请教如何编写游戏修改器(动态分配内存地址)(200分)

  • 主题发起人 主题发起人 HHYWorld
  • 开始时间 开始时间
H

HHYWorld

Unregistered / Unconfirmed
GUEST, unregistred user!
以前写过几个静态内存地址的游戏修改器,近来我的朋友突然爱上了一款老游戏,红色警戒2,他让我帮他做一款修改器使其能够拥有无限金钱,可是经分析后才发现,这款游戏的金钱地址是动态的,在论坛上翻遍了也没有找到关于如何编写动态内存的详细讲解,而且都牵扯到汇编语言,小子对汇编语言有点怕^o^ 望哪位高手能够针对这款游戏细细指点一下小子(特别是如何在delphi中写汇编语言),小子在这里先谢过了,分数不够可以再加,但务求详细源代码,谢谢。

我并没有用Ollydbg,而是直接用GameMaster 7对游戏的金钱地址进行跟踪,得到代码如下:
004E53AF mov dword [ebx+0000024c],eax
004E53B5 jmp 00401054
004E53B7 mov ecx,dword[ebx+0000024c]
004E53BD mov eax,dword[esp+28]
004E53C1 sub ecx,edi
004E53C3 add eax,edi
004E53C5 mov dword[ebx+0000024c],ecx
004E53CB mov dword[esp+28],eax
004E53CF xor edi,edi
004E53D1 mov ecx,ebp
004E53D3 call 005b6a61
004E53D8 fcomp 32real[0079a738]
004E53DE fnstsw ax
004E53E0 test ah,41
004E53E3 ie 00400f78
004E53E9 test edi,edi
004E53EB je 00401053
004E53ED mov eax,dword[esp+14]
004E53F1 mov ecx,dword[esp+18]
004E53F5 inc eax
 
不是什么秘密的玩意
不过连机修改无效,会断线
自己一个人yy吧

unit Unit1;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, ExtCtrls, StdCtrls;

type
TForm1 = class(TForm)
Edit1: TEdit;
Label1: TLabel;
Timer1: TTimer;
Label2: TLabel;
Edit2: TEdit;
Button1: TButton;
Button2: TButton;
Label3: TLabel;
Edit4: TEdit;
procedure Timer1Timer(Sender: TObject);
procedure Button2Click(Sender: TObject);
procedure Button1Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;

implementation

{$R *.dfm}
Function DuMem(pid:DWORD;Addres: Cardinal): Cardinal;
var PHND:THandle; bReadSucceed :BOOL; BytesRead:DWORD;
begin
if pid <> 0 then
begin
PHND := OpenProcess(PROCESS_VM_READ, False,pid);
if PHND <> 0 then
begin
bReadSucceed :=ReadProcessMemory(PHND, Pointer(Addres), @Result, 4, BytesRead);
if bReadSucceed = False then Result := 0 ;
end;
CloseHandle(PHND);
end else
Result := 0;
end;

Function XXMem(pid:DWORD;Addres: Cardinal;zhi:dword): Cardinal;
var PHND:THandle; bReadSucceed :BOOL; BytesRead:DWORD;
begin
if pid <> 0 then
begin
PHND := OpenProcess(PROCESS_ALL_ACCESS, False,pid);
if PHND <> 0 then
begin
bReadSucceed :=WriteProcessMemory(PHND, Pointer(Addres), @zhi, 4, BytesRead);
if bReadSucceed = False then Result := 0 ;
end;
CloseHandle(PHND);
end else
Result := 0;
end;

procedure TForm1.Timer1Timer(Sender: TObject);
var
hRedAlert2 : THandle; xpid:dword;
begin
hRedAlert2 := FindWindow('Red Alert 2', 'Red Alert 2');
if hRedAlert2<> 0 then
begin
GetWindowThreadProcessId(hRedAlert2,xpid);
edit1.Text:= inttostr( xpid );
edit4.Text:= inttostr( DuMem( xpid, DuMem( xpid ,$A35DB4 ) + $24C ) );
XXMem( xpid, DuMem( xpid ,$A35DB4 ) + $24C , strtoint(edit2.Text ) );
end else
begin
edit1.Text:='无';
end;
end;

procedure TForm1.Button2Click(Sender: TObject);
begin
halt;
end;

procedure TForm1.Button1Click(Sender: TObject);
begin
showmessage('程序设计:又欠'#13#10+'程序测试:安康')
end;

end.


/////////////////////

object Form1: TForm1
Left = 202
Top = 129
BorderIcons = []
BorderStyle = bsSingle
Caption = #32418#33394#35686#25106'2'#37329#38065#20462#25913#22120' '
ClientHeight = 82
ClientWidth = 198
Color = clBtnFace
Font.Charset = DEFAULT_CHARSET
Font.Color = clWindowText
Font.Height = -11
Font.Name = 'Tahoma'
Font.Style = []
OldCreateOrder = False
Position = poScreenCenter
PixelsPerInch = 96
TextHeight = 13
object Label1: TLabel
Left = 8
Top = 8
Width = 60
Height = 13
Caption = #28216#25103#36827#31243#65306
end
object Label2: TLabel
Left = 8
Top = 32
Width = 60
Height = 13
Caption = #37329#38065#20462#25913#65306
end
object Label3: TLabel
Left = 8
Top = 56
Width = 60
Height = 13
Caption = #24403#21069#37329#38065#65306
end
object Edit1: TEdit
Left = 67
Top = 5
Width = 54
Height = 21
TabOrder = 0
end
object Edit2: TEdit
Left = 67
Top = 29
Width = 54
Height = 21
TabOrder = 1
Text = '10000'
end
object Button1: TButton
Left = 127
Top = 5
Width = 64
Height = 21
Caption = #20851#20110
TabOrder = 2
OnClick = Button1Click
end
object Button2: TButton
Left = 127
Top = 30
Width = 64
Height = 21
Caption = #36864#20986
TabOrder = 3
OnClick = Button2Click
end
object Edit4: TEdit
Left = 67
Top = 53
Width = 54
Height = 21
TabOrder = 4
Text = '10000'
end
object Timer1: TTimer
OnTimer = Timer1Timer
Left = 16
Top = 8
end
end
 
sadnui兄,首先小子感谢你对我提出的问题进行解答,你的强大小子比较钦佩,可是下面还有几个问题,麻烦你解答一下,谢谢。

1、编译的时候出现如下警告提示,好像是XXMem函数返回值不明确,麻烦你看一下:
[DCC Warning] Unit1.pas(66): W1035 Return value of function 'XXMem' might be undefined

2、以下两句中的$A35DB4这个地址是如何得来的,机器码中并没有体现出这个地址啊,请解答。
edit4.Text:= inttostr( DuMem( xpid, DuMem( xpid ,$A35DB4 ) + $24C ) );
XXMem( xpid, DuMem( xpid ,$A35DB4 ) + $24C , strtoint(edit2.Text ) );

3、一个请求,麻烦你将上述所写的DuMem、XXMem函数以及Timer1控件中的内容加上详细的注解,小子想仔细研究研究,对知识的渴求是每个编程爱好者的宿愿,望身为高手的你能够帮忙,谢谢了。

差点忘记了,你有qq吗?如果有可以告诉我号码吗?或者你加我也可以,我的QQ:65063099
再次感谢[:D]
 
这个东西只能说是玩意而已,稍微了解一些api就能完成的东西
DuMem、XXMem就不给你解释了,说白了就俩api,一个读内存 一个写内存

FindWindow查找句柄
GetWindowThreadProcessId 获取pid
$A35DB4 基地址 $24C 偏移
然后读写内存就行了
 
还是先结帖吧
 
有一点还是不明白,不过非常感谢sadnui兄解答我的问题,分数送上。
我将另开一贴,如果可以,sadnui兄请解答。
 

Similar threads

后退
顶部