- 注册时间
- 2012-4-3
- 最后登录
- 1970-1-1
该用户从未签到
|
本帖最后由 syspol 于 2012-4-4 19:53 编辑
如题:能实现选怪,但是选完后挂就死了;
源码:
type
TForm1 = class(TForm)
btn1: TButton;
btn2: TButton;
procedure btn2Click(Sender: TObject);
private
{ Private declarations }
public
{ Public declarations }
end;
Param=packed record
param1:Single;
param2:Single;
end;
//测试用
procedure runCall();
var
addr : Pointer;
begin
addr:=Pointer($004f0f20);//基址
asm
pushad
pushad
push 101
push $3D
mov ecx,$093CD010
call addr
popad //恢复寄存器环境
end;
end;
procedure InjectFunc(InHWND: HWND; Func: Pointer; Param: Pointer; ParamSize: DWORD); //
var
hProcess_N: THandle;
ThreadAdd, ParamAdd: Pointer;
hThread: THandle;
ThreadID: DWORD;
lpNumberOfBytes: DWORD;
begin
GetWindowThreadProcessId(InHWND, @ThreadID); //PID
hProcess_N := OpenProcess(PROCESS_ALL_ACCESS, False, ThreadID);//打开被注入的进程
ThreadAdd := VirtualAllocEx(hProcess_N, nil, 4096, MEM_COMMIT, PAGE_READWRITE); //在目标进程建立内存空间
WriteProcessMemory(hProcess_N, ThreadAdd, Func, 4096, lpNumberOfBytes); //写入函数地址
ParamAdd := VirtualAllocEx(hProcess_N, nil, ParamSize, MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(hProcess_N, ParamAdd, Param, ParamSize, lpNumberOfBytes); //写入参数地址
hThread := CreateRemoteThread(hProcess_N, nil, 0, ThreadAdd, ParamAdd, 0, lpNumberOfBytes); //创建远程线程
ResumeThread(hThread); //运行远端线程
WaitForSingleObject(hThread, INFINITE);//等待线程结束
VirtualFreeEx(hProcess_N, ThreadAdd, 4096, MEM_RELEASE); //释放申请的内存空间
VirtualFreeEx(hProcess_N, ParamAdd, ParamSize, MEM_RELEASE); //释放申请的地址
CloseHandle(hThread); // 关闭远程线程
end;
procedure TForm1.btn2Click(Sender: TObject);
var
MyHwnd,PID:HWND;
PHND: THandle;
CallParam: Param;
begin
MyHwnd:=FindWindow(nil,'完美世界国际版');
GetWindowThreadProcessId(MyHwnd,@PID); //得到窗口ID
PHND := OpenProcess(PROCESS_ALL_ACCESS, False,PID);//以完全访问权限打开进程句柄
InjectFunc(MyhWnd,@runCall,@CallParam,SizeOf(CallParam)); //运行注入代码函数
CloseHandle(PHND); //关闭打开的句柄
end;
高手看看、啥问题啊?
就这句 hThread := CreateRemoteThread(hProcess_N, nil, 0, ThreadAdd, ParamAdd, 0, lpNumberOfBytes); //创建远程线程
出问题,但是不明白为什么; |
|