一个简单的用c写的外挂
写这个外挂的原因是闲来无事玩玩红警尤里,用ce生成的修改文件时灵时不灵,于是就想自己写个。思路很简单,用ce找到金钱的地址(*((int*)A83D4C+30C))),用Windowsapi改写内存就行了。
主要用到的函数ReadProcessMemory、WriteProcessMemory
另外由于权限的问题,打开进程还需要一点技巧,直接copy网上的一段代码。已经封装成了函数,用起来很方便。
#include "tlhelp32.h"
#include "windows.h"
BOOL SetPrivilege(
HANDLE hToken, // access token handle
LPCTSTR lpszPrivilege, // name of privilege to enable/disable
BOOL bEnablePrivilege // to enable or disable privilege
)
{
TOKEN_PRIVILEGES tp;
LUID luid;
if ( !LookupPrivilegeValue(
NULL, // lookup privilege on local system
lpszPrivilege, // privilege to lookup
&luid ) ) // receives LUID of privilege
{
printf("LookupPrivilegeValue error: %u/n", GetLastError() );
return FALSE;
}
tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
if ( bEnablePrivilege )
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
else
tp.Privileges[0].Attributes = 0;
// Enable the privilege or disable all privileges.
if ( !AdjustTokenPrivileges(
hToken,
FALSE,
&tp,
sizeof(TOKEN_PRIVILEGES),
(PTOKEN_PRIVILEGES) NULL,
(PDWORD) NULL) )
{
printf("AdjustTokenPrivileges error: %u/n", GetLastError() );
return FALSE;
}
if (GetLastError() == ERROR_NOT_ALL_ASSIGNED)
{
printf("The token does not have the specified privilege. /n");
return FALSE;
}
return TRUE;
}
HANDLE GetProcessHandle(int nID)
{
HANDLE hToken;
bool flag = OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES, &hToken );
if( !flag )
{
DWORD err = GetLastError();
printf( "OpenProcessToken error:%d", err );
}
SetPrivilege( hToken, SE_DEBUG_NAME, true );
CloseHandle(hToken);
return OpenProcess(PROCESS_ALL_ACCESS, FALSE, nID);
}
HANDLE GetProcessHandle(LPCTSTR pName)
{
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if (INVALID_HANDLE_VALUE == hSnapshot)
{
return NULL;
}
PROCESSENTRY32 pe = { sizeof(pe) };
BOOL fOk;
for (fOk = Process32First(hSnapshot, &pe); fOk; fOk = Process32Next(hSnapshot, &pe))
{
if (!strcmp(pe.szExeFile, pName))
{
CloseHandle(hSnapshot);
return GetProcessHandle(pe.th32ProcessID);
}
}
return NULL;
}
获取进程handle只需HANDLE handle=GetProcessHandle("gamemd.exe");
接下来就是
int money;
int adress;
ReadProcessMemory(handle,(void*)0xA83D4C,&adress,4,NULL);获取基地址
ReadProcessMemory(handle,(void*)(adress+0x30c),&money,4,NULL);读取金钱
WriteProcessMemory(handle,(void*)(adress+0x30c),&money,4,NULL);修改金钱