失眠网 > 自己动手制作植物大战僵尸简单修改器

自己动手制作植物大战僵尸简单修改器

时间：2021-09-07 17:42:53

相关推荐

自己动手制作植物大战僵尸简单修改器

获取植物大战僵尸进程改变阳光数改变金币数CD循环清零运行结果

获取植物大战僵尸进程

我用的是植物大战僵尸汉化第二版，基址是0x006A9EC0

编译器是VC++6.0

（注：未经说明且不是函数定义的代码添加于按钮处）

声明基址

const int baseaddr = 0x006A9EC0;

首先是获取植物大战僵尸进程

PROCESSENTRY32 pe32;pe32.dwSize = sizeof(pe32);HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);BOOL have_more = ::Process32First(hProcessSnap,&pe32);int processid = -1;while(have_more){if(!_tcscmp(pe32.szExeFile,_T("PlantsVsZombies.exe"))){processid = pe32.th32ProcessID;break;}have_more = ::Process32Next(hProcessSnap,&pe32);}if(processid == -1){AfxMessageBox("找不到游戏进程");ExitThread(-1);}CloseHandle(hProcessSnap);HANDLE hprocess = ::OpenProcess(PROCESS_ALL_ACCESS,FALSE,processid);

hprocess就是植物大战僵尸进程了

改变阳光数

接着就要改变阳光数了,阳光地址是0x006A9EC0 + 0x786 + 0x5560

（即0x006A9EC0的值加上0x786后作为地址，取值加0x5560为阳光地址，之后的不另做解释）

CString ssun;DWORD sun = 0;m_edit1.GetWindowText(ssun);//获取增加阳光数int addr;//改变阳光数::ReadProcessMemory(hprocess,(LPVOID)(baseaddr),&addr,4,0);::ReadProcessMemory(hprocess,(LPVOID)(addr+0x768),&addr,4,0);::ReadProcessMemory(hprocess,(LPVOID)(addr+0x5560),&sun,4,0);sun += atoi(ssun);::WriteProcessMemory(hprocess,(LPVOID)(addr+0x5560),&sun,4,0);

改变金币数

再其次是改变金币数，金币数地址是0x006A9EC0 + 0x82c+ 0x28

（注：实际金币数为该地址的值乘上10后的结果）

CString smoney;DWORD money = 0;m_edit2.GetWindowText(smoney);//改变金币数::ReadProcessMemory(hprocess,(LPVOID)(baseaddr),&addr,4,0);::ReadProcessMemory(hprocess,(LPVOID)(addr+0x82c),&addr,4,0);::ReadProcessMemory(hprocess,(LPVOID)(addr+0x28),&money,4,0);money += atoi(smoney)/10;::WriteProcessMemory(hprocess,(LPVOID)(addr+0x28),&money,4,0);

CD循环清零

再接着是CD循环清零，每个格子CD地址0x006A9EC0 + 0x768+ 0x144 +(0x70+0x50i) (0<=i<10)

（注：(0x70+0x50i)表示括号内为直接运算即可）

先在构造函数处添加如下代码

hthread = INVALID_HANDLE_VALUE;

再在按钮事件添加如下代码

//判断是否启动/终止CD循环清零if(m_check1.GetCheck() == 1 && hthread == INVALID_HANDLE_VALUE){hthread = CreateThread(NULL,0,hackthread,&hprocess,0,NULL);}else if(m_check1.GetCheck() != 1 && hthread != INVALID_HANDLE_VALUE){TerminateThread(hthread,0);hthread = INVALID_HANDLE_VALUE;}

DWORD _stdcall hackthread(LPVOID lpparam){const int baseaddr = 0x006A9EC0;HANDLE hprocess = *((HANDLE*)lpparam);int value = 1;int addr;while(true){ReadProcessMemory(hprocess,(LPVOID)(baseaddr),&addr,4,0);ReadProcessMemory(hprocess,(LPVOID)(addr+0x768),&addr,4,0);ReadProcessMemory(hprocess,(LPCVOID)(addr+0x144),&addr,4,0);for(int i = 0;i < 10;i++)//利用循环每次加50，循环10次实现10个方框无冷却{WriteProcessMemory(hprocess,(LPVOID)(addr+0x70+(0x50)*i),&value,4,0);}}return 0;}