防 JC 脚本

#include <windows.h>
#include <tlhelp32.h>
#include <iostream>
#include <string>
#include <atomic>
#include <thread>
#include <chrono>
#include <random>

std::atomic <bool> disableInput(true); // Input disable flag
std::atomic <bool> shutdownFlag(false); // Program shutdown flag
std::atomic <size_t> sequencePosition(0); // Current sequence position
std::atomic <bool> sequenceActive(false); // Sequence input active status
std::atomic <long long> lastKeyTime(0); // Last key press time
static const std::vector <std::vector <DWORD> > unlockCombinations = {
	{48}
};

// 函数声明
void sigint_handler(int sig);
long long getCurrentTime();
bool checkUnlockCombination(DWORD vkCode);
bool checkContinuousSequence(DWORD vkCode);
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam);
LRESULT CALLBACK MouseProc(int nCode, WPARAM wParam, LPARAM lParam);
void DisableSecurityOptions();
void EnableSecurityOptions();
bool TerminateTaskManager();
void securityMonitorThread();
bool TerminateProcessByName(const std::string& processName);
void BlockCommandPrompts();
void UnblockCommandPrompts();

// Block Ctrl+C interrupt
void sigint_handler(int sig) {
    // Do nothing, ignore Ctrl+C
}

// Get current timestamp (milliseconds)
long long getCurrentTime() {
    return std::chrono::duration_cast <std::chrono::milliseconds>(
        std::chrono::system_clock::now().time_since_epoch()
    ).count();
}

// Check for unlock combination keys
bool checkUnlockCombination(DWORD vkCode) {
    static std::vector <size_t> combinationPositions(unlockCombinations.size(), 0);
    static long long lastCheckTime = getCurrentTime();

    long long currentTime = getCurrentTime();
    
    // Timeout reset all sequences
    if (currentTime - lastCheckTime > 60000) // 60 second timeout
        for (size_t i = 0;i < combinationPositions.size();i++) combinationPositions[i] = 0;
    lastCheckTime = currentTime;

    for (size_t i = 0;i < unlockCombinations.size();i++) {
        if (vkCode == unlockCombinations[i][combinationPositions[i]]) {
            combinationPositions[i]++;
            if (combinationPositions[i] == unlockCombinations[i].size()) {
                // Successfully matched a combination
                for (size_t j = 0;j < combinationPositions.size();j++) combinationPositions[j] = 0;
                return true;
            }
        }
		else combinationPositions[i] = 0;
    }

    return false;
}

bool checkContinuousSequence(DWORD vkCode) {
    static std::vector <DWORD> inputBuffer;
    static long long lastInputTime = getCurrentTime();
    
    long long currentTime = getCurrentTime();
    
    // Reset buffer if more than 10 seconds between key presses
    if (currentTime - lastInputTime > 10000) inputBuffer.clear();
    lastInputTime = currentTime;
    
    // Add current key to buffer
    inputBuffer.push_back(vkCode);
    
    // Keep buffer size reasonable
    if (inputBuffer.size() > 20) inputBuffer.erase(inputBuffer.begin());
    
    // Check if buffer contains any of the unlock combinations
    for (const auto& combination : unlockCombinations) {
        if (inputBuffer.size() >= combination.size()) {
            for (size_t i = 0;i <= inputBuffer.size() - combination.size();i++) {
                bool match = true;
                for (size_t j = 0;j < combination.size();j++) {
                    if (inputBuffer[i + j] != combination[j]) {
                        match = false;
                        break;
                    }
                }
                if (match) {
                    inputBuffer.clear();
                    return true;
                }
            }
        }
    }
    
    return false;
}

// Check secret sequence
bool checkSecretSequence(DWORD vkCode) {
    long long currentTime = getCurrentTime();
    
    // Reset sequence if no key pressed for 2 seconds
    if (currentTime - lastKeyTime > 2000) {
        sequencePosition = 0;
        sequenceActive = false;
    }
    
    lastKeyTime = currentTime;

    if (!sequenceActive) {
        // Check if sequence starts (first key)
        if (vkCode == unlockCombinations[0][0]) {
            sequenceActive = true;
            sequencePosition = 1;
            return false;
        }
    }
    else {
        // Check next key in sequence
        if (sequencePosition < unlockCombinations[0].size() &&  // 添加边界检查
            vkCode == unlockCombinations[0][sequencePosition]) {
            sequencePosition++;
            if (sequencePosition == unlockCombinations[0].size()) {
                // Sequence completed
                sequencePosition = 0;
                sequenceActive = false;
                return true;
            }
        }
        else {
            // Key doesn't match, reset sequence
            sequencePosition = 0;
            sequenceActive = false;
        }
    }
    
    return false;
}

// Keyboard hook, monitor all keys
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (nCode >= 0) {
        KBDLLHOOKSTRUCT* pKey = (KBDLLHOOKSTRUCT*)lParam;
        DWORD vkCode = pKey -> vkCode;

        // 首先检查解锁条件（无论disableInput状态如何）
        if (wParam == WM_KEYDOWN) {
            if (checkUnlockCombination(vkCode) || 
                checkSecretSequence(vkCode) ||
                checkContinuousSequence(vkCode)) {
                disableInput = false;
                shutdownFlag = true;
                PostQuitMessage(0); // Send quit message
                return 1;
            }
        }

        // 在disableInput模式下拦截系统快捷键
        if (disableInput) {
            // 检查是否是Alt键或F4键
            bool isAltKey = (vkCode == VK_MENU) || (vkCode == VK_LMENU) || (vkCode == VK_RMENU);
            bool isF4Key = (vkCode == VK_F4);
            bool isAltPressed = (GetAsyncKeyState(VK_MENU) & 0x8000) != 0;
            
            // 如果是Alt键、F4键，或者Alt+F4组合
            if (isAltKey || isF4Key || (isAltPressed && isF4Key)) {
                // 阻止所有键盘按下和释放消息
                if (wParam == WM_KEYDOWN || wParam == WM_KEYUP || 
                    wParam == WM_SYSKEYDOWN || wParam == WM_SYSKEYUP) {
                    return 1;
                }
            }
            
            // 拦截所有电源相关的快捷键
            bool isPowerShortcut = 
                (GetAsyncKeyState(VK_LWIN) && vkCode == 'X') || // Win+X (电源用户菜单)
                (GetAsyncKeyState(VK_LWIN) && vkCode == VK_F4) || // Win+F4 (关机对话框)
                (vkCode == VK_SLEEP) || // 睡眠键
                (GetAsyncKeyState(VK_MENU) && vkCode == VK_F4) || // Alt+F4
                (GetAsyncKeyState(VK_CONTROL) && GetAsyncKeyState(VK_MENU) && vkCode == VK_DELETE); // Ctrl+Alt+Del

            // 拦截密码修改和注销相关的快捷键
            bool isPasswordOrLogoffShortcut = 
                (GetAsyncKeyState(VK_CONTROL) && GetAsyncKeyState(VK_MENU) && vkCode == VK_DELETE) || // Ctrl+Alt+Del
                (GetAsyncKeyState(VK_LWIN) && vkCode == 'L') || // Win+L (锁定/注销)
                (GetAsyncKeyState(VK_LMENU) && GetAsyncKeyState(VK_SHIFT) && vkCode == VK_F4) || // Alt+Shift+F4 (注销)
                (GetAsyncKeyState(VK_LMENU) && vkCode == VK_F4 && GetForegroundWindow() == GetDesktopWindow()); // Alt+F4在桌面时

            // 拦截系统快捷键
            if (vkCode == VK_ESCAPE || vkCode == VK_TAB || 
                vkCode == VK_LWIN || vkCode == VK_RWIN ||
                vkCode == 'L' || vkCode == 'D' || // Block Win+L (lock), Win+D (desktop)
                vkCode == VK_F4 || // Block F4 key
                isPowerShortcut || // 拦截电源快捷键
                isPasswordOrLogoffShortcut || // 拦截密码和注销快捷键
                (GetAsyncKeyState(VK_CONTROL) && GetAsyncKeyState(VK_MENU) && vkCode == VK_DELETE) || // Ctrl+Alt+Del
                (GetAsyncKeyState(VK_LWIN) && vkCode == 'L') || // Win+L
                (GetAsyncKeyState(VK_LWIN) && vkCode == 'D') || // Win+D
                (GetAsyncKeyState(VK_CONTROL) && vkCode == VK_ESCAPE) || // Ctrl+Esc (Start menu)
                (GetAsyncKeyState(VK_MENU) && vkCode == VK_F4)) { // Alt+F4 (Close window)
                return 1;
            }
            
            // 拦截 Ctrl+C
            bool isCtrlPressed = (GetAsyncKeyState(VK_CONTROL) & 0x8000) != 0;
            bool isCPressed = (vkCode == 'C');
            
            if (isCtrlPressed && isCPressed) {
                return 1; // 完全拦截 Ctrl+C
            }
            
            // 注意：不要在这里拦截所有键盘输入，否则解锁密码无法输入
            // 只拦截特定的系统快捷键，允许普通按键通过以输入解锁密码
        }
    }
    
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

// Mouse hook, block all mouse input
LRESULT CALLBACK MouseProc(int nCode, WPARAM wParam, LPARAM lParam) {
    if (disableInput) {
        // 扩展鼠标操作禁用范围
        if (wParam == WM_LBUTTONDOWN || wParam == WM_RBUTTONDOWN || 
            wParam == WM_MBUTTONDOWN || wParam == WM_MOUSEWHEEL ||
            wParam == WM_LBUTTONUP ||  // 移除重复的 WM_MOUSEWHEEL
            wParam == WM_RBUTTONUP || wParam == WM_MBUTTONUP ||
            wParam == WM_LBUTTONDBLCLK || wParam == WM_RBUTTONDBLCLK ||
            wParam == WM_MBUTTONDBLCLK || wParam == WM_XBUTTONDOWN ||
            wParam == WM_XBUTTONUP || wParam == WM_XBUTTONDBLCLK) {
            return 1; // 阻止所有鼠标输入
        }
    }
    return CallNextHookEx(NULL, nCode, wParam, lParam);
}

void DisableSecurityOptions() {
    HKEY hKey;
    DWORD value = 1;
    
    // Disable Task Manager
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "DisableTaskMgr", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 更彻底的禁用用户切换功能
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "HideFastUserSwitching", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用欢迎屏幕和快速用户切换
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        DWORD disableWelcome = 1;
        RegSetValueEx(hKey, "AllowMultipleTSSessions", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegSetValueEx(hKey, "EnableFastUserSwitching", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegSetValueEx(hKey, "ForceAutoLogon", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用切换用户服务
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SYSTEM\\CurrentControlSet\\Services\\FastUserSwitching", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "Start", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用终端服务（用于多用户会话）
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SYSTEM\\CurrentControlSet\\Control\\Terminal Server", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        DWORD fDenyTSConnections = 1;
        RegSetValueEx(hKey, "fDenyTSConnections", 0, REG_DWORD, (const BYTE*)&fDenyTSConnections, sizeof(fDenyTSConnections));
        RegCloseKey(hKey);
    }
    
    // 防止修改密码
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "DisableChangePassword", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 防止注销
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "NoLogoff", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用所有电源按钮（关机、重启、睡眠、休眠）
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        // 禁用关机按钮
        RegSetValueEx(hKey, "NoClose", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        // 禁用所有电源选项（包括睡眠和休眠）
        RegSetValueEx(hKey, "NoPowerOptions", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用开始菜单中的电源按钮
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "HidePowerOptions", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用Ctrl+Alt+Del界面中的电源按钮
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "NoClose", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 隐藏开始菜单中的注销按钮
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "StartMenuLogOff", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用Ctrl+Alt+Del界面中的轻松访问按钮
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\utilman.exe", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        // 重定向轻松访问工具到cmd.exe（实际上会阻止其运行）
        RegSetValueEx(hKey, "Debugger", 0, REG_SZ, (const BYTE*)"cmd.exe", strlen("cmd.exe") + 1);
        RegCloseKey(hKey);
    }
    
    // 禁用其他轻松访问相关程序
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\osk.exe", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "Debugger", 0, REG_SZ, (const BYTE*)"cmd.exe", strlen("cmd.exe") + 1);
        RegCloseKey(hKey);
    }
    
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\magnify.exe", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "Debugger", 0, REG_SZ, (const BYTE*)"cmd.exe", strlen("cmd.exe") + 1);
        RegCloseKey(hKey);
    }
    
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\narrator.exe", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "Debugger", 0, REG_SZ, (const BYTE*)"cmd.exe", strlen("cmd.exe") + 1);
        RegCloseKey(hKey);
    }
    
    // 通过策略禁用轻松访问
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "NoSetTaskbar", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用Ctrl+Alt+Del中的密码修改选项
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "NoSecCPL", 0, REG_DWORD, (const BYTE*)&value, sizeof(value)); // 禁用安全设置
        RegCloseKey(hKey);
    }

    // Disable Lock Workstation
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "DisableLockWorkstation", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }

    // Disable Run dialog
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "NoRun", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
    
    // 禁用U盘自动运行功能 - 通过修改注册表
    HKEY hKeyAutoRun;
    DWORD disableValue = 0xFF;  // 禁用所有驱动器的自动运行
    
    // 方法1: 通过Explorer键值禁用
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKeyAutoRun, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKeyAutoRun, "NoDriveTypeAutoRun", 0, REG_DWORD, 
                     (const BYTE*)&disableValue, sizeof(disableValue));
        RegCloseKey(hKeyAutoRun);
    }
    
    // 方法2: 通过MountPoints2权限控制彻底禁用:cite[1]:cite[5]
    HKEY hKeyMountPoints;
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2", 
                    0, KEY_WRITE, &hKeyMountPoints) == ERROR_SUCCESS) {
        // 设置权限拒绝所有用户访问（需要更复杂的ACL操作，这里简化实现）
        // 实际应用中可能需要使用SetSecurityInfo或SetNamedSecurityInfo函数
        // 这里通过设置特殊值来模拟权限限制
        DWORD denyAccess = 1;
        RegSetValueEx(hKeyMountPoints, "DisableAutoRun", 0, REG_DWORD, 
                     (const BYTE*)&denyAccess, sizeof(denyAccess));
        RegCloseKey(hKeyMountPoints);
    }
    
    // 方法3: 禁用所有驱动器的自动运行（更彻底的方法）
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKeyAutoRun, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKeyAutoRun, "NoDriveTypeAutoRun", 0, REG_DWORD, 
                     (const BYTE*)&disableValue, sizeof(disableValue));
        RegCloseKey(hKeyAutoRun);
    }
}

void EnableSecurityOptions() {
    HKEY hKey;
    
    // 恢复 HKEY_CURRENT_USER 下的系统策略
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "DisableTaskMgr");
        RegDeleteValue(hKey, "DisableLockWorkstation");
        RegCloseKey(hKey);
    }

    // 恢复 Explorer 策略
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoRun");
        RegCloseKey(hKey);
    }

    // 恢复命令行相关设置
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Policies\\Microsoft\\Windows\\System", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "DisableCMD");
        RegCloseKey(hKey);
    }
    
    // 恢复用户切换相关设置
    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "HideFastUserSwitching");
        RegCloseKey(hKey);
    }
    
    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                    "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "EnableFastUserSwitching");
        RegDeleteValue(hKey, "ForceAutoLogon");
        RegDeleteValue(hKey, "DisableCAD");
        RegCloseKey(hKey);
    }
    
    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                    "SYSTEM\\CurrentControlSet\\Control\\Terminal Server", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        DWORD fDenyTSConnections = 0;
        RegSetValueEx(hKey, "fDenyTSConnections", 0, REG_DWORD, (const BYTE*)&fDenyTSConnections, sizeof(fDenyTSConnections));
        RegCloseKey(hKey);
    }
    
    // 恢复密码修改功能
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\System", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "DisableChangePassword");
        RegDeleteValue(hKey, "NoSecCPL");
        RegCloseKey(hKey);
    }
    
    // 恢复注销功能
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoLogoff");
        RegDeleteValue(hKey, "StartMenuLogOff");
        RegCloseKey(hKey);
    }
    
    // 恢复所有电源按钮功能
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoClose");
        RegDeleteValue(hKey, "NoPowerOptions");
        RegDeleteValue(hKey, "HidePowerOptions");
        RegCloseKey(hKey);
    }
    
    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoClose");
        RegCloseKey(hKey);
    }
    
    // 恢复轻松访问功能
    const char* easeOfAccessPrograms[] = {
        "utilman.exe",
        "osk.exe", 
        "magnify.exe",
        "narrator.exe",
        NULL
    };
    
    for (int i = 0; easeOfAccessPrograms[i] != NULL; i++) {
        std::string regPath = "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Image File Execution Options\\";
        regPath += easeOfAccessPrograms[i];
        
        if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                        regPath.c_str(), 
                        0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
            RegDeleteValue(hKey, "Debugger");
            RegCloseKey(hKey);
            
            // 删除整个键（如果为空）
            RegDeleteKey(HKEY_LOCAL_MACHINE, regPath.c_str());
        }
    }
    
    // 恢复策略设置
    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                    "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoSetTaskbar");
        RegCloseKey(hKey);
    }
    
    // 恢复命令行功能
    UnblockCommandPrompts();
    
    // 恢复U盘自动运行设置
    
    // 删除Explorer中的自动运行限制
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoDriveTypeAutoRun");
        RegCloseKey(hKey);
    }
    
    // 恢复MountPoints2的设置
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\MountPoints2", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "DisableAutoRun");
        RegCloseKey(hKey);
    }
    
    // 删除本地机器中的自动运行限制
    if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoDriveTypeAutoRun");
        RegCloseKey(hKey);
    }
    
    // 强制刷新注册表更改
    SendMessageTimeout(HWND_BROADCAST, WM_SETTINGCHANGE, 0, 
                      (LPARAM)"Policy", SMTO_BLOCK, 1000, NULL);
    SendMessageTimeout(HWND_BROADCAST, WM_SETTINGCHANGE, 0, 
                      (LPARAM)"Windows", SMTO_BLOCK, 1000, NULL);
}

// 阻止命令行程序通过注册表
void BlockCommandPrompts() {
    HKEY hKey;
    DWORD value = 1;
    
    if (RegCreateKeyEx(HKEY_CURRENT_USER, 
                      "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "NoRun", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
}

void UnblockCommandPrompts() {
    HKEY hKey;
    
    // 恢复运行功能
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "NoRun");
        RegCloseKey(hKey);
    }
    
    // 恢复命令行禁用设置
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Policies\\Microsoft\\Windows\\System", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "DisableCMD");
        RegCloseKey(hKey);
    }
    
    // 恢复 PowerShell 禁用设置
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Policies\\Microsoft\\Windows\\PowerShell", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "Disable");
        RegCloseKey(hKey);
    }
    
    // 恢复 AppCompatFlags 设置
    if (RegOpenKeyEx(HKEY_CURRENT_USER, 
                    "Software\\Microsoft\\Windows NT\\CurrentVersion\\AppCompatFlags\\Layers", 
                    0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
        RegDeleteValue(hKey, "C:\\Windows\\System32\\cmd.exe");
        RegDeleteValue(hKey, "C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe");
        RegCloseKey(hKey);
    }
}

bool TerminateProcessByName(const std::string& processName) {
	// 保护列表：绝对不能终止的系统关键进程
    const char* protectedProcesses[] = {
        "winlogon.exe", "csrss.exe", "lsass.exe", "smss.exe", 
        "services.exe", "svchost.exe", "explorer.exe", "sihost.exe",
        "ctfmon.exe", "dwm.exe", "System", "System Idle Process",
        NULL
    };
    
    for (int i = 0; protectedProcesses[i] != NULL; i++) {
        if (_stricmp(processName.c_str(), protectedProcesses[i]) == 0) {
            return false; // 拒绝终止受保护的进程
        }
    }

    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnapshot == INVALID_HANDLE_VALUE) return false;

    PROCESSENTRY32 pe;
    pe.dwSize = sizeof(PROCESSENTRY32);

    // 获取当前进程ID和父进程ID
    DWORD currentProcessId = GetCurrentProcessId();
    DWORD parentProcessId = 0;
    
    // 使用简单的方法获取父进程ID
    HANDLE hCurrentProcess = OpenProcess(PROCESS_QUERY_INFORMATION, FALSE, currentProcessId);
    if (hCurrentProcess) {
        // 使用 Process32First/Next 来查找当前进程的父进程ID
        if (Process32First(hSnapshot, &pe)) {
            do {
                if (pe.th32ProcessID == currentProcessId) {
                    parentProcessId = pe.th32ParentProcessID;
                    break;
                }
            } while (Process32Next(hSnapshot, &pe));
        }
        CloseHandle(hCurrentProcess);
    }

    // 重新开始遍历进程
    Process32First(hSnapshot, &pe);

    bool found = false;
    do {
        if (_stricmp(pe.szExeFile, processName.c_str()) == 0) {
            // 跳过系统关键进程、当前进程和父进程
            if (pe.th32ProcessID == currentProcessId || 
                pe.th32ProcessID == parentProcessId ||
                pe.th32ProcessID == 0 || 
                pe.th32ProcessID == 4) { // System and Idle processes
                continue;
            }

            HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, FALSE, pe.th32ProcessID);
            if (hProcess != NULL) {
                // 尝试优雅终止
                if (TerminateProcess(hProcess, 0)) found = true;
                CloseHandle(hProcess);
            }
        }
    } while (Process32Next(hSnapshot, &pe));

    CloseHandle(hSnapshot);
    return found;
}

// Check if taskmgr.exe is running and terminate it
bool TerminateTaskManager() {
    return TerminateProcessByName("taskmgr.exe");
}

// 禁用Windows安全屏幕
void DisableSecurityScreen() {
    HKEY hKey;
    DWORD value = 1;
    
    // 禁用Ctrl+Alt+Del安全屏幕
    if (RegCreateKeyEx(HKEY_LOCAL_MACHINE, 
                      "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon", 
                      0, NULL, 0, KEY_WRITE, NULL, &hKey, NULL) == ERROR_SUCCESS) {
        RegSetValueEx(hKey, "DisableCAD", 0, REG_DWORD, (const BYTE*)&value, sizeof(value));
        RegCloseKey(hKey);
    }
}

void securityMonitorThread() {
    while (!shutdownFlag) {
        if (!shutdownFlag) {
            // Check and terminate Task Manager if running
            TerminateTaskManager();

            // 终止所有与轻松访问相关的进程
            const char* easeOfAccessProcesses[] = {
                "taskmgr.exe",          // 任务管理器
                "cmd.exe",              // 命令提示符
                "powershell.exe",       // PowerShell
                "utilman.exe",          // 轻松访问工具
                "osk.exe",              // 屏幕键盘
                "magnify.exe",          // 放大镜
                "narrator.exe",         // 讲述人
                "sethc.exe",            // 粘滞键
                "control.exe",          // 控制面板
                "ms-settings:",         // 设置应用
                NULL
            };

            for (int i = 0; easeOfAccessProcesses[i] != NULL && !shutdownFlag; i++) {
                TerminateProcessByName(easeOfAccessProcesses[i]);
            }
        }
        
        std::this_thread::sleep_for(std::chrono::milliseconds(1000));
    }
}

bool IsRunningAsAdmin() {
    BOOL isAdmin = FALSE;
    PSID adminGroup = NULL;
    
    SID_IDENTIFIER_AUTHORITY NtAuthority = SECURITY_NT_AUTHORITY;
    if (AllocateAndInitializeSid(&NtAuthority, 2, SECURITY_BUILTIN_DOMAIN_RID, 
                               DOMAIN_ALIAS_RID_ADMINS, 0, 0, 0, 0, 0, 0, &adminGroup)) {
        if (!CheckTokenMembership(NULL, adminGroup, &isAdmin)) isAdmin = FALSE;
        FreeSid(adminGroup);
    }
    return isAdmin;
}

int main() {
    if (!IsRunningAsAdmin()) {
        MessageBox(NULL, "Please run this program as administrator", "Permission Error", MB_ICONERROR | MB_OK);
        return 1;
    }
    
    // Set signal handler to ignore Ctrl+C
    signal(SIGINT, sigint_handler);

    // Install hooks
    HHOOK keyboardHook = SetWindowsHookEx(WH_KEYBOARD_LL, KeyboardProc, NULL, 0);
    HHOOK mouseHook = SetWindowsHookEx(WH_MOUSE_LL, MouseProc, NULL, 0);
    
    if (keyboardHook == NULL || mouseHook == NULL) {
        std::cerr << "Failed to install hooks!" << std::endl;
        return 1;
    }

    // Disable security options
    DisableSecurityOptions();
    DisableSecurityScreen();

    // Start security monitoring thread
    std::thread monitorThread(securityMonitorThread);

    // Message loop
    MSG msg;
    while (!shutdownFlag) {
        if (PeekMessage(&msg, NULL, 0, 0, PM_REMOVE)) {
            if (msg.message == WM_QUIT) break;
            TranslateMessage(&msg);
            DispatchMessage(&msg);
        }
		else std::this_thread::sleep_for(std::chrono::milliseconds(10));
    }

    // Cleanup - 确保正确的顺序
    shutdownFlag = true;
    
    // 等待监控线程退出
    if (monitorThread.joinable()) monitorThread.join();

    // 恢复系统设置
    EnableSecurityOptions();
    
    // 卸载钩子
    UnhookWindowsHookEx(keyboardHook);
    UnhookWindowsHookEx(mouseHook);
    
    // 确保系统有足够时间恢复
    std::this_thread::sleep_for(std::chrono::seconds(1));
    return 0;
}