控制台赋值工具seti.exe

/*
	THE VARIABLE SETTINGS TOOL, VERSION 1.0
	SETI.EXE
	COPYRIGHT@2016~2018 BY HAPPY
*/


#include <stdio.h>
#include <windows.h>
#include <ctype.h>
#include <math.h>
#include <tchar.h>
#include <tlhelp32.h>

//变量表尺寸
#define VAR_NAME_SIZE 1024
#define VAR_VALU_SIZE 4096

//可解释标签数量                         
#define LABEL_NUM 8
//添加标签小写定义,解释时不区分大小写。 
static const char* LABEL_WORDS[]={"(ascii)", "(calc)", "(color)", "(line", "(crc32)", "(md5)", "(sha1)", "(sha256)"};

//SetEnvironmentVariable函数
typedef BOOL (WINAPI *PFN_SetEnvironmentVariable)(LPCTSTR, LPCTSTR);

//存储结构体
typedef struct{
	DWORD funPTR;
	char NAME[VAR_NAME_SIZE];
	char VALU[VAR_VALU_SIZE];
}VAR_TABLE;

/*************辅助函数群*************/ 
//帮助信息
void HelpInfomation(int ExitCode)
{
		fputs(
			"VARIABLE SETTINGS TOOL, COPYRIGHT@2016~2018 BY HAPPY, VERSION 1.0\n"
			"-----------------------------------------------------------------------------\n"
			"seti [var]=(label)[value]\n"
			"-----------------------------------------------------------------------------\n"
			"     (ascii)   Assigns an ascii value to the variable\n"
			"     (calc)    Calculates the string's value and assigns it to the variable\n"
			"     (color)   Sets the console stdout color\n"
			"     (line[N]) Assigns a file's Nth line to the variable\n"
			"     (crc32)   Assigns string's crc32 value to the variable\n"
			"     (md5)     Assigns string's md5 value to the variable\n"
			"     (sha1)    Assigns string's sha1 value to the variable\n"
			"     (sha256)  Assigns string's sha256 value to the variable\n"
			"-----------------------------------------------------------------------------\n"
			"12/01/2016\n"
			,stdout
		);
		exit(ExitCode);
} 
//关键词解析函数
int Identify_KeyWords(const char* Line)
{
	int i, L, SN;
	for(SN=0; SN<LABEL_NUM; SN++){
		L=strlen(LABEL_WORDS[SN]);
		for(i=0; i < L; i++){
			if(
		 		Line[i]   !=LABEL_WORDS[SN][i] &&
		 		Line[i]+32!=LABEL_WORDS[SN][i]
		 		
			){break;}
		}
	 	if(i==L){return SN;}
	}				
	return 255;
}
//字体颜色: 1,2,4,8前景；16,32,64,128后景； 
int FontColor(unsigned short A)
{
	HANDLE handle_out = GetStdHandle(STD_OUTPUT_HANDLE);
	CONSOLE_SCREEN_BUFFER_INFO csbi;
	GetConsoleScreenBufferInfo(handle_out, &csbi);
	SetConsoleTextAttribute(handle_out, A);
	return 0;
}
//读文件流
char* FileStream(char* file, int lineNUM)
{
	FILE* fp;
	if( (fp=fopen(file, "rb"))==NULL ){
		fputs("Read file error.", stdout);
		exit(1);
	}
	int i=0;
	char* L=(char*)calloc(1025, sizeof(char));
	while(!feof(fp)){
		memset(L, 0,  1024*sizeof(char));
		fgets(L, 1024, fp);
		i++;
		if(i==lineNUM){break;}
	}
	fclose(fp);
	return L;
}
//子串替换
char *tmp_ExpressionA;
void Strrpl(char* str,char* x, char* y){
	char *n=NULL;
	tmp_ExpressionA=(char*)calloc(4096, sizeof(char));
	int i=0; 
	while((n =strstr(str,x)) !=0){
		if(n-str !=0){
			memcpy(&tmp_ExpressionA[i], str, n-str);
		}
		memcpy(&tmp_ExpressionA[i+n-str], y, strlen(y));		
		i+=n-str+strlen(y);		
		strcpy(str, n+strlen(x));
	}
	strcat(tmp_ExpressionA, str);
	strcpy(str, tmp_ExpressionA);
}
//表达式计算
#include "Lib\DataCalc\calcuexp.c"
char* CalculateExpression(char* str)
{
	Strrpl(str,"pi","3.141592653589");	
	Strrpl(str,"arcsinh","*A");
	Strrpl(str,"arccosh","*B");
	Strrpl(str,"arctanh","*C");
	Strrpl(str,"arcsin","*D");
	Strrpl(str,"arccos","*E");
	Strrpl(str,"arctan","*F");
	Strrpl(str,"round","*G");
	Strrpl(str,"floor","*H");
	Strrpl(str,"ceil","*I");
	Strrpl(str,"sqrt","*J");
	Strrpl(str,"deg","*K");
	Strrpl(str,"sinh","*L");
	Strrpl(str,"cosh","*M");
	Strrpl(str,"tanh","*N");
	Strrpl(str,"lg","*O");
	Strrpl(str,"ln","*P");
	Strrpl(str,"sin","*Q");
	Strrpl(str,"cos","*R");
	Strrpl(str,"tan","*S");
	Strrpl(str,"//","T");
	Strrpl(str,"fac","Z");
	Strrpl(str,"e","2.718281828489");
	double ans;
	const char *cur_pos = str;
	char *result=(char*)calloc(64, sizeof(char));
	status_t ret = do_calculate(&cur_pos, &ans);

	if(ret ==0){
		if (ans > 1e8 || IS_DOUBLE_ZERO(ans - (int)ans)){
			sprintf(result, "%.12g\0", ans);
		}else{
			sprintf(result, "%.12f\0", ans);
		}
		return result;
	}
	fputs("Error calculate\n", stdout);
	exit(1);
}
////////////////////////////////////////////crc32
#include "Lib/DataCalc/Crc32Calc.h"
#include "Lib/DataCalc/Crc32Calc.c"
Crc32Calc c1;
char* crc32(char* Buf){
	int x, y, z;
	char* result=(char*)calloc(64, sizeof(char));;
	Crc32Calc_init(&c1);
	Crc32Calc_reset(&c1);
	Crc32Calc_calculate(&c1,Buf, strlen(Buf));
	sprintf(result, "%x\0", c1.Value );
	Crc32Calc_uninit(&c1);
	return result;
}
////////////////////////////////////////////md5
#include "Lib/DataCalc/Md5Calc.h"
#include "Lib/DataCalc/Md5Calc.c"
char Buf[256]={0};
Md5Calc m5;
char* md5(char* TestStr){
	void* op;
	char* result=(char*)calloc(128, sizeof(char));
	SZ_T w,x,y,z,e;
	SZ_T f = 0;
	Md5Calc_init(&m5);
	Md5Calc_reset(&m5);
	Md5Calc_calculate( &m5, TestStr, strlen( TestStr));
	sprintf(result, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\0" ,( SZ_UCHAR )( m5.Value[0]),( SZ_UCHAR )( m5.Value[1]),( SZ_UCHAR )( m5.Value[2]),( SZ_UCHAR )( m5.Value[3]),( SZ_UCHAR )( m5.Value[4]),( SZ_UCHAR )( m5.Value[5]),( SZ_UCHAR )( m5.Value[6]),( SZ_UCHAR )( m5.Value[7]),( SZ_UCHAR )( m5.Value[8]),( SZ_UCHAR )( m5.Value[9]),( SZ_UCHAR )( m5.Value[10]),( SZ_UCHAR )( m5.Value[11]),( SZ_UCHAR )( m5.Value[12]),( SZ_UCHAR )( m5.Value[13]),( SZ_UCHAR )( m5.Value[14]),( SZ_UCHAR )( m5.Value[15]) );
	Md5Calc_uninit( &m5 );
	return result;
}
////////////////////////////////////////////sha1
#include "Lib/DataCalc/Sha1Calc.h"
#include "Lib/DataCalc/Sha1Calc.c"
char *abuf;
Sha1Calc s1;
char* sha1(char* TestStr){
	abuf=(char*)calloc(1000000,sizeof(char));
	char* result=(char*)calloc(128, sizeof(char));
	void* op;
	SZ_T w,x,y,z,e;
	SZ_T f=0; 
	for(x=0; x<1000000; x++){abuf[x]='a';}
	Sha1Calc_reset(&s1);
	Sha1Calc_calculate(&s1,TestStr,strlen(TestStr));
	sprintf(result, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\0", (SZ_UCHAR)(s1.Value[0]), (SZ_UCHAR)(s1.Value[1]), (SZ_UCHAR)(s1.Value[2]), (SZ_UCHAR)(s1.Value[3]), (SZ_UCHAR)(s1.Value[4]), (SZ_UCHAR)(s1.Value[5]), (SZ_UCHAR)(s1.Value[6]), (SZ_UCHAR)(s1.Value[7]), (SZ_UCHAR)(s1.Value[8]), (SZ_UCHAR)(s1.Value[9]), (SZ_UCHAR)(s1.Value[10]), (SZ_UCHAR)(s1.Value[11]), (SZ_UCHAR)(s1.Value[12]), (SZ_UCHAR)(s1.Value[13]), (SZ_UCHAR)(s1.Value[14]), (SZ_UCHAR)(s1.Value[15]), (SZ_UCHAR)(s1.Value[16]), (SZ_UCHAR)(s1.Value[17]), (SZ_UCHAR)(s1.Value[18]), (SZ_UCHAR)(s1.Value[19]) );
	Sha1Calc_uninit(&s1);
	return result;
}
////////////////////////////////////////////sha256
#include "Lib/DataCalc/Sha256Calc.h"
#include "Lib/DataCalc/Sha256Calc.c"
Sha256Calc s2;
char* sha256(char* TestStr){
	char* result=(char*)calloc(128, sizeof(char));
	void* op;
	SZ_T w,x,y,z,e;
	SZ_T f=0;
	abuf=(char*)calloc(1000000, sizeof(char));
	Sha256Calc_reset(&s2);
	Sha256Calc_calculate(&s2,TestStr,strlen(TestStr));
	sprintf(result, "%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x%02x\0", (SZ_UCHAR)(s2.Value[0]), (SZ_UCHAR)(s2.Value[1]), (SZ_UCHAR)(s2.Value[2]), (SZ_UCHAR)(s2.Value[3]), (SZ_UCHAR)(s2.Value[4]), (SZ_UCHAR)(s2.Value[5]), (SZ_UCHAR)(s2.Value[6]), (SZ_UCHAR)(s2.Value[7]), (SZ_UCHAR)(s2.Value[8]), (SZ_UCHAR)(s2.Value[9]), (SZ_UCHAR)(s2.Value[10]), (SZ_UCHAR)(s2.Value[11]), (SZ_UCHAR)(s2.Value[12]), (SZ_UCHAR)(s2.Value[13]), (SZ_UCHAR)(s2.Value[14]), (SZ_UCHAR)(s2.Value[15]), (SZ_UCHAR)(s2.Value[16]), (SZ_UCHAR)(s2.Value[17]), (SZ_UCHAR)(s2.Value[18]), (SZ_UCHAR)(s2.Value[19]), (SZ_UCHAR)(s2.Value[20]), (SZ_UCHAR)(s2.Value[21]), (SZ_UCHAR)(s2.Value[22]), (SZ_UCHAR)(s2.Value[23]), (SZ_UCHAR)(s2.Value[24]), (SZ_UCHAR)(s2.Value[25]), (SZ_UCHAR)(s2.Value[26]), (SZ_UCHAR)(s2.Value[27]), (SZ_UCHAR)(s2.Value[28]), (SZ_UCHAR)(s2.Value[29]), (SZ_UCHAR)(s2.Value[30]), (SZ_UCHAR)(s2.Value[31]) );
	Sha256Calc_uninit(&s2);
	free(abuf);
	return result;
}
//获取当前PID
DWORD GetCurrentPID()
{
	DWORD pid=GetCurrentProcessId();
	DWORD ppid = (DWORD)(-1);
	HANDLE hProcessSnap;
	PROCESSENTRY32 pe32;

	hProcessSnap = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
	if(hProcessSnap ==INVALID_HANDLE_VALUE){fputs("Get PID error.", stdout);exit(1);}

	pe32.dwSize = sizeof( PROCESSENTRY32 );
	BOOL bResult = Process32First( hProcessSnap, &pe32 );
	if(bResult ==FALSE){fputs("Get PID error.", stdout);exit(1);}

	do{
		if (pid == pe32.th32ProcessID)
		{
			ppid = pe32.th32ParentProcessID;
			break;
		}

	} while( Process32Next( hProcessSnap, &pe32 ) );

	CloseHandle( hProcessSnap );
	return( ppid );
}
//提升DEBUG权限
BOOL EnableDebugPrivilege(BOOL bEnable)
{
	HANDLE hToken;
	BOOL R=FALSE;
	if (OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken)){   
		TOKEN_PRIVILEGES tp;  
		tp.PrivilegeCount =1;  
		LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid);  
		tp.Privileges[0].Attributes = bEnable ? SE_PRIVILEGE_ENABLED : 0;  
		AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);  
		R =(GetLastError()==ERROR_SUCCESS);  
		CloseHandle(hToken);   
	}   
	return R;   
}

/*************业务函数群*************/
//SetEnvironmentVariable函数入口
DWORD WINAPI threadProc(LPVOID lpParam)
{
	VAR_TABLE *pRP=(VAR_TABLE*)lpParam;
	PFN_SetEnvironmentVariable pfnSetEnvironmentVariable =(PFN_SetEnvironmentVariable)pRP->funPTR;
	pfnSetEnvironmentVariable(pRP->NAME, pRP->VALU);
	return 0;
}
//线程注入函数
int Inject(const char* vNAME, const char* vValu)
{
	EnableDebugPrivilege(TRUE);
	DWORD DW_PID =GetCurrentPID();
	if(DW_PID ==(DWORD)(-1)){fputs("Inject error.", stdout);exit(1);}

	HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS, FALSE, DW_PID);
	if(hProcess ==NULL){fputs("Inject error.", stdout);exit(1);}

	DWORD DW_MEM_SIZE=4096;
	LPVOID pRemoteThread =VirtualAllocEx(hProcess, 0, DW_MEM_SIZE, MEM_COMMIT, PAGE_EXECUTE_READWRITE) ; 
	if(pRemoteThread ==NULL){fputs("Inject error.", stdout);exit(1);}

	BOOL bResult =WriteProcessMemory(hProcess, pRemoteThread, threadProc, DW_MEM_SIZE, NULL);
	if(bResult ==FALSE){fputs("Inject error.", stdout);exit(1);}

	VAR_TABLE var={0};
	HMODULE hKernel32 =LoadLibrary("Kernel32.dll");

	//获取SetEnvironmentVariableA函数入口地址
	var.funPTR=(DWORD)GetProcAddress(hKernel32, "SetEnvironmentVariableA");

	//赋值变量表
	strcpy(var.NAME, (char*)vNAME);
	strcpy(var.VALU, (char*)vValu);

	DW_MEM_SIZE=sizeof(var);
	LPVOID pRemoteParam =VirtualAllocEx(hProcess, 0, DW_MEM_SIZE, MEM_COMMIT, PAGE_READWRITE);
	if(pRemoteParam ==NULL){fputs("Inject error.", stdout);exit(1);}
	bResult=WriteProcessMemory(hProcess, pRemoteParam, &var.funPTR, DW_MEM_SIZE, NULL);
	if(bResult ==FALSE){fputs("Inject error.", stdout);exit(1);}
	
	HANDLE hRemoteThread=CreateRemoteThread(hProcess, NULL, 0, pRemoteThread, pRemoteParam, 0, NULL); 
	if(hRemoteThread ==FALSE){fputs("Inject error.", stdout);exit(1);}
	CloseHandle(hRemoteThread);
	CloseHandle(hProcess);
	return 0;
}

/*************主函数入口*************/ 
int main(int argc, char** argv) 
{
	//参数不足则退出 并抛出说明 
	if(argc==1){HelpInfomation(1);}
	
	//取得缓存区命令行 
	LPSTR Line=GetCommandLineA()+strlen(argv[0]);
	
	//过滤行TAB缩进或前空格
	while(*Line=='\t'|| *Line==' '){Line++;}

	//根据等号切分出变量名和变量赋值表达式
	char* vNAME=strtok(Line, "=");
	char* vValu=strtok(NULL, "=");
	if(vValu==NULL){HelpInfomation(1);}

	//过滤赋值表达式TAB缩进或前空格
	while(*vValu=='\t'|| *vValu==' '){vValu++;}

	//如赋值表达式为空则抛出使用说明
	if(vValu==NULL){HelpInfomation(1);}

	//设置行号
	int lineNUM=0;

	//解析标签
	int SN=Identify_KeyWords(vValu);
	switch(SN){
	case 0:
		vValu[0]=atoi(vValu+strlen(LABEL_WORDS[SN]))%128;
		vValu[1]=0x00;
		Inject(vNAME, vValu);
		break;
	case 1:
		vValu=CalculateExpression(vValu+strlen(LABEL_WORDS[SN]));
		Inject(vNAME, CalculateExpression(vValu));
		break;
	case 2:
		FontColor(atoi(vValu+strlen(LABEL_WORDS[SN])));
		break;
	case 3:
		vValu=vValu+strlen(LABEL_WORDS[SN]);
		lineNUM=atoi(vValu);
		strtok(vValu, ")");
		Inject(vNAME, FileStream(strtok(NULL, ")"), lineNUM));
		break;
	case 4:
		vValu=vValu+strlen(LABEL_WORDS[SN]);
		Inject(vNAME, crc32(vValu));
		break;
	case 5:
		vValu=vValu+strlen(LABEL_WORDS[SN]);
		Inject(vNAME, md5(vValu));
		break;
	case 6:
		vValu=vValu+strlen(LABEL_WORDS[SN]);
		Inject(vNAME, sha1(vValu));
		break;
	case 7:
		vValu=vValu+strlen(LABEL_WORDS[SN]);
		vValu=sha256(vValu);
		Inject(vNAME, vValu);
		break;
	default:
		fputs("Error label\n", stdout);
		return 1;
	}
	return 0;
}
复制代码

@echo off&setlocal enabledelayedexpansion&title seti演示脚本
set REM=echo

!REM!;
!REM! 将第1行赋值给变量L
seti L=(line1)%~f0&echo;!L!
!REM! 将STDOUT颜色赋值为15，即&seti STDOUT=(color)12&!REM!;改变输出缓存区&seti STDOUT=(color)15&!REM!;字体颜色
!REM!;
!REM! 将ASCII值07赋值给变量bell
seti bell=(ascii)07
!REM!;
!REM! 计算数学表达式的值并赋值给变量result
seti result=(calc)5*(arctan(cos(sin(ln(lg(2.71828))))))&echo;!result!
!REM!;
!REM! 对函数式的支持
set/a "x=1, y=2, z=3"
seti fun(%x%, %y%, %z%)=(calc)5*(arctan(cos(sin(ln(lg(%z%))))))+%x%+%y%&echo;!fun(1, 2, 3)!
!REM!;
!REM! 对超长算式的支持
seti result=(calc)5tan5lnlge+6pi*tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge+lnpi+6pi*tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge/lnpi+6pi-tanpi+arcsin0.75+sin0.75+lge+lnpi//2+5tan5lnlge+6pi*tanpi+arcsin0.75*tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge+lnpi+6pi*tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75+lge/lnpi+6pi-tanpi+arcsin0.75+sin0.75+lge+lnpi//2+5tan5lnlge+6pi*tanpi+arcsin0.75*tanpi+arcsin0.75+lge+lnpi+6pi-tanpi+arcsin0.75&echo;!result!
!REM!;
 REM hash赋值，支持crc32、md5、sh1、sha256等四种散列值
!REM! 对password做md5加密，并赋值给变量m
seti m=(md5)password&echo;!m!
!REM!;
pause
复制代码