void Scam_All(LPCTSTR szPath)
{
WIN32_FIND_DATA wfd;
HANDLE hFind;
CString sFullPath;
CString sFindFilter;
DWORD dwAttributes = 0;
sFindFilter = szPath;
sFindFilter += TEXT("\\*.*");
if ((hFind = FindFirstFile(sFindFilter, &wfd)) == INVALID_HANDLE_VALUE)
return;
do
{
if (_tcscmp(wfd.cFileName, TEXT(".")) == 0 ||
_tcscmp(wfd.cFileName, TEXT("..")) == 0)
{
continue;
}
//获取完整路径名
sFullPath = szPath;
sFullPath += TEXT("\\");
sFullPath += wfd.cFileName;
//如果当前路径是文件夹，则需要递归文件夹中的文件
if (wfd.dwFileAttributes&FILE_ATTRIBUTE_DIRECTORY)
{
Scam_All(sFullPath);
}
//否则，这是一个文件
else
{
//输出正在搜索的文件路径界面，让用户直观的看到正在扫描的文件路径
m_szStatus = _T("正在扫描 : ")+sFullPath;
SendMessage(WM_MYUPDATEDATA, FALSE);
//判断是否是病毒
if (IsMD5)
{
//MD5查杀
//如果是病毒 将文件信息保存到病毒Vector
if (MD5Scan(sFullPath))
{
//插入List中显示
m_List_Vir.InsertItem(0, wfd.cFileName); //文件名
m_List_Vir.SetItemText(0, 1, sFullPath); //文件路径
m_List_Vir.SetItemText(0, 2, //文件大小
GetShowSize(wfd.nFileSizeLow));
//保存病毒信息到Vector容器
VIRINFO VirInfo;
_tcscpy_s(VirInfo.szVirName, wfd.cFileName);
_tcscpy_s(VirInfo.szVirPath, sFullPath);
_tcscpy_s(VirInfo.szVirSize, GetShowSize(wfd.nFileSizeLow));
m_vecVirInfo.push_back(VirInfo);
}
}
else
{
//白名单查杀
//如果是病毒 将文件信息保存到病毒Vector
if (WhiteScan(sFullPath))
{
//插入List中显示
m_List_Vir.InsertItem(0, wfd.cFileName); //文件名
m_List_Vir.SetItemText(0, 1, sFullPath); //文件路径
m_List_Vir.SetItemText(0, 2, //文件大小
GetShowSize(wfd.nFileSizeLow));
//保存病毒信息到Vector容器
VIRINFO VirInfo;
_tcscpy_s(VirInfo.szVirName, wfd.cFileName);
_tcscpy_s(VirInfo.szVirPath, sFullPath);
_tcscpy_s(VirInfo.szVirSize, GetShowSize(wfd.nFileSizeLow));
m_vecVirInfo.push_back(VirInfo);
}
}
}
} while (FindNextFile(hFind, &wfd));
FindClose(hFind);
}
BOOL MD5Scan(LPCTSTR szPath)
{
//LPCTSTR 转CHAR*
int num = WideCharToMultiByte(CP_OEMCP, NULL, szPath, -1, NULL, 0, NULL, FALSE);
char *pchar = new char[num];
WideCharToMultiByte(CP_OEMCP, NULL, szPath, -1, pchar, num, NULL, FALSE);
//获取MD5值
char* md5 = md5FileValue(pchar);
//CHAR* 转LPCTSTR
num = MultiByteToWideChar(0, 0, md5, -1, NULL, 0);
wchar_t *wide = new wchar_t[num];
MultiByteToWideChar(0, 0, md5, -1, wide, num);
m_szMD5 = wide;
delete[]pchar;
delete[]wide;
//获取文件MD5信息完毕
//判断是本地查杀还是云端查杀
if (IsLocal)
{
//本地MD5查杀 与m_LocalMD5作对比
for (DWORD i = 0; i < m_LocalMD5.size();i++)
{
if (m_LocalMD5[i] == m_szMD5)
{
//是病毒 返回真
return TRUE;
}
}
}
else
{
//云端MD5查杀 与m_ServerMD5作对比
//本地MD5查杀 与m_LocalMD5作对比
for (DWORD i = 0; i < m_ServerMD5.size(); i++)
{
if (m_ServerMD5[i] == m_szMD5)
{
//是病毒 返回真
return TRUE;
}
}
}
return FALSE;
}
BOOL WhiteScan(LPCTSTR szPath)
{
//判断是本地查杀还是云端查杀
if (IsLocal)
{
//本地白名单查杀 与m_LocalWhite作对比
for (DWORD i = 0; i < m_LocalWhite.size(); i++)
{
if (m_LocalWhite[i] == szPath)
{
//是病毒 返回真
return FALSE;
}
}
}
else
{
//云端MD5查杀 与m_ServerWhite作对比
for (DWORD i = 0; i < m_ServerWhite.size(); i++)
{
if (m_ServerWhite[i] == szPath)
{
//是病毒 返回真
return FALSE;
}
}
}
return TRUE;
}
void DeleteVir()
{
//先判断病毒Vector是否为空，若为空，则提示没有可以清除的文件
if (m_vecVirInfo.size() == 0)
{
return;
}
//删除病毒
for (DWORD i = 0; i < m_vecVirInfo.size();i++)
{
DeleteFile(m_vecVirInfo[i].szVirPath);
}
m_vecVirInfo.clear();
m_List_Vir.DeleteAllItems();
m_szStatus = _T("病 毒 清 除 完 毕 !");
UpdateData(FALSE);
}
BOOL SHGetSpecialFolderPath(
HWND hwndOwner,
_Out_ LPTSTR lpszPath,
_In_ int csidl,
_In_ BOOL fCreate
);
VOID CleanRunHistory()
{
if (IsScanFile)
return; //如果是正在扫描垃圾文件，则直接返回，不进行清理操作。
SHDeleteKey(HKEY_CURRENT_USER,
TEXT("Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\RunMRU"));
}
BOOL WINAPI SetProcessWorkingSetSize(
_In_ HANDLE hProcess,
_In_ SIZE_T dwMinimumWorkingSetSize,
_In_ SIZE_T dwMaximumWorkingSetSize
);
BOOL WINAPI EmptyWorkingSet( _In_ HANDLE hProcess);
void ClearMemory()
{
HANDLE hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hProcessSnap == INVALID_HANDLE_VALUE)
{
return;
}
PROCESSENTRY32 ProcessInfo;
ProcessInfo.dwSize = sizeof(ProcessInfo);
int count = 0;
//获取系统中第一个进程的信息
BOOL Status = Process32First(hProcessSnap, &ProcessInfo);
while (Status)
{
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, TRUE,
ProcessInfo.th32ProcessID);
if (hProcess)
{
//设置进程工作区大小
SetProcessWorkingSetSize(hProcess, -1, -1);
//尽可能多的将指定进程的页面从工作区移除
EmptyWorkingSet(hProcess);
CloseHandle(hProcess);
}
//获取下一个进程的信息
Status = Process32Next(hProcessSnap, &ProcessInfo);
}
}
m_szStatus = _T("正在清理内存中... ...");
UpdateData(FALSE);
//获取清理前的内存信息
MEMORYSTATUSEX memStatus = { sizeof(MEMORYSTATUSEX) };
GlobalMemoryStatusEx(&memStatus);
DOUBLE preUsedMem = (DOUBLE)(memStatus.ullTotalPhys - memStatus.ullAvailPhys) / 1024 / 1024;
//开始清理内存
ClearMemory();
//获取清理后的内存信息
GlobalMemoryStatusEx(&memStatus);
DOUBLE afterUsedMem = (DOUBLE)(memStatus.ullTotalPhys - memStatus.ullAvailPhys) / 1024 / 1024;
//输出清理信息
m_szStatus.Format(_T("内存清理完毕！本次清理 : %.2f MB"), preUsedMem - afterUsedMem);
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
