// Md5Test.cpp : Defines the class behaviors for the application.
// by king_koo@163.net	www.otiana.com/vcanlge

#include "stdafx.h"
#include "Md5Test.h"
#include "Md5TestDlg.h"
#include "md5.h"

#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif

/////////////////////////////////////////////////////////////////////////////
// CMd5TestApp

BEGIN_MESSAGE_MAP(CMd5TestApp, CWinApp)
	//{{AFX_MSG_MAP(CMd5TestApp)
		// NOTE - the ClassWizard will add and remove mapping macros here.
		//    DO NOT EDIT what you see in these blocks of generated code!
	//}}AFX_MSG
	ON_COMMAND(ID_HELP, CWinApp::OnHelp)
END_MESSAGE_MAP()

/////////////////////////////////////////////////////////////////////////////
// CMd5TestApp construction

CMd5TestApp::CMd5TestApp()
{
	// TODO: add construction code here,
	// Place all significant initialization in InitInstance
}

/////////////////////////////////////////////////////////////////////////////
// The one and only CMd5TestApp object

CMd5TestApp theApp;

/********************************************************
 功能 判斷pe文件資源校驗值是否被改變。
 參數 m_filename：	pe文件名
      Orgin：		預設校驗值
 返回 TRUE：		已被改變
      FALSE：		未曾改變
********************************************************/
BOOL IsRcChange(LPCTSTR m_filename,unsigned char Orgin[8])
{
	MD5_CTX context;
	FILE* ff;
	unsigned char buff[8];
	unsigned char *rbuff;
	DWORD i,j;
	short k;
	DWORD dwAddr,dwSize;
	_IMAGE_NT_HEADERS	stPEHeader;		//NT文件頭
	if(!(ff=fopen(m_filename,"rb")))return TRUE;
	fseek(ff,0x3c,SEEK_SET);//PE文件頭地址
	fread(&k,2,1,ff);
	fseek(ff,k,SEEK_SET);
	fread(&stPEHeader,1,sizeof(_IMAGE_NT_HEADERS),ff);
	for(i=0;(DWORD)i<stPEHeader.OptionalHeader.NumberOfRvaAndSizes;i++)//其實i=16
	{
		dwAddr=stPEHeader.OptionalHeader.DataDirectory[i].VirtualAddress;
		if(dwAddr&&i==2)//2為資源節
		{
			dwSize=stPEHeader.OptionalHeader.DataDirectory[i].Size;
			rbuff=new unsigned char[dwSize];
			fseek(ff,dwAddr,SEEK_SET);
			fread(rbuff,sizeof(char),dwSize,ff);
			j=dwSize/8;
			for(i=0;i<j;i++)
			{
				MD5Init(&context);//每次加密8byte
				MD5Update(&context, (unsigned char*)(rbuff+8*i),8);
				MD5Final(&context);
				memcpy(buff,(unsigned char*)context.state,8);
				if(i>j-2)break;
				for(k=0;k<8;k++)//把前面8byte加密結果和后8byte與或
					rbuff[8*i+8+k]=rbuff[8*i+8+k]^buff[k];
			}
			delete[] rbuff;
			fclose(ff);
			if(memcmp(Orgin,(unsigned char*)context.state,8))k=TRUE;
			else k=FALSE;
			memcpy(Orgin,(unsigned char*)context.state,8);//返回加密結果，便于調試
			return k;
		}
	}
	fclose(ff);
	return TRUE;
}

/////////////////////////////////////////////////////////////////////////////
// CMd5TestApp initialization

BOOL CMd5TestApp::InitInstance()
{
	AfxEnableControlContainer();

	// Standard initialization
	// If you are not using these features and wish to reduce the size
	//  of your final executable, you should remove from the following
	//  the specific initialization routines you do not need.

#ifdef _AFXDLL
	Enable3dControls();			// Call this when using MFC in a shared DLL
#else
	Enable3dControlsStatic();	// Call this when linking to MFC statically
#endif 

	char buff[255]={0};
	char szDB[512]={0};
	unsigned char buff8[8];
	memcpy(buff8,"\x8a\xe4\x6e\x63\xbd\xd2\x31\x84",8);
	GetModuleFileName(NULL,szDB,512);//取得exe文件名
	bIsRCChange=IsRcChange(szDB,buff8);
	sprintf(szDB,"%02x %02x %02x %02x %02x %02x %02x %02x",
		buff8[0],buff8[1],buff8[2],buff8[3],buff8[4],buff8[5],buff8[6],buff8[7]);
	if(bIsRCChange)
	{
		MessageBox(NULL,"    文件不完整,可能中毒了!\n請重新下載本程序!",szDB,MB_OK);
		return FALSE;
	}

	CMd5TestDlg dlg;
	m_pMainWnd = &dlg;
	int nResponse = dlg.DoModal();
	if (nResponse == IDOK)
	{
		// TODO: Place code here to handle when the dialog is
		//  dismissed with OK
	}
	else if (nResponse == IDCANCEL)
	{
		// TODO: Place code here to handle when the dialog is
		//  dismissed with Cancel
	}

	// Since the dialog has been closed, return FALSE so that we exit the
	//  application, rather than start the application's message pump.
	return FALSE;
}