ACCESSC语言游戏外挂:简单DLL注入游戏

经过C语言编写一个DLL文件和一个EXE文件,其中DLL包含作弊功能,运行EXE后拿DLL注入游戏,使得游戏就因自己进程就得以兑现作弊功能。

目标分析

如果就此底API函数简单介绍

编制测试效果

圆评价

目标分析

注:本次打对象也Super Mario XP

靡更新所以可用任意版本 ,

试玩发现人血量最可怜也10,心太老吗99,命绝深呢99。

比方为此之API函数简单介绍

HANDLE CreateThread(LPSECURITYATTRIBUTES, SIZET, LPTHREADSTARTROUTINE,
LPVOID, DWORD ,LPDWORD

CreateThread 将在主线程的根底及开创一个新线程

LPVOID VirtualAllocEx(HANDLE, LPVOID, SIZE_T, DWORD, DWORD);

VirtualAllocEx
向指定进程申请内存,其中flAllocationType取值MEM_COMMIT表示写副物理存储而未磁盘交换内存

FARPROC GetProcAddress(HMODULE hModule, LPCSTR);

GetProcAddress 检索指定的动态链接库(DLL)中之出口库函数地址

HANDLE CreateRemoteThread(HANDLE, LPSECURITYATTRIBUTES, SIZET,
LPTHREADSTARTROUTINE, LPVOID, DWORD, LPDWORD);

CreateRemoteThread 创建一个以另外进程地址空间受到运作的线程

编辑测试效果

打开游戏

运转外挂

打开注入器Injecter,注入器注入DLL后自动退,仅剩下游戏,此时游乐已经有所作弊效果(锁定血量)

检测中

//

// 04简单DLL注入游戏(作弊模块DLL部分)

// C/C++

//

#include

#defineDllfuncitonextern”C” __declspec(dllexport)//以C方式导出

Dllfuncitonvoid lockdata();

Dllfunciton DWORD WINAPI inject(LPVOID);

void lockdata(){

while(true){

DWORD hp =10;

DWORD heart =99;

DWORD life =99;

DWORD addr3 =0x004282a2;

DWORD res
=WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)addr,&hp,4,0);//写副自己改游戏数量

DWORD res2
=WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)addr2,&heart,4,0);

DWORD res3
=WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)addr3,&life,4,0);

Sleep(1000);

}

}

DWORD WINAPI inject(LPVOID){

lockdata();

returntrue;

}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call,
LPVOID lpReserved){

switch(ul_reason_for_call){

case DLL_PROCESS_ATTACH:{

::DisableThreadLibraryCalls(hModule);//创建线程包含死循环,为防卡死得设置

CreateThread(NULL,0, inject, NULL,0, NULL);

}

break;

case DLL_THREAD_ATTACH:

case DLL_THREAD_DETACH:

case DLL_PROCESS_DETACH:

break;

default:;

}

returntrue;

}

//

// 04简单DLL注入游戏(注入器EXE部分)

// C/C++

//

#include

#include

#include

#include

usingnamespace std;

HWND hwnd = NULL;

DWORD processid = NULL;

HANDLE hprocess = NULL;

PVOID procdlladdr = NULL;

char dllname[25]=”cheatDLL”;

char loadfunc[25]=”LoadLibraryA”;

FARPROC loadfuncaddr = NULL;

HANDLE hfile;

void getwindow(){

hwnd =::FindWindow(NULL,”Super Mario XP”);

if(hwnd == NULL)

MessageBox(NULL,”找不交戏”,”错误”, MB_OK);

GetWindowThreadProcessId(hwnd,&processid);

hprocess =OpenProcess(PROCESS_ALL_ACCESS,FALSE,processid);

if(hprocess == NULL)

MessageBox(NULL,”打开游戏失败”,”错误”, MB_OK);

}

void inject(){

int size = strlen(dllname)+5;

procdlladdr =::VirtualAllocEx(hprocess, NULL, size, MEM_COMMIT,
PAGE_READWRITE);//向目标申请空间,得到新空间地址

if(procdlladdr == NULL)

MessageBox(NULL,”申请空间失败”,”错误”, MB_OK);

DWORD writenum;

::WriteProcessMemory(hprocess, procdlladdr, dllname,
size,&writenum);//向新空间描绘副如果注入的DLL名称

loadfuncaddr =::GetProcAddress(::GetModuleHandle(“kernel32.dll”),
loadfunc);//获得LoadLibraryA的地点,在旁进程空间都无异

HANDLE hthread =::CreateRemoteThread(hprocess,
NULL,0,(LPTHREAD_START_ROUTINE)loadfuncaddr,(LPVOID)procdlladdr,0,
NULL);

//新建线程执行LoadLibrary参数是早已当目标经过新空间描绘副的DLL名称,注意这函数在64各项生无法成功

::WaitForSingleObject(hthread, INFINITE);

::CloseHandle(hthread);

::CloseHandle(hprocess);

}

int main(){

getwindow();

inject();

return0;

}

DLL注入可要是作弊模块于先后自身“名义”下开展舞弊,提高作弊成功率,然而载入的DLL容易为DLL检测发现。

相关文章