#include "active_check.h" #include "utils.h" static const NTSTATUS StatusInfoLengthMismatch = 0xC0000004L; namespace active_check { auto check_awesun_process() -> bool { auto dwPid = utils::GetProcessByName(L"AweSun.exe"); auto hwnd = FindWindow(L"FLUTTERVIEW", NULL); if (dwPid || hwnd) return true; return false; } auto check_todesk_process() -> bool { auto dwPid = utils::GetProcessByName(L"ToDesk.exe"); auto hwnd = FindWindow(NULL, L"ToDesk"); if (dwPid || hwnd) return true; return false; } auto check_asklink_process() -> bool { auto dwPid = utils::GetProcessByName(L"AskLink.exe"); auto hwnd = FindWindow(NULL, L"AskLink"); if (dwPid || hwnd) return true; return false; } auto check_uu_remote_process() -> bool { auto dwPid = utils::GetProcessByName(L"GameViewer.exe"); auto hwnd = FindWindow(NULL, L"ÍøÒ×UUÔ¶³Ì"); if (dwPid || hwnd) return true; return false; } auto check_remote_app_process() -> bool { if (check_awesun_process() || check_todesk_process() || check_asklink_process() || check_uu_remote_process()) { return true; } return false; } DWORD GetProcessIdFromHandle( HANDLE ProcessHandle ) { PROCESS_BASIC_INFORMATION_CUSTOM _ProcessBasicInformation{}; ULONG ReturnLength = 0; NTSTATUS Status = NtQueryInformationProcess( ProcessHandle, ProcessBasicInformation, &_ProcessBasicInformation, sizeof(_ProcessBasicInformation), &ReturnLength ); if (Status < 0) return 0; return _ProcessBasicInformation.UniqueProcessId; } auto ScanProcessHandles(DWORD CurrentProcessId, PROCESS_HANDLE_RESULTS* Results) -> BOOL { if (!Results) return FALSE; ZeroMemory( Results, sizeof(PROCESS_HANDLE_RESULTS) ); ULONG BufferSize = 1024 * 1024; ULONG ReturnLength = 0; PVOID Buffer = nullptr; NTSTATUS Status; while (true) { Buffer = HeapAlloc( GetProcessHeap(), HEAP_ZERO_MEMORY, BufferSize ); if (!Buffer) return FALSE; Status = NtQuerySystemInformation( SystemExtendedHandleInformation, Buffer, BufferSize, &ReturnLength ); if (Status != StatusInfoLengthMismatch) break; HeapFree(GetProcessHeap(), 0, Buffer); Buffer = nullptr; BufferSize = ReturnLength > BufferSize ? ReturnLength + 0x10000 : BufferSize * 2; } if (Status < 0) { HeapFree(GetProcessHeap(), 0, Buffer); return FALSE; } SYSTEM_HANDLE_INFORMATION_EX* HandleInformation = (SYSTEM_HANDLE_INFORMATION_EX*)Buffer; for (ULONG_PTR Index = 0; Index < HandleInformation->NumberOfHandles; ++Index) { SYSTEM_HANDLE_TABLE_ENTRY_INFO_EX* HandleEntry = &HandleInformation->Handles[Index]; auto OwnerProcessId = HandleEntry->UniqueProcessId; if (OwnerProcessId == CurrentProcessId) continue; HANDLE OwnerProcessHandle = OpenProcess(PROCESS_DUP_HANDLE, FALSE, OwnerProcessId); if (!OwnerProcessHandle) continue; HANDLE DuplicatedHandle = nullptr; BOOL DuplicateResult = DuplicateHandle( OwnerProcessHandle, (HANDLE)HandleEntry->HandleValue, GetCurrentProcess(), &DuplicatedHandle, 0, FALSE, DUPLICATE_SAME_ACCESS ); if (DuplicateResult) { auto TargetProcessId = GetProcessIdFromHandle(DuplicatedHandle); if (TargetProcessId == CurrentProcessId) { if (Results->Count < MAX_PROCESS_HANDLE_RESULTS) { auto Result = &Results->Items[Results->Count]; Result->ProcessId = OwnerProcessId; Result->TargetProcessId = TargetProcessId; Result->HandleValue = HandleEntry->HandleValue; Result->GrantedAccess = HandleEntry->GrantedAccess; utils::GetProcessName( OwnerProcessId, Result->ProcessName, sizeof(Result->ProcessName) ); Results->Count++; } } CloseHandle(DuplicatedHandle); } CloseHandle(OwnerProcessHandle); } HeapFree(GetProcessHeap(), 0, Buffer); return TRUE; } }