第四例:修改游戏内存
当然这个在书上已经有了很多的解释,今天也太晚了,所以不再赘述,直接贴代码了。
我的和书上的是不大一样的,这个是你可以输入你想要修改的程序名称,之后查找值,最后修改。
如下:
1 #include<stdio.h> 2 #include<string.h> 3 #include<stdlib.h> 4 #include<windows.h> 5 #include<tlhelp32.h> 6 7 //预定义区 8 #define ONEPAGE 4096 9 #define ONEGB 1024*1024*1024 10 11 //全局定义区 12 HANDLE g_hProcess; 13 DWORD g_arList[1024]; 14 DWORD g_nList; 15 bool FindFirst(DWORD dwValue); 16 bool FindNext(DWORD dwValue); 17 18 //一般函数区 19 bool CompareAPage(DWORD dwAddrBase,DWORD dwValue) 20 { 21 BYTE arList[4096]; 22 bool bRet = false; 23 if(g_hProcess == NULL) 24 { 25 return bRet; 26 } 27 if( !::ReadProcessMemory(g_hProcess,(LPCVOID)dwAddrBase,arList,4096,NULL) ) 28 return bRet; 29 for(int i = 0;i<ONEPAGE-3;i++) 30 { 31 int temp = *((int*)(arList+i)); 32 if( temp == dwValue ) 33 { 34 g_arList[g_nList++] = (DWORD)(dwAddrBase+i); 35 bRet = true; 36 } 37 } 38 return bRet; 39 } 40 bool FindFirst(DWORD dwValue) 41 { 42 const DWORD OnePage = 4*1024; 43 const DWORD OneGb = 1024*1024*1024; 44 OSVERSIONINFO vi = {sizeof(vi)}; 45 bool bRet = false; 46 ::GetVersionEx(&vi); 47 for( 48 DWORD dwBase = (vi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS?4*1024*1024:64*1024); 49 dwBase<2*OneGb; 50 dwBase += OnePage 51 ) 52 { 53 if(CompareAPage(dwBase,dwValue)) 54 { 55 bRet = true; 56 } 57 } 58 59 return bRet; 60 } 61 bool FindNext(DWORD dwValue) 62 { 63 DWORD m_nList = g_nList; 64 g_nList = 0; 65 bool bRet = false; 66 DWORD dwTemp; 67 for(int i = 0;i<m_nList;i++) 68 { 69 if(::ReadProcessMemory(g_hProcess,(LPCVOID)g_arList[i],&dwTemp,sizeof(dwTemp),NULL)) 70 { 71 if(dwTemp == dwValue) 72 { 73 g_arList[g_nList++] = g_arList[i]; 74 bRet = true; 75 } 76 } 77 } 78 79 return bRet; 80 } 81 void ShowList() 82 { 83 for(int i = 0;i<g_nList;i++) 84 { 85 printf("%08X\n",g_arList[i]); 86 } 87 } 88 bool WriteMemory(LPVOID lpvAddr,DWORD dwValue) 89 { 90 return ::WriteProcessMemory(g_hProcess,lpvAddr,(LPCVOID)&dwValue,sizeof(dwValue),NULL); 91 } 92 HANDLE SearchFromName(const char*cName) 93 { 94 PROCESSENTRY32 pe32; 95 pe32.dwSize = sizeof(pe32); 96 HANDLE hSnapshotProcess = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0); 97 if(hSnapshotProcess == INVALID_HANDLE_VALUE) 98 { 99 return NULL; 100 } 101 bool bMore = ::Process32First(hSnapshotProcess,&pe32); 102 printf("%s\n",pe32.szExeFile); 103 while(bMore) 104 { 105 printf("%s\n",pe32.szExeFile); 106 if(strcmp(pe32.szExeFile,cName) == 0) 107 { 108 return ::OpenProcess(PROCESS_ALL_ACCESS,false,pe32.th32ProcessID); 109 } 110 bMore = ::Process32Next(hSnapshotProcess,&pe32); 111 } 112 return NULL; 113 } 114 int main(int argc,char* argv[]) 115 { 116 char szNameExeFile[30]; 117 DWORD dwValue; 118 scanf("%s",szNameExeFile); 119 g_hProcess = SearchFromName(szNameExeFile); 120 if(g_hProcess == NULL) 121 { 122 printf("Not useful handle!\n"); 123 system("pause"); 124 return 0; 125 } 126 scanf("%d",&dwValue); 127 g_nList = 0; 128 FindFirst(dwValue); 129 ShowList(); 130 while(g_nList > 2) 131 { 132 scanf("%d",&dwValue); 133 FindNext(dwValue); 134 ShowList(); 135 } 136 printf("Success!\nAnd The Value you want to change is:"); 137 scanf("%d",&dwValue); 138 WriteMemory((LPVOID)g_arList[0],dwValue); 139 return 0; 140 }
测试程序是这个:
1 #include<stdio.h> 2 int g_nNum; 3 int main(int argc,char* argv[]) 4 { 5 int i = 198; 6 g_nNum = 1003; 7 8 while(1) 9 { 10 printf("i = %d,addr = %08X; g_nNum = %d,addr = %08X\n",++i,&i,--g_nNum,&g_nNum); 11 getchar(); 12 } 13 return 0; 14 }