辛辛苦苦终于有点回报了5555555

#include "stdafx.h"
#include<iostream>
#include<string.h>
#include<windows.h>
#include<tlhelp32.h>
#include<Winbase.h>
#include "转换.h"
#include "基址.h"
using namespace std;
const char* name = "dnf.exe";
DWORD PID;
HANDLE hProcess;
//基址
DWORD pingfenjizhi=0x2A1E844;
DWORD jiamijizhi=0x2AE6AC0;//加密基址
DWORD jiemijizhi=0x2AE6A60;//解密基址
DWORD jiamicanshu1=0x26DBB28;//加密参数1
DWORD jiamicanshu2=0x26DBD28;//加密参数2
//函数声明↓
void pingfen();
void jiami(DWORD dizhi,int value);
void exit();
int jiemi( int Address);
DWORD GetProcessIDByName(const char* szProcessName)
{
HANDLE hSnapshot;
PROCESSENTRY32 pe;
BOOL fFound = FALSE;
DWORD dwPID = 0;
pe.dwSize = sizeof( PROCESSENTRY32 );
hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if( hSnapshot != NULL )
{
fFound = Process32First( hSnapshot, &pe );
while( fFound )
{
//cout<<pe.szExeFile<<endl;
const char* i=unicodetoansi(pe.szExeFile);
if( strncmp( szProcessName,i , MAX_PATH ) == 0 )
{
dwPID = pe.th32ProcessID;
break;
}
fFound = Process32Next( hSnapshot, &pe );
}
CloseHandle( hSnapshot );
}
return dwPID;
} 
//↓读
int ReadMem(int Address)
{
int lpBuffer;
ReadProcessMemory(hProcess,(LPVOID)Address,&lpBuffer,4,NULL);
return lpBuffer;
}
//↓写
int WriteMem(int Address,int Data)
{
DWORD dwWrite;
WriteProcessMemory(hProcess,(LPVOID)Address,&Data,4,&dwWrite);
return dwWrite;
}

void exit()
{
CloseHandle(hProcess);
exit(0);
}
//评分↓
void pingfen()
{
//BOOL WriteProcessMemory(HANDLE hProcess,LPVOID lpBaseAddress,LPVOID lpBuffer,DWORD nSize,LPDWORD lpNumberOfBytesWritten);
DWORD pingfenjizhi1;
int value=1314520;
ReadProcessMemory(hProcess,(LPVOID)pingfenjizhi,&pingfenjizhi1,sizeof(DWORD),0);
pingfenjizhi1=pingfenjizhi1+0x198;
//WriteProcessMemory(hProcess,(LPVOID)pingfenjizhi1,&value,4,0);
jiami(pingfenjizhi1,value);
}
//加密↓
void jiami(DWORD dizhi,int value)
{
DWORD edi,ecx,ebx,eax,esi,edx,ss;
ecx=dizhi;
ReadProcessMemory(hProcess,(LPVOID)jiamijizhi,&eax,sizeof(DWORD),0);
eax=eax+1;
WriteProcessMemory(hProcess,(LPVOID)jiamijizhi,&eax,4,0);
edx=eax;
edx=edx>>8;
//edx=edx<<24;
//edx=edx>>24;
int temp=edx*2+jiamicanshu1;
ReadProcessMemory(hProcess,(LPVOID)temp,&edx,sizeof(DWORD),0);
edx%=65536;
//eax=eax<<24;
//eax=eax>>24;
temp=eax*2+jiamicanshu2;
ReadProcessMemory(hProcess,(LPVOID)temp,&ss,sizeof(DWORD),0);
ss%=65536;
edx=edx^ss;
eax=edx;
eax%=65536;
esi=value;
edx=esi>>16;
ss=esi%65536;
edx=edx+ss;
edx=edx^eax;
edi=edx;
edx=eax;
eax=eax<<16;
eax=eax+edx;
esi=value;
eax=eax^esi;
esi=dizhi+8;
WriteProcessMemory(hProcess,(LPVOID)esi,&eax,4,0);
ReadProcessMemory(hProcess,(LPVOID)dizhi,&eax,sizeof(DWORD),0);
ReadProcessMemory(hProcess,(LPVOID)jiemijizhi,&esi,sizeof(DWORD),0);
ecx=edi;
ecx=ecx<<16;
ecx=ecx+edx;
edx=eax;
edx=edx>>16;
temp=esi+edx*4+36;
ReadProcessMemory(hProcess,(LPVOID)temp,&edx,sizeof(DWORD),0);
eax%=65536;
temp=edx+eax*4+8468;
WriteProcessMemory(hProcess,(LPVOID)temp,&ecx,4,0);
}
//解密↓
int jiemi( int Address)
{
int nEax,nEcx8,nEsi,nEdx,nTmp;
nEax=ReadMem(Address);
if (nEax==-1)
return nEax;
nEcx8=ReadMem(Address+8);
if (nEcx8==-1)
return nEcx8;
nEsi=ReadMem(jiemijizhi);
nEdx=nEax>>16;
nTmp=(nEdx<<2)+nEsi+36;
nEdx=ReadMem(nTmp);
if (nEdx==-1)
return nEdx;
nEax=nEax & 65535;
nTmp=(nEax<<2)+nEdx+8468;
nEax=ReadMem(nTmp);
if (nEax==-1)
return nEax;
/*asm
(
"mov %eax,nEax\n movzx %edx,%ax\n mov nEdx,%edx"
);*/
nEdx= (unsigned short)nEax;
nEsi=nEdx<<16;
nEsi=nEsi|nEdx;
nEax=nEsi^nEcx8;
return nEax;
}

int main()
{
cout<<"提示附加成功后使用"<<endl;
cout<<"功能："<<endl;
cout<<"1.评分 1314520\n0.退出"<<endl;
//name="DNF.exe";
PID=GetProcessIDByName(name);//根据进程名字获取PID
cout<<name<<"的PID:"<<PID<<endl;
hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, PID);//权限 可继承性 PID
if(hProcess!=NULL)
cout<<"附加"<<name<<"成功"<<endl; //输出
int a;
while(1)
{
cin>>a;
switch(a)
{
case 1: pingfen();break;
case 0: exit();break;
default: break;
}
}
CloseHandle(hProcess);
return 0;
}

加密解密不知道请教了多少人总算好了

再也不是随机的数字啦哈哈哈哈哈

转载于:https://www.cnblogs.com/YXL-sign/p/5418988.html