第四例：修改游戏内存

当然这个在书上已经有了很多的解释，今天也太晚了，所以不再赘述，直接贴代码了。

我的和书上的是不大一样的，这个是你可以输入你想要修改的程序名称，之后查找值，最后修改。

如下：

#include<stdio.h>
#include<string.h>
#include<stdlib.h>
#include<windows.h>
#include<tlhelp32.h>

//预定义区
#define ONEPAGE 4096
#define ONEGB 1024*1024*1024

//全局定义区
HANDLE g_hProcess;
DWORD g_arList[1024];
DWORD g_nList;
bool FindFirst(DWORD dwValue);
bool FindNext(DWORD dwValue);

//一般函数区
bool CompareAPage(DWORD dwAddrBase,DWORD dwValue)
{
    BYTE arList[4096];
    bool bRet = false;
    if(g_hProcess == NULL)
    {
        return bRet;
    }
    if( !::ReadProcessMemory(g_hProcess,(LPCVOID)dwAddrBase,arList,4096,NULL) )
        return bRet;
    for(int i = 0;i<ONEPAGE-3;i++)
    {
        int temp = *((int*)(arList+i));
        if( temp == dwValue )
        {
            g_arList[g_nList++] = (DWORD)(dwAddrBase+i);
            bRet = true;
        }
    }
    return bRet;
}
bool FindFirst(DWORD dwValue)
{
    const DWORD OnePage = 4*1024;
    const DWORD OneGb = 1024*1024*1024;
    OSVERSIONINFO vi = {sizeof(vi)};
    bool bRet = false;
    ::GetVersionEx(&vi);
    for(
        DWORD dwBase = (vi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS?4*1024*1024:64*1024);
        dwBase<2*OneGb;
        dwBase += OnePage
        )
        {
            if(CompareAPage(dwBase,dwValue))
            {
                bRet = true;
            }
        }
        
        return bRet;
}
bool FindNext(DWORD dwValue)
{
    DWORD m_nList = g_nList;
    g_nList = 0;
    bool bRet = false;
    DWORD dwTemp;
    for(int i = 0;i<m_nList;i++)
    {
        if(::ReadProcessMemory(g_hProcess,(LPCVOID)g_arList[i],&dwTemp,sizeof(dwTemp),NULL))
        {
            if(dwTemp == dwValue)
            {
                g_arList[g_nList++] = g_arList[i];
                bRet = true;
            }
        }
    }
    
    return bRet;
}
void ShowList()
{
    for(int i = 0;i<g_nList;i++)
    {
        printf("%08X
",g_arList[i]);
    }
}
bool WriteMemory(LPVOID lpvAddr,DWORD dwValue)
{
    return ::WriteProcessMemory(g_hProcess,lpvAddr,(LPCVOID)&dwValue,sizeof(dwValue),NULL);
}
HANDLE SearchFromName(const char*cName)
{
    PROCESSENTRY32 pe32;
    pe32.dwSize = sizeof(pe32);
    HANDLE hSnapshotProcess = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
    if(hSnapshotProcess == INVALID_HANDLE_VALUE)
    {
        return NULL;
    }
    bool bMore = ::Process32First(hSnapshotProcess,&pe32);
    printf("%s
",pe32.szExeFile);
    while(bMore)
    {
        printf("%s
",pe32.szExeFile);
        if(strcmp(pe32.szExeFile,cName) == 0)
        {
            return ::OpenProcess(PROCESS_ALL_ACCESS,false,pe32.th32ProcessID);
        }
        bMore = ::Process32Next(hSnapshotProcess,&pe32);
    }
    return NULL;
}
int main(int argc,char* argv[])
{
    char szNameExeFile[30];
    DWORD dwValue;
    scanf("%s",szNameExeFile);
    g_hProcess = SearchFromName(szNameExeFile);
    if(g_hProcess == NULL)
    {
        printf("Not useful handle!
");
        system("pause");
        return 0;
    }
    scanf("%d",&dwValue);
    g_nList = 0;
    FindFirst(dwValue);
    ShowList();
    while(g_nList > 2)
    {
        scanf("%d",&dwValue);
        FindNext(dwValue);
        ShowList();
    }
    printf("Success!
And The Value you want to change is:");
    scanf("%d",&dwValue);
    WriteMemory((LPVOID)g_arList[0],dwValue);
    return 0;
}

测试程序是这个：

#include<stdio.h>
int g_nNum;
int main(int argc,char* argv[])
{
    int i = 198;
    g_nNum = 1003;
    
    while(1)
    {
        printf("i = %d,addr = %08X;  g_nNum = %d,addr = %08X
",++i,&i,--g_nNum,&g_nNum);
        getchar();
    }
    return 0;
}