星际2在启动的时候，会创建2个exe进程。
这两个互相监视，关闭某一个，另外一个都会关掉。并且2个都无法用od附加。

我对比了进城里的那两个exe,虽然都来自一个sc2.exe,但是明显不是一个文件。

首先我先hook了WriteProcessMemory

BOOL __stdcall Dbg::WriteProcessMemory_Hook(HANDLE hProcess, LPVOID lpBaseAddress, LPCVOID lpBuffer, SIZE_T nSize, SIZE_T *lpNumberOfBytesWritten)
{
	char szBuffer[1024] = "";

	sprintf_s(szBuffer, sizeof(szBuffer), "Process: %x\nBaseAddr: %x\nBuffer: %x\nSize: %x",  hProcess, lpBaseAddress, lpBuffer, nSize);
	MessageBox(0, szBuffer,0 ,0);

	IMAGE_DOS_HEADER* pDos = (IMAGE_DOS_HEADER*)lpBuffer;

	if(pDos->e_magic == 0x5A4D)
	{
		DWORD dwWritten;
		HANDLE hFile = CreateFileA( "C:\\CHNHack.exe", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, CREATE_NEW, NULL, 0);
		WriteFile(hFile, lpBuffer, 0x400 * 8, &dwWritten, NULL);
		CloseHandle(hFile);
	}

	return WriteProcessMemory( hProcess, lpBaseAddress, lpBuffer, nSize, lpNumberOfBytesWritten );
}

[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！