i do not get the url from chrome Version29.because url control can not be found using spy++.
Option Explicit Private Const WM_GETTEXT = &HD Private Const WM_GETTEXTLENGTH = &HE Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long Private Declare Function GetDesktopWindow Lib "user32" () As Long Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long Private Sub Command1_Click() Dim dhWnd As Long Dim chWnd As Long Dim Web_Caption As String * 256 Dim Web_hWnd As Long Dim URL As String * 256 Dim URL_hWnd As Long dhWnd = GetDesktopWindow chWnd = FindWindowEx(dhWnd, 0, "Chrome_WidgetWin_1", vbNullString) Web_hWnd = FindWindowEx(dhWnd, chWnd, "Chrome_WidgetWin_1", vbNullString) URL_hWnd = FindWindowEx(Web_hWnd, 0, "Chrome_OmniboxView", vbNullString) Call SendMessage(Web_hWnd, WM_GETTEXT, 256, ByVal Web_Caption) Call SendMessage(URL_hWnd, WM_GETTEXT, 256, ByVal URL) MsgBox Split(Web_Caption, Chr(0))(0) & vbCrLf & Split(URL, Chr(0))(0) End Sub
I am using vb6
Chrome is no longer using Chrome_OmniboxView. I'm also looking for a new solution...
This MASM32 code used to work on earlier versions of chrome:
**EnumChildChrome** PROC hwndChild:DWORD,lParam:DWORD LOCAL lpClassUrl[64] :BYTE invoke RtlZeroMemory,addr lpClassUrl, 64 invoke GetClassName, hwndChild, addr lpClassUrl, 64 ; Get URL from AddressBar class Chrome_AutocompleteEditView. ; Get URL from AddressBar class Chrome_OmniboxView. ; Get URL from AddressBar class Chrome_WidgetWin_1. .IF (dword ptr [lpClassUrl+7]=='otuA') || (dword ptr [lpClassUrl+7]=='inmO') || (dword ptr [lpClassUrl+7]=='gdiW') invoke RtlZeroMemory,wText, BUFSIZE invoke SendMessage, hwndChild, WM_GETTEXT, BUFSIZE, wText invoke WriteToMem,3,addr startURL,wText,addr endURL .ENDIF mov eax,hwndChild ret EnumChildChrome ENDP
However, to capture URLs from the most recent versions of chrome, I've written this hacked version below. (Can easily be ported to C, VB etc.,...) It essentially uses the Chrome Tab Title (WinText) as a search key into the History file. Also, Chrome seems to delay URL writes, so that's an obstacle to overcome. Currently, I make several passes thru the history, for say 5 seconds, then abort if nothing found. :(
... googlePath db "%USERPROFILE%\Local Settings\Application Data\Google\Chrome\User Data\Default\History",0 GoogleChrome db " - Google Chrome",0 ... invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE mov googleHistory,eax invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, MAXSIZE mov WinText,eax invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE mov winTitle,eax invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE mov wwinTitle,eax invoke HeapAlloc, hHeap, HEAP_ZERO_MEMORY, BUFSIZE mov uwinTitle,eax ... ; --- Find Google History file path --- invoke RtlZeroMemory,googleHistory,BUFSIZE invoke ExpandEnvironmentStrings, addr googlePath, googleHistory, BUFSIZE ... Chrome PROC LOCAL found_url_ok :DWORD mov found_url_ok,FALSE invoke readdiskfile,googleHistory,addr lpMem,addr lpLen .IF (eax==0) ret .ENDIF invoke RtlZeroMemory,winTitle, BUFSIZE invoke RtlZeroMemory,wwinTitle, BUFSIZE invoke RtlZeroMemory,uwinTitle, BUFSIZE ;; Chrome History Titles are stored in UTF8 format. Example: Polítiques i principis -----> Pol,0C3h,0ADh,tiques i principis invoke szRemove,WinText,winTitle,addr GoogleChrome invoke CharToUTF8,winTitle,wwinTitle,uwinTitle invoke lstrlen,uwinTitle invoke BinSearch,0,lpMem,lpLen,uwinTitle,eax ; --- Search backwards looking for a begin url marker 01h ... .IF (eax!=-1) mov ecx,eax add eax,lpMem mov byte ptr[eax],0 ; end of url find_url_start: cmp byte ptr[eax-1],01h je start_url dec eax loop find_url_start jecxz no_url_found start_url: invoke WriteToMem,3,addr startURL,eax,addr endURL mov found_url_ok,TRUE no_url_found: .ENDIF invoke GlobalFree,lpMem mov eax,found_url_ok ret Chrome ENDP CharToUTF8 proc pAsciiString:DWORD,pWideOutbuf:DWORD,pUTF8Outbuf:DWORD invoke lstrlen,pAsciiString invoke MultiByteToWideChar,CP_ACP,0,pAsciiString,-1,pWideOutbuf,eax invoke WideCharToMultiByte,CP_UTF8,0,pWideOutbuf,-1,pUTF8Outbuf,BUFSIZE,NULL,NULL ret CharToUTF8 endp
I'm not really a fan of this approach, but it's all I could think of today. Several other ideas come to mind:
Querying the Chrome process memory and extracting URLs might be a better approach.
Using sqlite3 api's to parse the history.
szSQLite3Lib db "sqlite3.dll", 0h
szfnSQLite3_close db "sqlite3_close", 0h
szfnSQLite3_column_text db "sqlite3_column_text", 0h
szfnSQLite3_exec db "sqlite3_exec", 0h
szfnSQLite3_open db "sqlite3_open_v2", 0h
szfnSQLite3_prepare db "sqlite3_prepare", 0h
szfnSQLite3_step db "sqlite3_step", 0h
szSQLStmt5 db "SELECT datetime(((visits.visit_time/1000000)-11644473600), ",34,"unixepoch",34,"), urls.url, urls.title FROM urls, visits WHERE urls.id = visits.url;",0
If you find a nice method, please post your findings here. Thanks!
The code above is used on my keylogging site:
MyKeylogger.com - Web monitoring software to monitor children or employees and watch it LIVE online!
