• 保证模拟游戏中小老鼠不被打死

      • 血量不减
      • 判断die跳过
      • 血量不变

    • 知识点

      • 获得进程PID的方法
        • 方法一：CreateToolhelp32Snapshot、Process32First、Process32Next、CloseHandle
        • 方法二：FindWindow、GetWindowThreadProcessId
      • 获取进程句柄
        • OpenProcess
      • 搜索要patch的位置
        • SearchMemory（自定义）：一块一块的查找
          • EnumProcessModules：获得指定进程中所有模块的句柄
          • VirtualQueryEx：查询地址空间中内存地址的信息（保护属性等）
          • ReadProcessMemory：读取内存
          • CloseHandle
      • 读取memory
        • ReadProcessMemory
      • 写入memory
        • WriteProcessMemory

    • 模块（exe或者dll）被加载后，其开始地址就是该模块的句柄值，通常应用程序都是通过模块句柄来访问它的每个进程中的模块（一个应用程序可能启动多个进程），事实上模块句柄的值就是该模块映射到进程中的地址。进程是系统中运行的应用程序，进程句柄中储存用于访问该进程的一些信息，句柄值是一个索引值，通过该索引可以访问句柄中的内容

    1. #include <stdio.h>
    2. #include <stdlib.h>
    3. #include <windows.h>
    4. #include <tlhelp32.h>
    5. #include <tchar.h>
    6. #include <psapi.h>
    7. #include<stdio.h>
    8. #include<malloc.h>
    9. #include <array>
    12. BYTE* SearchMemory(HANDLE hProcess, DWORD pSearchBuffer1, DWORD pSearchBuffer2,DWORD dwSearchBufferSize)
    13. {
    14.     // 根据PID, 打开进程获取进程句柄
    15.     //HANDLE hProcess = ::OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwProcessId);
    16.     //if (NULL == hProcess)
    17.     //{
    18.     //    ShowError("OpenProcess");
    19.     //    return FALSE;
    20.     //}
    21.     // 获取进程加载基址
    22.     HMODULE hModule[1024];
    23.     DWORD cbNeeded;
    24.     EnumProcessModules(hProcess, (HMODULE*)hModule, sizeof(hModule), &cbNeeded);
    25.     // 把加载基址作为遍历内存的起始地址, 开始遍历
    27.     BYTE* pSearchAddress2 = (BYTE * )hModule[0];//从加载的第一个模块开始
    28.     printf("%x\n", pSearchAddress2);  
    29.     BYTE* pSearchAddress = (BYTE*)0x00010000;
    31.     MEMORY_BASIC_INFORMATION mbi = { 0 };
    32.     DWORD dwRet = 0;
    33.     BOOL bRet = FALSE;
    34.     DWORD* pTemp = NULL;
    35.     DWORD i = 0;
    36.     DWORD* pBuf = NULL;
    38.     while (pSearchAddress >= (BYTE*)0 && pSearchAddress <= (BYTE*)pSearchAddress2 && mbi.RegionSize >= 0)
    39.     {
    40.         // 查询地址空间中内存地址的信息
    41.         ::RtlZeroMemory(&mbi, sizeof(mbi));
    42.         dwRet = ::VirtualQueryEx(hProcess, (LPVOID)pSearchAddress, &mbi, sizeof(mbi));
    43.         //printf("%d\n", dwRet);
    44.         if (0 == dwRet)
    45.         {
    46.             //printf("hhhh");
    47.             break;
    48.         }
    49.         // printf("0x%p\n", pSearchAddress);
    50.         // 过滤内存空间, 根据内存的状态和保护属性进行过滤
    51.         if ((MEM_COMMIT == mbi.State) &&
    52.             (PAGE_READONLY == mbi.Protect || PAGE_READWRITE == mbi.Protect ||
    53.                 PAGE_EXECUTE_READ == mbi.Protect || PAGE_EXECUTE_READWRITE == mbi.Protect))
    54.         {
    55.            // printf("find pages\n");
    56.             // 申请动态内存
    57.             //pBuf = new DWORD[mbi.RegionSize / 4];
    58.             byte* FindArray = new byte[mbi.RegionSize];
    59.             DWORD dwData;
    60.             DWORD dwData2;
    61.            // printf("RegionSize: %d\n", mbi.RegionSize);
    62.             ::RtlZeroMemory(FindArray, mbi.RegionSize);
    63.             // 读取整块内存
    64.             if (ReadProcessMemory(hProcess, (LPVOID)pSearchAddress, FindArray, mbi.RegionSize, &dwRet))
    65.             {
    66.                // printf("read success\n");
    67.                 int len = 8;
    68.                 byte* intBuff = new byte[len];
    69.                 for (int i = 0; i < mbi.RegionSize - dwSearchBufferSize; i++)
    70.                 {
    71.                     int tmp = i;
    72.                     for (int j = 0;j < len;j++)
    73.                     {
    74.                         intBuff[j] = FindArray[tmp];
    75.                         tmp += 1;
    76.                     }
    77.                     dwData = intBuff[0];
    78.                     for (int j = 1;j < len/2;j++)
    79.                     {
    80.                         dwData= dwData | intBuff[j] << len *j;
    81.                     }
    82.                     dwData2 = intBuff[4];
    83.                     for (int j = 5;j < len;j++)
    84.                     {
    85.                         dwData2 = dwData2 | intBuff[j] << len * (j-4);
    86.                     }
    89.                     if (dwData == (DWORD)pSearchBuffer1 && dwData2 == (DWORD)pSearchBuffer2) {
    90.                         return (BYTE*)mbi.BaseAddress + i;
    92.                     }
    94.                 }
    95.             }
    97.             // 释放内存
    98.             delete[]pBuf;
    99.             pBuf = NULL;
    100.         }
    101.         // 继续对下一块内存区域进行遍历
    102.         pSearchAddress = pSearchAddress + mbi.RegionSize;
    103.     }
    104.     // 释放内存, 关闭句柄
    105.     if (pBuf)
    106.     {
    107.         delete[]pBuf;
    108.         pBuf = NULL;
    109.     }
    111.     ::CloseHandle(hProcess);
    112.     return 0;
    113. }
    116. int main()
    117. {
    118.     //获取进程PID_方法一
    119.     //  int pid=0;
    120.     //  PROCESSENTRY32 processentry={0};   //创建一个进程结构体
    121.     //  processentry.dwSize=sizeof(PROCESSENTRY32);
    122.     //  HANDLE hprocessSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);  //获取进程快照
    123.     //  if(hprocessSnap==INVALID_HANDLE_VALUE){
    124.     //     return -1;
    125.     //  }
    126.     //  int flag=Process32First(hprocessSnap,&processentry);  //获取第一个进程
    128.     //  while(flag){
    129.     //     if(lstrcmpi(processentry.szExeFile,"Afkayas.exe")==0){  //lstrcmpi函数用于比较两个字符串，相同时返回0
    130.     //         pid=processentry.th32ProcessID;
    131.     //     }
    132.     //   //  printf("%d----%s\n",processentry.th32ProcessID,processentry.szExeFile);
    133.     //     flag=Process32Next(hprocessSnap,&processentry);
    135.     //  }
    136.     //  CloseHandle(hprocessSnap);
    138.     // if(pid==0){
    139.     //     printf("请先打开进程");
    140.     //     return 0;
    141.     //  }
    143.     //获取进程PID_方法二
    144.     HWND hWnd = FindWindow(NULL, _T("MemSearchTest"));
    145.     if (hWnd == NULL) {    //如果无法获取句柄则报错
    146.         printf("无法获取进程句柄,请检查进程是否存在！");
    147.         getchar();
    148.         return -1;
    149.     }
    150.     //GetWindowThreadProcessId获取进程ID的变量类型是DWORD,但是GetWindowThreadProcessId在MSDN中并没有明确表示返回值得成功与失败，所以我们定义一个DWORD类型变量赋值为0，在调用GetWindowThreadProcessId之后看一下ID是否还为0如果为0则失败,一般来说不会失败！
    151.     DWORD Process_ID = 0;
    152.     GetWindowThreadProcessId(hWnd, &Process_ID);    //PID这里传址
    153.     printf("PID:%d\n", Process_ID);
    154.     if (Process_ID == 0) {    //判断是否与原值相同
    155.         printf("无法获取进程ID");
    156.     }
    159.     //获取进程句柄
    160.     HANDLE procHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Process_ID);
    162.     if (procHandle == NULL) {
    163.         printf("打开进程失败！");
    164.         return 0;
    165.     }
    168.     // 搜索要替换的位置
    169.     BYTE* address=SearchMemory(procHandle, 0x0000005A, 0x0000425C,8);
    172.     int blood;
    173.     int ord;
    174.     DWORD buffer;
    176.     /* 永恒方法一
    177.     // 运算失效: -10 -> -0
    181.     if(ReadProcessMemory(procHandle,(LPCVOID)0x00400000,&tmp,1,&buffer)){
    182.        printf("读取成功，读取内容为：%#X\n",tmp);
    183.     }
    184.     else{
    185.        printf("读取进程内容失败！");
    186.        exit(-1);
    187.     }
    189.     tmp=0x00;
    190.     if(WriteProcessMemory(procHandle,(LPVOID)0x00401E2D,&tmp,1,&buffer)){
    191.            printf("写入进程内容成功\n");
    192.         }
    193.         else{
    194.             printf("写入进程内容失败！\n");
    195.             exit(-1);
    196.     }
    197.     if(ReadProcessMemory(procHandle,(LPCVOID)0x00401E2D,&tmp,1,&buffer)){
    198.        printf("读取成功，读取内容为：%#X\n",tmp);
    199.     }
    200.     else{
    201.        printf("读取进程内容失败！");
    202.        exit(-1);
    203.     }
    204.     */
    207.     /* 永恒方法二*/
    208.     // 血量不变
    209.     while(TRUE)
    210.     {
    211.         blood=0x64;
    212.         if (!ReadProcessMemory(procHandle, (LPCVOID)address, &ord, 1, &buffer)) {
    214.             printf("读取进程内容失败！");
    215.             exit(-1);
    216.         }
    217.         if (ord != blood)
    218.         {
    219.             if (!WriteProcessMemory(procHandle, (LPVOID)address, &blood, 1, &buffer)) {
    221.                 printf("写入进程内容失败！\n");
    222.                 exit(-1);
    224.             }
    226.         }
    228.         //PostMessage(hWnd, WM_PAINT, 0,0);
    229.     }
    234.     /*永恒方法三
    235.     //判断失效
    237.      if(ReadProcessMemory(procHandle,(LPCVOID)0x00401E36,&tmp,1,&buffer)){
    238.         printf("读取成功，读取内容为：%#X\n",tmp);
    239.      }
    240.      else{
    241.         printf("读取进程内容失败！");
    242.         exit(-1);
    243.      }
    245.      tmp=0xEB;//jg->jmp
    246.      if(WriteProcessMemory(procHandle,(LPVOID)0x00401E36,&tmp,1,&buffer)){
    247.             printf("写入进程内容成功\n");
    248.          }
    249.          else{
    250.              printf("写入进程内容失败！\n");
    251.              exit(-1);
    252.      }
    253.      if(ReadProcessMemory(procHandle,(LPCVOID)0x00401E36,&tmp,1,&buffer)){
    254.         printf("读取成功，读取内容为：%#X\n",tmp);
    255.      }
    256.      else{
    257.         printf("读取进程内容失败！");
    258.         exit(-1);
    259.      }
    260.      */
    263.     return 0;
    264. }