UE4 4.23版本以下暴力搜索GName

小子不忘记

UE4 4.23版本以下暴力搜索GName

代码如下：

1. #include <stdio.h>
   
2. #include <stdlib.h>
   
3. #include <Windows.h>
   
4. 
   
5. DWORD64 GetName(HANDLE Process,LPVOID BaseAddress) {
   
6. 
   
7.     DWORD64 Buffer = 0;
   
8.     SIZE_T lpNumber = 0;
   
9.     ReadProcessMemory(Process, BaseAddress, &Buffer, sizeof(DWORD64), &lpNumber);
   
10.     if (Buffer != 0)
    
11.     {
    
12.         ReadProcessMemory(Process, (LPVOID)(Buffer), &Buffer, sizeof(DWORD64), &lpNumber);
    
13.     }
    
14.     if (Buffer != 0)
    
15.     {
    
16.         ReadProcessMemory(Process, (LPVOID)(Buffer + 0x8), &Buffer, sizeof(DWORD64), &lpNumber);
    
17.     }
    
18. 
    
19.     return Buffer + 0xc;
    
20. 
    
21. }
    
22. 
    
23. void main() {
    
24. 
    
25.     HANDLE Pid = OpenProcess(PROCESS_ALL_ACCESS, FALSE, 12060);
    
26.     DWORD64 BaseAddress = 0x7FF7122F0000;
    
27.     DWORD64 ValueAddress = 0;
    
28.     int i = 0;
    
29.     char buffer[255] = { 0 };
    
30.     ReadProcessMemory(Pid, (LPVOID)ValueAddress, buffer, 12,NULL);
    
31. 
    
32.     while (true) {
    
33. 
    
34.         ReadProcessMemory(Pid, (LPVOID)GetName(Pid, (LPVOID)(BaseAddress+i)), buffer, 12, NULL);
    
35. 
    
36.         if (!strcmp(buffer,"ByteProperty"))
    
37.         {
    
38.             break;
    
39.         }
    
40.         i = i + 4;
    
41.         memset(buffer,0,255);
    
42.         printf("[-] 当前地址为:BaseAddress + %x \r\n", i);
    
43. 
    
44.     }
    
45. 
    
46.     printf("GName Address = %p\r\n", BaseAddress);
    
47. 
    
48. }

复制代码

修改下return中的偏移就可以了： return Buffer + 0xc;

测试了大概半小时左右能跑出来：