dll注入,多开,多线程

 

//首先创建dll~~这个没什么说的~~我也是抄习论坛里某位高手的(不好意思不记得名字了)~

library dllProject1;

{ Important note about DLL memory management: ShareMem must be the
  first unit in your library's USES clause AND your project's (select
  Project-View Source) USES clause if your DLL exports any procedures or
  functions that pass strings as parameters or function results. This
  applies to all strings passed to and from your DLL--even those that
  are nested in records and classes. ShareMem is the interface unit to
  the BORLNDMM.DLL shared memory manager, which must be deployed along
  with your DLL. To avoid using BORLNDMM.DLL, pass string information
  using PChar or ShortString parameters. }

uses
  Windows,
  Messages,
  SysUtils,
  Variants,
  Classes,
  Graphics,
  Controls,
  Forms,
  Dialogs,
  StrUtils,
  dllUnit1 in 'dllUnit1.pas' {dllfrom1},
  threadUnit1 in 'threadUnit1.pas';

var
  hhk:HHOOK=0;
  homd:pointer;
  hthread:thandle;
//--------------------------勾子子程-----------------------------------
  function hookpro(ncode:integer;wparam:WPARAM;lparam:LPARAM):LRESULT;stdcall;
label
  toexit;
begin
  if ncode<0 then goto toexit;
  if ncode<>HC_ACTION then goto toexit;
  if (LPARAM and $80000000)=0 then goto toexit;
  if WPARAM=VK_F12 then
  begin
    if dllfrom1<>nil then
    begin
      if dllfrom1.Visible=true then
        dllfrom1.hide
      else
        dllfrom1.Show;
    end
    else
      dllfrom1:=Tdllfrom1.Create(application);
  end;
  toexit:
  result:=CallNexthookex(hhk,ncode,wparam,lparam);
end;
//--------------------------安装勾子-----------------------------------
function hookon(han:hwnd):longint;stdcall;export;
begin
  hthread:=getwindowthreadprocessid(han,homd);
  if hthread<>0 then hhk:=setwindowshookex(WH_KEYBOARD,@HOOKPRO,hinstance,hthread);
  result:=hhk;
end;
//--------------------------关闭勾子-----------------------------------
function hookoff():boolean;stdcall;export;
begin
  if hhk<>0 then
  begin
    unhookwindowshookex(hhk);
    hhk:=0;
    result:=true;
  end
  else
    result:=false;
end;

{$R *.res}
  exports hookon,hookoff;
begin
end.

 

再下来就是在DLL里创建一个窗口~这个窗口就是我们注入后在游戏中呼出的窗口~游戏的主要功能都在这个窗口中实现;

unit dllUnit1;

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;

type
  Tdllfrom1 = class(TForm)
    Label1: TLabel;
    Label2: TLabel;
    Button1: TButton;
    Button2: TButton;
    Button3: TButton;
    procedure Button1Click(Sender: TObject);
    procedure hp();
    procedure Button2Click(Sender: TObject);
    procedure Button3Click(Sender: TObject);

  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  dllfrom1: Tdllfrom1;
  hhp:boolean=false;
  baseaddr:pointer;
const
  jz:cardinal=$981b34;
implementation
uses threadunit1;
var
  thread1:rw;//声明线程变量~~

{$R *.dfm}

//-----------------------------取人名-------------------------------------------
procedure Tdllfrom1.Button1Click(Sender: TObject);
var
  name:string;
  name1:dword;
begin
  name1:=pdword(jz)^;
  name1:=pdword(name1+$1c)^;
  name1:=pdword(name1+$24)^;
  name1:=pdword(name1+$3d8)^;
  name:=pwidechar(name1);
  dllfrom1.caption:=name;
end;
//-----------------取人物HP过程-------------------------------------------
procedure Tdllfrom1.hp();
var
  rw_hp:cardinal;
begin
  while hhp do
  begin
    rw_hp:=pdword(pdword(pdword(pdword($981b34)^+$1c)^+$24)^+$260)^;
    label2.caption:=inttostr(rw_hp);
    sleep(1000);
  end;
end;
//----------------------汇篇取人物血-------------------------------------------

//--------------------------------加载人物线程显血-----------------------------
procedure Tdllfrom1.Button2Click(Sender: TObject);
begin
  if hhp=false then
  begin
    hhp:=true;
    thread1:=rw.create;//创建线程~~
  end else
    hhp:=false;
end;

{procedure Tdllfrom1.Button3Click(Sender: TObject);//这个不用看~想实现HOOK人物HP~但没成功(这个太难了~看得)~在论坛上听兔哥说在这篇文章里看~~http://www.ghoffice.com/bbs/read-htm-tid-63001-keyword-%D2%D1%B7%E8%BF%F1.html
var
  dllmodule:Hmodule;
begin
  //dllmodule:=GetModuleHandle(Pchar('dllProject1.dll'));
  //BaseAddr:=Pointer(GetProcAddress(DllModule,PChar('jx1')));
  pbyte($00456088)^:=$e8;
  //pdword($00456089)^:=baseaddr;
  pbyte($0045608e)^:=$90;
end;}

end.

 

接下来再创建一个工程~~窗体上有一个列表框各两个按钮~程序一启动就自动读取游戏人名显示在列表框中,选中后点'开始游戏'按钮注入~~在游戏中按F12呼出开始在dll中创建的窗体;

unit Unit1

interface

uses
  Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
  Dialogs, StdCtrls;

type
  TForm1 = class(TForm)
    ListBox1: TListBox;
    Button1: TButton;
    Button2: TButton;
    procedure FormCreate(Sender: TObject);
    procedure Button1Click(Sender: TObject);
    procedure FormDestroy(Sender: TObject);
    procedure FormClose(Sender: TObject; var Action: TCloseAction);
    procedure Button2Click(Sender: TObject);
  private
    { Private declarations }
  public
    { Public declarations }
  end;

var
  Form1: TForm1;
  function hookon(hwn:hwnd):longint;stdcall;external 'dllproject1.dll';
  function hookoff():boolean;stdcall;external 'dllproject1.dll';
  function GetTitle(hhwnd:thandle;param:pointer):boolean;stdcall;
var
  id:array[0..10]of hwnd;
  x:cardinal=0;
  hhk:longint;
const
  jz:dword=$00981b34;
implementation

{$R *.dfm}

//enumwindows函数的参数~用来读出所有武林窗体的句柄~并显示游戏人名;
function GetTitle(hhwnd:thandle;param:pointer):boolean;stdcall;
var
  text:string;
  dd:cardinal;
  hid:thandle;
  name:cardinal;
  nname:array[0..15]of widechar;
begin
  setlength(text,100);
  getwindowtext(hhwnd,pchar(text),100);
  if pchar(text)='Element Client' then//找到是武林窗体的就写入列表框
  begin
    id[x]:=hhwnd;//把窗口句柄保存在数组ID中
    x:=x+1;
    getwindowthreadprocessid(hhwnd,@dd);
    hid:=openprocess(PROCESS_ALL_ACCESS,false,dd);
    readprocessmemory(hid,pointer(jz),@name,4,dd);
    readprocessmemory(hid,pointer(name+$1c),@name,4,dd);//取人名
    readprocessmemory(hid,pointer(name+$24),@name,4,dd);
    readprocessmemory(hid,pointer(name+$3d8),@name,4,dd);
    readprocessmemory(hid,pointer(name+0),@nname,16,dd);
    form1.listbox1.items.Add(nname);
    closehandle(hid);//关闭打开的进程;
  end;
end;
//------------------窗口载入----------------------------------------------------
procedure TForm1.FormCreate(Sender: TObject);
begin
  listbox1.Items.Clear;
  enumwindows(@gettitle,0);
end;
//-------------------刷新列表框-------------------------------------------------
procedure TForm1.Button1Click(Sender: TObject);
begin
  listbox1.Items.Clear;
  enumwindows(@gettitle,0);
end;
//------------------------程序退出---------------------------------------------
procedure TForm1.FormDestroy(Sender: TObject);
begin
  if hhk<>0 then hookoff();
end;

procedure TForm1.FormClose(Sender: TObject; var Action: TCloseAction);
begin
  if hhk<>0 then hookoff();
end;
//-----------------------注入--------------------------------------------------

procedure TForm1.Button2Click(Sender: TObject);
var
i:integer;
begin
  if listbox1.Items.Count>0 then//列表框总数大于0~也就是要打开游戏~
  begin
    if listbox1.itemindex<>-1 then//已经选择了要注入的游戏~
    begin
      i:=listbox1.ItemIndex;
      hhk:=hookon(id[i]);//提取数组中的句柄~注入游戏~
      showmessage('已注入，请在游戏内按下F12');
    end
    else
      showmessage('请选择要注入的游戏');
  end
  else
    showmessage('请打开游戏');
end;

 

end.

OK了~~下面是在DLL窗体中创建的一个线程~用来显示人物HP~这个没什么说的~.

unit threadUnit1;

interface

uses
  Classes;

type
  rw = class(TThread)
  private
    { Private declarations }
  protected
    procedure Execute; override;
  public
    constructor create;
  end;

implementation

{ Important: Methods and properties of objects in visual components can only be
  used in a method called using Synchronize, for example,

      Synchronize(UpdateCaption);

  and UpdateCaption could look like,

    procedure rw.UpdateCaption;
    begin
      Form1.Caption := 'Updated in a thread';
    end; }

{ rw }
uses dllunit1;
constructor rw.create;
begin
  inherited create(false);
end;
procedure rw.Execute;
begin
  { Place thread code here }
  dllfrom1.hp;//线程创建调用HP函数显血`~
end;

end.