🚀 go-pugleaf

"JasperP" <Spam@SpamCop.net> wrote:

>I'm trying to create a small tool whereby users can retrieve their 
>passwords.
>So read a masked password from eg. Outlook.
>
>How can I manage this?

I rather hope you can't - because if you can, it means that there really
is no security in Windows.

(And I'm naive enough to hope that there's enough to defeat this, at
least.)

In principle, you should be able to use GetWindowText() using the window
handle. This can, in principle, be used to go cross-process. On the
other hand, it's down to control receiving the WM_GETTEXT message to
disable the functionality, and I would rather hope that a password entry
field does so.

If it didn't, then it's too easy for a virus on your machine to grab all
your passwords and email them to Lithuania, or Miami, or wherever.

An alternate solution - and no, I've not even thought about trying this
- would be to watch for new windows appearing with the ES_PASSWORD
attribute. When one does, you could pop up your window instead for the
user to type into, and then send the result off to the original.

(I assume that WM_SETTEXT would still work.)

Alan Bellingham
-- 
ACCU Conference: 11-14 April 2007 - Paramount Oxford Hotel

Alan Bellingham wrote:
> I rather hope you can't - because if you can, it means that there really
> is no security in Windows.

Then I have to disapoint you about this; many of these small tools already 
exist and work. A MaskEdit control is just as easily read as a Edit control. 
With GetWindowText I can get the masked text out of a couple of programs, 
but not all.

Strangly enough a program written in VB (I have the source of this simple 
and small program), uses gettext(hWindow) and gets the masked text out of 
almost all programs.

> An alternate solution - and no, I've not even thought about trying this
> - would be to watch for new windows appearing with the ES_PASSWORD
> attribute. When one does, you could pop up your window instead for the
> user to type into, and then send the result off to the original.
>
> (I assume that WM_SETTEXT would still work.)

I don't wish to intercept information. It is intended to just be a retrieval 
tool.

Jasper 

"Alan Bellingham" <alan@lspace.org> wrote in message
news:8v7rf25uai1ldlmu12psopd6oscoa4rtdv@4ax.com...

> I rather hope you can't - because if you can, it means that
> there really is no security in Windows.

Such tools already exist, such as Snadboy's Revelation, using the standard
WM_GETTEXT message.  Most edit controls that have a password mask applied do
not mask the text when requested, only when displayed visually.

> I would rather hope that a password entry field does so.

I don't know about recent Windows versions, but that has not always been the
case, unfortunately.  Maybe it has already changed, I don't know.  At one
time, I started implementing my own Edit control that prevented such tools
from working.  But I never finished it.


Gambit

JasperP wrote:
> How can I manage this?

Found a good example that works with hooking.

Jasper