B站搜索:指尖じ跳动
程序:32位
game.cpp
#include "game.h"
//返回模块中函数地址的偏移地址,函数名为空返回模块地址,偏移量默认为0
int GetModuleFuncAddress(char *ModuleName, char *FuncName,int Offset)
{
HMODULE ModuleAddress = NULL;
FARPROC FuncAddress = NULL;
if (ModuleName == NULL)
{
return NULL;
}
ModuleAddress = GetModuleHandle("FC3.dll");
if (FuncName!=NULL)
{
FuncAddress = GetProcAddress(ModuleAddress, FuncName);
printf("模块句柄=%p,函数地址=%p\n", ModuleAddress, FuncAddress);
}
return (int)FuncAddress + Offset;
}
game.h
#pragma once
#include <windows.h>
#include <Shlwapi.h>
#include<process.h>
#include<stdio.h>
//返回模块中函数地址的偏移地址,函数名为空返回模块地址,偏移量默认为0
int GetModuleFuncAddress(char* ModuleName, char* FuncName, int Offset);
halhook.cpp
#include "halhook.h"
BOOL FC3::OpenDebug()
{
HANDLE htoken;//令牌
BOOL fok = FALSE;
//打开进程令牌,提升调试权限,
printf("进程ID%d\n", GetCurrentProcessId());
if (OpenProcessToken(GetCurrentProcess(), TOKEN_QUERY | TOKEN_ADJUST_PRIVILEGES, &htoken))
{
TOKEN_PRIVILEGES tp;
tp.PrivilegeCount = 1;//设置默认权限
if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tp.Privileges[0].Luid))//遍历权限
{
}
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;//开启
if (AdjustTokenPrivileges(htoken, FALSE, &tp, sizeof(tp), NULL, NULL)==NULL)//令牌失效
{
}
else
{
fok = TRUE;
}
CloseHandle(htoken);//关闭令牌
}
return fok;
}
void FC3::CreateConsole()
{
HANDLE _handleOutput;
FILE* stream;
if (AllocConsole() == 0)//分配一个控制台窗口
{
MessageBox(0, "分配控制台窗口失败!", "", 0);
}
_handleOutput = GetStdHandle(STD_OUTPUT_HANDLE);
SetConsoleTextAttribute(_handleOutput, FOREGROUND_RED | FOREGROUND_INTENSITY);
freopen_s(&stream, "CON", "r", stdin);//重定向输入流
freopen_s(&stream, "CON", "w", stdout);//重定向输入流
SetConsoleTitle("游戏输出窗口:(QQ:2771135787)");
}
DWORD WINAPI FC3::ThreadProc(LPVOID lpThreadParameter)
{
while (hgamew==NULL)
{
hgamew = FindWindow(TEXT("Nomad"), NULL);
}
printf("获取窗口句柄成功,开始设置硬件断点。。。\n");
tid = NULL;
th = nullptr;
tid = GetWindowThreadProcessId(hgamew, &pid);
if (tid == NULL)
{
printf("线程ID获取失败:%d\n", GetLastError());
return 0;
}
printf("线程ID获取成功:%p\n", tid);
th = OpenThread(THREAD_ALL_ACCESS, FALSE, tid);
if (th == nullptr)
{
printf("线程句柄获取失败:%d\n", GetLastError());
return 0;
}
printf("线程句柄获取成功:%p\n", th);
SetHalBreakPoint();
CloseHandle(th);
return TRUE;
}
void FC3::SetBreakPoint(int breakaddr)//设置软件断点
{
*(unsigned char*)breakaddr = 0xCC;//设置软件断点
}
void FC3::SetHalBreakPoint()//设置硬件断点
{
printf("AttackAddr=%p\n", AttackAddr);
printf("HpAddr=%p\n", HpAddr);
SuspendThread(th);
GetThreadContext(th,&context);
context.ContextFlags = CONTEXT_DEBUG_REGISTERS;
context.Dr7 = 0x1;
context.Dr0 = AttackAddr;
//context.Dr1 = HpAddr;
ret = SetThreadContext(th, &context);
printf("设置线程上下文:错误码=%d,返回值=%d\n", GetLastError(),ret);
memset(&context, 0, sizeof(context));
GetThreadContext(th, &context);
printf("Dr7=%p\n", context.Dr7);
printf("Dr0=%p\n", context.Dr0);
printf("Dr1=%p\n", context.Dr1);
ResumeThread(th);
if (context.Dr0 == 0)
{
printf("设置硬件断点1失败\n");
}
else
{
printf("设置硬件断点1成功\n");
}
if (context.Dr1 == 0)
{
printf("设置硬件断点2失败\n");
}
else
{
printf("设置硬件断点2成功\n");
}
}
LONG CALLBACK FC3::VectoredHandler(PEXCEPTION_POINTERS pExceptionInfo)
{
static int i = 0;
static int _esi;
static int _eax;
static int _ecx;
static int _edx;
static int _edi;
static float hp = 0;
static float hpmax = 100.00;
if (HpAddr == pExceptionInfo->ContextRecord->Eip)
{
_esi = pExceptionInfo->ContextRecord->Esi;
__asm
{
/*mov esi, _esi
movss xmm0, dword ptr ds : [esi + 0x10]
movss hp, xmm0*/
/*movss xmm0, hpmax
movss dword ptr ds : [esi + 0x10],xmm0*/
}
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED);
printf("血量=%f,血量地址=%p\n", hp, _esi + 10);
//pExceptionInfo->ContextRecord->Eip += 5;
return EXCEPTION_CONTINUE_EXECUTION;
}
//一枪100发
if (AttackAddr == pExceptionInfo->ContextRecord->Eip)
{
_esi = pExceptionInfo->ContextRecord->Esi;
_edx = pExceptionInfo->ContextRecord->Edx;
_edi = pExceptionInfo->ContextRecord->Edi;
for (int i = 0; i < num; i++)
{
__asm
{
mov edx, _edx
mov edi, _edi
mov esi, _esi
push edx
mov ecx, [esi + 0x000000E8]
mov eax,[ecx]
push edi
call dword ptr[eax + 0x2C]
pop edx
mov _edx, edx
mov _ecx, ecx
mov _eax, eax
}
}
__asm
{
mov esi, _esi
mov eax, num
mov dword ptr ds : [esi + 0xCC] , eax
}
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_GREEN);
printf("第%d次开枪\n", i);
printf("_edx=%p,_ecx=%p,_eax=%p\n", _edx, _ecx, _eax);
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_BLUE);
printf("射速:%d发/1枪\n", num);
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_RED);
printf("射击成功\n");
SetConsoleTextAttribute(GetStdHandle(STD_OUTPUT_HANDLE), FOREGROUND_INTENSITY | FOREGROUND_GREEN | FOREGROUND_RED);
printf("EIP=%#x\n", pExceptionInfo->ContextRecord->Eip);
printf("%#x\n", *(unsigned char*)AttackAddr);
i++;
pExceptionInfo->ContextRecord->Eip += 4;
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_EXECUTE_HANDLER;
}
void FC3::GameInit()
{
AttackAddr = GetModuleFuncAddress((char*)"FC3.dll", (char*)"FCS_Server_DeleteMatchStats", 0x409A8F);
HpAddr = GetModuleFuncAddress((char*)"FC3.dll", (char*)"FCS_Server_DeleteMatchStats", 0x4AA181);
hgamew = NULL;
hmyw = NULL;
num = 99;
tid = 0;
th = nullptr;
CreateConsole();
hmyw = GetConsoleWindow();
if (hmyw == NULL)
{
MessageBox(0, TEXT("获取调试窗口失败"), TEXT(""), 0);
return;
}
if (FC3::OpenDebug() == FALSE)
{
printf("提升进程权限失败\n");
return;
}
printf("提升进程权限成功\n");
CreateThread(NULL, NULL, ThreadProc, NULL, NULL, NULL);
AddVectoredExceptionHandler(NULL, VectoredHandler);
}
halhook.h
#pragma once
#include <windows.h>
#include <Shlwapi.h>
#include<process.h>
#include<stdio.h>
#include"game.h"
namespace FC3
{
static int num;
static HWND hgamew;
static HWND hmyw;
static int AttackAddr;
static int HpAddr;
static DWORD pid;
static DWORD tid;
static HANDLE th;
static CONTEXT context;
static BOOL ret = TRUE;
void CreateConsole();
DWORD WINAPI ThreadProc(LPVOID lpThreadParameter);
BOOL OpenDebug();
void SetBreakPoint(int breakaddr);//设置软件断点
void SetHalBreakPoint();//设置硬件断点
LONG CALLBACK VectoredHandler(PEXCEPTION_POINTERS pExceptionInfo);
void GameInit();
}
拦截射击-硬件断点.cpp
//Created by AheadLib x86/x64 v1.2
#include<stdio.h>
#include<Windows.h>
#include<TlHelp32.h>
#include<string.h>
#include<ntdll.h>
#include<psapi.h>
#include<memory.h>
#include<iostream>
#include"game.h"
#include "halhook.h"
#pragma comment( lib, "Shlwapi.lib")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoA=_AheadLib_GetFileVersionInfoA,@1")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoByHandle=_AheadLib_GetFileVersionInfoByHandle,@2")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoExW=_AheadLib_GetFileVersionInfoExW,@3")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeA=_AheadLib_GetFileVersionInfoSizeA,@4")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeExW=_AheadLib_GetFileVersionInfoSizeExW,@5")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeW=_AheadLib_GetFileVersionInfoSizeW,@6")
#pragma comment(linker, "/EXPORT:GetFileVersionInfoW=_AheadLib_GetFileVersionInfoW,@7")
#pragma comment(linker, "/EXPORT:VerFindFileA=_AheadLib_VerFindFileA,@8")
#pragma comment(linker, "/EXPORT:VerFindFileW=_AheadLib_VerFindFileW,@9")
#pragma comment(linker, "/EXPORT:VerInstallFileA=_AheadLib_VerInstallFileA,@10")
#pragma comment(linker, "/EXPORT:VerInstallFileW=_AheadLib_VerInstallFileW,@11")
#pragma comment(linker, "/EXPORT:VerLanguageNameA=_AheadLib_VerLanguageNameA,@12")
#pragma comment(linker, "/EXPORT:VerLanguageNameW=_AheadLib_VerLanguageNameW,@13")
#pragma comment(linker, "/EXPORT:VerQueryValueA=_AheadLib_VerQueryValueA,@14")
#pragma comment(linker, "/EXPORT:VerQueryValueW=_AheadLib_VerQueryValueW,@15")
PVOID pfnAheadLib_GetFileVersionInfoA;
PVOID pfnAheadLib_GetFileVersionInfoByHandle;
PVOID pfnAheadLib_GetFileVersionInfoExW;
PVOID pfnAheadLib_GetFileVersionInfoSizeA;
PVOID pfnAheadLib_GetFileVersionInfoSizeExW;
PVOID pfnAheadLib_GetFileVersionInfoSizeW;
PVOID pfnAheadLib_GetFileVersionInfoW;
PVOID pfnAheadLib_VerFindFileA;
PVOID pfnAheadLib_VerFindFileW;
PVOID pfnAheadLib_VerInstallFileA;
PVOID pfnAheadLib_VerInstallFileW;
PVOID pfnAheadLib_VerLanguageNameA;
PVOID pfnAheadLib_VerLanguageNameW;
PVOID pfnAheadLib_VerQueryValueA;
PVOID pfnAheadLib_VerQueryValueW;
static HMODULE g_OldModule = NULL;
// 加载原始模块
__inline BOOL WINAPI Load()
{
TCHAR tzPath[MAX_PATH];
TCHAR tzTemp[MAX_PATH * 2];
GetSystemDirectory(tzPath, MAX_PATH); // 这里是否从系统目录加载或者当前目录,自行修改
lstrcat(tzPath, TEXT("\\version.dll"));
g_OldModule = LoadLibrary(tzPath);
if (g_OldModule == NULL)
{
wsprintf(tzTemp, TEXT("无法找到模块 %s,程序无法正常运行"), tzPath);
MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP);
}
return (g_OldModule != NULL);
}
// 释放原始模块
__inline VOID WINAPI Free()
{
if (g_OldModule)
{
FreeLibrary(g_OldModule);
}
}
// 获取原始函数地址
FARPROC WINAPI GetAddress(PCSTR pszProcName)
{
FARPROC fpAddress;
CHAR szProcName[128];
TCHAR tzTemp[MAX_PATH];
fpAddress = GetProcAddress(g_OldModule, pszProcName);
if (fpAddress == NULL)
{
if (HIWORD(pszProcName) == 0)
{
wsprintfA(szProcName, "%d", pszProcName);
pszProcName = szProcName;
}
wsprintf(tzTemp, TEXT("无法找到函数 %S,程序无法正常运行"), pszProcName);
MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP);
ExitProcess(-2);
}
return fpAddress;
}
// 初始化获取原函数地址
BOOL WINAPI Init()
{
if (NULL == (pfnAheadLib_GetFileVersionInfoA = GetAddress("GetFileVersionInfoA")))
return FALSE;
if (NULL == (pfnAheadLib_GetFileVersionInfoByHandle = GetAddress("GetFileVersionInfoByHandle")))
return FALSE;
if (NULL == (pfnAheadLib_GetFileVersionInfoExW = GetAddress("GetFileVersionInfoExW")))
return FALSE;
if (NULL == (pfnAheadLib_GetFileVersionInfoSizeA = GetAddress("GetFileVersionInfoSizeA")))
return FALSE;
if (NULL == (pfnAheadLib_GetFileVersionInfoSizeExW = GetAddress("GetFileVersionInfoSizeExW")))
return FALSE;
if (NULL == (pfnAheadLib_GetFileVersionInfoSizeW = GetAddress("GetFileVersionInfoSizeW")))
return FALSE;
if (NULL == (pfnAheadLib_GetFileVersionInfoW = GetAddress("GetFileVersionInfoW")))
return FALSE;
if (NULL == (pfnAheadLib_VerFindFileA = GetAddress("VerFindFileA")))
return FALSE;
if (NULL == (pfnAheadLib_VerFindFileW = GetAddress("VerFindFileW")))
return FALSE;
if (NULL == (pfnAheadLib_VerInstallFileA = GetAddress("VerInstallFileA")))
return FALSE;
if (NULL == (pfnAheadLib_VerInstallFileW = GetAddress("VerInstallFileW")))
return FALSE;
if (NULL == (pfnAheadLib_VerLanguageNameA = GetAddress("VerLanguageNameA")))
return FALSE;
if (NULL == (pfnAheadLib_VerLanguageNameW = GetAddress("VerLanguageNameW")))
return FALSE;
if (NULL == (pfnAheadLib_VerQueryValueA = GetAddress("VerQueryValueA")))
return FALSE;
if (NULL == (pfnAheadLib_VerQueryValueW = GetAddress("VerQueryValueW")))
return FALSE;
return TRUE;
}
BOOL WINAPI DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
FC3::GameInit();//功能初始化
//CreateThread(NULL, NULL, ThreadProc, NULL, NULL, NULL);
DisableThreadLibraryCalls(hModule);
if (Load() && Init())
{
}
else
{
return FALSE;
}
}
else if (dwReason == DLL_PROCESS_DETACH)
{
Free();
}
return TRUE;
}
// 导出函数
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoA(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoA;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoByHandle(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoByHandle;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoExW(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoExW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoSizeA(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoSizeA;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoSizeExW(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoSizeExW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoSizeW(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoSizeW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_GetFileVersionInfoW(void)
{
__asm jmp pfnAheadLib_GetFileVersionInfoW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerFindFileA(void)
{
__asm jmp pfnAheadLib_VerFindFileA;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerFindFileW(void)
{
__asm jmp pfnAheadLib_VerFindFileW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerInstallFileA(void)
{
__asm jmp pfnAheadLib_VerInstallFileA;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerInstallFileW(void)
{
__asm jmp pfnAheadLib_VerInstallFileW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerLanguageNameA(void)
{
__asm jmp pfnAheadLib_VerLanguageNameA;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerLanguageNameW(void)
{
__asm jmp pfnAheadLib_VerLanguageNameW;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerQueryValueA(void)
{
__asm jmp pfnAheadLib_VerQueryValueA;
}
EXTERN_C __declspec(naked) void __cdecl AheadLib_VerQueryValueW(void)
{
__asm jmp pfnAheadLib_VerQueryValueW;
}
B站搜索:指尖じ跳动