游戏内存修改器原理

BOOL

WINAPI

ReadProcessMemory(
                 
                  HANDLE hProcess,    //待读进程的句柄
                 
                  LPCVOID lpBaseAddress,    //目标进程中待读内存的起始地址
                 
                  LPVOID lpBuffer,    //用来读取数据的缓冲区
                 
                  DWORD nSize,    //要读取的字节数
                   
                  LPDWORD lpNumberOfBytesRead    //用来供函数返回实际读取的字节数
                 
    );
//参数同上
BOOL

WINAPI

WriteProcessMemory(
                  
                   HANDLE hProcess,
                  
                   LPVOID lpBaseAddress,
                  
                   LPVOID lpBuffer,
                  
                   DWORD nSize,
                  
                   LPDWORD lpNumberOfBytesWritten
                  
                   );

 

下面是利用上面的两个API写的内存修改器

#include "stdafx.h" #include <windows.h> #include <tchar.h> DWORD g_arList[1024]; int g_nListCnt; HANDLE g_hProcess; BOOL WriteMemory(DWORD dwAddr, DWORD dwValue); void ShowList(void); BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue); BOOL FindNext(DWORD dwValue); BOOL FindFirst(DWORD dwValue); BOOL FindFirst(DWORD dwValue) { const DWORD dwOneGB = 1024 * 1024 * 1024; const DWORD dwOnePage = 4 * 1024; if (NULL == g_hProcess) { return FALSE; } DWORD dwBase; OSVERSIONINFO vi = {sizeof(vi)}; ::GetVersionEx(&vi); if (VER_PLATFORM_WIN32_WINDOWS == vi.dwPlatformId) { dwBase = 4 * 1024 * 1024; } else { dwBase = 640 * 1024; } for (; dwBase < 2 * dwOneGB; dwBase += dwOnePage) { CompareAPage(dwBase, dwValue); } return TRUE; } BOOL CompareAPage(DWORD dwBaseAddr, DWORD dwValue) { BYTE arBytes[4096]; if (!::ReadProcessMemory(g_hProcess, (LPVOID)dwBaseAddr, arBytes, 4096, NULL)) { return FALSE; } DWORD* pdw = NULL; int i = 0; for (i = 0;i < (int)4 * 1024 -3; i++) { pdw = (DWORD*)&arBytes[i]; if (pdw[0] == dwValue) { if (g_nListCnt >= 1024) { return FALSE; } g_arList[g_nListCnt++] = dwBaseAddr + i; } } return TRUE; } void ShowList(void) { int i; for (i = 0; i < g_nListCnt; i++) { printf("%08lX/n", g_arList[i]); } } BOOL FindNext(DWORD dwValue) { int nOrgCnt = g_nListCnt; g_nListCnt = 0; BOOL bRet = FALSE; DWORD dwReadValue; int i; for (i = 0; i < nOrgCnt; i++) { if (::ReadProcessMemory(g_hProcess, (LPVOID)g_arList[i], &dwReadValue, sizeof(DWORD), NULL)) { if (dwReadValue == dwValue) { g_arList[g_nListCnt++] = g_arList[i]; bRet = TRUE; } } } return bRet; } BOOL WriteMemory(DWORD dwAddr, DWORD dwValue) { return ::WriteProcessMemory(g_hProcess, (LPVOID)dwAddr, &dwValue, sizeof(DWORD), NULL); } int main(int argc, char* argv[]) { TCHAR szFileName[] = _T("../Debug/Testor0.exe"); STARTUPINFO si = {sizeof(si)}; PROCESS_INFORMATION pi; ::CreateProcess(NULL, szFileName, NULL, NULL, FALSE, CREATE_NEW_CONSOLE, NULL, NULL, &si, π); ::CloseHandle(pi.hThread); g_hProcess = pi.hProcess; int iVal; printf("Input val = "); scanf("%d", &iVal); FindFirst(iVal); ShowList(); if (g_nListCnt > 1) { printf("Input val = "); scanf("%d", &iVal); FindNext(iVal); ShowList(); } printf("New value = "); scanf("%d", &iVal); if (WriteMemory(g_arList[0], iVal)) { printf("Write data success./n"); } ::CloseHandle(g_hProcess); return 0; }