赞
踩
- #include"stdafx.h"
- #include<iostream>
- #include<windows.h>
- #include <assert.h>
- #include<TlHelp32.h>
- #include <string.h>
- #include "stdio.h"
- #include "Shlwapi.h"
- #include "tlhelp32.h"
- #include "Psapi.h"
- #include <TChar.h>
- #pragma comment(lib,"Psapi.lib")
- #pragma comment(lib,"Shlwapi.lib")
-
-
- //参数结构 ;
- typedef struct _RemotePara
- {
- UINT y;
- UINT x;
- UINT id;
- }RemotePara;
-
- using namespace std;
- HWND hwnd_Game;
- DWORD ProcessID;
- HANDLE h_process;
- int Base;
- int Offset[10];
- HANDLE hToken, hThread;
- RemotePara myRemotePara;
- HINSTANCE hUser32;
- void *pRemoteThread;
- DWORD byte_write;
- RemotePara *pRemotePara;
- const DWORD THREADSIZE = 1024 * 4;
-
-
- // 远程线程执行体
- DWORD __stdcall ThreadProc(RemotePara *Para) {
- typedef void(__stdcall *pExitProcess) (UINT);
- pExitProcess y = (pExitProcess)Para->y;
- pExitProcess x = (pExitProcess)Para->x;
- pExitProcess id = (pExitProcess)Para->id;
- __asm {
- pushad
- push - 1
- push id
- mov eax, y
- push x
- mov edi, dword ptr ds : [0x755E0C]
- mov edi, dword ptr ds : [edi + 0x868]
- push edi
- mov edx, 0x418D70
- call edx
- popad
- }
- return 0;
- }
-
- BOOL EnablePrivilege(HANDLE hToken, LPCTSTR szPrivName, BOOL fEnable)
- {
- TOKEN_PRIVILEGES tp;
- tp.PrivilegeCount = 1;
- LookupPrivilegeValue(NULL, szPrivName, &tp.Privileges[0].Luid);
- tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
- AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
- return((GetLastError() == ERROR_SUCCESS));
- }
-
- HANDLE GetPidByName(char *szName)
- {
- HWND hwnd_Game = FindWindow(NULL, L"Plants vs. Zombies");
- GetWindowThreadProcessId(hwnd_Game, &ProcessID);
- return OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);
- }
-
- int callPlant()
- {
-
- // 启动线程
- if (!WriteProcessMemory(h_process, pRemotePara, &myRemotePara, sizeof myRemotePara, 0))
- {
-
- return 0;
-
- }
-
- hThread = CreateRemoteThread(h_process, 0, 0, (DWORD(__stdcall *)(void *))pRemoteThread, pRemotePara, 0, &byte_write);
-
-
- return 1;
- }
-
- void GetGameInfo()
- {
- hwnd_Game = FindWindow(NULL, L"Plants vs. Zombies");
- GetWindowThreadProcessId(hwnd_Game, &ProcessID);
- h_process = OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);
-
- Base = 0x00755E0C;
- Offset[0] = 0x868;
- Offset[1] = 0x5578;
- }
-
- //通过基址加偏移得到动态地址
- int GetDymThroughBase(int Base, int Offset[], int len)
- {
- int Dym_temp;
- ReadProcessMemory(h_process, (LPVOID)Base, &Dym_temp, 4, NULL);
- for (int i = 0; i < len; i++)
- {
- if (i == len - 1)
- Dym_temp += Offset[i];
- else
- ReadProcessMemory(h_process, (LPVOID)(Dym_temp + Offset[i]), &Dym_temp, 4, NULL);
- }
- return Dym_temp;
- }
- //修改阳光
- void ChangeSunshine(int num)
- {
- int DymnamicAddress = GetDymThroughBase(Base, Offset, 2);
- int ret = WriteProcessMemory(h_process, (LPVOID)DymnamicAddress, &num, 4, NULL);
- if (ret == 0)
- {
- cout << "修改失败!" << endl;
- }
- else
- {
- cout << "修改成功!" << endl;
- }
- }
- //免CD
- void DisableCoolDown()
- {
- int num = 0x1477;
- int ret = WriteProcessMemory(h_process, (LPVOID)0x0049CE02, &num, 2, NULL);
- if (ret)
- {
- cout << "免冷却成功!" << endl;
- }
- else
- {
- cout << "免冷却失败!" << endl;
- }
- }
-
- int in()
- {
-
- // 在远程进程地址空间分配虚拟内存
- pRemoteThread = VirtualAllocEx(h_process, 0, THREADSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
- if (!pRemoteThread)
- return 0;
-
- // 将线程执行体ThreadProc写入远程进程
- if (!WriteProcessMemory(h_process, pRemoteThread, &ThreadProc, THREADSIZE, 0))
- return 0;
-
- ZeroMemory(&myRemotePara, sizeof(RemotePara));
- hUser32 = LoadLibrary((LPCWSTR)"kernel32.dll");
-
- //写进目标进程
- pRemotePara = (RemotePara *)VirtualAllocEx(h_process, 0, sizeof(RemotePara), MEM_COMMIT, PAGE_READWRITE);
-
- if (pRemotePara)
- {
- return 1;
- }
- else
- return 0;
- }
-
-
-
- int main()
- {
- int n_sunshine_change;
- int n_choice = 99;
- GetGameInfo();
-
- DWORD pID;
-
- char szSafePath[MAX_PATH] = { "C://Program Files//Safe Office//oem//BioFileLogOp.dll" };
- char szKxPath[MAX_PATH] = { "C://Program Files//KeXin WPS Office//oem//BioFileLogOp.dll" };
-
- HANDLE hSafeFind;
- HANDLE hKxFind;
- WIN32_FIND_DATA FindFileData, FindKxFileData;
-
- OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken); //打开进程
-
- EnablePrivilege(hToken, SE_DEBUG_NAME, TRUE); //提升为调试权限
-
- if (!in())
- {
- cout << "No!!!!!!!!!!!" << endl;
- Sleep(50000);
- return 0;
- }
- cout << "欢迎使用植物大战僵尸外挂,请选择你要实现的功能:\n1.修改阳光\n2.植物免冷却\n3.种植植物\n4.召唤炮兵连队\n5.召唤寒冰西瓜连队\n0.退出\n";
-
-
- while (n_choice)
- {
- cin >> n_choice;
- switch (n_choice)
- {
- case 1:
- cout << "请输入你要修改的阳光值:";
- cin >> n_sunshine_change;
- ChangeSunshine(n_sunshine_change);
- break;
- case 2:
- DisableCoolDown();
- break;
- case 3:
- cout << "请输入你要种植的植物ID:";
- cin >> myRemotePara.id;
- cout << "请输入你要种植的x坐标:";
- cin >> myRemotePara.x;
- cout << "请输入你要种植的y坐标:";
- cin >> myRemotePara.y;
- callPlant();
- break;
- case 4:
- cout << "Waiting......";
- myRemotePara.id = 40;
- myRemotePara.x = 0;
- for (int i = 0; i < 20; i++)
- {
- for (int j = 0; j < 6; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- }
- myRemotePara.id = 43;
- myRemotePara.x = 1;
- for (int i = 0; i < 2; i++)
- {
- for (int j = 0; j < 6; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- }
- myRemotePara.id = 22;
- myRemotePara.x = 2;
- for (int j = 0; j < 6; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- myRemotePara.id = 25;
- myRemotePara.x = 6;
- for (int j = 0; j < 6; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- cout << "OK! We have done.\n";
- break;
- case 5:
- cout << "Waiting......";
- myRemotePara.id = 44;
- myRemotePara.x = 0;
- for (int i = 0; i < 40; i++)
- {
- for (int j = 0; j < 5; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- }
- myRemotePara.id = 43;
- myRemotePara.x = 1;
- for (int i = 0; i < 1; i++)
- {
- for (int j = 1; j < 4; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- }
- cout << "OK! We have done.\n";
- break;
- case 6:
- cout << "Waiting......";
- myRemotePara.id = 0;
- myRemotePara.x = 4;
- for (int i = 0; i < 40; i++)
- {
- for (int j = 0; j < 5; j++)
- {
- myRemotePara.y = j;
- Sleep(100);
- callPlant();
- }
- }
- break;
- }
- }
- return 0;
- }
Copyright © 2003-2013 www.wpsshop.cn 版权所有,并保留所有权利。