[经验分享]c++builder ide下(F9)和单独运行程序的区别,附赠-植物大战僵尸锁定阳光(代码)

hemiya 2011-10-13 09:10:09

加精

今天研究点注入其它进程的东西,拿植物大战僵尸练手,做好后在ide下运行就可以,单独运行就不行

自己仔细检查了代码也没发现什么问题,后来想到了可能是程序权限的问题,后来把程序权限提升,问题搞定.

c++builder ide下(F9)和单独运行程序的区别,最起码有程序权限的问题,以后遇到这类问题的童鞋,可以提升权限试试

编译好的文件

植物大战僵尸锁定阳光程序文件

程序源代码



// h

//---------------------------------------------------------------------------

#ifndef MainFormFMH

#define MainFormFMH

//---------------------------------------------------------------------------

#include <Classes.hpp>

#include <Controls.hpp>

#include <StdCtrls.hpp>

#include <Forms.hpp>

#include <ExtCtrls.hpp>

//---------------------------------------------------------------------------

class TMainForm : public TForm

{

__published:	// IDE-managed Components

	TButton *btnLock;

	TButton *btnAbout;

	TTimer *tmrSun;

	void __fastcall btnAboutClick(TObject *Sender);

	void __fastcall btnLockClick(TObject *Sender);

	void __fastcall tmrSunTimer(TObject *Sender);



public:		// User declarations

	__fastcall TMainForm(TComponent* Owner);

	__fastcall ~TMainForm();



private:	// User declarations

	void __fastcall SetProcessToken(HANDLE processH, const String &tokenName);

	DWORD __fastcall GetProcessID(const String &procName);

	DWORD mPID;

	HANDLE mPIDH;

	int mSun;

	int *mSunPtr;

	int mSunPtrAdd;

	bool mLock;

};

//---------------------------------------------------------------------------

extern PACKAGE TMainForm *MainForm;

//---------------------------------------------------------------------------

#endif



// cpp

//---------------------------------------------------------------------------

#include <vcl.h>

#pragma hdrstop



#include "MainFormFM.h"

//---------------------------------------------------------------------------

#pragma package(smart_init)

#pragma resource "*.dfm"

TMainForm *MainForm;

//---------------------------------------------------------------------------

__fastcall TMainForm::TMainForm(TComponent* Owner)

	: TForm(Owner), mLock(false), mPID(0)

{

}

//---------------------------------------------------------------------------

__fastcall TMainForm::~TMainForm()

{

	if (mLock)

		CloseHandle(mPIDH);

}

//---------------------------------------------------------------------------

void __fastcall TMainForm::btnAboutClick(TObject *Sender)

{

	ShowMessage(_T("锁定阳光 2011-10-30 cnhemiya@gmail.com"));

}

//---------------------------------------------------------------------------

void __fastcall TMainForm::btnLockClick(TObject *Sender)

{

	SetProcessToken(GetCurrentProcess(), SE_DEBUG_NAME);



	if (!mLock)

	{

		mPID = GetProcessID(_T("PlantsVsZombies.exe"));



		if (mPID == NULL)

		{

            ShowMessage(_T("植物大战僵尸进程没有找到!"));

			return;

		}





		mPIDH = OpenProcess(PROCESS_ALL_ACCESS , false, mPID);

		btnLock->Caption = _T("停止锁定");

		mLock = true;



		mSunPtr = (int *)0x00FE8330; // 0x00FE8330 初始指针地址

		ReadProcessMemory(mPIDH, mSunPtr, &mSunPtrAdd, 4, NULL);

		mSunPtr = (int *)(mSunPtrAdd + 0x5560); // 0x5560 偏移

	}

	else

	{

		btnLock->Caption = _T("锁定阳光");

		mLock = false;

		CloseHandle(mPIDH);

		mPID = 0;

	}



	tmrSun->Enabled = mLock;

}

//---------------------------------------------------------------------------

void __fastcall TMainForm::tmrSunTimer(TObject *Sender)

{

	ReadProcessMemory(mPIDH, mSunPtr, &mSun, 4, NULL);

	Caption = _T("锁定阳光 - ") + IntToStr(mSun);



	if (mSun < 9000)

	{

		mSun = 9999;

		WriteProcessMemory(mPIDH, mSunPtr, &mSun, 4, NULL);

	}

}

//---------------------------------------------------------------------------

void __fastcall TMainForm::SetProcessToken(HANDLE processH, const String &tokenName)

{

	HANDLE tokenH;

	TOKEN_PRIVILEGES tokenPs;



	OpenProcessToken(processH, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &tokenH);

	LookupPrivilegeValue(NULL, tokenName.c_str(), &tokenPs.Privileges[0].Luid);



	tokenPs.PrivilegeCount = 1;

	tokenPs.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;

	AdjustTokenPrivileges(tokenH, false, &tokenPs, NULL, NULL, NULL);

}

//---------------------------------------------------------------------------

DWORD __fastcall TMainForm::GetProcessID(const String &procName)

{

	HANDLE snapHand; // 快照句柄

	PROCESSENTRY32 process; // 进程结构

	bool ret; // 是否找到进程标志

	DWORD procID = 0; // 进程id



	snapHand = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL);

	process.dwSize = sizeof(PROCESSENTRY32);

	ret = Process32First(snapHand, &process);

	// 遍历所有进程

	while (ret)

	{



		if (procName == process.szExeFile)

		{

			procID = process.th32ProcessID;

			break;

		}



		ret = Process32Next(snapHand, &process);

	}



	CloseHandle(snapHand); // 关闭快照句柄

	return procID;

}