使用Python對FPS游戲讀寫操作

image

最近復(fù)習(xí)之余，復(fù)盤了一下之前搞的FPS熱感透視，通過單機游戲?qū)崿F(xiàn)成功。

搜索步驟

1.進入觀戰(zhàn)模式按 X

開啟后的效果，可以看到全部人都在發(fā)光，并且實現(xiàn)了透視效果

image

在按一次X就是關(guān)閉

這樣子啥都看不到了

image

2.打開CE，開始搜索

image

步驟：

發(fā)光搜1

image

不發(fā)光搜0

image

重復(fù)上述步驟，到最后就會剩下10幾條，把它全部添加到代碼表，從第一條開始查找訪問

image
image

就會看到有箭頭所指的代碼訪問，選擇這串代碼，顯示反匯編程序，觀察匯編代碼。

image
mov [ecx+edx*8+24],bl 這條語句，若bl為1，則開啟人物發(fā)光，為0則關(guān)閉，所以
這里搜索ecx，可以找到指向ecx的指針，我這里就叫做發(fā)光基址吧。。
edx是一個人物的類似ID的玩意兒，向上看，可以知道 lea edx,[esi*8+00000000]
sub edx,esi
而esi是在這里賦值的mov esi,[edi+0000a428] ，這個edi其實就是人物基址。
??
發(fā)光地址 = 發(fā)光對象地址+[人物基址 + 0xa428]*0x38+0x24

快捷鍵F5下斷，接著點擊箭頭所指ECX，將其值復(fù)制。

image

搜索框中，選擇4字節(jié)，勾選十六進制，將ECX的值粘貼進去，點擊搜索，會出來兩個綠色的基址，就是靜態(tài)基址，兩個選其一，添加到基址表中

image

dll + xxxx里 的xxx 這個就是發(fā)光基址

image

開關(guān)找到了，接下來就是處理顏色

顏色的ARGB分別是這4條代碼：

3EC7A0F7 - F3 0F11 44 C8 04      - movss [eax+ecx*8+04],xmm0
3EC7A0FD - F3 0F10 45 D0         - movss xmm0,[ebp-30]
3EC7A102 - F3 0F11 44 C8 08      - movss [eax+ecx*8+08],xmm0
3EC7A108 - F3 0F10 45 D4         - movss xmm0,[ebp-2C]
3EC7A10D - F3 0F11 44 C8 0C      - movss [eax+ecx*8+0C],xmm0
3EC7A1D1 - F3 0F11 44 C8 10      - movss [eax+ecx*8+10],xmm0

xmm0 是float 型

代碼編寫

image

1.導(dǎo)入庫

# -*- coding:utf-8 -*-
"""
@author: 
@file: ReadCs.py
@time: 2020-05-12 21:07
@desc: KeyboArd
"""
import win32process#進程模塊
from win32con import PROCESS_ALL_ACCESS #Opencress 權(quán)限
import win32api#調(diào)用系統(tǒng)模塊
import ctypes#C語言類型
from win32gui import FindWindow#界面

kernel32 = ctypes.windll.LoadLibrary("kernel32.dll")
GetLastError = kernel32.GetLastError

2.封裝函數(shù)

def _GetProcessId(className,windowName):
    hGameWindow = FindWindow(className, windowName)
    pid = win32process.GetWindowThreadProcessId(hGameWindow)[1]
    return pid

def _GetPorcessHandle(pid):
    hGameHandle = win32api.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
    return hGameHandle

def _ReadMemeryInt(hGameHandle,_address,bufflength):
    addr = ctypes.c_ulong()
    ReadProcessInt = kernel32.ReadProcessMemory
    ReadProcessInt(int(hGameHandle), _address, ctypes.byref(addr), bufflength, None)
    return addr.value


def WriteMemeryInt(hGameHandle, _address, Data):
    WriteProcessInt = kernel32.WriteProcessMemory
    WriteProcessInt(int(hGameHandle),_address,ctypes.byref(ctypes.c_ulong(Data)), 4, None)
    return Data

def WriteMemeryFloat(hGameHandle, _address,Data):
    WriteProcessInt = kernel32.WriteProcessMemory
    WriteProcessInt(int(hGameHandle),_address,ctypes.byref(ctypes.c_float(Data)),4,None)
    return Data

詳情看前面幾章

使用Python讀寫游戲1

使用Python讀寫游戲2

3.創(chuàng)建全局變量

moduleName = 0x3EF90000 //這是client_panorama.dll是一個動態(tài)地址，每次重上游戲或者重啟都會變
dwOwnObj = 0xD2FB94 //人物基址
dwEntityList = 0x4D43AC4 //對象基址
dwGlowObjectManager = 0x528B8A0 // 發(fā)光基址
m_iGlowIndex = 0xA428 // 發(fā)光首部
m_iTeamNum = 0xF4 //陣營偏移
m_Hp = 0x100 //血量偏移

4.先進行讀取操作測試

def _ReadHp(hGameHandle, baseAddr):
    Hp = _ReadMemeryInt(hGameHandle, baseAddr + m_Hp, 4)
    return Hp
def _ReadTemp(hGameHandle, baseAddr):
    Temp =  _ReadMemeryInt(hGameHandle, baseAddr + m_iTeamNum, 4)
    return Temp  

def main():
    ProcessId = _GetProcessId("Valve001", u"****")

    _hGameHandle = _GetPorcessHandle(ProcessId)
    Addr = _ReadMemeryInt(_hGameHandle, moduleName+dwOwnObj, 4)
    Hp = _ReadHp(_hGameHandle,Addr)
    print(Hp)
image

5.發(fā)光代碼編寫

首先了解下結(jié)構(gòu)體

這是一個關(guān)于敵人信息,包含 他的坐標(biāo) x y z 信息， id，血量，陣營，姓名等。

struct Entity
{
        PVOID entityObj;
        float x;
        float y;
        float z;
        int id;
        int Hp;
        int Temp;
        char name[10];
};

那么用Python來定義一個結(jié)構(gòu)體,因為Python 好像沒有 struct ，所以用類class來代替也可以

class Own:
    pass
own = Own()
own.Addr = _ReadMemeryInt(hGameHandle, moduleName+dwOwnObj, 4)
own.Hp = _ReadHp(hGameHandle, own.Addr)
own.Temp = _ReadTemp(hGameHandle, own.Addr)

class Entity:
    pass
Ent = Entity()
Ent.Addr = _ReadMemeryInt(hGameHandle, moduleName + dwEntityList+i*16, 4)
Ent.Hp = _ReadHp(hGameHandle, Ent.Addr)
Ent.Temp = _ReadTemp(hGameHandle, Ent.Addr)

發(fā)光地址 = 發(fā)光對象地址+[人物基址 + 0xa428]*0x38+0x24

def _dwGlowLight(hGameHandle):
   while True:
        GlowObjectManager = _ReadMemeryInt(hGameHandle, moduleName+dwGlowObjectManager, 4)
        own = Own()
        own.Addr = _ReadMemeryInt(hGameHandle, moduleName+dwOwnObj, 4)
        own.Hp = _ReadHp(hGameHandle, own.Addr)
        own.Temp = _ReadTemp(hGameHandle, own.Addr)
        # print("自己陣營：" + str(own.Temp))
        for i in range(32):
            Ent = Entity()
            Ent.Addr = _ReadMemeryInt(hGameHandle, moduleName + dwEntityList+i*16, 4)
            Ent.Hp = _ReadHp(hGameHandle, Ent.Addr)
            Ent.Temp = _ReadTemp(hGameHandle, Ent.Addr)
            glow = _ReadMemeryInt(hGameHandle, Ent.Addr+m_iGlowIndex, 4)
            if(own.Temp != Ent.Temp):
                WriteMemeryFloat(hGameHandle, (GlowObjectManager+((glow * 0x38)+4)), 1)//顏色
                WriteMemeryFloat(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 8)), 250)//顏色
                WriteMemeryFloat(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 12)), 128)//顏色
                WriteMemeryFloat(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 16)), 1)//顏色
                WriteMemeryInt(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 36)), 1)//發(fā)光開關(guān)

6.效果

image

7.完整代碼

# -*- coding:utf-8 -*-
"""
@author: 
@file: ReadCs.py
@time: 2020-05-12 21:07
@desc: KeyboArd
"""
import win32process#進程模塊
from win32con import PROCESS_ALL_ACCESS, PROCESS_VM_READ, PROCESS_VM_WRITE, PROCESS_QUERY_INFORMATION #Opencress 權(quán)限
import win32api#調(diào)用系統(tǒng)模塊
import ctypes#C語言類型
from win32gui import FindWindow#界面

kernel32 = ctypes.windll.LoadLibrary("kernel32.dll")
GetLastError = kernel32.GetLastError
moduleName = 0x3EF90000
dwOwnObj = 0xD2FB94
dwEntityList = 0x4D43AC4
dwGlowObjectManager = 0x528B8A0
m_iGlowIndex = 0xA428
m_iTeamNum = 0xF4
m_Hp = 0x100


def _GetProcessId(className,windowName):
    hGameWindow = FindWindow(className, windowName)
    pid = win32process.GetWindowThreadProcessId(hGameWindow)[1]
    return pid

def _GetPorcessHandle(pid):
    hGameHandle = win32api.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
    return hGameHandle

def _ReadMemeryInt(hGameHandle,_address,bufflength):
    addr = ctypes.c_ulong()
    ReadProcessInt = kernel32.ReadProcessMemory
    ReadProcessInt(int(hGameHandle), _address, ctypes.byref(addr), bufflength, None)
    return addr.value

def _ReadMemeryWchar(hGameHandle,_address,bufflength):
    addr = ctypes.c_wchar_p("0" * bufflength)
    ReadProcessInt = kernel32.ReadProcessMemory
    ReadProcessInt(int(hGameHandle), _address, addr, bufflength, None)
    return addr.value

def WriteMemeryInt(hGameHandle, _address, Data):
    WriteProcessInt = kernel32.WriteProcessMemory
    WriteProcessInt(int(hGameHandle),_address,ctypes.byref(ctypes.c_ulong(Data)), 4, None)
    return Data

def WriteMemeryFloat(hGameHandle, _address,Data):
    WriteProcessInt = kernel32.WriteProcessMemory
    WriteProcessInt(int(hGameHandle),_address,ctypes.byref(ctypes.c_float(Data)),4,None)
    return Data

def _ReadHp(hGameHandle, baseAddr):
    Hp = _ReadMemeryInt(hGameHandle, baseAddr + m_Hp, 4)
    return Hp

def _ReadTemp(hGameHandle, baseAddr):
    Temp =  _ReadMemeryInt(hGameHandle, baseAddr + m_iTeamNum, 4)
    return Temp

class Own:
    pass

class Entity:
    pass


def _dwGlowLight(hGameHandle):
   while True:
        GlowObjectManager = _ReadMemeryInt(hGameHandle, moduleName+dwGlowObjectManager, 4)
        own = Own()
        own.Addr = _ReadMemeryInt(hGameHandle, moduleName+dwOwnObj, 4)
        own.Hp = _ReadHp(hGameHandle, own.Addr)
        own.Temp = _ReadTemp(hGameHandle, own.Addr)
        # print("自己陣營：" + str(own.Temp))
        for i in range(32):
            Ent = Entity()
            Ent.Addr = _ReadMemeryInt(hGameHandle, moduleName + dwEntityList+i*16, 4)
            Ent.Hp = _ReadHp(hGameHandle, Ent.Addr)
            Ent.Temp = _ReadTemp(hGameHandle, Ent.Addr)
            glow = _ReadMemeryInt(hGameHandle, Ent.Addr+m_iGlowIndex, 4)
            if(own.Temp != Ent.Temp):
                WriteMemeryFloat(hGameHandle, (GlowObjectManager+((glow * 0x38)+4)), 1)
                WriteMemeryFloat(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 8)), 250)
                WriteMemeryFloat(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 12)), 128)
                WriteMemeryFloat(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 16)), 1)
                WriteMemeryInt(hGameHandle, (GlowObjectManager + ((glow * 0x38) + 36)), 1)



def main():
    ProcessId = _GetProcessId("Valve001", u"***")

    _hGameHandle = _GetPorcessHandle(ProcessId)

    _dwGlowLight(_hGameHandle)


if __name__ == '__main__':
    main()

結(jié)尾

因為每次重啟電腦后，模塊名字的動態(tài)基址都會發(fā)生變化，過幾天寫個通過模塊名稱獲取模塊基址就可以完美避免這個問題了。

目前就是因為32位游戲獲取基址操作有點難度，告辭
image

借用一句看到很不錯的話：

技術(shù)不分對錯.人性才分善惡.

學(xué)習(xí)逆向的人必須身心放正.

身心放正之人手握屠龍刀,也是保家衛(wèi)民.

image
?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請聯(lián)系作者
【社區(qū)內(nèi)容提示】社區(qū)部分內(nèi)容疑似由AI輔助生成，瀏覽時請結(jié)合常識與多方信息審慎甄別。
平臺聲明：文章內(nèi)容（如有圖片或視頻亦包括在內(nèi)）由作者上傳并發(fā)布，文章內(nèi)容僅代表作者本人觀點，簡書系信息發(fā)布平臺，僅提供信息存儲服務(wù)。

友情鏈接更多精彩內(nèi)容