// IncrediBuildReset.cpp : Implementation of WinMain


// Note: Proxy/Stub Information
//      To build a separate proxy/stub DLL, 
//      run nmake -f crackibps.mk in the project directory.

#include "stdafx.h"
#include "drvmgr.h"

CComModule _Module;

BEGIN_OBJECT_MAP(ObjectMap)
END_OBJECT_MAP()

EXTERN_C void GetIncrediBuildLicKey(LPTSTR lpszKey, UINT cchMax);
BOOL CrackIncrediBuild(void);
BOOL EnableDebugPrivilege(void);

//SvrName RegItem VerionKey VerionValue
//IncrediBuild_Coordinator Coordinator VersionText 3.60 Beta (build 1163)
//IncrediBuild_Agent Builder VersionText 3.60 Beta (build 1163)
const static TCHAR szCoordinatorSvrName[] = _T("IncrediBuild_Coordinator");
const static TCHAR szAgentSvrName[] = _T("IncrediBuild_Agent");
const static TCHAR szCoordinatorVerionKey[] = _T("SOFTWARE\\Xoreax\\IncrediBuild\\Coordinator");
const static TCHAR szAgentVerionKey[] = _T("SOFTWARE\\Xoreax\\IncrediBuild\\Builder");

TCHAR g_szErrorDesc[MAX_PATH*10] = { 0 };

EXTERN_C DWORD LogLastError()
{
	DWORD dwResult = 0;
	RtlZeroMemory(g_szErrorDesc, sizeof(g_szErrorDesc));
	dwResult = FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_MAX_WIDTH_MASK, 
		NULL, GetLastError(), MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), 
		g_szErrorDesc, _countof(g_szErrorDesc), NULL
		);
	if (dwResult == 0)
	{
		lstrcpy(g_szErrorDesc, _T("Error number not found."));
	}
	return dwResult;
}
/////////////////////////////////////////////////////////////////////////////
//
extern "C" int WINAPI _tWinMain(HINSTANCE hInstance, 
    HINSTANCE /*hPrevInstance*/, LPTSTR lpCmdLine, int /*nShowCmd*/)
{
    lpCmdLine = GetCommandLine(); //this line necessary for _ATL_MIN_CRT

#if _WIN32_WINNT >= 0x0400 & defined(_ATL_FREE_THREADED)
    HRESULT hRes = CoInitializeEx(NULL, COINIT_MULTITHREADED);
#else
    HRESULT hRes = CoInitialize(NULL);
#endif
    _ASSERTE(SUCCEEDED(hRes));
    _Module.Init(ObjectMap, hInstance, NULL);

	BOOL bRunEveryWeek = FALSE; // 每周运行的静默模式
	BOOL bRunToInstall = FALSE; // 安装添加到计划任务里

	// 分析命令行
	TCHAR szRunToInstall[] = _T("install");
	TCHAR szRunEveryWeek[] = _T(" silent");
	int nRunEveryWeek = lstrlen(szRunEveryWeek);
	LPTSTR pszInstallCmd = NULL;
	int nCmdLine = lstrlen(lpCmdLine);
	if (nCmdLine > nRunEveryWeek)
	{
		pszInstallCmd = lpCmdLine+nCmdLine-nRunEveryWeek;
		if (!lstrcmpi(pszInstallCmd,szRunToInstall))
		{
			bRunToInstall = TRUE;
		}
		else if (!lstrcmpi(pszInstallCmd,szRunEveryWeek))
		{
			bRunEveryWeek = TRUE;
		}
	}

	// 获得权限
	if (!EnableDebugPrivilege())
	{
		if (!bRunEveryWeek)
		{
			MessageBox(NULL, _T("EnableDebugPrivilege Failed!!!"), _T("Warnning"), MB_OK);
		}
		goto crack_error;
	}

	// 判断是否存在服务
	if (!IsExistDriver(szCoordinatorSvrName) && !IsExistDriver(szAgentSvrName))
		goto crack_error;

	// 不是静默模式就停止两个服务
	if (!bRunEveryWeek && !(StopDriver(szCoordinatorSvrName) | StopDriver(szAgentSvrName)))
	{
		MessageBox(NULL, _T("The service IncrediBuild_Coordinator or IncrediBuild_Agent can't stop!!!"), _T("Warnning"), MB_OK);
		goto crack_error;
	}

	// 修改试用期
	if (CrackIncrediBuild())
	{
		if (!bRunEveryWeek)
		{
			MessageBox(NULL, _T("IncrediBuild Crack Successed!!!\n\nUsage:\n"
								"(install to run every monday 9:10) \n  IncrediBuildReset.exe install\n"
								"(run silently without restart IncrediBuild service) \n  IncrediBuildReset.exe silent"), _T("Warnning"), MB_OK);
		}
	}
	Sleep(2000);

	// 不是静默模式就启动两个服务
	if (!bRunEveryWeek && !(RunDriver(szCoordinatorSvrName) | RunDriver(szAgentSvrName)))
	{
		MessageBox(NULL, _T("The service IncrediBuild_Coordinator or IncrediBuild_Agent can't start!!!"), _T("Warnning"), MB_OK);
		goto crack_error;
	}

	// 安装添加到计划任务里
	if (!bRunEveryWeek && bRunToInstall)
	{
		TCHAR* pszCmdPath = _tgetenv(_T("ComSpec"));
		TCHAR szParam[] = _T("/c \"at 9:10 /every:m C:\\Windows\\IncrediBuildReset.exe silent\"");
		TCHAR szCopyToPath[] = _T("C:\\Windows\\IncrediBuildReset.exe");
		BOOL bCopyRet = FALSE;
		BOOL bInstallRet = FALSE;

		STARTUPINFO si;
		PROCESS_INFORMATION pi;
		ZeroMemory( &si, sizeof(si) );
		si.cb = sizeof(si);
		ZeroMemory( &pi, sizeof(pi) );
		si.wShowWindow=SW_HIDE; 
		si.dwFlags=STARTF_USESHOWWINDOW; 

		// 获取当前程序文件路径
		TCHAR szExePath[MAX_PATH] = {0};
		GetModuleFileName(NULL,szExePath,MAX_PATH);

		if (pszCmdPath && szExePath[0]!=_T('\0'))
		{
			// 复制到C:\Windows
			bCopyRet = CopyFile(szExePath,szCopyToPath,FALSE);
		}

		// 每周一9点10分执行一次
		if (bCopyRet)
		{
			//int nInstallRet = (int)ShellExecute(NULL,pszCmdPath,szParam,NULL,NULL,SW_HIDE);
			bInstallRet = CreateProcess(pszCmdPath,szParam,NULL,NULL,FALSE,0,NULL,NULL,&si,&pi);
			if (bInstallRet)
			{
				//WaitForSingleObject(pi.hProcess, INFINITE);
				CloseHandle(pi.hProcess);
				CloseHandle(pi.hThread);
			}
		}

		if (!bInstallRet)
		{
			LogLastError();
			MessageBox(NULL, g_szErrorDesc, _T("Error"), MB_OK);
			MessageBox(NULL, _T("IncrediBuildReset install Failed!!!"), _T("Warnning"), MB_OK);
		}
		else
		{
			MessageBox(NULL, _T("IncrediBuildReset install Successed!!!"), _T("Warnning"), MB_OK);
		}
	}

crack_error:

    _Module.Term();
    CoUninitialize();
    return 0;
}


struct  
{
    TCHAR * sVer;
    TCHAR * sKey;
} stBinInfo [] = {
    { _T("2.40"), _T("{E9B0227F-437C-4F7A-86D9-2676B83F359F}")},
    { _T("3.20"), _T("{B7348B5D-B65D-4BF5-AF63-A3135249ACA7}")},
    { _T("3.31"), _T("{6F8793A7-3226-4B51-98C1-476A0D1A7AFC}")},
	{ _T("3.40"), _T("{48C6296A-4F4C-4238-A9E1-60E9A544A863}")},
	{ _T("3.51"), _T("{B2DD5486-4922-42CC-A68E-C9069FFC3205}")},
	{ _T("3.60"), _T("{527750C4-E5A7-404C-AE2B-749D9718EA0B}")},
};

BOOL CrackIncrediBuild()
{
    TCHAR szTargetGuid[MAX_PATH] = { 0 };
    CRegKey key1;
	if (ERROR_SUCCESS != key1.Open(HKEY_LOCAL_MACHINE, szCoordinatorVerionKey) &&
		ERROR_SUCCESS != key1.Open(HKEY_LOCAL_MACHINE, szAgentVerionKey))
		return FALSE;

	TCHAR szVer[MAX_PATH] = {0};
	DWORD dwLen = _countof(szVer);
	if (ERROR_SUCCESS == key1.QueryValue(szVer, _T("VersionText"), &dwLen))
	{ 
		szVer[4] = 0;
		for (int i=0; i<_countof(stBinInfo); i++)
		{
			if (0 == lstrcmpi(szVer, stBinInfo[i].sVer))
			{
				lstrcpyn(szTargetGuid, stBinInfo[i].sKey, _countof(szTargetGuid));
				break;
			}
		}
	}

    if (0 == lstrlen(szTargetGuid))
        return FALSE;

    TCHAR szWrite[MAX_PATH] = { 0 };
    wsprintf(szWrite, _T("Interface\\%s\\ProxyStubClsid32"), szTargetGuid);
    
    CRegKey key2;
    if (ERROR_SUCCESS == key2.Open(HKEY_CLASSES_ROOT, szWrite))
	{
		TCHAR szOut[MAX_PATH] = { 0 };
		GetIncrediBuildLicKey(szOut, _countof(szOut));
        
		if (ERROR_SUCCESS == key2.SetValue(szOut, NULL))
		{
			return TRUE;
		}
	}
	return FALSE;
}


/*
IncrediBuild 

  2.40: HKCR\Interface\{E9B0227F-437C-4F7A-86D9-2676B83F359F}\ProxyStubClsid32 = {M1-M2-M3-T1-T2}
  3.20: HKCR\Interface\{B7348B5D-B65D-4BF5-AF63-A3135249ACA7}\ProxyStubClsid32 = {M1-M2-M3-T1-T2}
  3.31: HKCR\Interface\{6F8793A7-3226-4B51-98C1-476A0D1A7AFC}\ProxyStubClsid32
  3.40: HKCR\Interface\{48C6296A-4F4C-4238-A9E1-60E9A544A863}\ProxyStubClsid32 
  3.51: Interface\{B2DD5486-4922-42CC-A68E-C9069FFC3205}
  3.60b:Interface\{527750C4-E5A7-404C-AE2B-749D9718EA0B}
  
  此时 Date 的值是 39598.999988425923 (0x37BA E7FFDF55E340)
    
  T1 = 37BA
  T2 = E7FFDF55E340
  M1 = 37 * BA * E7 * FF = 23EAEB06
  M2 = DF * 55 = 4A0B
  M3 = E3 * 40 = 38C0
     
  这样我们就可以把注册表中上述键值改为：{23EAEB06-4A0B-38C0-37BA-E7FFDF55E340}
//*/
#define FILE_TIME_DAY ((__int64)24*60*60*10000000L)
EXTERN_C void GetIncrediBuildLicKey(LPTSTR lpszKey, UINT cchMax)
{
	BYTE guid[16];
	double d;
	__int64 n;
	FILETIME ft;
	FILETIME ft_1900;
	SYSTEMTIME st = {1899,12,0,30,0,0,0,0};
	int nTrialDays = 31;

	SystemTimeToFileTime(&st, &ft_1900);
	GetLocalTime(&st);
	SystemTimeToFileTime(&st, &ft);
	n = *(__int64*)&ft;
	n = n + nTrialDays*FILE_TIME_DAY;

	*(__int64*)&ft = n;
	FileTimeToSystemTime(&ft, &st);
	char *wday[]={"星期天","星期一","星期二","星期三","星期四","星期五","星期六"};
	ATLTRACE("New expiration date is %02d.%02d.%02d %s %02d:%02d:%02d, %d days left\n",st.wYear,st.wMonth,st.wDay,wday[st.wDayOfWeek],st.wHour,st.wMinute,st.wSecond,nTrialDays);
	
	// calculate number of days since 1900 (delphi 
	n = n - *(__int64*)&ft_1900;
	d = (double)(n / FILE_TIME_DAY);
	d += (double)(n % FILE_TIME_DAY) / FILE_TIME_DAY;

	// copy double into GUID
	memcpy(&guid[8], &d, 8);
	// calculate checksum
	*(DWORD*)&guid = guid[8] * guid[9] * guid[10] * guid[11];
	*(WORD*)&guid[4] = guid[12] * guid[13];
	*(WORD*)&guid[6] = guid[14] * guid[15];

	wsprintf(lpszKey, _T("{%08X-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}"), 
		*(DWORD*)&guid,*(WORD*)&guid[4],*(WORD*)&guid[6],
		guid[8],guid[9],guid[10],guid[11],
		guid[12],guid[13],guid[14],guid[15]
		);
	//ATLTRACE("%s\n",lpszKey);
}

BOOL EnableDebugPrivilege(void)
{
    HANDLE hProcess = NULL;
    HANDLE hToken = NULL;
    //LUID uID = {0};
    TOKEN_PRIVILEGES tp = {0};
    BOOL bResult = FALSE;

    do 
    {
        // 获取当前应用程序进程句柄
        hProcess = ::GetCurrentProcess();  
        
        // 打开当前进程的访问令牌句柄(OpenProcessToken函数调用失败返回值为零)
        if(!::OpenProcessToken(hProcess,TOKEN_ADJUST_PRIVILEGES| TOKEN_QUERY,&hToken))  
            break;
        
        //获取权限名称为"SeShutdownPrivilege"的LUID(LookupPrivilegeValue函数调用失败返回值为零)
        if(!::LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid))  
            break;
        
        tp.PrivilegeCount = 1;  //欲调整的权限个数
        // 权限的属性, SE_PRIVILEGE_ENABLED 为使能该权限
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;  
        
        // 调整访问令牌里的指定权限(AdjustTokenPrivileges函数调用失败返回值为零)
        if(!::AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof tp,NULL,NULL))  
            break;
        
        //查看权限是否调整成功
        if(::GetLastError() != ERROR_SUCCESS) {
            break;
        }

        bResult = TRUE;
    } while (FALSE);
    
    ::CloseHandle(hToken);
    return TRUE;
}