秘密潜入1-榴弹枪射速修改-Python源码

B站搜索：指尖じ跳动

import win32process

from ctypes import *

from win32process import *
from win32api import *
from win32gui import *
from win32con import *
from win32gui import *
from win32security import *

import os
import win32com.client
from ctypes import *
import time


def opendebug():

    # 打开进程令牌，提升调试权限，
    htoken = OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES)

    if htoken == None:
        print("打开进程令牌失败")
        speaker.Speak("打开进程令牌失败")

        return False
    print("打开进程令牌成功")
    speaker.Speak("打开进程令牌成功")

    luid = LookupPrivilegeValue(None, SE_DEBUG_NAME)

    if luid == None:
        print("LookupPrivilegeValue错误")
        speaker.Speak("LookupPrivilegeValue错误")

        return False

    tp = ((luid, SE_PRIVILEGE_ENABLED),)
    if AdjustTokenPrivileges(htoken, FALSE, tp) == None:
        print("权限写入失败")
        speaker.Speak("权限写入失败")

        return False

    print("权限写入成功")
    speaker.Speak("权限写入成功")

    CloseHandle(htoken);  # 关闭令牌
    return True

# PROCESS_ALL_ACCESS=(0x000F0000|0x00100000|0xFFF)
kernel32dll = windll.kernel32
speaker=win32com.client.Dispatch("SAPI.SPVOICE")#系统接口
pid = None;

window = FindWindow("Innerloop", None)
if window == None:
    windll.user32.MessageBoxW(0, "Window no found", "", None)
tid, pid = win32process.GetWindowThreadProcessId(window)
if pid == None:
    windll.user32.MessageBoxW(0, "Process id no found", "", None)
hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid)
print('进程句柄：%#x' % int(hprocess))

if hprocess == None:
    windll.user32.MessageBoxW(0, "句柄无效", "", None)

if opendebug() == True:  #进程提权
    print("进程权限提升成功")
    speaker.Speak("进程权限提升成功")
else:
    print("进程权限提升失败")
    speaker.Speak("进程权限提升失败")
#0x533490，5452944‬
print("读取进程成功")
speaker.Speak("读取进程成功")


hDll = windll.LoadLibrary("Kernel32.dll")

temp=None

hDll.VirtualProtectEx(int(hprocess),0x533490,0x1000, PAGE_EXECUTE_READWRITE, id(temp))
int_err = GetLastError()
if int_err:
    print("内存属性修改错误,错误码:%d"%int_err)
    speaker.Speak("内存属性修改错误,错误码:%d"%int_err)
else:
    print("内存属性修改成功")
    speaker.Speak("内存属性修改成功")

del hDll


windll.kernel32.WriteProcessMemory(int(hprocess), 0x0040F4E8,
                                   byref(c_long(0x40E9C0)), 4, None)
int_err = GetLastError()
if int_err:
    print("榴弹射速修改错误,错误码:%d"%int_err)
    speaker.Speak("榴弹射速修改错误,错误码:%d"%int_err)
else:
    print("榴弹射速修改成功")
    speaker.Speak("榴弹射速修改成功")

windll.kernel32.WriteProcessMemory(int(hprocess), 0x0040ED06,
                                   byref(c_byte(0x90)), 1, None)

windll.kernel32.WriteProcessMemory(int(hprocess), 0x0040ED07,
                                   byref(c_byte(0x90)), 1, None)
int_err = GetLastError()
if int_err:
    print("子弹检测去除错误,错误码:%d"%int_err)
    speaker.Speak("子弹检测去除错误,错误码:%d"%int_err)
else:
    print("子弹检测去除成功")
    speaker.Speak("子弹检测去除成功")

B站搜索：指尖じ跳动