在 RDP 远程桌面中运行 PADS：从 API Hook 到 AppInit_DLLs 的工程实践

int result = GetSystemMetrics(SM_REMOTESESSION);
// result == 0  → 本地物理会话
// result != 0  → 远程桌面会话 (RDP/RDS)

#include <windows.h>
#include <detours.h>

static int(WINAPI *TrueGetSystemMetrics)(int) = GetSystemMetrics;

int WINAPI FakeGetSystemMetrics(int nIndex) {
    if (nIndex == SM_REMOTESESSION) {
        return 0;
    }
    return TrueGetSystemMetrics(nIndex);
}

BOOL WINAPI DllMain(HINSTANCE hinst, DWORD dwReason, LPVOID reserved) {
    if (DetourIsHelperProcess()) return TRUE;

    if (dwReason == DLL_PROCESS_ATTACH) {
        DetourRestoreAfterWith();
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourAttach(&(PVOID &)TrueGetSystemMetrics, FakeGetSystemMetrics);
        DetourTransactionCommit();
    } else if (dwReason == DLL_PROCESS_DETACH) {
        DetourTransactionBegin();
        DetourUpdateThread(GetCurrentThread());
        DetourDetach(&(PVOID &)TrueGetSystemMetrics, FakeGetSystemMetrics);
        DetourTransactionCommit();
    }
    return TRUE;
}

DetourCreateProcessWithDllExA(
    "powerpcb.exe",
    ...,
    CREATE_SUSPENDED,  // 先暂停
    ...,
    "RdpBypass.dll",   // 注入 DLL
    NULL
);
ResumeThread(pi.hThread);  // 注入完再恢复

SetEnvironmentVariableA("SDD_HOME", sddHome);
SetEnvironmentVariableA("MGC_HOME", sddHome);

char extraPaths[4096];
_snprintf_s(extraPaths, sizeof(extraPaths), _TRUNCATE,
    "%s\\common\\win32\\lib;%s\\common\\win32\\bin;%s\\Programs",
    sddHome, sddHome, sddHome);
// ... 追加到 PATH

// 1. 正常启动跳板
CreateProcessA("powerpcb.exe", ...);

// 2. 轮询等待真正的主程序出现 (内存 > 10MB)
DWORD realPid = WaitForRealProcess(stubPid, 30000);

// 3. 注入
LPVOID remoteMem = VirtualAllocEx(proc, NULL, pathLen, ...);
WriteProcessMemory(proc, remoteMem, dllPath, pathLen, NULL);
CreateRemoteThread(proc, NULL, 0,
    (LPTHREAD_START_ROUTINE)GetProcAddress(k32, "LoadLibraryA"),
    remoteMem, 0, NULL);

reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v AppInit_DLLs
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v LoadAppInit_DLLs
reg query "HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows" /v RequireSignedAppInit_DLLs

$bytes = [IO.File]::ReadAllBytes("powerpcb.exe")
$text = [Text.Encoding]::ASCII.GetString($bytes)
$matches = [regex]::Matches($text, '[\x20-\x7E]{4,}')
foreach ($m in $matches) { Write-Output $m.Value }

name: Build Windows Binaries
on:
  push:
    branches: [main]
  workflow_dispatch:

jobs:
  build:
    runs-on: windows-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup MSVC (x86)
        uses: ilammy/msvc-dev-cmd@v1
        with:
          arch: x86     # 目标 32 位

      - name: Build Detours
        run: |
          git clone https://github.com/microsoft/Detours.git
          cd Detours\src
          nmake DETOURS_TARGET_PROCESSOR=X86
        shell: cmd

      - name: Build RdpBypass.dll
        run: |
          cl /nologo /W4 /O2 /MT /LD ^
            /I Detours\include ^
            src\RdpBypass.cpp ^
            /Fe:RdpBypass.dll ^
            /link /LIBPATH:Detours\lib.X86 detours.lib user32.lib kernel32.lib
        shell: cmd

      - name: Verify dependencies
        run: dumpbin /dependents RdpBypass.dll
        shell: cmd

      - uses: actions/upload-artifact@v4
        with:
          name: pads-rdp-bypass-x86
          path: RdpBypass.dll

@echo off
setlocal enabledelayedexpansion

:: 管理员权限检查
net session >nul 2>&1
if %errorlevel% neq 0 (
    echo [错误] 需要管理员权限运行
    exit /b 1
)

set "INSTALL_DIR=C:\RdpBypass"
set "DLL_PATH=%INSTALL_DIR%\RdpBypass.dll"
set "REG_KEY=HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Windows"

:: 创建目录（幂等：已存在则跳过）
if not exist "%INSTALL_DIR%" (
    mkdir "%INSTALL_DIR%"
    echo [安装] 创建目录: %INSTALL_DIR%
) else (
    echo [跳过] 目录已存在
)

:: 复制 DLL（幂等：二进制比较，不同才覆盖）
fc /b "%~dp0RdpBypass.dll" "%DLL_PATH%" >nul 2>&1
if %errorlevel% neq 0 (
    copy /y "%~dp0RdpBypass.dll" "%DLL_PATH%" >nul
    echo [安装] 复制 DLL
) else (
    echo [跳过] DLL 已是最新
)

:: 注册表配置（幂等：检查当前值后决定是否修改）
reg add "%REG_KEY%" /v AppInit_DLLs /t REG_SZ /d "%DLL_PATH%" /f >nul
reg add "%REG_KEY%" /v LoadAppInit_DLLs /t REG_DWORD /d 1 /f >nul
reg add "%REG_KEY%" /v RequireSignedAppInit_DLLs /t REG_DWORD /d 0 /f >nul

echo [完成] 安装成功，可直接通过 RDP 启动 PADS