[DMC4]

Does this support web injects?

I will be interested, if it has similar characteristics to zeus.

[arigato]

What is with the influx of FormGrabbers..

Rebel FormGrabber
MP FormGrabber
nLoader bot w/ FormGrabber

And now this...

POR QUE?!

[Gone With The Wind]

What is with the influx of FormGrabbers..

Rebel FormGrabber
MP FormGrabber
nLoader bot w/ FormGrabber

And now this...

POR QUE?!

oh and Ares formgrabber was first 🤗

[Gone With The Wind]

I also do. OMG we have like so much in common.

:D, btw do you use NtReadFile for chrome?

[Gone With The Wind]

Nah, I have a method to find the address of PR_Write without any byte pattern scanning (hint: there actually is a table inside the process memory which stores the absolute addresses of each PR_xxxx function which is easy to find if you know how ;) ) Therefore I hook PR_Write in every version of chrome ;)

Yeah I've known some people to use that methods but I personally went for NtReadFile as I can then use my hooking method that I use for ntdll based hooks. Only thing is PR_Write hook will be way more efficient and faster because it isn't just HTTP requests in NtReadFile buffer, it literally transfers gigabytes of crap.

[Gone With The Wind]

My focus was speed as well as bin size and as the Chrome PR_Write is pretty much the same as the FF one I can reduce the size :)

Yeah i was going to say, you could use 1 log routine for both.

[UnNamedHacker]

So when will you be selling this ?
is this even working with all the latest versions of the Browsers ?
and just a quick suggestion

Can you do it like SpyEye. Well in spyeye whenever the user enters a site and his login information spyeye grabs it.
unlike the formgrabbers here they grab the sites that are listed such as facebook.com/twitter and that sh!t.
i want a formgrabber that grabs sites/login information that the user has entered. not the sites that we entered or put in a list.

[Gone With The Wind]

Are you hooking via 0xE9, because if so it's simple to remove :/

Any maybe $100 MAX, since most formgrabbers on here are complete shit, or jump the fence within a month.

Only a week or so ago you were saying how impossible hooks are to remove. Not to mention if he hooks NtQuery/ProtectVirtualMemory you and your copy and paste delphi are fucked.

[Abuser™]

Did anyone release any sources to Formgrabbers? Seems to be alot coming on here all of a sudden.

[Gone With The Wind]

He can hook NTQuery/ProtectVirualMemory all he wants, it won't hook the correct API. Not to mention I don't use delphi.

So how are you planning to remove his hooks if you can't write the memory -.-

[Gone With The Wind]

Sigh, sometimes I loath discussing anything with you.

The point is you don't know anything about the correct API. What you fail to realize is things like VirtualProtect, ReadFile, WriteFile all call their Nt Equivalent.

[Gone With The Wind]

Which is why I don't call VirtalProtect, ReadFile, or WriteFile. Nor do I call any NTQuery API's.

Lets just get this straight, practically all functions end up at Ntdll, unless you've written your own functions (you're not capable) you can easily be screwed over.

There's no way you've come up with a fool proof hook restoration method on your own when like last week you didn't even understand how a hook worked.
Unless you're going to explain your elite bulletproof method you can stop trying to pretend you're better than everyone in their C++ program thread when you code C#.

[Gone With The Wind]

I could always call NtProtectVirtualMemory.

Not if it's hooked you can't [img]http://cdn2.hackforums.net/images/smilies/thumbsup.gif[/img]

[Gone With The Wind]

No Shit 👍

I'm pointing out that Element failed to realize this API.

I mentioned the function a few posts back ❓

[deadaccount01]

No Shit 👍

I'm pointing out that Element failed to realize this API.

[img]http://media.thestar.topscms.com//images/63/90/a37b0944465da67feeae496ea6de.jpg[/img]