C#读写内存,编写《植物大战僵尸》外挂

1、最近闲来无事发现周围的朋友都在玩植物大战僵尸的游戏！于是动了制作这游戏工具的念头！虽然在网上同类工具很多 但是用C#写的我几乎看不到！所以我想用C#写一个！ 首先用CE或者OD或者其他反汇编工具找出游戏的内存基址！ 游戏内存基址：base = 0x006A9EC0 游戏阳光地址：base+0x768+0x5560 游戏金钱地址：base+0x82C+0x28 游戏关卡地址：base+0x82C+0x24 /关卡如：A-B 实际值为：（A-1）10B至于如何获取这些地址不在我们这论坛研究的范围中！对了我是用工具vs2008编写的！新建窗体：C# codeusing System;using Sy

2、stem.Drawing;using System.Text;usingnamespace PlantsVsZombiesTool / / / public partial class Form1 : Form public Form1() InitializeComponent(); private void Form1_Load(object sender, EventArgs e) /启动无线阳光 private void btnGet_Click(object sender, EventArgs e) if (Helper.GetPidByProcessName(processName

3、) = 0) MessageBox.Show(哥们启用之前游戏总该运行吧！); return; if (btnGet.Text = 启用-阳光无限) timer1.Enabled = true; btnGet.Text = 关闭-阳光无限; else timer1.Enabled = false; btnGet.Text = 启用-阳光无限; private void timer1_Tick(object sender, EventArgs e) if (Helper.GetPidByProcessName(processName) = 0) timer1.Enabled = false; b

4、tnGet.Text = 启用-阳光无限; int address = ReadMemoryValue(baseAddress); /读取基址(该地址不会改变) address = address + 0x768; /获取2级地址 address = ReadMemoryValue(address); address = address + 0x5560; /获取存放阳光数值的地址 WriteMemory(address, 0x1869F); /写入数据到地址（0x1869F表示99999） timer1.Interval = 1000; /启动无线金钱 private void btnMon

5、ey_Click(object sender, EventArgs e) if (Helper.GetPidByProcessName(processName) = 0) MessageBox.Show(哥们启用之前游戏总该运行吧！); return; if (btnMoney.Text = 启用-金钱无限) timer2.Enabled = true; btnMoney.Text = 关闭-金钱无限; else timer2.Enabled = false; btnMoney.Text = 启用-金钱无限; private void timer2_Tick(object sender, Ev

6、entArgs e) if (Helper.GetPidByProcessName(processName) = 0) timer2.Enabled = false; btnMoney.Text = 启用-金钱无限; int address = ReadMemoryValue(baseAddress); /读取基址(该地址不会改变) address = address + 0x82C; /获取2级地址 address = ReadMemoryValue(address); address = address + 0x28; /得到金钱地址 WriteMemory(address, 0x1869

7、F); /写入数据到地址（0x1869F表示99999） timer2.Interval = 1000; private void btnGo_Click(object sender, EventArgs e) if (Helper.GetPidByProcessName(processName) = 0) MessageBox.Show(哥们启用之前游戏总该运行吧！); return; int address = ReadMemoryValue(baseAddress); /读取基址(该地址不会改变) address = address + 0x82C; /获取2级地址 address =

8、ReadMemoryValue(address); address = address + 0x24; int lev = 1; try lev = int catch MessageBox.Show(输入的关卡格式不真确！默认设置为1); WriteMemory(address, lev); /读取制定内存中的值 public int ReadMemoryValue(int baseAdd) return Helper.ReadMemoryValue(baseAdd, processName); /将值写入指定内存中 public void WriteMemory(int baseAdd,

9、int value) Helper.WriteMemoryValue(baseAdd, processName, value); private int baseAddress = 0x006A9EC0; /游戏内存基址 private string processName = PlantsVsZombies; /游戏进程名字 下面这个类是整个工具的核心C# codeusing System;using System.Text;using System.Diagnostics;usingnamespace PlantsVsZombiesTool public abstract class He

10、lper DllImportAttribute(kernel32.dll, EntryPoint = ReadProcessMemory) public static extern bool ReadProcessMemory ( IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int nSize, IntPtr lpNumberOfBytesRead ); DllImportAttribute(kernel32.dll, EntryPoint = OpenProcess) public static extern IntPtr

11、OpenProcess ( int dwDesiredAccess, bool bInheritHandle, int dwProcessId ); DllImport(kernel32.dll) private static extern void CloseHandle ( IntPtr hObject ); /写内存 DllImportAttribute(kernel32.dll, EntryPoint = WriteProcessMemory) public static extern bool WriteProcessMemory ( IntPtr hProcess, IntPtr

12、lpBaseAddress, int lpBuffer, int nSize, IntPtr lpNumberOfBytesWritten ); /获取窗体的进程标识ID public static int GetPid(string windowTitle) int rs = 0; Process arrayProcess = Process.GetProcesses(); foreach (Process p in arrayProcess) if1) rs = p.Id; break; return rs; /根据进程名获取PID public static int GetPidByPr

13、ocessName(string processName) Process arrayProcess = Process.GetProcessesByName(processName); foreach (Process p in arrayProcess) return p.Id; return 0; /根据窗体标题查找窗口句柄（支持模糊匹配） public static IntPtr FindWindow(string title) Process ps = Process.GetProcesses(); foreach (Process p in ps) if1) return p.Ma

14、inWindowHandle; return IntPtr.Zero; /读取内存中的值 public static int ReadMemoryValue(int baseAddress,string processName) try byte buffer = new byte4; IntPtr byteAddress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0); /获取缓冲区地址 IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName); ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 4, IntPtr.Zero); /将制定内存中的值读入缓冲区 CloseHandle(hProcess); return Marshal.ReadInt32(byteAddress); catch return 0; /将值写入指定内存地址中 public static void WriteMemoryValue(int baseAddress,