设为首页收藏本站
切换到宽版

龙马谷

 找回密码
 立即注册

QQ登录

只需一步，快速开始

龙马谷»龙马谷论坛 › 技术专区 › 驱动开发技术 › 最强C++x86x64驱动级读写源码
龙马谷VIP会员办理客服QQ：82926983（如果临时会话没有收到回复，请先加QQ好友再发。）
1 [已完结] GG修改器新手入门与实战教程 31课 2 [已完结] GG修改器美化修改教程 6课 3 [已完结] GG修改器Lua脚本新手入门教程 12课
4 [已完结] 触动精灵脚本新手入门必学教程 22课 5 [已完结] 手游自动化脚本入门实战教程 9课 6 [已完结] C++射击游戏方框骨骼透视与自瞄教程 27课
7 [已完结] C++零基础UE4逆向开发FPS透视自瞄教程 29课 8 [已完结] C++零基础大漠模拟器手游自动化辅助教程 22课 9 [已完结] C++零基础开发DXF内存脚本辅助教程 32课
以下是天马阁VIP教程，本站与天马阁合作，赞助VIP可以获得天马阁对应VIP会员，名额有限！ 点击进入天马阁论坛
1 [已完结] x64CE与x64dbg入门基础教程 7课 2 [已完结] x64汇编语言基础教程 16课 3 [已完结] x64辅助入门基础教程 9课
4 [已完结] C++x64内存辅助实战技术教程 149课 5 [已完结] C++x64内存检测与过检测技术教程 10课 6 [已完结] C+x64二叉树分析遍历与LUA自动登陆教程 19课
7 [已完结] C++BT功能原理与x64实战教程 29课 8 [已完结] C+FPS框透视与自瞄x64实现原理及防护思路
返回列表 发新帖
查看: 8652|回复: 2

最强C++x86x64驱动级读写源码

[复制链接]
简单350

10

主题

2

回帖

15

积分

编程入门

Rank: 1

龙马币
30
简单350 | 显示全部楼层 |阅读模式

  1. //***************调用静态变量static***************需要修改下

  3. X64常用内存读写库

  5. DWORD GetModuleSizeX64(DWORD Pid, const TCHAR* ModuleName)//获取模块大小，只能搞64位=64位，32位无法对64位操作

  7. {/*初始化DLL列表*/

  9. HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, Pid);

  11. if (hProcess == INVALID_HANDLE_VALUE || !hProcess)return NULL;

  13. DWORD dwBuffSize = 0;

  15. BOOL bRet = EnumProcessModulesEx(hProcess, NULL, 0, &dwBuffSize, LIST_MODULES_ALL);

  17. HMODULE * pModuleHandlerArr = (HMODULE*) new char[dwBuffSize];

  19. bRet = EnumProcessModulesEx(hProcess, pModuleHandlerArr, dwBuffSize, &dwBuffSize, LIST_MODULES_ALL);

  21. // 模块名称

  23. TCHAR szModuleName[MAX_PATH] = { 0 };

  25. TCHAR szBaseName[MAX_PATH];//新建

  27. // 保存模块信息

  29. MODULEINFO stcModuleInfo = { 0 };

  31. // 遍历模块列表

  33. int nCount = dwBuffSize / sizeof(HMODULE);

  35. for (int i = 0; i < nCount; ++i)

  37. {

  39. // 根据进程句柄和模块句柄,获取模块信息

  41. GetModuleInformation(hProcess, pModuleHandlerArr[i], &stcModuleInfo, sizeof(stcModuleInfo));

  43. GetModuleBaseNameA(hProcess, pModuleHandlerArr[i], szBaseName, MAX_PATH);

  45. //printf("\n%x\n", (DWORD)stcModuleInfo.SizeOfImage); //模块内存大小

  47. if (strcmp(szBaseName, ModuleName) == 0)

  49. {

  51. delete[] pModuleHandlerArr;// 释放数组

  53. pModuleHandlerArr = nullptr;

  55. return   stcModuleInfo.SizeOfImage;

  57. }

  59. }

  61. return NULL;

  63. }



  67. HMODULE GetModuleBaseX64(DWORD Pid, const TCHAR* ModuleName)

  69. {/*初始化DLL列表*/ // 这个程序不能删除,基础功能



  73. HANDLE hProcess = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ, FALSE, Pid);

  75. if (hProcess == INVALID_HANDLE_VALUE || !hProcess)return NULL;



  79. DWORD dwBuffSize = 0;

  81. BOOL bRet = EnumProcessModulesEx(hProcess, NULL, 0, &dwBuffSize, LIST_MODULES_ALL);

  83. HMODULE * pModuleHandlerArr = (HMODULE*) new char[dwBuffSize];



  87. bRet = EnumProcessModulesEx(hProcess, pModuleHandlerArr, dwBuffSize, &dwBuffSize, LIST_MODULES_ALL);



  91. // 模块名称

  93. TCHAR szModuleName[MAX_PATH] = { 0 };

  95. TCHAR szBaseName[MAX_PATH];//新建

  97. // 保存模块信息

  99. MODULEINFO stcModuleInfo = { 0 };

  101. // 遍历模块列表

  103. int nCount = dwBuffSize / sizeof(HMODULE);

  105. for (int i = 0; i < nCount; ++i)

  107. {

  109. // 根据进程句柄和模块句柄,获取模块信息

  111. GetModuleInformation(hProcess, pModuleHandlerArr[i], &stcModuleInfo, sizeof(stcModuleInfo));



  115. // 根据进程句柄和模块句柄,获取模块的路径(包括模块名)

  117. //GetModuleFileNameEx(hProcess, pModuleHandlerArr[i], szModuleName, MAX_PATH); //获取模块的路径

  119. GetModuleBaseNameA(hProcess, pModuleHandlerArr[i], szBaseName, MAX_PATH);

  121. printf("\n%llx\n", (UINT64)stcModuleInfo.lpBaseOfDll); //获取模块基地址

  123. printf("\n%llx\n", (UINT64)stcModuleInfo.EntryPoint); //获取模块入口地址

  125. printf("\n%llx\n", (UINT64)stcModuleInfo.SizeOfImage); //模块内存大小



  129. if (strcmp(szBaseName, ModuleName) == 0)

  131. {

  133. printf("基地址是：%s\n\n", szBaseName);

  135. printf("基地址是：%llX\n\n", (UINT64)stcModuleInfo.lpBaseOfDll);

  137. delete[] pModuleHandlerArr;// 释放数组

  139. pModuleHandlerArr = nullptr;

  141. return   (HMODULE)stcModuleInfo.lpBaseOfDll;

  143. }

  145. // 基址

  147. //CString szTemp;

  149. //szTemp.Format(L"%08X", stcModuleInfo.lpBaseOfDll);



  153. //// 入口点

  155. //szTemp.Format(L"%08X", stcModuleInfo.EntryPoint);



  159. //// 内存大小

  161. //szTemp.Format(L"%d", stcModuleInfo.SizeOfImage);



  165. //// 模块路径

  167. //szModuleName;



  171. }

  173. return NULL;

  175. }



  179. HMODULE GetModuleBaseAddr(DWORD Pid, CONST TCHAR* moduleName)//获取进程模块入口地址   1.进程pid   2.模块的名称   xxx.exe 或者xxx.dll

  181. {



  185. MODULEENTRY32 moduleEntry;   //模块信息的结构体

  187. HANDLE handle = NULL;

  189. handle = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, Pid); //   获取进程快照中包含在th32ProcessID中指定的进程的所有的模块

  191. //printf("handle %llX \n", (DWORD)handle);

  193. if (!handle) {                           //handle 类似指针，指向进程模块信息

  195. CloseHandle(handle);

  197. return NULL;

  199. }

  201. ZeroMemory(&moduleEntry, sizeof(MODULEENTRY32)); //清空

  203. moduleEntry.dwSize = sizeof(MODULEENTRY32);

  205. if (!Module32First(handle, &moduleEntry)) {   //结果传到 结构体指针moduleEntry

  207. CloseHandle(handle);

  209. return NULL;

  211. }

  213. do {

  215. if (strcmp(moduleEntry.szModule, moduleName) == 0) {   //wcscmp宽字节比较   moduleEntry.szModule模块名字

  217. //printf("基地址是 %X \n", (DWORD)moduleEntry.hModule);

  219. return moduleEntry.hModule; //返回模块入口地址

  221. }

  223. } while (Module32Next(handle, &moduleEntry));

  225. CloseHandle(handle);

  227. return 0;

  229. }



  233. BOOL EnableSeDebugPrivilege(IN const CHAR*   PriviledgeName, BOOL IsEnable)

  235. {

  237. // 打开权限令牌

  239. HANDLE   ProcessHandle = GetCurrentProcess();

  241. HANDLE   TokenHandle = NULL;

  243. TOKEN_PRIVILEGES TokenPrivileges = { 0 };

  245. if (!OpenProcessToken(ProcessHandle, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &TokenHandle))

  247. {

  249. return FALSE;

  251. }

  253. LUID v1;

  255. if (!LookupPrivilegeValue(NULL, PriviledgeName, &v1))// 通过权限名称查找uID

  257. {

  259. CloseHandle(TokenHandle);

  261. TokenHandle = NULL;

  263. return FALSE;

  265. }



  269. TokenPrivileges.PrivilegeCount = 1;// 要提升的权限个数

  271. TokenPrivileges.Privileges[0].Attributes = IsEnable == TRUE ? SE_PRIVILEGE_ENABLED : 0;    // 动态数组，数组大小根据Count的数目

  273. TokenPrivileges.Privileges[0].Luid = v1;

  275. if (!AdjustTokenPrivileges(TokenHandle, FALSE, &TokenPrivileges,

  277. sizeof(TOKEN_PRIVILEGES), NULL, NULL))

  279. {

  281. CloseHandle(TokenHandle);

  283. TokenHandle = NULL;

  285. return FALSE;

  287. }

  289. CloseHandle(TokenHandle);

  291. TokenHandle = NULL;

  293. return TRUE;

  295. }



  299. //==============================================x86x64内存读写wow64函数指针获取=====================================================

  301. LPFN_NTWOW64READVIRTUALMEMORY64       __NtWow64ReadVirtualMemory64;

  303. LPFN_NTWOW64WRITEVIRTUALMEMORY64   __NtWow64WriteVirtualMemory64;

  305. BOOL GetNTWOW64MemoryProcAddress()

  307. {

  309. HMODULE NtdllModuleBase = NULL;

  311. NtdllModuleBase = GetModuleHandle("Ntdll.dll");

  313. if (NtdllModuleBase == NULL)

  315. {

  317. return FALSE;

  319. }

  321. __NtWow64ReadVirtualMemory64 = (LPFN_NTWOW64READVIRTUALMEMORY64)GetProcAddress(NtdllModuleBase,

  323. "NtWow64ReadVirtualMemory64");

  325. printf("__NtWow64ReadVirtualMemory64   %llx\n", (UINT64)__NtWow64ReadVirtualMemory64);

  327. __NtWow64WriteVirtualMemory64 = (LPFN_NTWOW64WRITEVIRTUALMEMORY64)GetProcAddress(NtdllModuleBase,

  329. "NtWow64WriteVirtualMemory64");

  331. return TRUE;

  333. }



  337. char* UTF8ToUnicode(char* szUTF8)//编码转换，已经修复delet释放bug

  339. {

  341. DWORD wcscLen = MultiByteToWideChar(CP_UTF8, NULL, szUTF8, (int)strlen(szUTF8), NULL, 0);//得到所需空间的大小

  343. wchar_t wszcString[1024] = { 0 };//这个大小的转换我这里是为了写辅助的。溢出数据自己修改

  345. MultiByteToWideChar(CP_UTF8, NULL, szUTF8, (int)strlen(szUTF8), wszcString, wcscLen);   //转换

  347. wszcString[wcscLen] = '\0';

  349. DWORD len = WideCharToMultiByte(CP_ACP, 0, wszcString, (int)wcslen(wszcString), NULL, 0, NULL, NULL);

  351. static char m_char[1024] = { 0 };//这个大小的转换我这里是为了写辅助的。

  353. WideCharToMultiByte(CP_ACP, 0, wszcString, (int)wcslen(wszcString), m_char, len, NULL, NULL);

  355. m_char[len] = '\0';

  357. return m_char;

  359. }



  363. char* UnicodeToUTF8(wchar_t* wszcString)//编码转换，已经修复 注意内存delet释放bug

  365. {

  367. DWORD utf8Len = ::WideCharToMultiByte(CP_UTF8, NULL, wszcString, (int)wcslen(wszcString), NULL, 0, NULL, NULL);    //得到所需空间的大小

  369. static char szUTF8[1024] = { 0 };//这个大小的转换我这里是为了写辅助的。

  371. WideCharToMultiByte(CP_UTF8, NULL, wszcString, (int)wcslen(wszcString), szUTF8, utf8Len, NULL, NULL);    //转换

  373. szUTF8[utf8Len] = '\0';

  375. return szUTF8;

  377. }



  381. int Wow64ReadInt(ULONG ProcessID, ULONG64 BaseAddress)

  383. {

  385. BOOL     IsWow64 = FALSE;

  387. HANDLE   ProcessHandle = NULL;

  389. int   BufferData = NULL;//=====================ULONG64   BufferData = NULL

  391. ULONG64   ReturnLen = 4;//默认

  393. ULONG64   BufferLen = 4;//默认

  395. if (BaseAddress == NULL)

  397. {

  399. return FALSE;

  401. }

  403. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  405. {

  407. return FALSE;

  409. }

  411. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  413. if (ProcessHandle == NULL)

  415. {

  417. return FALSE;

  419. }



  423. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  425. {

  427. goto Exit;

  429. }

  431. __try

  433. {

  435. NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, BufferLen, &ReturnLen);

  437. printf("4字节数据是：%ld\r\n", BufferData);



  441. }

  443. __except (EXCEPTION_EXECUTE_HANDLER)

  445. {

  447. printf("异常\r\n");

  449. goto Exit;

  451. }

  453. Exit:

  455. if (ProcessHandle != NULL)

  457. {

  459. CloseHandle(ProcessHandle);

  461. ProcessHandle = NULL;

  463. }

  465. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  467. return BufferData;

  469. }



  473. char *   Wow64ReadAscii(ULONG ProcessID, ULONG64 BaseAddress, DWORD Len) //写入ASCII 参数三是长度

  475. {

  477. BOOL     IsWow64 = FALSE;

  479. HANDLE   ProcessHandle = NULL;

  481. static char   BufferData[4096] = { 0 };//=====================

  483. ULONG64   ReturnLen = 4;//默认



  487. if (BaseAddress == NULL)

  489. {

  491. return FALSE;

  493. }

  495. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  497. {

  499. return FALSE;

  501. }

  503. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  505. if (ProcessHandle == NULL)

  507. {

  509. return FALSE;

  511. }



  515. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  517. {

  519. goto Exit;

  521. }

  523. __try

  525. {

  527. NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, Len, &ReturnLen);



  531. printf("字符串是：%s \n", BufferData);

  533. }

  535. __except (EXCEPTION_EXECUTE_HANDLER)

  537. {

  539. printf("异常\r\n");

  541. goto Exit;

  543. }

  545. Exit:

  547. if (ProcessHandle != NULL)

  549. {

  551. CloseHandle(ProcessHandle);

  553. ProcessHandle = NULL;

  555. }

  557. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  559. return BufferData;

  561. }



  565. wchar_t *   Wow64ReadUnicode(ULONG ProcessID, ULONG64 BaseAddress, DWORD Len) //写入ASCII 参数三是长度

  567. {

  569. setlocale(LC_ALL, "chs"); // unicode 必加 只有添加这一句下面的打印1,2与调试打印成功

  571. BOOL     IsWow64 = FALSE;

  573. HANDLE   ProcessHandle = NULL;

  575. static wchar_t   BufferData[4096] = { 0 };//=====================

  577. ULONG64   ReturnLen = 4;//默认



  581. if (BaseAddress == NULL)

  583. {

  585. return FALSE;

  587. }

  589. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  591. {

  593. return FALSE;

  595. }

  597. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  599. if (ProcessHandle == NULL)

  601. {

  603. return FALSE;

  605. }



  609. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  611. {

  613. goto Exit;

  615. }

  617. __try

  619. {

  621. NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, Len * 5, &ReturnLen); //unicode编码要乘以2



  625. //printf("字符串是：%s \n", BufferData);

  627. }

  629. __except (EXCEPTION_EXECUTE_HANDLER)

  631. {

  633. printf("异常\r\n");

  635. goto Exit;

  637. }

  639. Exit:

  641. if (ProcessHandle != NULL)

  643. {

  645. CloseHandle(ProcessHandle);

  647. ProcessHandle = NULL;

  649. }

  651. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  653. return BufferData;

  655. }



  659. float Wow64ReadFloat(ULONG ProcessID, ULONG64 BaseAddress)

  661. {

  663. BOOL     IsWow64 = FALSE;

  665. HANDLE   ProcessHandle = NULL;

  667. FLOAT   BufferData = NULL;//=====================

  669. ULONG64   ReturnLen = 4;//默认

  671. ULONG64   BufferLen = 4;//默认

  673. if (BaseAddress == NULL)

  675. {

  677. return FALSE;

  679. }

  681. if (EnableSeDeb



  685. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  687. {

  689. goto Exit;

  691. }

  693. __try

  695. {

  697. NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, BufferLen, &ReturnLen);



  701. printf("单精度数据是：%f \n", BufferData);

  703. }

  705. __except (EXCEPTION_EXECUTE_HANDLER)

  707. {

  709. printf("异常\r\n");

  711. goto Exit;

  713. }

  715. Exit:

  717. if (ProcessHandle != NULL)

  719. {

  721. CloseHandle(ProcessHandle);

  723. ProcessHandle = NULL;

  725. }

  727. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  729. return BufferData;

  731. }



  735. double Wow64ReadDouble(ULONG ProcessID, ULONG64 BaseAddress)

  737. {

  739. BOOL     IsWow64 = FALSE;

  741. HANDLE   ProcessHandle = NULL;

  743. DOUBLE   BufferData = NULL;//=====================

  745. ULONG64   ReturnLen = 8;//默认

  747. ULONG64   BufferLen = 8;//默认

  749. if (BaseAddress == NULL)

  751. {

  753. return FALSE;

  755. }

  757. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  759. {

  761. return FALSE;

  763. }

  765. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  767. if (ProcessHandle == NULL)

  769. {

  771. return FALSE;

  773. }



  777. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  779. {

  781. goto Exit;

  783. }

  785. __try

  787. {

  789. NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, BufferLen, &ReturnLen);

  791. printf("浮点数数据是：%lf \n", BufferData);

  793. }

  795. __except (EXCEPTION_EXECUTE_HANDLER)

  797. {

  799. printf("异常\r\n");

  801. goto Exit;

  803. }

  805. Exit:

  807. if (ProcessHandle != NULL)

  809. {

  811. CloseHandle(ProcessHandle);

  813. ProcessHandle = NULL;

  815. }

  817. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  819. return BufferData;

  821. }



  825. LONG64 Wow64ReadInt64(ULONG ProcessID, ULONG64 BaseAddress)

  827. {

  829. BOOL     IsWow64 = FALSE;

  831. HANDLE   ProcessHandle = NULL;

  833. ULONG64   BufferData = NULL;//=====================

  835. ULONG64   ReturnLen = 8;//默认

  837. ULONG64   BufferLen = 8;//默认

  839. if (BaseAddress == NULL)

  841. {

  843. return FALSE;

  845. }

  847. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  849. {

  851. return FALSE;

  853. }

  855. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  857. if (ProcessHandle == NULL)

  859. {

  861. return FALSE;

  863. }



  867. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  869. {

  871. goto Exit;

  873. }

  875. __try

  877. {

  879. NTSTATUS Status = __NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, BufferLen, &ReturnLen);

  881. printf("8字节数据是：%lld\r\n", BufferData);



  885. }

  887. __except (EXCEPTION_EXECUTE_HANDLER)

  889. {

  891. printf("异常\r\n");

  893. goto Exit;

  895. }

  897. Exit:

  899. if (ProcessHandle != NULL)

  901. {

  903. CloseHandle(ProcessHandle);

  905. ProcessHandle = NULL;

  907. }

  909. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  911. return BufferData;

  913. }



  917. BOOL Wow64WriteInt(ULONG ProcessID, ULONG64 BaseAddress, INT Value)

  919. {

  921. BOOL     IsWow64 = FALSE;

  923. HANDLE   ProcessHandle = NULL;

  925. ULONG64   ReturnLen = 4;//默认

  927. ULONG64   BufferLen = 4;//默认

  929. if (BaseAddress == NULL)

  931. {

  933. return FALSE;

  935. }

  937. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  939. {

  941. return FALSE;

  943. }

  945. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);



  949. __except (EXCEPTION_EXECUTE_HANDLER)

  951. {

  953. printf("异常\r\n");

  955. goto Exit;

  957. }

  959. Exit:

  961. if (ProcessHandle != NULL)

  963. {

  965. CloseHandle(ProcessHandle);

  967. ProcessHandle = NULL;

  969. }

  971. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  973. return TRUE;

  975. }



  979. BOOL Wow64WriteFloat(ULONG ProcessID, ULONG64 BaseAddress, FLOAT Value)

  981. {

  983. BOOL     IsWow64 = FALSE;

  985. HANDLE   ProcessHandle = NULL;

  987. ULONG64   ReturnLen = 4;//默认

  989. ULONG64   BufferLen = 4;//默认

  991. if (BaseAddress == NULL)

  993. {

  995. return FALSE;

  997. }

  999. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  1001. {

  1003. return FALSE;

  1005. }

  1007. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  1009. if (ProcessHandle == NULL)

  1011. {

  1013. return FALSE;

  1015. }

  1017. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  1019. {

  1021. goto Exit;

  1023. }

  1025. __try

  1027. {

  1029. __NtWow64WriteVirtualMemory64(ProcessHandle, BaseAddress, &Value, BufferLen, &ReturnLen);

  1031. }

  1033. __except (EXCEPTION_EXECUTE_HANDLER)

  1035. {

  1037. printf("异常\r\n");

  1039. goto Exit;

  1041. }

  1043. Exit:

  1045. if (ProcessHandle != NULL)

  1047. {

  1049. CloseHandle(ProcessHandle);

  1051. ProcessHandle = NULL;

  1053. }

  1055. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  1057. return TRUE;

  1059. }



  1063. BOOL Wow64WriteDouble(ULONG ProcessID, ULONG64 BaseAddress, DOUBLE Value)

  1065. {

  1067. BOOL     IsWow64 = FALSE;

  1069. HANDLE   ProcessHandle = NULL;

  1071. ULONG64   ReturnLen = 8;//默认

  1073. ULONG64   BufferLen = 8;//默认

  1075. if (BaseAddress == NULL)

  1077. {

  1079. return FALSE;

  1081. }

  1083. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  1085. {

  1087. return FALSE;

  1089. }

  1091. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  1093. if (ProcessHandle == NULL)

  1095. {

  1097. return FALSE;

  1099. }

  1101. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  1103. {

  1105. goto Exit;

  1107. }

  1109. __try

  1111. {

  1113. __NtWow64WriteVirtualMemory64(ProcessHandle, BaseAddress, &Value, BufferLen, &ReturnLen);

  1115. }

  1117. __except (EXCEPTION_EXECUTE_HANDLER)

  1119. {

  1121. printf("异常\r\n");

  1123. goto Exit;

  1125. }

  1127. Exit:

  1129. if (ProcessHandle != NULL)

  1131. {

  1133. CloseHandle(ProcessHandle);

  1135. ProcessHandle = NULL;

  1137. }

  1139. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  1141. return TRUE;

  1143. }



  1147. BOOL Wow64WriteInt64(ULONG ProcessID, ULONG64 BaseAddress, INT64 Value)

  1149. {

  1151. BOOL     IsWow64 = FALSE;

  1153. HANDLE   ProcessHandle = NULL;

  1155. ULONG64   ReturnLen = 8;//默认

  1157. ULONG64   BufferLen = 8;//默认

  1159. if (BaseAddress == NULL)

  1161. {

  1163. return FALSE;

  1165. }

  1167. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  1169. {

  1171. return FALSE;

  1173. }

  1175. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  1177. if (ProcessHandle == NULL)

  1179. {

  1181. return FALSE;

  1183. }

  1185. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  1187. {

  1189. goto Exit;

  1191. }

  1193. __try

  1195. {

  1197. __NtWow64WriteVirtualMemory64(ProcessHandle, BaseAddress, &Value, BufferLen, &ReturnLen);



  1201. }

  1203. __except (EXCEPTION_EXECUTE_HANDLER)

  1205. {

  1207. printf("异常\r\n");

  1209. goto Exit;

  1211. }

  1213. Exit:

  1215. if (ProcessHandle != NULL)

  1217. {

  1219. CloseHandle(ProcessHandle);

  1221. ProcessHandle = NULL;

  1223. }

  1225. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  1227. return TRUE;

  1229. }



  1233. BOOL Wow64WriteAscii(ULONG ProcessID, ULONG64 BaseAddress, const char* Value)

  1235. {

  1237. BOOL     IsWow64 = FALSE;

  1239. HANDLE   ProcessHandle = NULL;

  1241. ULONG64   ReturnLen = NULL;//默认

  1243. ULONG64   BufferLen = strlen(Value);//获取字符串长度

  1245. //printf("BufferLen   %d\n", BufferLen);

  1247. if (BaseAddress == NULL)

  1249. {

  1251. return FALSE;

  1253. }

  1255. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  1257. {

  1259. return FALSE;

  1261. }

  1263. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  1265. if (ProcessHandle == NULL)

  1267. {

  1269. return FALSE;

  1271. }

  1273. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  1275. {

  1277. goto Exit;

  1279. }

  1281. __try

  1283. {

  1285. __NtWow64WriteVirtualMemory64(ProcessHandle, BaseAddress, (PVOID64)Value, BufferLen, &ReturnLen);//32位和64位区别



  1289. }

  1291. __except (EXCEPTION_EXECUTE_HANDLER)

  1293. {

  1295. printf("异常\r\n");

  1297. goto Exit;

  1299. }

  1301. Exit:

  1303. if (ProcessHandle != NULL)

  1305. {

  1307. CloseHandle(ProcessHandle);

  1309. ProcessHandle = NULL;

  1311. }

  1313. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  1315. return TRUE;

  1317. }



  1321. BOOL Wow64WriteUTF8(ULONG ProcessID, UINT64 BaseAddress, const wchar_t   * GBK_Str)//为了兼容，写入的是unicode，函数内部会进行转换操作的。

  1323. {

  1325. BOOL     IsWow64 = FALSE; //64位程序备用

  1327. HANDLE   ProcessHandle = NULL;

  1329. ULONG64   ReturnLen = NULL;//默认

  1331. char strUTF8[4096] = { 0 };

  1333. char *unGunG = UnicodeToUTF8((wchar_t*)GBK_Str);

  1335. size_t   BufferLen = strlen(unGunG);//获取字符串长度   宽字符用 wcslen

  1337. RtlMoveMemory(strUTF8, unGunG, BufferLen);

  1339. //printf("BufferLen   %lld\n", BufferLen);

  1341. if (BaseAddress == NULL)

  1343. {

  1345. return FALSE;

  1347. }

  1349. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  1351. {

  1353. return FALSE;

  1355. }

  1357. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  1359. if (ProcessHandle == NULL)

  1361. {

  1363. return FALSE;

  1365. }

  1367. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  1369. {

  1371. goto Exit;

  1373. }

  1375. __try

  1377. {

  1379. __NtWow64WriteVirtualMemory64(ProcessHandle, BaseAddress, &strUTF8, BufferLen, &ReturnLen);//32位和64位区别



  1383. }

  1385. __except (EXCEPTION_EXECUTE_HANDLER)

  1387. {

  1389. printf("异常\r\n");

  1391. goto Exit;

  1393. }

  1395. Exit:

  1397. if (ProcessHandle != NULL)

  1399. {

  1401. CloseHandle(ProcessHandle);

  1403. ProcessHandle = NULL;

  1405. }

  1407. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  1409. return TRUE;

  1411. }



  1415. BOOL Wow64WriteUnicode(ULONG ProcessID, UINT64 BaseAddress, const wchar_t * Value)

  1417. {

  1419. BOOL     IsWow64 = FALSE;

  1421. HANDLE   ProcessHandle = NULL;

  1423. UINT64   ReturnLen = NULL;//默认

  1425. UINT64   BufferLen = wcslen(Value) * 2;//获取字符串长度   宽字符用 wcslen

  1427. printf("BufferLen   %lld\n", BufferLen);

  1429. if (BaseAddress == NULL)

  1431. {

  1433. return FALSE;

  1435. }

  1437. if (EnableSeDebugPrivilege("SeDebugPrivilege", TRUE) == FALSE)

  1439. {

  1441. return FALSE;

  1443. }

  1445. ProcessHandle = OpenProcess(PROCESS_QUERY_INFORMATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, ProcessID);

  1447. if (ProcessHandle == NULL)

  1449. {

  1451. return FALSE;

  1453. }

  1455. if (__NtWow64ReadVirtualMemory64 == NULL || __NtWow64WriteVirtualMemory64 == NULL)

  1457. {

  1459. goto Exit;

  1461. }

  1463. __try

  1465. {

  1467. __NtWow64WriteVirtualMemory64(ProcessHandle, BaseAddress, (PVOID64)Value, BufferLen, &ReturnLen);//32位和64位区别



  1471. }

  1473. __except (EXCEPTION_EXECUTE_HANDLER)

  1475. {

  1477. printf("异常\r\n");

  1479. goto Exit;

  1481. }

  1483. Exit:

  1485. if (ProcessHandle != NULL)

  1487. {

  1489. CloseHandle(ProcessHandle);

  1491. ProcessHandle = NULL;

  1493. }

  1495. EnableSeDebugPrivilege("SeDebugPrivilege", FALSE);

  1497. return TRUE;

  1499. }



  1503. //===============================x86   r3层普通API 内存读写=================================================

  1505. BOOL WriteInt64(DWORD ProcessID, UINT64 Addr, __int64 Value)

  1507. {

  1509. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1511. if (Process_handle == NULL)

  1513. {

  1515. printf("获取进程句柄失败\n");

  1517. }

  1519. else

  1521. {

  1523. printf("获取进程句柄成功\n");

  1525. }

  1527. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 8, NULL);

  1529. CloseHandle(Process_handle);

  1531. return ret;

  1533. }



  1537. BOOL WriteInt(DWORD ProcessID, UINT64 Addr, int Value)

  1539. {

  1541. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1543. if (Process_handle == NULL)

  1545. {

  1547. printf("获取进程句柄失败\n");

  1549. }

  1551. else

  1553. {

  1555. printf("获取进程句柄成功\n");

  1557. }



  1561. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 4, NULL);

  1563. CloseHandle(Process_handle);

  1565. return ret;

  1567. }



  1571. BOOL WriteShort(DWORD ProcessID, UINT64 Addr, short Value) //2字节整数

  1573. {

  1575. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1577. if (Process_handle == NULL)

  1579. {

  1581. printf("获取进程句柄失败\n");

  1583. }

  1585. else

  1587. {

  1589. //printf("获取进程句柄成功\n");

  1591. }

  1593. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 2, NULL);

  1595. CloseHandle(Process_handle);

  1597. return ret;

  1599. }





  1605. bool WriteData(DWORD ProcessID, UINT64   Addr, byte byteArr[]) //写入字节集   "1d   80 66 a2"

  1607. {

  1609. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1611. if (Process_handle == NULL)

  1613. {

  1615. printf("获取进程句柄失败\n");

  1617. }

  1619. else

  1621. {

  1623. printf("获取进程句柄成功\n");

  1625. }



  1629. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, byteArr, sizeof(byteArr), NULL);//strlen字符长度

  1631. CloseHandle(Process_handle);

  1633. return ret;

  1635. }







  1643. BOOL WriteByte(DWORD ProcessID, UINT64 Addr, byte Value)

  1645. {

  1647. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1649. if (Process_handle == NULL)

  1651. {

  1653. printf("获取进程句柄失败\n");

  1655. }

  1657. else

  1659. {

  1661. //printf("获取进程句柄成功\n");

  1663. }

  1665. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 2, NULL);

  1667. CloseHandle(Process_handle);

  1669. return ret;

  1671. }

  1673. //

  1675. BOOL WriteFloat(DWORD ProcessID, UINT64 Addr, float Value)

  1677. {

  1679. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1681. if (Process_handle == NULL)

  1683. {

  1685. printf("获取进程句柄失败\n");

  1687. }

  1689. else

  1691. {

  1693. //printf("获取进程句柄成功\n");

  1695. }

  1697. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 4, NULL);

  1699. CloseHandle(Process_handle);

  1701. return ret;

  1703. }



  1707. BOOL WriteDouble(DWORD ProcessID, UINT64 Addr, double Value)

  1709. {

  1711. //printf("打印输出进程pid ：%x \n", game_pid);

  1713. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1715. if (Process_handle == NULL)

  1717. {

  1719. printf("获取进程句柄失败\n");

  1721. }

  1723. else

  1725. {

  1727. printf("获取进程句柄成功\n");

  1729. }

  1731. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 8, NULL);

  1733. CloseHandle(Process_handle);

  1735. return ret;

  1737. }



  1741. BOOL WriteAcsii(DWORD ProcessID, UINT64 Addr, const   char * str)

  1743. {

  1745. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1747. if (Process_handle == NULL)

  1749. {

  1751. printf("获取进程句柄失败\n");

  1753. }

  1755. else

  1757. {

  1759. printf("获取进程句柄成功\n");

  1761. }

  1763. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, (LPVOID)str, strlen(str), NULL);//strlen字符长度

  1765. CloseHandle(Process_handle);

  1767. return ret;

  1769. }



  1773. BOOL WriteUnicode(DWORD ProcessID, UINT64 Addr, const wchar_t * str)

  1775. {

  1777. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1779. if (Process_handle == NULL)

  1781. {

  1783. printf("获取进程句柄失败\n");

  1785. }

  1787. else

  1789. {

  1791. printf("获取进程句柄成功\n");

  1793. }

  1795. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, (LPVOID)str, wcslen(str) * 2 + 2, NULL);//wcslen宽字符长度+2

  1797. CloseHandle(Process_handle);

  1799. return ret;

  1801. }



  1805. BOOL WriteUnicode(DWORD ProcessID, UINT64 Addr, wchar_t * str)

  1807. {

  1809. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1811. if (Process_handle == NULL)

  1813. {

  1815. printf("获取进程句柄失败\n");

  1817. }

  1819. else

  1821. {

  1823. printf("获取进程句柄成功\n");

  1825. }

  1827. BOOL ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, (LPVOID)str, wcslen(str) * 2 + 2, NULL);//wcslen宽字符长度+2

  1829. //printf("iiiiiiiiiii    %d\n", sizeof(str));

  1831. CloseHandle(Process_handle);

  1833. return ret;

  1835. }







  1843. DWORD GetPidByHwnd(HWND hwnd)

  1845. {

  1847. DWORD Pid = NULL;

  1849. GetWindowThreadProcessId(hwnd, &Pid); //lpdword指针类型

  1851. return   Pid;

  1853. }



  1857. DWORD FloatToDword(float value)//单浮点数转整数

  1859. {

  1861. DWORD   val = NULL;

  1863. memcpy(&val, &value, 4);

  1865. return val;

  1867. }



  1871. UINT64 DoubleToDword(double value)//双浮点数转整数

  1873. {

  1875. UINT64   val = NULL;

  1877. memcpy(&val, &value, 8);

  1879. return val;

  1881. }



  1885. int Int64To32(__int64 value)//部分接口

  1887. {

  1889. DWORD   val = NULL;

  1891. memcpy(&val, &value, 4);

  1893. return val;

  1895. }



  1899. int DwordToInt(DWORD value)//无符号转有符号

  1901. {

  1903. int   val = NULL;

  1905. memcpy(&val, &value, 4);

  1907. return val;

  1909. }



  1913. DWORD IntToDword(int value)//无符号转有符号

  1915. {

  1917. DWORD   val = NULL;

  1919. memcpy(&val, &value, 4);

  1921. return val;

  1923. }



  1927. BOOL WriteIntEx(DWORD ProcessID, UINT64 Addr, __int64 Value, int NumByte)

  1929. {

  1931. HANDLE   Process_handle = OpenProcess(PROCESS_ALL_ACCESS, NULL, ProcessID); //1.渴望得到的访问权限（标志）,全局   

  1933. if (Process_handle == NULL)

  1935. printf("获取进程句柄失败\n");

  1937. else

  1939. printf("获取进程句柄成功\n");

  1941. BOOL ret = NULL;

  1943. if (NumByte == 4)

  1945. {

  1947. int   real_val = (int)Value;

  1949. ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &real_val, 4, NULL);

  1951. }

  1953. else if (NumByte == 2)

  1955. {

  1957. short   real_val = (short)Value;

  1959. ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &real_val, 2, NULL);

  1961. }

  1963. else if (NumByte == 1)

  1965. {

  1967. short   real_val = (short)Value;

  1969. ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &real_val, 1, NULL);

  1971. }

  1973. else if (NumByte == 8)

  1975. {

  1977. ret = WriteProcessMemory(Process_handle, (LPVOID)Addr, &Value, 8, NULL);

  1979. }

  1981. CloseHandle(Process_handle);

  1983. return ret;

  1985. }





  1991. byte* ReadByteArray(DWORD ProcessID, UINT64   addr, DWORD size) //写入4字节整数

  1993. {

  1995. byte *Value = NULL;

  1997. HANDLE Hprocess = NULL;

  1999. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2001. if (Hprocess == 0)

  2003. printf("打开进程失败！\n");

  2005. else

  2007. {

  2009. printf("打开进程成功！\n");

  2011. ReadProcessMemory(Hprocess, (LPVOID)(addr), Value, size, NULL);//注意参数 4字节

  2013. }

  2015. CloseHandle(Hprocess);//关闭进程句柄

  2017. return Value;

  2019. }













  2033. byte ReadByte(DWORD ProcessID, UINT64   addr) //写入4字节整数

  2035. {

  2037. byte Value = NULL;

  2039. HANDLE Hprocess = NULL;

  2041. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2043. if (Hprocess == 0)

  2045. printf("打开进程失败！\n");

  2047. else

  2049. {

  2051. printf("打开进程成功！\n");

  2053. ReadProcessMemory(Hprocess, (LPVOID)(addr), &Value, 1, NULL);//注意参数 4字节

  2055. }

  2057. CloseHandle(Hprocess);//关闭进程句柄

  2059. return Value;

  2061. }



  2065. short ReadShort(DWORD ProcessID, UINT64   addr) //写入4字节整数

  2067. {

  2069. short Value = NULL;

  2071. HANDLE Hprocess = NULL;

  2073. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2075. if (Hprocess == 0)

  2077. printf("打开进程失败！\n");

  2079. else

  2081. {

  2083. printf("打开进程成功！\n");

  2085. ReadProcessMemory(Hprocess, (LPVOID)(addr), &Value, 2, NULL);//注意参数 4字节

  2087. }

  2089. CloseHandle(Hprocess);//关闭进程句柄

  2091. return Value;

  2093. }



  2097. int ReadInt(DWORD ProcessID, UINT64   addr) //写入4字节整数

  2099. {

  2101. int Value = NULL;

  2103. HANDLE Hprocess = NULL;

  2105. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2107. if (Hprocess == 0)

  2109. printf("打开进程失败！\n");

  2111. else

  2113. {

  2115. printf("打开进程成功！\n");

  2117. ReadProcessMemory(Hprocess, (LPVOID)(addr), &Value, 4, NULL);//注意参数 4字节

  2119. }

  2121. CloseHandle(Hprocess);//关闭进程句柄

  2123. return Value;

  2125. }



  2129. DWORD ReadDword(DWORD ProcessID, UINT64   addr) //写入4字节整数

  2131. {

  2133. DWORD Value = NULL;

  2135. HANDLE Hprocess = NULL;

  2137. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2139. if (Hprocess == 0)

  2141. printf("打开进程失败！\n");

  2143. else

  2145. {

  2147. printf("打开进程成功！\n");

  2149. ReadProcessMemory(Hprocess, (LPVOID)(addr), &Value, 4, NULL);//注意参数 4字节



  2153. }

  2155. CloseHandle(Hprocess);//关闭进程句柄

  2157. return Value;

  2159. }



  2163. __int64 ReadInt64(DWORD ProcessID, UINT64   addr) //写入8字节整数,地址还是4字节

  2165. {

  2167. __int64 Value = NULL;

  2169. HANDLE Hprocess = NULL;

  2171. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2173. if (Hprocess == 0)

  2175. printf("打开进程失败！\n");

  2177. else

  2179. {

  2181. printf("打开进程成功！\n");

  2183. ReadProcessMemory(Hprocess, (LPVOID)(addr), &Value, 8, NULL);//注意参数 4字节



  2187. }

  2189. CloseHandle(Hprocess);//关闭进程句柄

  2191. return Value;

  2193. }







  2201. UINT64 MemoryVirtualAllocEx(DWORD ProcessID, DWORD Len) //远程申请内存空间

  2203. {

  2205. HANDLE Hprocess = NULL;

  2207. LPVOID   Addr = NULL;

  2209. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2211. Addr = VirtualAllocEx(Hprocess, NULL, Len, MEM_COMMIT, PAGE_READWRITE);

  2213. CloseHandle(Hprocess);//关闭进程句柄

  2215. return (UINT64)Addr;

  2217. }





  2223. void * ReadAscii(DWORD ProcessID, UINT64   addr, DWORD Len) //写入8字节整数,地址还是4字节

  2225. {

  2227. static char   Value[1024] = { 0 };

  2229. char ByteBuffer = NULL;

  2231. HANDLE Hprocess = NULL;

  2233. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2235. if (Hprocess == 0)

  2237. printf("打开进程失败！\n");

  2239. else

  2241. {

  2243. printf("打开进程成功！\n");



  2247. for (size_t i = 0; i < 1024; i++)//遍历长度，上限1024

  2249. {

  2251. ReadProcessMemory(Hprocess, (LPCVOID)(addr + i), &ByteBuffer, 1, NULL);//注意参数 4字节

  2253. //printf("遍历I数值！   %d   \n", i);

  2255. if (ByteBuffer == 0)

  2257. {

  2259. if (Len == 0)//如果是0自动长度

  2261. {

  2263. ReadProcessMemory(Hprocess, (LPCVOID)(addr), &Value, i + 1, NULL); //   字节\0

  2265. break;



  2269. }

  2271. else {

  2273. ReadProcessMemory(Hprocess, (LPCVOID)(addr), &Value, Len, NULL); //   字节\0

  2275. break;

  2277. }



  2281. }



  2285. }

  2287. }

  2289. CloseHandle(Hprocess);//关闭进程句柄

  2291. return Value;

  2293. }



  2297. wchar_t * ReadUnicode(DWORD ProcessID, UINT64   addr, DWORD Len) //控制台程序不支持unicode打印输出

  2299. {

  2301. static wchar_t   StrValue[1024] = { 0 };

  2303. wchar_t ShortBuffer = NULL;

  2305. HANDLE Hprocess = NULL;

  2307. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2309. if (Hprocess == 0)

  2311. printf("打开进程失败！\n");

  2313. else

  2315. {

  2317. printf("打开进程成功！\n");



  2321. for (size_t i = 0; i < 1024; i = i + 2)//遍历长度，上限1024

  2323. {

  2325. ReadProcessMemory(Hprocess, (LPCVOID)(addr + i), &ShortBuffer, 2, NULL);//注意参数 4字节

  2327. if (ShortBuffer == '\0')

  2329. {

  2331. if (Len == 0)//如果是0自动长度

  2333. {

  2335. ReadProcessMemory(Hprocess, (LPCVOID)(addr), &StrValue, i + 2, NULL); //   字节\0

  2337. printf("打印    %ls   \n", StrValue);

  2339. //printf("打印i   ：   %d   \n", i);

  2341. break;

  2343. }

  2345. else {

  2347. ReadProcessMemory(Hprocess, (LPCVOID)(addr), &StrValue, Len, NULL); //   字节\0

  2349. break;

  2351. }

  2353. }

  2355. }

  2357. }

  2359. CloseHandle(Hprocess);//关闭进程句柄

  2361. return StrValue;

  2363. }



  2367. int ReadIntEx(DWORD ProcessID, UINT64   BaseAddr, UINT64 OffsetArray[], DWORD Num) //第二个是基地址 第三个参数是偏移数组 第四个偏移数量

  2369. {

  2371. int Value = NULL;

  2373. HANDLE Hprocess = NULL;

  2375. DWORD nBuffer = NULL;

  2377. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2379. if (Hprocess != 0)

  2381. {

  2383. ReadProcessMemory(Hprocess, (LPVOID)(BaseAddr), &Value, 4, NULL);//注意参数 4字节

  2385. for (size_t i = 0; i < Num; i++)//word占2字节

  2387. {

  2389. ReadProcessMemory(Hprocess, (LPVOID)(Value + OffsetArray[i]), &Value, 4, NULL);//注意参数 4字节

  2391. }

  2393. }

  2395. else printf("打开进程失败！\n");

  2397. CloseHandle(Hprocess);//关闭进程句柄

  2399. return Value;

  2401. }



  2405. float ReadFloatEx(DWORD ProcessID, UINT64   BaseAddr, UINT64 OffsetArray[], DWORD Num) //第二个是基地址 第三个参数是偏移数组 第四个偏移数量

  2407. {

  2409. UINT64 Value = NULL;

  2411. HANDLE Hprocess = NULL;

  2413. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2415. if (Hprocess != 0)

  2417. {

  2419. ReadProcessMemory(Hprocess, (LPVOID)(BaseAddr), &Value, 4, NULL);//注意参数 4字节

  2421. for (size_t i = 0; i < Num; i++)//word占2字节

  2423. {

  2425. //printf("str       %lld\n", Value);

  2427. ReadProcessMemory(Hprocess, (LPVOID)(Value + OffsetArray[i]), &Value, 4, NULL);//注意参数 4字节

  2429. }

  2431. }

  2433. else printf("打开进程失败！\n");

  2435. CloseHandle(Hprocess);//关闭进程句柄

  2437. return (float)Value;

  2439. }



  2443. double ReadDoubleEx(DWORD ProcessID, UINT64   BaseAddr, UINT64 OffsetArray[], DWORD Num) //第二个是基地址 第三个参数是偏移数组 第四个偏移数量

  2445. {

  2447. double ValueDouble = NULL;

  2449. HANDLE Hprocess = NULL;

  2451. UINT64 nBuffer = NULL;

  2453. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2455. if (Hprocess != 0)

  2457. {

  2459. ReadProcessMemory(Hprocess, (LPVOID)(BaseAddr), &nBuffer, 4, NULL);//注意参数 4字节

  2461. DWORD   i = NULL;

  2463. for (i = 0; i < Num - 1; i++)//word占2字节

  2465. {

  2467. ReadProcessMemory(Hprocess, (LPVOID)(nBuffer + OffsetArray[i]), &nBuffer, 4, NULL);//注意参数 4字节

  2469. /*printf("double       %x\n", OffsetArray[i]);*/

  2471. }

  2473. ReadProcessMemory(Hprocess, (LPVOID)(nBuffer + OffsetArray[i]), &ValueDouble, 8, NULL);//Value64最终结果

  2475. }

  2477. else printf("打开进程失败！\n");

  2479. CloseHandle(Hprocess);//关闭进程句柄

  2481. return ValueDouble;

  2483. }



  2487. __int64 ReadIntEx64(DWORD ProcessID, UINT64   BaseAddr, DWORD OffsetArray[], DWORD Num) //第二个是基地址 第三个参数是偏移数组 第四个偏移数量

  2489. {

  2491. __int64 value64 = NULL;

  2493. HANDLE Hprocess = NULL;

  2495. UINT64 nBuffer = NULL;

  2497. Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  2499. if (Hprocess != 0)

  2501. {

  2503. ReadProcessMemory(Hprocess, (LPVOID)(BaseAddr), &nBuffer, 4, NULL);//注意参数 4字节

  2505. DWORD   i = NULL;

  2507. for (i = 0; i < Num - 1; i++)//word占2字节

  2509. {

  2511. ReadProcessMemory(Hprocess, (LPVOID)(nBuffer + OffsetArray[i]), &nBuffer, 4, NULL);//注意参数 4字节

  2513. /*printf("double       %x\n", OffsetArray[i]);*/

  2515. }

  2517. ReadProcessMemory(Hprocess, (LPVOID)(nBuffer + OffsetArray[i]), &value64, 8, NULL);//Value64最终结果

  2519. }

  2521. else printf("打开进程失败！\n");

  2523. CloseHandle(Hprocess);//关闭进程句柄

  2525. return value64;

  2527. }



  2531. int EnableDebugPriv(const char *name)

  2533. {

  2535. HANDLE hToken;        //进程令牌句柄

  2537. TOKEN_PRIVILEGES tp;   //TOKEN_PRIVILEGES结构体，其中包含一个【类型+操作】的权限数组

  2539. LUID luid;           //上述结构体中的类型值

  2541. //打开进程令牌环

  2543. //GetCurrentProcess()获取当前进程的伪句柄，只会指向当前进程或者线程句柄，随时变化

  2545. if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))

  2547. {

  2549. fprintf(stderr, "OpenProcessToken error\n");

  2551. return -1;

  2553. }

  2555. //获得本地进程name所代表的权限类型的局部唯一ID

  2557. if (!LookupPrivilegeValue(NULL, name, &luid))

  2559. {

  2561. fprintf(stderr, "LookupPrivilegeValue error\n");

  2563. }



  2567. tp.PrivilegeCount = 1;                               //权限数组中只有一个“元素”

  2569. tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;   //权限操作

  2571. tp.Privileges[0].Luid = luid;                        //权限类型



  2575. //调整进程权限

  2577. if (!AdjustTokenPrivileges(hToken, 0, &tp, sizeof(TOKEN_PRIVILEGES), NULL, NULL))

  2579. {

  2581. fprintf(stderr, "AdjustTokenPrivileges error!\n");

  2583. return -1;

  2585. }

  2587. return 0;

  2589. }





  2595. DWORD   GetPidByName(const char * ProcessName) //根据进程名字获取进程ID

  2597. {

  2599. HANDLE ProcessAll = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);

  2601. PROCESSENTRY32 processInfo = { 0 };

  2603. processInfo.dwSize = sizeof(PROCESSENTRY32);

  2605. do {

  2607. if (strcmp(ProcessName, processInfo.szExeFile) == 0) {

  2609. return processInfo.th32ProcessID;

  2611. }



  2615. } while (Process32Next(ProcessAll, &processInfo));

  2617. return NULL;

  2619. }

  2621. //======================================注入==========================

  2623. VOID InjectDll(const CHAR pathStr[0x1000], const CHAR ProcessName[256])

  2625. {

  2627. //CHAR   pathStr[0x1000] = { "K:\\我的文档\\visual studio 2012\\Projects\\InjectChat\\Debug\\WeChatDll.dll" };

  2629. DWORD PID = GetPidByName((CHAR*)ProcessName);

  2631. if (PID == 0)

  2633. {

  2635. MessageBox(NULL, "没有找到微信进程或者微信没有启动", "错误", 0);

  2637. return;

  2639. }



  2643. HANDLE hProcsee = OpenProcess(PROCESS_ALL_ACCESS, FALSE, PID);

  2645. if (hProcsee == NULL) {

  2647. MessageBox(NULL, "没有找到微信进程", "错误", 0);

  2649. return;

  2651. }



  2655. LPVOID dllAdd = VirtualAllocEx(hProcsee, NULL, strlen(pathStr), MEM_COMMIT, PAGE_READWRITE);

  2657. if (dllAdd == NULL) {

  2659. MessageBox(NULL, "内存写入", "错误", 0);

  2661. }

  2663. if (WriteProcessMemory(hProcsee, dllAdd, pathStr, strlen(pathStr), NULL) == 0) {

  2665. MessageBox(NULL, "内存写入", "错误", 0);

  2667. return;

  2669. }



  2673. HMODULE K32 = GetModuleHandle("Kernel32.dll");

  2675. LPVOID LoadAdd = GetProcAddress(K32, "LoadLibraryA");

  2677. HANDLE exec = CreateRemoteThread(hProcsee, NULL, 0, (LPTHREAD_START_ROUTINE)LoadAdd, dllAdd, 0, NULL);

  2679. if (NULL == exec) {

  2681. MessageBox(NULL, "远程注入失败", "错误", 0);

  2683. return;

  2685. }

  2687. WaitForSingleObject(exec, INFINITE);

  2689. CloseHandle(hProcsee);

  2691. }



  2695. VOID InjectSellCode(DWORD processid, BYTE SellCode[]) //注入硬编码 shellcode

  2697. {

  2699. EnableDebugPriv(SE_DEBUG_NAME); //提高进程权限

  2701. if (processid == 0)

  2703. {

  2705. MessageBox(NULL, "没有找到微信进程或者微信没有启动", "错误", 0);

  2707. return;

  2709. }



  2713. HANDLE hProcsee = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processid); //打开目的程序，获取游戏权限   PROCESS_ALL_ACCESS获取所有权限

  2715. if (hProcsee == NULL) {

  2717. MessageBox(NULL, "没有找到微信进程", "错误", 0);

  2719. return;

  2721. }



  2725. LPVOID dllAdd = VirtualAllocEx(hProcsee, NULL, 1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE);//向游戏申请内存空间

  2727. if (dllAdd == NULL) {

  2729. MessageBox(NULL, "内存申请失败", "0", 0);

  2731. }





  2737. if (WriteProcessMemory(hProcsee, dllAdd, SellCode, 1023, NULL) == 0) {       //讲shellcode内存写入到游戏里面

  2739. MessageBox(NULL, "内存写入", "错误", 0);

  2741. return;

  2743. }



  2747. TRACE("申请的内存空间是 %x\n", dllAdd);



  2751. HANDLE ThreadHandle = CreateRemoteThread(hProcsee, NULL, 0, (LPTHREAD_START_ROUTINE)dllAdd, NULL, 0, NULL); //远程 创建线程   返回值是线程句柄

  2753. if (NULL == ThreadHandle) {

  2755. MessageBox(NULL, "远程注入失败", "错误", 0);

  2757. return;

  2759. }



  2763. WaitForSingleObject(ThreadHandle, INFINITE); //等到我线程代码执行完成之后，再返回，否则一直在等待   1秒=1000毫秒。 大量代码注入的

  2765. CloseHandle(ThreadHandle); ///释放线程句柄

  2767. CloseHandle(hProcsee); //关闭临时进程句柄        临时的指针



  2771. }



  2775. BOOL UnloadDll(DWORD dwPid, CHAR   strDllName[256])

  2777. {

  2779. //获取宿主进程的句柄，注意那几个参数，不然会出错

  2781. HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS,

  2783. FALSE, dwPid);

  2785. if (hProcess == NULL) {

  2787. ::MessageBox(NULL, "无法获取进程句柄", "错误", MB_OK | MB_ICONERROR);

  2789. return FALSE;

  2791. }



  2795. DWORD   dwSize = 0;

  2797. ULONG64   dwWritten = 0;

  2799. DWORD   dwHandle = 0;



  2803. dwSize = sizeof(strDllName) + 1;//dll的全路径名的长度，待会分配内存要用到的



  2807. //向宿主进程分配内存，返回一个指针

  2809. LPVOID lpBuf = VirtualAllocEx(hProcess, NULL, dwSize, MEM_COMMIT, PAGE_READWRITE);



  2813. //如果在宿主进程空间写失败就直接报错闪人

  2815. if (!WriteProcessMemory(hProcess, lpBuf, strDllName, dwSize, (SIZE_T*)&dwWritten))

  2817. {

  2819. VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT);

  2821. CloseHandle(hProcess);

  2823. MessageBox(NULL, "在目标进程中写入失败", "错误", MB_OK | MB_ICONERROR);

  2825. return FALSE;

  2827. }



  2831. //获取GetModuleHandleA函数地址

  2833. LPVOID pFun = GetProcAddress(GetModuleHandle("Kernel32"), "GetModuleHandleA");



  2837. //在宿主进程中创建一个远程线程，线程函数为上面导出的GetModuleHandleA，参数为lpBuf指针，还

  2839. //记得我们获取的dll全路径不

  2841. HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFun,

  2843. lpBuf, 0, NULL);

  2845. //如果创建线程失败，直接报错闪人

  2847. if (hThread == NULL) {

  2849. CloseHandle(hProcess);

  2851. ::MessageBox(NULL, "在目标进程创建远程线程失败", "错误", MB_OK | MB_ICONERROR);

  2853. return FALSE;

  2855. }



  2859. //   等待GetModuleHandle运行完毕   

  2861. WaitForSingleObject(hThread, INFINITE);

  2863. //   获得GetModuleHandle的返回值   

  2865. GetExitCodeThread(hThread, &dwHandle);



  2869. //   释放目标进程中申请的空间   

  2871. VirtualFreeEx(hProcess, lpBuf, dwSize, MEM_DECOMMIT);

  2873. CloseHandle(hThread);



  2877. //   使目标进程调用FreeLibraryAndExit，卸载DLL,实际也可以用FreeLibrary，但是我发现前者好一点

  2879. pFun = GetProcAddress(GetModuleHandle("Kernel32"), "FreeLibraryAndExitThread");

  2881. hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)pFun, (LPVOID)dwHandle, 0, NULL);

  2883. //   等待FreeLibraryAndExitThread执行完毕   

  2885. WaitForSingleObject(hThread, INFINITE);

  2887. CloseHandle(hThread);

  2889. CloseHandle(hProcess);



  2893. return TRUE;   //操作成功

  2895. }



  2899. //提升进程访问权限

  2901. bool enableDebugPriv()

  2903. {

  2905. HANDLE   hToken;

  2907. LUID    sedebugnameValue;

  2909. TOKEN_PRIVILEGES tkp;

  2911. if (!OpenProcessToken(GetCurrentProcess(),

  2913. TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken)

  2915. )

  2917. {

  2919. return false;

  2921. }

  2923. if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))

  2925. {

  2927. CloseHandle(hToken);

  2929. return false;

  2931. }

  2933. tkp.PrivilegeCount = 1;

  2935. tkp.Privileges[0].Luid = sedebugnameValue;

  2937. tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

  2939. if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))

  2941. {

  2943. CloseHandle(hToken);

  2945. return false;

  2947. }

  2949. return true;

  2951. }

  2953. //======================================结尾部分

  2955. HANDLE GetModule()

  2957. {

  2959. HANDLE hProcess;                        //进程句柄

  2961. HANDLE hModule;                         //模块句柄

  2963. BOOL bProcess = FALSE;                  //获取进程信息的函数返回值

  2965. BOOL bModule = FALSE;                   //获取模块信息的函数返回值

  2967. PROCESSENTRY32 pe32;                    //保存进程信息

  2969. MODULEENTRY32   me32;                    //保存模块信息



  2973. int i = 0;

  2975. int j = 0;



  2979. //获取进程调试权限,如果失败,则提示获取权限失败,失败的话,有的进程信息就会获取不到

  2981. if (EnableDebugPriv(SE_DEBUG_NAME))

  2983. {

  2985. fprintf(stderr, "Add Privilege error\n");

  2987. }



  2991. hProcess = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);//获取进程快照

  2993. if (hProcess == INVALID_HANDLE_VALUE)

  2995. {

  2997. printf("获取进程快照失败\n");

  2999. exit(1);

  3001. }



  3005. bProcess = Process32First(hProcess, &pe32);              //获取第一个进程信息

  3007. while (bProcess)                                         //循环获取其余进程信息

  3009. {

  3011. printf("%d :\t Father's PID(%d)\tPID(%d)\t%s\n", i, pe32.th32ParentProcessID, pe32.th32ProcessID, pe32.szExeFile);

  3013. i++;

  3015. j = 0;

  3017. if (0 != pe32.th32ParentProcessID)                   //获取进程PID不为0的模块信息

  3019. {

  3021. hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pe32.th32ProcessID);   //获取模块快照

  3023. if (hModule != INVALID_HANDLE_VALUE)

  3025. {

  3027. bModule = Module32First(hModule, &me32);      //获取第一个模块信息,即进程相应可执行文件的信息

  3029. while (bModule)

  3031. {

  3033. printf("模块:\n%d\t%s\n", j, me32.szExePath);

  3035. j++;

  3037. bModule = Module32Next(hModule, &me32);   //获取其他模块信息

  3039. }

  3041. CloseHandle(hModule);

  3043. }

  3045. }



  3049. bProcess = Process32Next(hProcess, &pe32);           //继续获取其他进程信息

  3051. printf("\n\n");

  3053. getchar();

  3055. }



  3059. CloseHandle(hProcess);

  3061. return 0;

  3063. }



  3067. PVOID GetRemoteProcAddress32(HANDLE hProc, HMODULE hModule, LPCSTR lpProcName)//这个函数只支持32位的

  3069. {

  3071. PVOID pAddress = NULL;

  3073. SIZE_T OptSize;

  3075. IMAGE_DOS_HEADER DosHeader;

  3077. SIZE_T ProcNameLength = lstrlenA(lpProcName) + sizeof(CHAR);//'\0'  



  3081. //读DOS头  

  3083. if (ReadProcessMemory(hProc, hModule, &DosHeader, sizeof(DosHeader), &OptSize))

  3085. {

  3087. IMAGE_NT_HEADERS NtHeader;



  3091. //读NT头  

  3093. if (ReadProcessMemory(hProc, (PVOID)((SIZE_T)hModule + DosHeader.e_lfanew), &NtHeader, sizeof(NtHeader), &OptSize))

  3095. {

  3097. IMAGE_EXPORT_DIRECTORY ExpDir;

  3099. SIZE_T ExportVirtualAddress = NtHeader.OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;



  3103. //读输出表  

  3105. if (ExportVirtualAddress && ReadProcessMemory(hProc, (PVOID)((SIZE_T)hModule + ExportVirtualAddress), &ExpDir, sizeof(ExpDir), &OptSize))

  3107. {



  3111. if (ExpDir.NumberOfFunctions)

  3113. {



  3117. //x64待定:地址数组存放RVA的数据类型是4字节还是8字节???  

  3119. SIZE_T *pProcAddressTable = (SIZE_T *)GlobalAlloc(GPTR, ExpDir.NumberOfFunctions * sizeof(SIZE_T));



  3123. //读函数地址表  

  3125. if (ReadProcessMemory(hProc, (PVOID)((SIZE_T)hModule + ExpDir.AddressOfFunctions), pProcAddressTable, ExpDir.NumberOfFunctions * sizeof(PVOID), &OptSize))

  3127. {

  3129. //x64待定:名称数组存放RVA的数据类型是4字节还是8字节???  

  3131. SIZE_T *pProcNamesTable = (SIZE_T *)GlobalAlloc(GPTR, ExpDir.NumberOfNames * sizeof(SIZE_T));



  3135. //读函数名称表  

  3137. if (ReadProcessMemory(hProc, (PVOID)((SIZE_T)hModule + ExpDir.AddressOfNames), pProcNamesTable, ExpDir.NumberOfNames * sizeof(PVOID), &OptSize))

  3139. {

  3141. CHAR *pProcName = (CHAR *)GlobalAlloc(GPTR, ProcNameLength);



  3145. //遍历函数名称  

  3147. for (DWORD i = 0; i < ExpDir.NumberOfNames; i++)

  3149. {



  3153. if (ReadProcessMemory(hProc, (PVOID)((SIZE_T)hModule + pProcNamesTable[i]), pProcName, ProcNameLength, &OptSize))

  3155. {

  3157. if (RtlEqualMemory(lpProcName, pProcName, ProcNameLength))

  3159. {

  3161. //x64待定:函数在地址数组索引的数据类型是2字节还是???  

  3163. WORD NameOrdinal;



  3167. //获取函数在地址表的索引  

  3169. if (ReadProcessMemory(hProc, (PVOID)((SIZE_T)hModule + ExpDir.AddressOfNameOrdinals + sizeof(NameOrdinal) * i), &NameOrdinal, sizeof(NameOrdinal), &OptSize))

  3171. {

  3173. pAddress = (PVOID)((SIZE_T)hModule + pProcAddressTable[NameOrdinal]);

  3175. }

  3177. break;//for  

  3179. }

  3181. }

  3183. }

  3185. GlobalFree(pProcName);

  3187. }

  3189. GlobalFree(pProcNamesTable);

  3191. }

  3193. GlobalFree(pProcAddressTable);

  3195. }

  3197. }

  3199. }

  3201. }

  3203. return pAddress;

  3205. }









  3215. //=========================内存搜索支持x86x64位游戏===================================

  3217. //查找内存地址

  3219. INT64 X64ScanAddr(DWORD ProcessID, char *markCode, const wchar_t * ModuleName, DWORD offset)

  3221. {

  3223. DWORD size = 8; //==== 返回大小

  3225. DWORD ordinal = 1;//====返回次数

  3227. UINT64 beginAddr = GetX86X64Module(ProcessID, ModuleName);

  3229. UINT64 endAddr = beginAddr + GetX86X64ModuleSize(ProcessID, ModuleName);

  3231. return X64ScanOpcode(ProcessID, markCode, offset, size, ordinal, beginAddr, endAddr);

  3233. }



  3237. INT64 X64ScanBase(DWORD ProcessID, const char *markCode, const wchar_t * ModuleName, DWORD offset, DWORD size)//==== 返回大小)

  3239. {

  3241. DWORD ordinal = 1;//====返回次数

  3243. INT64 BufferData = NULL; //

  3245. //ULONG64 Len = size;

  3247. UINT64 beginAddr = GetX86X64Module(ProcessID, ModuleName);

  3249. UINT64 endAddr = beginAddr + GetX86X64ModuleSize(ProcessID, ModuleName);

  3251. INT64 Addr_Ret = X64ScanOpcode(ProcessID, markCode, offset, size, ordinal, beginAddr, endAddr);

  3253. HANDLE Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  3255. __NtWow64ReadVirtualMemory64(Hprocess, Addr_Ret, &BufferData, size, 0);//注意返回值大小问题，size就是字节大小

  3257. CloseHandle(Hprocess);

  3259. return BufferData;

  3261. }



  3265. INT64 X64ScanCall(DWORD ProcessID, const char *markCode, const wchar_t * ModuleName, DWORD offset)//==== 返回大小)

  3267. {

  3269. DWORD ordinal = 1;//====返回次数

  3271. DWORD size = 4;//x64的call只能是4字节的，不能8字节，否走要mov rax 0x1121212121   jmp rax

  3273. INT64 BufferData = NULL;

  3275. ULONG64 Len = size;

  3277. UINT64 beginAddr = GetX86X64Module(ProcessID, ModuleName);

  3279. UINT64 endAddr = beginAddr + GetX86X64ModuleSize(ProcessID, ModuleName);

  3281. INT64 Addr_Ret = X64ScanOpcode(ProcessID, markCode, offset, size, ordinal, beginAddr, endAddr);

  3283. HANDLE Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  3285. __NtWow64ReadVirtualMemory64(Hprocess, Addr_Ret, &BufferData, size, &Len);//注意返回值大小问题，size就是字节大小

  3287. CloseHandle(Hprocess);

  3289. return Addr_Ret - 1 + 5 + BufferData;;

  3291. }



  3295. /************************************************************************/

  3297. /* 函数说明：查找特征码

  3299. /* process: 要查找的进程

  3301. /* markCode: 特征码字符串,不能有空格

  3303. /* distinct：特征码首地址离目标地址的距离 负数在特征码在上

  3305. /* offset: 返回目标地址

  3307. /* size: 设置返回数据为几个BYTE 1 2 3 4

  3309. /* ordinal: 特征码出现的次数

  3311. /* beginAddr: 开始搜索地址

  3313. /* endAddr: 结束地址

  3315. /* ret:返回目标地址的内容

  3317. /************************************************************************/

  3319. INT64 X64ScanOpcode(DWORD ProcessID, const char *markCode,   ///核心算法

  3321. DWORD offset,

  3323. DWORD size,   // size: 设置返回数据为几个BYTE 1 2 3 4

  3325. DWORD ordinal, //ordinal: 特征码出现的次数

  3327. UINT64 beginAddr, UINT64 endAddr)

  3329. {

  3331. HANDLE Hprocess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, ProcessID);//打开进程

  3333. GetNTWOW64MemoryProcAddress(); //加进去的

  3335. //每次读取游戏内存数目的大小

  3337. const DWORD pageSize = 4096;

  3339. ////////////////////////处理特征码/////////////////////

  3341. //特征码长度不能为单数

  3343. if (strlen(markCode) % 2 != 0) return 0;

  3345. //特征码长度

  3347. size_t len = strlen(markCode) / 2;

  3349. //将特征码转换成byte型

  3351. BYTE *m_code = new BYTE[len];

  3353. for (int i = 0; i < len; i++) {

  3355. char c[] = { markCode[i * 2], markCode[i * 2 + 1], '\0' };

  3357. m_code[i] = (BYTE)::strtol(c, NULL, 16);

  3359. }

  3361. /////////////////////////查找特征码/////////////////////

  3363. BOOL _break = FALSE;

  3365. //用来保存在第几页中的第几个找到的特征码

  3367. int curPage = 0;

  3369. int curIndex = 0;

  3371. //每页读取4096个字节

  3373. BYTE *page = new BYTE[pageSize + len - 1];

  3375. UINT64 tmpAddr = beginAddr;

  3377. DWORD ord = 0;

  3379. ULONG64   BufferLen = 4096;

  3381. while (tmpAddr <= endAddr - len) {

  3383. //printf("Status打印输出：   %llx\n", tmpAddr);

  3385. NTSTATUS Status = __NtWow64ReadVirtualMemory64(Hprocess, tmpAddr, page, pageSize + len - 1, &BufferLen);

  3387. //在该页中查找特征码

  3389. for (int i = 0; i < pageSize; i++) {

  3391. for (int j = 0; j < len; j++) {

  3393. //只要有一个与特征码对应不上则退出循环

  3395. if (m_code[j] != page[i + j])break;

  3397. //找到退出所有循环

  3399. if (j == len - 1) {

  3401. ord++;

  3403. if (ord != ordinal)

  3405. break;

  3407. _break = TRUE;

  3409. curIndex = i; // 特征码的首地址偏移

  3411. break;

  3413. }

  3415. }

  3417. if (_break) break;

  3419. }

  3421. if (_break) break;

  3423. curPage++;

  3425. tmpAddr += pageSize;

  3427. }

  3429. // 一个也没找到



  3433. //__NtWow64ReadVirtualMemory64(ProcessHandle, BaseAddress, &BufferData, BufferLen, &ReturnLen);

  3435. delete m_code;

  3437. delete page;

  3439. CloseHandle(Hprocess);

  3441. //printf("base   :%llx\n", offsetaddr);

  3443. return offsetaddr;

  3445. }





  3451. UINT64   GetX86X64Module(DWORD ProcessID, const wchar_t* DllName)

  3453. {

  3455. DWORD dwPid = ProcessID;

  3457. HANDLE m_ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);

  3459. BOOL bTarget = FALSE;

  3461. BOOL bSource = FALSE;



  3465. IsWow64Process(GetCurrentProcess(), &bSource);

  3467. IsWow64Process(m_ProcessHandle, &bTarget);



  3471. SYSTEM_INFO si;

  3473. GetSystemInfo(&si);



  3477. if (bTarget == FALSE && bSource == TRUE)

  3479. {

  3481. HMODULE NtdllModule = GetModuleHandle("ntdll.dll");

  3483. pfnNtWow64QueryInformationProcess64 NtWow64QueryInformationProcess64 = (pfnNtWow64QueryInformationProcess64)GetProcAddress(NtdllModule, "NtWow64QueryInformationProcess64");

  3485. pfnNtWow64ReadVirtualMemory64 NtWow64ReadVirtualMemory64 = (pfnNtWow64ReadVirtualMemory64)GetProcAddress(NtdllModule, "NtWow64ReadVirtualMemory64");

  3487. PROCESS_BASIC_INFORMATION64 pbi64 = { 0 };

  3489. if (NT_SUCCESS(NtWow64QueryInformationProcess64(m_ProcessHandle, ProcessBasicInformation, &pbi64, sizeof(pbi64), NULL)))

  3491. {

  3493. DWORD64 Ldr64 = 0;

  3495. LIST_ENTRY64 ListEntry64 = { 0 };

  3497. LDR_DATA_TABLE_ENTRY64 LDTE64 = { 0 };

  3499. wchar_t ProPath64[256];

  3501. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)(pbi64.PebBaseAddress + offsetof(PEB64, Ldr)), &Ldr64, sizeof(Ldr64), NULL)))

  3503. {

  3505. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)(Ldr64 + offsetof(PEB_LDR_DATA64, InLoadOrderModuleList)), &ListEntry64, sizeof(LIST_ENTRY64), NULL)))

  3507. {

  3509. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)(ListEntry64.Flink), &LDTE64, sizeof(_LDR_DATA_TABLE_ENTRY64), NULL)))

  3511. {

  3513. while (1)

  3515. {

  3517. if (LDTE64.InLoadOrderLinks.Flink == ListEntry64.Flink) break;

  3519. /*if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)LDTE64.FullDllName.Buffer, ProPath64, sizeof(ProPath64), NULL)))*/

  3521. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)LDTE64.BaseDllName.Buffer, ProPath64, sizeof(ProPath64), NULL)))//修改

  3523. {



  3527. //printf("模块基址:0x%llX   模块大小:0x%X    模块路径:%ls\n", LDTE64.DllBase, LDTE64.SizeOfImage, ProPath64);

  3529. //printf("BaseDllName :%ls\n", ProPath64);

  3531. if (wcscmp(ProPath64, DllName) == 0)

  3533. {

  3535. //printf("BaseDllName :%ls\n", ProPath64);

  3537. return   (UINT64)LDTE64.DllBase;

  3539. }



  3543. }

  3545. if (!NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)LDTE64.InLoadOrderLinks.Flink, &LDTE64, sizeof(_LDR_DATA_TABLE_ENTRY64), NULL))) break;

  3547. }

  3549. }

  3551. }

  3553. }

  3555. }



  3559. }

  3561. else if (bTarget == TRUE && bSource == TRUE || si.wProcessorArchitecture != PROCESSOR_ARCHITECTURE_AMD64 ||

  3563. si.wProcessorArchitecture != PROCESSOR_ARCHITECTURE_IA64)

  3565. {

  3567. HMODULE NtdllModule = GetModuleHandle("ntdll.dll");

  3569. pfnNtQueryInformationProcess NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(NtdllModule, "NtQueryInformationProcess");

  3571. PROCESS_BASIC_INFORMATION32 pbi32 = { 0 };

  3573. if (NT_SUCCESS(NtQueryInformationProcess(m_ProcessHandle, ProcessBasicInformation, &pbi32, sizeof(pbi32), NULL)))

  3575. {

  3577. DWORD Ldr32 = 0;

  3579. LIST_ENTRY32 ListEntry32 = { 0 };

  3581. LDR_DATA_TABLE_ENTRY32 LDTE32 = { 0 };

  3583. wchar_t ProPath32[256];

  3585. if (ReadProcessMemory(m_ProcessHandle, (PVOID)(pbi32.PebBaseAddress + offsetof(PEB32, Ldr)), &Ldr32, sizeof(Ldr32), NULL))

  3587. {

  3589. if (ReadProcessMemory(m_ProcessHandle, (PVOID)(Ldr32 + offsetof(PEB_LDR_DATA32, InLoadOrderModuleList)), &ListEntry32, sizeof(LIST_ENTRY32), NULL))

  3591. {

  3593. if (ReadProcessMemory(m_ProcessHandle, (PVOID)(ListEntry32.Flink), &LDTE32, sizeof(_LDR_DATA_TABLE_ENTRY32), NULL))

  3595. {

  3597. while (1)

  3599. {

  3601. if (LDTE32.InLoadOrderLinks.Flink == ListEntry32.Flink) break;

  3603. if (ReadProcessMemory(m_ProcessHandle, (PVOID)LDTE32.BaseDllName.Buffer, ProPath32, sizeof(ProPath32), NULL))//修改PVOID)LDTE32.BaseDllName.Buffer

  3605. {

  3607. //printf("模块基址:0x%X\n模块大小:0x%X\n模块路径:%ls\n", LDTE32.DllBase, LDTE32.SizeOfImage, ProPath32);

  3609. //printf("模块基址:0x%X   模块大小:0x%X   模块路径:%ls\n", LDTE32.DllBase, LDTE32.SizeOfImage, ProPath32);

  3611. //printf("%d\n",   LDTE32.BaseDllName);



  3615. if (wcscmp(ProPath32, DllName) == 0)

  3617. {

  3619. //printf("BaseDllName :%ls\n", ProPath32);

  3621. return   (UINT64)LDTE32.DllBase;   //============32位这里最好改成DWORD

  3623. }





  3629. }

  3631. if (!ReadProcessMemory(m_ProcessHandle, (PVOID)LDTE32.InLoadOrderLinks.Flink, &LDTE32, sizeof(_LDR_DATA_TABLE_ENTRY32), NULL)) break;

  3633. }

  3635. }

  3637. }

  3639. }

  3641. }

  3643. }

  3645. return   FALSE;

  3647. CloseHandle(m_ProcessHandle);

  3649. }





  3655. UINT64   GetX86X64ModuleSize(DWORD ProcessID, const wchar_t* DllName)

  3657. {

  3659. DWORD dwPid = ProcessID;

  3661. HANDLE m_ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPid);

  3663. BOOL bTarget = FALSE;

  3665. BOOL bSource = FALSE;



  3669. IsWow64Process(GetCurrentProcess(), &bSource);

  3671. IsWow64Process(m_ProcessHandle, &bTarget);



  3675. SYSTEM_INFO si;

  3677. GetSystemInfo(&si);



  3681. if (bTarget == FALSE && bSource == TRUE)

  3683. {

  3685. HMODULE NtdllModule = GetModuleHandle("ntdll.dll");

  3687. pfnNtWow64QueryInformationProcess64 NtWow64QueryInformationProcess64 = (pfnNtWow64QueryInformationProcess64)GetProcAddress(NtdllModule, "NtWow64QueryInformationProcess64");

  3689. pfnNtWow64ReadVirtualMemory64 NtWow64ReadVirtualMemory64 = (pfnNtWow64ReadVirtualMemory64)GetProcAddress(NtdllModule, "NtWow64ReadVirtualMemory64");

  3691. PROCESS_BASIC_INFORMATION64 pbi64 = { 0 };

  3693. if (NT_SUCCESS(NtWow64QueryInformationProcess64(m_ProcessHandle, ProcessBasicInformation, &pbi64, sizeof(pbi64), NULL)))

  3695. {

  3697. DWORD64 Ldr64 = 0;

  3699. LIST_ENTRY64 ListEntry64 = { 0 };

  3701. LDR_DATA_TABLE_ENTRY64 LDTE64 = { 0 };

  3703. wchar_t ProPath64[256];

  3705. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)(pbi64.PebBaseAddress + offsetof(PEB64, Ldr)), &Ldr64, sizeof(Ldr64), NULL)))

  3707. {

  3709. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)(Ldr64 + offsetof(PEB_LDR_DATA64, InLoadOrderModuleList)), &ListEntry64, sizeof(LIST_ENTRY64), NULL)))

  3711. {

  3713. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)(ListEntry64.Flink), &LDTE64, sizeof(_LDR_DATA_TABLE_ENTRY64), NULL)))

  3715. {

  3717. while (1)

  3719. {

  3721. if (LDTE64.InLoadOrderLinks.Flink == ListEntry64.Flink) break;

  3723. /*if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)LDTE64.FullDllName.Buffer, ProPath64, sizeof(ProPath64), NULL)))*/

  3725. if (NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)LDTE64.BaseDllName.Buffer, ProPath64, sizeof(ProPath64), NULL)))//修改

  3727. {



  3731. //printf("模块基址:0x%llX   模块大小:0x%X    模块路径:%ls\n", LDTE64.DllBase, LDTE64.SizeOfImage, ProPath64);

  3733. //printf("BaseDllName :%ls\n", ProPath64);

  3735. if (wcscmp(ProPath64, DllName) == 0)

  3737. {

  3739. //printf("BaseDllName :%ls\n", ProPath64);

  3741. return   (UINT64)LDTE64.SizeOfImage;

  3743. }



  3747. }

  3749. if (!NT_SUCCESS(NtWow64ReadVirtualMemory64(m_ProcessHandle, (PVOID64)LDTE64.InLoadOrderLinks.Flink, &LDTE64, sizeof(_LDR_DATA_TABLE_ENTRY64), NULL))) break;

  3751. }

  3753. }

  3755. }

  3757. }

  3759. }



  3763. }

  3765. else if (bTarget == TRUE && bSource == TRUE || si.wProcessorArchitecture != PROCESSOR_ARCHITECTURE_AMD64 ||

  3767. si.wProcessorArchitecture != PROCESSOR_ARCHITECTURE_IA64)

  3769. {

  3771. HMODULE NtdllModule = GetModuleHandle("ntdll.dll");

  3773. pfnNtQueryInformationProcess NtQueryInformationProcess = (pfnNtQueryInformationProcess)GetProcAddress(NtdllModule, "NtQueryInformationProcess");

  3775. PROCESS_BASIC_INFORMATION32 pbi32 = { 0 };

  3777. if (NT_SUCCESS(NtQueryInformationProcess(m_ProcessHandle, ProcessBasicInformation, &pbi32, sizeof(pbi32), NULL)))

  3779. {

  3781. DWORD Ldr32 = 0;

  3783. LIST_ENTRY32 ListEntry32 = { 0 };

  3785. LDR_DATA_TABLE_ENTRY32 LDTE32 = { 0 };

  3787. wchar_t ProPath32[256];

  3789. if (ReadProcessMemory(m_ProcessHandle, (PVOID)(pbi32.PebBaseAddress + offsetof(PEB32, Ldr)), &Ldr32, sizeof(Ldr32), NULL))

  3791. {

  3793. if (ReadProcessMemory(m_ProcessHandle, (PVOID)(Ldr32 + offsetof(PEB_LDR_DATA32, InLoadOrderModuleList)), &ListEntry32, sizeof(LIST_ENTRY32), NULL))

  3795. {

  3797. if (ReadProcessMemory(m_ProcessHandle, (PVOID)(ListEntry32.Flink), &LDTE32, sizeof(_LDR_DATA_TABLE_ENTRY32), NULL))

  3799. {

  3801. while (1)

  3803. {

  3805. if (LDTE32.InLoadOrderLinks.Flink == ListEntry32.Flink) break;

  3807. if (ReadProcessMemory(m_ProcessHandle, (PVOID)LDTE32.BaseDllName.Buffer, ProPath32, sizeof(ProPath32), NULL))//修改PVOID)LDTE32.BaseDllName.Buffer

  3809. {

  3811. //printf("模块基址:0x%X\n模块大小:0x%X\n模块路径:%ls\n", LDTE32.DllBase, LDTE32.SizeOfImage, ProPath32);

  3813. //printf("模块基址:0x%X   模块大小:0x%X   模块路径:%ls\n", LDTE32.DllBase, LDTE32.SizeOfImage, ProPath32);

  3815. //printf("%d\n",   LDTE32.BaseDllName);



  3819. if (wcscmp(ProPath32, DllName) == 0)

  3821. {

  3823. //printf("BaseDllName :%ls\n", ProPath32);

  3825. return   (UINT64)LDTE32.SizeOfImage;   //============32位这里最好改成DWORD

  3827. }





  3833. }

  3835. if (!ReadProcessMemory(m_ProcessHandle, (PVOID)LDTE32.InLoadOrderLinks.Flink, &LDTE32, sizeof(_LDR_DATA_TABLE_ENTRY32), NULL)) break;

  3837. }

  3839. }

  3841. }

  3843. }

  3845. }

  3847. }

  3849. return   FALSE;

  3851. CloseHandle(m_ProcessHandle);

  3853. }

复制代码
回复

举报

moon58654

1

主题

5

回帖

7

积分

编程入门

Rank: 1

龙马币
12
moon58654 | 显示全部楼层
代码真长呀，慢慢看。
回复

举报

yongli

0

主题

5

回帖

6

积分

编程入门

Rank: 1

龙马币
10
yongli | 显示全部楼层
会不会被检测到
回复

举报

返回列表 发新帖
高级模式
B Color Image Link Quote Code Smilies
您需要登录后才可以回帖 登录 | 立即注册

本版积分规则

龙马谷| C/C++辅助教程| 安卓逆向安全| 论坛导航| 免责申明|Archiver|
拒绝任何人以任何形式在本论坛发表与中华人民共和国法律相抵触的言论，本站内容均为会员发表，并不代表龙马谷立场!
任何人不得以任何方式翻录、盗版或出售本站视频，一经发现我们将追究其相关责任!
我们一直在努力成为最好的编程论坛!
Copyright© 2018-2021 All Right Reserved.
关闭

会员办理

售后客服

技术支持

工作时间：9:00-22:00

在线客服
快速回复 返回顶部 返回列表