魔兽maphack其实很简单

 抱歉，弄这么一个标题绝无半点狂妄之意，只是纯粹的标题作用，希望理解...

 写这篇文章也只是为了整理一下这些天弄maphack还有lancraft的所得

---

    看过前几篇前辈们关于maphack的文章，发现maphack真的很简单，就几个函数嘛，EnableDebugPriv()提权，再FindWindow(),OpenProcess(),然后要修改什么就WriteProcessMemory(),有什么难的？可难就难在要开启的一些选项的内存地址！像前辈们介绍的那样，用CE一个一个找，我想说是个人都会哭的(那些最先做maphack的前辈，我只能表示万分的敬佩)……

    说到这里我又不得不再次高呼"Tribute to Shadow French”，外国人的开源精神真的是没的说，虽然Shadow French的MH没有直接开源，但人家发布的程序都是赤裸裸的，没有加密啊，而且用的还是native编码，不像国内的那些高手，加了几层壳~当然了，人家的版权嘛！

    不好意思，偏题了。对于native code 的VB程序，用smart check一跟踪，你会发现世界如此美好！

---

Visual Basic程序调试器 SmartCheck  http://www.pediy.com/tools/Debuggers.htm

---

从http://www.securegamers.com/shadowfrench/maphack.php下载一个1.20E的版本，然后勾选一个单一选项

点击On，在Smart Check 里面已经跟踪到OnClick事件

BOOL WriteProcessMemory(
　　HANDLE hProcess,
　　LPVOID lpBaseAddress,
　　LPVOID lpBuffer,
　　DWORD nSize,
　　LPDWORD lpNumberOfBytesWritten
　　);
再看一下这个操作的C语言原型

1.  BYTE data[] = {0xBF,0x0F,0x00};   
2.  bool success = WriteProcessMemory(hopen,(LPVOID)0x6F2A3B92, &data,3, NULL);   

lpBuffer里面的内容是至关重要的，要找到0x0013F2A0里面的内容，只有用OllyDbg了

---

OllyDbg调试器 OllyDbg[2008.1.1]  http://www.pediy.com/tools/Debuggers.htm

---

从Smart Check 右边的窗口可以找到

WriteProcessMemory(HPROCESS:000006B4,DWORD:6F406B30,PTR:0013F2A0,DWORD:00000001,PTR:0013F29C)

的偏移地址为0000F609

用 OllyDbg打开maphack，然后找到0040F609处，发现根本不要调试，lpBuffer的内容就出来了...

0040F5DD   .  8B4D 0C                          mov     ecx, dword ptr [ebp+C]
0040F5E0   .  8D95 2CFFFFFF                    lea     edx, dword ptr [ebp-D4]
0040F5E6   .  52                               push    edx
0040F5E7   .  8D85 30FFFFFF                    lea     eax, dword ptr [ebp-D0]
0040F5ED   .  8B51 08                          mov     edx, dword ptr [ecx+8]
0040F5F0   .  6A 01                            push    1
0040F5F2   .  50                               push    eax
0040F5F3   .  52                               push    edx
0040F5F4   .  56                               push    esi
0040F5F5   .  C785 2CFFFFFF 00000000           mov     dword ptr [ebp-D4], 0
0040F5FF   .  C785 30FFFFFF 74000000           mov     dword ptr [ebp-D0], 74
0040F609   .  E8 A23CFFFF                      call    004032B0

mov     dword ptr [ebp-D0], 74   lpBuffer指向的内容就是0x74

再依葫芦画瓢，要找出所有的地址不是件难事！

这里给出我自己写的样本MH里所需要的一些功能的地址

/ //打开按住CTRL给钱 BYTE val=0x40; int lRet = WriteProcessMemory(hOpen, LPVOID(0x6F127B35), &val, 1, 0); val=0xb8; lRet =WriteProcessMemory(hOpen, LPVOID(0x6F127B36), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F127B37), &num_dclick, 4, 0); //打开单击给钱 val=0x40; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F127B3D), &val, 1, 0); val=0xb8; lRet =WriteProcessMemory(hOpen, LPVOID(0x6F127B3E), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F127B3F), &num_click, 4, 0); // //小地图查看隐身 val=0x39; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F1494E0), &val, 1, 0); val=0x85; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F1494E3), &val, 1, 0); // //大地图查看隐身 val=0x90; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4E8), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4E9), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EA), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EB), &val, 1, 0); val=0xb8; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EC), &val, 1, 0); val=0x1; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4ED), &val, 1, 0); val=0x0; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EE), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EF), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4F0), &val, 1, 0); //显示单位？？？ val= 0x66; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B1), &val, 1, 0); val= 0xBF; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B2), &val, 1, 0); val= 0xF; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B3), &val, 1, 0); val= 0x0; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B4), &val, 1, 0); / //查看人物技能 val=0x90; lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC1A), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC1B), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC5A), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC5B), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F5573FE), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F5573FF), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557400), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557401), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557402), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557403), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0BF), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C0), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C1), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C2), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C3), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C4), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F55E15C), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F55E15D), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F4A11A1), &val, 1, 0); lRet = WriteProcessMemory(hOpen, LPVOID(0x6F4A11A0), &val, 1, 0); //

---

附上我写的一个样例maphack，仅仅添加了为了方便玩仙之侠道的一些功能(准备再加上模拟按键，哈哈 我的鬼魅就无敌啦！)，早期给钱方便，这个是我写MH最初动力，那个10块10块的给太麻烦了，手都点痛！

里面还加了跨网段联机功能(原理在下篇博文)，= =！程序写的很乱，见笑了...

http://download.csdn.net/source/1819854