如何使用API 查看窗体中密码框显示的内容 ？
?0xCC
?0xD2
Private Const EM_GETPASSWORDCHAR = &HD2    210
Private Const EM_SETPASSWORDCHAR = &HCC

1、SendMessage(hwnd, EM_GETPASSWORDCHAR, 0, 0);        //获取星号
2、PostMessage(hwnd, EM_SETPASSWORDCHAR, 0, 0);         //取消星号字符
3、SendMessage(hwnd, WM_GETTEXT, 255, long(buffer));      //获取真实密码
4、PostMessage(hwnd, EM_SETPASSWORDCHAR, Char, 0);   //还原密码


/*
 * 参数介绍
 * hwnd：控件句柄
 * buffer：接收密码的缓冲区
 */
void getTextPass(HWND hwnd, char* buffer)
{
    LRESULT Char;
    Char = ::SendMessage(hwnd, EM_GETPASSWORDCHAR, 0, 0);    //获取星号
    ::PostMessage(hwnd, EM_SETPASSWORDCHAR, 0, 0);        //取消星号字符
    Sleep(60);                                    //等异步消息完成
    ::SendMessage(hwnd, WM_GETTEXT, 255, long(buffer));        //获取真实密码
    ::PostMessage(hwnd, EM_SETPASSWORDCHAR, Char, 0);        //还原密码
}



但是在Win7下要想不用注入DLL，不用Windows钩子的确有点困难，最近简单了逆向了一下"Win7星号密码查看器"，终于把原理搞清楚了，希望发出来能对大家有帮助

大家都知道在本进程内调用WM_GETTEXT和GetWindowText就能获取密码框的文本，而如果要跨进程WM_GETTEXT和GetWindowText就不管用了
在xp我们可以这样做，这也算微软的一个漏洞吧，没有判断是不是本进程发送的EM_SETPASSWORDCHAR消息

代码:

chPassChar = (TCHAR)SendMessage (hwndPoint, EM_GETPASSWORDCHAR, 0, 0);//获取密码字符

         

SendMessage(hwndPoint, EM_SETPASSWORDCHAR, 0, 0);//取消密码属性

SendMessage(hwndPoint, WM_GETTEXT, sizeof(szTitle) / sizeof(TCHAR), (LPARAM)szTitle);//获取密码文本

SendMessage(hwndPoint, EM_SETPASSWORDCHAR, 0, chPassChar);//设置密码字符

但在Win7上，上面的代码已经不能使用了，即使你用SetWindowLong取消掉ES_PASSWORD样式也行不通。虽然SetWindowLong不行，我们还有其它方法，这也算微软太马虎的吧
事实证明只要文本框包含ES_PASSWORD样式，SetWindowLong就取消不了ES_PASSWORD，但SetWindowWord可以

代码:
GWL_STYLE=-16

dwStyle = GetWindowLong(hwndPoint, GWL_STYLE);//获取密码框原来样式
SetWindowWord(hwndPoint, GWL_STYLE, 0);//取消所有样式
SetWindowLong(hwndPoint, GWL_STYLE, dwStyle & ~ES_PASSWORD);//去掉密码属性
SendMessage(hwndPoint, WM_GETTEXT, sizeof(szTitle) / sizeof(TCHAR), (LPARAM)szTitle);//没有了ES_PASSWORD属性WM_GETTEXT可以成功
SetWindowLong(hwndPoint, GWL_STYLE, dwStyle);//还原密码框原来样式



dwStyle = GetWindowLong(hCldWndGet, GWL_STYLE);
            dwStyle &= ~ES_PASSWORD;
            SetWindowLong(hCldWndGet, GWL_STYLE, dwStyle);

[此贴子已经被作者于2023-8-24 19:11编辑过]

Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long) As Long

Declare Function SetWindowWord Lib "user32" Alias "SetWindowWord" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal wNewWord As Long) As Long


Private Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hwnd As Long, ByVal nIndex As Long, ByVal dwNewLong As Long) As Long

declare integer GetWindowLong in Win32API ;
   integer hWnd, integer nIndex


declare integer     SetWindowWord   in  Win32API ;
   integer hWnd, integer nIndex, iNTEGER dwNewLong
DECLARE INTEGER SetWindowLong IN user32.DLL INTEGER hWnd, INTEGER nIndex, INTEGER dwNewLong



dwStyle = GetWindowLong(hwndPoint, GWL_STYLE);//获取密码框原来样式
SetWindowWord(hwndPoint, GWL_STYLE, 0);//取消所有样式
SetWindowLong(hwndPoint, GWL_STYLE, dwStyle & ~ES_PASSWORD);//去掉密码属性

SendMessage(hwndPoint, WM_GETTEXT, sizeof(szTitle) / sizeof(TCHAR), (LPARAM)szTitle);//没有了ES_PASSWORD属性WM_GETTEXT可以成功

SetWindowLong(hwndPoint, GWL_STYLE, dwStyle);//还原密码框原来样式

[此贴子已经被作者于2023-8-24 20:28编辑过]

dwStyle & ~ES_PASSWORD
=bitand(dwStyle ,bitnot(ES_PASSWORD))  ?

ES_PASSWORD=?

#define ES_PASSWORD         0x0020L

[此贴子已经被作者于2023-8-24 20:35编辑过]

忘记密码了

搞定了

[此贴子已经被作者于2023-8-25 09:23编辑过]