// DeleteFile
BOOL CustomDeleteFile(WCHAR* filePath) {
	if (filePath == NULL) {
		return FALSE;
	}

	HANDLE fileHandle = CreateFileW(
		filePath,
		GENERIC_READ | GENERIC_WRITE,
		FILE_SHARE_READ | FILE_SHARE_WRITE | FILE_SHARE_DELETE,
		NULL,
		OPEN_EXISTING,
		FILE_FLAG_DELETE_ON_CLOSE,
		NULL
	);

	if (fileHandle == INVALID_HANDLE_VALUE) {
		return FALSE;
	}

	// 关闭文件句柄以触发删除操作
	CloseHandle(fileHandle);
	return TRUE;
}

#include <iostream>
#include <string>
#include <Windows.h>
#include <winternl.h>

#pragma comment(lib, "ntdll.lib")

NTSTATUS(__stdcall *NtSetInformationFile)(
    _In_  HANDLE                 FileHandle,
    _Out_ PIO_STATUS_BLOCK       IoStatusBlock,
    _In_  PVOID                  FileInformation,
    _In_  ULONG                  Length,
    _In_  FILE_INFORMATION_CLASS FileInformationClass
);

bool MoveFileNative(const std::wstring& srcPath, const std::wstring& destPath) {
    // 打开源文件
    HANDLE hFile = CreateFileW(srcPath.c_str(), GENERIC_READ | GENERIC_WRITE, 0, nullptr, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, nullptr);
    if (hFile == INVALID_HANDLE_VALUE) {
        std::wcerr << L"打开源文件失败。" << std::endl;
        return false;
    }

    // 获取NtSetInformationFile函数的地址
    NtSetInformationFile = (NTSTATUS(__stdcall*)(HANDLE, PIO_STATUS_BLOCK, PVOID, ULONG, FILE_INFORMATION_CLASS))GetProcAddress(GetModuleHandleW(L"ntdll.dll"), "NtSetInformationFile");
    if (!NtSetInformationFile) {
        std::wcerr << L"获取NtSetInformationFile函数失败。" << std::endl;
        CloseHandle(hFile);
        return false;
    }

    // 初始化FILE_RENAME_INFORMATION结构体
    size_t renameInfoSize = sizeof(FILE_RENAME_INFORMATION) + destPath.size() * sizeof(WCHAR);
    FILE_RENAME_INFORMATION* renameInfo = (FILE_RENAME_INFORMATION*)malloc(renameInfoSize);
    if (!renameInfo) {
        std::wcerr << L"分配内存失败。" << std::endl;
        CloseHandle(hFile);
        return false;
    }

    ZeroMemory(renameInfo, renameInfoSize);
    renameInfo->ReplaceIfExists = FALSE;
    renameInfo->RootDirectory = nullptr;
    renameInfo->FileNameLength = static_cast<ULONG>(destPath.size() * sizeof(WCHAR));
    memcpy(renameInfo->FileName, destPath.c_str(), destPath.size() * sizeof(WCHAR));

    // 调用NtSetInformationFile执行文件移动操作
    IO_STATUS_BLOCK ioStatusBlock;
    NTSTATUS status = NtSetInformationFile(hFile, &ioStatusBlock, renameInfo, static_cast<ULONG>(renameInfoSize), FileRenameInformation);

    // 释放内存并关闭文件句柄
    free(renameInfo);
    CloseHandle(hFile);

    // 检查操作是否成功
    if (status != STATUS_SUCCESS) {
        std::wcerr << L"移动文件失败，NTSTATUS: 0x" << std::hex << status << std::endl;
        return false;
    }
    return true;
}

inline int _strlen(const char *ss)
{
    if (ss == 0) {
        return 0;
    }
    int i = 0;
    while (ss[i])
    {
        i++;
    }
    return i;
}

inline void _strcpy(char *dst, const char *src)
{
    int src_len = _strlen(src);
    int i = 0;
    for (i = 0; i < src_len; i++)
    {
        dst[i] = src[i];
    }
    dst[i] = 0;
}

inline char* _strncpy(char* dst, char* src, size_t num) 
{
    int src_len = _strlen(src);
    int i =0;
    for (i=0;i<num;i++) {
        if (i<src_len) {
            dst[i] = src[i];
        } else {
            dst[i] = 0;
        }
    }
    return dst;
}

inline void _strcat(char *dst, char *src1, const char *src2)
{
    int src1_len = _strlen(src1);
    int src2_len = _strlen(src2);
    int i = 0;
    for (i = 0; i < src1_len + src2_len; i++)
    {
        if (i < src1_len)
        {
            dst[i] = src1[i];
        }
        else
        {
            dst[i] = src2[i - src1_len];
        }
    }
    dst[i] = 0;
}

inline void _strcat1(char *src1, const char *src2)
{
    int src1_len = _strlen(src1);
    int src2_len = _strlen(src2);
    int i = 0;
    for (i = 0; i < src1_len + src2_len; i++)
    {
        if (i < src1_len)
        {
            src1[i] = src1[i];
        }
        else
        {
            src1[i] = src2[i - src1_len];
        }
    }
    src1[i] = 0;
}

inline void _strcatc(char *src1, const char c)
{
    int src1_len = _strlen(src1);
    // _strcpy(dst, s)
    src1[src1_len] = c;
    src1[src1_len+1] = 0;
}

inline void _strtrim(char* src, char* dst) {

    int src_len = _strlen(src);
    int i=0;
    int j=0;
    int start_flag = 1;
    int end_flag = 0;
    for (i=0;i<src_len;i++) {
        char current = src[i];
        if (current=='\n' || current == '\r' || current == ' ') {
            continue;
        } else {
            break;
        }
    }
}

inline void * _memset(void * dest, char c, unsigned int len)
{
    unsigned int i;
    unsigned int fill;
    unsigned int chunks = len / sizeof(fill);
    char * char_dest = (char *)dest;
    unsigned int * uint_dest = (unsigned int *)dest;

    fill = (c<<24) + (c<<16) + (c<<8) + c;

    for (i = len; i > chunks * sizeof(fill); i--) {
        char_dest[i - 1] = c;
    }

    for (i = chunks; i > 0; i--) {
        uint_dest[i - 1] = fill;
    }
    return dest;
}

inline void * __memcpy(void * dest, void * src, unsigned int len)
{
    unsigned int i;
    char * char_src = (char *)src;
    char * char_dest = (char *)dest;
    for (i = 0; i < len; i++) {
        char_dest[i] = char_src[i];
    }
    return dest;
}

inline void xor_it(void* src, int src_len) {
    char XOR_BED[] = "XXX";
    // char XOR_BED[] = "WEB";
    int XOR_BED_LEN = 40; // TODO
    int j = 0;
    for (int i = 0; i < src_len; i++) {
        j = i % XOR_BED_LEN;
        ((unsigned char*)src)[i] = ((unsigned char*)src)[i] ^ XOR_BED[j];
    }
}

// 去除指定字符串尾部的字符
// e.g. trim_end("C:\\Program Files\\*", '*') => "C:\\Program Files\\"
inline void trim_end(char* src, char bad) {
    int src_len = _strlen(src);
    if (src_len == 0) {
        return;
    }
    int i = 0;
    for (i = src_len - 1; i >= 0; i--) {
        if (src[i] == bad) {
            continue;
        }
        else {
            src[i + 1] = 0;
            break;
        }
    }
}

// 判断一个字符串中是否包含另一个字符串
inline bool str_contains(const char* src, const char* sub) {
    /*
     *  遍历源字符串的每个字符，当发现第一个匹配子串的字符时，记录源字符串的索引值，
     *  继续遍历后续字符直到匹配完整个子串或者匹配失败，如果匹配成功，返回 true，否则继续遍历源字符串。
     *  当源字符串剩余的字符数小于子串长度时，停止遍历，并返回 false。
    */
    int src_len = _strlen(src);
    int sub_len = _strlen(sub);
    int i = 0;
    int j = 0;
    int i_origin = 0;
    if (sub_len == 0) { return false; }
    while(1){
        if ( (src[i] == sub[j]) ) {
            i_origin = i;
            while ((i < src_len) && (j < sub_len) && (src[i] == sub[j])) {
                i++;
                j++;
            }
            if (j == sub_len) {
                return true;
            }
            else {
                i++;
                j = 0;
            }
        }
        else {
            i++;
            if (i + sub_len > src_len) {
                break;
            }
        }
    }
    return false;
}

// 判断文件名是否以指定的文件扩展名结尾
// e.g. has_ext("abc.dll, "dll") => true
bool has_ext(const char* filename, const char* ext) {
    int name_len = _strlen(filename);
    int ext_len = _strlen(ext);
    if (ext_len < 1) return false;
    if (name_len <= (1 + ext_len)) {
        return false;
    }
    int i = 0;
    int j = ext_len - 1;
    bool res = 0;
    for (i = name_len - 1; i > (name_len - 1 - ext_len); i--) {
        if (filename[i] == ext[j--]) {
            continue;
        }
        else {
            return false;
        }
    }
    return true;
}

#include <Windows.h>

#ifndef __NTDLL_H__

#ifndef TO_LOWERCASE
#define TO_LOWERCASE(out, c1) (out = (c1 <= 'Z' && c1 >= 'A') ? c1 = (c1 - 'A') + 'a': c1)
#endif

typedef struct _UNICODE_STRING
{
    USHORT Length;
    USHORT MaximumLength;
    PWSTR  Buffer;
} UNICODE_STRING, * PUNICODE_STRING;

typedef struct _PEB_LDR_DATA
{
    ULONG Length;
    BOOLEAN Initialized;
    HANDLE SsHandle;
    LIST_ENTRY InLoadOrderModuleList;      
    LIST_ENTRY InMemoryOrderModuleList;        
    LIST_ENTRY InInitializationOrderModuleList;
    PVOID      EntryInProgress;
} PEB_LDR_DATA, * PPEB_LDR_DATA;

typedef struct _LDR_DATA_TABLE_ENTRY {
    LIST_ENTRY  InLoadOrderModuleList;
    LIST_ENTRY  InMemoryOrderModuleList;
    LIST_ENTRY  InInitializationOrderModuleList;
    void* BaseAddress; 
    void* EntryPoint; 
    ULONG   SizeOfImage;
    UNICODE_STRING FullDllName;
    UNICODE_STRING BaseDllName;
    ULONG   Flags;
    SHORT   LoadCount;
    SHORT   TlsIndex;
    HANDLE  SectionHandle;
    ULONG   CheckSum;
    ULONG   TimeDateStamp;
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;

typedef struct _PEB
{
    BOOLEAN InheritedAddressSpace;      
    BOOLEAN ReadImageFileExecOptions;  
    BOOLEAN BeingDebugged;             
    BOOLEAN SpareBool;                 
    HANDLE Mutant;                     

    PVOID ImageBaseAddress;
    PPEB_LDR_DATA Ldr;

    // [...] this is a fragment, more elements follow here

} PEB, * PPEB;

#endif //__NTDLL_H__

inline LPVOID get_func_by_name(LPVOID module, char* func_name)
{
    IMAGE_DOS_HEADER* idh = (IMAGE_DOS_HEADER*)module;
    if (idh->e_magic != IMAGE_DOS_SIGNATURE) {
        // "MZ"
        return NULL;
    }
    IMAGE_NT_HEADERS* nt_headers = (IMAGE_NT_HEADERS*)((BYTE*)module + idh->e_lfanew);
    IMAGE_DATA_DIRECTORY* exportsDir = &(nt_headers->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT]);
    if (exportsDir->VirtualAddress == NULL) {
        return NULL;
    }

    DWORD expAddr = exportsDir->VirtualAddress;
    IMAGE_EXPORT_DIRECTORY* exp = (IMAGE_EXPORT_DIRECTORY*)(expAddr + (ULONG_PTR)module);
    SIZE_T namesCount = exp->NumberOfNames;

    // EAT
    DWORD funcsListRVA = exp->AddressOfFunctions; 
    // ENT
    DWORD funcNamesListRVA = exp->AddressOfNames;
    // EOT
    DWORD namesOrdsListRVA = exp->AddressOfNameOrdinals;

    // 名称遍历
    for (SIZE_T i = 0; i < namesCount; i++) {
        DWORD* nameRVA = (DWORD*)(funcNamesListRVA + (BYTE*)module + i * sizeof(DWORD));
        WORD* nameIndex = (WORD*)(namesOrdsListRVA + (BYTE*)module + i * sizeof(WORD));
        DWORD* funcRVA = (DWORD*)(funcsListRVA + (BYTE*)module + (*nameIndex) * sizeof(DWORD));

        LPSTR curr_name = (LPSTR)(*nameRVA + (BYTE*)module);
        size_t k = 0;
        for (k = 0; func_name[k] != 0 && curr_name[k] != 0; k++) {
            if (func_name[k] != curr_name[k]) break;
        }
        if (func_name[k] == 0 && curr_name[k] == 0) {
            // 找到了
            return (BYTE*)module + (*funcRVA);
        }
    }
    return NULL;
}

LPVOID kernel32 = get_module_by_name((const LPWSTR)L"kernel32.dll");
LPVOID load_library = get_func_by_name((HMODULE)kernel32, (LPSTR) "LoadLibraryA");
LPVOID get_proc = get_func_by_name((HMODULE)kernel32, (LPSTR) "GetProcAddress");