmeline;
+    // <20>Ի<EFBFBD><D4BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+#ifdef AFX_DESIGN_TIME
+    enum { IDD = IDD_TEXT };
+#endif
+
+protected:
+    virtual void DoDataExchange(CDataExchange* pDX);    // DDX/DDV ֧<><D6A7>
+
+    DECLARE_MESSAGE_MAP()
+public:
+    afx_msg void OnBnClickedOk();
+};
--- a/server/2015Remote/HideScreenSpyDlg.cpp
+++ b/server/2015Remote/HideScreenSpyDlg.cpp
@@ -0,0 +1,927 @@
+// ScreenSpyDlg.cpp : implementation file
+//
+
+#include "stdafx.h"
+#include "2015Remote.h"
+#include "InputDlg.h"
+#include "CTextDlg.h"
+#include "HideScreenSpyDlg.h"
+#include <windows.h>
+
+#ifdef _DEBUG
+#define new DEBUG_NEW
+#endif
+
+/////////////////////////////////////////////////////////////////////////////
+// CHideScreenSpyDlg dialog
+enum {
+    IDM_SET_FLUSH = 0x0010,
+    IDM_CONTROL,
+    IDM_SAVEDIB,		// 保存图片
+    IDM_SAVEAVI_S,      // 保存录像
+    IDM_GET_CLIPBOARD,	// 获取剪贴板
+    IDM_SET_CLIPBOARD,	// 设置剪贴板
+    IDM_SETSCERRN,		// 修改分辨率
+    IDM_QUALITY60,		// 清晰度低
+    IDM_QUALITY85,		// 清晰度中
+    IDM_QUALITY100,		// 清晰度高
+
+    IDM_FPS_1,
+    IDM_FPS_5,
+    IDM_FPS_10,
+    IDM_FPS_15,
+    IDM_FPS_20,
+    IDM_FPS_25,
+    IDM_FPS_30,
+};
+
+IMPLEMENT_DYNAMIC(CHideScreenSpyDlg, CDialog)
+
+CHideScreenSpyDlg::CHideScreenSpyDlg(CWnd* pParent, ISocketBase* pIOCPServer, ClientContext* pContext)
+    : DialogBase(CHideScreenSpyDlg::IDD, pParent, pIOCPServer, pContext, 0)
+{
+    m_iocpServer = pIOCPServer;
+    m_ContextObject = pContext;
+    m_bIsFirst = true; // 如果是第一次打开对话框，显示提示等待信息
+    m_BitmapData_Full = NULL;
+    m_lpvRectBits = NULL;
+    m_hIcon = LoadIcon(AfxGetInstanceHandle(), MAKEINTRESOURCE(IDI_SCREENSYP));
+    m_IPAddress = m_ContextObject->GetPeerName().c_str();
+    UINT	nBISize = m_ContextObject->GetBufferLength() - 1;
+    m_BitmapInfor_Full = (BITMAPINFO*) new BYTE[nBISize];
+    m_lpbmi_rect = (BITMAPINFO*) new BYTE[nBISize];
+    memcpy(m_BitmapInfor_Full, m_ContextObject->GetBuffer(1), nBISize);
+    memcpy(m_lpbmi_rect, m_ContextObject->GetBuffer(1), nBISize);
+    m_bIsCtrl = true;
+    m_bIsClosed = FALSE;
+    m_ClientCursorPos = {};
+    m_bCursorIndex = -1;
+}
+
+CHideScreenSpyDlg::~CHideScreenSpyDlg() {
+	m_bIsClosed = TRUE;
+	m_iocpServer->Disconnect(m_ContextObject);
+	DestroyIcon(m_hIcon);
+	Sleep(200);
+	if (!m_aviFile.IsEmpty()) {
+		KillTimer(132);
+		m_aviFile = "";
+		m_aviStream.Close();
+	}
+	::ReleaseDC(m_hWnd, m_hFullDC);
+	DeleteDC(m_hFullMemDC);
+	DeleteObject(m_BitmapHandle);
+	SAFE_DELETE_ARRAY(m_lpvRectBits);
+	SAFE_DELETE_ARRAY(m_BitmapInfor_Full);
+	SAFE_DELETE_ARRAY(m_lpbmi_rect);
+	SetClassLongPtr(m_hWnd, GCLP_HCURSOR, (LONG_PTR)LoadCursor(NULL, IDC_ARROW));
+	m_bIsCtrl = false;
+}
+
+void CHideScreenSpyDlg::DoDataExchange(CDataExchange* pDX)
+{
+    CDialog::DoDataExchange(pDX);
+}
+
+
+BEGIN_MESSAGE_MAP(CHideScreenSpyDlg, CDialog)
+    ON_WM_SYSCOMMAND()
+    ON_WM_SIZE()
+    ON_WM_PAINT()
+    ON_WM_TIMER()
+    ON_WM_CLOSE()
+END_MESSAGE_MAP()
+
+
+/////////////////////////////////////////////////////////////////////////////
+// CHideScreenSpyDlg message handlers
+void CHideScreenSpyDlg::OnClose()
+{
+    m_ContextObject->CancelIO();
+
+	CDialogBase::OnClose();
+}
+
+void CHideScreenSpyDlg::OnReceiveComplete()
+{
+    if (m_bIsClosed) 	return;
+    switch (m_ContextObject->GetBuffer(0)[0]) {
+    case TOKEN_FIRSTSCREEN: {
+        m_bIsFirst = false;
+        DrawFirstScreen(m_ContextObject->GetBuffer(1), m_ContextObject->GetBufferLength()-1);
+    }
+    break;
+	case TOKEN_NEXTSCREEN: {
+		DrawNextScreenDiff(m_ContextObject->GetBuffer(0), m_ContextObject->GetBufferLength());
+		break;
+	}
+    case TOKEN_BITMAPINFO_HIDE:
+        ResetScreen();
+        break;
+    case TOKEN_CLIPBOARD_TEXT:
+        UpdateServerClipboard((char*)m_ContextObject->GetBuffer(1), m_ContextObject->GetBufferLength() - 1);
+        break;
+    case TOKEN_SCREEN_SIZE:
+        memcpy(&m_rect, m_ContextObject->GetBuffer(0) + 1, sizeof(RECT));
+        return;
+    default:
+        Mprintf("Unknown command: %d\n", (int)m_ContextObject->GetBuffer(0)[0]);
+        return;
+    }
+}
+
+
+bool CHideScreenSpyDlg::SaveSnapshot()
+{
+    CString	strFileName = m_IPAddress + CTime::GetCurrentTime().Format(_T("_%Y-%m-%d_%H-%M-%S.bmp"));
+    CFileDialog dlg(FALSE, _T("bmp"), strFileName, OFN_OVERWRITEPROMPT, _T("位图文件(*.bmp)|*.bmp|"), this);
+    if (dlg.DoModal() != IDOK)
+        return false;
+
+    BITMAPFILEHEADER	hdr;
+    LPBITMAPINFO		lpbi = m_BitmapInfor_Full;
+    CFile	file;
+    if (!file.Open(dlg.GetPathName(), CFile::modeWrite | CFile::modeCreate)) {
+        MessageBox(_T("文件保存失败:\n") + dlg.GetPathName());
+        return false;
+    }
+    // BITMAPINFO大小
+    int	nbmiSize = sizeof(BITMAPINFOHEADER) + (lpbi->bmiHeader.biBitCount > 16 ? 1 : (1 << lpbi->bmiHeader.biBitCount)) * sizeof(RGBQUAD);
+    // Fill in the fields of the file header
+    hdr.bfType = ((WORD)('M' << 8) | 'B');	// is always "BM"
+    hdr.bfSize = lpbi->bmiHeader.biSizeImage + sizeof(hdr);
+    hdr.bfReserved1 = 0;
+    hdr.bfReserved2 = 0;
+    hdr.bfOffBits = sizeof(hdr) + nbmiSize;
+    // Write the file header
+    file.Write(&hdr, sizeof(hdr));
+    file.Write(lpbi, nbmiSize);
+    // Write the DIB header and the bits
+    file.Write(m_BitmapData_Full, lpbi->bmiHeader.biSizeImage);
+    file.Close();
+    return true;
+}
+
+BOOL CHideScreenSpyDlg::OnInitDialog()
+{
+    CDialog::OnInitDialog();
+	CString strString;
+	strString.Format("%s - 远程虚拟屏幕 %d×%d", m_IPAddress,
+		m_BitmapInfor_Full->bmiHeader.biWidth, m_BitmapInfor_Full->bmiHeader.biHeight);
+    SetWindowText(strString);
+
+    // Set the icon for this dialog.  The framework does this automatically
+    // when the application's main window is not a dialog
+    SetIcon(m_hIcon, TRUE);			// Set big icon
+    SetIcon(m_hIcon, FALSE);		// Set small icon
+    SetClassLongPtr(m_hWnd, GCLP_HCURSOR, (LONG_PTR)LoadCursor(NULL, IDC_NO));
+    CMenu* pSysMenu = GetSystemMenu(FALSE);
+    if (pSysMenu != NULL) {
+        pSysMenu->AppendMenu(MF_SEPARATOR);
+        pSysMenu->AppendMenu(MF_STRING, IDM_SET_FLUSH, _T("刷新(&F)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_CONTROL, _T("控制屏幕(&Y)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_SAVEDIB, _T("保存快照(&S)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_SAVEAVI_S, _T("保存录像(&A)"));
+        pSysMenu->AppendMenu(MF_SEPARATOR);
+        pSysMenu->AppendMenu(MF_STRING, IDM_GET_CLIPBOARD, _T("获取剪贴板(&R)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_SET_CLIPBOARD, _T("设置剪贴板(&L)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_SETSCERRN, _T("修复分辨率(&G)"));
+        pSysMenu->AppendMenu(MF_SEPARATOR);
+        pSysMenu->AppendMenu(MF_STRING, IDM_QUALITY60, _T("清晰度低60/100"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_QUALITY85, _T("清晰度中85/100"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_QUALITY100, _T("清晰度高100/100"));
+        pSysMenu->AppendMenu(MF_SEPARATOR);
+
+        /*
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_1, _T("FPS-1"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_5, _T("FPS-5"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_10, _T("FPS-10"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_15, _T("FPS-15"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_20, _T("FPS-20"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_25, _T("FPS-25"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_FPS_30, _T("FPS-30"));
+        pSysMenu->AppendMenu(MF_SEPARATOR);
+        */
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Explorer, _T("打开-文件管理(&B)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_run, _T("打开-运行(&H)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Powershell, _T("打开-Powershell(&N)"));
+
+        /*
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Chrome, _T("打开-Chrome(&I)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Edge, _T("打开-Edge(&M)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Brave, _T("打开-Brave(&D)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Firefox, _T("打开-Firefox(&V)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_Iexplore, _T("打开-Iexplore(&Z)"));
+        */
+
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_zdy, _T("自定义CMD命令(&y)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_zdy2, _T("高级自定义命令(&O)"));
+        pSysMenu->AppendMenu(MF_STRING, IDM_OPEN_close, _T("清理后台(&J)"));
+
+        pSysMenu->CheckMenuRadioItem(IDM_QUALITY60, IDM_QUALITY100, IDM_QUALITY85, MF_BYCOMMAND);
+    }
+
+    // TODO: Add extra initialization here
+    m_hRemoteCursor = LoadCursor(NULL, IDC_ARROW);
+    ICONINFO CursorInfo;
+    ::GetIconInfo(m_hRemoteCursor, &CursorInfo);
+	pSysMenu->CheckMenuItem(IDM_CONTROL, m_bIsCtrl ? MF_CHECKED : MF_UNCHECKED);
+	SetClassLongPtr(m_hWnd, GCLP_HCURSOR, (LONG_PTR)m_hRemoteCursor);
+    if (CursorInfo.hbmMask != NULL)
+        ::DeleteObject(CursorInfo.hbmMask);
+    if (CursorInfo.hbmColor != NULL)
+        ::DeleteObject(CursorInfo.hbmColor);
+    // 初始化窗口大小结构
+    m_hFullDC = ::GetDC(m_hWnd);
+    m_hFullMemDC = CreateCompatibleDC(m_hFullDC);
+    m_BitmapHandle = CreateDIBSection(m_hFullDC, m_BitmapInfor_Full, DIB_RGB_COLORS, &m_BitmapData_Full, NULL, NULL);
+    m_lpvRectBits = new BYTE[m_lpbmi_rect->bmiHeader.biSizeImage];
+    SelectObject(m_hFullMemDC, m_BitmapHandle);
+    SetStretchBltMode(m_hFullDC, STRETCH_HALFTONE);
+    SetStretchBltMode(m_hFullMemDC, STRETCH_HALFTONE);
+    GetClientRect(&m_CRect);
+    ScreenToClient(m_CRect);
+    m_wZoom = ((double)m_BitmapInfor_Full->bmiHeader.biWidth) / ((double)(m_CRect.right - m_CRect.left));
+    m_hZoom = ((double)m_BitmapInfor_Full->bmiHeader.biHeight) / ((double)(m_CRect.bottom - m_CRect.top));
+    SetStretchBltMode(m_hFullDC, STRETCH_HALFTONE);
+    BYTE	bBuff = COMMAND_NEXT;
+    m_iocpServer->Send2Client(m_ContextObject, &bBuff, 1);
+#ifdef _DEBUG
+    // ShowWindow(SW_MINIMIZE);
+#endif
+    m_strTip = CString("请等待......");
+    return TRUE;  // return TRUE unless you set the focus to a control
+    // EXCEPTION: OCX Property Pages should return FALSE
+}
+
+void CHideScreenSpyDlg::ResetScreen()
+{
+    UINT	nBISize = m_ContextObject->GetBufferLength() - 1;
+    if (m_BitmapInfor_Full != NULL) {
+        SAFE_DELETE_ARRAY(m_BitmapInfor_Full);
+        SAFE_DELETE_ARRAY(m_lpbmi_rect);
+        m_BitmapInfor_Full = (BITMAPINFO*) new BYTE[nBISize];
+        m_lpbmi_rect = (BITMAPINFO*) new BYTE[nBISize];
+        memcpy(m_BitmapInfor_Full, m_ContextObject->GetBuffer(1), nBISize);
+        memcpy(m_lpbmi_rect, m_ContextObject->GetBuffer(1), nBISize);
+        DeleteObject(m_BitmapHandle);
+        m_BitmapHandle = CreateDIBSection(m_hFullDC, m_BitmapInfor_Full, DIB_RGB_COLORS, &m_BitmapData_Full, NULL, NULL);
+        if (m_lpvRectBits) {
+            delete[] m_lpvRectBits;
+            m_lpvRectBits = new BYTE[m_lpbmi_rect->bmiHeader.biSizeImage];
+        }
+        SelectObject(m_hFullMemDC, m_BitmapHandle);
+        SetStretchBltMode(m_hFullDC, STRETCH_HALFTONE);
+        SetStretchBltMode(m_hFullMemDC, STRETCH_HALFTONE);
+        GetClientRect(&m_CRect);
+        ScreenToClient(m_CRect);
+        m_wZoom = ((double)m_BitmapInfor_Full->bmiHeader.biWidth) / ((double)(m_CRect.right - m_CRect.left));
+        m_hZoom = ((double)m_BitmapInfor_Full->bmiHeader.biHeight) / ((double)(m_CRect.bottom - m_CRect.top));
+    }
+}
+
+void CHideScreenSpyDlg::DrawFirstScreen(PBYTE pDeCompressionData, unsigned long	destLen)
+{
+    BYTE	algorithm = pDeCompressionData[0];
+    LPVOID	lpFirstScreen = pDeCompressionData + 1;
+    DWORD	dwFirstLength = destLen - 1;
+    if (algorithm == ALGORITHM_HOME) {
+        if(dwFirstLength > 0)
+            JPG_BMP(m_BitmapInfor_Full->bmiHeader.biBitCount, lpFirstScreen, dwFirstLength, m_BitmapData_Full);
+    } else {
+		m_ContextObject->CopyBuffer(m_BitmapData_Full, m_BitmapInfor_Full->bmiHeader.biSizeImage, 1);
+    }
+#if _DEBUG
+    DoPaint();
+#else
+    PostMessage(WM_PAINT);
+#endif
+}
+
+void CHideScreenSpyDlg::DrawNextScreenHome(PBYTE pDeCompressionData, unsigned long	destLen)
+{
+    if (!destLen) return;
+
+    // 根据鼠标是否移动和屏幕是否变化判断是否重绘鼠标, 防止鼠标闪烁
+    bool	bIsReDraw = false;
+    int		nHeadLength =  1; // 标识[1] + 算法[1]
+    LPVOID	lpNextScreen = pDeCompressionData + nHeadLength;
+    DWORD	dwNextLength = destLen - nHeadLength;
+    DWORD	dwNextOffset = 0;
+
+	// 屏幕数据是否变化
+	while (dwNextOffset < dwNextLength) {
+		int* pinlen = (int*)((LPBYTE)lpNextScreen + dwNextOffset);
+
+		if (JPG_BMP(m_BitmapInfor_Full->bmiHeader.biBitCount, pinlen + 1, *pinlen, m_lpvRectBits)) {
+			bIsReDraw = true;
+			LPRECT lpChangedRect = (LPRECT)((LPBYTE)(pinlen + 1) + *pinlen);
+			int nChangedRectWidth = lpChangedRect->right - lpChangedRect->left;
+			int nChangedRectHeight = lpChangedRect->bottom - lpChangedRect->top;
+
+			m_lpbmi_rect->bmiHeader.biWidth = nChangedRectWidth;
+			m_lpbmi_rect->bmiHeader.biHeight = nChangedRectHeight;
+			m_lpbmi_rect->bmiHeader.biSizeImage = (((nChangedRectWidth * m_lpbmi_rect->bmiHeader.biBitCount + 31) & ~31) >> 3)
+				* nChangedRectHeight;
+
+			StretchDIBits(m_hFullMemDC, lpChangedRect->left, lpChangedRect->top, nChangedRectWidth, nChangedRectHeight,
+				0, 0, nChangedRectWidth, nChangedRectHeight, m_lpvRectBits, m_lpbmi_rect, DIB_RGB_COLORS, SRCCOPY);
+
+			dwNextOffset += sizeof(int) + *pinlen + sizeof(RECT);
+		}
+	}
+
+    if (bIsReDraw) {
+        DoPaint();
+    }
+}
+
+BOOL CHideScreenSpyDlg::ParseFrame(void) {
+	//该函数不是直接画到屏幕上，而是更新一下变化部分的屏幕数据然后调用
+	//OnPaint画上去
+	//根据鼠标是否移动和屏幕是否变化判断是否重绘鼠标，防止鼠标闪烁
+	BOOL	bChange = FALSE;
+	const ULONG	ulHeadLength = 1 + 1 + sizeof(POINT) + sizeof(BYTE); // 标识 + 算法 + 光标位置 + 光标类型索引
+	ULONG	NextScreenLength = m_ContextObject->GetBufferLength() - ulHeadLength;
+
+	POINT	OldClientCursorPos;
+	memcpy(&OldClientCursorPos, &m_ClientCursorPos, sizeof(POINT));
+	memcpy(&m_ClientCursorPos, m_ContextObject->GetBuffer(2), sizeof(POINT));
+
+	// 鼠标移动了
+	if (memcmp(&OldClientCursorPos, &m_ClientCursorPos, sizeof(POINT)) != 0) {
+		bChange = TRUE;
+	}
+
+	// 光标类型发生变化
+	BYTE bOldCursorIndex = m_bCursorIndex;
+	m_bCursorIndex = m_ContextObject->GetBYTE(2 + sizeof(POINT));
+	if (bOldCursorIndex != m_bCursorIndex) {
+		bChange = TRUE;
+		if (m_bIsCtrl)//替换指定窗口所属类的WNDCLASSEX结构
+#ifdef _WIN64
+			SetClassLongPtrA(m_hWnd, GCLP_HCURSOR, (LONG)m_CursorInfo.getCursorHandle(m_bCursorIndex == (BYTE)-1 ? 1 : m_bCursorIndex));
+#else
+			SetClassLongA(m_hWnd, GCL_HCURSOR, (LONG)m_CursorInfo.getCursorHandle(m_bCursorIndex == (BYTE)-1 ? 1 : m_bCursorIndex));
+#endif
+	}
+
+	// 屏幕是否变化
+	if (NextScreenLength > 0) {
+		bChange = TRUE;
+	}
+	return bChange;
+}
+
+void CHideScreenSpyDlg::DrawNextScreenDiff(PBYTE pDeCompressionData, unsigned long	destLen)
+{
+	if (!destLen) return;
+	// 根据鼠标是否移动和屏幕是否变化判断是否重绘鼠标, 防止鼠标闪烁
+	BYTE	algorithm = pDeCompressionData[1];
+    if (algorithm == ALGORITHM_HOME) {
+        return DrawNextScreenHome(pDeCompressionData + 1, destLen - 1);
+    }
+	bool	bIsReDraw = ParseFrame();
+	bool    keyFrame = false;
+	const ULONG	ulHeadLength = 1 + 1 + sizeof(POINT) + sizeof(BYTE);
+	LPVOID	FirstScreenData = m_BitmapData_Full;
+	LPVOID	NextScreenData = m_ContextObject->GetBuffer(ulHeadLength);
+	ULONG	NextScreenLength = NextScreenData ? m_ContextObject->GetBufferLength() - ulHeadLength : 0;
+
+	LPBYTE dst = (LPBYTE)FirstScreenData, p = (LPBYTE)NextScreenData;
+	if (keyFrame)
+	{
+		if (m_BitmapInfor_Full->bmiHeader.biSizeImage == NextScreenLength)
+			memcpy(dst, p, m_BitmapInfor_Full->bmiHeader.biSizeImage);
+	}
+	else if (0 != NextScreenLength) {
+        bIsReDraw = true;
+		for (LPBYTE end = p + NextScreenLength; p < end; ) {
+			ULONG ulCount = *(LPDWORD(p + sizeof(ULONG)));
+			if (algorithm == ALGORITHM_GRAY) {
+				LPBYTE p1 = dst + *(LPDWORD)p, p2 = p + 2 * sizeof(ULONG);
+				for (int i = 0; i < ulCount; ++i, p1 += 4)
+					memset(p1, *p2++, sizeof(DWORD));
+			}
+			else {
+				memcpy(dst + *(LPDWORD)p, p + 2 * sizeof(ULONG), ulCount);
+			}
+			p += 2 * sizeof(ULONG) + ulCount;
+		}
+	}
+
+    if (bIsReDraw)
+    {
+        DoPaint();
+    }
+}
+
+void CHideScreenSpyDlg::OnSize(UINT nType, int cx, int cy)
+{
+    CDialog::OnSize(nType, cx, cy);
+
+    // TODO: Add your message handler code here
+    if (!IsWindowVisible())
+        return;
+
+    GetClientRect(&m_CRect);
+    ScreenToClient(m_CRect);
+    if (!m_bIsFirst) {
+        m_wZoom = ((double)m_BitmapInfor_Full->bmiHeader.biWidth) / ((double)(m_CRect.right - m_CRect.left));
+        m_hZoom = ((double)m_BitmapInfor_Full->bmiHeader.biHeight) / ((double)(m_CRect.bottom - m_CRect.top));
+    }
+}
+
+void  CHideScreenSpyDlg::OnSysCommand(UINT nID, LPARAM lParam)
+{
+    CMenu* pSysMenu = GetSystemMenu(FALSE);
+    switch (nID) {
+    case SC_MAXIMIZE:
+        OnNcLButtonDblClk(HTCAPTION, NULL);
+        return;
+    case SC_MONITORPOWER: // 拦截显示器节电自动关闭的消息
+        return;
+    case SC_SCREENSAVE:   // 拦截屏幕保护启动的消息
+        return;
+    case IDM_SET_FLUSH: {
+        BYTE	bToken = COMMAND_FLUSH_HIDE;
+        m_iocpServer->Send2Client(m_ContextObject, &bToken, sizeof(bToken));
+    }
+    break;
+    case IDM_CONTROL: {
+        m_bIsCtrl = !m_bIsCtrl;
+        pSysMenu->CheckMenuItem(IDM_CONTROL, m_bIsCtrl ? MF_CHECKED : MF_UNCHECKED);
+
+        if (m_bIsCtrl) {
+            SetClassLongPtr(m_hWnd, GCLP_HCURSOR, (LONG_PTR)m_hRemoteCursor);
+        } else
+            SetClassLongPtr(m_hWnd, GCLP_HCURSOR, (LONG_PTR)LoadCursor(NULL, IDC_NO));
+    }
+    break;
+
+    case IDM_SAVEDIB:
+        SaveSnapshot();
+        break;
+    case IDM_SAVEAVI_S: {
+
+        if (pSysMenu->GetMenuState(IDM_SAVEAVI_S, MF_BYCOMMAND) & MF_CHECKED) {
+            KillTimer(132);
+            pSysMenu->CheckMenuItem(IDM_SAVEAVI_S, MF_UNCHECKED);
+            m_aviFile = "";
+            m_aviStream.Close();
+
+            return;
+        }
+
+        if (m_BitmapInfor_Full->bmiHeader.biBitCount <= 15) {
+            AfxMessageBox(_T("不支持16位及以下颜色录像!"));
+            return;
+        }
+
+        CString	strFileName = m_IPAddress + CTime::GetCurrentTime().Format(_T("_%Y-%m-%d_%H-%M-%S.avi"));
+        CFileDialog dlg(FALSE, _T("avi"), strFileName, OFN_OVERWRITEPROMPT, _T("Video(*.avi)|*.avi|"), this);
+        if (dlg.DoModal() != IDOK)
+            return;
+
+        m_aviFile = dlg.GetPathName();
+
+        if (!m_aviStream.Open(m_hWnd, m_aviFile, m_BitmapInfor_Full)) {
+            m_aviFile = _T("");
+            MessageBox(_T("Create Video(*.avi) Failed:\n") + m_aviFile);
+        } else {
+            ::SetTimer(m_hWnd, 132, 250, NULL);
+            pSysMenu->CheckMenuItem(IDM_SAVEAVI_S, MF_CHECKED);
+        }
+    }
+    break;
+    case IDM_GET_CLIPBOARD: { // 获取剪贴板
+        BYTE	bToken = COMMAND_SCREEN_GET_CLIPBOARD;
+        m_iocpServer->Send2Client(m_ContextObject, &bToken, sizeof(bToken));
+    }
+    break;
+    case IDM_SET_CLIPBOARD: { // 设置剪贴板
+        SendServerClipboard();
+    }
+    break;
+    case IDM_SETSCERRN: {
+        BYTE	bToken = COMMAND_SCREEN_SETSCREEN_HIDE;
+        m_iocpServer->Send2Client(m_ContextObject, &bToken, sizeof(bToken));
+    }
+    break;
+    case IDM_QUALITY60: { // 清晰度60
+        BYTE	bToken = COMMAND_COMMAND_SCREENUALITY60_HIDE;
+        m_iocpServer->Send2Client(m_ContextObject, &bToken, sizeof(bToken));
+        pSysMenu->CheckMenuRadioItem(IDM_QUALITY60, IDM_QUALITY100, IDM_QUALITY60, MF_BYCOMMAND);
+    }
+    break;
+    case IDM_QUALITY85: { // 清晰度85
+        BYTE	bToken = COMMAND_COMMAND_SCREENUALITY85_HIDE;
+        m_iocpServer->Send2Client(m_ContextObject, &bToken, sizeof(bToken));
+        pSysMenu->CheckMenuRadioItem(IDM_QUALITY60, IDM_QUALITY100, IDM_QUALITY85, MF_BYCOMMAND);
+    }
+    break;
+    case IDM_QUALITY100: { // 清晰度100
+        BYTE	bToken = COMMAND_COMMAND_SCREENUALITY100_HIDE;
+        m_iocpServer->Send2Client(m_ContextObject, &bToken, sizeof(bToken));
+        pSysMenu->CheckMenuRadioItem(IDM_QUALITY60, IDM_QUALITY100, IDM_QUALITY100, MF_BYCOMMAND);
+    }
+    break;
+    case IDM_FPS_1:
+        pSysMenu->CheckMenuRadioItem(IDM_FPS_1, IDM_FPS_30, nID, MF_BYCOMMAND);
+        break;
+    case IDM_FPS_5:
+    case IDM_FPS_10:
+    case IDM_FPS_15:
+    case IDM_FPS_20:
+    case IDM_FPS_25:
+    case IDM_FPS_30:
+        pSysMenu->CheckMenuRadioItem(IDM_FPS_1, IDM_FPS_30, nID, MF_BYCOMMAND);
+        break;
+    case IDM_OPEN_Explorer: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Explorer;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case 	IDM_OPEN_run: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_run;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case 	IDM_OPEN_Powershell: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Powershell;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case	IDM_OPEN_Chrome: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Chrome;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case	IDM_OPEN_Edge: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Edge;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case	IDM_OPEN_Brave: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Brave;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case	IDM_OPEN_Firefox: {
+        BYTE bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Firefox;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case	IDM_OPEN_Iexplore: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_Iexplore;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case IDM_OPEN_ADD_1: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_ADD_1;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case 	IDM_OPEN_ADD_2: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_ADD_2;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case 	IDM_OPEN_ADD_3: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_ADD_3;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case 	IDM_OPEN_ADD_4: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_ADD_4;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case	IDM_OPEN_zdy: {
+        EnableWindow(FALSE);
+
+        CInputDialog	dlg(this);
+        dlg.Init(_T("自定义"), _T("请输入CMD命令:"));
+
+        if (dlg.DoModal() == IDOK && dlg.m_str.GetLength()) {
+            int		nPacketLength = dlg.m_str.GetLength()*sizeof(TCHAR) + 3;
+            LPBYTE	lpPacket = new BYTE[nPacketLength];
+            lpPacket[0] = COMMAND_HIDE_USER;
+            lpPacket[1] = IDM_OPEN_zdy;
+            memcpy(lpPacket + 2, dlg.m_str.GetBuffer(0), nPacketLength - 2);
+            m_iocpServer->Send2Client(m_ContextObject, lpPacket, nPacketLength);
+            delete[] lpPacket;
+
+        }
+        EnableWindow(TRUE);
+    }
+    break;
+    case IDM_OPEN_zdy2: {
+        EnableWindow(FALSE);
+        CTextDlg	dlg(this);
+        if (dlg.DoModal() == IDOK) {
+            ZdyCmd m_ZdyCmd = {};
+            _stprintf_s(m_ZdyCmd.oldpath, MAX_PATH,_T("%s"), dlg.oldstr.GetBuffer());
+            _stprintf_s(m_ZdyCmd.newpath, MAX_PATH, _T("%s"), dlg.nowstr.GetBuffer());
+            CString m_str = _T("\"");
+            m_str += _T("\"");
+            m_str += _T(" ");
+            m_str += _T("\"");
+            m_str += dlg.cmeline;
+            m_str += _T("\"");
+            _stprintf_s(m_ZdyCmd.cmdline, MAX_PATH, _T("%s"), m_str.GetBuffer());
+            int		nPacketLength = sizeof(ZdyCmd) + 2;
+            LPBYTE	lpPacket = new BYTE[nPacketLength];
+            lpPacket[0] = COMMAND_HIDE_USER;
+            lpPacket[1] = IDM_OPEN_zdy2;
+            memcpy(lpPacket + 2, &m_ZdyCmd, nPacketLength - 2);
+            m_iocpServer->Send2Client(m_ContextObject, lpPacket, nPacketLength);
+            delete[] lpPacket;
+        }
+        EnableWindow(TRUE);
+    }
+    break;
+    case 	IDM_OPEN_360JS: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_360JS;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+        break;
+    }
+    case 	IDM_OPEN_360AQ: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_360AQ;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+    }
+    break;
+    case 	IDM_OPEN_360AQ2: {
+        BYTE	bToken[2];
+        bToken[0] = COMMAND_HIDE_USER;
+        bToken[1] = IDM_OPEN_360AQ2;
+        m_iocpServer->Send2Client(m_ContextObject, bToken, 2);
+        break;
+    }
+    case	IDM_OPEN_close: {
+        LPBYTE	lpPacket = new BYTE;
+        lpPacket[0] = COMMAND_HIDE_CLEAR;
+        m_iocpServer->Send2Client(m_ContextObject, lpPacket, 1);
+        delete lpPacket;
+    }
+    break;
+    default:
+        CDialog::OnSysCommand(nID, lParam);
+    }
+}
+
+void CHideScreenSpyDlg::DrawTipString(CString str)
+{
+    RECT rect;
+    GetClientRect(&rect);
+    COLORREF bgcol = RGB(0x00, 0x00, 0x00);
+    COLORREF oldbgcol = SetBkColor(m_hFullDC, bgcol);
+    COLORREF oldtxtcol = SetTextColor(m_hFullDC, RGB(0xff, 0x00, 0x00));
+    ExtTextOut(m_hFullDC, 0, 0, ETO_OPAQUE, &rect, NULL, 0, NULL);
+
+    DrawText(m_hFullDC, str, -1, &rect, DT_SINGLELINE | DT_CENTER | DT_VCENTER);
+
+    SetBkColor(m_hFullDC, oldbgcol);
+    SetTextColor(m_hFullDC, oldtxtcol);
+}
+
+
+BOOL CHideScreenSpyDlg::PreTranslateMessage(MSG* pMsg)
+{
+    if (m_bIsClosed)
+        return CDialog::PreTranslateMessage(pMsg);
+    switch (pMsg->message) {
+    case WM_ERASEBKGND:
+        return TRUE;
+    case WM_LBUTTONDOWN: case WM_LBUTTONUP: // 左键按下
+    case WM_RBUTTONDOWN: case WM_RBUTTONUP: // 右键按下
+    case WM_MBUTTONDOWN: case WM_MBUTTONUP: // 中键按下
+    case WM_LBUTTONDBLCLK: case WM_RBUTTONDBLCLK: case WM_MBUTTONDBLCLK: // 双击
+    case WM_MOUSEMOVE: case WM_MOUSEWHEEL:  // 鼠标移动
+    {
+        // 此逻辑会丢弃所有 非左键拖拽 的鼠标移动消息（如纯移动或右键拖拽）
+        if (pMsg->message == WM_MOUSEMOVE && GetKeyState(VK_LBUTTON) >= 0)
+            break;
+        SendScaledMouseMessage(pMsg, true);
+        return TRUE;
+    }
+    case WM_CHAR: {
+        // 检查给定字符是否为控制字符
+		if (iswcntrl(static_cast<wint_t>(pMsg->wParam))) {
+			break;
+		}
+        SendScaledMouseMessage(pMsg);
+        return TRUE;
+    }
+    case WM_KEYDOWN: case WM_KEYUP: {
+        SendScaledMouseMessage(pMsg);
+        return TRUE;
+    }
+    }
+    // 屏蔽Enter和ESC关闭对话
+    if (pMsg->message == WM_KEYDOWN && (pMsg->wParam == VK_ESCAPE || pMsg->wParam == VK_RETURN))
+        return TRUE;
+
+    return CDialog::PreTranslateMessage(pMsg);
+}
+
+void CHideScreenSpyDlg::SendScaledMouseMessage(MSG* pMsg, bool makeLP) {
+	if (!m_bIsCtrl)
+		return;
+
+    MYMSG msg(*pMsg);
+	auto low = ((LONG)LOWORD(pMsg->lParam)) * m_wZoom;
+	auto high = ((LONG)HIWORD(pMsg->lParam)) * m_hZoom;
+    if(makeLP) msg.lParam = MAKELPARAM(low, high);
+	msg.pt.x = (int)(low + m_rect.left);
+	msg.pt.y = (int)(high + m_rect.top);
+	SendCommand(msg);
+}
+
+void CHideScreenSpyDlg::SendCommand(const MYMSG& pMsg)
+{
+    if (!m_bIsCtrl) {
+        return;
+    }
+
+    LPBYTE lpData = new BYTE[sizeof(MYMSG) + 1];
+    lpData[0] = COMMAND_SCREEN_CONTROL;
+    memcpy(lpData + 1, &pMsg, sizeof(MYMSG));
+    m_iocpServer->Send2Client(m_ContextObject, lpData, sizeof(MYMSG) + 1);
+
+    SAFE_DELETE_ARRAY(lpData);
+}
+
+void CHideScreenSpyDlg::UpdateServerClipboard(char* buf, int len)
+{
+    if (!::OpenClipboard(NULL))
+        return;
+
+    ::EmptyClipboard();
+    HGLOBAL hglbCopy = GlobalAlloc(GMEM_MOVEABLE, len);
+    if (hglbCopy != NULL) {
+        // Lock the handle and copy the text to the buffer.
+        LPTSTR lptstrCopy = (LPTSTR)GlobalLock(hglbCopy);
+        memcpy(lptstrCopy, buf, len);
+        GlobalUnlock(hglbCopy);          // Place the handle on the clipboard.
+        SetClipboardData(CF_TEXT, hglbCopy);
+        GlobalFree(hglbCopy);
+    }
+    CloseClipboard();
+}
+
+void CHideScreenSpyDlg::SendServerClipboard()
+{
+    if (!::OpenClipboard(NULL))
+        return;
+    HGLOBAL hglb = GetClipboardData(CF_TEXT);
+    if (hglb == NULL) {
+        ::CloseClipboard();
+        return;
+    }
+    int	nPacketLen = GlobalSize(hglb) + 1;
+    LPSTR lpstr = (LPSTR)GlobalLock(hglb);
+    LPBYTE	lpData = new BYTE[nPacketLen];
+    lpData[0] = COMMAND_SCREEN_SET_CLIPBOARD;
+    memcpy(lpData + 1, lpstr, nPacketLen - 1);
+    ::GlobalUnlock(hglb);
+    ::CloseClipboard();
+    m_iocpServer->Send2Client(m_ContextObject, lpData, nPacketLen);
+    delete[] lpData;
+}
+
+void CHideScreenSpyDlg::DoPaint()
+{
+    if (m_bIsFirst) {
+        DrawTipString(m_strTip);
+        return;
+    }
+    if (m_bIsClosed) return;
+    StretchBlt(m_hFullDC, 0, 0, m_CRect.Width(), m_CRect.Height(), m_hFullMemDC, 0, 0, m_BitmapInfor_Full->bmiHeader.biWidth, m_BitmapInfor_Full->bmiHeader.biHeight, SRCCOPY);
+    // Do not call CDialog::OnPaint() for painting messages
+}
+
+void CHideScreenSpyDlg::OnPaint()
+{
+    CPaintDC dc(this);
+
+    if (m_bIsFirst) {
+        DrawTipString(m_strTip);
+        return;
+    }
+    if (m_bIsClosed) return;
+    StretchBlt(m_hFullDC, 0, 0, m_CRect.Width(), m_CRect.Height(), m_hFullMemDC, 0, 0, m_BitmapInfor_Full->bmiHeader.biWidth, m_BitmapInfor_Full->bmiHeader.biHeight, SRCCOPY);
+    CDialog::OnPaint();
+}
+
+LRESULT CHideScreenSpyDlg::WindowProc(UINT message, WPARAM wParam, LPARAM lParam)
+{
+    // TODO: Add your specialized code here and/or call the base class
+    if (message == WM_POWERBROADCAST && wParam == PBT_APMQUERYSUSPEND) {
+        return BROADCAST_QUERY_DENY; // 拦截系统待机, 休眠的请求
+    }
+    if (message == WM_ACTIVATE && LOWORD(wParam) != WA_INACTIVE && !HIWORD(wParam)) {
+        SetWindowPos(&wndTopMost, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE);
+        return TRUE;
+    }
+    if (message == WM_ACTIVATE && LOWORD(wParam) == WA_INACTIVE) {
+        SetWindowPos(&wndNoTopMost, 0, 0, 0, 0, SWP_NOMOVE | SWP_NOSIZE);
+        return TRUE;
+    }
+
+    return CDialog::WindowProc(message, wParam, lParam);
+}
+
+void CHideScreenSpyDlg::OnTimer(UINT_PTR nIDEvent)
+{
+    if (!m_aviFile.IsEmpty()) {
+        LPCTSTR	lpTipsString = _T("●");
+
+        m_aviStream.Write(m_BitmapData_Full);
+
+        // 提示正在录像
+        SetTextColor(m_hFullDC, RGB(0xff, 0x00, 0x00));
+        TextOut(m_hFullDC, 0, 0, lpTipsString, lstrlen(lpTipsString));
+    }
+    CDialog::OnTimer(nIDEvent);
+}
+
+bool CHideScreenSpyDlg::JPG_BMP(int cbit, void* input, int inlen, void* output)
+{
+    struct jpeg_decompress_struct jds;
+    struct jpeg_error_mgr jem;
+
+    // 设置错误处理
+    jds.err = jpeg_std_error(&jem);
+    // 创建解压结构
+    jpeg_create_decompress(&jds);
+    // 设置读取(输入)位置
+    jpeg_mem_src(&jds, (byte*)input, inlen);
+    // 读取头部信息
+    if (jpeg_read_header(&jds, true) != JPEG_HEADER_OK) {
+        jpeg_destroy_decompress(&jds);
+        return false;
+    }
+    // 设置相关参数
+    switch (cbit) {
+    case 16:
+        jds.out_color_space = JCS_EXT_RGB;
+        break;
+    case 24:
+        jds.out_color_space = JCS_EXT_BGR;
+        break;
+    case 32:
+        jds.out_color_space = JCS_EXT_BGRA;
+        break;
+    default:
+        jpeg_destroy_decompress(&jds);
+        return false;
+    }
+    // 开始解压图像
+    if (!jpeg_start_decompress(&jds)) {
+        jpeg_destroy_decompress(&jds);
+        return false;
+    }
+    int line_stride = (jds.output_width * cbit / 8 + 3) / 4 * 4;
+    while (jds.output_scanline < jds.output_height) {
+        byte* pline = (byte*)output + jds.output_scanline * line_stride;
+        jpeg_read_scanlines(&jds, &pline, 1);
+    }
+    // 完成图像解压
+    if (!jpeg_finish_decompress(&jds)) {
+        jpeg_destroy_decompress(&jds);
+        return false;
+    }
+    // 释放相关资源
+    jpeg_destroy_decompress(&jds);
+
+    return true;
+}
--- a/server/2015Remote/HideScreenSpyDlg.h
+++ b/server/2015Remote/HideScreenSpyDlg.h
@@ -0,0 +1,93 @@
+#pragma once
+#include "stdafx.h"
+#include "../client/CursorInfo.h"
+#include "../common/jpeglib.h"
+#include "IOCPServer.h"
+#include "VideoDlg.h"
+#include "Resource.h"
+
+/////////////////////////////////////////////////////////////////////////////
+// CHideScreenSpyDlg dialog
+
+#ifdef _WIN64
+#ifdef _DEBUG
+#pragma comment(lib, "jpeg\\turbojpeg_64_d.lib")
+#else
+#pragma comment(lib, "jpeg\\turbojpeg_64_r.lib")
+#endif
+#else
+#ifdef _DEBUG
+#pragma comment(lib, "jpeg\\turbojpeg_32_d.lib")
+#else
+#pragma comment(lib, "jpeg\\turbojpeg_32_r.lib")
+#endif
+#endif
+
+
+class CHideScreenSpyDlg : public DialogBase {
+    DECLARE_DYNAMIC(CHideScreenSpyDlg)
+    enum { IDD = IDD_SCREEN };
+
+public:
+    CHideScreenSpyDlg(CWnd* pParent = NULL, ISocketBase* pIOCPServer = NULL, ClientContext* pContext = NULL);
+    virtual ~CHideScreenSpyDlg();
+
+	VOID SendNext(void) {
+		BYTE	bToken = COMMAND_NEXT;
+		m_iocpServer->Send2Client(m_ContextObject, &bToken, 1);
+	}
+    void OnReceiveComplete();
+	BOOL ParseFrame(void);
+	void DrawFirstScreen(PBYTE pDeCompressionData, unsigned long destLen);
+	void DrawNextScreenDiff(PBYTE pDeCompressionData, unsigned long	destLen);
+    void DrawNextScreenHome(PBYTE pDeCompressionData, unsigned long	destLen);
+	void DrawTipString(CString str);
+
+	void SendCommand(const MYMSG& pMsg);
+	void SendScaledMouseMessage(MSG* pMsg, bool makeLP = false);
+	void UpdateServerClipboard(char* buf, int len);
+	void SendServerClipboard(void);
+    bool SaveSnapshot(void);
+
+    virtual void DoDataExchange(CDataExchange* pDX);
+    virtual BOOL PreTranslateMessage(MSG* pMsg);
+    virtual BOOL OnInitDialog();
+
+    afx_msg void OnClose();
+    afx_msg void OnPaint();
+    afx_msg void OnSysCommand(UINT nID, LPARAM lParam);
+	afx_msg void OnSize(UINT nType, int cx, int cy);
+
+    virtual LRESULT WindowProc(UINT message, WPARAM wParam, LPARAM lParam);
+
+    afx_msg void OnTimer(UINT_PTR nIDEvent);
+
+    DECLARE_MESSAGE_MAP()
+
+protected:
+	void DoPaint();
+    bool JPG_BMP(int cbit, void* input, int inlen, void* output);
+    void ResetScreen();
+
+	HDC                 m_hFullDC, m_hFullMemDC;
+	HBITMAP	            m_BitmapHandle;
+	LPVOID              m_BitmapData_Full;
+	LPBITMAPINFO        m_BitmapInfor_Full;
+	HCURSOR	            m_hRemoteCursor;
+	CCursorInfo	        m_CursorInfo;
+	BOOL                m_bIsFirst;
+	BOOL                m_bIsCtrl;
+    POINT               m_ClientCursorPos;
+    BYTE                m_bCursorIndex;
+	CString				m_strTip;
+
+private:
+	CString             m_aviFile;
+	CBmpToAvi	        m_aviStream;
+	CRect               m_CRect;
+	RECT                m_rect;
+	double              m_wZoom;
+	double              m_hZoom;
+	LPVOID	            m_lpvRectBits;
+	LPBITMAPINFO        m_lpbmi_rect;
+};
--- a/server/2015Remote/IOCPServer.cpp
+++ b/server/2015Remote/IOCPServer.cpp
@@ -34,6 +34,13 @@
 #endif
 #endif

+// <20><><EFBFBD><EFBFBD> socket <20><>ȡ<EFBFBD>ͻ<EFBFBD><CDBB><EFBFBD>IP<49><50>ַ.
+std::string GetPeerName(SOCKET sock) {
+	sockaddr_in  ClientAddr = {};
+	int ulClientAddrLen = sizeof(sockaddr_in);
+	int s = getpeername(sock, (SOCKADDR*)&ClientAddr, &ulClientAddrLen);
+	return s != INVALID_SOCKET ? inet_ntoa(ClientAddr.sin_addr) : "";
+}

 // <20><><EFBFBD><EFBFBD> socket <20><>ȡ<EFBFBD>ͻ<EFBFBD><CDBB><EFBFBD>IP<49><50>ַ.
 std::string GetRemoteIP(SOCKET sock) {
@@ -585,6 +592,7 @@ VOID IOCPServer::OnClientPreSending(CONTEXT_OBJECT* ContextObject, PBYTE szBuffe
 				return;
 			}
 			else if (ContextObject->CompressMethod == COMPRESS_NONE) {
+				Buffer tmp(szBuffer, ulOriginalLength); szBuffer = tmp.Buf();
 				ContextObject->WriteBuffer(szBuffer, ulOriginalLength, ulOriginalLength);
 				break;
 			}
@@ -717,7 +725,7 @@ void IOCPServer::OnAccept()
 	}

 	//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊÿһ<C3BF><D2BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ź<EFBFBD>ά<EFBFBD><CEAC><EFBFBD><EFBFBD>һ<EFBFBD><D2BB><EFBFBD><EFBFBD>֮<EFBFBD><D6AE><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݽṹ<DDBD><E1B9B9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ϊ<EFBFBD>û<EFBFBD><C3BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD>±<EFBFBD><C2B1><EFBFBD><EFBFBD><EFBFBD>
-	PCONTEXT_OBJECT ContextObject = AllocateContext();   // Context
+	PCONTEXT_OBJECT ContextObject = AllocateContext(sClientSocket);   // Context

 	if (ContextObject == NULL)
 	{
@@ -806,7 +814,7 @@ VOID IOCPServer::PostRecv(CONTEXT_OBJECT* ContextObject)
 	}
 }

-PCONTEXT_OBJECT IOCPServer::AllocateContext()
+PCONTEXT_OBJECT IOCPServer::AllocateContext(SOCKET s)
 {
 	PCONTEXT_OBJECT ContextObject = NULL;

@@ -820,7 +828,7 @@ PCONTEXT_OBJECT IOCPServer::AllocateContext()

 	if (ContextObject != NULL)
 	{
-		ContextObject->InitMember();
+		ContextObject->InitMember(s);
 	}

 	return ContextObject;
--- a/server/2015Remote/IOCPServer.h
+++ b/server/2015Remote/IOCPServer.h
@@ -1,5 +1,6 @@
 #pragma once

+#include "StdAfx.h"
 #include <WinSock2.h>
 #pragma comment(lib,"ws2_32.lib")
 #include "CpuUseage.h"
@@ -12,15 +13,15 @@
 #endif

 #include <Mstcpip.h>
+#include "common/header.h"
+#include "common/encrypt.h"
 #define PACKET_LENGTH   0x2000

-#define FLAG_LENGTH   5
-#define HDR_LENGTH   13
-
 #define	NC_CLIENT_CONNECT		0x0001
 #define	NC_RECEIVE				0x0004
 #define NC_RECEIVE_COMPLETE		0x0005 // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>

+std::string GetPeerName(SOCKET sock);
 std::string GetRemoteIP(SOCKET sock);


@@ -42,43 +43,6 @@ enum
 	ONLINELIST_MAX,
 };

-// Encoder interface. The default encoder will do nothing.
-class Encoder {
-public:
-	virtual ~Encoder(){}
-	// Encode data before compress.
-	virtual void Encode(unsigned char* data, int len) const{}
-	// Decode data after uncompress.
-	virtual void Decode(unsigned char* data, int len) const{}
-};
-
-// XOR Encoder implementation.
-class XOREncoder : public Encoder {
-private:
-	std::vector<char> Keys;
-
-public:
-	XOREncoder(const std::vector<char>& keys = {0}) : Keys(keys){}
-
-	virtual void Encode(unsigned char* data, int len) const {
-		XOR(data, len, Keys);
-	}
-
-	virtual void Decode(unsigned char* data, int len) const {
-		static std::vector<char> reversed(Keys.rbegin(), Keys.rend());
-		XOR(data, len, reversed);
-	}
-
-protected:
-	void XOR(unsigned char* data, int len, const std::vector<char> &keys) const {
-		for (char key : keys) {
-			for (int i = 0; i < len; ++i) {
-				data[i] ^= key;
-			}
-		}
-	}
-};
-
 enum {
 	PARSER_FAILED = -1,			// <20><><EFBFBD><EFBFBD>ʧ<EFBFBD><CAA7>
 	PARSER_NEEDMORE = 0,		// <20><>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
@@ -114,57 +78,75 @@ protected:
 		Reset();
 	}
 	PR Parse(CBuffer& buf, int &compressMethod) {
-		const int MinimumCount = 8;
+		const int MinimumCount = MIN_COMLEN;
 		if (buf.GetBufferLength() < MinimumCount) {
 			return PR{ PARSER_NEEDMORE };
 		}
 		char szPacketFlag[32] = { 0 };
 		buf.CopyBuffer(szPacketFlag, MinimumCount, 0);
+		HeaderEncType encTyp = HeaderEncUnknown;
+		FlagType flagType = CheckHead(szPacketFlag, encTyp);
+		if (flagType == FLAG_UNKNOWN) {
+			return PR{ PARSER_FAILED };
+		}
 		if (m_bParsed) { // Check if the header has been parsed.
 			return memcmp(m_szPacketFlag, szPacketFlag, m_nCompareLen) == 0 ? PR{ m_nFlagLen } : PR{ PARSER_FAILED };
 		}
 		// More version may be added in the future.
-		const char version0[] = "Shine", version1[] = "<<FUCK>>", version2[] = "Hello?", version3[] = "HELL";
-		if (memcmp(version0, szPacketFlag, sizeof(version0) - 1) == 0) {
-			memcpy(m_szPacketFlag, version0, sizeof(version0) - 1);
-			m_nCompareLen = strlen(m_szPacketFlag);
+		switch (m_nFlagType = flagType)
+		{
+		case FLAG_UNKNOWN:
+			return PR{ PARSER_FAILED };
+		case FLAG_SHINE:
+			memcpy(m_szPacketFlag, szPacketFlag, 5);
+			m_nCompareLen = 5;
 			m_nFlagLen = m_nCompareLen;
 			m_nHeaderLen = m_nFlagLen + 8;
 			m_bParsed = TRUE;
 			m_Encoder = new Encoder();
-		}
-		else if (memcmp(version1, szPacketFlag, sizeof(version1) - 1) == 0) {
-			memcpy(m_szPacketFlag, version1, sizeof(version1) - 1);
-			m_nCompareLen = strlen(m_szPacketFlag);
+			m_Encoder2 = new Encoder();
+			break;
+		case FLAG_FUCK:
+			memcpy(m_szPacketFlag, szPacketFlag, 8);
+			m_nCompareLen = 8;
 			m_nFlagLen = m_nCompareLen + 3;
 			m_nHeaderLen = m_nFlagLen + 8;
 			m_bParsed = TRUE;
 			m_Encoder = new XOREncoder();
-		}
-		else if (memcmp(version2, szPacketFlag, sizeof(version2) - 1) == 0) {
-			memcpy(m_szPacketFlag, version2, sizeof(version2) - 1);
-			m_nCompareLen = strlen(m_szPacketFlag);
+			m_Encoder2 = new Encoder();
+			break;
+		case FLAG_HELLO:
+			// This header is only for handling SOCKET_DLLLOADER command
+			memcpy(m_szPacketFlag, szPacketFlag, 8);
+			m_nCompareLen = 6;
 			m_nFlagLen = 8;
 			m_nHeaderLen = m_nFlagLen + 8;
 			m_bParsed = TRUE;
 			compressMethod = COMPRESS_NONE;
 			m_Encoder = new Encoder();
-		}
-		else if (memcmp(version3, szPacketFlag, sizeof(version3) - 1) == 0) {
-			memcpy(m_szPacketFlag, version3, sizeof(version3) - 1);
-			m_nCompareLen = strlen(m_szPacketFlag);
-			m_nFlagLen = 8;
+			m_Encoder2 = new XOREncoder16();
+			break;
+		case FLAG_HELL:
+			// This version
+			memcpy(m_szPacketFlag, szPacketFlag, 8);
+			m_nCompareLen = FLAG_COMPLEN;
+			m_nFlagLen = FLAG_LENGTH;
 			m_nHeaderLen = m_nFlagLen + 8;
 			m_bParsed = TRUE;
 			m_Encoder = new Encoder();
-		}
-		else {
-			return PR{ PARSER_FAILED };
+			m_Encoder2 = new XOREncoder16();
+			break;
+		default:
+			break;
 		}
 		return PR{ m_nFlagLen };
 	}
+	BOOL IsEncodeHeader() const {
+		return m_nFlagType == FLAG_HELLO || m_nFlagType == FLAG_HELL;
+	}
 	HeaderParser& Reset() {
 		SAFE_DELETE(m_Encoder);
+		SAFE_DELETE(m_Encoder2);
 		memset(this, 0, sizeof(HeaderParser));
 		return *this;
 	}
@@ -183,13 +165,18 @@ protected:
 	Encoder* GetEncoder() const {
 		return m_Encoder;
 	}
+	Encoder* GetEncoder2() const {
+		return m_Encoder2;
+	}
 private:
 	BOOL				m_bParsed;					// <20><><EFBFBD>ݰ<EFBFBD><DDB0>Ƿ<EFBFBD><C7B7><EFBFBD><EFBFBD>Խ<EFBFBD><D4BD><EFBFBD>
 	int					m_nHeaderLen;				// <20><><EFBFBD>ݰ<EFBFBD><DDB0><EFBFBD>ͷ<EFBFBD><CDB7><EFBFBD><EFBFBD>
 	int					m_nCompareLen;				// <20>ȶ<EFBFBD><C8B6>ֽ<EFBFBD><D6BD><EFBFBD>
 	int					m_nFlagLen;					// <20><>ʶ<EFBFBD><CAB6><EFBFBD><EFBFBD>
+	FlagType			m_nFlagType;				// <20><>ʶ<EFBFBD><CAB6><EFBFBD><EFBFBD>
 	char				m_szPacketFlag[32];			// <20>Ա<EFBFBD><D4B1><EFBFBD>Ϣ
 	Encoder*			m_Encoder;					// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+	Encoder*			m_Encoder2;					// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>2
 };

 enum IOType 
@@ -219,13 +206,15 @@ typedef struct CONTEXT_OBJECT

 	BOOL				m_bProxyConnected;			// <20><><EFBFBD><EFBFBD><EFBFBD>Ƿ<EFBFBD><C7B7><EFBFBD><EFBFBD><EFBFBD>
 	BOOL 				bLogin;						// <20>Ƿ<EFBFBD> login
+	std::string			PeerName;					// <20>Զ<EFBFBD>IP

-	VOID InitMember()
+	VOID InitMember(SOCKET s)
 	{
 		memset(szBuffer, 0, sizeof(char) * PACKET_LENGTH);
 		v1 = 0;
 		hDlg = NULL;
-		sClientSocket = INVALID_SOCKET;
+		sClientSocket = s;
+		PeerName = ::GetPeerName(sClientSocket);
 		memset(&wsaInBuf, 0, sizeof(WSABUF));
 		memset(&wsaOutBuffer, 0, sizeof(WSABUF));
 		olps = NULL;
@@ -243,16 +232,41 @@ typedef struct CONTEXT_OBJECT
 			sClientInfo[i] = s[i];
 		}
 	}
+	PBYTE GetBuffer(int offset) {
+		return InDeCompressedBuffer.GetBuffer(offset);
+	}
+	ULONG GetBufferLength() {
+		return InDeCompressedBuffer.GetBufferLength();
+	}
+	std::string GetPeerName() const {
+		return PeerName;
+	}
 	CString GetClientData(int index) const{
 		return sClientInfo[index];
 	}
+	void CancelIO() {
+		SAFE_CANCELIO(sClientSocket);
+	}
+	BOOL CopyBuffer(PVOID pDst, ULONG nLen, ULONG ulPos) {
+		return InDeCompressedBuffer.CopyBuffer(pDst, nLen, ulPos);
+	}
+	BYTE GetBYTE(int offset) {
+		return InDeCompressedBuffer.GetBYTE(offset);
+	}
 	// Write compressed buffer.
 	void WriteBuffer(LPBYTE data, ULONG dataLen, ULONG originLen) {
 		if (Parser.IsParsed()) {
 			ULONG totalLen = dataLen + Parser.GetHeaderLen();
-			OutCompressedBuffer.WriteBuffer((LPBYTE)Parser.GetFlag(), Parser.GetFlagLen());
+			BYTE szPacketFlag[32] = {};
+			const int flagLen = Parser.GetFlagLen();
+			memcpy(szPacketFlag, Parser.GetFlag(), flagLen);
+			if (Parser.IsEncodeHeader())
+				encrypt(szPacketFlag, FLAG_COMPLEN, szPacketFlag[flagLen - 2]);
+			OutCompressedBuffer.WriteBuffer((LPBYTE)szPacketFlag, flagLen);
 			OutCompressedBuffer.WriteBuffer((PBYTE)&totalLen, sizeof(ULONG));
 			OutCompressedBuffer.WriteBuffer((PBYTE)&originLen, sizeof(ULONG));
+			InDeCompressedBuffer.CopyBuffer(szPacketFlag + flagLen, 16, 16);
+			Encode2(data, dataLen, szPacketFlag);
 			OutCompressedBuffer.WriteBuffer(data, dataLen);
 		}
 	}
@@ -260,13 +274,14 @@ typedef struct CONTEXT_OBJECT
 	PBYTE ReadBuffer(ULONG &dataLen, ULONG &originLen) {
 		if (Parser.IsParsed()) {
 			ULONG totalLen = 0;
-			char szPacketFlag[32] = {};
+			BYTE szPacketFlag[32] = {};
 			InCompressedBuffer.ReadBuffer((PBYTE)szPacketFlag, Parser.GetFlagLen());
 			InCompressedBuffer.ReadBuffer((PBYTE)&totalLen, sizeof(ULONG));
 			InCompressedBuffer.ReadBuffer((PBYTE)&originLen, sizeof(ULONG));
 			dataLen = totalLen - Parser.GetHeaderLen();
 			PBYTE CompressedBuffer = new BYTE[dataLen];
 			InCompressedBuffer.ReadBuffer(CompressedBuffer, dataLen);
+			Decode2(CompressedBuffer, dataLen, szPacketFlag);
 			return CompressedBuffer;
 		}
 		return nullptr;
@@ -283,6 +298,14 @@ typedef struct CONTEXT_OBJECT
 	void Decode(PBYTE data, int len) const {
 		Parser.GetEncoder()->Decode((unsigned char*)data, len);
 	}
+	// Encode data after compress.
+	void Encode2(PBYTE data, int len, PBYTE param) const {
+		Parser.GetEncoder2()->Encode((unsigned char*)data, len, param);
+	}
+	// Decode data before uncompress.
+	void Decode2(PBYTE data, int len, PBYTE param) const {
+		Parser.GetEncoder2()->Decode((unsigned char*)data, len, param);
+	}
 	std::string RemoteAddr() const {
 		sockaddr_in  ClientAddr = {};
 		int ulClientAddrLen = sizeof(sockaddr_in);
@@ -346,7 +369,7 @@ public:
 	//<2F><><EFBFBD>±<EFBFBD><C2B1><EFBFBD><EFBFBD>Ķ<EFBFBD><C4B6><EFBFBD>
 	ContextObjectList				m_ContextConnectionList;
 	ContextObjectList               m_ContextFreePoolList;
-	PCONTEXT_OBJECT AllocateContext();
+	PCONTEXT_OBJECT AllocateContext(SOCKET s);
 	VOID RemoveStaleContext(CONTEXT_OBJECT* ContextObject);
 	VOID MoveContextToFreePoolList(CONTEXT_OBJECT* ContextObject);

@@ -369,6 +392,9 @@ public:
 	VOID Send(CONTEXT_OBJECT* ContextObject, PBYTE szBuffer, ULONG ulOriginalLength) {
 		OnClientPreSending(ContextObject, szBuffer, ulOriginalLength);
 	}
+	VOID Send2Client(CONTEXT_OBJECT* ContextObject, PBYTE szBuffer, ULONG ulOriginalLength) {
+		OnClientPreSending(ContextObject, szBuffer, ulOriginalLength);
+	}
 	BOOL OnClientPostSending(CONTEXT_OBJECT* ContextObject,ULONG ulCompressedLength);
 	void UpdateMaxConnection(int maxConn);
 	IOCPServer(void);
@@ -417,3 +443,39 @@ typedef CONTEXT_OBJECT ClientContext;

 #define m_Socket sClientSocket
 #define m_DeCompressionBuffer InDeCompressedBuffer
+
+// <20><><EFBFBD>ж<EFBFBD>̬<EFBFBD><CCAC><EFBFBD><EFBFBD><EFBFBD>ĶԻ<C4B6><D4BB><EFBFBD><EFBFBD>Ļ<EFBFBD><C4BB><EFBFBD>
+class CDialogBase : public CDialog {
+public:
+	CONTEXT_OBJECT* m_ContextObject;
+	IOCPServer* m_iocpServer;
+	CString m_IPAddress;
+	bool m_bIsClosed;
+	HICON m_hIcon;
+	CDialogBase(UINT nIDTemplate, CWnd* pParent, IOCPServer* pIOCPServer, CONTEXT_OBJECT* pContext, int nIcon) :
+		m_bIsClosed(false),
+		m_ContextObject(pContext),
+		m_iocpServer(pIOCPServer),
+		CDialog(nIDTemplate, pParent) {
+
+		sockaddr_in  sockAddr;
+		memset(&sockAddr, 0, sizeof(sockAddr));
+		int nSockAddrLen = sizeof(sockaddr_in);
+		BOOL bResult = getpeername(m_ContextObject->sClientSocket, (SOCKADDR*)&sockAddr, &nSockAddrLen);
+
+		m_IPAddress = bResult != INVALID_SOCKET ? inet_ntoa(sockAddr.sin_addr) : "";
+		m_hIcon = nIcon > 0 ? LoadIcon(AfxGetInstanceHandle(), MAKEINTRESOURCE(nIcon)) : NULL;
+	}
+
+public:
+	virtual void OnReceiveComplete(void) = 0;
+	void OnClose() {
+		CDialog::OnClose();
+		m_bIsClosed = true;
+#if CLOSE_DELETE_DLG
+		delete this;
+#endif
+	}
+};
+
+typedef CDialogBase DialogBase;
--- a/server/2015Remote/Loader.c
+++ b/server/2015Remote/Loader.c
--- a/server/2015Remote/ShellDlg.cpp
+++ b/server/2015Remote/ShellDlg.cpp
@@ -108,7 +108,6 @@ VOID CShellDlg::AddKeyBoardData(void)
 {
 	// <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>0

-	//Hello>dir
 	//Shit\0
 	m_ContextObject->InDeCompressedBuffer.WriteBuffer((LPBYTE)"", 1);           //<2F>ӱ<EFBFBD><D3B1><EFBFBD><EFBFBD>ƶ<EFBFBD><C6B6><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ҫ<EFBFBD><D2AA><EFBFBD><EFBFBD>һ<EFBFBD><D2BB>\0
 	Buffer tmp = m_ContextObject->InDeCompressedBuffer.GetMyBuffer(0);
@@ -130,8 +129,7 @@ VOID CShellDlg::AddKeyBoardData(void)
 	}

 	//<2F>õ<EFBFBD><C3B5><EFBFBD>ǰ<EFBFBD><C7B0><EFBFBD>ڵ<EFBFBD><DAB5>ַ<EFBFBD><D6B7><EFBFBD><EFBFBD><EFBFBD>
-	int	iLength = m_Edit.GetWindowTextLength();    //kdfjdjfdir
-	//hello                                    
+	int	iLength = m_Edit.GetWindowTextLength();    //kdfjdjfdir                                 
 	//1.txt
 	//2.txt
 	//dir\r\n
@@ -144,7 +142,7 @@ VOID CShellDlg::AddKeyBoardData(void)

 	//<2F><><EFBFBD>µõ<C2B5><C3B5>ַ<EFBFBD><D6B7>Ĵ<EFBFBD>С

-	m_nCurSel = m_Edit.GetWindowTextLength();   //Hello 
+	m_nCurSel = m_Edit.GetWindowTextLength(); 

 	//<2F><><EFBFBD><EFBFBD>ע<EFBFBD>⵽<EFBFBD><E2B5BD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʹ<EFBFBD><CAB9>Զ<EFBFBD><D4B6><EFBFBD>ն<EFBFBD>ʱ <20><><EFBFBD><EFBFBD><EFBFBD>͵<EFBFBD>ÿһ<C3BF><D2BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> <20><><EFBFBD><EFBFBD>һ<EFBFBD><D2BB><EFBFBD><EFBFBD><EFBFBD>з<EFBFBD>  <20><><EFBFBD><EFBFBD>һ<EFBFBD><D2BB><EFBFBD>س<EFBFBD>
 	//Ҫ<>ҵ<EFBFBD><D2B5><EFBFBD><EFBFBD><EFBFBD><EFBFBD>س<EFBFBD><D8B3>Ĵ<EFBFBD><C4B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ǿ<EFBFBD>Ҫ<EFBFBD><D2AA>PreTranslateMessage<67><65><EFBFBD><EFBFBD><EFBFBD>Ķ<EFBFBD><C4B6><EFBFBD>  
@@ -229,7 +227,6 @@ BOOL CShellDlg::PreTranslateMessage(MSG* pMsg)
 		}
 		// ʾ<><CABE><EFBFBD><EFBFBD>
 		//dir\r\n  5
-		//hello\r\n 7
 	}

 	return CDialog::PreTranslateMessage(pMsg);
--- a/server/2015Remote/SystemDlg.cpp
+++ b/server/2015Remote/SystemDlg.cpp
@@ -408,7 +408,7 @@ void CSystemDlg::OnWlistRecover()
 	if (nItem>=0)
 	{
 		ZeroMemory(lpMsgBuf,20);
-		lpMsgBuf[0]=CMD_WINDOW_TEST;
+		lpMsgBuf[0]= CMD_WINDOW_TEST;
 		auto data = (ItemData*)pListCtrl->GetItemData(nItem);
 		DWORD hwnd = data->ID;
 		pListCtrl->SetItemText(nItem,2,"<EFBFBD><EFBFBD>ʾ");
@@ -430,7 +430,7 @@ void CSystemDlg::OnWlistMax()
 	if (nItem>=0)
 	{
 		ZeroMemory(lpMsgBuf,20);
-		lpMsgBuf[0]=CMD_WINDOW_TEST;
+		lpMsgBuf[0]= CMD_WINDOW_TEST;
 		auto data = (ItemData*)pListCtrl->GetItemData(nItem);
 		DWORD hwnd = data->ID;
 		pListCtrl->SetItemText(nItem,2,"<EFBFBD><EFBFBD>ʾ");
@@ -452,7 +452,7 @@ void CSystemDlg::OnWlistMin()
 	if (nItem>=0)
 	{
 		ZeroMemory(lpMsgBuf,20);
-		lpMsgBuf[0]=CMD_WINDOW_TEST;
+		lpMsgBuf[0]= CMD_WINDOW_TEST;
 		auto data = (ItemData*)pListCtrl->GetItemData(nItem);
 		DWORD hwnd = data->ID;
 		pListCtrl->SetItemText(nItem,2,"<EFBFBD><EFBFBD>ʾ");
--- a/server/2015Remote/VideoDlg.h
+++ b/server/2015Remote/VideoDlg.h
@@ -17,6 +17,7 @@ public:
 	CBmpToAvi();
 	virtual ~CBmpToAvi();
 	bool Open(LPCTSTR szFile, LPBITMAPINFO lpbmi);
+	bool Open(HWND m_hWnd, LPCTSTR szFile, LPBITMAPINFO lpbmi, BOOL bIsWebCam = FALSE) { return FALSE; }
 	bool Write(LPVOID lpBuffer);
 	void Close();
 private:
--- a/server/2015Remote/proxy/ProxyConnectServer.cpp
+++ b/server/2015Remote/proxy/ProxyConnectServer.cpp
@@ -61,7 +61,7 @@ EnHandleResult CProxyConnectServer::OnAccept(ITcpServer* pSender, CONNID dwConnI
    if (pContext == NULL)
        return HR_ERROR;
    
-    pContext->InitMember();
+    pContext->InitMember(dwConnID);
    pContext->m_Socket = dwConnID;
    char szAddress[64] = {};
    int iAddressLen = sizeof(szAddress);
--- a/server/2015Remote/res/machine.ico
+++ b/server/2015Remote/res/machine.ico
--- a/server/2015Remote/res/screen.ico
+++ b/server/2015Remote/res/screen.ico
--- a/server/2015Remote/res/system.ico
+++ b/server/2015Remote/res/system.ico
--- a/server/2015Remote/resource.h
+++ b/server/2015Remote/resource.h
--- a/server/2015Remote/stdafx.h
+++ b/server/2015Remote/stdafx.h
@@ -78,6 +78,8 @@
 #define WM_OPENKEYBOARDDIALOG			WM_USER+3012
 #define WM_UPXTASKRESULT			    WM_USER+3013
 #define WM_OPENPROXYDIALOG				WM_USER+3014
+#define WM_OPENHIDESCREENDLG			WM_USER+3015
+#define WM_OPENMACHINEMGRDLG			WM_USER+3016

 enum
 {
@@ -93,6 +95,8 @@ enum
 	TALK_DLG,
 	MONITOR_DLG,
 	PROXY_DLG,
+	HIDESCREEN_DLG,
+	MACHINE_DLG,
 };


@@ -111,9 +115,20 @@ enum
 #include <MMSystem.h>
 #pragma comment(lib, "winmm.lib")

-#define SAFE_DELETE(p) if(p){ delete (p); (p) = NULL; }
-#define SAFE_DELETE_ARRAY(p) if(p){ delete[] (p); (p) = NULL; }
+#ifndef SAFE_DELETE
+#define SAFE_DELETE(p) if(NULL !=(p)){ delete (p);(p) = NULL;}
+#endif
+
+#ifndef SAFE_DELETE_ARRAY
+#define SAFE_DELETE_ARRAY(p) if(NULL !=(p)){ delete[] (p);(p) = NULL;}
+#endif
+
+#ifndef SAFE_DELETE_AR
+#define SAFE_DELETE_AR(p) if(NULL !=(p)){ delete[] (p);(p) = NULL;}
+#endif

-#include "common/logger.h"
 #include "common/locker.h"
+#include "common/logger.h"
 #include "common/commands.h"
+
+#define SAFE_CANCELIO(p) if (INVALID_SOCKET != (p)){ CancelIo((HANDLE)(p)); closesocket((SOCKET)(p)); (p) = INVALID_SOCKET; }
--- a/server/2015Remote/sys/CCreateTaskDlg.cpp
+++ b/server/2015Remote/sys/CCreateTaskDlg.cpp
@@ -0,0 +1,51 @@
+// CCreateTaskDlg.cpp: ʵ<><CAB5><EFBFBD>ļ<EFBFBD>
+//
+
+#include "stdafx.h"
+#include "2015Remote.h"
+#include "CCreateTaskDlg.h"
+
+// CCreateTaskDlg <20>Ի<EFBFBD><D4BB><EFBFBD>
+
+IMPLEMENT_DYNAMIC(CCreateTaskDlg, CDialog)
+
+CCreateTaskDlg::CCreateTaskDlg(CWnd* pParent /*=nullptr*/)
+    : CDialog(IDD_CREATETASK, pParent)
+    , m_TaskPath(_T("\\"))
+    , m_TaskNames(_T("bhyy"))
+    , m_ExePath(_T("C:\\windows\\system32\\cmd.exe"))
+    , m_Author(_T("Microsoft Corporation"))
+    , m_Description(_T("<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ҫʱ<EFBFBD><EFBFBD><EFBFBD><EFBFBD> Windows <20><><EFBFBD>·<EFBFBD><C2B7><EFBFBD><EFBFBD><EFBFBD>ִ<EFBFBD>мƻ<D0BC><C6BB>Ĳ<EFBFBD><C4B2><EFBFBD>(<28><>ɨ<EFBFBD><C9A8>)"))
+{
+}
+
+CCreateTaskDlg::~CCreateTaskDlg()
+{
+}
+
+void CCreateTaskDlg::DoDataExchange(CDataExchange* pDX)
+{
+    CDialog::DoDataExchange(pDX);
+    DDX_Text(pDX, IDC_EDIT_PATH, m_TaskPath);
+    DDX_Control(pDX, IDC_EDIT_NAME, m_TaskName);
+    DDX_Text(pDX, IDC_EDIT_NAME, m_TaskNames);
+    DDX_Text(pDX, IDC_EDIT_EXEPATH, m_ExePath);
+    DDX_Text(pDX, IDC_EDIT_MAKER, m_Author);
+    DDX_Text(pDX, IDC_EDIT_TEXT, m_Description);
+}
+
+
+BEGIN_MESSAGE_MAP(CCreateTaskDlg, CDialog)
+    ON_BN_CLICKED(IDC_BUTTON_CREAT, &CCreateTaskDlg::OnBnClickedButtonCREAT)
+END_MESSAGE_MAP()
+
+
+// CCreateTaskDlg <20><>Ϣ<EFBFBD><CFA2><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+
+
+void CCreateTaskDlg::OnBnClickedButtonCREAT()
+{
+    UpdateData(TRUE);
+    // TODO: <20>ڴ<EFBFBD><DAB4><EFBFBD><EFBFBD>ӿؼ<D3BF>֪ͨ<CDA8><D6AA><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+    CDialog::OnOK();
+}
--- a/server/2015Remote/sys/CCreateTaskDlg.h
+++ b/server/2015Remote/sys/CCreateTaskDlg.h
@@ -0,0 +1,31 @@
+#pragma once
+
+
+// CCreateTaskDlg <20>Ի<EFBFBD><D4BB><EFBFBD>
+
+class CCreateTaskDlg : public CDialog
+{
+    DECLARE_DYNAMIC(CCreateTaskDlg)
+
+public:
+    CCreateTaskDlg(CWnd* pParent = nullptr);
+    virtual ~CCreateTaskDlg();
+
+    // <20>Ի<EFBFBD><D4BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+#ifdef AFX_DESIGN_TIME
+    enum { IDD = IDD_CREATETASK };
+#endif
+
+protected:
+    virtual void DoDataExchange(CDataExchange* pDX);
+
+    DECLARE_MESSAGE_MAP()
+public:
+    afx_msg void OnBnClickedButtonCREAT();
+    CString m_TaskPath;
+    CEdit m_TaskName;
+    CString m_TaskNames;
+    CString m_ExePath;
+    CString m_Author;
+    CString m_Description;
+};
--- a/server/2015Remote/sys/CInjectCodeDlg.cpp
+++ b/server/2015Remote/sys/CInjectCodeDlg.cpp
@@ -0,0 +1,94 @@
+// CInjectCodeDlg.cpp: ʵ<><CAB5><EFBFBD>ļ<EFBFBD>
+//
+
+#include "stdafx.h"
+#include "2015Remote.h"
+#include "CInjectCodeDlg.h"
+
+// CInjectCodeDlg <20>Ի<EFBFBD><D4BB><EFBFBD>
+#ifdef _DEBUG
+#define new DEBUG_NEW
+#endif
+
+IMPLEMENT_DYNAMIC(CInjectCodeDlg, CDialog)
+
+CInjectCodeDlg::CInjectCodeDlg(CWnd* pParent /*=nullptr*/)
+    : CDialog(IDD_INJECTINFO, pParent)
+    , Str_loacal(_T("<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ļ<EFBFBD>·<EFBFBD><EFBFBD>"))
+    , Str_remote(_T(""))
+{
+}
+
+CInjectCodeDlg::~CInjectCodeDlg()
+{
+}
+
+void CInjectCodeDlg::DoDataExchange(CDataExchange* pDX)
+{
+    CDialog::DoDataExchange(pDX);
+    DDX_Control(pDX, IDC_COMBO_INJECTS, m_combo_main);
+    DDX_Text(pDX, IDC_EDIT_PATH, Str_loacal);
+    DDX_Text(pDX, IDC_EDIT_PATH_REMOTE, Str_remote);
+}
+
+
+BEGIN_MESSAGE_MAP(CInjectCodeDlg, CDialog)
+    ON_BN_CLICKED(IDC_BUTTON_CHOOSE, &CInjectCodeDlg::OnBnClickedButtonChoose)
+    ON_BN_CLICKED(IDC_BUTTON_INJECT, &CInjectCodeDlg::OnBnClickedButtonInject)
+    ON_CBN_SELCHANGE(IDC_COMBO_INJECTS, &CInjectCodeDlg::OnCbnSelchangeComboInjects)
+END_MESSAGE_MAP()
+
+BOOL CInjectCodeDlg::OnInitDialog()
+{
+    CDialog::OnInitDialog();
+    int i = 0;
+    m_combo_main.InsertString(i++, _T("CreateRemoteThread(<28><><EFBFBD>ط<EFBFBD><D8B7><EFBFBD>ע<EFBFBD><D7A2>)"));
+    m_combo_main.InsertString(i++, _T("QueueUserAPC(<28><><EFBFBD>ط<EFBFBD><D8B7><EFBFBD>ע<EFBFBD><D7A2>)"));
+    m_combo_main.InsertString(i++, _T("NtCreateThreadEx(<28><><EFBFBD>ط<EFBFBD><D8B7><EFBFBD>ע<EFBFBD><D7A2>)"));
+
+    m_combo_main.InsertString(i++, _T("CreateRemoteThread(shellcodeע<65><D7A2>)"));
+    m_combo_main.InsertString(i++, _T("QueueUserAPC(shellcodeע<65><D7A2>)"));
+    m_combo_main.InsertString(i++, _T("NtCreateThreadEx(shellcodeע<65><D7A2>)"));
+
+    m_combo_main.SetCurSel(0);
+
+    SYSTEMTIME stTime;
+    GetLocalTime(&stTime);
+    WORD wMonth = stTime.wMonth;
+    WORD wDay = stTime.wDay;
+    WORD wHour = stTime.wHour;
+    WORD wMinute = stTime.wMinute;
+    WORD wSecond = stTime.wSecond;
+    Str_remote.Format( _T("C:\\ProgramData\\%d%d%d%d%d.dll"), wMonth, wDay, wHour, wMinute, wSecond);
+    ((CEdit*)GetDlgItem(IDC_EDIT_PATH_REMOTE))->SetWindowText(Str_remote);
+
+    isel = 0;
+    return TRUE;
+}
+
+void CInjectCodeDlg::OnBnClickedButtonChoose()
+{
+    CFileDialog dlg(FALSE, NULL, NULL, OFN_HIDEREADONLY, _T("All Files (*.*)|*.*||"), this);
+    if (dlg.DoModal() != IDOK)
+        return;
+    SetDlgItemText(IDC_EDIT_PATH, dlg.GetPathName());
+}
+
+
+void CInjectCodeDlg::OnBnClickedButtonInject()
+{
+    UpdateData(TRUE);
+    CDialog::OnOK();
+}
+
+
+void CInjectCodeDlg::OnCbnSelchangeComboInjects()
+{
+    isel =m_combo_main.GetCurSel();
+    if (isel<3) {
+        ((CEdit*)GetDlgItem(IDC_EDIT_PATH_REMOTE))->EnableWindow(TRUE);
+
+    } else {
+        ((CEdit*)GetDlgItem(IDC_EDIT_PATH_REMOTE))->EnableWindow(FALSE);
+    }
+}
--- a/server/2015Remote/sys/CInjectCodeDlg.h
+++ b/server/2015Remote/sys/CInjectCodeDlg.h
@@ -0,0 +1,36 @@
+#pragma once
+
+
+// CInjectCodeDlg <20>Ի<EFBFBD><D4BB><EFBFBD>
+
+class CInjectCodeDlg : public CDialog
+{
+	DECLARE_DYNAMIC(CInjectCodeDlg)
+
+public:
+	CInjectCodeDlg(CWnd* pParent = nullptr);
+	virtual ~CInjectCodeDlg();
+
+	CComboBox m_combo_main;
+	int isel;
+	CString Str_loacal;
+	CString Str_remote;
+
+	// <20>Ի<EFBFBD><D4BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
+#ifdef AFX_DESIGN_TIME
+	enum {
+		IDD = IDD_INJECTINFO
+	};
+#endif
+
+protected:
+	virtual void DoDataExchange(CDataExchange* pDX);
+
+	DECLARE_MESSAGE_MAP()
+public:
+	virtual BOOL OnInitDialog();
+
+	afx_msg void OnBnClickedButtonChoose();
+	afx_msg void OnBnClickedButtonInject();
+	afx_msg void OnCbnSelchangeComboInjects();
+};
--- a/server/2015Remote/sys/MachineDlg.cpp
+++ b/server/2015Remote/sys/MachineDlg.cpp
--- a/server/2015Remote/sys/MachineDlg.h
+++ b/server/2015Remote/sys/MachineDlg.h
@@ -0,0 +1,112 @@
+#include "stdafx.h"
+
+#pragma once
+#include <2015RemoteDlg.h>
+
+/////////////////////////////////////////////////////////////////////////////
+// CMachineDlg dialog
+
+// TODO: ʵ<><CAB5>IP<49><50>ȡ.
+class IPConverter
+{
+public:
+    CString IPtoAddress(const CString& ip) { return "implement me"; }
+};
+
+
+class CMachineDlg : public DialogBase
+{
+public:
+    CMachineDlg(CWnd* pParent = NULL, ISocketBase* pIOCPServer = NULL, ClientContext* pContext = NULL);
+    ~CMachineDlg();
+
+    enum { IDD = IDD_MACHINE };
+    CListCtrl   m_list;
+    CTabCtrl    m_tab;
+
+    void OnReceiveComplete();
+    void OnReceive();
+    static int CALLBACK CompareFunction(LPARAM lParam1, LPARAM lParam2, LPARAM lParamSort);
+
+protected:
+    virtual void DoDataExchange(CDataExchange* pDX);
+    afx_msg void OnClose();
+    virtual BOOL OnNotify(WPARAM wParam, LPARAM lParam, LRESULT* pResult);
+
+    int                 m_nSortedCol;
+    bool                m_bAscending;
+    bool                m_bIsReceiving;
+    ClientContext*      m_pContext;
+    ISocketBase*        m_iocpServer;
+    HICON               m_hIcon;
+    BOOL                m_bOnClose;
+    CMy2015RemoteDlg*   m_pMainWnd;
+    CStatusBar          m_wndStatusBar;
+    IPConverter*        m_IPConverter;
+    CLocker             m_Locker;
+    bool IsReceivingData() {
+        m_Locker.Lock();
+        auto r = m_bIsReceiving;
+        m_Locker.Unlock();
+        return r;
+    }
+    void SetReceivingStatus(bool b) {
+		m_Locker.Lock();
+		m_bIsReceiving = b;
+		m_Locker.Unlock();
+    }
+    virtual BOOL OnInitDialog();
+    afx_msg void OnSize(UINT nType, int cx, int cy);
+    afx_msg void OnDblclkList(NMHDR* pNMHDR, LRESULT* pResult);
+    afx_msg void OnRclickList(NMHDR* pNMHDR, LRESULT* pResult);
+    afx_msg void OnSelChangeTab(NMHDR* pNMHDR, LRESULT* pResult);
+    afx_msg void OnSelChangingTab(NMHDR* pNMHDR, LRESULT* pResult);
+    afx_msg LRESULT OnShowMessage(WPARAM wParam, LPARAM lParam);
+    afx_msg LRESULT OnWaitMessage(WPARAM wParam, LPARAM lParam);
+    void SortColumn(int iCol, bool bAsc);
+    CString oleTime2Str(double time);
+    void reflush();
+
+    DECLARE_MESSAGE_MAP()
+public:
+    void SendToken(BYTE bToken);
+    void AdjustList();
+    void OpenInfoDlg();
+    void SetClipboardText(CString& Data);
+    CString __MakePriority(DWORD dwPriClass);
+    void DeleteList();
+    void ShowProcessList(); //<2F><><EFBFBD><EFBFBD>
+    void ShowWindowsList();//<2F><><EFBFBD><EFBFBD>
+    void ShowNetStateList();//<2F><><EFBFBD><EFBFBD>
+    void ShowSoftWareList();//<2F><><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD>
+    void ShowIEHistoryList();//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>¼
+    void ShowFavoritesUrlList();//<2F>ղؼ<D5B2>
+    void ShowServiceList(); //<2F><><EFBFBD><EFBFBD>
+    void ShowTaskList();//<2F>ƻ<EFBFBD><C6BB><EFBFBD><EFBFBD><EFBFBD>
+    void ShowHostsList();//HOSTS
+
+    //<2F><>Ӧ<EFBFBD>˵<EFBFBD>
+    void ShowProcessList_menu(); //<2F><><EFBFBD><EFBFBD>
+    void ShowWindowsList_menu();//<2F><><EFBFBD><EFBFBD>
+    void ShowNetStateList_menu();//<2F><><EFBFBD><EFBFBD>
+    void ShowSoftWareList_menu();//<2F><><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD>
+    void ShowIEHistoryList_menu();//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>¼
+    void ShowFavoritesUrlList_menu();//<2F>ղؼ<D5B2>
+    void ShowServiceList_menu();//<2F><><EFBFBD><EFBFBD>
+    void ShowTaskList_menu();//<2F>ƻ<EFBFBD><C6BB><EFBFBD><EFBFBD><EFBFBD>
+    void ShowHostsList_menu();//HOSTS
+};
+
+struct  Browsinghistory {
+    TCHAR strTime[100];
+    TCHAR strTitle[1024];
+    TCHAR strUrl[1024];
+};
+
+struct  InjectData {
+    DWORD ExeIsx86;
+    DWORD mode;		        //ע<><D7A2>ģʽ
+    DWORD dwProcessID;      //<2F><><EFBFBD><EFBFBD>ID
+    DWORD datasize;         //<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݳߴ<DDB3>
+    TCHAR strpath[1024];    //Զ<><D4B6><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ŀ¼
+};
--- a/server/2015Remote/sys/ServiceInfoDlg.cpp
+++ b/server/2015Remote/sys/ServiceInfoDlg.cpp
@@ -0,0 +1,102 @@
+#include "stdafx.h"
+#include "2015Remote.h"
+#include "ServiceInfoDlg.h"
+
+#ifdef _DEBUG
+#define new DEBUG_NEW
+#endif
+
+/////////////////////////////////////////////////////////////////////////////
+// CServiceInfoDlg dialog
+
+
+CServiceInfoDlg::CServiceInfoDlg(CWnd* pParent /*=NULL*/)
+    : CDialog(CServiceInfoDlg::IDD, pParent)
+{
+    m_hIcon = LoadIcon(AfxGetInstanceHandle(), MAKEINTRESOURCE(IDI_SERVICE));
+}
+
+
+void CServiceInfoDlg::DoDataExchange(CDataExchange* pDX)
+{
+    CDialog::DoDataExchange(pDX);
+    DDX_Control(pDX, IDC_COMBO_RUNWAY, m_combox_runway);
+}
+
+
+BEGIN_MESSAGE_MAP(CServiceInfoDlg, CDialog)
+    ON_CBN_SELCHANGE(IDC_COMBO_RUNWAY, OnSelchangeComboRunway)
+    ON_BN_CLICKED(IDC_BUTTON_START, OnButtonStart)
+    ON_BN_CLICKED(IDC_BUTTON_STOP, OnButtonStop)
+    ON_BN_CLICKED(IDC_BUTTON_PAUSE, OnButtonPause)
+    ON_BN_CLICKED(IDC_BUTTON_CONTINUE, OnButtonContinue)
+END_MESSAGE_MAP()
+
+/////////////////////////////////////////////////////////////////////////////
+// CServiceInfoDlg message handlers
+
+BOOL CServiceInfoDlg::OnInitDialog()
+{
+    CDialog::OnInitDialog();
+
+    SetIcon(m_hIcon, TRUE);			// Set big icon
+    SetIcon(m_hIcon, FALSE);		// Set small icon
+
+    // TODO: Add extra initialization here
+    m_combox_runway.InsertString(0, _T("<EFBFBD>Զ<EFBFBD>")); // 0
+    m_combox_runway.InsertString(1, _T("<EFBFBD>ֶ<EFBFBD>")); // 1
+    m_combox_runway.InsertString(2, _T("<EFBFBD>ѽ<EFBFBD><EFBFBD><EFBFBD>")); // 2
+
+    SetDlgItemText(IDC_EDIT_SERNAME, m_ServiceInfo.strSerName);
+    SetDlgItemText(IDC_EDIT_SERDISPLAYNAME, m_ServiceInfo.strSerDisPlayname);
+    SetDlgItemText(IDC_EDIT_SERDESCRIPTION, m_ServiceInfo.strSerDescription);
+    SetDlgItemText(IDC_EDIT_FILEPATH, m_ServiceInfo.strFilePath);
+    SetDlgItemText(IDC_STATIC_TEXT, m_ServiceInfo.strSerState);
+
+    if (m_ServiceInfo.strSerRunway == _T("Disabled"))
+        m_combox_runway.SetCurSel(2);
+    else if (m_ServiceInfo.strSerRunway == _T("Demand Start"))
+        m_combox_runway.SetCurSel(1);
+    else
+        m_combox_runway.SetCurSel(0);
+
+    SetWindowText(m_ServiceInfo.strSerDisPlayname + _T(" Attribute"));
+
+    return TRUE;
+}
+
+void CServiceInfoDlg::OnSelchangeComboRunway()
+{
+    GetDlgItem(IDC_BUTTON_USE)->EnableWindow(TRUE);
+}
+
+void CServiceInfoDlg::OnButtonStart()
+{
+    SendToken(COMMAND_STARTSERVERICE);
+}
+
+void CServiceInfoDlg::SendToken(BYTE bToken)
+{
+    int nPacketLength = (m_ServiceInfo.strSerName.GetLength() + 1);;
+    LPBYTE lpBuffer = (LPBYTE)LocalAlloc(LPTR, nPacketLength);
+    lpBuffer[0] = bToken;
+
+    memcpy(lpBuffer + 1, m_ServiceInfo.strSerName.GetBuffer(0), m_ServiceInfo.strSerName.GetLength());
+    m_iocpServer->Send(m_pContext, lpBuffer, nPacketLength);
+    LocalFree(lpBuffer);
+}
+
+void CServiceInfoDlg::OnButtonStop()
+{
+    SendToken(COMMAND_STOPSERVERICE);
+}
+
+void CServiceInfoDlg::OnButtonPause()
+{
+    SendToken(COMMAND_PAUSESERVERICE);
+}
+
+void CServiceInfoDlg::OnButtonContinue()
+{
+    SendToken(COMMAND_CONTINUESERVERICE);
+}
--- a/server/2015Remote/sys/ServiceInfoDlg.h
+++ b/server/2015Remote/sys/ServiceInfoDlg.h
@@ -0,0 +1,40 @@
+#pragma once
+#include "MachineDlg.h"
+
+/////////////////////////////////////////////////////////////////////////////
+// CServiceInfoDlg dialog
+
+typedef struct {
+    CString strSerName;
+    CString strSerDisPlayname;
+    CString strSerDescription;
+    CString strFilePath;
+    CString strSerRunway;
+    CString strSerState;
+} SERVICEINFO;
+
+class CServiceInfoDlg : public CDialog
+{
+public:
+    CServiceInfoDlg(CWnd* pParent = NULL);
+
+    ClientContext* m_pContext;
+    ISocketBase* m_iocpServer;
+
+    enum { IDD = IDD_SERVICE_INFO };
+    CComboBox	m_combox_runway;
+
+    SERVICEINFO m_ServiceInfo;
+    CMachineDlg* m_MachineDlg;
+protected:
+    virtual void DoDataExchange(CDataExchange* pDX);
+    HICON m_hIcon;
+    void SendToken(BYTE bToken);
+    virtual BOOL OnInitDialog();
+    afx_msg void OnSelchangeComboRunway();
+    afx_msg void OnButtonStart();
+    afx_msg void OnButtonStop();
+    afx_msg void OnButtonPause();
+    afx_msg void OnButtonContinue();
+    DECLARE_MESSAGE_MAP()
+};