引用这个单元,看看他公布的 函数,就知道啦,可以取2000 的*<br>采用了线程注入。<br>unit ReadWndText;<br><br>interface<br><br>uses<br> Classes, Windows, Messages;<br><br>const<br> MAX_THREAD_SIZE = $FF * $4;<br> // type define,here<br>type<br> TSendMessageProc = function(hWnd: THandle;<br> uMsg: UINT;<br> wParam: LongInt;<br> lParam: LongInt): LRESULT; stdcall;<br> TThreadData = record<br> hWnd: THandle;<br> AddrOfSendMSG: TSendMessageProc;<br> Text: Pointer;<br> TextLen: Integer;<br> end;<br> PThreadData = ^TThreadData;<br> // export function define,here<br>function ReadWindowText(hWnd: THandle; buf: PChar; var len: Integer): Boolean;<br><br>implementation<br><br>function threadFunc(P: Pointer): DWORD; stdcall;<br>var<br> PData: PThreadData;<br>begin<br> if (P = nil) then<br> begin<br> Result := 0;<br> Exit;<br> end;<br> PData := PThreadData(P);<br> PData^.AddrOfSendMSG(PData^.hWnd,<br> WM_GETTEXT,<br> PData^.TextLen,<br> LongInt(@PData^.Text));<br> Result := PData^.TextLen;<br>end;<br><br>function ReadWindowText(hWnd: THandle; buf: PChar; var len: Integer): Boolean;<br>var<br> threadID: DWORD;<br> ProcID: DWORD;<br> hProc: THandle;<br> pThreadAddr: Pointer;<br> pParamAddr: Pointer;<br> pTextBuf: Pointer;<br> dwThreadID, dwBufWrite, dwBufRead: DWORD;<br> hThread: THandle;<br> bWrite: BOOL;<br> pParam: PThreadData;<br> hMod: THandle;<br>label<br> Cleanup;<br>begin<br> GetWindowThreadProcessId(hWnd, ProcID);<br> if (ProcID = 0) then<br> begin<br> Result := False;<br> Exit;<br> end;<br> hProc := OpenProcess(PROCESS_ALL_ACCESS, False, ProcID);<br> if (hProc = 0) then<br> begin<br> Result := False;<br> Exit;<br> end;<br> // alloc a space in object process virtual memory<br> pThreadAddr := VirtualAllocEx(hProc,<br> nil,<br> MAX_THREAD_SIZE,<br> MEM_COMMIT or MEM_RESERVE,<br> PAGE_EXECUTE_READWRITE);<br> if (pThreadAddr = nil) then<br> begin<br> Result := False;<br> goto Cleanup;<br> end;<br> // write address of threadFunc in virtual memory<br> bWrite := WriteProcessMemory(hProc,<br> pThreadAddr,<br> @threadFunc,<br> MAX_THREAD_SIZE,<br> dwBufWrite);<br> if not bWrite then<br> begin<br> Result := False;<br> goto Cleanup;<br> end;<br> //<br> hMod := LoadLibrary('User32.dll');<br> //<br> pTextBuf := VirtualAllocEx(hProc,<br> nil,<br> len,<br> MEM_COMMIT,<br> PAGE_EXECUTE_READWRITE);<br> pParamAddr := VirtualAllocEx(hProc,<br> nil,<br> sizeof(TThreadData),<br> MEM_COMMIT,<br> PAGE_EXECUTE_READWRITE);<br> GetMem(pParam, sizeof(TThreadData));<br> pParam^.hWnd := hWnd;<br> pParam^.Text := pTextBuf;<br> pParam^.AddrOfSendMSG := GetProcAddress(hMod, 'SendMessageA');<br> pParam^.TextLen := len;<br><br> if (pParamAddr = nil) then<br> begin<br> Result := False;<br> goto Cleanup;<br> end;<br> bWrite := WriteProcessMemory(hProc,<br> pParamAddr,<br> pParam,<br> sizeof(TThreadData),<br> dwBufWrite);<br> if not bWrite then<br> begin<br> Result := False;<br> goto Cleanup;<br> end;<br> //<br> hThread := CreateRemoteThread(hProc, nil, 0, pThreadAddr, pParamAddr, 0,<br> dwThreadID);<br> if (hThread = 0) then<br> begin<br> Result := False;<br> goto Cleanup;<br> end;<br> WaitForSingleObject(hThread, INFINITE);<br> ReadProcessMemory(hProc, pParamAddr, pParam, sizeof(TThreadData), dwBufRead);<br> if (dwBufRead <= 0) then<br> begin<br> Result := False;<br> Exit;<br> end;<br> CopyMemory(buf, @pParam^.Text, Len);<br> Result := True;<br> Cleanup:<br> if (pTextBuf <> nil) then<br> VirtualFreeEx(hProc, pTextBuf, MAX_THREAD_SIZE, MEM_RELEASE);<br> if (pParamAddr <> nil) then<br> VirtualFreeEx(hProc, pParamAddr, sizeof(TThreadData), MEM_RELEASE);<br> if (pThreadAddr <> nil) then<br> VirtualFreeEx(hProc, pThreadAddr, MAX_THREAD_SIZE, MEM_RELEASE);<br> if (hProc <> 0) then<br> CloseHandle(hProc);<br> if (hMod <> 0) then<br> FreeLibrary(hMod);<br>end;<br><br>end.<br><br>