我有一句不知道怎么更改才是正确的。奉上源码。
hThread = &OpenThread(THREAD_ALL_ACCESS,FALSE,tid);错误C4013:警告函数“OpenThread"未定义;假设外部返回 int
还有一个错误C2102没有标示。我也不明白。
完整的在下面:
#include <stdio.h>
#include <windows.h>
#include <TlHelp32.h>
#include <gl/gl.h>
#pragma pack(1)
static __declspec(naked)void glrange()
{
__asm{
PUSH 0x3FE00000
PUSH 0
PUSH 0
PUSH 0
mov eax,0
call eax
ret
}
}
static __declspec(naked)void glbeginhook(GLenum mode)
{
__asm{
push ebp
mov ebp,esp
mov eax,0
push eax
}
if(mode==GL_TRIANGLE_STRIP || mode==GL_TRIANGLE_FAN)
{
glrange();
}
__asm{
pop eax
leave
jmp eax
}
}
static __declspec(naked)void glrangeend(){}
#pragma pack()
#ifndef CONTEXT_ALL
#ifndef CONTEXT_DEBUG
#ifndef CONTEXT_IA64
#define CONTEXT_IA64 0x00080000
#endif
#ifndef CONTEXT_IA32_CONTROL
#define CONTEXT_IA32_CONTROL (CONTEXT_IA64 | 0x00000020L)
#endif
#define CONTEXT_DEBUG (CONTEXT_IA64 | 0x00000010L)
#endif
#define CONTEXT_ALL (CONTEXT_CONTROL | CONTEXT_FLOATING_POINT | CONTEXT_INTEGER | CONTEXT_DEBUG | CONTEXT_IA32_CONTROL)
#endif
DWORD GetThreadSafeSection(HANDLE hThread)
{
CONTEXT tRegister;
LDT_ENTRY ldt;
tRegister.ContextFlags = CONTEXT_ALL;
if(GetThreadContext(hThread,&tRegister))
{
if(GetThreadSelectorEntry(hThread,tRegister.SegFs,&ldt))
{
return (DWORD)ldt.BaseLow | (DWORD)(ldt.HighWord.Bits.BaseMid << 16) | (DWORD)(ldt.HighWord.Bits.BaseHi << 24);
}
}
return 0;
}
int main(int argc, char* argv[])
{
DWORD pid,tid;
HANDLE hProcess,hThread;
DWORD dwFS;
HMODULE hOpenGL;
PVOID pWrite;
DWORD oldprotect;
DWORD dwBegin;
DWORD pnewAddr;
FARPROC pglRange;
PVOID pWriteMem;
HWND hWnd = FindWindow("ACG!",NULL);
if(!hWnd)
hWnd = FindWindow("Valve001",NULL);
if(!hWnd){
printf("没有找到CS1.6游戏\n");
return -1;
}
tid = GetWindowThreadProcessId(hWnd,&pid);
hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,pid);
hThread = &OpenThread(THREAD_ALL_ACCESS,FALSE,tid);
dwFS = GetThreadSafeSection(hThread);
printf("获取远程设置成功0x%X\n",dwFS);
hOpenGL = LoadLibrary("opengl32.dll");
pglRange = GetProcAddress(hOpenGL,"glDepthRange");
//
__asm{
lea eax,glrange
add eax,12
mov pWrite,eax
}
VirtualProtect(pWrite,4,PAGE_EXECUTE_READWRITE,&oldprotect);
*(PDWORD)pWrite = (DWORD)pglRange;
pWriteMem = VirtualAllocEx(hProcess,0,1024,MEM_COMMIT,PAGE_EXECUTE_READWRITE);
printf("远程内存申请成功0x%X\n",pWriteMem);
//读取远程显卡glBegin地址
ReadProcessMemory(hProcess,(PVOID)(dwFS+0x7cc),&dwBegin,4,NULL);
__asm{
lea eax,glbeginhook
add eax,4
mov pWrite,eax
}
VirtualProtect(pWrite,4,PAGE_EXECUTE_READWRITE,&oldprotect);
__asm{
mov eax,pWrite
mov ecx,dwBegin
mov dword ptr [eax],ecx
}
WriteProcessMemory(hProcess,pWriteMem,&glrange,((DWORD)&glrangeend-(DWORD)&glrange),NULL);
__asm{
lea eax,glbeginhook
lea ecx,glrange
sub eax,ecx
add eax,pWriteMem
mov pnewAddr,eax
}
//hook,开始wallhack
WriteProcessMemory(hProcess,(PVOID)(dwFS+0x7cc),&pnewAddr,4,NULL);
printf("软件启动成功\n");
Sleep(2000);
return 0;
}
//code end eof