contact contact contact
  Articles | Editorials | Reviews | InfoSec Directory | News | Press Releases
Extracting Email IDs from IM Clients
Author: Hirr
Wednesday, 11 September 2002, 12:27 GMT
Reader Comments | Add your opinion

All IM clients store the buddy lists on the system.It is easy to extract the email ids of our buddy lists from the system .This Article shows how to find the email ids of yahoo,MSN,ICQ buddies.


The Buddy Email ids of .NET MSN Messenger is stored on this location HKEY_CURRENT_USER\ Software\Microsoft\MessengerService\ListCache\.NET Messenger Service On registry.So it is easy to find the all email ids ,just enumarate all the values under this key.But this contains so many same entries.so after enumarating we must sort all the email ids and amke it a good list.the program for finding the email ids is given below.

void findmsnid()
{
char eid[1500][50];HKEY hkeyresult1;
char name[250];BYTE dat[250];DWORD dw,dw1;LONG l1,k;int cnt=0;
l1=RegOpenKeyEx(HKEY_CURRENT_USER, "Software\\Microsoft\\MessengerService\\ListCache\\.NET Messenger Service",0,KEY_ALL_ACCESS, &hkeyresult1 );
if(l1==ERROR_SUCCESS){
dw=300;dw1=REG_BINARY;k=0;dw=100;dw1=REG_BINARY;l1=ERROR_SUCCESS;
while(l1!=ERROR_NO_MORE_ITEMS){
l1=RegEnumValue(hkeyresult1,k,name,&dw,0,&dw1,dat,&dw);k++;
if(!validAddress((char *)dat)){
lstrcpy(eid[cnt],(char *)dat);
cnt++;}}}
RegCloseKey(hkeyresult1);
}

ICQ

The Email IDs of ICQ buddys r stored in .dat file.But the location of that file is different in different versions,so first we find exact location of dat file from registry and then look for the word "PrimaryEmail" in that dat file.the email ids r stored next to that word.The program for finding the email ids of buddy lists is given below

void findidicq()
{
HANDLE hF1;
WIN32_FIND_DATA f;
HANDLE hFind;
BYTE uin[MAX_PATH],dbpath[MAX_PATH];
DWORD size;
HKEY hkeyresult;
char datafname[MAX_PATH], fn[50];size=800;
LONG l1=RegOpenKeyEx(HKEY_CURRENT_USER, ( LPCTSTR )"Software\\Mirabilis\\ICQ\\DefaultPrefs" ,0,KEY_ALL_ACCESS, &hkeyresult );
if(l1!=ERROR_SUCCESS) return ;
RegQueryValueEx ( hkeyresult, ( LPCTSTR )"UIN Dir" , 0, 0, uin, &size ) ;size=800;
RegQueryValueEx ( hkeyresult, ( LPCTSTR )"ICQPath" , 0, 0, dbpath, &size ) ;
RegCloseKey(hkeyresult);
SetCurrentDirectory((char *)uin);
hFind = FindFirstFile("*.uin", &f);
if (hFind == INVALID_HANDLE_VALUE){ FindClose(hFind); return ;}
FindClose(hFind);
strcpy(fn,f.cFileName );
fn[lstrlen(fn)-3]='d';fn[lstrlen(fn)-2]='a';fn[lstrlen(fn)-1]='t';
if(!(dbpath[lstrlen((char *)dbpath)-1]=='\\')) lstrcat((char *)dbpath,"\\");
char *pb[6]={"2000b","2001a","2001b","2002a","2002b",};
for (int cc=0;cc<5;cc++){
wsprintf(datafname,"%s%s\\%s",(char *)dbpath,pb[cc],fn);
hFind = FindFirstFile(datafname, &f);
if (hFind != INVALID_HANDLE_VALUE){ FindClose(hFind); goto RR; }
FindClose(hFind);
}
return;
RR:
//////////////
char eid[3000][50];int cnt=0;
hF1= CreateFile (datafname,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_ALWAYS,FILE_ATTRIBUTE_NORMAL,NULL);
if (hF1==NULL) return ;
size=GetFileSize(hF1,NULL);
char *buffer=NULL;
HANDLE hFMAP=CreateFileMapping(hF1,0,PAGE_READONLY,0,0,0);
if(!hFMAP) { CloseHandle(hF1); return ; }
buffer=(char *)MapViewOfFile(hFMAP,FILE_MAP_READ,0,0,0);
if(!buffer) { CloseHandle(hFMAP); CloseHandle(hF1); return ; }
char eID[250];eID[0]=0;DWORD i=0;
while(i {
if(!strncmp(buffer+i,"PrimaryEmail",strlen("PrimaryEmail"))) {
i+=16;
if(!validAddress(buffer+i )){ lstrcpy(eid[cnt],buffer+i);cnt++; }
}

else i++;
}

UnmapViewOfFile(buffer);
CloseHandle (hFMAP);
CloseHandle (hF1);
return ;
}

Yahoo

In the case of yahoo messenger,It will not storing the full email ids. anyway we will get some recent buddy names by enumarating the strings registry at this location HKEY_CURRENT_USER\Software\Yahoo\Pager\profiles\\IMVironme ts\Recent .The rest is simpile gussing,just add the @yahoo.com to the buddy names. The program for finding the yahoo buddy email id is given below.

void findidyahoo()
{
HKEY hkeyresult ,hkeyresult1;long i;char name[200],skey[100],chatn[200];
DWORD dw2,dw;FILETIME f;
if(RegOpenKeyEx(HKEY_CURRENT_USER, ( LPCTSTR )"Software\\Yahoo\\Pager\\profiles",0,KEY_ALL_ACCESS, &hkeyresult1 )!= ERROR_SUCCESS )
return ;
dw2=200;i=0;int j;
while(RegEnumKeyEx(hkeyresult1,i,name,&dw2,NULL,NULL,NULL,&f)!=ERROR_NO_MORE_ITEMS){
wsprintf(skey,"Software\\Yahoo\\Pager\\profiles\\%s\\IMVironments\\Recent",name);
if(RegOpenKeyEx(HKEY_CURRENT_USER, ( LPCTSTR )skey,0,KEY_ALL_ACCESS, &hkeyresult )!= ERROR_SUCCESS )
{
return ;
}
dw=200;j=0;
while(RegEnumValue(hkeyresult,j,chatn,&dw,NULL,NULL,NULL,NULL)!=ERROR_NO_MORE_ITEMS)
{
*(strchr(chatn,';'))='\0';
if (strcmp(chatn,name)!=0){
lstrcat(chatn,"@yahoo.com");
if(!validAddress(chatn))
SendDlgItemMessage(hd,IDC_LIST2,LB_ADDSTRING,0,(LPARAM)chatn);
}
j++;dw=200;
}
RegCloseKey(hkeyresult);
i++;dw2=200;
}
RegCloseKey(hkeyresult1);
}

By hirosh
www.hirosh.tk

Add IT Observer Reviews to your RSS newsreader or



Reader Comments:

No comments. Post your comment here

InfoSec Directory
» Bluetooth Security Tools
» Windows/Linux Security - Web Server Role
» Anti-Spyware Software: Securing the Corporate Network
» Using Digital Signatures to Secure Email and Stop Phishing Attacks
» Tracking and Tracing Cyber-Attacks: Technical Challenges and Global Policy Issues
Latest Press Releases
» Network Utilities ships New Version of Proxy Remote Control Software
» GunnAllen Financial Switches to FrontBridge to Ease Message Archiving Processes
» "Mastering FreeBSD and OpenBSD Security": Building, Securing, and Maintaining BSD Systems
» Secured Services and Allegent Technology Group Announce Bristol West Deployment of Network Security Platform
» Netframeworks announces the availability of its SafeSpaceSoftware suite of products and services
» CP-Lab Releases Password Manager XP
More Articles
» Mozilla: The Honeymoon is over
» VoIP – What’s the Real Opportunity for Small Businesses?
» Run Your IT Department Like a Business! What?
» Zombie Computers
» HTTP Response Splitting
 Copyright © 2000 - 2005 eBCVG IT Security Affiliates :: RSS feeds :: Privacy 
Site Meter