尤里复仇金钱修改

一个简单的用c写的外挂

写这个外挂的原因是闲来无事玩玩红警尤里，用ce生成的修改文件时灵时不灵，于是就想自己写个。思路很简单，用ce找到金钱的地址（*(（int*）A83D4C+30C))），用Windowsapi改写内存就行了。

主要用到的函数ReadProcessMemory、WriteProcessMemory

另外由于权限的问题，打开进程还需要一点技巧，直接copy网上的一段代码。已经封装成了函数，用起来很方便。

#include "tlhelp32.h"
#include "windows.h"

BOOL SetPrivilege(
                  HANDLE hToken,          // access token handle
                  LPCTSTR lpszPrivilege,  // name of privilege to enable/disable
                  BOOL bEnablePrivilege   // to enable or disable privilege
                  ) 
{
    TOKEN_PRIVILEGES tp;
    LUID luid;

    if ( !LookupPrivilegeValue( 
        NULL,            // lookup privilege on local system
        lpszPrivilege,   // privilege to lookup 
        &luid ) )        // receives LUID of privilege
    {
        printf("LookupPrivilegeValue error: %u/n", GetLastError() ); 
        return FALSE; 
    }

    tp.PrivilegeCount = 1;
    tp.Privileges[0].Luid = luid;
    if ( bEnablePrivilege )
        tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
    else
        tp.Privileges[0].Attributes = 0;

    // Enable the privilege or disable all privileges.

    if ( !AdjustTokenPrivileges(
        hToken, 
        FALSE, 
        &tp, 
        sizeof(TOKEN_PRIVILEGES), 
        (PTOKEN_PRIVILEGES) NULL, 
        (PDWORD) NULL) )
    { 
        printf("AdjustTokenPrivileges error: %u/n", GetLastError() ); 
        return FALSE; 
    } 

    if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)

    {
        printf("The token does not have the specified privilege. /n");
        return FALSE;
    } 

    return TRUE;
}

HANDLE GetProcessHandle(int nID)
{
    HANDLE hToken;
    bool flag = OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken );
    if( !flag )
    {
        DWORD err = GetLastError();
        printf( "OpenProcessToken error:%d", err );
    }
    SetPrivilege( hToken, SE_DEBUG_NAME, true );
    CloseHandle(hToken);
    return OpenProcess(PROCESS_ALL_ACCESS, FALSE, nID);
}

HANDLE GetProcessHandle(LPCTSTR pName)
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (INVALID_HANDLE_VALUE == hSnapshot)
    {
        return NULL;
    }
    PROCESSENTRY32 pe = { sizeof(pe) };
    BOOL fOk;
    for (fOk = Process32First(hSnapshot, &pe); fOk; fOk = Process32Next(hSnapshot, &pe))
    {
        if (!strcmp(pe.szExeFile, pName))
        {
            CloseHandle(hSnapshot);
            return GetProcessHandle(pe.th32ProcessID);
        }
    }
    return NULL;
}

获取进程handle只需HANDLE handle=GetProcessHandle("gamemd.exe");

接下来就是

int money;
int adress;
ReadProcessMemory(handle,(void*)0xA83D4C,&adress,4,NULL);获取基地址
ReadProcessMemory(handle,(void*)(adress+0x30c),&money,4,NULL);读取金钱
WriteProcessMemory(handle,(void*)(adress+0x30c),&money,4,NULL);修改金钱