本帖最后由 xiaobang 于 2013-4-10 22:26 编辑
只为解释我不是飘零专业户更不是网络验证专业户,这些是大牛级别的人玩的,小菜玩不动,更不想玩,这个工具只是群内的好友需要,不是为了炫耀甚么,某人心态请摆正,正好之前也有一定的研究..
[C++] 纯文本查看 复制代码
HANDLE hProcess=OpenProcess(PROCESS_ALL_ACCESS,NULL,ProcessID);//打开进程
if (hProcess==INVALID_HANDLE_VALUE)
{
MessageBox("打开进程失败!","",MB_ICONERROR);
return;
}
BYTE FinOld[12]={0x8B,0x45,0xEC,0x33,0xC9,0x50,0x8D,0x45,0xE8,0x8B,0xD8,0x58};//特征码
BYTE CurOld[12];//读取当前字节
for (int i = 0x00401000;i<0x00500000;i++)//一般都是在0040为base的这个代码段
{
ReadProcessMemory(hProcess,(LPVOID)i,&CurOld,12,NULL);//读取12个字节
if (!memcmp(FinOld,CurOld,12))//与定义的特征码比较
{
break; //符合要求,跳出循环
}
}
//下面就是获取密码.对着飘零验证程序看吧.
i=i-0x3f;
int base;
ReadProcessMemory(hProcess,(LPVOID)i,&base,4,NULL);
ReadProcessMemory(hProcess,(LPVOID)base,&base,4,NULL);
base=base + 4;
DWORD NumValue=0;
ReadProcessMemory(hProcess,(LPVOID)base,&NumValue,4,NULL);
base=base+4;
DWORD Temp=0;
DWORD size= NumValue *4;
DWORD dWsize=base +size;
CString TempValue;
CString PassWord;
for (UINT p=base;p<dWsize;)
{
ReadProcessMemory(hProcess,(LPVOID)p,&Temp,4,0);
// Temp=Temp/65536;
TempValue.Format("%d",Temp);
PassWord= PassWord + TempValue;
p=p+4;
}
MessageBox(PassWord);//弹出密码
CloseHandle(hProcess);//关闭句柄
|