我试图编译由 proc.cpp、proc.h、mem.cpp、mem.h 和 acinternal.cpp 组成的程序,当我将鼠标悬停在 procEntry 上方时,当 PROCESSENTRY32 定义它时,它说它没有初始化,但我想我已经初始化了它与 .dwSize 所以我不确定还有哪些其他功能无法声明,因为我的研究似乎是问题所在
我期待程序注入程序 ac_client 以便我可以覆盖内存
acinternal.cpp(源文件)
#include <iostream>
#include <Windows.h>
#include <TlHelp32.h>
#include "mem.h"
#include "proc.h"
DWORD WINAPI HackThread(HMODULE hModule)
{
//Create console
AllocConsole();
FILE* f;
freopen_s(&f, "CONOUT$", "w", stdout);
std::cout << "OG for a fee, stay sippin' fam\n";
//get module base
uintptr_t moduleBase = (uintptr_t)GetModuleHandle(L"ac_client.exe");
bool bHealth = false, bAmmo = false, bRecoil = false;
//hack loop
while (true)
{
//key input
if (GetAsyncKeyState(VK_END) & 1)
{
break;
}
if (GetAsyncKeyState(VK_NUMPAD1) & 1)
{
bHealth = !bHealth;
}
if (GetAsyncKeyState(VK_NUMPAD2) & 1)
{
bAmmo = !bAmmo;
}
if (GetAsyncKeyState(VK_NUMPAD3) & 1)
{
bRecoil = !bRecoil;
if (bRecoil)
{
//nop
mem::Nop((BYTE*)(moduleBase + 0x63786), 10);
}
else
{
//write back original instructions
mem::Patch((BYTE*)(moduleBase + 0x63786), (BYTE*)"\x50\x8d\x4c\x24\x1c\x51\x8b\xec\xff\xd2", 10);
}
}
//continues write/freeze
uintptr_t* localPlayerPtr = (uintptr_t*)(moduleBase + 0x10f4f4);
if (localPlayerPtr)
{
if (bHealth)
{
*(int*)(*localPlayerPtr + 0xf8) = 1337;
}
if (bAmmo)
{
uintptr_t ammoAddr = mem::FindDMAAddy(moduleBase + 0xf4f4, { 0x374, 0x14, 0x0 });
int* ammo = (int*)ammoAddr;
*ammo = 1337;
//or just
//
//*(int*)mem::FindDMAAddy(moduleBase + 0xf4f4, { 0x374, 0x14, 0x0 }) = 1337;
}
}
Sleep(5);
}
//cleanup & inject
fclose(f);
FreeConsole();
FreeLibraryAndExitThread(hModule, 0);
return 0;
}
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
{
CloseHandle(CreateThread(nullptr, 0, (LPTHREAD_START_ROUTINE)HackThread, hModule, 0, nullptr));
}
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}
proc.cpp
#include "proc.h"
DWORD GetProcId(const wchar_t* procName)
{
DWORD procId = 0;
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (hSnap != INVALID_HANDLE_VALUE)
{
PROCESSENTRY32 procEntry;
procEntry.dwSize = sizeof(procEntry);
if (Process32First(hSnap, &procEntry))
{
do
{
if (!_wcsicmp(procEntry.szExeFile, procName))
{
procId = procEntry.th32ProcessID;
break;
}
} while (Process32Next(hSnap, &procEntry));
}
}
CloseHandle(hSnap);
return procId;
}
uintptr_t GetModuleBaseAddress(DWORD procId, const wchar_t* modName)
{
uintptr_t modBaseAddr = 0;
HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);
if (hSnap != INVALID_HANDLE_VALUE)
{
MODULEENTRY32 modEntry;
modEntry.dwSize = sizeof(modEntry);
if (Module32First(hSnap, &modEntry))
{
do
{
if (!_wcsicmp(modEntry.szModule, modName))
{
modBaseAddr = (uintptr_t)modEntry.modBaseAddr;
break;
}
} while (Module32Next(hSnap, &modEntry));
}
}
CloseHandle(hSnap);
return modBaseAddr;
}
uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets)
{
uintptr_t addr = ptr;
for (unsigned int i = 0; i < offsets.size(); ++i)
{
ReadProcessMemory(hProc, (BYTE*)addr, &addr, sizeof(addr), 0);
addr += offsets[i];
}
return addr;
}
proc.h
#pragma once
#include <vector>
#include <windows.h>
#include <TlHelp32.h>
DWORD GetProcId(const wchar_t* procName);
uintptr_t GetModuleBaseAddress(DWORD procId, const wchar_t* modName);
uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets);
记忆.h
#pragma once
#include <Windows.h>
#include <vector>
namespace mem
{
void PatchEx(BYTE* dst, BYTE* src, unsigned int size, HANDLE hProcess);
void NopEx(BYTE* dst, unsigned int size, HANDLE hProcess);
uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets);
void Patch(BYTE* dst, BYTE* src, unsigned int size);
void Nop(BYTE* dst, unsigned int size);
uintptr_t FindDMAAddy(uintptr_t ptr, std::vector<unsigned int> offsets);
}
内存.cpp
#include "mem.h"
void mem::PatchEx(BYTE* dst, BYTE* src, unsigned int size, HANDLE hProcess)
{
DWORD oldprotect;
VirtualProtectEx(hProcess, dst, size, PAGE_EXECUTE_READWRITE, &oldprotect);
WriteProcessMemory(hProcess, dst, src, size, nullptr);
VirtualProtectEx(hProcess, dst, size, oldprotect, &oldprotect);
}
void mem::NopEx(BYTE* dst, unsigned int size, HANDLE hProcess)
{
BYTE* nopArray = new BYTE[size];
memset(nopArray, 0x90, size);
PatchEx(dst, nopArray, size, hProcess);
delete[] nopArray;
}
uintptr_t mem::FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets)
{
uintptr_t addr = ptr;
for (unsigned int i = 0; i < offsets.size(); ++i)
{
ReadProcessMemory(hProc, (BYTE*)addr, &addr, sizeof(addr), 0);
addr += offsets[i];
}
return addr;
}
void mem::Patch(BYTE* dst, BYTE* src, unsigned int size)
{
DWORD oldprotect;
VirtualProtect(dst, size, PAGE_EXECUTE_READWRITE, &oldprotect);
memcpy(dst, src, size);
VirtualProtect(dst, size, oldprotect, &oldprotect);
}
void mem::Nop(BYTE* dst, unsigned int size)
{
DWORD oldprotect;
VirtualProtect(dst, size, PAGE_EXECUTE_READWRITE, &oldprotect);
memset(dst, 0x90, size);
VirtualProtect(dst, size, oldprotect, &oldprotect);
}
uintptr_t mem::FindDMAAddy(uintptr_t ptr, std::vector<unsigned int> offsets)
{
uintptr_t addr = ptr;
for (unsigned int i = 0; i < offsets.size(); ++i)
{
addr = *(uintptr_t*)addr;
addr += offsets[i];
}
return addr;
}