-
-
[旧帖] [求助]关于C++写内存补丁 0.00雪花
-
发表于: 2012-4-9 19:49
-
DWORD _stdcall buding1(LPVOID lParam)
{
HMODULE k = NULL;
BYTE a[5] = {0xE8,0xBC,0x5E,0x2B,0x7C};
DWORD oldProtect=0;
VirtualProtect((LPVOID)((DWORD)0x00566C51),5,PAGE_READWRITE,&oldProtect);
memcpy((LPVOID)((DWORD)0x00566C51),a,5);
VirtualProtect((LPVOID)((DWORD)0x00566C51),5,oldProtect,&oldProtect);
return 0;
}
这段代码是取函数+偏移地址的，我修改成直接地址就没作用了，有没有高手告诉下我该怎么改呀？小弟再此谢过了
{
HMODULE k = NULL;
BYTE a[5] = {0xE8,0xBC,0x5E,0x2B,0x7C};
DWORD oldProtect=0;
VirtualProtect((LPVOID)((DWORD)0x00566C51),5,PAGE_READWRITE,&oldProtect);
memcpy((LPVOID)((DWORD)0x00566C51),a,5);
VirtualProtect((LPVOID)((DWORD)0x00566C51),5,oldProtect,&oldProtect);
return 0;
}
这段代码是取函数+偏移地址的，我修改成直接地址就没作用了，有没有高手告诉下我该怎么改呀？小弟再此谢过了
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
|
|
|---|---|
|
|
|
|
|
编译出来出错。。
我把文件代码贴出来，麻烦大哥帮我帮看看怎么不行呢。  //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 头文件 #include <Windows.h> //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 导出函数 #pragma comment(linker, "/EXPORT:WahCloseApcHelper=_AheadLib_WahCloseApcHelper,@1") #pragma comment(linker, "/EXPORT:WahCloseHandleHelper=_AheadLib_WahCloseHandleHelper,@2") #pragma comment(linker, "/EXPORT:WahCloseNotificationHandleHelper=_AheadLib_WahCloseNotificationHandleHelper,@3") #pragma comment(linker, "/EXPORT:WahCloseSocketHandle=_AheadLib_WahCloseSocketHandle,@4") #pragma comment(linker, "/EXPORT:WahCloseThread=_AheadLib_WahCloseThread,@5") #pragma comment(linker, "/EXPORT:WahCompleteRequest=_AheadLib_WahCompleteRequest,@6") #pragma comment(linker, "/EXPORT:WahCreateHandleContextTable=_AheadLib_WahCreateHandleContextTable,@7") #pragma comment(linker, "/EXPORT:WahCreateNotificationHandle=_AheadLib_WahCreateNotificationHandle,@8") #pragma comment(linker, "/EXPORT:WahCreateSocketHandle=_AheadLib_WahCreateSocketHandle,@9") #pragma comment(linker, "/EXPORT:WahDestroyHandleContextTable=_AheadLib_WahDestroyHandleContextTable,@10") #pragma comment(linker, "/EXPORT:WahDisableNonIFSHandleSupport=_AheadLib_WahDisableNonIFSHandleSupport,@11") #pragma comment(linker, "/EXPORT:WahEnableNonIFSHandleSupport=_AheadLib_WahEnableNonIFSHandleSupport,@12") #pragma comment(linker, "/EXPORT:WahEnumerateHandleContexts=_AheadLib_WahEnumerateHandleContexts,@13") #pragma comment(linker, "/EXPORT:WahInsertHandleContext=_AheadLib_WahInsertHandleContext,@14") #pragma comment(linker, "/EXPORT:WahNotifyAllProcesses=_AheadLib_WahNotifyAllProcesses,@15") #pragma comment(linker, "/EXPORT:WahOpenApcHelper=_AheadLib_WahOpenApcHelper,@16") #pragma comment(linker, "/EXPORT:WahOpenCurrentThread=_AheadLib_WahOpenCurrentThread,@17") #pragma comment(linker, "/EXPORT:WahOpenHandleHelper=_AheadLib_WahOpenHandleHelper,@18") #pragma comment(linker, "/EXPORT:WahOpenNotificationHandleHelper=_AheadLib_WahOpenNotificationHandleHelper,@19") #pragma comment(linker, "/EXPORT:WahQueueUserApc=_AheadLib_WahQueueUserApc,@20") #pragma comment(linker, "/EXPORT:WahReferenceContextByHandle=_AheadLib_WahReferenceContextByHandle,@21") #pragma comment(linker, "/EXPORT:WahRemoveHandleContext=_AheadLib_WahRemoveHandleContext,@22") #pragma comment(linker, "/EXPORT:WahWaitForNotification=_AheadLib_WahWaitForNotification,@23") //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 宏定义 #define EXTERNC extern "C" #define NAKED __declspec(naked) #define EXPORT __declspec(dllexport) #define ALCPP EXPORT NAKED #define ALSTD EXTERNC EXPORT NAKED void __stdcall #define ALCFAST EXTERNC EXPORT NAKED void __fastcall #define ALCDECL EXTERNC NAKED void __cdecl //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // AheadLib 命名空间 namespace AheadLib { HMODULE m_hModule = NULL; // 原始模块句柄 DWORD m_dwReturn[23] = {0}; // 原始函数返回地址 // 加载原始模块 inline BOOL WINAPI Load() { TCHAR tzPath[MAX_PATH]; TCHAR tzTemp[MAX_PATH * 2]; GetSystemDirectory(tzPath, MAX_PATH); lstrcat(tzPath, TEXT("\\ws2help1")); m_hModule = LoadLibrary(tzPath); if (m_hModule == NULL) { wsprintf(tzTemp, TEXT("无法加载 %s，程序无法正常运行。"), tzPath); MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP); } return (m_hModule != NULL); } // 释放原始模块 inline VOID WINAPI Free() { if (m_hModule) { FreeLibrary(m_hModule); } } // 获取原始函数地址 FARPROC WINAPI GetAddress(PCSTR pszProcName) { FARPROC fpAddress; CHAR szProcName[16]; TCHAR tzTemp[MAX_PATH]; fpAddress = GetProcAddress(m_hModule, pszProcName); if (fpAddress == NULL) { if (HIWORD(pszProcName) == 0) { wsprintf(szProcName, "%d", pszProcName); pszProcName = szProcName; } wsprintf(tzTemp, TEXT("无法找到函数 %hs，程序无法正常运行。"), pszProcName); MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP); ExitProcess(-2); } return fpAddress; } } using namespace AheadLib; //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// DWORD _stdcall buding1(LPVOID lParam) { HMODULE k = NULL; BYTE a[5] = {0xE8,0xBC,0x5E,0x2B,0x7C}; DWORD oldProtect=0; VirtualProtect((LPVOID)((DWORD)0x00566C51),5,PAGE_READWRITE,&oldProtect); memcpy((LPVOID)((DWORD)0x00566C51),a,5); VirtualProtect((LPVOID)((DWORD)0x00566C51),5,oldProtect,&oldProtect); return 0; } 出错部分 -------------------------------------------------------- --------------------Configuration: ws2help - Win32 Release-------------------- Compiling... 123.cpp F:\C++系统函数源码\x\ws2help\123.cpp(128) : error C2065: 'hProcess' : undeclared identifier F:\C++系统函数源码\x\ws2help\123.cpp(128) : error C2065: 'dwOldProt' : undeclared identifier F:\C++系统函数源码\x\ws2help\123.cpp(131) : error C2146: syntax error : missing ';' before identifier 'WriteProcessMemory' F:\C++系统函数源码\x\ws2help\123.cpp(131) : error C2065: 'dwPatchLen' : undeclared identifier F:\C++系统函数源码\x\ws2help\123.cpp(134) : error C2146: syntax error : missing ';' before identifier 'VirtualProtectEx' F:\C++系统函数源码\x\ws2help\123.cpp(134) : error C2065: 'dwNewProt' : undeclared identifier F:\C++系统函数源码\x\ws2help\123.cpp(136) : error C2143: syntax error : missing ';' before 'return' 执行 cl.exe 时出错. 123.obj - 1 error(s), 0 warning(s) |
|
|
我这样改的，不知道怎么错了，麻烦大哥帮我看下应该怎么修改
DWORD _stdcall buding1(LPVOID lParam) { HMODULE k = NULL; BYTE a[5] = {0xE8,0xBC,0x5E,0x2B,0x7C}; DWORD oldProtect=0; VirtualProtectEx(hProcess, (LPVOID)0x00566C51, dwPatchLen, PAGE_EXECUTE_READWRITE, &dwOldProt) WriteProcessMemory(hProcess, (LPVOID)0x00566C51, a, dwPatchLen, NULL) VirtualProtectEx(hProcess, (LPVOID)0x00566C51, dwPatchLen, dwOldProt, &dwNewProt) return 0; |
|
|
|
|
|
我不会用C++.能帮我修改一下吗
|
|
|
|
|
|
建议你买本C++的书去啃，连最基本的变量声明都不懂，你还要写代码。怎么可能呢
|
|
|
|
|
|
|
|
|
晕，不会写一个代码专门去抱本书去啃吧- -！那不知道要多久去了
|
|
|
|
|
|
那是当然，我现在是想找高手帮我解决下这个问题
|
|
|
////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////
// 头文件 #include <Windows.h> //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 导出函数 #pragma comment(linker, "/EXPORT:WahCloseApcHelper=_AheadLib_WahCloseApcHelper,@1") #pragma comment(linker, "/EXPORT:WahCloseHandleHelper=_AheadLib_WahCloseHandleHelper,@2") #pragma comment(linker, "/EXPORT:WahCloseNotificationHandleHelper=_AheadLib_WahCloseNotificationHandleHelper,@3") #pragma comment(linker, "/EXPORT:WahCloseSocketHandle=_AheadLib_WahCloseSocketHandle,@4") #pragma comment(linker, "/EXPORT:WahCloseThread=_AheadLib_WahCloseThread,@5") #pragma comment(linker, "/EXPORT:WahCompleteRequest=_AheadLib_WahCompleteRequest,@6") #pragma comment(linker, "/EXPORT:WahCreateHandleContextTable=_AheadLib_WahCreateHandleContextTable,@7") #pragma comment(linker, "/EXPORT:WahCreateNotificationHandle=_AheadLib_WahCreateNotificationHandle,@8") #pragma comment(linker, "/EXPORT:WahCreateSocketHandle=_AheadLib_WahCreateSocketHandle,@9") #pragma comment(linker, "/EXPORT:WahDestroyHandleContextTable=_AheadLib_WahDestroyHandleContextTable,@10") #pragma comment(linker, "/EXPORT:WahDisableNonIFSHandleSupport=_AheadLib_WahDisableNonIFSHandleSupport,@11") #pragma comment(linker, "/EXPORT:WahEnableNonIFSHandleSupport=_AheadLib_WahEnableNonIFSHandleSupport,@12") #pragma comment(linker, "/EXPORT:WahEnumerateHandleContexts=_AheadLib_WahEnumerateHandleContexts,@13") #pragma comment(linker, "/EXPORT:WahInsertHandleContext=_AheadLib_WahInsertHandleContext,@14") #pragma comment(linker, "/EXPORT:WahNotifyAllProcesses=_AheadLib_WahNotifyAllProcesses,@15") #pragma comment(linker, "/EXPORT:WahOpenApcHelper=_AheadLib_WahOpenApcHelper,@16") #pragma comment(linker, "/EXPORT:WahOpenCurrentThread=_AheadLib_WahOpenCurrentThread,@17") #pragma comment(linker, "/EXPORT:WahOpenHandleHelper=_AheadLib_WahOpenHandleHelper,@18") #pragma comment(linker, "/EXPORT:WahOpenNotificationHandleHelper=_AheadLib_WahOpenNotificationHandleHelper,@19") #pragma comment(linker, "/EXPORT:WahQueueUserApc=_AheadLib_WahQueueUserApc,@20") #pragma comment(linker, "/EXPORT:WahReferenceContextByHandle=_AheadLib_WahReferenceContextByHandle,@21") #pragma comment(linker, "/EXPORT:WahRemoveHandleContext=_AheadLib_WahRemoveHandleContext,@22") #pragma comment(linker, "/EXPORT:WahWaitForNotification=_AheadLib_WahWaitForNotification,@23") //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 宏定义 #define EXTERNC extern "C" #define NAKED __declspec(naked) #define EXPORT __declspec(dllexport) #define ALCPP EXPORT NAKED #define ALSTD EXTERNC EXPORT NAKED void __stdcall #define ALCFAST EXTERNC EXPORT NAKED void __fastcall #define ALCDECL EXTERNC NAKED void __cdecl //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // AheadLib 命名空间 namespace AheadLib { HMODULE m_hModule = NULL; // 原始模块句柄 DWORD m_dwReturn[23] = {0}; // 原始函数返回地址 // 加载原始模块 inline BOOL WINAPI Load() { TCHAR tzPath[MAX_PATH]; TCHAR tzTemp[MAX_PATH * 2]; GetSystemDirectory(tzPath, MAX_PATH); lstrcat(tzPath, TEXT("\\ws2help1")); m_hModule = LoadLibrary(tzPath); if (m_hModule == NULL) { wsprintf(tzTemp, TEXT("无法加载 %s，程序无法正常运行。"), tzPath); MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP); } return (m_hModule != NULL); } // 释放原始模块 inline VOID WINAPI Free() { if (m_hModule) { FreeLibrary(m_hModule); } } // 获取原始函数地址 FARPROC WINAPI GetAddress(PCSTR pszProcName) { FARPROC fpAddress; CHAR szProcName[16]; TCHAR tzTemp[MAX_PATH]; fpAddress = GetProcAddress(m_hModule, pszProcName); if (fpAddress == NULL) { if (HIWORD(pszProcName) == 0) { wsprintf(szProcName, "%d", pszProcName); pszProcName = szProcName; } wsprintf(tzTemp, TEXT("无法找到函数 %hs，程序无法正常运行。"), pszProcName); MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP); ExitProcess(-2); } return fpAddress; } } using namespace AheadLib; //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// void PatchProcess(HANDLE hProcess) { PatchProcess(GetCurrentProcess()); DWORD Oldpp; /************************************************************************/ /*补丁代码样例 */ /************************************************************************/ unsigned char p4CBA00[8] = { 0xCA, 0xA7, 0xB0, 0xDC, 0xCA, 0xA7, 0xB0, 0xDC }; VirtualProtectEx(hProcess, (LPVOID)0x004657DC, 8, PAGE_EXECUTE_READWRITE, &Oldpp); WriteProcessMemory(hProcess, (LPVOID)0x004657DC, p4CBA00, 8, NULL); } //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // 判断是否是目标程序,这里需要改动,在自己做补丁的时候 BOOL isTarget(HANDLE hProcess) { return TRUE; } //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// // void hijack() { GetAddress("数据测试.exe"); if (isTarget(GetCurrentProcess())) { PatchProcess(GetCurrentProcess()); } } 我把代码重新改过了，用的是论坛里的lpk补丁修改了下，能编译就是没起作用，谁知道哪里的问题啊 
|
|
|
|
|
|
|
