内存映射+远线程 调用游戏CALL

  1 源码中 用到的结构和未公开函数 请到 http://www.cnblogs.com/IMyLife/p/4826286.html 获取
  2 
  3 HANDLE ProcessHandle=NULL;
  4 DWORD pPID=NULL;
  5 DWORD TID=NULL;
  6 HWND i = FindWindowW(NULL, L"游戏窗口名称");
  7 TID=GetWindowThreadProcessId(i,&pPID);
  8 ProcessHandle=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pPID);
  9 /映射字节集到进程
 10 DWORD MappingBytes(PVOID Address,DWORD BYTE_SIZE,WCHAR Nume[])
 11 {
 12     DWORD vaddress=NULL,size=NULL;
 13     HANDLE hMap=CreateFileMappingW(INVALID_HANDLE_VALUE,NULL,PAGE_EXECUTE_READWRITE,NULL,BYTE_SIZE,Nume);
 14     if(hMap!=NULL)
 15     {
 16         HANDLE pAddress=MapViewOfFile(hMap,FILE_MAP_ALL_ACCESS,NULL,NULL,NULL);
 17         if(pAddress!=NULL)
 18         {
 19             RtlMoveMemory(pAddress,Address,BYTE_SIZE);
 20             //映射字节集到目标进程
 21             ZwMapViewOfSection(hMap,ProcessHandle,&vaddress,NULL,NULL,NULL,&size,1,0,PAGE_EXECUTE_READWRITE);
 22             UnmapViewOfFile(pAddress);
 23             return vaddress;
 24         }
 25     }
 26     return 0;
 27 }
 28 //获取HOOK函数的字节数量//记得HOOK函数最后加上 int 0 不然无法判断
 29 DWORD GetFunctionLong(DWORD JMPAddress)
 30 {
 31     BYTE *p=(BYTE*)JMPAddress;
 32     int i=0;
 33     while (TRUE)
 34     {
 35         if((DWORD)*p==205)
 36         {
 37             return i;
 38         }
 39         p++;
 40         i++;
 41     }
 42     return 0;
 43 }
 44 //远程调用CALL函数主功能
 45 
 46  
 47 
 48 //要调用的CALL，参数结构，结构大小    可实现任意个数参数调用(看下面怎么获取参数的) 只测试了DWORD类型参数 
 49 DWORD LoadCALL(DWORD* CALLAddress, DWORD* ParameterStruct, DWORD ParameterStruct_SIZE)
 50 {
 51     DWORD vaddress = NULL, size = NULL,lsbuff = 0,lenght=0,structbuff=0;
 52     lenght = GetFunctionLong((DWORD)CALLAddress);
 53     HANDLE hMap = CreateFileMappingW(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, NULL, lenght, L"CALL");
 54     if (hMap != NULL)
 55     {
 56         HANDLE pAddress = MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, NULL, NULL, NULL);
 57         if (pAddress != NULL)
 58         {
 59             RtlMoveMemory(pAddress, CALLAddress, lenght);
 60             //映射CALL字节集到目标进程
 61             ZwMapViewOfSection(hMap, ProcessHandle, &vaddress, NULL, NULL, NULL, &size, 1, 0, 4);
 62             //映射参数结构到目标进程
 63             structbuff=MappingBytes((PVOID)ParameterStruct, ParameterStruct_SIZE, L"struct");
 64             //修改内存页面保护属性
 65             VirtualProtectEx(ProcessHandle, (LPVOID)vaddress, lenght, PAGE_EXECUTE_READWRITE, &lsbuff);
 66             //创建远线程执行CALL
 67             CreateRemoteThread(ProcessHandle, NULL, NULL, (LPTHREAD_START_ROUTINE)vaddress, (LPVOID)structbuff, NULL, NULL);
 68             UnmapViewOfFile(pAddress);
 69             return = vaddress;
 70         }
 71     }
 72     return 0;
 73 }
 74  
 75 
 76  1 //调用远程CALL格式
 77  2 /*
 78  3 参数结构
 79  4 typedef struct A
 80  5 {
 81  6 DWORD a1;
 82  7 DWORD a2;
 83  8 DWORD a3;
 84  9 DWORD a4;
 85 10 };
 86 11 typedef struct A A1;
 87 12 typedef A1 *A2;
 88 13 
 89 14 要调用的CALL
 90 15 void __declspec( naked ) ZwGoodsCALL()
 91 16 {
 92 17 _asm
 93 18 {
 94 19 MOV EAX, [ebp+8]
 95 20 mov ebx,dword ptr ds : [eax] //取结构第一个参数 第二个+4 第三个+8依次加4
 96 21 mov ecx,dword ptr ds : [eax+4]//获取第二个参数
 97 22 retn
 98 23 int 0// 结尾标识符 给获取函数长度函数做判断
 99 24 }
100 25 }
101 26 调用方法
102 27 A2 pA2 = NULL;
103 28 pA2 = (A2)malloc(sizeof(A1));
104 29 pA2->a1 = 1;
105 30 pA2->a2 = 2;
106 31 pA2->a3 = 3;
107 32 pA2->a4 = 4;
108 33 LoadCALL((DWORD*)ZwGoodsCALL, (DWORD*)pA2, sizeof(A1));
109 34 */ //

 

转载于:https://www.cnblogs.com/IMyLife/p/4827870.html