[C] 纯文本查看 复制代码 #include <stdio.h>
#include <windows.h>
char buf[100];
int main(int argc, char *argv[]){
STARTUPINFO si = {0};
PROCESS_INFORMATION pi = {0};
CreateProcess(NULL, "crackme.exe", NULL, NULL, FALSE, 0, NULL, NULL, &si, &pi);
printf("pid %08x, hProc %08x\n",pi.dwProcessId,pi.hProcess);
LPVOID lp=0;
DWORD r;
//0040F739 68 00 00 02 00 E8 03 00 00 00 CC
char patch[]="\x68\x00\x00\x02\x00\xE8\x03\x00\x00\x00\xCC";
WriteProcessMemory(pi.hProcess,0x40F739,patch,sizeof(patch)-1,&r);
for(;;){
Sleep(200);
ReadProcessMemory(pi.hProcess,0x20000,buf,sizeof(buf),&r);
if(buf[0]||!r){
puts(buf);
break;
}
}
CloseHandle(pi.hProcess);
system("pause");
}
实现了一个更优雅的算法,XP-WIN7通用
WIN10未测 |