#include <Windows.h>
#include "stdafx.h"
#include "ILHook.h"
#include "vmpsdk.h"
#include <shellapi.h>
#include <Shlwapi.h>
#include <time.h>
#include <string>
#include "CAnyHook.h"
#include <fstream>

using namespace std;
#pragma(lib,"shell32.lib")
#pragma comment(lib,"shlwapi.lib")
CILHook HookGetVersion;
CILHook HookCreateWindowEx;
CILHook HookSetTimer;

typedef unsigned char byte;
void enableDebuggerPrivileges()
{
	
	HANDLE tokenHandle;
	OpenProcessToken(GetCurrentProcess(), 40, &tokenHandle);
	TOKEN_PRIVILEGES token_privileges = { 0 };
	token_privileges.PrivilegeCount = 1;
	token_privileges.Privileges->Attributes = 2;
	LookupPrivilegeValueA(NULL, "SeDebugPrivilege", &token_privileges.Privileges->Luid);;
	AdjustTokenPrivileges(tokenHandle, false, &token_privileges, sizeof(token_privileges), NULL, false);

}

void MakeHook(DWORD CurAddr,DWORD TargetAddr)
{
	byte JmpCode[5]={0xe9};
	*((DWORD*)&JmpCode[1])=TargetAddr-CurAddr-5;
	DWORD dwOldProtect=0;
	VirtualProtect((LPVOID)CurAddr,5,PAGE_EXECUTE_READWRITE,&dwOldProtect);
	memcpy((LPVOID)CurAddr,JmpCode,5);

}



void MakeCall(DWORD CurAddr,DWORD TargetAddr)
{
	byte JmpCode[5]={0xe8};
	*((DWORD*)&JmpCode[1])=TargetAddr-CurAddr-5;
	DWORD dwOldProtect=0;
	VirtualProtect((LPVOID)CurAddr,5,PAGE_EXECUTE_READWRITE,&dwOldProtect);
	memcpy((LPVOID)CurAddr,JmpCode,5);

}



char* eText(char * str)
{
	int len = strlen(str);
	if (len == 0)
		return NULL;
	char* lpE =(char*) malloc(len + 1);
	memset(lpE, 0, len + 1);
	memcpy(lpE, str, len);
	return lpE;
}
byte bOrg =0xe9;
DWORD patchAddr1 = 0x006C6399;
byte patchData1[] = {
		0xb8, 0x01, 0x00, 0x00, 0x00 };
DWORD patchAddr2 = 0x006C6F36;
byte patchData2[] = {
		0xb8, 0x01, 0x00, 0x00, 0x00 };
DWORD patchAddr3=0x006A5474;
byte patchData3[] = {
		0xb8, 0x00, 0x00, 0x00, 0x00 };
DWORD patchAddr4=0x006A5495;
byte patchData4[]= {
		0xb8, 0x01, 0x00, 0x00, 0x00 };
DWORD patchAddr5=0x00607608;
byte patchData5[] = "SQL+Access数据库编缉器V7.61 联系QQ：258428265";
DWORD patchAddr6=0x0062C8AB;
byte patchData6[] = "搜索查找功能(联系QQ：258428265)";
DWORD patchAddr7= 0x403CD0;
byte patchData7[] = "联系QQ：258428265";
DWORD patchAddr8=0x00A68141;
byte patchData8[]= {
		0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
DWORD patchAddr9= 0x004BE757;
byte patchData9[]= { 0xeb };
DWORD patchAddr10=0x00BE29D1;
byte patchData10[]= { 0xeb };
DWORD patchAddr11=0xBF91F1;
byte patchData11[]= { 0xeb };
DWORD patchAddr12=0x94D482;
byte patchData12[]= { 0xeb };
DWORD patchAddr13= 0x9BB324;
byte patchData13[]= { 0xeb };
DWORD patchAddr14= 0xB66DD9;
byte patchData14[]= { 0xeb };
DWORD patchAddr15= 0xB790A9;
byte patchData15[]= { 0xeb };
DWORD patchAddr16 = 0xB5FA89;
byte patchData16[] = { 0xeb };
DWORD patchAddr17 = 0x0059C470;
byte patchData17[] = { 0xeb };
DWORD patchAddr18 = 0x00C0ED56;
byte patchData18[] = { 0xeb };
DWORD patchAddr19 = 0x0094D4D9;
byte patchData19[] = { 0xeb };
DWORD patchAddr20 = 0x00BF9248;
byte patchData20[] = { 0xeb };
DWORD patchAddr21 = 0x00C14CCE;
byte patchData21[] = { 0xeb };
DWORD patchAddr22 = 0x00C0C378;
byte patchData22[] = { 0xeb };
DWORD patchAddr23 = 0x00C16855;
byte patchData23[] = { 0xeb };
DWORD patchAddr24 = 0x00C710E6;
byte patchData24[] = { 0xeb };
DWORD patchAddr25 = 0x00CA01C5;
byte patchData25[] = { 0xeb };
DWORD patchAddr26 = 0x00CB37F2;
byte patchData26[] = { 0xeb };
DWORD patchAddr27 = 0x0087ABAA;
byte patchData27[] = { 0xeb };
DWORD patchAddr28 = 0x0096CB6A;
byte patchData28[] = { 0xeb };
DWORD patchAddr29 = 0x00978D13;
byte patchData29[] = { 0xeb };
DWORD patchAddr30 = 0x009BB380;
byte patchData30[] = { 0xeb };
DWORD patchAddr31=0x00B9443D;
byte patchData31[] = { 0xeb };
DWORD patchAddr32=0x00CA020F;
byte patchData32[] = { 0xeb };
//DWORD patchAddr3=0x00BD6235;
//byte patchData3[] = { 0xeb };
void writeData(DWORD patchAddr, LPVOID patchData, DWORD patchSize)
{
	DWORD oldProtect = 0;
	VirtualProtect((LPVOID)patchAddr, patchSize, PAGE_EXECUTE_READWRITE, &oldProtect);
	memcpy((LPVOID)patchAddr, patchData, patchSize);
}

char* WINAPI get_token(int a1,int a2)
{
	return eText("{\"data\":{\"username\":\"diy\",\"uid\":81,\"group_id\":3,\"token\":\"b3a4e7a82b9ce573c8b4d5ad0b2936e0\"},\"code\":1,\"message\":\"success\"}");
}

CAnyHook hook1;
typedef char* (WINAPI netapi)(char** param);
netapi* netapi1 = (netapi*)patchAddr1;


void WINAPI outInfo(char* str)
{
	ofstream ofs("data.txt",ios_base::app);
	ofs << str<<endl;
}

char* WINAPI My_GetData(long index)
{
	//AfxMessageBox("getdata被调用");
	if (index == 0x009896AA)
	{
		return eText("37");
	}
	if (index == 0x009896AC)
	{
		return eText("黑科技联盟    v: z55227777");
	}if (index == 0x0098970F)
	{
		return eText("http://d1.gutousoft.com/GTQQRQKJDZPLZS.htm");
	}if (index == 0x00989710)
	{
		return eText("[2019-05-23]点赞与为QQ大号增加人气，复制人气QQ号必备软件，免费打码支持！");
	}
	
		
	if (index == 10000054)
	{
		return NULL;//公告2？
	}
	if (index == 0)
	{
		return "1";
	}
	else if (index == 1)
	{
		return "TXGuiFoundation|DzTXZv";
	}
	else if (index == 2)
	{
		return "TXGuiFoundation|DzTXZv";
	}
	else if (index == 3)
	{
		return "61";
	}
	else if (index == 4)
	{
		return " ";
	}
	else if (index == 5)
	{
		return "999999999";
	}
	else if (index == 6)
	{
		return "http://us1.fwwz.com/qqrobot/Upgrade.gz/";
	}
	else if (index == 7)
	{
		return  "1";
	}
	else if (index == 8)
	{
		return  "44";
	}
	else if (index == 9)
	{
		return "http://auth.tygem.org/kss_api/io.php?a=uplog&apiver=905&c=0&gdata=0&softcode=1000004";
	}
	else if (index == 10)
	{
		return "9999.0";
	}
	else if (index == 11)
	{
		return "1428853125";
	}
	else if (index == 12)
	{
		return "0";
	}
	else if (index == 13)
	{
		return "老鬼";
	}
	else if (index == 14)
	{
		return "1";
	}
	else if (index == 15)
	{
		return "http://vip.zhong123.net";
	}
	else if (index == 16)
	{
		return "0";
	}
	else if (index == 17)
	{
		return "VIP";
	}
	else if (index == 18)
	{
		return "0";
	}
	else if (index == 19)
	{
		return "1";
	}
	else if (index == 20)
	{

	}
	return "扰乱市场销售价的代理们注意封号风险。低价购买有风险。";

}

char* WINAPI get_data(char** a1)
{
	string str = *a1;
	if (str.compare("v_get_key")==0)
	{
		return eText("mp.dayu.com");
	}else
	{
		return nullptr;
	}
	
}

char* get_Rtcode()
{
	return eText("|20542056235520232220202020202020272829535352562227292256552651242254272653235555|56222923205222545527285323282351282455562351542552555454532255545523522355242754|55242354545428252020562551562056275295AC5CA13");
}

char* get_exp()
{
	return eText("2099-12-26 23:04:17");
}
void patch()
{
	 // MakeHook(0x00470225, (DWORD)My_GetData);
	MakeCall(0x006C6B50,(DWORD) get_Rtcode);
	MakeCall(0x006C668C,(DWORD) get_exp);
	
     writeData(patchAddr1,patchData1,sizeof(patchData1));
	 //MakeHook(0x0041D504, (DWORD)My_GetData);
	writeData(patchAddr2,patchData2,sizeof(patchData2));	
	 writeData(patchAddr3, patchData3, sizeof(patchData3));
	writeData(patchAddr4, patchData4, sizeof(patchData4));
	writeData(patchAddr5, patchData5, sizeof(patchData5));
	writeData(patchAddr6, patchData6, sizeof(patchData6));
	writeData(patchAddr7, patchData7, sizeof(patchData7));
	// writeData(patchAddr8, patchData8, sizeof(patchData8));
	// writeData(patchAddr9, patchData9, sizeof(patchData9));
	// writeData(patchAddr10, patchData10, sizeof(patchData10));
	// writeData(patchAddr11, patchData11, sizeof(patchData11));
	// writeData(patchAddr12, patchData12, sizeof(patchData12));
	// writeData(patchAddr13, patchData13, sizeof(patchData13));
	// writeData(patchAddr14, patchData14, sizeof(patchData14));
	// writeData(patchAddr15, patchData15, sizeof(patchData15));
	// writeData(patchAddr16, patchData16, sizeof(patchData16));
	// writeData(patchAddr17, patchData17, sizeof(patchData17));
	// writeData(patchAddr18, patchData18, sizeof(patchData18));
	// writeData(patchAddr19, patchData19, sizeof(patchData19));
	// writeData(patchAddr20, patchData20, sizeof(patchData20));
	// writeData(patchAddr21, patchData21, sizeof(patchData21));
	// writeData(patchAddr22, patchData22, sizeof(patchData22));
	// writeData(patchAddr23, patchData23, sizeof(patchData23));
	// writeData(patchAddr24, patchData24, sizeof(patchData24));
	// writeData(patchAddr25, patchData25, sizeof(patchData25));
	// writeData(patchAddr26, patchData26, sizeof(patchData26));
	// writeData(patchAddr27, patchData27, sizeof(patchData27));
	// writeData(patchAddr28, patchData28, sizeof(patchData28));
	// writeData(patchAddr29, patchData29, sizeof(patchData29));
	// writeData(patchAddr30, patchData30, sizeof(patchData30));
	// writeData(patchAddr31, patchData31, sizeof(patchData31));
	// writeData(patchAddr32, patchData32, sizeof(patchData32));
}




HWND WINAPI MyCreateWindowExW(          DWORD dwExStyle,
					LPWSTR lpClassName,
					LPWSTR lpWindowName,
					DWORD dwStyle,
					int x,
					int y,
					int nWidth,
					int nHeight,
					HWND hWndParent,
					HMENU hMenu,
					HINSTANCE hInstance,
					LPVOID lpParam
					)
{

	HookCreateWindowEx.UnHook();
	
	HWND hwnd=CreateWindowExW(dwExStyle,lpClassName,lpWindowName,dwStyle,x,y,nWidth,nHeight,hWndParent,hMenu,hInstance,lpParam);
	DWORD dwOrigin=0;

	// DWORD base =(DWORD) GetModuleHandleA("HZX3981.dll");
	// patchAddr1 = base + 0x2b2ea;
	if (IsBadReadPtr((LPVOID)patchAddr1,1))
	{
		return hwnd;
	}

	if (*(byte*)patchAddr1==bOrg)
	{
		//LoadLibraryA("patch.dll");
		//MakeHook(patchAddr1,(DWORD)MyInit);
		//CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)patch, nullptr, 0, NULL);
		patch();
		return hwnd;
	}
	HookCreateWindowEx.ReHook();
	return hwnd;
}

void deleteSe()
{
	SHDeleteKey(HKEY_CURRENT_USER, TEXT("Software\\Classes\\Interface\\{C6680AAC-C1DA-C66C-CF10-C4227DE20C53}"));
	SHDeleteKey(HKEY_CURRENT_USER, TEXT("Software\\Classes\\Wow6432Node\\Interface\\{C6680AAC-C1DA-C66C-CF10-C4227DE20C53}"));
	SHDeleteKeyA(HKEY_CLASSES_ROOT, "Wow6432Node\\Interface\\{C6680AAC-C1DA-C66C-CF10-C4227DE20C53}");
	SHDeleteKeyA(HKEY_CLASSES_ROOT, "Interface\\{C6680AAC-C1DA-C66C-CF10-C4227DE20C53}");
}