-
-
[原创]分享个东西,cheat engine的变速精灵(speedhack)模块调用方法.
-
发表于: 2022-9-27 15:25
-
CE变速精灵(speedhack)导出表
CE的变速精灵实现原理是把speedhack.dll注入游戏,劫持了三个高精度计时函数
kernel32.dll->GetTickCount
ntdll.RtlQueryPerformanceCounter
kernel32.dll->GetTickCount64
实现了加速/减速功能(别问怎么过注入过检测)
下面是伪代码
这个东西支持x64玩法很多,也非常多检测方式,怎么使用全看你脑洞
很小白,但是我不会pascal,看了CE源码十多个小时才看明白
把ntdll.RtlQueryPerformanceCounter inlink hook77892984 | 8BFF mov edi,edi
改成77892984 | E9 B7DA7E8D
jmp <speedhack-i386.speedhackversion_QueryPerformanceCounter
//speedhack.dll变速精灵模块
speedhack-i386->speedhackversion_QueryPerformanceCounter
//构建回跳桥板
40111111 mov edi,edi
push ebp
mov ebp,esp
jmp (77892984+5)
speedhack-i386->realQueryPerformanceCounter = 40111111
最后这步很重要,speedhack.dll->realQueryPerformanceCounter填入回跳桥板地址,不懂就去调试CE看看他的实现.
剩下两个是hook完全相同,就不说了kernel32.dll->GetTickCount inline hook
jmp speedhackversion_GetTickCountrealGetTickCount填入回跳地址kernel32.dll->GetTickCount64 inline hook
jmp speedhackversion_GetTickCount64realGetTickCount64填入会跳地址把ntdll.RtlQueryPerformanceCounter inlink hook77892984 | 8BFF mov edi,edi
改成77892984 | E9 B7DA7E8D
jmp <speedhack-i386.speedhackversion_QueryPerformanceCounter
//speedhack.dll变速精灵模块
speedhack-i386->speedhackversion_QueryPerformanceCounter
//构建回跳桥板
40111111 mov edi,edi
push ebp
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
|
|
|---|---|
|
|
|
|
|
|
|
|
哈哈是的,我看他源码太多例外处理了,我就简化了下,照他那么搞人都麻了 |
|
|
对,还有个这个 WINMM.dll->timeGetTime JMP speedhackversion_GetTickCount |
|
|
|
|
|
大佬我最近在研究csol请问你现在研究过吗 |
|
|
给出源码拿去玩吧 void InitSpeedHack()
{
DWORD ndbase_speed;//speedhack基址
DWORD i;
DWORD kernel32base;
DWORD WINMMbase;
DWORD ntdllbase;
DWORD kernel_GetTickCount;
DWORD WINMMtimeGetTime;
DWORD ntdll_RtlqueryPerf;
DWORD kernel_GetTick64;
CString szbuff;
wchar_t szpid[10];
nhHero = g_dm->FindWindow(NULL,_T("游戏名"));//我懒得用自己注入,随便找了个大漠注入
DWORD pid = g_dm->GetWindowProcessId(nhHero);
_itow(pid,szpid,10);
szbuff = L"inject 2 <c:\\1.dll> ";
szbuff = szbuff + szpid;
szbuff = szbuff + L" 0 1";
OutputDebugStringW(L"InitSpeedHack");
i = g_dm->DmGuard(1,szbuff.GetBuffer());//注入
dbg_print(i);
wchar_t* szsign = L"55 89 E5 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? A3";
wchar_t wszbuff[4]={0};
CString szresult=L"";
CString csbuff,szback;
//找到基址speedhack
for (i=0;i<0xf;i++)
{
if (i<10)
{ wszbuff[0]=i+48;
}else
{
wszbuff[0]=i+55;
}
csbuff = wszbuff;
szback = csbuff + L"0000000-" + csbuff + L"FFFFFFF";
szresult = g_dm->FindData(nhHero,szback,szsign);
OutputDebugStringW(szresult.GetBuffer());
if (szresult!="")
{
break;
}
}
ndbase_speed = wcstoul(szresult.GetBuffer(),0,16);
ndbase_speed = ndbase_speed-0x204F0;
dbg_print(ndbase_speed);
speedhackversion_QueryPerformanceCounter = ndbase_speed+0x20440;
speedhackversion_GetTickCount64 = ndbase_speed+0x000203B0 ;
speedhackversion_GetTickCount = ndbase_speed+0x00020330;
realQueryPerformanceCounter = ndbase_speed+0x0002D950;
realGetTickCount64 = ndbase_speed+0x0002D940;
realGetTickCount = ndbase_speed+0x0002D930;
InitializeSpeedhack = ndbase_speed+0x000204F0;
kernel32base = g_dm->GetModuleBaseAddr(nhHero,L"kernel32.dll");
kernel_GetTickCount = kernel32base+0x1110C;
kernel_GetTick64 = kernel32base+0x2EEC8;
WINMMbase = g_dm->GetModuleBaseAddr(nhHero,L"WINMM.dll");
WINMMtimeGetTime = WINMMbase+0x26E0;
ntdllbase = g_dm->GetModuleBaseAddr(nhHero,L"ntdll.dll");
ntdll_RtlqueryPerf = ntdllbase+0x388C4;
inlineHook(kernel_GetTickCount,speedhackversion_GetTickCount,realGetTickCount,0);
inlineHook(WINMMtimeGetTime,speedhackversion_GetTickCount,0,0);
inlineHook(ntdll_RtlqueryPerf,speedhackversion_QueryPerformanceCounter,realQueryPerformanceCounter,1);
inlineHook(kernel_GetTick64,speedhackversion_GetTickCount64,realGetTickCount64,0);
}
void 3被加速()
{
if (InitializeSpeedhack==0)
{
checkspeedhack();
}
wchar_t wsbuff[10];
CString csbuff;
float fchange=3.0;
_itow(*(PDWORD)&fchange,wsbuff,16);
csbuff = L"push ";
csbuff =csbuff + wsbuff;
OutputDebugStringW(csbuff);
g_dm->AsmAdd(csbuff);
_itow(InitializeSpeedhack,wsbuff,16);
csbuff = L"call ";
csbuff = csbuff + wsbuff;
OutputDebugStringW(csbuff);
g_dm->AsmAdd(csbuff);
g_dm->AsmCall(nhHero,1);
g_dm->AsmClear();
} |
|
|
研究这游戏变现非常危险,所以没兴趣 |
|
|
|
|
|
怎么说 老牌产品不是屹立不倒吗 |
|
|
|
|
|
|
|
|
你先看看用ce变速精灵功能能不能正常使用，这个和ce变速精灵功能等价的 再检查代码 |
|
|
所有fps都有概率速通铁饭碗,一辈子无忧 |
|
|
怎么说？FPS游戏收益最高还是咋？ |
|
|
|
