外挂编程

开发平台：
Visual C++

MH.h：源码内容
							
//SimpleWc3Hack for Warcraft 3 Patch 1.22...
#include <windows.h>
#include <Tlhelp32.h>
DWORD GetPIDForProcess (TCHAR* process);
void EnableDebugPriv();
DWORD GetDLLBase(TCHAR* DllName, DWORD tPid);
#define PATCH(i,w,l) WriteProcessMemory(hProc,reinterpret_cast<LPVOID>(gameBase+i),w,l,&dSize)
typedef void (*pTextFun)(LPCTSTR);
#define LOG(s) if (text) text(s)
int startMH(pTextFun text)
{
	LOG(_T("SimpleWc3Hack v1.0 by wyuzhu loaded!"));
	LOG(_T("Searching Wc3..."));
	if(GetPIDForProcess(_T("War3.exe")) == 0)
	{
		LOG(_T("Warcraft 3 was not found..."));
		return 0;
	}
	else
	{
		LOG(_T("Getting debug privileges..."));
		EnableDebugPriv();
		LOG(_T("Opening Warcraft 3 Process..."));
		HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, false, GetPIDForProcess(_T("War3.exe")));
		if(hProc)
		{
			LOG(_T("Process opened... Patching"));
			DWORD gameBase = GetDLLBase(_T("Game.dll"), GetPIDForProcess(_T("War3.exe")));
			DWORD dSize = 0;
			PATCH(0x406B4F,"x09x90",2); //Patch 6F3A04AB to nop nop :-)
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showunitsingame"));
			}
			PATCH(0x406B54,"x09x90",2);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showunitsmap"));
			}
			PATCH(0x147C12,"x40x33xC0",3);  
			if(dSize == 0)
			{
				LOG(_T("Failed to patch clickableunits"));
			}
			PATCH(0x147C17,"x41x33xC9",3);  
			if(dSize == 0)
			{
				LOG(_T("Failed to patch clickableunits (2nd patch)"));
			}
			PATCH(0x1486F4,"x41x33xC9",3);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch revealillu"));
			}
			PATCH(0x1486FB,"x41x33xC9",3);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch removefogingame"));
			}
			PATCH(0x2A0923,"x40x33xC0x42x33xD2",6);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch pingsigna"));
			}
			PATCH(0x1ACFFC,"x40xC3",2);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showinvisibleingame"));
			}
			PATCH(0x7D4E8,"x90x90x90x90xB8x01x00",7);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showinvisiblemap"));
			}
			PATCH(0x1491A8,"x00",1);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showinvisiblemap"));
			}
			PATCH(0x1494E0,"x39",1);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showinvisiblemap"));
			}
			PATCH(0x1494E3,"x85",1);
			if(dSize == 0)
			{
				LOG(_T("Failed to patch showinvisiblemap"));
			}
			CloseHandle(hProc);
			LOG(_T("Done, goodbye!"));
			return 1;
		}
		else
		{
			LOG(_T("Warcraft 3 could not be opened..."));
			return 0;
		}
	}
	return 0;
}
//Queries the ProcessId of a certain process
DWORD GetPIDForProcess (TCHAR* process)
{
	BOOL			working = 0;
	PROCESSENTRY32 lppe = {0};
	DWORD			targetPid = 0;
	HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
	if (hSnapshot) 
	{
		lppe.dwSize = sizeof(lppe);
		working = Process32First(hSnapshot, &lppe);
		while (working)
		{
			if(wcscmp(lppe.szExeFile, process) == 0)
			{
				targetPid = lppe.th32ProcessID;
				break;
			}
			working = Process32Next(hSnapshot, &lppe);
		}
	}
	CloseHandle( hSnapshot );
	return targetPid;
}
//Enables to open other processes
void EnableDebugPriv()
{
	HANDLE hToken;
	LUID sedebugnameValue;
	TOKEN_PRIVILEGES tkp;
	if ( ! OpenProcessToken( GetCurrentProcess(),
		TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
		return;
	if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ){
		CloseHandle( hToken );
		return;
	}
	tkp.PrivilegeCount = 1;
	tkp.Privileges[0].Luid = sedebugnameValue;
	tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
	if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
		CloseHandle( hToken );
} 
//Gets the base of our dll
DWORD GetDLLBase(TCHAR* DllName, DWORD tPid)
{
	HANDLE snapMod;  
	MODULEENTRY32 me32;
	if (tPid == 0) return 0;
	snapMod = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, tPid);  
	me32.dwSize = sizeof(MODULEENTRY32);  
	if (Module32First(snapMod, &me32)){ 
		do{
			if (wcscmp(DllName,me32.szModule) == 0){ 
				CloseHandle(snapMod); 
				return (DWORD) me32.modBaseAddr; 
			}
		}while(Module32Next(snapMod,&me32));
	}
	CloseHandle(snapMod); 
	return 0;  
}

						