|
|
本帖最后由 小白学编程 于 2021-3-14 22:04 编辑
本人小白，刚学会简单的编程，望大神指点下
帝国时代2：高清版
https://dl.3dmgame.com/pc/30310.html
代码：
//帝国时代2高清版
HWND jubing = FindWindow(NULL, L"Age of Empires II: HD Edition");
DWORD pid;
GetWindowThreadProcessId(jubing, &pid);
HANDLE hpro = 0;
hpro = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
int nSize = 0;
DWORD resourcesPtr1 = 0;
ReadProcessMemory(hpro, (void*)0x929254, &resourcesPtr1, sizeof(resourcesPtr1), NULL);
//cout << "读取一级指针偏移" << (void*)resourcesPtr1 << endl;
resourcesPtr1 = resourcesPtr1 + 0x10C;
DWORD resourcesPtr2 = 0;
ReadProcessMemory(hpro, (void*)resourcesPtr1, &resourcesPtr2, sizeof(resourcesPtr1), NULL);
//cout << "读取二级指针偏移" << (void*)resourcesPtr2 << endl;
resourcesPtr2 = resourcesPtr2 + 0x0A8;
DWORD resourcesPtr3 = 0;
ReadProcessMemory(hpro, (void*)resourcesPtr2, &resourcesPtr3, sizeof(resourcesPtr3), NULL);
//cout << "读取三级指针偏移" << (void*)resourcesPtr3 << endl;
resourcesPtr3 = resourcesPtr3 + 0x4;
/*DWORD resourcesPtr4 = 0;
ReadProcessMemory(hpro, (void*)resourcesPtr3, &resourcesPtr4, sizeof(resourcesPtr4), NULL);*/
cout << "读取4级指针偏移" << (void*)resourcesPtr3 << endl; //
/*resourcesPtr4 = resourcesPtr4 + 4;
unsigned long foodPtr = 0;
ReadProcessMemory(hpro, (void*)resourcesPtr4, &foodPtr, sizeof(foodPtr), NULL);
cout << "读取食物" << (float*)&foodPtr << endl;*/
/*resourcesPtr4 = resourcesPtr4 + 0;
unsigned long woodPtr = 0;
ReadProcessMemory(hpro, (void*)resourcesPtr4, &woodPtr, sizeof(woodPtr), NULL);
cout << "读取木材" << *(float*)&woodPtr << endl;*/
system("pause");
return 0;
运行后，黑窗口显示的是十进制，哪里需要修改可以显示单浮点数，望大神解答小菜的迷惑，不胜感激
没游戏只能你自己测试下了.
- #include<Windows.h>
- #include <stdio.h>
- //提权
- bool EnableDebugPrivilege()
- {
- HANDLE hToken;
- LUID sedebugnameValue;
- TOKEN_PRIVILEGES tkp;
- if (!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
- {
- return FALSE;
- }
- if (!LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &sedebugnameValue))
- {
- CloseHandle(hToken);
- return false;
- }
- tkp.PrivilegeCount = 1;
- tkp.Privileges[0].Luid = sedebugnameValue;
- tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
- if (!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))
- {
- CloseHandle(hToken);
- return false;
- }
- return true;
- }
- int main(void)
- {
- //如需要,本进程提权invoke
- //EnableDebugPrivilege()
- //获取窗口句柄
- HWND jubing = FindWindow(NULL, TEXT("Age of Empires II: HD Edition"));
- //获取进程PID
- DWORD pid;
- GetWindowThreadProcessId(jubing, &pid);
- //通过PID获取进程句柄
- HANDLE hpro = 0;
- hpro = OpenProcess(PROCESS_ALL_ACCESS, false, pid);
- //开始读内存 [[[0x00929254]+0x10C]+0xA8]+0x4
- DWORD dwAddress = 0x00929254;
- DWORD dwReadedContent = 0;
- //[0x00929254] 读出来的指针地址在dwReadedContent
- ReadProcessMemory(hpro, (void*)dwAddress, &dwReadedContent, 4, NULL);
- //[[0x00929254]+0x10C] 读出来的指针地址在dwReadedContent
- dwAddress = dwReadedContent + 0x10C;
- ReadProcessMemory(hpro, (void*)dwAddress, &dwReadedContent, 4, NULL);
- //[[[0x00929254] + 0x10C] + 0xA8] 读出来的指针地址在dwReadedContent
- dwAddress = dwReadedContent + 0xA8;
- ReadProcessMemory(hpro, (void*)dwAddress, &dwReadedContent, 4, NULL);
- //拿到最后一个浮点数所在的地址
- dwAddress = dwReadedContent + 0x4;
- //定义一个浮点数接收它,你CE扫描选用的是4字节单精度,这里就定义float
- float result;
- ReadProcessMemory(hpro, (void*)dwAddress, &result, 4, NULL);
- printf("%f", result);
- return 0;
- }
|
-
-
上一篇： 关于shellcode调用崩溃的问题下一篇： 怎样能让开机，就自动重启服务进程？
|
/2 
发表于 2021-3-14 02:07:16
楼主
发表于 2021-3-14 02:50:24
发表于 2021-3-14 11:06:29
