声明：本系列文章由网络转载，
转载来源未知，
版权属于原作者，特此声明。
1
通过C语言编写一个游戏要加载的系统DLL文件(lpk.dll)，其中假DLL包含劫持功能和作弊功能且拥有相同的导出函数，将该假DLL放入游戏相同目录下，游戏打开时会自动加载该假DLL，使游戏直接包含作弊功能。
设计思路分析
对象分析
要用的函数介绍
编写测试效果
总体评价
设计思路分析
-
构造一个与系统目录下LPK.DLL一样的导出表
-
加载系统目录下的LPK.DLL
-
将导出函数转发到系统目录下的LPK.DLL上
-
在初始化函数中加入我们要执行的代码
对象分析
注：本次游戏对象为Super Mario XP
没有更新所以可用任意版本 ，
试玩发现人物血量最大为10，心最大为99，命最大为99。
要用的函数介绍
__asm{ }
执行括号内的汇编代码
JMP EAX
将EIP跳转到EAX执行，劫持DLL后要获取真正的原函数地址，使用时要进行跳转
编写测试效果
将生成的mylpk和作弊模块放入游戏目录，并改mylpk名为lpk
打开游戏
直接打开游戏即可,发现此时游戏已具备作弊效果(锁定血量)
工具查看加载模块
发现cheatDLL模块已加载入游戏，说明lpk劫持成功
WIN7下劫持
在WIN7下要劫持只需稍修改注册表即可
//
// 05简单DLL劫持(作弊模块DLL部分)
// C/C++
//
#include <windows.h>
#define Dllfunciton extern "C" __declspec(dllexport) //以C方式导出
Dllfunciton void lockdata();
Dllfunciton DWORD WINAPI inject(LPVOID);
void lockdata() {
while (true) {
DWORD hp = 10;
DWORD heart = 99;
DWORD life = 99;
DWORD addr = 0x00428282;
DWORD addr2 = 0x00428292;
DWORD addr3 = 0x004282a2;
DWORD res = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)addr, &hp, 4, 0); //写入自身修改游戏数据
DWORD res2 = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)addr2, &heart, 4, 0);
DWORD res3 = WriteProcessMemory(INVALID_HANDLE_VALUE, (LPVOID)addr3, &life, 4, 0);
Sleep(1000);
}
}
DWORD WINAPI inject(LPVOID) {
lockdata();
return true;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch(ul_reason_for_call) {
case DLL_PROCESS_ATTACH: {
::DisableThreadLibraryCalls(hModule); //创建线程包含死循环，为防卡死必须设置
CreateThread(NULL, 0, inject, NULL, 0, NULL);
}
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
default:;
}
return true;
}
//
// 05简单DLL劫持(假LPK模块部分)
// C/C++
//
#include <windows.h>
#include <stdlib.h>
#define Dllfunciton extern "C" __declspec(dllexport) //以C方式导出
#pragma comment(linker, "/EXPORT:LpkInitialize=_gamehacker_LpkInitialize,@1") //设置导出表
#pragma comment(linker, "/EXPORT:LpkTabbedTextOut=_gamehacker_LpkTabbedTextOut,@2")
#pragma comment(linker, "/EXPORT:LpkDllInitialize=_gamehacker_LpkDllInitialize,@3")
#pragma comment(linker, "/EXPORT:LpkDrawTextEx=_gamehacker_LpkDrawTextEx,@4")
#pragma comment(linker, "/EXPORT:LpkExtTextOut=_gamehacker_LpkExtTextOut,@6")
#pragma comment(linker, "/EXPORT:LpkGetCharacterPlacement=_gamehacker_LpkGetCharacterPlacement,@7")
#pragma comment(linker, "/EXPORT:LpkGetTextExtentExPoint=_gamehacker_LpkGetTextExtentExPoint,@8")
#pragma comment(linker, "/EXPORT:LpkPSMTextOut=_gamehacker_LpkPSMTextOut,@9")
#pragma comment(linker, "/EXPORT:LpkUseGDIWidthCache=_gamehacker_LpkUseGDIWidthCache,@10")
#pragma comment(linker, "/EXPORT:ftsWordBreak=_gamehacker_ftsWordBreak,@11")
char syslpk[250] = {0};
HMODULE hmodule;
FARPROC funcaddr = NULL;
FARPROC WINAPI GetAddress(PCSTR pszProcName) { //从真正lpk.dll中找需要调用的真正函数地址
funcaddr = GetProcAddress(hmodule, pszProcName);
return funcaddr;
}
Dllfunciton gamehacker_LpkInitialize() { //找真正函数地址后跳转
GetAddress("LpkInitialize");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkTabbedTextOut() {
GetAddress("LpkTabbedTextOut");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkDllInitialize() {
GetAddress("LpkDllInitialize");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkDrawTextEx() {
GetAddress("LpkDrawTextEx");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkEditControl() {
GetAddress("LpkEditControl");
__asm jmp DWORD ptr [EAX];
}
Dllfunciton gamehacker_LpkExtTextOut() {
GetAddress("LpkExtTextOut");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkGetCharacterPlacement() {
GetAddress("LpkGetCharacterPlacement");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkGetTextExtentExPoint() {
GetAddress("LpkGetTextExtentExPoint");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkPSMTextOut() {
GetAddress("LpkPSMTextOut");
__asm JMP EAX;
}
Dllfunciton gamehacker_LpkUseGDIWidthCache() {
GetAddress("LpkUseGDIWidthCache");
__asm JMP EAX;
}
Dllfunciton gamehacker_ftsWordBreak() {
GetAddress("ftsWordBreak");
__asm JMP EAX;
}
BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
switch(ul_reason_for_call) {
case DLL_PROCESS_ATTACH: {
GetSystemDirectory(syslpk, 250);
strcat(syslpk, "\lpk");
hmodule = LoadLibrary(syslpk); //加载真正系统lpk.dll
::LoadLibrary("cheatDLL"); //加载作弊模块lpk.dll
} break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
case DLL_PROCESS_DETACH:
break;
default:;
}
return true;
}
总体评价
DLL劫持可以在不用手动加载外挂,在运行游戏时自动加载作弊功能。
本文始发于微信公众号（inn0team）：C语言游戏外挂(五)：简单 DLL 劫持
- 左青龙
- 微信扫一扫
-
- 右白虎
- 微信扫一扫
-
评论