■ ■ ■ ■ ■ ■
SearchAvailableExe/SearchAvailableExe.cpp
1 - #include <iostream > 2 - #include <windows.h> 3 - #include <fstream> 4 - #include <thread> 1 + #include <thread > 5 2 #include "Tools.h" 3 + #include "CmdlineParser.hpp" 6 4 7 5 using namespace std; 8 6 9 7 vector<PResultInfo> results; 8 + ARG_CONFIG c; 10 9 11 10 void ThreadFunction(const std::wstring& filePath) { 12 11 VerifyFileSignature(filePath.c_str()); skipped 30 lines 43 42 } 44 43 } 45 44 46 - int main() { 47 - string outputFilename = "output.txt"; 48 - ofstream outputFile(outputFilename); 45 + bool compare(PResultInfo a, PResultInfo b) { 46 + int aPreSize = a->preLoadDlls.size() == 0 ? 999 : a->preLoadDlls.size(); 47 + int aPostSize = a->postLoadDlls.size() == 0 ? 999 : a->postLoadDlls.size(); 48 + int bPreSize = b->preLoadDlls.size() == 0 ? 999 : b->preLoadDlls.size(); 49 + int bPostSize = b->postLoadDlls.size() == 0 ? 999 : b->postLoadDlls.size(); 49 50 50 - if (!outputFile.is_open()) { 51 - cerr << "Failed to open output file." << endl; 51 + if ((aPreSize < bPreSize && aPreSize < bPostSize) || (aPostSize < bPreSize && aPostSize < bPostSize)) 52 + return true; 53 + else if ((bPreSize < aPreSize && bPreSize < aPostSize) || (bPostSize < aPreSize && bPostSize < aPostSize)) 54 + return false; 55 + else { 56 + return a->isWrite > b->isWrite; 57 + } 58 + } 59 + 60 + bool isUnwanted(const PResultInfo result) { 61 + if (c.isWrite == 1 && result->isWrite == 0) 62 + return true; 63 + if ((c.bit == 32 && result->bit != 32) || (c.bit == 64 && result->bit != 64)) 64 + return true; 65 + if (c.dllCount < result->postLoadDlls.size() && c.dllCount < result->preLoadDlls.size()) 66 + return true; 67 + 68 + return false; 69 + } 70 + 71 + static int validate_dllCount(opt_arg* arg, void* args) { 72 + char* str = (char*)args; 73 + 74 + arg->u32 = 0; 75 + if (str == NULL) return 0; 76 + 77 + arg->u32 = atoi(str); 78 + 79 + if (arg->u32 <= 0) 80 + return 0; 81 + else 52 82 return 1; 83 + } 84 + 85 + static int validate_bit(opt_arg* arg, void* args) { 86 + char* str = (char*)args; 87 + 88 + arg->u32 = 0; 89 + if (str == NULL) return 0; 90 + 91 + arg->u32 = atoi(str); 92 + 93 + if (arg->u32 != 32 && arg->u32 != 64 && arg->u32 != 96) 94 + return 0; 95 + else 96 + return 1; 97 + } 98 + 99 + static void usage(void) { 100 + printf("usage: SearchAvailableExe [options]\n"); 101 + printf(" -o,--output: <path> Output file to save dll info. Default is output command.\n"); 102 + printf(" -i,--input: <path> Input search path. Default traverse all disks.\n"); 103 + printf(" -w,--write: <bool> Whether to only output information about directories with write permissions, with the default value being 'no'.\n"); 104 + printf(" -c,--count: <count> Controls the output of the number of DLLs loaded by white programs, only outputting if the count is less than or equal to a specified value. The default value is 5.\n"); 105 + printf(" -b,--bit: <count> Select the output bitness, supporting 32, 64, and 96 bits. The default is 96 bits, while also outputting information for 32 and 64-bit white programs.\n"); 106 + exit(0); 107 + } 108 + 109 + int main(int argc, char* argv[]) { 110 + 111 + memset(&c, 0, sizeof(c)); 112 + 113 + c.dllCount = 5; 114 + c.bit = 96; 115 + 116 + get_opt(argc, argv, OPT_TYPE_NONE, NULL, "h;?", "help", usage); 117 + get_opt(argc, argv, OPT_TYPE_STRING, c.output, "o", "output", NULL); 118 + get_opt(argc, argv, OPT_TYPE_STRING, c.input, "i", "input", NULL); 119 + get_opt(argc, argv, OPT_TYPE_FLAG, &c.isWrite, "w", "write", NULL); 120 + get_opt(argc, argv, OPT_TYPE_DEC, &c.dllCount, "c", "count", validate_dllCount); 121 + get_opt(argc, argv, OPT_TYPE_DEC, &c.bit, "b", "bit", validate_bit); 122 + 123 + ostream* output = &cout; 124 + ofstream outputFile; 125 + if (c.output[0] != 0) { 126 + outputFile.open(c.output); 127 + 128 + if (!outputFile.is_open()) { 129 + cerr << "Failed to open output file." << endl; 130 + return 1; 131 + } 132 + output = &outputFile; 53 133 } 54 134 55 - // 遍历系统的所有盘符 56 - for (char drive = 'A'; drive <= 'Z'; ++drive) { 57 - wstring rootDirectory = wstring(1, drive) + L":"; 58 - ListExecutableFiles(rootDirectory); 135 + if (c.input[0] == 0) { 136 + for (char drive = 'A'; drive <= 'Z'; ++drive) { 137 + wstring rootDirectory = wstring(1, drive) + L":"; 138 + ListExecutableFiles(rootDirectory); 139 + } 140 + } 141 + else { 142 + ListExecutableFiles(ConvertToWideString(c.input)); 59 143 } 60 144 61 - //wstring rootDirectory = L"D:\\Code\\TeamWorkspace\\beacon\\白+黑 嵌入生成"; 62 - //wstring rootDirectory = L"C:\\Program Files\\Microsoft Visual Studio\\2022\\Professional\\VC\\Tools\\Llvm\\x64\\bin"; 63 - /*wstring rootDirectory = L"D:\\Users\\MaoKu\\AppData\\Local\\Programs\\Microsoft VS Code\\bin"; 64 - ListExecutableFiles(rootDirectory);*/ 145 + sort(results.begin(), results.end(), compare); 146 + 147 + results.erase(std::remove_if(results.begin(), results.end(), isUnwanted), results.end()); 65 148 66 149 for (const auto& result : results) { 67 - outputFile << result->filePath << endl; 68 - outputFile << "程序位数: " << result->bit << " 目录是否可写: " << result->isWrite << endl; 150 + * output << result->filePath << endl; 151 + * output << "程序位数: " << result->bit << " 目录是否可写: " << result->isWrite << endl; 69 152 70 153 if (result->preLoadDlls.size() > 0) { 71 - outputFile << "预加载DLL个数: " << result->preLoadDlls.size() << endl; 154 + * output << "预加载DLL个数: " << result->preLoadDlls.size() << endl; 72 155 for (const auto& dll : result->preLoadDlls) { 73 - outputFile << dll << endl; 156 + * output << dll << endl; 74 157 delete[] dll; 75 158 } 76 159 } 77 160 78 161 if (result->postLoadDlls.size() > 0) { 79 - outputFile << "动态加载DLL个数: " << result->postLoadDlls.size() << endl; 162 + * output << "动态加载DLL个数: " << result->postLoadDlls.size() << endl; 80 163 for (const auto& dll : result->postLoadDlls) { 81 - outputFile << dll << endl; 164 + * output << dll << endl; 82 165 delete[] dll; 83 166 } 84 167 } 85 168 86 - outputFile << "-------------------------" << endl; 169 + * output << "- - - - - - - - - - - - - - - - - - - - - - - - - -------------------------" << endl; 87 170 88 171 delete result; 89 172 } 90 173 91 - outputFile.close(); 92 - cout << "Output saved to " << outputFilename << endl; 174 + if (c.output[0] != 0) { 175 + outputFile.close(); 176 + cout << "Search finish. Output saved to " << c.output << endl; 177 + } 178 + else 179 + cout << "Search finish!" << endl; 93 180 94 181 return 0; 95 182 }