2024年6月14日发(作者：)

【原创】hookQQ-API拦截QQ聊天记录

作 者: yinchengak

时 间: 2012-06-13,20:37:56

链 接: /?t=152085

大家先对QQ采用ollydbg调试QQ，

分析出相关QQ内部函数

//?GetMsgTime@Msg@Util@@YA_JPAUITXMsgPack@@@Z

//?GetSelfUin@Contact@Util@@YAKXZ

//?GetGroupName@Group@Util@@YA?AVCTXStringW@@K@Z

//?GetDiscussName@Group@Util@@YA?AVCTXStringW@@K@Z

//?GetGroupMemLongNickname@Group@Util@@YAHKKAAVCTXStringW@@@Z

//?GetGroupMemShowName@Group@Util@@YA?AVCTXStringW@@KK@Z

//?GetSelfUin@Contact@Util@@YAKXZ

然后我们写一个ＤＬＬ来注射到ＱＱ内部，调用ＱＱ相关函数，获取相关QQ聊天记录信息，然后将QQ聊

天记录用sendmessage发送出来。

DLL代码如下

代码:

#include "stdafx.h"

#include "QQspy.h"

#include "detours.h"

#pragma comment (lib, "")

#include

#include

#pragma comment (lib, "")

#ifdef _DEBUG

#define new DEBUG_NEW

#undef THIS_FILE

static char THIS_FILE[] = __FILE__;

#endif

//

// Note!

//

// If this DLL is dynamically linked against the MFC

// DLLs, any functions exported from this DLL which

// call into MFC must have the AFX_MANAGE_STATE macro

// added at the very beginning of the function.

//

// For example:

//

// extern "C" BOOL PASCAL EXPORT ExportedFunction()

// {

// AFX_MANAGE_STATE(AfxGetStaticModuleState());

// // normal function body here

// }

//

// It is very important that this macro appear in each

// function, prior to any calls into MFC. This means that

// it must appear as the first statement within the

// function, even before any object variable declarations

// as their constructors may generate calls into the MFC

// DLL.

//

// Please see MFC Technical Notes 33 and 58 for additional