某游戏无限视距检测绕过

XiaoTouM1ng

代码是几个版本之前的代码了，现在用不了了，主要是让大家看下思路

#pragma once
#include "pch.h"

DWORD 游戏主模块 = (DWORD)GetModuleHandle("League of Legends.exe");
DWORD 无限视距检测1 = (DWORD)GetModuleHandle("ACE-PBC-Game32.dll") + 0x162859;
DWORD 无限视距检测2 = (DWORD)GetModuleHandle("ACE-PBC-Game32.dll") + 0x16708C;

BOOL 过无限视距检测() {
    char Buffer[50] = { 0 };
    float *视距大小 = new float;
    DWORD* Jmp = new DWORD;
    DWORD* Jmp1 = new DWORD;
    DWORD* Jmp2 = new DWORD;
    DWORD* Jmp3 = new DWORD;
    *视距大小 = 2250.00f;

    BYTE ShellCode[] = {
        0xF3,0x0F,0x10,0x05,0x78,0x56,0x34,0x12,
        0xF3,0x0F,0x11,0x45,0xEC,
        0xFF,0x25,0x71,0x56,0x4f,0x11
    };
    memcpy(ShellCode+4, &视距大小,sizeof(DWORD*));

    *Jmp = 无限视距检测1 + 0x6;
    memcpy(ShellCode + 15, &Jmp, 4);
    LPVOID Address = VirtualAlloc(NULL, sizeof(ShellCode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (Address == 0) {
        return FALSE;
    }

    memcpy(Address, ShellCode, sizeof(ShellCode));

    *Jmp1 = 无限视距检测2 + 0x6;
    memcpy(ShellCode + 15, &Jmp1, 4);

    LPVOID Address2 = VirtualAlloc(NULL, sizeof(ShellCode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
    if (Address == 0) {
        return FALSE;
    }
    memcpy(Address2, ShellCode, sizeof(ShellCode));

    BYTE HookCode[] = {
        0xFF,0x25,0x78,0x56,0x34,0x12,0x90,0x90,0x90,0x90
    };

    DWORD dwBuffer = 0;
    if (!VirtualProtect((LPVOID)(无限视距检测1 - 0x100), 1024, PAGE_EXECUTE_READWRITE, &dwBuffer)) {

        MessageBox(NULL, "修改属性错误!", "title", MB_OK);
        wsprintf(Buffer,"Error : %d",GetLastError());
        MessageBox(NULL, Buffer, "title", MB_OK);
    }

    *Jmp2 = (DWORD)Address;
    memcpy((VOID*)(HookCode+2), &Jmp2, sizeof(DWORD*));
    memcpy((VOID*)无限视距检测1,HookCode, sizeof(HookCode));

    VirtualProtect((LPVOID)(无限视距检测2-0x100), 1024, PAGE_EXECUTE_READWRITE, &dwBuffer);
    *Jmp3 = (DWORD)Address2;
    memcpy((VOID*)(HookCode + 2), &Jmp3, sizeof(DWORD*));
    memcpy((VOID*)无限视距检测2, HookCode, sizeof(HookCode));
}

BOOL 开启无限视距(DWORD 主模块地址) {

    DWORD 基础地址 = *(DWORD*)(主模块地址 + 0x18243f8);
    DWORD 一级偏移 = *(DWORD*)(基础地址 + 0x0C);
    DWORD 二级偏移 = *(DWORD*)(一级偏移 + 0x25C);
    float* 最大视距 = (float*)(二级偏移 + 0x28);
    *最大视距 = 9999.99f;

    if (*最大视距 == 9999.99f) {
        return TRUE;
    }

    return FALSE;
}

BOOL 关闭无限视距(DWORD 主模块地址) {

    DWORD 基础地址 = *(DWORD*)(主模块地址 + 0x18243f8);
    DWORD 一级偏移 = *(DWORD*)(基础地址 + 0x0C);
    DWORD 二级偏移 = *(DWORD*)(一级偏移 + 0x25C);
    float* 最大视距 = (float*)(二级偏移 + 0x28);
    *最大视距 = 2250.00f;

    if (*最大视距 == 2250.00f) {
        return TRUE;
    }

    return FALSE;
}

qiujun268998898

最近在学习写外挂,看了下大佬的代码,给大家解释下大佬过检测姿势.
检测无限视距肯定是检测视距倍率.
所以这里把这段检测hook了返回给检测点了正常的倍率,不知道我理解对不对.

叶子暄

zpt2lq 发表于 2021-10-9 17:56
没有具体点么？比喻某农药还是某联盟

进程名都在那了还不够具体啊

zpt2lq

没有具体点么？比喻某农药还是某联盟

GJH588

LXL现在还有搞这个的？我记得刚出的时候视距火了一段时间

qiujun268998898

666 大佬牛逼

涛之雨

感谢分享，但是硬生生把C艹写出来易语言的风味确实有点emmm接地气

北小神

感谢发布原创作品，吾爱破解论坛因你更精彩！

Duduyoi

牛啊 大佬大佬