早些年用纯汇编写的一个自用的《征途》外挂（四）

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 内存拷贝
;        参数:        target        （类型PVOID）目标地址
;        参数:        source        （类型PVOID）源地址
;        参数:        dwSize        （类型PVOID）需拷贝的字节数
;        返回:        EAX        （=dwSzie）SUCCESS
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
CopyMemory         proc         uses  edi  esi target: DWORD, source: DWORD, dwSize: DWORD
                 mov         esi, source
                 mov         edi, target
                 mov         ecx, dwSize
                 jecxz        _copy_memory_failed
                
                 cld
         ;_copy_memory_loop:
                 rep         movsb
                 ;loop        _copy_memory_loop
                 mov         eax, dwSize
                 jmp        _copy_memory_exit
        _copy_memory_failed:
                 xor         eax,  eax
        _copy_memory_exit:
                 ret
CopyMemory         endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 初始化事件队列
;        参数:        evtQueue        （类型PVOID）队列
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
InitEventQueue         proc         uses  esi  edi  edx lpEvtQueue: DWORD
                 cmp        lpEvtQueue, NULL
                 jne        _exit_init_event_queue
                 invoke        EnterCriticalSection,  addr g_stCS
                 mov         esi, lpEvtQueue
                assume         esi: ptr EVENTQUEUE
                 ;mov        [esi + EVENTQUEUE.front], 0
                 ;mov        [esi + EVENTQUEUE.rear], 0
                 mov        [ esi].front, 0
                 mov        [ esi].rear, 0
                assume         esi:nothing
                 invoke        LeaveCriticalSection,  addr g_stCS
        _exit_init_event_queue:
                 xor         eax,  eax
                 ret
                
InitEventQueue         endp

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 事件入队列
;        参数:        evtQueue        （类型PVOID）队列
;        参数:        ke        （类型PVOID）按键事件
;        返回:        EAX        （TRUE, SUCCESS;FALSE, FAILED）
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
EnterEventQueue         proc         uses  edx  esi  edi lpEvtQueue: DWORD, lpEvt: DWORD
                        
                 invoke        EnterCriticalSection,  addr g_stCS
                 xor         eax,  eax
                 cmp        lpEvtQueue, NULL
                 je        _en_ke_queue_exit
                 mov         edi, lpEvtQueue
                assume         edi: ptr EVENTQUEUE
        _en_ke_queue:
                 movzx         eax, [ edi].rear
                 add         eax, 1
                 mov         ecx, MAX_KEY_EVENT
                 xor         edx,  edx
                 div         ecx
                 cmp         dl, [ edi].front
                 je        _en_ke_queue_full
                 mov        [ edi].rear,  dl
                 mov         ecx, sizeof EVENTDATA
                 mov         eax,  edx
                 mul         ecx
                 lea         esi,  DWORD  ptr [ edi +  eax]
                 invoke        CopyMemory,  esi, lpEvt,  ecx
                 mov         eax,  eax
                 jmp        _en_ke_queue_exit
        _en_ke_queue_full:
                 invoke        InitEventQueue, lpEvtQueue
                 jmp        _en_ke_queue
        _en_ke_queue_exit:
                 push         eax
                 invoke        LeaveCriticalSection,  addr g_stCS
                assume         edi:nothing
                 pop         eax
                 ret
EnterEventQueue         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 事件出队列
;        参数:        evtQueue（类型PVOID）队列
;        参数:        ke        （类型PVOID）出队的按键事件
;        返回:        EAX        （TRUE, SUCCESS;FALSE, FAILED）
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
GetEventQueue         proc         uses  edi  esi  edx lpEvtQueue: DWORD, lpEvt: DWORD
                 invoke        EnterCriticalSection,  addr g_stCS
                 xor         eax,  eax
                 cmp        lpEvtQueue, NULL
                 je        _get_ke_queue_exit
                 mov         edi, lpEvtQueue
                assume         edi: ptr EVENTQUEUE
                 movzx         eax, [ edi].front
                 cmp         al, [ edi].rear
                 je        _get_ke_queue_empty
                 add         eax, 1
                 mov         ecx, MAX_KEY_EVENT
                 xor         edx,  edx
                 div         ecx
                 mov        [ edi].front,  dl
                 mov         ecx, sizeof EVENTDATA
                 mov         eax,  edx
                 mul         ecx
                 lea         esi,  DWORD  ptr [ edi +  eax]
                 invoke        CopyMemory, lpEvt,  esi,  ecx
                 mov         ebx, [ esi + EVENTDATA.dwCurWnd]
                 cmp         ebx, g_ZTCurWnd
                 jne        _front_dec
                 invoke        MemSet,  esi, 0, sizeof EVENTDATA
                 mov         eax,  TRUE
                 jmp        _get_ke_queue_exit
        _front_dec:
                 sub        [ edi].front, 1
        _get_ke_queue_empty:
                 xor         eax,  eax
        _get_ke_queue_exit:
                 push         eax
                 invoke        LeaveCriticalSection,  addr g_stCS
                assume         edi:nothing
                 pop         eax
                 ret
GetEventQueue         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 判断队列是否为满
;        参数:        evtQueue        （类型PVOID）队列
;        返回:        EAX                （TRUE, FULL;FALSE, NotFull）
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
IsFullEventQueue         proc         uses  esi lpEvtQueue: DWORD
                 invoke        EnterCriticalSection,  addr g_stCS
                 xor         eax,  eax
                 cmp        lpEvtQueue, NULL
                 je        _exit_is_full
                 mov         esi, lpEvtQueue
                assume         esi: ptr EVENTQUEUE
                 movzx         eax, [ esi].rear
                 add         eax, 1
                 mov         ecx, MAX_KEY_EVENT
                 xor         edx,  edx
                 div         ecx
                 cmp         dl, [ esi].front
                 jne        _not_full
                 mov         eax,  TRUE
                 jmp        _result_full_adjust
        _not_full:
                 xor         eax,  eax
        _result_full_adjust:
                assume         esi:nothing
        _exit_is_full:
                 push         eax
                 invoke        LeaveCriticalSection,  addr g_stCS
                 pop         eax
                 ret
IsFullEventQueue         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 判断队列是否为空
;        参数:        evtQueue        （类型PVOID）队列
;        返回:        EAX        （TRUE, Empty;FALSE, NotEmpty）
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
IsEmptyEventQueue         proc         uses  esi lpEvtQueue: DWORD
                 invoke        EnterCriticalSection,  addr g_stCS
                 xor         eax,  eax
                 cmp        lpEvtQueue, NULL
                 je        _exit_is_empty
                 mov         esi, lpEvtQueue
                assume         esi: ptr EVENTQUEUE
                 movzx         eax, [ esi].front
                 cmp         al, [ esi].rear
                 jne        _not_empty
                 mov         eax,  TRUE
                 jmp        _result_empty_adjust
        _not_empty:
                 xor         eax,  eax
        _result_empty_adjust:
                assume         esi:nothing
        _exit_is_empty:
                 push         eax
                 invoke        LeaveCriticalSection,  addr g_stCS
                 pop         eax
                 ret
IsEmptyEventQueue         endp        

;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 向事件队列添加按键事件
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
AddKeyEventToQueue         proc         uses  edx  edi  esi skillKeyIndex: DWORD, \
                                skillLevel: DWORD, time: DWORD, skillState: DWORD
                 local        _evt:EVENTDATA
                 local        _vKey: DWORD
                
                 mov         eax, skillKeyIndex
                 .if         eax <= 9
                         add         eax, 30H
                 .else
                         add         eax, 66H        
                 .endif
                 mov        _vKey,  eax
                 invoke        RtlZeroMemory,  addr _evt, sizeof EVENTDATA
                 push        skillLevel
                 pop        _evt.dwLevel
                 mov        _evt.EvtInput.dwType, INPUT_KEYBOARD
                 PUSH        _vKey
                 POP        _evt.EvtInput.ki.wVk
                 invoke        MapVirtualKey, _vKey, 0
                 mov        _evt.EvtInput.ki.wScan,  eax
                 push        time
                 pop        _evt.dwDelay
                 push        skillState
                 pop        _evt.dwEvtMask
                 mov        _evt.EvtInput.ki.dwFlags, KEYEVENTF_UNICODE
                 push        g_ZTCurWnd
                 pop        _evt.dwCurWnd
                
;                invoke        IsFullEventQueue, g_EvtQueueOfMapAddr
;                test        eax, eax
;                jz        _add_key_evt_to_queue
;                invoke        InitEventQueue, g_EvtQueueOfMapAddr
        _add_key_evt_to_queue:
                 invoke        EnterEventQueue,  offset g_EvtQueue,  addr _evt
                 xor         eax,  eax
                 ret
                
AddKeyEventToQueue         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 事件执行线程执行体
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
EventThreadProc         proc         uses  edx  edi  esi lParam: DWORD
                 local        _evt:EVENTDATA
                 local        _activeWnd: DWORD
                 local        _threadID: DWORD
                 local        _buf[5]: BYTE
                
        _event_thread_loop:
                 invoke        Sleep, 10
                 invoke        RtlZeroMemory,  addr _evt, sizeof EVENTDATA
                 invoke        IsExistGameProcess
                 .if        ! eax
                         invoke        SendMessage, g_MainWnd, WM_CLOSE,  TRUE, 0
                 .endif
                
                 cmp        g_HelpStop,  TRUE
                 je        _event_thread_exit
        
         ; 检查当前队列是否为空
         ;********************************************************************
                 invoke        IsEmptyEventQueue,  offset g_EvtQueue
                 test         eax,  eax
                 jnz        _event_thread_loop
         ; 等待事件执行互斥体释放
         ;********************************************************************
                 invoke        WaitForSingleObject, g_hMutex, INFINITE
         ; 从事件队列中获取事件
         ;********************************************************************
                 invoke        GetEventQueue,  offset g_EvtQueue,  addr _evt
                 test         eax,  eax
                 jz        _event_thread_release_mutex
         ; 事件类型判断
         ;********************************************************************        
                 mov         eax, _evt.EvtInput.dwType
                 cmp         eax, INPUT_KEYBOARD
                 jne        _event_thread_release_mutex
        
        _event_thread_keyboard_evt:
         ; 是否处于打坐状态,是站起
         ;********************************************************************        
                 invoke        GetSitState, 0
                 .if         eax
                         invoke        PostMessage, g_ZTCurWnd, WM_KEYDOWN, 044H, 00440001H
                         invoke        PostMessage, g_ZTCurWnd, WM_KEYUP, 044H, 0C0440000H
                         invoke        Sleep, 200
                 .endif
;                .if        _evt.EvtInput.ki.wVk >=0  && _evt.EvtInput.ki.wVk <= 39H
;                        mov        eax, _evt.EvtInput.ki.wScan
;                        shl        eax, 10H
;                        or        eax, 00000001H
;                        push        eax
;                        invoke        lpSetKeyData, TRUE, _evt.EvtInput.ki.wVk
;                        invoke        SendMessage, g_ZTCurWnd, WM_KEYDOWN, _evt.EvtInput.ki.wVk, _evt.EvtInput.ki.wScan
;;                        invoke        Sleep, 100
;;                        pop        eax
;;                        or        eax, 0C0000000H
;;                        invoke        PostMessage, g_ZTCurWnd, WM_KEYUP, _evt.EvtInput.ki.wVk, eax
;                        invoke        lpSetKeyData, FALSE, NULL
;                .else
         ; 保存当前前台窗体句柄
         ;********************************************************************
                 mov        _activeWnd, NULL
                 invoke        GetForegroundWindow
                 mov        _activeWnd,  eax
                 invoke        SetForegroundWindow, g_ZTCurWnd
                 invoke        Sleep, 500
                
                 invoke        keybd_event, _evt.EvtInput.ki.wVk, _evt.EvtInput.ki.wScan, 0, 0
                 invoke        Sleep, 100
                 invoke        keybd_event, _evt.EvtInput.ki.wVk, _evt.EvtInput.ki.wScan, \
                        KEYEVENTF_KEYUP, 0
                 invoke        Sleep, 500
                
         ; 置原窗体为前台窗体
         ;********************************************************************
                 mov         eax, _activeWnd
                 cmp         eax, g_ZTCurWnd
                 je        _event_thread_delay_time
                
                 cmp         eax, NULL
                 je        _event_thread_delay_time
                 invoke        SetForegroundWindow, _activeWnd
                
;                .endif
        
         ;********************************************************************
        _event_thread_delay_time:
                 invoke        ReleaseMutex, g_hMutex
                 invoke        Sleep, _evt.dwDelay
                 mov         eax, _evt.dwEvtMask
                 BTC        g_SkillAssoilState,  eax
                 jmp        _event_thread_loop
         ;********************************************************************
        _event_thread_release_mutex:
                 invoke        ReleaseMutex, g_hMutex
;        _event_thread_other_evt:
                 jmp        _event_thread_loop
        _event_thread_exit:
                 xor         eax,  eax
                 ret
EventThreadProc         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 显示信息线程执行体
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
ShowInfoThreadProc         proc         uses  edx  edi  esi lParam: DWORD
                
        _show_thread_loop:
                 invoke        Sleep, 10
                 invoke        IsExistGameProcess
                 .if        ! eax
                         invoke        SendMessage, g_MainWnd, WM_CLOSE,  TRUE, 0
                 .endif
                
                 cmp        g_HelpStop,  TRUE
                 je        _show_thread_exit
                 ;call        GetMousePos
                 invoke        ShowSelfInfo, 0
                 .if        !g_IsLoadOption
                         call LoadOption
                         mov        g_IsLoadOption,  TRUE
                 .endif
                 invoke        ShowObjectInfo, 0
                 invoke        GetSitState, 0
                 jmp        _show_thread_loop
                
        _show_thread_exit:
                 xor         eax,  eax
                 ret
                
ShowInfoThreadProc         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 角色辅助线程执行体
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
HelpThreadProc         proc
                
        _help_thread_loop:
                 invoke        Sleep, 10
                 invoke        IsExistGameProcess
                 .if        ! eax
                         invoke        SendMessage, g_MainWnd, WM_CLOSE,  TRUE, 0
                 .endif
                 mov         eax, g_IsLoadOption
                 cmp         eax,  TRUE
                 jne        _help_thread_loop
                
                 cmp        g_HelpStop,  TRUE
                 je        _help_thread_exit
                
                 call        SafeSelf
                 call        HelpeSelf
                 call        AutoAssoilSkill
                 call        XianSafeObject
                 call        XianSitDown
                 jmp        _help_thread_loop
        _help_thread_exit:
                 xor         eax,  eax
                 ret
                
HelpThreadProc         endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 类似C语言的memset函数
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
MemSet                 proc         uses  edx  edi  esi dest: DWORD, char: BYTE, _dwSize: DWORD
                
                 mov         edi, dest
                 mov         ecx, _dwSize
                 mov         al, char
                 cld
                 rep         stosb
                 ret
MemSet                 endp
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
; 查找游戏PID
;        参数:        lpProcessName        游戏进程名
;                lpPidFilterList        要过滤掉的游戏进程PID
;        返回：无
;>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>
SearchGameProcess         proc         uses  ebx  edi  esi lpProcessName: DWORD, lpPidFilterList: DWORD
                 local        _stProcess:PROCESSENTRY32
                 local        _hSnapShot
                
                 invoke        RtlZeroMemory,  addr _stProcess, sizeof PROCESSENTRY32
                 mov        _stProcess.dwSize, sizeof PROCESSENTRY32
                 invoke        CreateToolhelp32Snapshot, TH32CS_SNAPPROCESS, 0
                 mov        _hSnapShot,  eax
                 invoke        Process32First, _hSnapShot,  addr _stProcess
                 test         eax,  eax
                 jz        _exit_search_game_process
                
        _search_game_process_start:
                 invoke        lstrcmp, [lpProcessName],  addr _stProcess.szExeFile
                 test         eax,  eax
                 jnz        _search_game_process_next
         ;************************************************************
         ; 搜索存在的PID列表，是否存在当前PID值
                 mov         esi, lpPidFilterList
                 mov         ecx, MAX_GAME_PROCESS_INFO
                 mov         eax, _stProcess.th32ProcessID
        _search_pid_loop:
                 cmp        [ esi],  eax
                 je        _search_game_process_next
                 add         esi, 4
                 loop        _search_pid_loop
        
         ;************************************************************
                 push        _stProcess.th32ProcessID                         ; 如果列表以查找完并且没有存在，则保存当前PID值
                 pop        g_ZTCurPID
                
                 jmp        _exit_search_game_process
                
        _search_game_process_next:
                 invoke        Process32Next, _hSnapShot,  addr _stProcess
                 test         eax,  eax
                 jz        _exit_search_game_process
                 jnz        _search_game_process_start

        _exit_search_game_process:
                 invoke        CloseHandle, _hSnapShot
                 xor         eax,  eax
                 ret        
SearchGameProcess         endp