??xml version="1.0" encoding="utf-8" standalone="yes"?>
BHO兌原理 (BHO兌的是SHDOCVW,也就是说不只兌IE,下面全部用IE来说?
1.IE的窗口打开?先寻找HKLM下的SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ 里的CLSID,q些CLSID,都对应着相应的BHO插gQ然后根据这个CLSID到HKCR下的CLSIDs里找到此插g的信息,包括文g位置{?br>2.IEҎ扑ֈ的CLSID信息创徏 BHO 对象,q且查找 IObjectWithSite 接口. (q个接口非常?只有SetSite和GetSite两个Ҏ)
3.IE把IWebBrowser2(览器插?传到 BHO ?SetSite ҎQ用户在此方法中可挂载自q事g处理Ҏ?br>4.H口关闭?IE?null 传到 BHO ?SetSite ҎQ此Ҏ用来L挂蝲的事件处理方法?/p>
~写BHO程
1.创徏IObjectWithSite昑ּ接口Q创?COM cdQ实现承IObjectWithSite接口
2.实现此接口ƈ在SetSiteҎ里加上所要挂载的事g
3.处理事g
4.注册此BHO到注册表中HKLM下的Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects;(HKCR下的CLSIDs是根据上面的路径自动注册?
5?net 下须讄此BHO目?配置属性_>生成 中ؓInterop注册为TrueQ这h能将.net cd文g注册到COM
删除BHO
打开注册表项?HKLM下的Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\Browser Helper Objects 可以看到下面有一些CLSID?q些值对应相关的插g,点击可以在默认值后看到相关插g的名U?可以复制相关CLSID到注册表中搜索相关CLSID,扑ֈ后打开InprocServer32可以看到相关文g的\?至于DLL文g{可以用UEDIT32.exe工具打开查看具体信息,当然也可以用修改E序cȝeXeScope.exe研究一?
h据具体情况删除相关键值和相关文g!
REF:
BHO 的编?nbsp;
VCKBase 关于IE ~程文档中心
C++中用BHO来屏蔽特定网?/a>
览器集成教?自定义浏览器
当用IE 打开q个面的时? IE 首先Ҏ classid 在注册表?HKEY_CLASS_ROOT)查找其安装信? 如果未找? 则IE Ҏcodebase ȝ是否有对应的控g存在; 如果q是不行, 则会一些控件注册服务器联系(列表?HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\CodeBaseSearchPath 可以扑ֈ ), 一般是 http://activex.microsoft.com/objects/ocget.dll , http://codecs.microsoft.com/isapi/ocget.dll , 然后服务器会告诉IE 从哪里去下蝲.
FROM : http://oreilly.com/catalog/malmobcode/chapter/ch11.html
2. ActiveX 控g是如何启动的
创徏一个控件有很多U方?
CoCreateInstance, CoGetInstanceFromFile, CoGetInstanceFromIStorage
CoCreateInstanceEx
CoGetClassObjectFromURL , CoGetClassObject
CoGetObject, DllGetClassObject {?
基本调用序好像?
(CoGetInstanceFromFile, CoGetInstanceFromIStorage ) -> CoCreateInstance
CoCreateInstanceEx
CoGetClassObjectFromURL -> CoGetClassObject
其他没有试q?.. :9
IE 创徏控g的时候会调用 CoGetClassObjectFromURL -> CoGetClassObject 的顺序进? 而不是直接调?CoCreateInstance 或?CoCreateInstanceEx) , 但是免不了控件会自己调用 CoCreateInstanceEx, 比如Real 控g在创建的时候会调用Dx 的组件等.
iframe 跨域讉K(cross frame) zz from : http://codecentrix.blogspot.com/2007/10/when-ihtmlwindow2getdocument-returns.html
׃安全性限? 为防止跨域脚本攻? 当frames 跨域的时? IHTMLWindow2::get_document 调用返?E_ACCESSDENIED .
下面函数 HtmlWindowToHtmlDocument 对于跨域的frame 通过 IHTMLWindow2 -> IID_IWebBrowserApp -> IHTMLWindow2 l过了限?
== 预处理操作符(Preprocessor Operators) ==
Stringizing operator (#)
Causes the corresponding actual argument to be enclosed in double quotation marks
参数变成字W串 : #x -> "x"
Charizing operator (#@)
Causes the corresponding argument to be enclosed in single quotation marks and to be treated as a character (Microsoft Specific)
参数变成字W变?: #x -> 'x'
Token-pasting operator (##)
Allows tokens used as actual arguments to be concatenated to form other tokens
参数和前面的符L?: token##x -> tokenx
== 预定义宏(Predefined Macros) ==
__FILE__
__LINE__
#define LINE1(x) #x
#define LINE(x) LINE1(x)
#define TODO(msg) message ( __FILE__ "(" LINE(__LINE__) "): [TODO] " #msg )
#define NOTE(msg) message ( __FILE__ "(" LINE(__LINE__) "): [NOTE] " #msg )
集成览器控件的最单的Ҏ是找一个支持ActiveX的集成开发环境,在工L中加入Microsoft Web Browserq个控gQ往表单上拖一个这个控件就可以完成工作。你甚至可以用集成开发环境添加ActiveX的事件处理函数。如果要直接导入ActiveX的话Q徏议用mehrcpp的vbMHWB控gQ?a >http://www.codeproject.com/atl/vbmhwb.aspQ。这个控件在览器控件的基础上进行了扩展Q暴露了很多底层接口?/p>
通常导入ActiveX可以满_部分需?nbsp; Q但是有些类库中也集成了览器控Ӟq且提供了更多的功能Q例如MFC的CHTMLView和CDHtmlDialogQATL的HTML ControlQ以?Net 2.0中的Windows.Forms.WebBrowser。如果用Visual C++来进行非托管~程Q那么徏议用MFC或者ATL的封装类Q或者用vbMHWB控g。托编E中当然首选Windows.Forms.WebBrowser。除非这些类的BUG影响C应用E序的开发,否则使用q些功能更加强大的封装类?/p>
在用浏览器控g及其装cȝ时候要注意一些已知问?/p>
在集成浏览器控g之后Q可以完成基本的|页览Q但是对于不同的dQ也需要进一步的处理Q例如设|控件的属性、ؓ控gd事g处理、操作HTML文档{等?/p>
q在集成开发环境中可以很容易地讄Q也可以自己实现容器来设|,但是CHTMLViewq样的封装类没有q个选项Q?a >http://support.microsoft.com/kb/197921Q?/p>
集成开发环境中可以也很Ҏ地添加浏览器的事件处理函数。比较常用的事g包括
通常HTML分析和浏览器自动化程序都需要分析网늚l构Q找到需要操作的元素。这需要对|页的结构进行分析,扑ֈ目标元素的标识方法?一些常用的操作包括Q?
在页面包含框架的时候,可能需要跨框架讉KHTML文档。可以通过查询框架元素所支持的IWebBrowser2接口或者IHTMLWindow2接口来访问框架中的文档(http://support.microsoft.com/kb/196340Q,但是也有可能因ؓ安全讄而无法访?http://support.microsoft.com/kb/167796)?/p>
在浏览器控g中显C其它类型的文档Ӟ可以用IWebBrowser2的document属性来讉KActiveX文档Q例如在昄Microsoft WordӞIWebBrowser2的document属性就是Word的文档对象,在显C文件夹的时候,IWebBrowser2的document属性就是文件夹对象{等?/p>
览器控件在创徏时会查询ActiveX容器的IOleClientSite的实现的如下接口Q?strong>IDocHostUIHandler, IDocHostUIHandler2 and IDocHostShowUI?/p>
虽然在无法自定义ActiveX容器的情况下可以用ICustomDoc::SetUIHandler来挂接IDocHostUIHandler到浏览器控gQ但是这样也会造成内存泄漏Q?a >http://support.microsoft.com/kb/893629Q。一些类库,例如MFC、ATL?Netcd都实CIDocHostUIHandler接口?/p>
除了专门用于览器用途的E序之外Q通常都需要自定义览器控件的上下文菜单。这需要实现IDocHostUIHandler::ShowContextMenu。通常的实现包括完全禁用上下文菜单、完全替换上下文菜单、以及修攚w分上下文菜单。经常被从上下文菜单中移除的菜单包含查看源代码、刷新和属性。一U替代的Ҏ是在容器中过滤右键消息(http://support.microsoft.com/kb/231578Q?/p>
与浏览器相比Q一些Internet Explorer的宿d能在览器控件中q不是默认启用。在某些场合Q默认启用的宿主功能可能q预期。这旉要实现IDocHostUIHandler::GetHostInfo。可以通过实现IDocHostUIHandler::GetHostInfo来自定义的功能包括:
在用浏览器控g来做数据录入界面的场合,需要更Ҏ览器控g默认的Tab键处理得用户可以用Tab键切换到容器中的其他控g。这需要实现IDocHostUIHandler::TranslateAccelerator来自定义览器控件的快捷键处理。对于MFCq样用消息钩子来做消息预处理的可自定义容器来_也可以用PreTranslateMessage来过滤F5键盘消息Q而不是实现IDocHostUIHandler::TranslateAccelerator?
在脚本中调用应用E序Ҏ览器控g的扩展,q需要实现IDocHostUIHandler::GetExternal。?Net的WebBrowser控g的话讄ObjectForScripting属性就可以了?/p>
对于用浏览器控g来做HTML分析器的场合来说Q有旉要屏蔽脚本生的消息框。这需要实现IDocHostShowUI::ShowMessageQ或者设|浏览器的Silent属性?/p>
另外Q浏览器也会查询IOleClientSite来获得其它的服务信息Q例?/p>
对于用浏览器控g来做HTML分析器的场合来说Q有旉要禁用浏览器的脚本、ActiveX或者图片下载。这可以通过在容器中实现IDispatchQ处理DISPID_AMBIENT_DLCONTROL来做刎ͼhttp://msdn.microsoft.com/library/default.asp?url=/workshop/browser/overview/Overview.aspQ?/p>
看来ȝ览的控制ƈ不能用这U方法来控制Q?a >http://support.microsoft.com/kb/247336Q。不q你可以自己~写一个HTTP层传?BINDF_OFFLINEOPERATION标志 Q?a >http://groups-beta.google.com/group/microsoft.public.inetsdk.programming.mshtml_hosting/msg/76bf4910a289d4b3Q?/p>
在浏览器控g中java程序可能不能正常运行,如果使用Sun JVM1.4之后的版本,可以用SetEnvironmentVariable 来设|JAVA_PLUGIN_WEBCONTROL_ENABLE?来启用Sun JVM?/p>
默认情况下在面载入时会有点d。屏蔽点d的一个方法是在程序运行时修改注册表键Q?a >http://support.microsoft.com/kb/201901Q,另一个方法是浏览器控g隐藏Q在调用Navigate2之后再显C,但是q也需要锁定控件的更新区域QLockWindowUpdateQ以避免闪烁。在IE7中,也可以调?CoInternetSetFeatureEnabled函数Q传递FEATURE_DISABLE_NAVIGATION_SOUNDS来禁用浏览时的声韟?/p>
在需要用代理服务器Ӟ有可能需要在应用E序中用非默认的代理服务器讄。这可以通过调用UrlMkSetSessionOption来实现?br>
Overriding IInternetSecurityManager in a CComControl class
CAxWindow implements IObjectWithSite interface (get it with QueryHost
method). Call SetSite passing your implementation of IServiceProvider.
At this point, AxWin will forward all QueryService calls from hosted
WebBrowser to your implementation.
1. Ҏie 症状
当ie 讉K恶意面的遭受攻L, 光要表现是
a. 内存使用
b. cpu 使用?br>所以实时监这些参数可以基本判断是否有d
2. Ҏ行ؓ
shellcode 如果被执? 那么肯定会进行木马下载执行等步骤. 一般纯shellcode 里面的内容不会很? 所以不可能完成很多复杂的攻?
win32 创徏q程的API调用串是:
WinExec/ShellExecuteA/CreateProcessA->CreateProcessInternalA->CreateProcessInternalW->ZwCreateProcessEx
?br>CreateProcessW->CreateProcessInternalW->ZwCreateProcessEx
win32 要执行下载的API 主要是wsock32.dll ?
recv , recvfrom
所以对上述API q行拦截, 一般可以检到是否有ie 是否被攻? 但是q个只能在攻L功后, shellcode 执行后才能被到
3.
拦截一些操作注册表, 创徏H口{API , 可以做到防止被修改主? 弹出H口{?
利用ms 的Detours 可以很容易的实现对系l?API 的hook
http://blog.csdn.net/hu0406/archive/2008/03/05/2150358.aspx
http://blog.csdn.net/hu0406/archive/2008/03/05/2150351.aspx
http://www.moon-soft.com/doc/2288.htm
http://blog.csdn.net/dedodong/archive/2006/10/07/1323925.aspx
[ [JavaScript中的堆风水]|[ http://www.team509.com/download/Heap%20Feng%20Shui%20in%20JavaScript_en_cn.htm ] ] ie 堆喷?
[ [也聊inline-hook]|[ http://blog.tom.com/tigerkings941220/article/9211.html ] ] 介绍?q程自n保护(通过拦截LoadLibraryW)和IE漏洞防护(通过拦截CreateProcessInternalW)
[ [maxthon2(遨游2) mxsafe.dll对网|马的防护以及l过]|[ http://hi.baidu.com/54nop/blog/item/b52cff6e713964d980cb4a9e.html ] ] 讨论了maxthon2 防止|页木马的策? 拦截 ZwCreateProcessEx/ZwCreateProcess, ZwWriteVirtualMemory, LoadLibraryExW, CreateProcessInternalW )以及Ҏ{略, 其实q个只是hook & unhook 的游戏了..
[ [议PE病毒技术]|[ http://blog.vckbase.com/windowssky/archive/2007/04/17.html ] ] 介绍?pe 病毒 & win32 q程加蝲内部
[ [360安全卫士E序员志愿者]|[ http://blog.csdn.net/dedodong/archive/2006/10/07/1323925.aspx ] ] 通过拦截 NtCreateProcessEx/NtCreateProcess 实现?""~写一个程序,在此E序中运行a.exeQƈ使得a.exe认ؓ是由explorer.exeq行它的"""
[ [d恶意软g--清除和保护你的网站的技巧]|[ http://www.googlechinawebmaster.com/labels/badware.html ] ] google 上的Ҏ意Y?badware) 的介l?
[ [StopBadware Blog]|[ http://blogs.stopbadware.org/articles/2007/11 ] ]
?U方?
a)
创徏CInternetSession 对象 -> 调用 CInternetSession::OpenURL 该函数解析URLQ然后打开与URL指定的服务器q接Q同时返回一个只ȝCInternetFile对象 -> CInternetFile::Read d文g -> 析构CInternetSession
b)
创徏CInternetSession 对象 -> 调用 CInternetSession::GetHttpConnection
q回CHttpConnection 对象 -> 调用CHttpConnection::OpenRequest 创徏一个CHttpFile对象 -> CHttpFile::SendRequest 发送连接请?-> CHttpFile::QueryInfo 获取HTTP 信息(比如文g大小, ETAG{? | CInternetFile::Read d文g -> 析构CInternetSession
在上q过E中, 如果出现错误会抛?CInternetException 异常
另外在打开链接? 可以q行如下讄
CInternetSession::SetOption d或设|?InternetQuery 选项 (如超时或重试ơ数Q?br>CInternetSession::EnableStatusCallback 讄回调函数监视session状?br>CHttpFile::AddRequestHeaders 讄HTTP h?需要在CHttpFile::SendRequest 前调?
2. 实现断点l传
断点l传其实是通过在HTTP h头中讄要下载的文g区间来实? 一个典型的HTTP h头是
GEThttp://class/download.microtool.de:80/somedata.exe
Host:download.microtool.de
Accept:*/*
Pragma:no-cache
Cache-Control:no-cache
Referer:http://class/download.microtool.de/
User-Agent:Mozilla/4.04[en](Win95;I;Nav)
Range:bytes=554554-
注意最后一行:Range:bytes=554554-Q格式ؓ:Range: bytes=起始位置 - l止位置Q也是_我们可以通过讄Httph头的讄起始l束位置Q来获取HTTP文g的某一部分?
3. Win32 WinInet API 实现
和MFC 的函数对? 执行下蝲操作大致需要的函数有:
InternetOpen是最先调用的函数Q它q回HINTERNET句柄Q习惯定义ؓhSessionQ即会话句柄, 相当于CInternetSession
InternetConnect使用hSession句柄Q返回的是httpq接句柄Q定义ؓhConnect, 相当?CInternetSession::GetHttpConnection
HttpOpenRequest使用hConnect句柄Q返回的句柄是httph句柄Q定义ؓhRequest, 相当?CHttpConnection::OpenRequest
HttpSendRequest(相当?CHttpFile::SendRequest)、HttpQueryInfo、InternetSetFilePointer和InternetReadFile都用HttpOpenRequestq回的句柄,即hRequest?/p>
CInternetSession::OpenURL 相当于实C InternetConnect & HttpOpenRequest & HttpSendRequest 3个函?
当这几个句柄不再使用Ӟ应该用函数InternetCloseHandle把它关闭Q以释放其占用的资源?
用WinInet开发Internet客户端应用指南(一Q?/a> http://www.vckbase.com/document/viewdoc/?id=545
用WinInet开发Internet客户端应用指南(二) http://www.vckbase.com/document/viewdoc/?id=546
使用 CInternetSession 装多线E?http 文g下蝲 http://www.vckbase.com/document/viewdoc/?id=1693
Http下蝲的断点箋?/a> http://sunyan331.spaces.live.com/blog/cns!89B9F8BF2575E281!947.entry
HTTP服务器上断点下蝲文g(里面有很不错的源? http://www.cnitblog.com/wangk/archive/2007/05/22/5942.html
~写断点l传和多U程下蝲(有源? http://www.bbbh.org/20060427/2620/
WinInet: implementing resuming feature http://www.clevercomponents.com/articles/article015/resuming.asp
(很详l的一个代码解?Retrieving a file via. HTTP http://www.codeproject.com/KB/IP/getwebfile.aspx
We can split up the working of MSN messenger into 2 phases
Authentication Phase
Instant Messaging Phase
The Authentication Phase involves logging into the MSN messenger server and also (friends) list retrieval in this case.
The Instant Messaging Phase involves sending/accepting requests for an Instant Messaging session and also sending/receiving messages.
The MSN messenger protocol is an ASCII based protocol. In other words the commands are in pure English !!!.The first phase involves connecting to an MSN messenger server .In this case we shall connect to the server 64.4.13.58 on port 1863(MSN messenger works through port 1863).
Once the connection is done we need to start the log in process. The first stage in this phase is the versioning stage. In this stage the client (in this case your app) lists/sends the versions that it can support to the server and waits for the server to respond.
VER 0 MSNP7 MSNP6 MSNP5 MSNP4 CVRO
In the MSN messenger protocol a "trial id" is sent along with every command. The trial id starts from 0 and is incremented every time the server responds successfully to the client's commands.
The server responds like this
VER 0 MSNP7 MSNP6 MSNP5 MSNP4
The Client and the server have agreed on a version in which they will communicate.
Next the client sends a request to the server asking it for the name of the security package it supports for authentication.
INF 1
Unlike Yahoo, Rediff and a few other Messengers MSN does not actually send the password as it is.It encrypts the password while sending it ensuring that your password will not be leaked out easily if somebody monitors your port.
The server responds with this
INF 1 MD5
Here MD5 is the name of the security package which the server currently supports.
Next the client sends the userid to the server
USR 2 MD5 I venky_dude@hotmail.com
Here the server does a check whether it contains all the relevant details about the user for authentication .If it does not then it sends the following reply
XFR 2 NS 64.4.13.55:1863 0
What the server says is that the client should connect to the Notification Server(NS) on 64.4.13.55 on port 1863. We close the current connection and repeat the steps while being connected to the new server i.e 64.4.13.55
(client) VER 3 MSNP7 MSNP6 MSNP5 MSNP4 CVRO
(server) VER 3 MSNP7 MSNP6 MSNP5 MSNP4
(client) INF 4
(server) INF 4 MD5
(client) USR 5 MD5 I venky_dude@hotmail.com
Now the server to which we are connected to has the relevant information about the user trying to log in. The server replies this way
USR 5 MD5 S 989048851.1851137130
The string which is sent by the server is the " MD5 Hash". It is a hash generated by the server and is used in the authentication process. The client then has to send the password which is encrypted using the MD5 algorithm.In effect the client has to send the unique MD5 equivalent of the MD5 hash i.e 989048851.1851137130 in this case and the password combined .i.e. MD5 equivalent of (hash+pass). In this case it turns out to be 3b7926d277068ec49576a0c40598ff21.
USR 6 MD5 S 3b7926d277068ec49576a0c40598ff21
If the password is right then the server replies with this
USR 6 OK venky_dude@hotmail.com venkat
Here the last word is the nickname/name by which the user is known.
In the new version of the protocol (MSNP7) the server sends additional data like some general information about the user and a authentication code something similar to a cookie which can be used for various other functions.
MSG Hotmai Hotmail 362
MIME-Version: 1.0
Content-Type: text/x-msmsgspro file; charset=UT
LoginTime: 1011252477
EmailEnabled: 1
MemberIdHigh: 84736
MemberIdLow: - 1434729391
lang _preference: 103
preferredEmai l: venky_dude@hotmail.com
country: IN
PostalCode:
Gender: M
Kid:0
Age: 22
sid: 517
kv: 2
MSPAuth: 2AAAAAAAADU0p4uxxxJtDJozJSlUTS0i7YpwnC9PUHRv56YKxxxCTWmg$$
Now we are logged into the server but our status is still offline. We need to change our status to online in order to send and receive messages. The client does this in the following way
CHG 7 NLN
The server replies with friends who are online and in various states.
CHG 7 NLN
ILN 7 NLN btxxxe@hotmail.com nick
ILN 7 AWY wmpyxxx@msn.com mike
ILN 7 BSY tehpxxpxx@hotmail.com yeaxxx
MSG Hotmail Hotmail 223
MIME-Version: 1.0
Content-Type: text/x-msmsgsinitialemailnotification; charset=UTF-8
Inbox-Unread: 293
Folders-Unread: 0
Inbox-URL: /cgi-bin/HoTMaiL
Folders-URL: /cgi-bin/folders
Post-URL: http://www.hotmail.com
The next command to be sent to the server pertains to the version of the client currently being used.The client send to the server it's version number and also information about the machine like the OS and the build.
CVR 8 0x0409 win 4.10 i386 MSMSGS 4.5.0127 MSMSGS
Here 0x409 win 4.10 i386 specifies that the client is running win98 on a intel microprocessor, and MSMSGS 4.5.0127 MSMSGS here specifies the version and build no of msmsgs.exe (basically the version no of MSN messenger).
The server responds with the url to download the latest version and some other info
CVR 8 4.5.0127 4.5.0127 1.0.0863 http://download.microsoft.com/download/msnmessenger/install/4.5/win98me/en-us/mmssetup.exe http://messenger.microsoft.com
It is not necesarry to send the CVR command, the messenger protocol will function properly regardless of this command being sent
To get a list of people who are in our friends list we may send this command
LST 9 RL
On sending this command the server will reply by sending the reverse list .The reverse list is basically a list of users who can see you when you are online and send you a message.You could alternatively also request for the forward list by sending LST 9 FL .The forward list contains a list of all users whom the user has added to his/her list.
The server responds this way
LST 9 RL 69 1 19 venky_dude@hotmail.com venkat
LST 9 RL 69 2 19 puxxxxx@hotmail.com PUJA
LST 9 RL 69 3 19 vancxxxxx@hotmail.com ramachandran
LST 9 RL 69 4 19 moxxxxx@hotmail.com chandramouli
LST 9 RL 69 5 19 v_n_xxxxx@hotmail.com Narayanaswamy
LST 9 RL 69 6 19 dexxxxx@hotmail.com Venkatesh
LST 9 RL 69 7 19 lousydxxxxx@hotmail.com deepika%20kalyani%20Vairam LST 9 RL 69 8 19 hexxxxxr@hotmail.com Hetchar%20Ramachandran
LST 9 RL 69 9 19 ambxxxxx@hotmail.com Aiyer
LST 9 RL 69 10 19 suxxx@hotmail.com Ganesh
LST 9 RL 69 11 19 deexxxxx@hotmail.com Deepak
LST 9 RL 69 12 19 anilxxxxx@hotmail.com anil
LST 9 RL 69 13 19 dixxxxx@hotmail.com <Diamond>
LST 9 RL 69 14 19 nvxxxx@hotmail.com giri
LST 9 RL 69 15 19 shxxx@hotmail.com Hari
LST 9 RL 69 16 19 radhikashuxxxxx@hotmail.com radhika
LST 9 RL 69 17 19 eskaxxxxx@hotmail.com kannan
LST 9 RL 69 18 19 shaxxxxx@hotmail.com Shankar
LST 9 RL 69 19 19 puneetagarxxxxx@hotmail.com puneet
*Every time a friend comes online the server(NS) sends us the following command
NLN 10NLN deaxxxx@hotmail.com Venkatesh
and when the friend goes offline the server sends us this
FLN 10 FLN deaxxxx@hotmail.com
With the MSNP7 protocol msn has introduced a new challenege authentication mechanism. The MSN server sends t a challenge key which the user has to authenticate succesfully in order for the session to continue.
CHL 0 20881396011366812350
The client has to send the md5 equivalent of this string which is formed by appending this hash with the string "Q1P7W2E4J9R8U3S5".So the final string which will be sent to the server will be the md5 equivalent of 20881396011366812350Q1P7W2E4J9R8U3S5
i.e MD5string(20881396011366812350Q1P7W2E4J9R8U3S5 )
So the client response would be something like this
QRY 18 msmsgs@msnmsgr.com 32
0212eaad0876afb8505859ca75d21a78
Here 18 is the trial id .Replace it by the appropriate trial id in your program .
The server will respond in the following way if the authentication is right
QRY 18
We have successfully logged into the MSN Messenger server. The Instant Messaging phase is next.
Instant Messaging in MSN Messenger is session based . The people in between whom the conversation is going to take place have to be in a session mode. We cannot send/receive messages unless we start a chat session with a user.
There are basically two methods in which a user can be in a chat session
User sends a chat session request
The client(user) sends a command to the server asking it for the address of the SwitchBoard(SB) server. All instant messaging conversation take place via the switchboard server.
XFR 9 SB
The server(SB) replies back with the ip address of the switchboard server(SB),the port on which to connect and a CKI hash. CKI is a security package and the client has to use the hash to connect to the switchboard server.
XFR 9 SB 64.4.13.88:1863 CKI 989487642.2070896604
Now we have to make another new connection this time to the switchboard server. Our previous connection to the MSN messenger server must be kept as it is. If we lose connection with that server we would log out.
After we have connected to the switchboard server(SB) we send the following command to the switchboard server.
USR 1 venky_dude@hotmail.com 989487642.2070896604
If the CKI hash sent by us is right the server(SB) responds back with this
USR 1 OK venky_dude@hotmail.com venkat
After this has been done the user has to "Call" the other user to the chat session. This is done by sending the following command.
CAL 2 deadxxx@hotmail.com
The server replies back with the a session id which it will pass on to the other user
CAL 2 RINGING 11717653
When the other user replies and is ready for a chat the server(SB) sends us this command
JOI deadlee@hotmail.com Venkatesh
This indicates that the other user has joined in the conversation and we are now ready to send and receive messages.
User receives a chat session request
When we are being invited to a chat session by a user the server(NS) send us the following message.
RNG 11742066 64.4.13.74:1863 CKI 989495494.750408580 deaxxxx@hotmail.com Venkatesh
Here the server(NS) sends us the session id ,the ip address of the SwitchBoard server to connect to,the port on which to connect to ,the CKI hash and the user trying to start a conversation with us.
Now we have to make another new connection this time to the switchboard server. Our previous connection to the MSN messenger server must be kept as it is. If we loose connection with that server we would log out.
We connect to the switchboard server and send the following command
ANS 1 venky_dude@hotmail.com 989495494.750408580 11742066
Here we send our login name ,the CKI hash that was sent to us and the session Id that was sent to us
The server responds back with
IRO 1 1 1 deaxxxx@hotmail.com Venkatesh
and
ANS 1 OK
We are now ready to send and receive messages.
Before sending/receiving messages let us see how the message is constructed.
When we are sending a message we build the header information in the following way
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
X-MMS-IM-Format: FN=Microsoft%20Sans%20Serif; EF=; CO=0; CS=0; PF=22
While sending a message we send it this way
MSG 2 N 137 MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
X-MMS-IM-Format: FN=Microsoft%20Sans%20Serif; EF=; CO=0; CS=0; PF=22
hello
Here 2 is the trial id which has to incremented each time we send a message. 137 is the total length of the message i.e length of the header and length of the actual message that we are sending in this case it is 'hello'.
While receiving the message it is more or less similar
Here is an example of a message received
MSG deaxxxx@hotmail.com Venkatesh 137
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
X-MMS-IM-Format: FN=Microsoft%20Sans%20Serif; EF=; CO=0; CS=0; PF=22
hello
When the other user is typing a message we receive the foll message
MSG deaxxxx@hotmail.com Venkatesh 100
MIME-Version: 1.0
Content-Type: text/x-msmsgscontrol
TypingUser: deaxxxx@hotmail.com
I guess now u guys are well on your way to make your own version of MSN messenger.Post your doubts/comments/message in the Forumn .Do visit my projects page for some cool vb & c++ codes
I'll keep adding to the protocol ,will try to put in addition functions like add/remove users ,rename user id,file transfer and voice chat, so keep checking back
References:
You could take a look at these sites for more information
This is the original protocol published by microsoft.
http://www.tlsecurity.net/Textware/Misc/draft-movva-msn-messenger-protocol-00.txt
This is the MD5 homepage where u can find programs/codes for doing the MD5 encryption
http://userpages.umbc.edu/~mabzug1/cs/md5/md5.html
2. ҎURL 协议调用cd象来处理
可以ҎURL 协议或者MIME type 注册不同的处理对?br>有两U方式:
a) 通过在注册表URL 协议与COM 对象兌
主要在注册表中的
HKEY_CLASSES_ROOT\PROTOCOLS\Handler # URL 协议
HKEY_CLASSES_ROOT\PROTOCOLS\Filter # Mime Filter
b) 通过临时注册cd象将URL 协议与其兌
// 注册
CComPtr<IInternetSession> spSession;
CComPtr<IClassFactory> spCFHTTP;
HRESULT hr = CoInternetGetSession(0, &spSession, 0);
hr = FilterFactory::CreateInstance(CLSID_HttpProtocol, &spCFHTTP);
hr = spSession->RegisterNameSpace(spCFHTTP, CLSID_NULL, L"http", 0, 0, 0);
// 反注?br>spSession->UnregisterNameSpace(spCFHTTP, L"http");
3. FilterFactory 的实现可以参?br>Asynchronous Pluggable Protocol Implementation with ATL
http://www.codeguru.com/cpp/com-tech/atl/misc/article.php/c37/
Internet Explorer下蝲文g的终极过?/a>
http://blog.csdn.net/111222/archive/2002/02/09/7255.aspx
通过Mime filter技术对|页源码q行qoQ监视下载文Ӟ
http://blog.csdn.net/lion_wing/archive/2006/06/27/839134.aspx
HTML代码qo技?/a>
http://blog.csdn.net/lion_wing/articles/534716.aspx
About Asynchronous Pluggable Protocols QMSDNQ?br>
Internet Explorer ~程qͼ九)在自q览器中嵌入Google工具?/a>
http://blog.csdn.net/CathyEagle/archive/2005/12/12/550698.aspx
?000分,高手q来动手试试Q如何提取AJAX里的HTML内容Q?br>http://topic.csdn.net/t/20061214/12/5230161.html
q里主要通过监视IE 的下载从而保存Google Map 的地图数据文? 通过监视http & text/html & application/javascript 的内Ҏ获取囄文gURL ?信息.. :)
Tree Control 不支持节点的用, 但是可以通过自绘实现, 主要如下:
1. 标记节点是否用. 可以?SetItemData & GetItemData 来设|?amp;获取节点数据
2. 在禁用的节点? 要过滤一些对节点操作, 如expanding, selecting, drag & drop {?
TVN_SELCHANGING 节点选中改变?br>TVN_ITEMEXPANDING 节点展开?br>TVN_BEGINDRAG 节点开始被拖拉
TVN_BEGINLABELEDIT 节点被编?/p>
3. 对禁用节点进行自? 用图?颜色禁用节点和其他节点q行区分
a) 直接?WM_PAINT 中进行自?(或对Tree Control的绘囄果进行修?
可以参? 如何在树型控件中使用背景位图
b) 相应 WM_OWERDRAW 事g
可以参? Outlook风格的单列用不同的颜色昄新邮件数
参?
MFC Tree Control: How to disable an item?
Setting color and font attribute for individual items
?http://www.80diy.com/home/20041120/19/3572410.html 看到几段关于COM 的类厂的?
"""
cd用来抽象lg的createq程Q客户不需要知道组件的详细情况Q也不需要知道类厂的详细情况Q只要知道CoCreateInstance可以创徏lg卛_。而CoCreateInstance内部调用DllGetClassObject来生成该lg的类厂,׃cd有组件的作者撰写,所以对lgcd谓知根知底,q厂来生成lg完全行得通,q样客户和组件就q一步划分,客户只能查询该组件是否支持某借口Q而对lg的其他情况一无所知,q样的划分可以ɾlg和客户间的耦合更小?br>"""
"""
lg如果某接口的全部方法都实现了,q该组件支持某接口Qcomq没有规定组件和接口之间是虚函数l承的关p,只是在c++中以q种Ҏ来实现最好而已?nbsp;
IClassFactory说穿了就是专门构造组件的c,q样做是Z抽象Q因为客h有必要知道组件是什么,如果由客L接构造组Ӟ客户势必要知道组件的信息Qcom失M它的意义了,所以,规定了一个类厂(支持IClassFactory接口Q,每个lg的类厂都很清楚ƈ且也只清楚该lg的信息,而客户只需要调用com库函数CoCreateInstance可以了?nbsp;
下面是流E图Q?nbsp;
CoCreateInstance -> CoGetClassObject -> DllGetClassObject -> new ClassFactory -> IClassFactory::CreateInstance() -> new Component
"""
q且?http://www.codeproject.com/com/comintro2.asp 也看到几D话
"""
每次实现lg对象cȝ时候,都要写一个旁c负责创建第一个组件对象类的实例。这个旁cd叫这个组件对象类的类工厂Qclass factoryQ,其唯一目的是创建COM对象。之所以要一个类工厂Q是因ؓ语言无关的缘故。COM本nq不创徏对象Q因为它不是独立于语a的也不是独立于实现的?
当某个客L惌创徏一个COM对象ӞCOM库就从COM服务器请求类工厂。然后类工厂创徏COM对象q将它返回客L。它们的通讯机制由函数DllGetClassObject()来提供?br>"""
?lt;COM 技术内q?gt; ? 对类厂的引入也有描述.
主要?
a. 在面向对象系l中, 对象创徏是非帔R要的, 因ؓ要用它必须先创建它. 所以尽可能灉|的创建对?component)
b. 在CoCreateInstance 创徏对象q程? 传给一共CLSID, 然后创徏成相应组? q返回所h的指? 其弊端在于无法提供给客户一U控制对象创E的Ҏ. (问题关键不在初始? 而是控制创徏对象q程)
c. IClassFactory2 成批的调用接?
2.
参考CoCreateInstance 的实现过E?
CoCreateInstance -> CoGetClassObject -[pȝ|lg代码]-> DllGetClassObject -> new ClassFactory -> IClassFactory::CreateInstance() -> new Component
因ؓ DllGetClassObject -> new ClassFactory -> IClassFactory::CreateInstance() -> new Component 都是lg所来实现的, 而系l调?CoCreateInstance 所提供的参? 和通过自己使用IClassFactory 来创建Component 的参数是没有变化? 所以如果省?ClassFactory 应该也可?
CoCreateInstance -> CoGetClassObject -[pȝ|lg代码]-> DllGetClassObject -> new Component
DllGetClassObject 完全可以完成<COM 技术内q说?gt; a. 灉|创徏对象, b. 控制创徏q程, c. IClassFactory2 , 而且q样子的实现也与语言无关.
所以感觉没有必要一定要用到IClassFactory q个接口
3.
因此在实现的时? 完全可以q样子的实现lg
CCoClass : public IA, public IB, public IClassFactory
{
......
}
DllGetClassObject()
{
new CCoClass
}
而不需要额外的用一个类单独的去实现IClassFactory . 好像ATL 默认的就是这么干? 提供了一个CComCoClass<CCoClass, &CLSID_CCoClass) 实现c?
q个是我的对COM 的IClassFactory 的理? 感觉没必要多一个这个东?
不知道大家是如何看待q个东西?)
2 类?br>H口类化是在窗口类——WNDCLASS或WNDCLASSEXQ非MFCcL念)U别q行的改变窗口类特征?/strong>?br>使用q程Q首先获得一个已存在的窗口类Q然后设|窗口类Q最后注册该H口cR?br>例:
WNDCLASSEX wc;
wc.cbSize=sizeof(wc); //Windows用来q行版本查的Q与H口特征无关
GetClassInfoEx(hinst,”XXXXXX”,&wc);
// hinst—定义窗口类XXXXXX的模块的句柄Q如为系l定义的H口c(如:EDIT、BUTTONQ则hinst=NULL.?
wc.lpszClassName = “YYYYYYY”;//必须改变H口cȝ名字
wc.hbrBackGround = CreateSolidBrush(RGB(0,0.0));//改变背景?
wc.lpfnWndProc = NewWndProc;//改变H口函数
……
RegisterClassEx(&wc);// 注册新窗口类
//使用H口c?
……
::CreateWindow(_T(“YYYYYYYY”,……)Q?
故超cd只能改变自己创徏的窗口的特征Q而不能用于由Windows创徏的窗口(如对话框上的按钮׃能进行超cdQ?。而子cd是实例别上的,只要能获得窗口的实例Q就可对其子cdQ这是唯一的子cd对于类化的优势。另外,凡是子类化可实现的,类化都可实玎ͼ不过类化用h较麻烦?
3. ȝ
Q?Q?子类化修改窗口过E函? 类化修改窗口类(新的H口cd)
Q?Q?子类化是在窗口实例别上的,类化是在窗口类QWNDCLASSQ别上的?
Q?Q?类化可以完成比子类化更复杂的功能,在SDK范畴上,可以认ؓ子类化是类化的子集?
Q?Q?子类化只能改变窗口创建后的性质Q对于窗口创建期间无能ؓ?无法截获ON_CREATE 事g)Q而超cd可以实现Q超cd不能用于Windows创徏的窗口,子类化可以?nbsp;
4. 其他
?D为实(2)Q介lWindows的窗口、消息、子cd和超cd q里有一个例?.
可以得出l论
a) 子类化的classname 是不会变化的, 而超cd使用新注册classname
b) 子类?& 类?描述的是一个动?和实现方法没什么关p?.... 主要是子cd是SubclassWindow, SubclassDlgItem, 而超cd是RegisterClassEx(&newwindowclass)
c) 感觉具体没有必要区分q些, 实现功能p? 呵呵
Some of the DirectShow samples break if you install Visual Studio 2005 Beta 2. Most of the errors that I found fall into three categories:
Here are the specific fixes that I made. Warning: I have not thoroughly tested these, and I only tried them under the "Windows XP 32-bit Debug" environment in Platform SDK. You should use your own judgment before making any of these fixes.
4. 问题
a. DocumentComplete 事g会在URL 对应面的每个元素下载完毕的时候都会发? 所?( q不知道哪个事g是整个页面下载完毕的事g:/
b. 现在是通过MFC 来创建WebBrowser Control ? 不知道怎么在Win32 Application 中创个控?
c. 不知道如何得到整个页面的大小, 现在只能保存面截图的一部分:(
q个已经知道怎么做了.
IHTMLElement2 ?scrollWidth & scrollHeight 加上 scrollLeft & scrollTop 来实? 但是不知道ؓ什? put_scrollTop & put_scrollLeft q些函数好像不对, 只能截获C部分面截图.:( 不知道ؓ什?br>
代码可以在这里下? http://m.shnenglu.com/Files/bigsml/iesnapshot.zip