第一步：确定外挂类型

首先，模拟键盘输入被首先排除了，因为听说用这种方法必须要游戏始终为前台窗口，这样做的话，就不可能多开刷副本了。

然后考虑远线程代码注入，这方法比较简单，不需要DLL文件的支持。但是我试了很多次，每次注入线程以后，CreateRemoteThread的时候我的挂就会崩溃……

以调用选怪CALL为例，代码如下：

 

bool gjwin::InjectRemoteFunc(DWORD dwProcId, LPVOID mFunc, LPVOID pRemoteParam, DWORD ParamSize){HANDLE hProcess;LPVOID ThreadAdd;LPVOID ParamAdd = NULL;HANDLE hThread = NULL;DWORD lpNumberOfBytes;BOOL BO;ThreadAdd = mFunc;hProcess = OpenProcess(PROCESS_ALL_ACCESS,FALSE,dwProcId);//打开被注入的进程//AfxMessageBox(_T("准备开辟进程空间"));ThreadAdd = VirtualAllocEx(hProcess,NULL,4096,MEM_COMMIT | MEM_RESERVE,PAGE_EXECUTE_READWRITE); if (!ThreadAdd) { AfxMessageBox(_T("没能开辟进程空间")); return FALSE; }//AfxMessageBox(_T("开辟进程空间成功，准备开辟进程参数空间"));BO = WriteProcessMemory(hProcess,ThreadAdd,mFunc,4096, &lpNumberOfBytes); //写入函数地址if(ParamSize!=0){ParamAdd = VirtualAllocEx(hProcess,NULL,ParamSize, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);if (!ParamAdd) {AfxMessageBox(_T("没能开辟进程参数空间"));return FALSE;}BO = WriteProcessMemory(hProcess, ParamAdd, pRemoteParam, ParamSize, &lpNumberOfBytes); //写入参数地址}//AfxMessageBox(_T("开辟进程参数空间成功，准备创建远进程"));hThread = CreateRemoteThread(hProcess, NULL,0,(LPTHREAD_START_ROUTINE)ThreadAdd, ParamAdd, 0,&lpNumberOfBytes); //创建远程线程 //每次到这里就崩溃if (!hThread) { AfxMessageBox(_T("没能创建远进程~~~"));VirtualFreeEx(hProcess, ThreadAdd, 4096, MEM_RELEASE);if(ParamSize!=0){VirtualFreeEx(hProcess, ParamAdd, ParamSize, MEM_RELEASE); //释放申请的地址}CloseHandle(hThread); return FALSE; }else{WaitForSingleObject(hThread, INFINITE);//等待线程结束 VirtualFreeEx(hProcess, ThreadAdd, 4096, MEM_RELEASE);if(ParamSize!=0){VirtualFreeEx(hProcess, ParamAdd, ParamSize, MEM_RELEASE); //释放申请的地址}CloseHandle(hThread);//CloseHandle(hProcess);return TRUE;}}void __stdcall CallSelectMonster(DWORD * dwMonsterID){DWORD sn = * MonsterID;const DWORD dwSelMonsterAddr = 0x00599450;const DWORD dwCallBaseAddr = 0x009BA89C;__asm{PUSHADMOV ECX,dwCallBaseAddrMOV EAX,DWORD PTR DS:[ECX]MOV ESI,DWORD PTR DS:[EAX+0x20] //ESI=ROLE_FINALL_ADDRMOV EDI, sn //MOV DWORD PTR DS:[ESI+0x000009E4],EDI //怪物ID存入目标ID地址+4PUSH EDIMOV ECX,dwCallBaseAddrMOV EAX,DWORD PTR DS:[ECX]MOV ECX,DWORD PTR DS:[EAX+0x20]ADD ECX,0x000000ECMOV EBX, dwSelMonsterAddrCALL EBXPOPAD}}void gjwin::SelectMonster(DWORD ProcessId, DWORD dwMonsterID){DWORD * m_pMonsterID = & MonsterID ;//调用注入函数InjectRemoteFunc(ProcessId,CallSelectMonster,m_pMonsterID,sizeof(*m_pMonsterID));}SelectMonster(ProcId,Monster.ID);
也不知道是我做得不对还是完美限制了这种方法……想想也许是禁止了吧，看别人做的挂基本都是用到了DLL的。

 

没办法，那我也改用DLL吧，结果如何，下次试过再说吧……