[经验分享]c++builder ide下(F9)和单独运行程序的区别,附赠-植物大战僵尸锁定阳光(代码)
今天研究点注入其它进程的东西,拿植物大战僵尸练手,做好后在ide下运行就可以,单独运行就不行
自己仔细检查了代码也没发现什么问题,后来想到了可能是程序权限的问题,后来把程序权限提升,问题搞定.
c++builder ide下(F9)和单独运行程序的区别,最起码有程序权限的问题,以后遇到这类问题的童鞋,可以提升权限试试
编译好的文件
植物大战僵尸锁定阳光程序文件
程序源代码
// h//---------------------------------------#ifndef MainFormFMH#define MainFormFMH//---------------------------------------#include <Classes.hpp>#include <Controls.hpp>#include <StdCtrls.hpp>#include <Forms.hpp>#include <ExtCtrls.hpp>//---------------------------------------class TMainForm : public TForm{__published: // IDE-managed Components TButton *btnLock; TButton *btnAbout; TTimer *tmrSun; void __fastcall btnAboutClick(TObject *Sender); void __fastcall btnLockClick(TObject *Sender); void __fastcall tmrSunTimer(TObject *Sender);public: // User declarations __fastcall TMainForm(TComponent* Owner); __fastcall ~TMainForm();private: // User declarations void __fastcall SetProcessToken(HANDLE processH, const String &tokenName); DWORD __fastcall GetProcessID(const String &procName); DWORD mPID; HANDLE mPIDH; int mSun; int *mSunPtr; int mSunPtrAdd; bool mLock;};//---------------------------------------extern PACKAGE TMainForm *MainForm;//---------------------------------------#endif// cpp//---------------------------------------#include <vcl.h>#pragma hdrstop#include "MainFormFM.h"//---------------------------------------#pragma package(smart_init)#pragma resource "*.dfm"TMainForm *MainForm;//---------------------------------------__fastcall TMainForm::TMainForm(TComponent* Owner) : TForm(Owner), mLock(false), mPID(0){}//---------------------------------------__fastcall TMainForm::~TMainForm(){ if (mLock) CloseHandle(mPIDH);}//---------------------------------------void __fastcall TMainForm::btnAboutClick(TObject *Sender){ ShowMessage(_T("锁定阳光 2011-10-30 cnhemiya@gmail.com"));}//---------------------------------------void __fastcall TMainForm::btnLockClick(TObject *Sender){ SetProcessToken(GetCurrentProcess(), SE_DEBUG_NAME); if (!mLock) { mPID = GetProcessID(_T("PlantsVsZombies.exe")); if (mPID == NULL) { ShowMessage(_T("植物大战僵尸进程没有找到!")); return; } mPIDH = OpenProcess(PROCESS_ALL_ACCESS , false, mPID); btnLock->Caption = _T("停止锁定"); mLock = true; mSunPtr = (int *)0x00FE8330; // 0x00FE8330 初始指针地址 ReadProcessMemory(mPIDH, mSunPtr, &mSunPtrAdd, 4, NULL); mSunPtr = (int *)(mSunPtrAdd + 0x5560); // 0x5560 偏移 } else { btnLock->Caption = _T("锁定阳光"); mLock = false; CloseHandle(mPIDH); mPID = 0; } tmrSun->Enabled = mLock;}//---------------------------------------void __fastcall TMainForm::tmrSunTimer(TObject *Sender){ ReadProcessMemory(mPIDH, mSunPtr, &mSun, 4, NULL); Caption = _T("锁定阳光 - ") + IntToStr(mSun); if (mSun < 9000) { mSun = 9999; WriteProcessMemory(mPIDH, mSunPtr, &mSun, 4, NULL); }}//---------------------------------------void __fastcall TMainForm::SetProcessToken(HANDLE processH, const String &tokenName){ HANDLE tokenH; TOKEN_PRIVILEGES tokenPs; OpenProcessToken(processH, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &tokenH); LookupPrivilegeValue(NULL, tokenName.c_str(), &tokenPs.Privileges[0].Luid); tokenPs.PrivilegeCount = 1; tokenPs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED; AdjustTokenPrivileges(tokenH, false, &tokenPs, NULL, NULL, NULL);}//---------------------------------------DWORD __fastcall TMainForm::GetProcessID(const String &procName){ HANDLE snapHand; // 快照句柄 PROCESSENTRY32 process; // 进程结构 bool ret; // 是否找到进程标志 DWORD procID = 0; // 进程id snapHand = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); process.dwSize = sizeof(PROCESSENTRY32); ret = Process32First(snapHand, &process); // 遍历所有进程 while (ret) { if (procName == process.szExeFile) { procID = process.th32ProcessID; break; } ret = Process32Next(snapHand, &process); } CloseHandle(snapHand); // 关闭快照句柄 return procID;}
#include <vcl.h>#pragma hdrstop#include <tlhelp32.h>#include <winbase.h>#include "Unit1.h"//---------------------------------------#pragma package(smart_init)#pragma resource "*.dfm"TForm1 *Form1;//---------------------------------------__fastcall TForm1::TForm1(TComponent* Owner) : TForm(Owner){}//--------------------------------------- int baseAddress = 0x006A9EC0; //游戏内存基址 AnsiString processName = "PlantsVsZombie.exe"; //游戏进程名字int GetPidByProcessName(AnsiString AppName){HANDLE hSnap=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); PROCESSENTRY32 pe; int AppPid = 0; pe.dwSize = sizeof(pe); BOOL bNext=Process32First(hSnap, &pe); while(bNext) { if(strcmp(pe.szExeFile,AppName.c_str())==0) { //strcpy(szBuffer, pe.szExeFile); //break; //CloseHandle(hSnap); //return true; AppPid = pe.th32ProcessID; CloseHandle(hSnap); return AppPid; } bNext=Process32Next(hSnap, &pe); } CloseHandle(hSnap); return AppPid;}//int ReadMemoryValue(int baseAddress,AnsiString processName){try{//DWORD dwBytesWritten;HANDLE hProcess = OpenProcess(PROCESS_VM_READ , false, GetPidByProcessName(processName));//byte buffer[4];int buffer;ReadProcessMemory(hProcess, (LPCVOID)baseAddress, &buffer, 4,NULL); //将制定内存中的值读入缓冲区CloseHandle(hProcess);//int valuse = 0;// for (int i = 0; i < 4; i++)// valuse += (int)buffer[i] << (i * 8);return buffer;//valuse;}catch(...){ return 0; }}// void WriteMemoryValue(int baseAddress, AnsiString processName, int value) {// DWORD dwBytesWritten; // unsigned char buffer[4];// for (int i = 0; i < 4; i++) // buffer[i] = (Byte)(value >> (8 * i)); //PROCESS_VM_WRITE HANDLE hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName)); //0x1F0FFF 最高权限 WriteProcessMemory(hProcess, (LPVOID)baseAddress,&value,4, NULL); CloseHandle(hProcess); } //void __fastcall TForm1::Button1Click(TObject *Sender){if(GetPidByProcessName(processName)==0 ){ ShowMessage("游戏没有运行");}else { if(Button1->Caption =="启用-阳光无限") { Timer1->Enabled = true; Button1->Caption = "关闭-阳光无限"; } else { Timer1->Enabled = false; Button1->Caption = "启用-阳光无限"; } }}//---------------------------------------void __fastcall TForm1::Timer1Timer(TObject *Sender){if(GetPidByProcessName(processName)==0 ){ Timer1->Enabled = false; Button1->Caption = "启用-阳光无限"; return;}else{ int address = ReadMemoryValue(baseAddress,processName); //读取基址(该地址不会改变) address = address + 0x768; //获取2级地址 address = ReadMemoryValue(address,processName); address = address + 0x5560; //获取存放阳光数值的地址 WriteMemoryValue(address,processName,0x1869F); //写入数据到地址（0x1869F表示99999） }}//---------------------------------------void __fastcall TForm1::Button2Click(TObject *Sender){if(GetPidByProcessName(processName)==0 ){ ShowMessage("游戏没有运行");}else { if(Button2->Caption =="启用-金钱无限") { Timer2->Enabled = true; Button2->Caption = "关闭-金钱无限"; } else { Timer2->Enabled = false; Button2->Caption = "启用-金钱无限"; } }}//---------------------------------------void __fastcall TForm1::Timer2Timer(TObject *Sender){if(GetPidByProcessName(processName)==0 ){ Timer2->Enabled = false; Button2->Caption = "启用-金钱无限"; return;}else{ int address = ReadMemoryValue(baseAddress,processName); //读取基址(该地址不会改变) address = address + 0x82C; //获取2级地址 address = ReadMemoryValue(address,processName); address = address + 0x28; //获取存放阳光数值的地址 WriteMemoryValue(address,processName,0x1869F); //写入数据到地址（0x1869F表示99999） }}//---------------------------------------void __fastcall TForm1::Button3Click(TObject *Sender){if(GetPidByProcessName(processName)==0 ){ ShowMessage("游戏没有运行");}else { try{ Edit1->Text.ToInt(); } catch(...) { ShowMessage("输入的关卡数错误"); return; } int address = ReadMemoryValue(baseAddress,processName); // ShowMessage(address); //读取基址(该地址不会改变) address = address + 0x82C; //获取2级地址 address = ReadMemoryValue(address,processName); //ShowMessage(address); address = address + 0x24; //获取存放阳光数值的地址 WriteMemoryValue(address,processName,Edit1->Text.ToInt()); }}//---------------------------------------void __fastcall TForm1::Edit1KeyPress(TObject *Sender, char &Key){ if (Key != '\b') if(!(Key>='0' && Key<='9' )) { Key =0; }}//---------------------------------------
[解决办法]
学习了，顶起
[解决办法]
我这个是翻译得网上得,网上得原文是c#得,没有你厉害.
ReadMem(nil,PChar('Plants vs. Zombies'),$006A9EC0,@iAddr,4 ); if iAddr <> 0 then begin ReadMem(nil, PChar('Plants vs. Zombies'),iAddr + $768,@iAddr2,4); if iAddr <> 0 then WriteMem(nil, PChar('Plants vs. Zombies'),iAddr2 + $5560,@iMoney,4) ; end;
[解决办法]
e，有没有大波僵尸的程序啊
想看大波僵尸
[解决办法]
Android 上的 Wave Launcher 程序的效果：
http://ultimatefaves.com/
[解决办法]
内存修改器
[解决办法]
有意思！
[解决办法]
看看 学习一下
------解决方案--------------------
看看 学习一下
[解决办法]