C#内存操作

最近闲来无事发现周围的朋友都在玩《植物大战僵尸》的游戏！于是动了制作这游戏工具的念头！虽然在网上同类工具很多 但是用C#写的我几乎看不到！所以我想用C#写一个！
  首先用CE或者OD或者其他反汇编工具找出游戏的内存基址！
  游戏内存基址：base = 0x006A9EC0
  游戏阳光地址：[base+0x768]+0x5560
  游戏金钱地址：[base+0x82C]+0x28
  游戏关卡地址：[base+0x82C]+0x24 //关卡如：A-B 实际值为：（A-1）×10＋B
至于如何获取这些地址不在我们这论坛研究的范围中！
对了我是用工具vs2008编写的！
新建窗体：

C# code

    
      

     
       
     
        
     
       using
     
        System; 
     
       using
     
        System.Drawing; 
     
       using
     
        System.Text; 
     
       using
     
        System.Windows.Forms; 
     
       namespace
     
        PlantsVsZombiesTool { 
     
       ///
     
        
     
       <summary>
     
        
     
       ///
     
        
     
       ///
     
        
     
       </summary>
     
        
     
        
     
       public
     
        
     
       partial
     
        
     
       class
     
        Form1 : Form { 
     
       public
     
        Form1() { InitializeComponent(); } 
     
       private
     
        
     
       void
     
        Form1_Load(
     
       object
     
        sender, EventArgs e) { } 
     
       //
     
       启动无线阳光
     
        
     
        
     
       private
     
        
     
       void
     
        btnGet_Click(
     
       object
     
        sender, EventArgs e) { 
     
       if
     
        (Helper.GetPidByProcessName(processName) 
     
       ==
     
        
     
       0
     
       ) { MessageBox.Show(
     
       "
     
       哥们启用之前游戏总该运行吧！
     
       "
     
       ); 
     
       return
     
       ; } 
     
       if
     
        (btnGet.Text 
     
       ==
     
        
     
       "
     
       启用-阳光无限
     
       "
     
       ) { timer1.Enabled 
     
       =
     
        
     
       true
     
       ; btnGet.Text 
     
       =
     
        
     
       "
     
       关闭-阳光无限
     
       "
     
       ; } 
     
       else
     
        { timer1.Enabled 
     
       =
     
        
     
       false
     
       ; btnGet.Text 
     
       =
     
        
     
       "
     
       启用-阳光无限
     
       "
     
       ; } } 
     
       private
     
        
     
       void
     
        timer1_Tick(
     
       object
     
        sender, EventArgs e) { 
     
       if
     
        (Helper.GetPidByProcessName(processName) 
     
       ==
     
        
     
       0
     
       ) { timer1.Enabled 
     
       =
     
        
     
       false
     
       ; btnGet.Text 
     
       =
     
        
     
       "
     
       启用-阳光无限
     
       "
     
       ; } 
     
       int
     
        address 
     
       =
     
        ReadMemoryValue(baseAddress); 
     
       //
     
       读取基址(该地址不会改变)
     
        
     
        address 
     
       =
     
        address 
     
       +
     
        
     
       0x768
     
       ; 
     
       //
     
       获取2级地址
     
        
     
        address 
     
       =
     
        ReadMemoryValue(address); address 
     
       =
     
        address 
     
       +
     
        
     
       0x5560
     
       ; 
     
       //
     
       获取存放阳光数值的地址
     
        
     
        WriteMemory(address, 
     
       0x1869F
     
       ); 
     
       //
     
       写入数据到地址（0x1869F表示99999）
     
        
     
        timer1.Interval 
     
       =
     
        
     
       1000
     
       ; } 
     
       //
     
       启动无线金钱
     
        
     
        
     
       private
     
        
     
       void
     
        btnMoney_Click(
     
       object
     
        sender, EventArgs e) { 
     
       if
     
        (Helper.GetPidByProcessName(processName) 
     
       ==
     
        
     
       0
     
       ) { MessageBox.Show(
     
       "
     
       哥们启用之前游戏总该运行吧！
     
       "
     
       ); 
     
       return
     
       ; } 
     
       if
     
        (btnMoney.Text 
     
       ==
     
        
     
       "
     
       启用-金钱无限
     
       "
     
       ) { timer2.Enabled 
     
       =
     
        
     
       true
     
       ; btnMoney.Text 
     
       =
     
        
     
       "
     
       关闭-金钱无限
     
       "
     
       ; } 
     
       else
     
        { timer2.Enabled 
     
       =
     
        
     
       false
     
       ; btnMoney.Text 
     
       =
     
        
     
       "
     
       启用-金钱无限
     
       "
     
       ; } } 
     
       private
     
        
     
       void
     
        timer2_Tick(
     
       object
     
        sender, EventArgs e) { 
     
       if
     
        (Helper.GetPidByProcessName(processName) 
     
       ==
     
        
     
       0
     
       ) { timer2.Enabled 
     
       =
     
        
     
       false
     
       ; btnMoney.Text 
     
       =
     
        
     
       "
     
       启用-金钱无限
     
       "
     
       ; } 
     
       int
     
        address 
     
       =
     
        ReadMemoryValue(baseAddress); 
     
       //
     
       读取基址(该地址不会改变)
     
        
     
        address 
     
       =
     
        address 
     
       +
     
        
     
       0x82C
     
       ; 
     
       //
     
       获取2级地址
     
        
     
        address 
     
       =
     
        ReadMemoryValue(address); address 
     
       =
     
        address 
     
       +
     
        
     
       0x28
     
       ; 
     
       //
     
       得到金钱地址
     
        
     
        WriteMemory(address, 
     
       0x1869F
     
       ); 
     
       //
     
       写入数据到地址（0x1869F表示99999）
     
        
     
        timer2.Interval 
     
       =
     
        
     
       1000
     
       ; } 
     
       private
     
        
     
       void
     
        btnGo_Click(
     
       object
     
        sender, EventArgs e) { 
     
       if
     
        (Helper.GetPidByProcessName(processName) 
     
       ==
     
        
     
       0
     
       ) { MessageBox.Show(
     
       "
     
       哥们启用之前游戏总该运行吧！
     
       "
     
       ); 
     
       return
     
       ; } 
     
       int
     
        address 
     
       =
     
        ReadMemoryValue(baseAddress); 
     
       //
     
       读取基址(该地址不会改变)
     
        
     
        address 
     
       =
     
        address 
     
       +
     
        
     
       0x82C
     
       ; 
     
       //
     
       获取2级地址
     
        
     
        address 
     
       =
     
        ReadMemoryValue(address); address 
     
       =
     
        address 
     
       +
     
        
     
       0x24
     
       ; 
     
       int
     
        lev 
     
       =
     
        
     
       1
     
       ; 
     
       try
     
        { lev 
     
       =
     
        
     
       int
     
       .Parse(txtLev.Text.Trim()); } 
     
       catch
     
        { MessageBox.Show(
     
       "
     
       输入的关卡格式不真确！默认设置为1
     
       "
     
       ); } WriteMemory(address, lev); } 
     
       //
     
       读取制定内存中的值
     
        
     
        
     
       public
     
        
     
       int
     
        ReadMemoryValue(
     
       int
     
        baseAdd) { 
     
       return
     
        Helper.ReadMemoryValue(baseAdd, processName); } 
     
       //
     
       将值写入指定内存中
     
        
     
        
     
       public
     
        
     
       void
     
        WriteMemory(
     
       int
     
        baseAdd, 
     
       int
     
        value) { Helper.WriteMemoryValue(baseAdd, processName, value); } 
     
       private
     
        
     
       int
     
        baseAddress 
     
       =
     
        
     
       0x006A9EC0
     
       ; 
     
       //
     
       游戏内存基址
     
        
     
        
     
       private
     
        
     
       string
     
        processName 
     
       =
     
        
     
       "
     
       PlantsVsZombies
     
       "
     
       ; 
     
       //
     
       游戏进程名字
     
        
     
        } } 
    
      

下面这个类是整个工具的核心

C# code

    
      

     
       
     
        
     
       using
     
        System; 
     
       using
     
        System.Text; 
     
       using
     
        System.Diagnostics; 
     
       using
     
        System.Runtime.InteropServices; 
     
       namespace
     
        PlantsVsZombiesTool { 
     
       public
     
        
     
       abstract
     
        
     
       class
     
        Helper { [DllImportAttribute(
     
       "
     
       kernel32.dll
     
       "
     
       , EntryPoint 
     
       =
     
        
     
       "
     
       ReadProcessMemory
     
       "
     
       )] 
     
       public
     
        
     
       static
     
        
     
       extern
     
        
     
       bool
     
        ReadProcessMemory ( IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, 
     
       int
     
        nSize, IntPtr lpNumberOfBytesRead ); [DllImportAttribute(
     
       "
     
       kernel32.dll
     
       "
     
       , EntryPoint 
     
       =
     
        
     
       "
     
       OpenProcess
     
       "
     
       )] 
     
       public
     
        
     
       static
     
        
     
       extern
     
        IntPtr OpenProcess ( 
     
       int
     
        dwDesiredAccess, 
     
       bool
     
        bInheritHandle, 
     
       int
     
        dwProcessId ); [DllImport(
     
       "
     
       kernel32.dll
     
       "
     
       )] 
     
       private
     
        
     
       static
     
        
     
       extern
     
        
     
       void
     
        CloseHandle ( IntPtr hObject ); 
     
       //
     
       写内存
     
        
     
        [DllImportAttribute(
     
       "
     
       kernel32.dll
     
       "
     
       , EntryPoint 
     
       =
     
        
     
       "
     
       WriteProcessMemory
     
       "
     
       )] 
     
       public
     
        
     
       static
     
        
     
       extern
     
        
     
       bool
     
        WriteProcessMemory ( IntPtr hProcess, IntPtr lpBaseAddress, 
     
       int
     
       [] lpBuffer, 
     
       int
     
        nSize, IntPtr lpNumberOfBytesWritten ); 
     
       //
     
       获取窗体的进程标识ID
     
        
     
        
     
       public
     
        
     
       static
     
        
     
       int
     
        GetPid(
     
       string
     
        windowTitle) { 
     
       int
     
        rs 
     
       =
     
        
     
       0
     
       ; Process[] arrayProcess 
     
       =
     
        Process.GetProcesses(); 
     
       foreach
     
        (Process p 
     
       in
     
        arrayProcess) { 
     
       if
     
        (p.MainWindowTitle.IndexOf(windowTitle) 
     
       !=
     
        
     
       -
     
       1
     
       ) { rs 
     
       =
     
        p.Id; 
     
       break
     
       ; } } 
     
       return
     
        rs; } 
     
       //
     
       根据进程名获取PID
     
        
     
        
     
       public
     
        
     
       static
     
        
     
       int
     
        GetPidByProcessName(
     
       string
     
        processName) { Process[] arrayProcess 
     
       =
     
        Process.GetProcessesByName(processName); 
     
       foreach
     
        (Process p 
     
       in
     
        arrayProcess) { 
     
       return
     
        p.Id; } 
     
       return
     
        
     
       0
     
       ; } 
     
       //
     
       根据窗体标题查找窗口句柄（支持模糊匹配）
     
        
     
        
     
       public
     
        
     
       static
     
        IntPtr FindWindow(
     
       string
     
        title) { Process[] ps 
     
       =
     
        Process.GetProcesses(); 
     
       foreach
     
        (Process p 
     
       in
     
        ps) { 
     
       if
     
        (p.MainWindowTitle.IndexOf(title) 
     
       !=
     
        
     
       -
     
       1
     
       ) { 
     
       return
     
        p.MainWindowHandle; } } 
     
       return
     
        IntPtr.Zero; } 
     
       //
     
       读取内存中的值
     
        
     
        
     
       public
     
        
     
       static
     
        
     
       int
     
        ReadMemoryValue(
     
       int
     
        baseAddress,
     
       string
     
        processName) { 
     
       try
     
        { 
     
       byte
     
       [] buffer 
     
       =
     
        
     
       new
     
        
     
       byte
     
       [
     
       4
     
       ]; IntPtr byteAddress 
     
       =
     
        Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 
     
       0
     
       ); 
     
       //
     
       获取缓冲区地址
     
        
     
        IntPtr hProcess 
     
       =
     
        OpenProcess(
     
       0x1F0FFF
     
       , 
     
       false
     
       , GetPidByProcessName(processName)); ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 
     
       4
     
       , IntPtr.Zero); 
     
       //
     
       将制定内存中的值读入缓冲区
     
        
     
        CloseHandle(hProcess); 
     
       return
     
        Marshal.ReadInt32(byteAddress); } 
     
       catch
     
        { 
     
       return
     
        
     
       0
     
       ; } } 
     
       //
     
       将值写入指定内存地址中
     
        
     
        
     
       public
     
        
     
       static
     
        
     
       void
     
        WriteMemoryValue(
     
       int
     
        baseAddress, 
     
       string
     
        processName, 
     
       int
     
        value) { IntPtr hProcess 
     
       =
     
        OpenProcess(
     
       0x1F0FFF
     
       , 
     
       false
     
       , GetPidByProcessName(processName)); 
     
       //
     
       0x1F0FFF 最高权限
     
        
     
        WriteProcessMemory(hProcess, (IntPtr)baseAddress, 
     
       new
     
        
     
       int
     
       [] { value }, 
     
       4
     
       , IntPtr.Zero); CloseHandle(hProcess); } } }