带有多级指针的WriteProcessMemory

Question

我正在尝试写入内存中的某个地址（我从作弊引擎获得的基地址，所以它不会改变），问题是我无法弄清楚我需要如何使用所有偏移量进行写入。

这是我的以下地址和偏移量：

DWORD Pointer = 0x001E8AA0;
DWORD offset1 = 0x3F0;
DWORD offset2 = 0x62C;
DWORD offset3 = 0x4;
DWORD offset4 = 0x104;
DWORD offset5 = 0x68;
char moduleName[] = "Insaniquarium.exe";

作弊引擎中的指针图片：

我尝试了很多事情，但都失败了，我知道这一点是因为在游戏中该值不会改变，在作弊引擎中该值的指针也不会改变。 这是我最后的尝试：

WriteProcessMemory(handle, (LPVOID)(moduleName + Pointer + offset1 + offset2 + offset3 + offset4 + offset5), &val, sizeof(val), nullptr);

我之前描述过，该值没有改变。

如果您认为需要更多信息，请告诉我，谢谢。

Answer 1

您的偏移量添加顺序错误。您需要从该屏幕截图的底部到顶部进行操作。

您需要取消引用链中的每个指针，但您没有这样做。

以下是正确的做法：

DWORD GetProcId(const wchar_t* procName)
{
    DWORD procId = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnap != INVALID_HANDLE_VALUE)
    {
        PROCESSENTRY32 procEntry;
        procEntry.dwSize = sizeof(procEntry);

        if (Process32First(hSnap, &procEntry))
        {
            do
            {
                if (!_wcsicmp(procEntry.szExeFile, procName))
                {
                    procId = procEntry.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnap, &procEntry));

        }
    }
    CloseHandle(hSnap);
    return procId;
}

uintptr_t GetModuleBaseAddress(DWORD procId, const wchar_t* modName)
{
    uintptr_t modBaseAddr = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);
    if (hSnap != INVALID_HANDLE_VALUE)
    {
        MODULEENTRY32 modEntry;
        modEntry.dwSize = sizeof(modEntry);
        if (Module32First(hSnap, &modEntry))
        {
            do
            {
                if (!_wcsicmp(modEntry.szModule, modName))
                {
                    modBaseAddr = (uintptr_t)modEntry.modBaseAddr;
                    break;
                }
            } while (Module32Next(hSnap, &modEntry));
        }
    }
    CloseHandle(hSnap);
    return modBaseAddr;
}

uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets)
{
    uintptr_t addr = ptr;
    for (unsigned int i = 0; i < offsets.size(); ++i)
    {
        ReadProcessMemory(hProc, (BYTE*)addr, &addr, sizeof(addr), 0);
        addr += offsets[i];
    }
    return addr;
}

int main()
{
    //Get ProcId of the target process
    DWORD procId = GetProcId(L"Insaniquarium.exe");

    //Getmodulebaseaddress
    uintptr_t moduleBase = GetModuleBaseAddress(procId, L"Insaniquarium.exe");

    //Get Handle to Process
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, procId);

    //Resolve base address of the pointer chain
    uintptr_t dynamicPtrBaseAddr = moduleBase + 0x001E8AA0;

    //Resolve the pointer chain
    std::vector<unsigned int> offsets = {0x68, 0x104, 0x4, 0x62C, 0x3F0};

    uintptr_t addr = FindDMAAddy(hProcess, dynamicPtrBaseAddr, offsets);

    return 0;
}

Answer 2

//这是完整的锻炼

//
#include <windows.h>
#include <TlHelp32.h>
#include <iostream>
#include <tchar.h>
#include <vector>
#include <stdlib.h>
 
 
DWORD GetProcId(const wchar_t* procName)
{
    DWORD procId = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hSnap != INVALID_HANDLE_VALUE)
    {
        PROCESSENTRY32 procEntry;
        procEntry.dwSize = sizeof(procEntry);

        if (Process32First(hSnap, &procEntry))
        {
            do
            {
                if (!_wcsicmp(procEntry.szExeFile, procName))
                {
                    procId = procEntry.th32ProcessID;
                    break;
                }
            } while (Process32Next(hSnap, &procEntry));

        }
    }
    CloseHandle(hSnap);
    return procId;
}
uintptr_t GetModuleBaseAddress(DWORD procId, const wchar_t* modName)
{
    uintptr_t modBaseAddr = 0;
    HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);
    if (hSnap != INVALID_HANDLE_VALUE)
    {
        MODULEENTRY32 modEntry;
        modEntry.dwSize = sizeof(modEntry);
        if (Module32First(hSnap, &modEntry))
        {
            do
            {
                if (!_wcsicmp(modEntry.szModule, modName))
                {
                    modBaseAddr = (uintptr_t)modEntry.modBaseAddr;
                    break;
                }
            } while (Module32Next(hSnap, &modEntry));
        }
    }
    CloseHandle(hSnap);
    return modBaseAddr;
}

uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets)
{
    uintptr_t addr = ptr;
    for (unsigned int i = 0; i < offsets.size(); ++i)
    {
        ReadProcessMemory(hProc, (BYTE*)addr, &addr, sizeof(addr), 0);
        addr += offsets[i];
    }
    return addr;
}
int main() {
    DWORD procId = GetProcId(L"NSUNS4.exe");

    //Getmodulebaseaddress
    uintptr_t moduleBase = GetModuleBaseAddress(procId, L"NSUNS4.exe");

    //Get Handle to Process
    HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, procId);

    //Resolve base address of the pointer chain
    uintptr_t dynamicPtrBaseAddr = moduleBase + 0x0161C940;

    //Resolve the pointer chain
    std::vector<unsigned int> offsets = { 0x40,0x10,0x0,0x0,0x7C };

    uintptr_t addr = FindDMAAddy(hProcess, dynamicPtrBaseAddr, offsets);
     





    //************
       // Data to write
    int dataToWrite = 123;

    // Write data to the calculated address
    SIZE_T bytesWritten;
    if (WriteProcessMemory(hProcess, (LPVOID)addr, &dataToWrite, sizeof(dataToWrite), &bytesWritten)) {
        std::cout << "Data written to process memory" << std::endl;
    }
    else {
        std::cout << "Failed to write data to process memory. Error code: " << GetLastError() << std::endl;
    }

    CloseHandle(hProcess);
    return 0;
}