#include "stdafx.h"
#include "PwdSpy.h"
#include "PopupTipWnd.h"#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif#define BORDER_X 5
#define BORDER_Y 5//***********************************************
CPopupTipWnd::CPopupTipWnd()
{m_pParentWnd = NULL;
}//***********************************************
CPopupTipWnd::~CPopupTipWnd()
{
}BEGIN_MESSAGE_MAP(CPopupTipWnd, CWnd)//{{AFX_MSG_MAP(CPopupTipWnd)//}}AFX_MSG_MAP
END_MESSAGE_MAP()//***********************************************
BOOL CPopupTipWnd::Create(CWnd *pParentWnd)
{_ASSERTE(pParentWnd);m_pParentWnd = pParentWnd;DWORD dwStyle = WS_BORDER | WS_POPUP;DWORD dwExStyle = WS_EX_TOOLWINDOW | WS_EX_TOPMOST;CString strWndClass = AfxRegisterWndClass(CS_SAVEBITS, 0, (HBRUSH)(COLOR_INFOBK + 1));BOOL bCreated = CreateEx(dwExStyle,strWndClass,NULL,dwStyle,0, 0, 0, 0,NULL, NULL, NULL);return bCreated;
}//***********************************************
void CPopupTipWnd::ShowPopupWindow(CString strText, CPoint point, CRect rect)
{// If there is no password, instead hide the window and be done with itif(strText.IsEmpty()){HidePopupWindow();return;}CClientDC dc(this);// Use same font as parent windowCFont *pOldFont = dc.SelectObject(m_pParentWnd->GetFont());// Calculate the window size.CSize sizeText = dc.GetTextExtent(strText);CSize sizeWindow;sizeWindow.cx = sizeText.cx + 2 * BORDER_X;sizeWindow.cy = sizeText.cy + 2 * BORDER_Y;// Draw information in windowdc.SetBkMode(TRANSPARENT);dc.DrawText(strText, CRect(0, 0, sizeWindow.cx, sizeWindow.cy), DT_CENTER | DT_VCENTER | DT_SINGLELINE);dc.SelectObject(pOldFont);// Calculate window rectangle position on screenCRect rectWindow;rectWindow.left = rect.left;rectWindow.right = rectWindow.left + sizeWindow.cx;rectWindow.top = rect.top - (sizeWindow.cy + 20);if(rectWindow.top <= 0)rectWindow.top = rect.bottom + 20;rectWindow.bottom = rectWindow.top + sizeWindow.cy;// Display windowSetWindowPos(&wndTop,rectWindow.left,rectWindow.top,rectWindow.Width(),rectWindow.Height(),SWP_SHOWWINDOW | SWP_NOACTIVATE);
}//***********************************************
void CPopupTipWnd::HidePopupWindow(void)
{ShowWindow(SW_HIDE);
}//.h
#pragma onceclass CPopupTipWnd : public CWnd
{
// Construction
public:CPopupTipWnd();virtual ~CPopupTipWnd();virtual BOOL Create(CWnd *pParentWnd);void ShowPopupWindow(CString strText, CPoint point, CRect rect);void HidePopupWindow(void);// Overrides// ClassWizard generated virtual function overrides//{{AFX_VIRTUAL(CPopupTipWnd)//}}AFX_VIRTUAL// Generated message map functions
protected:CRect m_rectPos;CWnd *m_pParentWnd;//{{AFX_MSG(CPopupTipWnd)//}}AFX_MSGDECLARE_MESSAGE_MAP()
};//{{AFX_INSERT_LOCATION}}
2 操作系統信息類
COSInfo，封裝了Win32 API 操作系統信息相關API;
#include "stdafx.h"
#include "OSInfo.h"//***********************************************
COSInfo::COSInfo()
{ZeroMemory(&m_osvi, sizeof(OSVERSIONINFO));m_osvi.dwOSVersionInfoSize = sizeof(OSVERSIONINFO);if(!GetVersionEx(&m_osvi))ZeroMemory(&m_osvi, sizeof(OSVERSIONINFO));
}//***********************************************
COSInfo::~COSInfo()
{
}//***********************************************
EOSType COSInfo::GetOSType(void) const
{EOSType eOSType = eUnknown;if(IsWindowsNT())eOSType = eWinNT;else if(IsWindows2000())eOSType = eWin2000;else if(IsWindowsXP())eOSType = eWinXP;else if(IsWindows2003())eOSType = eWin2003;else if(IsWindows95())eOSType = eWin95;else if(IsWindows98())eOSType = eWin98;else if(IsWindowsME())eOSType = eWinME;return eOSType;
}//***********************************************
LPCTSTR COSInfo::GetOSString(void) const
{struct OSTypeTableEntry{EOSType eOSType;LPCTSTR szOSName;}static const OSLookupTable[] ={{eUnknown, _T("")}, // Undefined{eWin95, _T("Windows 95")}, // Windows 95{eWin98, _T("Windows 98")}, // Windows 98{eWinME, _T("Windows ME")}, // Windows ME{eWinNT, _T("Windows NT")}, // Windows NT{eWin2000, _T("Windows 2000")}, // Windows 2000{eWinXP, _T("Windows XP")}, // Windows XP{eWin2003, _T("Windows 2003")} // Windows 2003};EOSType eOSType = GetOSType();_ASSERTE(eOSType < sizeof(OSLookupTable) / sizeof(OSLookupTable[0]));return OSLookupTable[eOSType].szOSName;
}//***********************************************
bool COSInfo::IsWindows95(void) const
{// Windows95 if:// Major == 4 and Minor == 0 and PlatformId != NTreturn (m_osvi.dwMajorVersion == 4 &&m_osvi.dwMinorVersion == 0 &&m_osvi.dwPlatformId != VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
bool COSInfo::IsWindows98(void) const
{// Windows98 if:// Major >= 4 and Minor > 0 and PlatformId != NT// (except Major == 4 and Minor == 90 which is ME)// (note: Major == 4 and Minor == 0 is 95)return (m_osvi.dwMajorVersion >= 4 &&m_osvi.dwMinorVersion > 0 &&m_osvi.dwPlatformId != VER_PLATFORM_WIN32_NT &&!(m_osvi.dwMajorVersion == 4 && m_osvi.dwMinorVersion == 90)) ? true : false;
}//***********************************************
bool COSInfo::IsWindowsME(void) const
{// WindowsME if:// Major == 4 and Minor == 90 and PlatformId != NTreturn (m_osvi.dwMajorVersion == 4 &&m_osvi.dwMinorVersion == 90 &&m_osvi.dwPlatformId != VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
bool COSInfo::IsWindowsNT(void) const
{// WindowsNT4 if:// Major == 4 and Minor == 0 and PlatformId == NTreturn (m_osvi.dwMajorVersion == 4 &&m_osvi.dwMinorVersion == 0 &&m_osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
bool COSInfo::IsWindows2000(void) const
{// Windows2000 if:// Major == 5 and Minor == 0 and PlatformId == NTreturn (m_osvi.dwMajorVersion == 5 &&m_osvi.dwMinorVersion == 0 &&m_osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
bool COSInfo::IsWindowsXP(void) const
{// WindowsXP if:// Major == 5 and Minor == 1 and PlatformId == NTreturn (m_osvi.dwMajorVersion == 5 &&m_osvi.dwMinorVersion == 1 &&m_osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
bool COSInfo::IsWindows2003(void) const
{// Windows2003 if:// Major == 5 and Minor == 2 and PlatformId == NTreturn (m_osvi.dwMajorVersion == 5 &&m_osvi.dwMinorVersion == 2 &&m_osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
bool COSInfo::IsNT(void) const
{return (m_osvi.dwPlatformId == VER_PLATFORM_WIN32_NT) ? true : false;
}//***********************************************
DWORD COSInfo::GetMajor(void) const
{return m_osvi.dwMajorVersion;
}//***********************************************
DWORD COSInfo::GetMinor(void) const
{return m_osvi.dwMinorVersion;
}//***********************************************
DWORD COSInfo::GetBuild(void) const
{return m_osvi.dwBuildNumber;
}//***********************************************
DWORD COSInfo::GetPlatformId(void) const
{return m_osvi.dwPlatformId;
}//***********************************************
LPCTSTR COSInfo::GetCSDString(void) const
{return m_osvi.szCSDVersion;
}//.h
#pragma oncetypedef enum _EOSType
{eUnknown = 0,eWin95,eWin98,eWinME,eWinNT,eWin2000,eWinXP,eWin2003
} EOSType, *LPEOSType;class COSInfo
{
public:COSInfo();virtual ~COSInfo();EOSType GetOSType(void) const;LPCTSTR GetOSString(void) const;bool IsWindows95(void) const;bool IsWindows98(void) const;bool IsWindowsME(void) const;bool IsWindowsNT(void) const;bool IsWindows2000(void) const;bool IsWindowsXP(void) const;bool IsWindows2003(void) const;bool IsNT(void) const;DWORD GetMajor(void) const;DWORD GetMinor(void) const;DWORD GetBuild(void) const;DWORD GetPlatformId(void) const;LPCTSTR GetCSDString(void) const;protected:OSVERSIONINFO m_osvi;
};
3 代碼注入CPP文件
包括線程函數，拷貝線程函數和注入數據到遠程進程的函數；
/***************************************************************
Module name: InjCode.cpp
Copyright (c) 2003 Robert KusterNotice: If this code works, it was written by Robert Kuster.Else, I don't know who wrote it.Use it on your own risk. No responsibilities forpossible damages of even functionality can be taken.
***************************************************************/#include <Windows.h>
#include "InjCode.h"//---------------------------------------------------------------------
// INJDATA
// Notice: The data structure being injected.
//
typedef LRESULT (WINAPI *SENDMESSAGE)(HWND,UINT,WPARAM,LPARAM);typedef struct {HWND hwnd;SENDMESSAGE fnSendMessage; // pointer to user32!SendMessageBYTE pbText[128 * sizeof(TCHAR)];
} INJDATA, *PINJDATA;//---------------------------------------------------------------------
// ThreadFunc
// Notice: - the code being injected;
// - the remote copy of this function retrieves the password;
//
// Return value: password length
//
static DWORD WINAPI ThreadFunc (INJDATA *pData)
{// There must be less than a page-worth of local// variables used in this function.int nXferred = 0; // number of chars retrieved by WM_GETTEXT// Get passwordnXferred = pData->fnSendMessage( pData->hwnd, WM_GETTEXT,sizeof(pData->pbText)/sizeof(TCHAR),(LPARAM)pData->pbText );pData->pbText [127 * sizeof(TCHAR)] = __TEXT('\0'); // The thread's exit code is the number // of characters retrieved by WM_GETTEXTreturn nXferred;
}// This function marks the memory address after ThreadFunc.
// int cbCodeSize = (PBYTE) AfterThreadFunc - (PBYTE) ThreadFunc.
static void AfterThreadFunc (void) {
}//---------------------------------------------------------------------
// GetTextRemote
// Notice: - copies ThreadFunc and INJDATA to the remote process;
// - starts the excecution of the remote ThreadFunc;
//
// Return value: password length;
//
int GetTextRemote (HANDLE hProcess, HWND hWnd, BYTE* pbString, bool fUnicode)
{ HINSTANCE hUser32;INJDATA *pDataRemote; // the address (in the remote process) where INJDATA will be copied to;DWORD *pCodeRemote; // the address (in the remote process) where ThreadFunc will be copied to;HANDLE hThread = NULL; // the handle to the thread executing the remote copy of ThreadFunc;DWORD dwThreadId = 0;int nCharsXferred = 0; // number of chars retrieved by WM_GETTEXT in the remote thread;DWORD dwNumBytesXferred = 0; // number of bytes written/read to/from the remote process;__try {hUser32 = GetModuleHandle(__TEXT("user32"));if (hUser32 == NULL)__leave;// Initialize INJDATA and then // copy it to the remote processINJDATA DataLocal = {hWnd,(SENDMESSAGE) GetProcAddress(hUser32, fUnicode ? "SendMessageW" : "SendMessageA") };if( DataLocal.fnSendMessage == NULL )__leave; // 1. Allocate memory in the remote process for INJDATA// 2. Write a copy of DataLocal to the allocated memorypDataRemote = (INJDATA*) VirtualAllocEx( hProcess, 0, sizeof(INJDATA), MEM_COMMIT, PAGE_READWRITE );if (pDataRemote == NULL)__leave;WriteProcessMemory( hProcess, pDataRemote, &DataLocal, sizeof(INJDATA), &dwNumBytesXferred );// Calculate the number of bytes that ThreadFunc occupiesconst int cbCodeSize = ((LPBYTE) AfterThreadFunc - (LPBYTE) ThreadFunc);// 1. Allocate memory in the remote process for the injected ThreadFunc// 2. Write a copy of ThreadFunc to the allocated memorypCodeRemote = (PDWORD) VirtualAllocEx( hProcess, 0, cbCodeSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE ); if (pCodeRemote == NULL)__leave;WriteProcessMemory( hProcess, pCodeRemote, &ThreadFunc, cbCodeSize, &dwNumBytesXferred );// Start execution of remote ThreadFunchThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE) pCodeRemote,pDataRemote, 0 , &dwThreadId);if (hThread == NULL)__leave;WaitForSingleObject(hThread, INFINITE);// Get result (password) backReadProcessMemory( hProcess, pDataRemote, &DataLocal, sizeof(INJDATA), &dwNumBytesXferred);if (fUnicode) wcscpy((LPWSTR) pbString, (LPCWSTR) DataLocal.pbText);else strcpy((LPSTR) pbString, (LPCSTR) DataLocal.pbText);}__finally {if ( pDataRemote != 0 )VirtualFreeEx( hProcess, pDataRemote, 0, MEM_RELEASE );if ( pCodeRemote != 0 )VirtualFreeEx( hProcess, pCodeRemote, 0, MEM_RELEASE );if ( hThread != NULL ) {GetExitCodeThread(hThread, (PDWORD) &nCharsXferred);CloseHandle(hThread); }}// Return the number of chars retrieved // by WM_GETTEXT in the remote thread.return nCharsXferred;
}///int GetWindowTextRemoteA (HANDLE hProcess, HWND hWnd, LPSTR lpString)
{return GetTextRemote (hProcess, hWnd, (BYTE*)lpString, false);
}int GetWindowTextRemoteW (HANDLE hProcess, HWND hWnd, LPWSTR lpString)
{return GetTextRemote (hProcess, hWnd, (BYTE*)lpString, true);
}End Of File ////.h
/***************************************************************
Module name: InjCode.h
Copyright (c) 2003 Robert KusterNotice: If this code works, it was written by Robert Kuster.Else, I don't know who wrote it.Use it on your own risk. No responsibilities forpossible damages of even functionality can be taken.
***************************************************************/
#if !defined INJCODE_H
#define INJCODE_Hint GetWindowTextRemoteA (HANDLE hProcess, HWND hWnd, LPSTR lpString);
int GetWindowTextRemoteW (HANDLE hProcess, HWND hWnd, LPWSTR lpString);#ifdef UNICODE
#define GetWindowTextRemote GetWindowTextRemoteW
#else
#define GetWindowTextRemote GetWindowTextRemoteA
#endif // !UNICODE#endif // !defined(INJCODE_H)
