转ASM代码
@echo offf
@cd /d "%~dp0"
cl /c /FAs %1
读取进程数据:
HWND g=::FindWindow(NULL,gamename);
DWORD a;
::GetWindowThreadProcessId(g,(LPDWORD)&a);
HANDLE ph=::OpenProcess(PROCESS_ALL_ACCESS,false,a);
int buff;
::ReadProcessMemory(ph,(LPCVOID)0xffffffff,(LPVOID)&buff,4,NULL);//0xffffffff 为读出的地址
写取进程数据:
HWND g=::FindWindow(NULL,gamename);
DWORD a;
::GetWindowThreadProcessId(g,(LPDWORD)&a);
HANDLE ph=::OpenProcess(PROCESS_ALL_ACCESS,false,a);
int buff;
::WriteProcessMemory(ph,(LPCVOID)0xffffffff,(LPVOID)&buff,4,NULL);//0xffffffff 为写入的地址
调用call地址代码:
HWND g=::FindWindow(NULL,gamename);
DWORD a;
::GetWindowThreadProcessId(g,(LPDWORD)&a);
HANDLE ph=::OpenProcess(PROCESS_ALL_ACCESS,false,a);
DWORD b;
::CreateRemoteThread(ph,NULL,0,(LPTHREAD_START_ROUTINE)0xffffffff,0,0,&b);//0xffffffff 为地址(函数指针)
------------------------------------------------------------------------------------------------------
dll 加载:
一:
1.直接在def文件中加入函数名
2.在函数前 AFX_MANAGE_STATE(AfxGetStaticModuleState());
exe:
#pragma comment(lib,"some.lib")
一:
1.使用 __declspec(dllimport)int myfun(int a,int b); 声明函数
extern "c" int myfun(int a,int b)
------------------------------------------------------------------------------------------------------
远程进程写代码并执行:
------------------------------------------------------------------------------------------------------
键盘hook dll代码(注意def文件导出)
//回调函数
LRESULT CALLBACK KeyboardProc(
int code, // hook code
WPARAM wParam, // virtual-key code
LPARAM lParam // keystroke-message information
)
{
AFX_MANAGE_STATE(AfxGetStaticModuleState()); //MFC头部最好加上的宏
if (wParam==VK_HOME && (lParam&(1<<31))==0 ){AfxMessageBox("asdasds");} //按下home
return CallNextHookEx(0,code,wParam,lParam);
}
//安装钩子
void sethook()
{
AFX_MANAGE_STATE(AfxGetStaticModuleState());//MFC头部最好加上的宏
HWND myg=::FindWindow(NULL,"1");
DWORD tid=::GetWindowThreadProcessId(myg,NULL);
::SetWindowsHookEx(
WH_KEYBOARD, // hook type
&KeyboardProc, // hook procedure
::GetModuleHandle("hookdll.dll"), // handle to application instance
tid // thread identifier
);
}
------------------------------------------------------------------------------------------------------