孤岛惊魂3-孤岛惊魂3-武器射速修改-一枪100发

1 篇文章 0 订阅
1 篇文章 0 订阅

B站搜索:指尖じ跳动

程序:32位

game.cpp

#include "game.h"


//返回模块中函数地址的偏移地址,函数名为空返回模块地址,偏移量默认为0
int GetModuleFuncAddress(char *ModuleName, char *FuncName,int Offset)
{

	HMODULE ModuleAddress = NULL;
	FARPROC FuncAddress = NULL;

	if (ModuleName == NULL)
	{
		return NULL;
	}

	ModuleAddress = GetModuleHandle("FC3.dll");

	if (FuncName!=NULL)
	{
		
		FuncAddress = GetProcAddress(ModuleAddress, FuncName);
		printf("模块句柄=%p,函数地址=%p\n", ModuleAddress, FuncAddress);
	}
	
	return (int)FuncAddress + Offset;

}

game.h

#pragma once

#include <windows.h>
#include <Shlwapi.h>
#include<process.h>
#include<stdio.h>


//返回模块中函数地址的偏移地址,函数名为空返回模块地址,偏移量默认为0
int GetModuleFuncAddress(char* ModuleName, char* FuncName, int Offset);

halhook.cpp

#include "halhook.h"


BOOL FC3::OpenDebug()
{
	HANDLE htoken;//令牌
	BOOL fok = FALSE;
	//打开进程令牌,提升调试权限,
	printf("进程ID%d\n", GetCurrentProcessId());
	if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &htoken))
	{
		TOKEN_PRIVILEGES tp;
		tp.PrivilegeCount = 1;//设置默认权限
		if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid))//遍历权限
		{


		}
		tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;//开启
		if (AdjustTokenPrivileges(htoken, FALSE, &tp, sizeof(tp), NULL, NULL)==NULL)//令牌失效
		{

		}
		else
		{
			fok = TRUE;
			
		}
		CloseHandle(htoken);//关闭令牌


	}
	return fok;

}


void FC3::CreateConsole()
{
	HANDLE _handleOutput;
	FILE* stream;
	if (AllocConsole() == 0)//分配一个控制台窗口
	{
		MessageBox(0, "分配控制台窗口失败!", "", 0);
	}

	_handleOutput = GetStdHandle(STD_OUTPUT_HANDLE);
	SetConsoleTextAttribute(_handleOutput, FOREGROUND_RED | FOREGROUND_INTENSITY);
	freopen_s(&stream, "CON", "r", stdin);//重定向输入流
	freopen_s(&stream, "CON", "w", stdout);//重定向输入流
	SetConsoleTitle("游戏输出窗口:(QQ:2771135787)");
}

DWORD WINAPI FC3::ThreadProc(LPVOID lpThreadParameter)
{

	
	while (hgamew==NULL)
	{
		hgamew = FindWindow(TEXT("Nomad"), NULL);

	}

	printf("获取窗口句柄成功,开始设置硬件断点。。。\n");

	tid = NULL;
	th = nullptr;


	tid = GetWindowThreadProcessId(hgamew, &pid);

	if (tid == NULL)
	{
		printf("线程ID获取失败:%d\n", GetLastError());
		return 0;
	}
	printf("线程ID获取成功:%p\n", tid);
	th = OpenThread(THREAD_ALL_ACCESS, FALSE, tid);

	if (th == nullptr)
	{
		printf("线程句柄获取失败:%d\n", GetLastError());
		return 0;
	}
	printf("线程句柄获取成功:%p\n", th);

	
	SetHalBreakPoint();

	CloseHandle(th);


	return TRUE;
}



void FC3::SetBreakPoint(int breakaddr)//设置软件断点
{

	*(unsigned char*)breakaddr = 0xCC;//设置软件断点
}


void FC3::SetHalBreakPoint()//设置硬件断点
{

	printf("AttackAddr=%p\n", AttackAddr);
	printf("HpAddr=%p\n", HpAddr);
	
	SuspendThread(th);

	GetThreadContext(th,&context);

	context.ContextFlags = CONTEXT_DEBUG_REGISTERS;

	context.Dr7 = 0x1;

	context.Dr0 = AttackAddr;

	//context.Dr1 = HpAddr;

	


	ret = SetThreadContext(th, &context);

	printf("设置线程上下文:错误码=%d,返回值=%d\n", GetLastError(),ret);

	memset(&context, 0, sizeof(context));

	

	GetThreadContext(th, &context);

	printf("Dr7=%p\n", context.Dr7);

	printf("Dr0=%p\n", context.Dr0);

	printf("Dr1=%p\n", context.Dr1);

	ResumeThread(th);

	if (context.Dr0 == 0)
	{
		printf("设置硬件断点1失败\n");
	}
	else
	{
		printf("设置硬件断点1成功\n");
	}

	if (context.Dr1 == 0)
	{
		printf("设置硬件断点2失败\n");
	}
	else
	{
		printf("设置硬件断点2成功\n");
	}

	

}


LONG CALLBACK FC3::VectoredHandler(PEXCEPTION_POINTERS pExceptionInfo)
{
	static int i = 0;


	static int _esi;
	static int _eax;
	static int _ecx;
	static int _edx;
	static int _edi;

	static float hp = 0;

	static float hpmax = 100.00;



	if (HpAddr == pExceptionInfo->ContextRecord->Eip)
	{
		_esi = pExceptionInfo->ContextRecord->Esi;
		
		__asm
		{
			/*mov esi, _esi
			movss xmm0, dword ptr ds : [esi + 0x10]
			movss hp, xmm0*/

			/*movss xmm0, hpmax
			movss  dword ptr ds : [esi + 0x10],xmm0*/
			
		}

		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED);
		printf("血量=%f,血量地址=%p\n", hp, _esi + 10);


		//pExceptionInfo->ContextRecord->Eip += 5;

		return EXCEPTION_CONTINUE_EXECUTION;
	}


	//一枪100发
	if (AttackAddr == pExceptionInfo->ContextRecord->Eip)
	{
		_esi = pExceptionInfo->ContextRecord->Esi;
		_edx = pExceptionInfo->ContextRecord->Edx;
		_edi = pExceptionInfo->ContextRecord->Edi;
		for (int i = 0; i < num; i++)
		{
			
			__asm
			{


				mov edx, _edx
				mov edi, _edi
				mov esi, _esi

				push edx

				mov ecx, [esi + 0x000000E8]
				mov eax,[ecx]

				push edi
				call dword ptr[eax + 0x2C]

				pop edx

				mov _edx, edx
				mov _ecx, ecx
				mov _eax, eax
			}
		}
		__asm
		{
			mov esi, _esi
			mov eax, num
			mov dword ptr ds : [esi + 0xCC] , eax
		}
		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_GREEN);
		printf("第%d次开枪\n", i);

		printf("_edx=%p,_ecx=%p,_eax=%p\n", _edx, _ecx, _eax);

		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_BLUE);
		printf("射速:%d发/1枪\n", num);


		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED);
		printf("射击成功\n");

		SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_GREEN | FOREGROUND_RED);
		printf("EIP=%#x\n", pExceptionInfo->ContextRecord->Eip);
		printf("%#x\n", *(unsigned char*)AttackAddr);

		i++;

		pExceptionInfo->ContextRecord->Eip += 4;

		return EXCEPTION_CONTINUE_EXECUTION;
	}
	return EXCEPTION_EXECUTE_HANDLER;
}




void FC3::GameInit()
{
	AttackAddr = GetModuleFuncAddress((char*)"FC3.dll", (char*)"FCS_Server_DeleteMatchStats", 0x409A8F);

	HpAddr = GetModuleFuncAddress((char*)"FC3.dll", (char*)"FCS_Server_DeleteMatchStats", 0x4AA181);
	
	hgamew = NULL;
	hmyw = NULL;
	num = 99;

	tid = 0;

	th = nullptr;


	CreateConsole();

	hmyw = GetConsoleWindow();

	if (hmyw == NULL)
	{
		MessageBox(0, TEXT("获取调试窗口失败"), TEXT(""), 0);
		return;
	}

	if (FC3::OpenDebug() == FALSE)
	{
		printf("提升进程权限失败\n");
		return;
	}
	printf("提升进程权限成功\n");

	CreateThread(NULL, NULL, ThreadProc, NULL, NULL, NULL);

	AddVectoredExceptionHandler(NULL, VectoredHandler);

	
	
}

halhook.h

#pragma once

#include <windows.h>
#include <Shlwapi.h>
#include<process.h>
#include<stdio.h>
#include"game.h"



namespace FC3
{
	static int num;
	static  HWND hgamew;
	static  HWND hmyw;

	static int AttackAddr;
	static int HpAddr;

	static DWORD pid;
	static DWORD tid;
	static HANDLE th;
	static CONTEXT context;
	static BOOL ret = TRUE;


	void CreateConsole();
	DWORD WINAPI ThreadProc(LPVOID lpThreadParameter);


	BOOL OpenDebug();
	void SetBreakPoint(int breakaddr);//设置软件断点
	void SetHalBreakPoint();//设置硬件断点

	LONG CALLBACK VectoredHandler(PEXCEPTION_POINTERS pExceptionInfo);
	void GameInit();
}


拦截射击-硬件断点.cpp

//Created by AheadLib x86/x64 v1.2
#include<stdio.h>
#include<Windows.h>
#include<TlHelp32.h>
#include<string.h>
#include<ntdll.h>
#include<psapi.h>
#include<memory.h>
#include<iostream>
#include"game.h"
#include "halhook.h"
#pragma comment( lib, "Shlwapi.lib")

#pragma comment(linker, "/EXPORT:GetFileVersionInfoA=_AheadLib_GetFileVersionInfoA,@1")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoByHandle=_AheadLib_GetFileVersionInfoByHandle,@2")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoExW=_AheadLib_GetFileVersionInfoExW,@3")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeA=_AheadLib_GetFileVersionInfoSizeA,@4")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeExW=_AheadLib_GetFileVersionInfoSizeExW,@5")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeW=_AheadLib_GetFileVersionInfoSizeW,@6")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoW=_AheadLib_GetFileVersionInfoW,@7")
#pragma comment(linker, "/EXPORT:VerFindFileA=_AheadLib_VerFindFileA,@8")
#pragma comment(linker, "/EXPORT:VerFindFileW=_AheadLib_VerFindFileW,@9")
#pragma comment(linker, "/EXPORT:VerInstallFileA=_AheadLib_VerInstallFileA,@10")
#pragma comment(linker, "/EXPORT:VerInstallFileW=_AheadLib_VerInstallFileW,@11")
#pragma comment(linker, "/EXPORT:VerLanguageNameA=_AheadLib_VerLanguageNameA,@12")
#pragma comment(linker, "/EXPORT:VerLanguageNameW=_AheadLib_VerLanguageNameW,@13")
#pragma comment(linker, "/EXPORT:VerQueryValueA=_AheadLib_VerQueryValueA,@14")
#pragma comment(linker, "/EXPORT:VerQueryValueW=_AheadLib_VerQueryValueW,@15")
PVOID pfnAheadLib_GetFileVersionInfoA;
PVOID pfnAheadLib_GetFileVersionInfoByHandle;
PVOID pfnAheadLib_GetFileVersionInfoExW;
PVOID pfnAheadLib_GetFileVersionInfoSizeA;
PVOID pfnAheadLib_GetFileVersionInfoSizeExW;
PVOID pfnAheadLib_GetFileVersionInfoSizeW;
PVOID pfnAheadLib_GetFileVersionInfoW;
PVOID pfnAheadLib_VerFindFileA;
PVOID pfnAheadLib_VerFindFileW;
PVOID pfnAheadLib_VerInstallFileA;
PVOID pfnAheadLib_VerInstallFileW;
PVOID pfnAheadLib_VerLanguageNameA;
PVOID pfnAheadLib_VerLanguageNameW;
PVOID pfnAheadLib_VerQueryValueA;
PVOID pfnAheadLib_VerQueryValueW;




static HMODULE	g_OldModule = NULL;

// 加载原始模块
__inline BOOL WINAPI Load()
{
	TCHAR tzPath[MAX_PATH];
	TCHAR tzTemp[MAX_PATH * 2];
	GetSystemDirectory(tzPath, MAX_PATH); // 这里是否从系统目录加载或者当前目录,自行修改

	lstrcat(tzPath, TEXT("\\version.dll"));
	g_OldModule = LoadLibrary(tzPath);
	if (g_OldModule == NULL)
	{
		wsprintf(tzTemp, TEXT("无法找到模块 %s,程序无法正常运行"), tzPath);
		MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP);
	}

	return (g_OldModule != NULL);
}

// 释放原始模块
__inline VOID WINAPI Free()
{
	if (g_OldModule)
	{
		FreeLibrary(g_OldModule);
	}
}
// 获取原始函数地址
FARPROC WINAPI GetAddress(PCSTR pszProcName)
{
	FARPROC fpAddress;
	CHAR szProcName[128];
	TCHAR tzTemp[MAX_PATH];

	fpAddress = GetProcAddress(g_OldModule, pszProcName);
	if (fpAddress == NULL)
	{
		if (HIWORD(pszProcName) == 0)
		{
			wsprintfA(szProcName, "%d", pszProcName);
			pszProcName = szProcName;
		}

		wsprintf(tzTemp, TEXT("无法找到函数 %S,程序无法正常运行"), pszProcName);
		MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP);
		ExitProcess(-2);
	}
	return fpAddress;
}

// 初始化获取原函数地址
BOOL WINAPI Init()
{
	if (NULL == (pfnAheadLib_GetFileVersionInfoA = GetAddress("GetFileVersionInfoA")))
		return FALSE;
	if (NULL == (pfnAheadLib_GetFileVersionInfoByHandle = GetAddress("GetFileVersionInfoByHandle")))
		return FALSE;
	if (NULL == (pfnAheadLib_GetFileVersionInfoExW = GetAddress("GetFileVersionInfoExW")))
		return FALSE;
	if (NULL == (pfnAheadLib_GetFileVersionInfoSizeA = GetAddress("GetFileVersionInfoSizeA")))
		return FALSE;
	if (NULL == (pfnAheadLib_GetFileVersionInfoSizeExW = GetAddress("GetFileVersionInfoSizeExW")))
		return FALSE;
	if (NULL == (pfnAheadLib_GetFileVersionInfoSizeW = GetAddress("GetFileVersionInfoSizeW")))
		return FALSE;
	if (NULL == (pfnAheadLib_GetFileVersionInfoW = GetAddress("GetFileVersionInfoW")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerFindFileA = GetAddress("VerFindFileA")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerFindFileW = GetAddress("VerFindFileW")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerInstallFileA = GetAddress("VerInstallFileA")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerInstallFileW = GetAddress("VerInstallFileW")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerLanguageNameA = GetAddress("VerLanguageNameA")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerLanguageNameW = GetAddress("VerLanguageNameW")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerQueryValueA = GetAddress("VerQueryValueA")))
		return FALSE;
	if (NULL == (pfnAheadLib_VerQueryValueW = GetAddress("VerQueryValueW")))
		return FALSE;
	return TRUE;
}




BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
	if (dwReason == DLL_PROCESS_ATTACH)
	{
		FC3::GameInit();//功能初始化
		
		//CreateThread(NULL, NULL, ThreadProc, NULL, NULL, NULL);
		
		DisableThreadLibraryCalls(hModule);

		if (Load() && Init())
		{
			
		}
		else
		{
			return FALSE;
		}
	}
	else if (dwReason == DLL_PROCESS_DETACH)
	{
		Free();
	}

	return TRUE;
}

// 导出函数
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoA(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoA;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoByHandle(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoByHandle;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoExW(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoExW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoSizeA(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoSizeA;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoSizeExW(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoSizeExW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoSizeW(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoSizeW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoW(void)
{
	__asm jmp pfnAheadLib_GetFileVersionInfoW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerFindFileA(void)
{
	__asm jmp pfnAheadLib_VerFindFileA;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerFindFileW(void)
{
	__asm jmp pfnAheadLib_VerFindFileW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerInstallFileA(void)
{
	__asm jmp pfnAheadLib_VerInstallFileA;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerInstallFileW(void)
{
	__asm jmp pfnAheadLib_VerInstallFileW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerLanguageNameA(void)
{
	__asm jmp pfnAheadLib_VerLanguageNameA;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerLanguageNameW(void)
{
	__asm jmp pfnAheadLib_VerLanguageNameW;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerQueryValueA(void)
{
	__asm jmp pfnAheadLib_VerQueryValueA;
}

EXTERN_C __declspec(naked) void __cdecl AheadLib_VerQueryValueW(void)
{
	__asm jmp pfnAheadLib_VerQueryValueW;
}

B站搜索:指尖じ跳动

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值