½ûÖ¹SnagIt½ØͼÈí¼þץȡÊÓƵÎÊÌâ¡¡½ñÌì´ò¿ªÒ»¸öÊÓƵ½Ì³Ì,Ïë½ØÈ¡¾«²ÊµÄÊÓÆÁ¡£µ«ÎÒÓÃSnagitץȡÆÁÄ»ÊÓÆÁʱ£¬¸ÃexeÊÓÆÁÈí¼þµ¯³ö:¼ì²âµ½Â¼ÏñÈí¼þsnagit32.exe...È»ºóÍ£ÁË....ÄѵÀ»¹ÒªÄÃÊÖ»úÅÄÂ𣿿϶¨²»¸É£¬ÓеçÄÔ»¹ÓÃÊÖ»ú£¬Ð§¹û»¹²»ºÃ...ÆÆÖ®....¼ì²âÎļþ£º·¢ÏÖÔÚC:\DocumentsandSettings\Administrator\LocalSettings\ApplicationData\lib϶àÁËC:\DocumentsandSettings\Administrator\LocalSettings\ApplicationData\libµÄĿ¼2015-01-3110:29<DIR>.2015-01-3110:29<DIR>..2015-01-3017:18299,864cuspro.dll2015-01-3017:1855,264EDOG.dll2015-01-3017:1839,256global.dll2015-01-3017:183,054,128libwzplayer2.dll2013-08-0515:047,419,224Player.dll2015-01-3013:106,899,120temp.dll2015-01-3017:1858,712WzPlayerControl.dll2015-01-3017:18274,608wzplayerExt.dll¼ì²â½ø³Ì£¬·¢ÏÖ¶àÁ˸öplayer.dll½ø³Ì,HookÆäEnumWindows,È»ºó¾Í²»¾¯¸æÁË,snagitÔËÐÐÕý³£µ«´ò¿ª¿´£¬ÓÐÉùÒôÎÞͼÏñ.ÓÃPrintScreen¼ü£¬×¥È¡Í¼Æ¬£¬×¥È¡µÄͼƬÊǺÚÉ«µÄ±³¾°£¬¸ù±¾²»ÐС£°Ù¶ÈÁËһϣ¬½â¾ö°ì·¨ÈçÏÂ:¿ØÖÆÃæ°å-->ÏÔʾ-->ÉèÖÃ-->¸ß¼¶-->ÒÉÄѽâ´ð-->Ó²¼þ¼ÓËÙ-->ÎÞ,Ò»ÇÐOK!!!¸½MASMÔ´´úÂë:.486.modelflat,stdcalloptioncasemap:noneincluded:\masm32\include\windows.incincluded:\masm32\macros\macros.asmincluded:\masm32\include\kernel32.incincluded:\masm32\include\ws2_32.incincludelibd:\masm32\lib\ws2_32.libincludelibd:\masm32\lib\kernel32.libincluded:\masm32\include\user32.incincludelibd:\masm32\lib\user32.libHOOKAPIstructabyte?PMyapiDWORD?dBYTE?eBYTE?HOOKAPIendsWriteApiproto:DWORD,:DWORD,:DWORD,:DWORD.data.data?NIDdd?WProcessdd?hackerHOOKAPI<>CommandLineLPSTR?Papi1DWORD?ApiBak1db10dup(?)Apinewdb10dup(?)hwnddd?snumdb?.codeF2procb1:DWORD,b2:DWORDmoveax,TRUEretF2endpDllEntryprochInst:HINSTANCE,reason:DWORD,reserved1:DWORD.ifreason==DLL_PROCESS_ATTACH;µ±DLL¼ÓÔØʱ²úÉú´Ëʼþmoveax,5000movNID,eaxinvokeGetForegroundWindowinvokeSetWindowText,eax,SADD("¼ÓÔØDLL³É¹¦")invokeGetCommandLinemovCommandLine,eaxmovhacker.a,0B8hmovhacker.d,0FFh;jmpmovhacker.e,0E0h;eaxinvokeGetCurrentProcess;È¡½ø³Ìα¾ä±úmovWProcess,eax;·Àֹû¼ÓÔØÒªÔ¤ÏȼÓÔØDLLinvokeGetModuleHandle,SADD("user32.dll").ifeax==NULLinvokeLoadLibrary,SADD("user32.dll").endifinvokeGetProcAddress,eax,SADD("EnumWindows");±ØÐë¿ÉÒÔÆô¶¯ÆÁĻ¼Ïñ¶øÎÞ¾¯¸æ,µ«Â¼³öµÄÊÓÆÁÎÞͼÏñ£¬ÓÐÉùÒô¡£;½â¾öijЩÊÓÆÁÎÞͼÏñ¿ØÖÆÃæ°å-->ÏÔʾ-->ÉèÖÃ-->¸ß¼¶-->ÒÉÄѽâ´ð-->Ó²¼þ¼ÓËÙ-->ÎÞmovPapi1,eax;±£´æAPIµØÖ·invokeReadProcessMemory,WProcess,Papi1,addrApiBak1,8,NULL;±¸·ÝÔAPIµÄÇ°8×Ö½Úmovhacker.PMyapi,offsetF2;0x0000,ÕâÀïÉèÖÃÌæ´úAPIµÄº¯ÊýµØÖ·invokeWriteApi,WProcess,Papi1,addrhacker,sizeHOOKAPI;HOOKAPIinvokeReadProcessMemory,WProcess,Papi1,addrApinew,8,NULL;±¸·ÝÏÖÔÚAPIµÄÇ°8×Ö½Ú.endif.ifreason==DLL_PROCESS_DETACH;invokeWriteApi,WProcess,Papi1,addrApiBak1,8;»¹ÔAPI.endifmoveax,TRUEretDllEntryEndpWriteApiprocProcess:DWORD,Papi:DWORD,Ptype:DWORD,Psize:DWORDLOCALmbi:MEMORY_BASIC_INFORMATIONLOCALmsize:DWORDinvokeVirtualQueryEx,Process,Papi,addrmbi,SIZEOFMEMORY_BASIC_INFORMATIONinvokeVirtualProtectEx,Process,mbi.BaseAddress,8h,PAGE_EXECUTE_READWRITE,addrmbi.ProtectinvokeWriteProcessMemory,Process,Papi,Ptype,Psize,NULLPUSHeaxinvokeVirtualProtectEx,Process,mbi.BaseAddress,8h,PAGE_EXECUTE_READ,addrmbi.ProtectpopeaxretWriteApiendpEndDllEntry½«ÒÔÉÏ´úÂë´æΪpo.asm±àÒë:d:\masm32\bin\ml/c/coffpo.asmd:\masm32\bin\Link/SUBSYSTEM:WINDOWS/DLLpo.objÄãµÄmasm32ÒªÔÚd:\ÔٰѱàºÃµÄpo.dll×¢Èëplayer.dll¾ÍÐÐÁ˽¨Ò飺ÔÚ·´ÆÁĻ¼Ïñʱ»¹Òª·ÀHOOKAPI,ÕâÑù¿ÉÒÔÌá¸ßÄãÃǵķ´ÆÁĻ¼Ïñˮƽ¡£