植物大战僵尸外挂源码

#include"stdafx.h"
#include<iostream>      
#include<windows.h>   
#include <assert.h>
#include<TlHelp32.h>    
#include <string.h>
#include "stdio.h"
#include "Shlwapi.h"
#include "tlhelp32.h"
#include "Psapi.h"
#include <TChar.h> 
#pragma comment(lib,"Psapi.lib")
#pragma comment(lib,"Shlwapi.lib")


//参数结构 ; 
typedef struct _RemotePara
{
	UINT y;
	UINT x;
	UINT id;
}RemotePara;

using namespace std;
HWND hwnd_Game;
DWORD ProcessID;
HANDLE h_process;
int Base;
int Offset[10];
HANDLE hToken, hThread;
RemotePara myRemotePara;
HINSTANCE hUser32;
void *pRemoteThread;
DWORD byte_write;
RemotePara *pRemotePara;
const DWORD THREADSIZE = 1024 * 4;


// 远程线程执行体
DWORD __stdcall ThreadProc(RemotePara *Para) {
	typedef void(__stdcall *pExitProcess) (UINT);
	pExitProcess y = (pExitProcess)Para->y;
	pExitProcess x = (pExitProcess)Para->x;
	pExitProcess id = (pExitProcess)Para->id;
	__asm {
		pushad
		push - 1
		push id
		mov eax, y
		push x
		mov edi, dword ptr ds : [0x755E0C]
		mov edi, dword ptr ds : [edi + 0x868]
		push edi
		mov edx, 0x418D70
		call   edx
		popad
	}
	return 0;
}

BOOL EnablePrivilege(HANDLE hToken, LPCTSTR szPrivName, BOOL fEnable)
{
	TOKEN_PRIVILEGES tp;
	tp.PrivilegeCount = 1;
	LookupPrivilegeValue(NULL, szPrivName, &tp.Privileges[0].Luid);
	tp.Privileges[0].Attributes = fEnable ? SE_PRIVILEGE_ENABLED : 0;
	AdjustTokenPrivileges(hToken, FALSE, &tp, sizeof(tp), NULL, NULL);
	return((GetLastError() == ERROR_SUCCESS));
}

HANDLE GetPidByName(char *szName)
{
	HWND hwnd_Game = FindWindow(NULL, L"Plants vs. Zombies");
	GetWindowThreadProcessId(hwnd_Game, &ProcessID);
	return OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);
}

int callPlant()
{

	// 启动线程 
	if (!WriteProcessMemory(h_process, pRemotePara, &myRemotePara, sizeof myRemotePara, 0))
	{

		return 0;

	}

	hThread = CreateRemoteThread(h_process, 0, 0, (DWORD(__stdcall *)(void *))pRemoteThread, pRemotePara, 0, &byte_write);


	return 1;
}

void GetGameInfo()
{
	hwnd_Game = FindWindow(NULL, L"Plants vs. Zombies");
	GetWindowThreadProcessId(hwnd_Game, &ProcessID);
	h_process = OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);

	Base = 0x00755E0C;
	Offset[0] = 0x868;
	Offset[1] = 0x5578;
}

//通过基址加偏移得到动态地址    
int GetDymThroughBase(int Base, int Offset[], int len)
{
	int Dym_temp;
	ReadProcessMemory(h_process, (LPVOID)Base, &Dym_temp, 4, NULL);
	for (int i = 0; i < len; i++)
	{
		if (i == len - 1)
			Dym_temp += Offset[i];
		else
			ReadProcessMemory(h_process, (LPVOID)(Dym_temp + Offset[i]), &Dym_temp, 4, NULL);
	}
	return Dym_temp;
}
//修改阳光  
void ChangeSunshine(int num)
{
	int DymnamicAddress = GetDymThroughBase(Base, Offset, 2);
	int ret = WriteProcessMemory(h_process, (LPVOID)DymnamicAddress, &num, 4, NULL);
	if (ret == 0)
	{
		cout << "修改失败!" << endl;
	}
	else
	{
		cout << "修改成功!" << endl;
	}
}
//免CD  
void DisableCoolDown()
{
	int num = 0x1477;
	int ret = WriteProcessMemory(h_process, (LPVOID)0x0049CE02, &num, 2, NULL);
	if (ret)
	{
		cout << "免冷却成功!" << endl;
	}
	else
	{
		cout << "免冷却失败!" << endl;
	}
}

int in()
{

	// 在远程进程地址空间分配虚拟内存
	pRemoteThread = VirtualAllocEx(h_process, 0, THREADSIZE, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
	if (!pRemoteThread)
		return 0;

	// 将线程执行体ThreadProc写入远程进程
	if (!WriteProcessMemory(h_process, pRemoteThread, &ThreadProc, THREADSIZE, 0))
		return 0;
	
	ZeroMemory(&myRemotePara, sizeof(RemotePara));
	hUser32 = LoadLibrary((LPCWSTR)"kernel32.dll");

	//写进目标进程 
	pRemotePara = (RemotePara *)VirtualAllocEx(h_process, 0, sizeof(RemotePara), MEM_COMMIT, PAGE_READWRITE);

	if (pRemotePara)
	{
		return 1;
	}
	else
		return 0;
}



int main()
{
	int n_sunshine_change;
	int n_choice = 99;
	GetGameInfo();

	DWORD pID;

	char szSafePath[MAX_PATH] = { "C://Program Files//Safe Office//oem//BioFileLogOp.dll" };
	char szKxPath[MAX_PATH] = { "C://Program Files//KeXin WPS Office//oem//BioFileLogOp.dll" };

	HANDLE hSafeFind;
	HANDLE hKxFind;
	WIN32_FIND_DATA FindFileData, FindKxFileData;

	OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken); //打开进程

	EnablePrivilege(hToken, SE_DEBUG_NAME, TRUE); //提升为调试权限

	if (!in()) 
	{
		cout << "No!!!!!!!!!!!" << endl;
		Sleep(50000);
		return 0;
	}
	cout << "欢迎使用植物大战僵尸外挂，请选择你要实现的功能:\n1.修改阳光\n2.植物免冷却\n3.种植植物\n4.召唤炮兵连队\n5.召唤寒冰西瓜连队\n0.退出\n";


	while (n_choice)
	{
		cin >> n_choice;
		switch (n_choice)
		{
		case 1:
			cout << "请输入你要修改的阳光值:";
			cin >> n_sunshine_change;
			ChangeSunshine(n_sunshine_change);
			break;
		case 2:
			DisableCoolDown();
			break;
		case 3:
			cout << "请输入你要种植的植物ID:";
			cin >> myRemotePara.id;
			cout << "请输入你要种植的x坐标:";
			cin >> myRemotePara.x;
			cout << "请输入你要种植的y坐标:";
			cin >> myRemotePara.y;
			callPlant();
			break;
		case 4:
			cout << "Waiting......";
			myRemotePara.id = 40;
			myRemotePara.x = 0;
			for (int i = 0; i < 20; i++)
			{
				for (int j = 0; j < 6; j++)
				{
					myRemotePara.y = j;
					Sleep(100);
					callPlant();
				}
			}
			myRemotePara.id = 43;
			myRemotePara.x = 1; 
			for (int i = 0; i < 2; i++)
			{
				for (int j = 0; j < 6; j++)
				{
					myRemotePara.y = j;
					Sleep(100);
					callPlant();
				}
			}
			myRemotePara.id = 22;
			myRemotePara.x = 2;
			for (int j = 0; j < 6; j++)
			{
				myRemotePara.y = j;
				Sleep(100);
				callPlant();
			}
			myRemotePara.id = 25;
			myRemotePara.x = 6;
			for (int j = 0; j < 6; j++)
			{
				myRemotePara.y = j;
				Sleep(100);
				callPlant();
			}
			cout << "OK! We have done.\n";
			break;
		case 5:
			cout << "Waiting......";
			myRemotePara.id = 44;
			myRemotePara.x = 0;
			for (int i = 0; i < 40; i++)
			{
				for (int j = 0; j < 5; j++)
				{
					myRemotePara.y = j;
					Sleep(100);
					callPlant();
				}
			}
			myRemotePara.id = 43;
			myRemotePara.x = 1;
			for (int i = 0; i < 1; i++)
			{
				for (int j = 1; j < 4; j++)
				{
					myRemotePara.y = j;
					Sleep(100);
					callPlant();
				}
			}
			cout << "OK! We have done.\n";
			break;
		case 6:
			cout << "Waiting......";
			myRemotePara.id = 0;
			myRemotePara.x = 4;
			for (int i = 0; i < 40; i++)
			{
				for (int j = 0; j < 5; j++)
				{
					myRemotePara.y = j;
					Sleep(100);
					callPlant();
				}
			}
			break;
		}
	}
	return 0;
}