#include "Example.h" #include "resource.h" #include "CpuUsage.h" #include "r77def.h" #include extern "C" { #include "r77win.h" } int CALLBACK WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nCmdShow) { WCHAR executablePath[MAX_PATH + 1]; if (FAILED(GetModuleFileNameW(NULL, executablePath, MAX_PATH))) return 0; LPWSTR fileName = PathFindFileNameW(executablePath); WCHAR processId[100]; Int32ToStrW(GetCurrentProcessId(), processId); StrCpyW(Title, fileName); StrCatW(Title, L" (PID: "); StrCatW(Title, processId); StrCatW(Title, L")"); if (!StrCmpNIW(fileName, HIDE_PREFIX, HIDE_PREFIX_LENGTH)) { WindowWidth = 460; WindowHeight = 200; ShowWarningIcon = false; StrCpyW(Text, L"This executable's filename starts with \""); StrCatW(Text, HIDE_PREFIX); StrCatW(Text, L"\"\n\n"); StrCatW(Text, L" - A task manager that is injected with r77 will not display this process.\n"); StrCatW(Text, L" - File Explorer (or any other file browser) will not display this file.\n"); StrCatW(Text, L" - etc... (see documentation)"); } else { WindowWidth = 400; WindowHeight = 150; ShowWarningIcon = true; StrCpyW(Text, L"Rename this executable's file to start with \""); StrCatW(Text, HIDE_PREFIX); StrCatW(Text, L"\".\n"); StrCatW(Text, L"It will be hidden by r77."); } ULONG_PTR gdiToken; GdiplusStartupInput gdiInput; GdiplusStartup(&gdiToken, &gdiInput, NULL); WNDCLASSW wc = { }; wc.hInstance = hInstance; wc.lpszClassName = L"R77EXAMPLE"; wc.lpfnWndProc = WindowProc; RegisterClassW(&wc); Window = CreateWindowExW( WS_EX_DLGMODALFRAME, wc.lpszClassName, L"r77 Rootkit Example File", WS_OVERLAPPED | WS_CAPTION | WS_SYSMENU | WS_MINIMIZEBOX, CW_USEDEFAULT, CW_USEDEFAULT, WindowWidth, WindowHeight, NULL, NULL, hInstance, NULL ); if (Window == NULL) return 0; TextFont = CreateFontW(16, 0, 0, 0, FW_DONTCARE, FALSE, FALSE, FALSE, ANSI_CHARSET, OUT_TT_PRECIS, CLIP_DEFAULT_PRECIS, DEFAULT_QUALITY, DEFAULT_PITCH | FF_DONTCARE, L"Segoe UI"); TitleFont = CreateFontW(26, 0, 0, 0, FW_DONTCARE, FALSE, FALSE, FALSE, ANSI_CHARSET, OUT_TT_PRECIS, CLIP_DEFAULT_PRECIS, DEFAULT_QUALITY, DEFAULT_PITCH | FF_DONTCARE, L"Segoe UI"); WhiteBrush = CreateSolidBrush(RGB(255, 255, 255)); LightGrayBrush = CreateSolidBrush(RGB(240, 240, 240)); LogoImage = GetImageResource(IDB_EXAMPLE32, "PNG"); HelpImage = GetImageResource(IDB_HELP16, "PNG"); WarningImage = GetImageResource(IDB_WARNING16, "PNG"); RECT windowRect = { 0, 0, WindowWidth, WindowHeight }; AdjustWindowRect(&windowRect, GetWindowLongW(Window, GWL_STYLE), FALSE); SetWindowPos(Window, NULL, 0, 0, windowRect.right - windowRect.left, windowRect.bottom - windowRect.top, SWP_NOMOVE); SetClassLongPtrW(Window, GCLP_HBRBACKGROUND, (LONG_PTR)WhiteBrush); ShowWindow(Window, nCmdShow); CpuUsageComboBox = CreateWindowW(WC_COMBOBOXW, NULL, WS_TABSTOP | WS_CHILD | WS_VISIBLE | CBS_DROPDOWNLIST, 15, WindowHeight - 35, 120, 23, Window, NULL, hInstance, NULL); SendMessageW(CpuUsageComboBox, WM_SETFONT, (WPARAM)TextFont, TRUE); SendMessageW(CpuUsageComboBox, CB_ADDSTRING, 0, (LPARAM)L"CPU Usage: 0%"); SendMessageW(CpuUsageComboBox, CB_ADDSTRING, 0, (LPARAM)L"CPU Usage: 25%"); SendMessageW(CpuUsageComboBox, CB_ADDSTRING, 0, (LPARAM)L"CPU Usage: 50%"); SendMessageW(CpuUsageComboBox, CB_ADDSTRING, 0, (LPARAM)L"CPU Usage: 75%"); SendMessageW(CpuUsageComboBox, CB_ADDSTRING, 0, (LPARAM)L"CPU Usage: 100%"); SendMessageW(CpuUsageComboBox, CB_SETCURSEL, 0, 0); HelpButton = CreateWindowW(WC_STATICW, NULL, WS_CHILD | WS_VISIBLE | SS_BITMAP | SS_NOTIFY | SS_CENTERIMAGE, 140, WindowHeight - 35, 23, 23, Window, (HMENU)1, hInstance, NULL); SendMessageW(HelpButton, STM_SETIMAGE, IMAGE_BITMAP, (LPARAM)HelpImage); CloseButton = CreateWindowW(WC_BUTTONW, L"Close", WS_TABSTOP | WS_CHILD | WS_VISIBLE | BS_DEFPUSHBUTTON, WindowWidth - 90, WindowHeight - 35, 75, 23, Window, NULL, hInstance, NULL); SendMessageW(CloseButton, WM_SETFONT, (WPARAM)TextFont, TRUE); InitializeCpuUsage(); MSG msg; while (GetMessageW(&msg, NULL, 0, 0)) { if (!IsDialogMessageW(Window, &msg)) { TranslateMessage(&msg); DispatchMessageW(&msg); } } UninitializeCpuUsage(); GdiplusShutdown(gdiToken); return 0; } LRESULT CALLBACK WindowProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) { switch (msg) { case WM_PAINT: { PAINTSTRUCT ps; HDC hdc = BeginPaint(hwnd, &ps); SetBkMode(hdc, TRANSPARENT); HDC hdcMem = CreateCompatibleDC(hdc); BITMAP bitmap; // Window logo HBITMAP oldBitmap = (HBITMAP)SelectObject(hdcMem, LogoImage); GetObject(LogoImage, sizeof(bitmap), &bitmap); BitBlt(hdc, 20, 20, bitmap.bmWidth, bitmap.bmHeight, hdcMem, 0, 0, SRCCOPY); // Title HFONT oldFont = (HFONT)SelectObject(hdc, TitleFont); SetTextColor(hdc, RGB(0, 102, 204)); TextOutW(hdc, 60, 20, Title, lstrlenW(Title)); // Warning icon if (ShowWarningIcon) { SelectObject(hdcMem, WarningImage); GetObject(WarningImage, sizeof(bitmap), &bitmap); BitBlt(hdc, 60, 60, bitmap.bmWidth, bitmap.bmHeight, hdcMem, 0, 0, SRCCOPY); } // Text RECT rect; if (ShowWarningIcon) { rect = { 85, 60, WindowWidth - 45, WindowHeight - 50 }; } else { rect = { 60, 60, WindowWidth - 20, WindowHeight - 50 }; } SelectObject(hdc, TextFont); SetTextColor(hdc, RGB(0, 0, 0)); DrawTextW(hdc, Text, -1, &rect, DT_LEFT | DT_TOP | DT_WORDBREAK); // Button row background rect = { 0, WindowHeight - 45, WindowWidth, WindowHeight }; FillRect(hdc, &rect, LightGrayBrush); SelectObject(hdc, oldFont); SelectObject(hdcMem, oldBitmap); DeleteDC(hdcMem); EndPaint(hwnd, &ps); } break; case WM_COMMAND: if (lParam == (LPARAM)CloseButton) { DestroyWindow(hwnd); } else if (lParam == (LPARAM)HelpButton) { MessageBoxW(hwnd, L"CPU usage is hidden by r77. To see the effect, increase CPU usage of this process.\n\nThis process is running with idle priority to not interrupt other tasks.", L"Help", MB_OK | MB_ICONINFORMATION); } else if (lParam == (LPARAM)CpuUsageComboBox && HIWORD(wParam) == CBN_SELCHANGE) { switch ((int)SendMessageW(CpuUsageComboBox, CB_GETCURSEL, 0, 0)) { case 0: SetCpuUsage(0); break; case 1: SetCpuUsage(25); break; case 2: SetCpuUsage(50); break; case 3: SetCpuUsage(75); break; case 4: SetCpuUsage(100); break; default: throw; } } break; case WM_SETCURSOR: if ((HWND)wParam == HelpButton) { SetCursor(LoadCursorW(NULL, IDC_HAND)); return TRUE; } else { SetCursor(LoadCursorW(NULL, IDC_ARROW)); return TRUE; } case WM_DESTROY: PostQuitMessage(0); break; default: return DefWindowProcW(hwnd, msg, wParam, lParam); } return 0; } HBITMAP GetImageResource(DWORD resourceID, LPCSTR type) { LPBYTE resourceData; DWORD resourceSize; if (GetResource(resourceID, type, &resourceData, &resourceSize)) { return CreateImage(resourceData, resourceSize); } return NULL; } HBITMAP CreateImage(LPCBYTE data, DWORD size) { HBITMAP result = NULL; IStream *imageStream = SHCreateMemStream(data, size); if (imageStream) { Bitmap *bitmap = new Bitmap(imageStream); if (bitmap->GetHBITMAP(Color::Transparent, &result) != Ok) { result = NULL; } delete bitmap; imageStream->Release(); } return result; }