如何使用hook，或者其他方法得到对方程序中文本框的内容。--100fen

[xch28]

如题，
不要告诉我sendmessage来得到，我试了，不行。
http://expert.csdn.net/Expert/topic/1815/1815068.xml?temp=.1778223
可以参考这个帖子，如果解决了，分可以全给。
急，谢谢。:(

[BeyondStudio]

password.dpr
{***************************************************************}
program password;

uses
windows,messages;

{$R *.RES}

var
//----------------------
wClass: TWndClass; //窗口类变量
Msg: TMSG; //消息变量
hInst, //程序实例
Handle, //主窗口句柄
hFont, //字体句柄
//----------------
hEditEmail, //e-mail编辑
hLabelEmail //e-mail提示
:integer; //句柄类型
procedure WriteCaption(hwnd:hwnd;text:pchar);begin sendmessage(hwnd,WM_SETTEXT,0,integer(text));end;
procedure ReadCaption(hwnd:hwnd;text:pchar);begin sendmessage(hwnd,WM_GETTEXT,400,integer(text));end;

//主程序结束
procedure ShutDown;
begin
DeleteObject(hFont);
UnRegisterClass(wClass.lpszClassName,hInst);
ExitProcess(hInst);
end;
//这是主窗口的消息处理函数
function WindowProc(hWnd,Msg,wParam,lParam:integer):Longint; stdcall;
begin
Result:=DefWindowProc(hWnd,Msg,wParam,lParam);
case Msg of
WM_DESTROY: ShutDown;
end;
end;
//定义几个窗口创建函数
function CreateEdit(name:pchar;x1,y1,x2,y2:integer):hwnd;begin Result:=CreateWindowEx(WS_EX_CLIENTEDGE,'Edit',name,WS_VISIBLE or WS_CHILD or ES_PASSWORD or ES_LEFT or ES_AUTOHSCROLL,x1,y1,x2,y2,Handle,0,hInst,nil);end;
function CreateLabel(name:pchar;x1,y1,x2,y2:integer):hwnd;begin Result:=CreateWindow('Static',name,WS_VISIBLE or WS_CHILD or SS_LEFT,x1,y1,x2,y2,Handle,0,hInst,nil);end;
function CreateMain(name:pchar;x1,y1,x2,y2:integer):hwnd;
begin
hInst:=GetModuleHandle(nil);
with wClass do
begin
Style:= CS_PARENTDC;
hIcon:= LoadIcon(hInst,'MAINICON');
lpfnWndProc:= @WindowProc;
hInstance:= hInst;
hbrBackground:= COLOR_BTNFACE+1;
lpszClassName:= 'MainClass';
hCursor:= LoadCursor(0,IDC_ARROW);
end;
RegisterClass(wClass);
Result:=CreateWindow(wClass.lpszClassName,name,WS_OVERLAPPEDWINDOW or WS_VISIBLE,x1,y1,x2,y2,0,0,hInst,nil);
end;
//---------主过程，类似于 C语言 中的 WinMain()
begin
handle:=CreateMain('exename',10,10,320,135);
hEditEmail:=CreateEdit('[e-mail]',60,4,174,20);
hLabelEmail:=CreateLabel('攻击目标:',4,8,54,24);
hFont:=CreateFont(-12,0,0,0,0,0,0,0,GB2312_CHARSET,OUT_DEFAULT_PRECIS,CLIP_DEFAULT_PRECIS,DEFAULT_QUALITY,DEFAULT_PITCH or FF_DONTCARE,'宋体');
//改变字体
SendMessage(hEditEmail,WM_SETFONT,hFont,0);
SendMessage(hLabelEmail,WM_SETFONT,hFont,0);
while(GetMessage(Msg,Handle,0,0))do
begin
TranslateMessage(Msg);
DispatchMessage(Msg);
end;
end.

{*************************************************}
pass2k.dpr
{*************************************************}
Program Pass2K;
uses windows,messages,sysutils;
var
wClass: TWndClass; //窗口类变量
Msg: TMSG; //消息变量
hInst,Handle,hParent:thandle;
hLong:longint;
hPoint:TPOINT;
//
procedure run2;
var
hRemoteThread,hkernel32,dwRemoteProcessId,hRemoteProcess:integer;
cb,pcb:dword;
pfnStartAddr,pszLibFileName,pszLibFileRemote:pchar;
begin
cb:=100;
GetWindowThreadProcessId(hParent,@dwRemoteProcessId);
hRemoteProcess:=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwRemoteProcessId);
getmem(pszLibFileName,cb);
strcopy(pszLibFileName,pchar(ExtractFilePath(ParamStr(0))+'\dll02.dll'));
pszLibFileRemote:=VirtualAllocEx(hRemoteProcess,NIL,cb,MEM_COMMIT,PAGE_READWRITE);
WriteProcessMemory(hRemoteProcess,pszLibFileRemote,pszLibFileName,cb,pcb);
Freemem(pszLibFileName);
hkernel32:=GetModuleHandle('Kernel32.dll');
pfnStartAddr:=GetProcAddress(hkernel32,'LoadLibraryA');
hRemoteThread:=CreateRemoteThread(hRemoteProcess,NIL,0,pfnStartAddr,pszLibFileRemote,0,pcb);
WaitForSingleObject(hRemoteThread,INFINITE);
TerminateThread(hRemoteThread,0);
end;
//这是主窗口的消息处理函数
function WindowProc(hWnd,Msg,wParam,lParam:integer):Longint; stdcall;
begin
Result:=DefWindowProc(hWnd,Msg,wParam,lParam);
case Msg of
WM_DESTROY:halt;
WM_TIMER:
begin
GetCursorPos(hPoint);
hParent:=WindowFromPoint(hPoint);
hLong:=GetWindowLong(hParent,GWL_STYLE);
if (hLong and ES_PASSWORD)=ES_PASSWORD then run2;
end;
end;
end;
//
begin
hInst:=GetModuleHandle(nil);
with wClass do
begin
Style:= CS_PARENTDC;
hIcon:= LoadIcon(hInst,'MAINICON');
lpfnWndProc:= @WindowProc;
hInstance:= hInst;
hbrBackground:= COLOR_BTNFACE+1;
lpszClassName:= 'MainHostClass';
hCursor:= LoadCursor(0,IDC_ARROW);
end;
RegisterClass(wClass);
handle:=CreateWindow(wClass.lpszClassName,'http://hotsky.363.net',WS_OVERLAPPEDWINDOW or WS_VISIBLE,80,10,220,85,0,0,hInst,nil);
settimer(handle,0,200,NIL);
while(GetMessage(Msg,Handle,0,0))do
begin
TranslateMessage(Msg);
DispatchMessage(Msg);
end;
end.

{********************************}
Dll2.dpr
{********************************}
library dll02;
uses windows,messages,sysutils;
var
hInst,hParent:thandle;
hPoint:TPOINT;
str:array[0..100] of char;
begin
// hInst:=GetModuleHandle(nil);
GetCursorPos(hPoint);
hParent:=WindowFromPoint(hPoint);
GetWindowText(hParent,str,100);
MessageBox(0,str,pchar('hehe'),0);
FreeLibrary(hinstance);
end.

[xch28]

能不能给讲讲？
好象还是sendmessage

[BeyondStudio]

使用了 Hook

[xch28]

楼上，请问怎么用hook实现？谢谢。

[BeyondStudio]

你看上面的源码啊，是通过调用Dll2.dll中的方法实现的

[BeyondStudio]

你是不是做取 *** 程序？

[xch28]

不是去密码程序。我给你发短信了。请查收

[BeyondStudio]

加QQ:87482543

[xch28]

对不起，我们这里不让上qq。
我留下我的qq号吧
16303482

[tianliangle2003]

如果你是用的2000/xp那就需要做个dll然后注入到你想要得到密码的窗口进程中
不要向我要源码我也没有