/************************************************************************
获取开始游戏时，玩家列表(还有其他更好的方法，比如HF的方法就更NB)
作者:MentalDease
地址:
http://hi.baidu.com/堕落的神曲
时间:2009-5-12
For War3 1.20E(不保证版本通用性)
这个是很早前写的代码，不怎么好看，大家将就下
***********************************************************************/
#include <windows.h>
#include <stdio.h>
#include <string.h>
char buffer[256];
DWORD JmpAddr,RetAddr590;
DWORD RetAddr578;
BYTE JmpCode590[9]={0xe9,0,0,0,0,0x90,0x90,0x90,0x90}; //前9个字节
BYTE JmpCode578[6]={0xe9,0,0,0,0,0x90}; //前6个字节
DWORD Func590;
DWORD Func578;
DWORD Nameaddr_tmp,Nameaddr = 0;
int player_num;
BOOLEAN Logged = FALSE;
char PlayersName[30][30] ={0};
void _stdcall GetSth(char * pstr){
if (strncmp (pstr, "LOADING_LOADING", 0xF) == 0 && Nameaddr &&!Logged)
{
player_num = 0;
DWORD tmp = Nameaddr;
DWORD OldProtect;
while (1)
{
tmp = Nameaddr + 0x18; //序号偏移
VirtualProtectEx ((HANDLE)-1,(PVOID)Nameaddr, 0x10, PAGE_READWRITE, &OldProtect);
if (*(int *)Nameaddr == 0)
{
//player_num --;
VirtualProtectEx ((HANDLE)-1,(PVOID)Nameaddr, 0x10, OldProtect, NULL);
break;
}
memcpy(PlayersName[player_num], (PVOID)Nameaddr, 0x20);
VirtualProtectEx ((HANDLE)-1,(PVOID)Nameaddr, 0x10, OldProtect, NULL);
Nameaddr += 0x1d8; //用户块偏移
player_num++;
}
Logged = TRUE;
}
}
__declspec(naked) void JmpFunc590(void){
__asm{
push eax
push ebx
push edx
mov eax,esp
add eax,4*4
mov ebx,[eax]
mov dl,byte ptr[ebx]
cmp dl,'L'
jz next
jmp end
next:
inc ebx
mov dl,byte ptr[ebx]
cmp dl,'O'
jz good
jmp end
good: //包含目标字符
push [eax]
call GetSth
end:
pop edx
pop ebx
pop eax
push ebp
mov ebp,esp
sub esp,0x400
jmp dword ptr[RetAddr590]
}
}
void __stdcall FindNameAddr(char * pstr){
if (!strncmp(pstr, "%s %u", 5) )
{
__asm{
mov eax,Nameaddr_tmp
and eax, 0x00000fff;
xor eax, 0x00000204;
cmp eax,0
jz GoodAddr
jmp BadAddr
}
GoodAddr:
Nameaddr = Nameaddr_tmp;
Logged = FALSE;
BadAddr:
return;
}
}
__declspec(naked) void JmpFunc578(void){
__asm{
pop ebp
mov eax, dword ptr [esp+0XC]
push eax
mov eax, dword ptr [esp+0x1C]
add eax,0x174
mov Nameaddr_tmp, eax
call FindNameAddr
push ebp
mov ebp, esp
mov eax, dword ptr[ebp+0x10]
push edi
mov edi, dword ptr[ebp+0x8]
mov ecx, edi
jmp dword ptr [RetAddr578]
}
}
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
if(ul_reason_for_call==DLL_PROCESS_ATTACH){
if (!GetModuleHandle("War3.exe"))
{
OutputDebugString("I am not in War3.exe");
return TRUE;
}
DWORD dwret;
HMODULE hDll =LoadLibrary( "Storm.dll" );
Func590 = ( DWORD )GetProcAddress( hDll, (LPCTSTR)590 ); //钩住这两个函数
Func578 = ( DWORD )GetProcAddress (hDll, (LPCTSTR)578 );
// hook func590
JmpAddr=(DWORD)JmpFunc590-Func590-5;
RetAddr590=(DWORD)Func590+9;
memcpy(JmpCode590+1,(char *)&JmpAddr,4); //生成跳转指令
WriteProcessMemory((HANDLE)-1,(PVOID)Func590,JmpCode590,9,&dwret);
// hook func578
JmpAddr = (DWORD)JmpFunc578-(Func578+6)-5;
RetAddr578 = (DWORD)Func578+6+6;
memcpy (JmpCode578+1,(char *)&JmpAddr,4); //生成跳转指令
WriteProcessMemory((HANDLE)-1,(PVOID)(Func578+6),JmpCode578,6,&dwret);
}
return TRUE;
}
都没了啊
这么快就有fans了
