原创从来没人公开的秘密 D3D HOOK的捷径.docx
- 文档编号:6237258
- 上传时间:2023-01-04
- 格式:DOCX
- 页数:30
- 大小:23.72KB
原创从来没人公开的秘密 D3D HOOK的捷径.docx
《原创从来没人公开的秘密 D3D HOOK的捷径.docx》由会员分享,可在线阅读,更多相关《原创从来没人公开的秘密 D3D HOOK的捷径.docx(30页珍藏版)》请在冰豆网上搜索。
原创从来没人公开的秘密D3DHOOK的捷径
【原创】从来没人公开的秘密D3DHOOK的捷径
看雪安全论坛>Windows>『编程技术』>【原创】从来没人公开的秘密-----D3DHOOK的捷径
PDA
查看完整版本:
【原创】从来没人公开的秘密-----D3DHOOK的捷径
页:
[1]
2
chengqiyan2014-06-28,22:
46:
23D3DHOOK,googlebaidu一大把的东西,要么是劫持的,要么是硬编码的,我介绍一种通吃各个系统DX版本的方法分为EXE和DLL,DLL采用驱动注入,然后内存重载DLL并且抹PE标志。
EXE通过FileMap与游戏内存中的DLL通信,主要是通信一些D3D偏移部分代码是内存的所以只发关键:
confused:
表达有限看不懂勿喷
EXE层:
cpp
#ifndef_FINDDNF_H
#include
#include//#include"Find.h"
//#include"MyOcr.h"
//#include"GobalStruct.h"//MOMO命令目标
#includetypedefstruct_ImeMessage
{
boolIsSendIme;
charSendStr[102400];
LONGSendImeLenth;
}MyImeStr,*PMyImeStr;
typedefstruct_FindPicdx
{charFindPicDx_Path[1024];
intFindPic_simmin;
intFindPic_simmax;
intFindPic_x1;
intFindPic_x2;
intFindPic_y1;
intFindPic_y2;
intFindPic_RetX;
intFindPic_RetY;
intFindPic_Retsim;}FindPicdx,*PFindPicdx;typedefstruct_SendKey
{
intHasDownKey;
boolIsSendKey;
BYTESendGameDxKeyDate[0xed];
}SendKey,*PSendKey;typedefstruct_SendMouse
{
boolIsSendMouse;
intx;
inty;
}SendMouse,*PSendMouse;
typedefstruct_KuoZan
{
boolIsHookGetSelfWindow;
boolIsHookGetCurSor;}Kuozan,*Pkuozan;
typedefstruct_MyDic
{
charDic1Path[256];
charDic2Path[256];
boolIsloadOk;
}MyDic,*PMyDic;typedefstruct_MyShowDic
{
charStrname[256];
intDicIndex;
boolIsshowDic;
}MyShowDic,*PMyShowDic;
/*
BSTRMOMO:
:
FindStrII(
LONGIndex,
LONGDicIndex
LONGX1,
LONGY1,
LONGX2,LONGY2,
LPCTSTRStrName,
LPCTSTRColorStr,
VARIANT*FindCout)
*/
typedefstruct_MyFindDxStr
{
intDicIndex;
intX1;
intY1;
intX2;
intY2;
charStrnameS[256];
charColors[256];
intRetFindHows;//返回的数据,找到多少字
charRetStr[1024];
boolIsFindOk;}MyFindDxStr,*PMyFindDxStr;typedefstruct_Test_XY
{
intX;
intY;
boolIsOk;}TESTXY,*PTESTXY;
typedefstruct_RENWU_GOTO_XY
{
intX;
intY;
intZ;}RENWU_GOTO_XY,*PRENWU_GOTO_XY;
typedefstruct_Wupinsub
{
WCHARName[50];
intShuLiang;
WCHARLeiXingName1[50];
intLv;
intZhongLiang;
WCHARZhongLeiName[50];//魔法封印此处字符串是"1"未启用崩溃
intNaiJiu;//当前耐久}Wupinsub,*PWupinsub;typedefstruct_WupinAll
{
WupinsubJinBi_FuHuo[3];
WupinsubKuaiJieLan[6];
WupinsubZhuangBeiLan[56];
WupinsubXiaoHaoLan[56];
WupinsubCaiLiaoLan[56];
WupinsubRenWuLan[48];}WupinAll,*PWupinAll;
typedefstruct_SmallCangku
{
WupinsubCangku[6];}SmallCangku,*PSmallCangku;typedefstruct_CurZhuangBei
{
WupinsubWuqi;
WupinsubShangYi;
WupinsubHuJian;
WupinsubXiaZhuang;
WupinsubXieZi;
WupinsubYaoDai;WupinsubHuWan;
WupinsubJieZhi;
WupinsubXiangLian;}CurZhuangBei,*PCurZhuangBei;typedefstruct_GetLv_Name_Info
{
intLevel;
WCHARName[200];
intPilao;
intCurFuzhong;
intMaxFuzhong;
}GetLv_Name_Info;typedefstruct_XiGuai_GOTO_XY
{
intX;
intY;}XiGuai_GOTO_XY,*PXiGuai_GOTO_XY;typedefstruct_3S
{
intBIG;
intSMALL;}SSS3,*P3S;typedefstruct_ZhiYe
{
BOOLIsGetZhiYe;
WCHARZhiye[256];}ZhiYe,*PZhiYe;
typedefstruct_DATA_TO_DX
{intBind_moshi;
intBind_moshi_KEY;
boolNeedWait;
booliscpu;
intcpu_sleepTime;
boolIsScreen;
charScreenPath[1024];
HWNDthisWindow;
HWNDMYWINDOWS;
boolIsFindPic_QuanPing;
charFindPci_Path[1024];
boolBegin_CF;
DWORDD3D_44;//SetTransform偏移量
DWORDD3D_17;//Present偏移量
DWORDD3D_81;
DWORDD3D_82;//DrawIndexedPrimitive偏移量
DWORDD3D_65;//DrawIndexedPrimitive偏移量
boolIs_Bind2_ok;
boolIs_Bind1_ok;
boolIs_Bind_KEY1_ok;
boolIsScreenXY;
intx1;
intx2;
inty1;
inty2;
boolIS_FindPicDX;
FindPicdxfindPicdx_struct;
boolIS_FindPicDX_XY;
FindPicdxfindPicdx_xy_struct;
MyImeStrmyImeMessage;
HWNDImeHwnd;
DWORDD3DKEY_9;
DWORDD3DKEY_10;
DWORDUnacquire_8;
DWORDSetCooperativeLevel_13;
SendKeyDxKeyTogame;
SendMouseDxMouseTogame;
KuozanSuperKuozan;
POINTMOUSE_MOVE_WINDOWS;
MyDicmydic;
MyShowDicmyshowdic;
MyFindDxStrmyDxStr;
BYTEASM_CODE[1024];
intAsm_code_len;
TESTXYTestXY;
intGuaiwuShuliang;
intWUPUN_WULIANG;
BOOLISXIGUAI;
BOOLISXIWU;
RENWU_GOTO_XYRENWU_XY;
WupinAllGameBeiBao;
GetLv_Name_InfoName_Lv;
boolIsChuShou;
CurZhuangBeicurzb;
boolIsXiuli;
boolIsadd_Liliang;
intliliang;
boolIsRetTili;
intRettili;
intTili;
intLv;
boolIsGetName_Lv_Pilao;
boolIsGetJinbi;
intjinbi;
BOOLIsGetBeibao;
BOOLIsGetCurZhuangBei;
BOOLIsEndXiuLiMaiWu;
BOOLIsBeginXiuliMaiWu;
intXiuliMaiwuWat;
BOOLIsGetGuaiwuShuliang;
BOOLIsGetWupinShuLiang;
BOOLIsShunyibefor;
BOOLIsShunyi;
intShunyi_Fangxiang;
BOOLIsSetXiGuaiFangXiang;
intXiGuaiFangXiang;
BOOLIs3S;
XiGuai_GOTO_XYGuai_add_xy;
BOOLISGETFANGXIANG;
intRetGetFangXiang;
boolIsSet3s;
SSS3sss;
boolIsAddDuli;
intDuli_Value;
boolIsAddJingShen;
intJingShen_Value;
boolIsAddZL;
intZL_Value;
boolIsRuoGuai;
boolIsTest;
boolIsSY;
DWORDsdjz;
DWORDfx;
DWORDCallBase;
BOOLIs_GetCangku;
SmallCangkuGameCanuku;
intPrintTest;
BOOLISGOTOXY;
intXIGUAI_TYPE;//吸怪类型1排队2移到怪物那
ZhiYezhiye;}DATA_TO_DX,*PDATA_TO_DX;classMyMOMO
{
public:
MyMOMO();
~MyMOMO();
HANDLEFile_Maping_HANDLE;
PDATA_TO_DXdata;//绑定后就用它来更新控制数据
DATA_TO_DXNewData;//用来存放初始化的不可以是指针哦
LPVOIDFileMapDATA;
HWNDThehwnd;
DWORDProcessid;
charFileName[1024];
boolIsBind;
LONGBindWindow(HWNDhwnd,LONGBIND_MOSHI,LONGBIND_MOSHI_KEYBORD);
voidSendTo_Game(DATA_TO_DX*data);
//MyFindmyfind;
//MyOcrmyocr[2];
//KeyArrayMapKeymap;
voidGetWuPinArray();
voidGetCurZhungbeiArray();
protected:
private:
};classMOMO{public:
MOMO();
//virtual~MOMO();
MyMOMOmomo1[1];
IplImage*imagelistWindow;ULONG_PTRBind_shuliang;
ULONG_PTRBind_index;
LONGMOMO:
:
Ready1(LONGIndex,LONGHwnd,char*show,char*Key_Bord,char*HELP);
LONGLoadDic(LONGIndex,char*DicPath,LONGDicIndex);//由于DNF,所以只在前台加载字库,即本进程加载字库。
LONGShowDic(LONGIndex,LONGDicIndex,char*StrName);//把字库指定文字显示为图片
BOOLScreenShot_DxForce(LPDIRECT3DDEVICE9lpDevice,HWNDhWnd,char*fileName);//DX前台截图HWND=0
IplImage*GetFroceDxPic_Dnf(LPDIRECT3DDEVICE9lpDevice,HWNDhWnd);//DX前台获取图像并返回图像那块内存
LONGFindStrOne_DNF(LONGIndex,char*StrName,char*RGB_STR,int*RetX,int*RetY,LONGDicIndex);
LONGFindStrOne_DNF_XY(LONGIndex,char*StrName,byteR,byteG,byteB,intX1,intY1,intX2,intY2,int*RetX,int*RetY,LONGDicIndex,CAtlString&SaveRet,int*FindCout);
LONGFindStr_DNF_XY_OCR(LONGIndex,byteR,byteG,byteB,intX1,intY1,intX2,intY2,int*RetX,int*RetY,LONGDicIndex,CAtlString&SaveRet,int*FindCout);//ocr功能
LONGMOMO:
:
FindStrOne_DNF_XY_YUZHIHUA(LONGIndex,char*StrName,intThrow,intX1,intY1,intX2,intY2,int*RetX,int*RetY,LONGDicIndex,CAtlString&SaveRet,int*FindCout);
//////////////////////////////////////////////////////////////////////////};//////////////////////////////////////////////////////////////////////////
/************************************************************************/
/*
用于DNF找图写的功能函数,通用
正在完善...
沫D
*/
/************************************************************************//************************************************************************/
/*
提供2张图片,第一张大,第二张小,然后载入内存查找。
可直接屏幕查找
参数1:
第一张图片的内存,
2:
第二图片内存
3:
返回找到的X
4:
返回找到的Y
返回值:
没找到返回0,找到返回1
测试连续查找3次耗时47毫秒
*/
/************************************************************************/
//使用系统截图键一次图,参数,截图保存的地方
boolKeyDownPrint_Screen(char*SavePicPath);#define_FINDDNF_H
#endif.H
#include"stdafx.h"
#include"FindDnf.h"
#include
//#include"Find.h"
//#include"MyMouseKey.h"
//#include"ImeInject.h"
#include
#include
#include
#defineDIRECTINPUT_VERSION0x0800//本来800改700
#include
//#include"OlsApi.h"
//#include"Cdmsoft1.h"
//#include"NTFUNCTION.h"
MyMOMO:
:
~MyMOMO()
{
if(this->data!
=NULL)
{
OutputDebugStringA("unreset");
UnmapViewOfFile(this->data);
}}
MyMOMO:
:
MyMOMO()
{this->data=NULL;
NewData.Is_Bind2_ok=FALSE;
NewData.Is_Bind1_ok=FALSE;
NewData.Is_Bind_KEY1_ok=FALSE;
NewData.NeedWait=false;
NewData.iscpu=FALSE;
this->IsBind=FALSE;
this->NewData.cpu_sleepTime=0;
this->NewData.IsScreen=FALSE;
this->NewData.IsScreenXY=FALSE;
this->NewData.DxKeyTogame.IsSendKey=FALSE;memset(&NewData.DxKeyTogame,0,sizeof(SendKey));
memset(&NewData.SuperKuozan,0,sizeof(Kuozan));
memset(&NewData.DxMouseTogame,0,sizeof(SendMouse));
memset(NewData.ScreenPath,0,1024);
memset(NewData.FindPci_Path,0,1024);
memset(NewData.findPicdx_struct.FindPicDx_Path,0,1024);
memset(NewData.findPicdx_xy_struct.FindPicDx_Path,0,1024);
memset(NewData.myImeMessage.SendStr,0,102400);
NewData.myImeMessage.IsSendIme=FALSE;
NewData.myImeMessage.SendImeLenth=0;
this->NewData.IsFindPic_QuanPing=FALSE;
this->NewData.Begin_CF=FALSE;
this->NewData.IS_FindPicDX=FALSE;/*
this->NewData.IS_FindPicDX_XY=FALSE;
this->NewData.findPicdx_struct.FindPic_Retsim=-1;
this->NewData.findPicdx_struct.FindPic_x1=-1;
this->NewData.findPicdx_xy_struct.FindPic_simmax=-1;
*/}voidMyMOMO:
:
SendTo_Game(DATA_TO_DX*data)
{/*memcpy(this->FileMapDATA,data,sizeof(DATA_TO_DX));*/
FlushViewOfFile(this->FileMapDATA,sizeof(DATA_TO_DX));}LPVOIDGetClassVirtualFnAddress(LPVOIDpthis,intIndex)//Add2010.8.6
{
LPVOIDFnAddress;*(int*)&FnAddress=*(int*)pthis;//lpvtable
*(int*)&FnAddress=*(int*)((int*)FnAddress+Index);
returnFnAddress;
}
LPDIRECT3D9g_pD3D=NULL;//UsedtocreatetheD3DDevice
LPDIRECT3DDEVICE9g_pd3dDevice=NULL;//Ourrenderingdevice
HRESULTInitD3D1(HWNDhWnd)
{
//CreatetheD3Dobject.
if(NULL==(g_pD3D=Direct3DCreate9(D3D_SDK_VERSION)))
returnE_FAIL;//SetupthestructureusedtocreatetheD3DDevice
D3DPRESENT_PARAMETERSd3dpp;
ZeroMemory(&d3dpp,sizeof(d3dpp));
d3dpp.Windowed=TRUE;
d3dpp.SwapEffect=D3DSWAPEFFECT_DISCARD;
d3dpp.BackBufferFormat=D3DFMT_UNKNOWN;//CreatetheD3DDevice
if(FAILED(g_pD3D->CreateDevice(D3DADAPTER_DEFAULT,D3DDEVTYPE_HAL,hWnd,
D3DCREATE_SOFTWARE_VERTEXPROCESSING,
&d3dpp,&g_pd3dDevice)))
{
AfxMessageBox("CreateDeviceerro");
returnE_FAIL;
}returnS_OK;
}LPDIRE
- 配套讲稿:
如PPT文件的首页显示word图标,表示该PPT已包含配套word讲稿。双击word图标可打开word文档。
- 特殊限制:
部分文档作品中含有的国旗、国徽等图片,仅作为作品整体效果示例展示,禁止商用。设计者仅对作品中独创性部分享有著作权。
- 关 键 词:
- 原创从来没人公开的秘密 D3D HOOK的捷径 原创 从来 没人 公开 秘密 HOOK 捷径