-
-
[原创]Minesweeper 外挂 I(有VC6代码)
-
发表于: 2012-5-31 10:21
-
|
|
|---|---|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
 Use IDA Pro to locate the respective memory addresses of Map Width X, Map Height Y and Map Data. Use Winspy to obtain the PostMessage details for WM_LBUTTONDOWN, WM_LBUTTONUP. Compile using VC 6.0 into DLL application. 基本原理： 1. Findwindow 找 Minesweeper Window Handle。 2. Process_Game函数里面， 就会读取游戏的内存，得到的是游戏地图。 然后判断哪个宽宽里没有炸弹就点击。 因为是注入Minesweeper本身里,这次是用memcpy来读取游戏的内存 ! (Minesweeper 外挂 I 的方法 是用readprocessmemory跨界读取). 找内存地址： 因为炸弹的位子是随机安排的，所以在IDAPro[Imports]里或者IDA View里搜索 rand。 找到后，就会找到重点函数StartGame。 _xBoxMac，_yBoxMac （大概可以猜到是什么） 不过还是要下断点，调式，就会肯定以下的地址： _xBoxMac，_yBoxMac，_rgBlk 适合以下版本：（其他的，可能需要改内存地址） // Microsoft Minesweeper Version 5.1 // Build 2600.xpsp_sp3_gdr.120411-1615 : Service Pack 3 打开Minesweeper，选好游戏. 用DLL注入软件(网上搜索就有),把这个dll注入Minesweeper (这个方法也是很多外挂用的方法). F3，1秒搞定 ！ F4, 取消卸载dll.
// Minesweeper Hack II - DLL Inject Method
#include <windows.h>
// Microsoft Minesweeper Version 5.1
// Build 2600.xpsp_sp3_gdr.120411-1615 : Service Pack 3
#define ADR_WIDTH_X 0x1005334 // Memory address where map width X is stored
#define ADR_HEIGHT_Y 0x1005338 // Memory address where map height Y is stored
#define ADR_GAME_MAP 0x1005340 // Memory address of game map
#define MAX_HEIGHT_Y (24+2) // Max. Y height for Custom game
#define MAX_WIDTH_X (30+2) // Max. X width for Custom game
// Add 2 to include boundary data (0x10 value) of game map
#define MINE_VALUE 0x8F // value of a mine in game map
#define NO_MINE_VALUE 0x0F // value of a mine in game ap
#define FIRST_MINE_X 20 // First Mine X Location
#define FIRST_MINE_Y 62 // First Mine Y Location
#define STEP_X 16 // X step size between adjacent mines
#define STEP_Y 16 // Y step size between adjacent mines
// Function declaration
DWORD WINAPI GetKeyThread(LPVOID);
void __stdcall Process_Game(void);
// Global variables
BYTE Game_Map[MAX_HEIGHT_Y*MAX_WIDTH_X];
HMODULE g_hModule;
INT APIENTRY DllMain(HMODULE hDLL, DWORD Reason, LPVOID Reserved)
{
switch(Reason)
{
case DLL_PROCESS_ATTACH:
DisableThreadLibraryCalls(hDLL);
g_hModule = hDLL;
CreateThread(NULL, NULL, &GetKeyThread, NULL, NULL, NULL);
break;
case DLL_PROCESS_DETACH:
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
break;
}
return TRUE;
}
DWORD WINAPI GetKeyThread(LPVOID)
{
while(1)
{
// Set F3 as our hotkey to play game
// Set F4 as our hotkey to end hook
if(GetAsyncKeyState(VK_F3) & 1)
{
Process_Game();
}
else if(GetAsyncKeyState(VK_F4) & 1)
{
break;
}
Sleep(100);
}
FreeLibraryAndExitThread(g_hModule, 0);
return 0;
}
void __stdcall Process_Game(void)
{
DWORD Map_Width_X, Map_Height_Y;
DWORD x,y;
HWND hMineAppWnd;
POINT pt;
hMineAppWnd=FindWindow("Minesweeper", NULL);
// Read Width & Height of current game map
memcpy(&Map_Width_X,LPCVOID(ADR_WIDTH_X),4);
memcpy(&Map_Height_Y,LPCVOID(ADR_HEIGHT_Y),4);
// Read map data
memcpy(&Game_Map,LPCVOID(ADR_GAME_MAP),(MAX_HEIGHT_Y*MAX_WIDTH_X));
// x & y starts from 1 to skip the boundary data
for (x = 1; x <= Map_Width_X; x++)
{
for (y = 1; y <= Map_Height_Y; y++)
{
// No mine is found in this cell
if (Game_Map[x + y * 32] == NO_MINE_VALUE)
{
pt.x = FIRST_MINE_X + ((x-1)*STEP_X);
pt.y = FIRST_MINE_Y + ((y-1)*STEP_Y);
// Click cell
PostMessage(hMineAppWnd,WM_LBUTTONDOWN,0x1,MAKELPARAM(pt.x,pt.y));
PostMessage(hMineAppWnd,WM_LBUTTONUP,0,MAKELPARAM(pt.x,pt.y));
}
}
}
}
|
|
|
|
|
|
|
|
|
|
