Oto Pointer Örneği

tarafından **Hello EMO** Çarş. Haz. 29, 2011 7:04 am

[QUOTE=Thyke;795663]

Kod:: #include <stdio.h> #include <stdlib.h> #include <windows.h> BOOL GetHandle( char* WindowName ); BOOL PatternCmp( BYTE *p1, BYTE *p2, size_t plen ); DWORD SearchPattern( HANDLE ProcessHandle, BYTE *Pattern, size_t pattern_length ); HANDLE ProcessHandle; int main(void) { DWORD KO_SNDX; DWORD KO_CHRB; DWORD KO_DLG; if( !GetHandle("Knight OnLine Client") ) { puts("Cannot get handle\n"); return 1; } BYTE KO_SNDX_PATTERN[] = { 0x8B, 0x81, 0xD0, 0, 0, 0, 0x8D, 0x54, 0x24, 0x18, 0x88, 0x44, 0x24, 0x26, 0x52, 0x6A, 0x04, 0x68 }; BYTE KO_CHRB_PATTERN[] = { 0x8B, 0x50, 0x1C, 0x89, 0x54, 0x24, 0x40, 0x8B, 0x50, 0x20, 0x89, 0x54, 0x24, 0x44, 0x8B, 0x15 }; BYTE KO_DLG_PATTERN[] = { 0x8B, 0x4C, 0x24, 0x20, 0x89, 0x44, 0x24, 0x24, 0x33, 0xF6, 0xC6, 0x04, 0x01, 0x00, 0x8B, 0x15 }; KO_SNDX = SearchPattern( ProcessHandle , KO_SNDX_PATTERN, sizeof(KO_SNDX_PATTERN) ); KO_CHRB = SearchPattern( ProcessHandle , KO_CHRB_PATTERN, sizeof(KO_CHRB_PATTERN) ), KO_DLG = SearchPattern( ProcessHandle , KO_DLG_PATTERN, sizeof(KO_DLG_PATTERN) ), printf("KO_SNX = %X\nKO_CHRB = %X\nKO_DLG = %X\n",KO_SNDX,KO_CHRB,KO_DLG); return 0; } BOOL GetHandle( char* WindowName ) { HWND WindowHandle; DWORD PID; if( (WindowHandle = FindWindow(NULL,WindowName)) ) { if( GetWindowThreadProcessId(WindowHandle,&PID) ) { if( (ProcessHandle = OpenProcess( 0x1F0FFF , 0 , PID)) ) { return TRUE; } } } return FALSE; } DWORD SearchPattern( HANDLE ProcessHandle, BYTE *Pattern, size_t pattern_length ) { DWORD i; DWORD j; BYTE *Buff = malloc(0x1000); for( i = 0 ; i < 0x7FFFFFFF ; i+= 0x1000 ) { ReadProcessMemory( ProcessHandle, (LPCVOID)i , Buff , 0x1000 , NULL ); for( j = 0 ; j < 0x1000 ; j++ ) { if( Buff[j] == Pattern[0] ) { if( PatternCmp( Buff + j, Pattern, pattern_length ) ) { return *(DWORD*)(Buff+j+pattern_length); } } } } free(Buff); return 0; } BOOL PatternCmp( BYTE *p1, BYTE *p2, size_t plen ) { int i; for( i = 0 ; i < plen ; i++ ) { if( p1[i] != p2[i] ) { return FALSE; } } return TRUE; }

[/QUOTE]