📄 spypro.pas
字号:
unit spypro;
interface
uses
Windows, Messages, SysUtils, Classes, Graphics, Controls, Forms, Dialogs,
StdCtrls,Win32Hook, ScktComp, ComCtrls;
const
SZ_HOOKDLL = '\hook.dll';
type
TForm1 = class(TForm)
Button1: TButton;
Edit1: TEdit;
OpenDialog1: TOpenDialog;
ServerSocket1: TServerSocket;
ClientSocket1: TClientSocket;
Memo1: TMemo;
procedure Button1Click(Sender: TObject);
procedure ServerSocket1ClientConnect(Sender: TObject;
Socket: TCustomWinSocket);
Procedure OnMsg(Var Msg: TMessage); Message Wm_CopyData;
procedure ServerSocket1Accept(Sender: TObject;
Socket: TCustomWinSocket);
procedure ServerSocket1ClientRead(Sender: TObject;
Socket: TCustomWinSocket);
procedure ServerSocket1GetSocket(Sender: TObject; Socket: Integer;
var ClientSocket: TServerClientWinSocket);
procedure ServerSocket1ClientError(Sender: TObject;
Socket: TCustomWinSocket; ErrorEvent: TErrorEvent;
var ErrorCode: Integer);
procedure ServerSocket1ClientDisconnect(Sender: TObject;
Socket: TCustomWinSocket);
procedure FormCreate(Sender: TObject);
procedure ClientSocket1Read(Sender: TObject; Socket: TCustomWinSocket);
procedure ClientSocket1Connect(Sender: TObject;
Socket: TCustomWinSocket);
procedure ClientSocket1Disconnect(Sender: TObject;
Socket: TCustomWinSocket);
private
procedure CreateParams(var Params: TCreateParams); override;
procedure PortMessage(var Msg: TMsg);
{ Private declarations }
public
CX: Integer;
{ Public declarations }
end;
var
Form1: TForm1;
lpPI: TProcessInformation;
lpSA: TSecurityAttributes;
lpSI: TStartupInfo;
szFilePath: String;
dwSize: Integer;
implementation
{$R *.DFM}
procedure Tform1.CreateParams(var Params: TCreateParams);
begin
inherited CreateParams(Params);
Params.WinClassName := 'MessengerHook';
end;
procedure InitializeSecurity(var SA: TSecurityAttributes);
var sd: PSecurityDescriptor;
begin
// Allocate memory for the security descriptor
sd:=AllocMem(SECURITY_DESCRIPTOR_MIN_LENGTH);
// Initialise the new security descriptor
if InitializeSecurityDescriptor(sd, SECURITY_DESCRIPTOR_REVISION) then
begin
// Add a NULL descriptor ACL to the security descriptor
if SetSecurityDescriptorDacl(sd, True, nil, False) then
begin
// Set up the security attributes structure
with SA do
begin
nLength:=SizeOf(TSecurityAttributes);
lpSecurityDescriptor:=sd;
bInheritHandle:=True;
end;
end
else
// Failed to init the sec descriptor
RaiseLastWin32Error;
end
else
// Failed to init the sec descriptor
RaiseLastWin32Error;
end;
procedure FinalizeSecurity(var SA: TSecurityAttributes);
begin
// Release memory that was assigned to security descriptor
if Assigned(SA.lpSecurityDescriptor) then
begin
// Free memory
FreeMem(SA.lpSecurityDescriptor);
// Clear pointer
SA.lpSecurityDescriptor:=nil;
end;
end;
Procedure InjectProcess(Fn: String);
Begin
// Set buffer size
SetLength(szFilePath, Succ(MAX_PATH));
// Get application filename
dwSize:=GetModuleFileName(0, Pointer(szFilePath), MAX_PATH);
// Reset to actual string size
SetLength(szFilePath, dwSize);
// Extract file path from the application name
szFilePath:=ExcludeTrailingBackslash(ExtractFilePath(szFilePath));
// Initialize a null security descriptor
InitializeSecurity(lpSA);
// Clear startup structures
FillChar(lpPI, SizeOf(lpPI), #0);
FillChar(lpSI, SizeOf(lpSI), #0);
// Set default flags
lpSI.cb:=SizeOf(lpSI);
lpSI.dwFlags:=STARTF_USESHOWWINDOW;
lpSI.wShowWindow:=SW_SHOW;
// Resource protection
try
// Attempt to create the notepad process
if CreateProcess(nil, Pchar(Fn), @lpSA, @lpSA, True, NORMAL_PRIORITY_CLASS, nil, PChar(szFilePath), lpSI, lpPI) then
begin
// Process was created
try
// Wait for input idle so we are sure the app is in a state where we can inject
WaitForInputIdle(lpPI.hProcess, 2000);
// Inject the library into the
with TLibraryInject.Create do
begin
// Resource protection
try
// Don't want to unload on free
UnloadOnFree:=False;
// Inject the hook library into the target process
Add(lpPI.dwProcessId, szFilePath+SZ_HOOKDLL);
finally
// Free the injection class
Free;
end;
end;
finally
// Need to close the handles we got back
CloseHandle(lpPI.hThread);
CloseHandle(lpPI.hProcess);
end;
end;
finally
// Finalize the security descriptor
FinalizeSecurity(lpSA);
end;
End;
procedure TForm1.Button1Click(Sender: TObject);
Var
Fn: String;
begin
OpenDialog1.Execute;
Fn:=OpenDialog1.FileName;
ClientSocket1.Active:=True;
Sleep(1000);
Form1.ServerSocket1.Active:=True;
If Fn<>'' Then
InjectProcess(FN);
end;
procedure TForm1.PortMessage(var Msg: TMsg);
Var
Port: Integer;
begin
Port:=Msg.lParam;
Memo1.Lines.Add('Listen on port '+IntToStr(Port));
end;
procedure TForm1.ServerSocket1ClientConnect(Sender: TObject;
Socket: TCustomWinSocket);
begin
Memo1.Lines.Add('Connection on 5050 '+Socket.RemoteHost);
end;
procedure TForm1.ServerSocket1Accept(Sender: TObject;
Socket: TCustomWinSocket);
begin
Memo1.Lines.add('Accept');
end;
procedure TForm1.ServerSocket1ClientRead(Sender: TObject;
Socket: TCustomWinSocket);
Var
S: String;
Tmp: String;
N: Integer;
begin
s:=Socket.ReceiveText;
Memo1.Lines.AdD(S);
ClientSocket1.Socket.SendText(S);
end;
procedure TForm1.ServerSocket1GetSocket(Sender: TObject; Socket: Integer;
var ClientSocket: TServerClientWinSocket);
begin
memo1.Lines.Add('Getsocket');
end;
procedure TForm1.ServerSocket1ClientError(Sender: TObject;
Socket: TCustomWinSocket; ErrorEvent: TErrorEvent;
var ErrorCode: Integer);
begin
Memo1.Lines.Add('client Error');
end;
procedure TForm1.ServerSocket1ClientDisconnect(Sender: TObject;
Socket: TCustomWinSocket);
begin
memo1.Lines.Add('Client Disconnect');
end;
procedure TForm1.FormCreate(Sender: TObject);
begin
cx:=0;
end;
procedure TForm1.ClientSocket1Read(Sender: TObject;
Socket: TCustomWinSocket);
Var
S: String;
begin
S:=Socket.ReceiveText;
ServerSocket1.Socket.Connections[0].SendText(s);
end;
procedure TForm1.ClientSocket1Connect(Sender: TObject;
Socket: TCustomWinSocket);
begin
memo1.Lines.add('connected to yahoo');
end;
procedure TForm1.ClientSocket1Disconnect(Sender: TObject;
Socket: TCustomWinSocket);
begin
memo1.lines.add('client d/c');
end;
procedure TForm1.OnMsg(var Msg: TMessage);
Var
MsgRecv: ^TCopyDataStruct;
MyStr: String;
Begin
MsgRecv:=Pointer(Msg.Lparam);
SetLength(MyStr,MsgRecv.cbData);
Move(MsgRecv.LpData^,MyStr[1],MsgRecv.CbData);
ShowMessage(MyStr);
// ShowMessage('Something!');
end;
end.
⌨️ 快捷键说明
复制代码
Ctrl + C
搜索代码
Ctrl + F
全屏模式
F11
切换主题
Ctrl + Shift + D
显示快捷键
?
增大字号
Ctrl + =
减小字号
Ctrl + -