C语言C语言游戏外挂:简单DLL注入游戏

C语言 1

经C语言编写一个DLL文件及一个EXE文件,其中DLL包含作弊效用,运行EXE后将DLL注入游戏,使得游戏只据自己进程就得以兑现作弊功效。

对象分析

一经因而底API函数简单介绍

编排测试效果

全部评价

对象分析

C语言 2

流淌:本次打对象啊Super Mario XP

莫改进所以可用任意版本 ,

试玩发现人血量最特别呢10,心太充足啊99,命绝要命也99。

假若由此底API函数简单介绍

C语言,HANDLE CreateThread(LPSECURITYATTRIBUTES, SIZET, LPTHREADSTARTROUTINE,
LPVOID, DWORD ,LPDWORD

CreateThread 将当主线程的底蕴及创立一个新线程

LPVOID VirtualAllocEx(HANDLE, LPVOID, SIZE_T, DWORD, DWORD);

VirtualAllocEx
向指定进程申请内存,其中flAllocationType取值MEM_COMMIT表示写副物理存储而休磁盘互换内存

FARPROC GetProcAddress(HMODULE hModule, LPCSTR);

GetProcAddress 检索指定的动态链接库(DLL)中之出口库函数地址

HANDLE CreateRemoteThread(HANDLE, LPSECURITYATTRIBUTES, SIZET,
LPTHREADSTARTROUTINE, LPVOID, DWORD, LPDWORD);

CreateRemoteThread 创造一个在另外进程地址空间中运作的线程

编排测试效果

C语言 3

开辟娱乐

C语言 4

运作外挂

打开注入器Injecter,注入器注入DLL后活动退,仅剩下游戏,此时娱乐已经具备作弊效果(锁定血量)

C语言 5

检测中

//

// 04简单DLL注入游戏(作弊模块DLL部分)

// C/C++

//

#include

#defineDllfuncitonextern”C” __declspec(dllexport)//以C格局导出

Dllfuncitonvoid lockdata();

Dllfunciton DWORD WINAPI inject(LPVOID);

void lockdata(){

while(true){

DWORD hp =10;

DWORD heart =99;

DWORD life =99;

DWORD addr3 =0x004282a2;

DWORD res
=WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)addr,&hp,4,0);//写副自己改游戏数量

DWORD res2
=WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)addr2,&heart,4,0);

DWORD res3
=WriteProcessMemory(INVALID_HANDLE_VALUE,(LPVOID)addr3,&life,4,0);

Sleep(1000);

}

}

DWORD WINAPI inject(LPVOID){

lockdata();

returntrue;

}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call,
LPVOID lpReserved){

switch(ul_reason_for_call){

case DLL_PROCESS_ATTACH:{

::DisableThreadLibraryCalls(hModule);//创设线程包含死循环,为防卡死得装

CreateThread(NULL,0, inject, NULL,0, NULL);

}

break;

case DLL_THREAD_ATTACH:

case DLL_THREAD_DETACH:

case DLL_PROCESS_DETACH:

break;

default:;

}

returntrue;

}

//

// 04简单DLL注入游戏(注入器EXE部分)

// C/C++

//

#include

#include

#include

#include

usingnamespace std;

HWND hwnd = NULL;

DWORD processid = NULL;

HANDLE hprocess = NULL;

PVOID procdlladdr = NULL;

char dllname[25]=”cheatDLL”;

char loadfunc[25]=”LoadLibraryA”;

FARPROC loadfuncaddr = NULL;

HANDLE hfile;

void getwindow(){

hwnd =::FindWindow(NULL,”Super Mario XP”);

if(hwnd == NULL)

MessageBox(NULL,”找不至耍”,”错误”, MB_OK);

GetWindowThreadProcessId(hwnd,&processid);

hprocess =OpenProcess(PROCESS_ALL_ACCESS,FALSE,processid);

if(hprocess == NULL)

MessageBox(NULL,”打开游戏败北”,”错误”, MB_OK);

}

void inject(){

int size = strlen(dllname)+5;

procdlladdr =::VirtualAllocEx(hprocess, NULL, size, MEM_COMMIT,
PAGE_READWRITE);//向目的申请空间,得到新空间地址

if(procdlladdr == NULL)

MessageBox(NULL,”申请空间失败”,”错误”, MB_OK);

DWORD writenum;

::WriteProcessMemory(hprocess, procdlladdr, dllname,
size,&writenum);//向新空间描绘副假若注入的DLL名称

loadfuncaddr =::GetProcAddress(::GetModuleHandle(“kernel32.dll”),
loadfunc);//拿到LoadLibraryA的地点,在旁进程空间还平等

HANDLE hthread =::CreateRemoteThread(hprocess,
NULL,0,(LPTHREAD_START_ROUTINE)loadfuncaddr,(LPVOID)procdlladdr,0,
NULL);

//新建线程执行LoadLibrary参数是已经当对象经过新空间描绘副的DLL名称,注意这函数在64各种生无法成功

::WaitForSingleObject(hthread, INFINITE);

::CloseHandle(hthread);

::CloseHandle(hprocess);

}

int main(){

getwindow();

inject();

return0;

}

DLL注入可假设作弊模块于程序自身“名义”下举办舞弊,提升作弊成功率,可是载入的DLL容易让DLL检测发现。

C语言 6