能力值：
( LV9，RANK：780 )
|
-
-
5 楼
呵呵，快了，正在学习驱动编写 RadASM+MASM+KmdKit
可能下期就是这些内容了
|
能力值：
( LV2，RANK：10 )
|
-
-
9 楼
试过了，强啊！有的地方不明白，能否解释下啊！
CTEXT("#32770")，还有1343，1345，1356几个数据是怎么来的啊？恕我愚昧。
还有，那个修改的数据应该会返回保存到服务器上吧？
|
能力值：
( LV2，RANK：10 )
|
-
-
11 楼
楼上的回答正解,#32770是对话框程序的标志
1343，1345，1356几个数据都可以用用spy++可以查到的
修改的数据是在服务器上保存的,不信你可以用QQ的查找功能看看!
|
能力值：
( LV12，RANK：410 )
|
-
-
13 楼
SendMessage,hWnd,245,0,0这样的代码你很喜欢看吗？总之我不喜欢。从ＯＤ中看清楚多了。
00401000 . 55 push ebp
00401001 . 8BEC mov ebp, esp
00401003 . 83C4 E4 add esp, -1C
00401006 . 53 push ebx
00401007 . 57 push edi
00401008 . 56 push esi
00401009 . 8B45 0C mov eax, dword ptr ss:[ebp+C]
0040100C . 83F8 10 cmp eax, 10 ; Switch (cases 10..111)
0040100F . 74 1A je short Qqsexedi.0040102B
00401011 . 3D 10010000 cmp eax, 110
00401016 . 74 22 je short Qqsexedi.0040103A
00401018 . 3D 11010000 cmp eax, 111
0040101D . 74 34 je short Qqsexedi.00401053
0040101F . B8 00000000 mov eax, 0 ; Default case of switch 0040100C
00401024 . 5E pop esi
00401025 . 5F pop edi
00401026 . 5B pop ebx
00401027 . C9 leave
00401028 . C2 1000 retn 10
0040102B > 6A 00 push 0 ; /Result = 0; Case 10 (WM_CLOSE) of switch 0040100C
0040102D . FF75 08 push dword ptr ss:[ebp+8] ; |hWnd
00401030 . E8 8B010000 call <jmp.&user32.EndDialog> ; \EndDialog
00401035 . E9 41010000 jmp Qqsexedi.0040117B
0040103A > 6A 03 push 3 ; /Flags = SWP_NOSIZE|SWP_NOMOVE; Case 110 (WM_INITDIALOG) of switch 0040100C
0040103C . 6A 00 push 0 ; |Height = 0
0040103E . 6A 00 push 0 ; |Width = 0
00401040 . 6A 00 push 0 ; |Y = 0
00401042 . 6A 00 push 0 ; |X = 0
00401044 . 6A FF push -1 ; |InsertAfter = HWND_TOPMOST
00401046 . FF75 08 push dword ptr ss:[ebp+8] ; |hWnd
00401049 . E8 9C010000 call <jmp.&user32.SetWindowPos> ; \SetWindowPos
0040104E . E9 28010000 jmp Qqsexedi.0040117B
00401053 > 8B45 10 mov eax, dword ptr ss:[ebp+10] ; Case 111 (WM_COMMAND) of switch 0040100C
00401056 . 3D EA030000 cmp eax, 3EA
0040105B . 0F85 1A010000 jnz Qqsexedi.0040117B
00401061 . 68 07304000 push Qqsexedi.00403007 ; /Title = "QQ2007设置"
00401066 . 68 00304000 push Qqsexedi.00403000 ; |Class = "#32770"
0040106B . E8 56010000 call <jmp.&user32.FindWindowA> ; \FindWindowA
00401070 . 0BC0 or eax, eax
00401072 . 75 0F jnz short Qqsexedi.00401083
00401074 . 68 19304000 push Qqsexedi.00403019 ; /Title = "QQ2006设置"
00401079 . 68 12304000 push Qqsexedi.00403012 ; |Class = "#32770"
0040107E . E8 43010000 call <jmp.&user32.FindWindowA> ; \FindWindowA
00401083 > 0BC0 or eax, eax
00401085 . 0F84 DD000000 je Qqsexedi.00401168
0040108B . 8945 FC mov dword ptr ss:[ebp-4], eax
0040108E . 6A 00 push 0 ; /Title = NULL
00401090 . 68 24304000 push Qqsexedi.00403024 ; |Class = "#32770"
00401095 . 6A 00 push 0 ; |hAfterWnd = NULL
00401097 . FF75 FC push dword ptr ss:[ebp-4] ; |hParent
0040109A . E8 2D010000 call <jmp.&user32.FindWindowExA> ; \FindWindowExA
0040109F . 8945 F8 mov dword ptr ss:[ebp-8], eax
004010A2 . 6A 00 push 0 ; /Title = NULL
004010A4 . 68 2B304000 push Qqsexedi.0040302B ; |Class = "#32770"
004010A9 . 6A 00 push 0 ; |hAfterWnd = NULL
004010AB . FF75 F8 push dword ptr ss:[ebp-8] ; |hParent
004010AE . E8 19010000 call <jmp.&user32.FindWindowExA> ; \FindWindowExA
004010B3 . 8945 F4 mov dword ptr ss:[ebp-C], eax
004010B6 . 68 4C050000 push 54C ; /ControlID = 54C (1356.)
004010BB . FF75 F4 push dword ptr ss:[ebp-C] ; |hWnd
004010BE . E8 0F010000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
004010C3 . 8945 F0 mov dword ptr ss:[ebp-10], eax
004010C6 . 68 41050000 push 541 ; /ControlID = 541 (1345.)
004010CB . FF75 F4 push dword ptr ss:[ebp-C] ; |hWnd
004010CE . E8 FF000000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
004010D3 . 8945 EC mov dword ptr ss:[ebp-14], eax
004010D6 . 68 3F050000 push 53F ; /ControlID = 53F (1343.)
004010DB . FF75 F8 push dword ptr ss:[ebp-8] ; |hWnd
004010DE . E8 EF000000 call <jmp.&user32.GetDlgItem> ; \GetDlgItem
004010E3 . 8945 E8 mov dword ptr ss:[ebp-18], eax
004010E6 . 6A 00 push 0 ; /lParam = 0
004010E8 . 6A 00 push 0 ; |wParam = 0
004010EA . 6A 20 push 20 ; |Message = WM_SETCURSOR
004010EC . FF75 F0 push dword ptr ss:[ebp-10] ; |hWnd
004010EF . E8 F0000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
004010F4 . 6A 0A push 0A ; /Count = A (10.)
004010F6 . 68 5A304000 push Qqsexedi.0040305A ; |Buffer = Qqsexedi.0040305A
004010FB . 68 E9030000 push 3E9 ; |ControlID = 3E9 (1001.)
00401100 . FF75 08 push dword ptr ss:[ebp+8] ; |hWnd
00401103 . E8 D0000000 call <jmp.&user32.GetDlgItemTextA> ; \GetDlgItemTextA
00401108 . 68 5A304000 push Qqsexedi.0040305A ; /lParam = 40305A
0040110D . 6A 00 push 0 ; |wParam = 0
0040110F . 68 43010000 push 143 ; |Message = CB_ADDSTRING
00401114 . FF75 F0 push dword ptr ss:[ebp-10] ; |hWnd
00401117 . E8 C8000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
0040111C . 8945 E4 mov dword ptr ss:[ebp-1C], eax
0040111F . 6A 00 push 0 ; /lParam = 0
00401121 . FF75 E4 push dword ptr ss:[ebp-1C] ; |wParam
00401124 . 68 4E010000 push 14E ; |Message = CB_SETCURSEL
00401129 . FF75 F0 push dword ptr ss:[ebp-10] ; |hWnd
0040112C . E8 B3000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401131 . 68 50304000 push Qqsexedi.00403050 ; /lParam = 403050
00401136 . 6A 0A push 0A ; |wParam = A
00401138 . 6A 0D push 0D ; |Message = WM_GETTEXT
0040113A . FF75 EC push dword ptr ss:[ebp-14] ; |hWnd
0040113D . E8 A2000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401142 . 68 50304000 push Qqsexedi.00403050 ; /lParam = 403050
00401147 . 6A 00 push 0 ; |wParam = 0
00401149 . 6A 0C push 0C ; |Message = WM_SETTEXT
0040114B . FF75 EC push dword ptr ss:[ebp-14] ; |hWnd
0040114E . E8 91000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401153 . 6A 00 push 0 ; /lParam = 0
00401155 . 6A 00 push 0 ; |wParam = 0
00401157 . 68 F5000000 push 0F5 ; |Message = BM_CLICK
0040115C . FF75 E8 push dword ptr ss:[ebp-18] ; |hWnd
0040115F . E8 80000000 call <jmp.&user32.SendMessageA> ; \SendMessageA
00401164 . EB 15 jmp short Qqsexedi.0040117B
00401166 . EB 13 jmp short Qqsexedi.0040117B
00401168 > 6A 00 push 0 ; /Style = MB_OK|MB_APPLMODAL
0040116A . 68 4B304000 push Qqsexedi.0040304B ; |Title = "提示"
0040116F . 68 32304000 push Qqsexedi.00403032 ; |Text = "请先",B4,"蚩猀Q",B8,"鋈松柚?,B4,"",B0,"口?,A1,""
00401174 . 6A 00 push 0 ; |hOwner = NULL
00401176 . E8 63000000 call <jmp.&user32.MessageBoxA> ; \MessageBoxA
0040117B > B8 01000000 mov eax, 1
00401180 . 5E pop esi
00401181 . 5F pop edi
00401182 . 5B pop ebx
00401183 . C9 leave
00401184 . C2 1000 retn 10
00401187 >/$ 6A 00 push 0 ; /pModule = NULL
00401189 |. E8 26000000 call <jmp.&kernel32.GetModuleHandleA> ; \GetModuleHandleA
0040118E |. A3 64304000 mov dword ptr ds:[403064], eax
00401193 |. 6A 00 push 0 ; /lParam = NULL
00401195 |. 68 00104000 push Qqsexedi.00401000 ; |DlgProc = Qqsexedi.00401000
0040119A |. 6A 00 push 0 ; |hOwner = NULL
0040119C |. 68 E8030000 push 3E8 ; |pTemplate = 3E8
004011A1 |. 50 push eax ; |hInst
004011A2 |. E8 13000000 call <jmp.&user32.DialogBoxParamA> ; \DialogBoxParamA
004011A7 |. 6A 00 push 0 ; /ExitCode = 0
004011A9 \. E8 00000000 call <jmp.&kernel32.ExitProcess> ; \ExitProcess
|
能力值：
( LV9，RANK：780 )
|
-
-
14 楼
SendMessage,hWnd,245,0,0 呵呵，不喜欢吗？重新发一个
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Programmed by hacker0058, nohacks@126.com
; Website: http://nohacks.ys168.com
; QQ性别修改器 V1.0
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.386
.model flat,stdcall
option casemap:none
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Include 数据
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
include windows.inc
include kernel32.inc
include shell32.inc
include debug.inc
includelib kernel32.lib
include user32.inc
includelib user32.lib
includelib shell32.lib
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; Equ 数据 RC资源
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
DLG_MAIN equ 1000
IDC_EDT equ 1001
IDC_IDOK equ 1002
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
.data
.data?
ls db 10 dup (?)
sextemp db 10 dup (?)
hInstance HINSTANCE ?
.code
;********************************************************************
_ProcDlgMain proc uses ebx edi esi, \
hWnd:DWORD,wMsg:DWORD,wParam:DWORD,lParam:DWORD
LOCAL hwnd,hwnd1,hwnd2,hwnd3,hwnd4,hwnd5,idx
mov eax,wMsg
cmp eax,WM_CLOSE
je boxClose
cmp eax,WM_INITDIALOG
je boxStart
cmp eax,WM_COMMAND
je commoand
retFalse:
mov eax,FALSE
ret
boxClose:
invoke EndDialog,hWnd,NULL
jmp retTrue
boxStart:
invoke SetWindowPos,hWnd,HWND_TOPMOST,0,0,0,0, SWP_NOMOVE or SWP_NOSIZE ;窗口置顶
jmp retTrue
commoand:
mov eax,wParam
.if eax == IDC_IDOK
invoke FindWindow,CTEXT("#32770"), CTEXT("QQ2007设置")
.if eax==0
invoke FindWindow,CTEXT("#32770"), CTEXT("QQ2006设置")
.endif
.if eax!=0
mov hwnd,eax
invoke FindWindowEx ,hwnd, 0, CTEXT("#32770"), 0
mov hwnd1,eax
invoke FindWindowEx ,hwnd1, 0, CTEXT("#32770"), 0
mov hwnd2,eax
invoke GetDlgItem ,hwnd2, 1356
mov hwnd3,eax
invoke GetDlgItem ,hwnd2, 1345
mov hwnd4,eax
invoke GetDlgItem ,hwnd1, 1343
mov hwnd5,eax
invoke SendMessage,hwnd3,WM_SETCURSOR,0,0
invoke GetDlgItemText,hWnd,IDC_EDT ,addr sextemp,10 ;取用户输入到文本
invoke SendMessage,hwnd3,CB_ADDSTRING,0, addr sextemp
;HKM_SETHOTKEY
mov idx,eax
invoke SendMessage,hwnd3,CB_SETCURSEL,idx,0
invoke SendMessage ,hwnd4, WM_GETTEXT, 10,addr ls
invoke SendMessage ,hwnd4, WM_SETTEXT, 0, addr ls
invoke SendMessage,hwnd5,BM_CLICK, 0, 0
jmp retTrue
.else
invoke MessageBox,0,CTEXT("请先打开QQ个人设置窗口！"),CTEXT("提示"),MB_OK
.endif
.endif
retTrue:
mov eax,TRUE
ret
_ProcDlgMain endp
;********************************************************************
start:
invoke GetModuleHandle,NULL
mov hInstance,eax
invoke DialogBoxParam,eax,DLG_MAIN,NULL,offset _ProcDlgMain,0 ;显示对话框
invoke ExitProcess,NULL
;********************************************************************
end start
|
能力值：
( LV2，RANK：10 )
|
-
-
15 楼
强，可以提供多个选择啊。如魔，妖什么的。更好，气气QQ。
|
能力值：
( LV4，RANK：50 )
|
-
-
22 楼
试过了，强啊！有的地方不明白，能否解释下啊！
CTEXT("#32770")，还有1343，1345，1356几个数据是怎么来的啊？恕我愚昧。
还有，那个修改的数据应该会返回保存到服务器上吧？
这个我也不明白 希望楼主能解释下 ?
我用spy++ 看不到control identifier 1343 1345 1356啊 ....
|
