一天一天学做外挂@第四天-给自己找个贴心小护士[武林外传]

 

学习目的：
1.实现简单加血功能


内容：

1.首先我们要绘制一个界面，最先添加一个Frame控件、最少两个Label控件用于输出生命和真气值、两个Text控件用于输入数据还有两个Timer控件，分别改名为TimerList及TimerAdd，最后添加一个Command控件。可以参考下图，呵呵~我知道你可以画的更好看！




2.下一步就是添加代码了，和上次一样新建一个模块，模块内容如下：
Option Explicit
'---------------声明函数-----------------------
'得到窗体句柄的函数,FindWindow函数用来返回符合指定的类名( ClassName )和窗口名( WindowTitle )的窗口句柄
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
'得到窗体控件句柄的函数
Public Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long
'得到进程标识符的函数
Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
'得到目标进程句柄的函数
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
'关闭句柄的函数
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
'读取进程内存的函数
Public Declare Function ReadProcessMemory Lib "kernel32.dll" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
'参数决定了对进程的存储权限，使用完全控制
Public Const PROCESS_ALL_ACCESS = &H1F0FFF
'发送信息的函数
Public Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Public Declare Function PostMessage Lib "user32" Alias "PostMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long
'延迟函数
Public Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)

发送消息函数和延迟函数是以前内容没有用过的，这回我们将涉及发送模拟键盘消息给窗口，所以加入这两个函数。


3.做好模块，下一步该写Form了。同样还是声明一些变量及Form_Load，代码如下：
Dim hwd As Long
Dim pid As Long
Dim hProcess As Long '存放进程句柄
Dim base As Long    '存放人物基地址
Dim hp As Long      '存储生命值
Dim hpmax As Long    '存储生命最大值
Dim mp As Long      '存储真气值
Dim mpmax As Long    '存储真气最大值

Private Sub Form_Load()
hwd = FindWindow("QElementClient Window", "Element Client")
If hwd = 0 Then
   MsgBox "未启动游戏", vbOKOnly, "提示"
   Unload Form1
End If
GetWindowThreadProcessId hwd, pid    '获取进程标识符
'将进程标识符做为参数，返回目标进程PID的句柄，得到此句柄后
'即可对目标进行读写操,PROCESS_ALL_ACCESS表示完全控制,权限最大
hProcess = OpenProcess(PROCESS_ALL_ACCESS, 0, pid)
If hProcess = 0 Then
   MsgBox "不能打开进程", vbOKOnly, "提示"
   Unload Form1
End If
CloseHandle hProcess
End Sub


4.下一步，我们通过TimerList显示人物信息，设置TimerList的Interval属性值为1000，其代码如下：
Private Sub TimerList_Timer() '显示人物信息时钟
Dim name(31) As Byte    '存储人物名称
Dim name_temp As Long

hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If hProcess Then
   ReadProcessMemory hProcess, ByVal &H8C9E54, base, 4, 0&
   ReadProcessMemory hProcess, ByVal base + &H24, base, 4, 0&      '得到为人物基地址，方便以后使用
   ReadProcessMemory hProcess, ByVal base + &H254, hp, 4, 0&      '得到生命值
   ReadProcessMemory hProcess, ByVal base + &H26C, hpmax, 4, 0&    '得到生命最大值
   ReadProcessMemory hProcess, ByVal base + &H258, mp, 4, 0&      '得到真气值
   ReadProcessMemory hProcess, ByVal base + &H270, mpmax, 4, 0&    '得到真气最大值
   ReadProcessMemory hProcess, ByVal base + &H390, name_temp, 4, 0&
   ReadProcessMemory hProcess, ByVal name_temp, name(0), 32, 0&    '得到人物名称
   CloseHandle hProcess
End If
Frame1.Caption = name    '显示人物名称
Label2.Caption = "生命值：" & hp & "/" & hpmax '显示生命值
Label3.Caption = "真气值：" & mp & "/" & mpmax '显示真气值
End Sub


现在可以运行一下看看数值是否能正常显示！

5.在来做第二个TimerAdd，设置Enabled = False，Interval属性值为100，期代码如下：
Private Sub TimerAdd_Timer()    '加血判断时钟
If Val(Text1.Text) > hp Then    '比较当前血量是否比预定值低，是则按下F1健
   SendMessage hwd, &H100, &H70, 0&    '按住F1键，&H100代表按下，&H70代表F1
   SendMessage hwd, &H101, &H70, 0&    '松开F1键，&H101代表松开，&H70代表F1
   Sleep Val(Text2.Text)    '延迟text2中的数值，用val()取数值
End If
End Sub


6.最后就剩下Command了，设置其Caption属性为“开始”，期代码如下：
Private Sub Command1_Click()
If Command1.Caption = "开始" Then    '按下标签为“开始”的按钮，激活TimerAdd并改变标签为“停止”
   TimerAdd.Enabled = True
   Command1.Caption = "停止"
ElseIf Command1.Caption = "停止" Then    '刚好和上面相反
   TimerAdd.Enabled = False
   Command1.Caption = "开始"
End If
End Sub


7.小功告成！运行测试看看，能否实现加血功能！那加蓝、补助技能呢？嘻嘻~~~




8.本次内容重点：
SendMessage /通过此函数实现模拟键盘操作功能
Sleep /必不可少的延迟函数


9.当然，你看完整个文章或者在测试的时候会发现，这个程序还有很多的漏洞或者说还可以做的更完善，没错，这就是接下来你要做的，还是那句话：“因为我知道你可以做的到”


ps:自己设置按键



SendMessage hwd, &H100, Key(Combo1.ListIndex), 0&
SendMessage hwd, &H101, Key(Combo1.ListIndex), 0&


Private Function Key(Anjian As Long) As Long '用于转换按键的函数
Select Case Anjian
   Case 0
     Key = &H70 ‘F1
   Case 1
     Key = &H71 'F2
   Case 2
     Key = &H72 'F3
   Case 3
     Key = &H73 'F4
   Case 4
     Key = &H74
   Case 5
     Key = &H75
   Case 6
     Key = &H76
   Case 7
     Key = &H77
   Case 8
     Key = &H31 '1
   Case 9
     Key = &H32 '2
   Case 10
     Key = &H33 '3
   Case 11
     Key = &H34
   Case 12
     Key = &H35
   Case 13
     Key = &H36
   Case 14
     Key = &H37
   Case 15
     Key = &H38
   Case 16
     Key = &H39 '9
   Case 17
     Key = &H30 '0
End Select
End Function