欢迎您访问程序员文章站本站旨在为大家提供分享程序员计算机编程知识!
您现在的位置是: 首页  >  IT编程

C# 操作地址 从内存中读取写入数据(初级)

程序员文章站 2023-11-02 13:54:10
本示例以植物大战僵尸为例, 实现功能为 每1秒让阳光刷新为 9999.本示例使用的游戏版本为 [植物大战僵尸2010年度版], 使用的辅助查看内存地址的工具是 CE. 由于每次启动游戏, 游戏中阳光地址都是变的, 唯一不变的基址1, 我们要通过CE工具找到基址1的地址, 可以算出阳光的地址. 基址2 ......

本示例以植物大战僵尸为例, 实现功能为 每1秒让阳光刷新为 9999.本示例使用的游戏版本为 [植物大战僵尸2010年度版], 使用的辅助查看内存地址的工具是  ce.

由于每次启动游戏, 游戏中阳光地址都是变的, 唯一不变的基址1, 我们要通过ce工具找到基址1的地址, 可以算出阳光的地址.

基址2的地址 = 基址1中的值 + 偏移1;

阳光的的地址 = 基址2中的值 + 偏移2;

以下为简单示例:  窗口界面一个按钮 和 一个定时器

using system;
using system.collections.generic;
using system.componentmodel;
using system.data;
using system.drawing;
using system.linq;
using system.text;
using system.windows.forms;
using system.runtime.interopservices;
using system.diagnostics;
 
namespace zhiwudazhanjiangshi
{
    public partial class form1 : form
    {
        public form1()
        {
            initializecomponent();
        }
 
        #region api
 
        //从指定内存中读取字节集数据
        [dllimportattribute("kernel32.dll", entrypoint = "readprocessmemory")]
        public static extern bool readprocessmemory(intptr hprocess,intptr lpbaseaddress,intptr lpbuffer,int nsize,intptr lpnumberofbytesread);
 
        //从指定内存中写入字节集数据
        [dllimportattribute("kernel32.dll", entrypoint = "writeprocessmemory")]
        public static extern bool writeprocessmemory(intptr hprocess,intptr lpbaseaddress,int[] lpbuffer,int nsize, intptr lpnumberofbyteswritten );
 
        //打开一个已存在的进程对象,并返回进程的句柄
        [dllimportattribute("kernel32.dll", entrypoint = "openprocess")]
        public static extern intptr openprocess(int dwdesiredaccess, bool binherithandle, int dwprocessid);
 
        //关闭一个内核对象。其中包括文件、文件映射、进程、线程、安全和同步对象等。
        [dllimport("kernel32.dll")]
        private static extern void closehandle(intptr hobject);
 
        #endregion
 
        #region 使用方法
 
        //根据进程名获取pid
        public static int getpidbyprocessname(string processname)
        {
            process[] arrayprocess = process.getprocessesbyname(processname);
            foreach (process p in arrayprocess)
            {
                return p.id;
            }
            return 0;
        }
 
        //读取内存中的值
        public static int readmemoryvalue(int baseaddress, string processname)
        {
            try
            {
                byte[] buffer = new byte[4];
                //获取缓冲区地址
                intptr byteaddress = marshal.unsafeaddrofpinnedarrayelement(buffer, 0);
                //打开一个已存在的进程对象  0x1f0fff 最高权限
                intptr hprocess = openprocess(0x1f0fff, false, getpidbyprocessname(processname));
                //将制定内存中的值读入缓冲区
                readprocessmemory(hprocess, (intptr)baseaddress, byteaddress, 4, intptr.zero); 
                //关闭操作
                closehandle(hprocess);
                //从非托管内存中读取一个 32 位带符号整数。
                return marshal.readint32(byteaddress);
            }
            catch
            {
                return 0;
            }
        }
 
        //将值写入指定内存地址中
        public static void writememoryvalue(int baseaddress, string processname, int value)
        {
            try
            {
                //打开一个已存在的进程对象  0x1f0fff 最高权限
                intptr hprocess = openprocess(0x1f0fff, false, getpidbyprocessname(processname));
                //从指定内存中写入字节集数据
                writeprocessmemory(hprocess, (intptr)baseaddress, new int[] { value }, 4, intptr.zero);
                //关闭操作
                closehandle(hprocess);
            }
            catch { }
        }
 
        #endregion
 
        //游戏内存基址
        private int baseaddress = 0x0015e944;
        //游戏进程名字
        private string processname = "plantsvszombies";
 
        //开启/关闭 功能 的按钮
        private void button1_click(object sender, eventargs e)
        {
            if (getpidbyprocessname(processname) == 0)
            {
                messagebox.show("游戏没有运行!");
                return;
            }
            if (button1.text == "开启")
            {
                button1.text = "关闭";
                timer1.enabled = true;
            }
            else
            {
                button1.text = "开启";
                timer1.enabled = false;
            }
        }
 
        //定时器
        private void timer1_tick(object sender, eventargs e)
        {
            if (getpidbyprocessname(processname) == 0)
            {
                timer1.enabled = false;
            }
            //baseaddress : 游戏内存基址   processname : 游戏进程名
            //读取 基址1 中存放的值
            int address = readmemoryvalue(baseaddress, processname);
            //计算 基址2的地址 = 基址1中的值 + 偏移量1
            address = address + 0x868;
            //读取 基址2 中存放的值
            address = readmemoryvalue(address, processname);
            //计算 阳光的地址 = 基址2中的值 + 偏移量2
            address = address + 0x5578;
            //给阳光地址中写入数值,0x378 : 888
            writememoryvalue(address, processname, 0x378);
        } 
    }
}

下面增加了一个刷新金币的示例 (注意, 金币值是界面的金币输 除以 10 , 我们刷100 在界面里面显示为1000)

C# 操作地址 从内存中读取写入数据(初级)

private void button2_click(object sender, eventargs e)
        {
            if (getpidbyprocessname(processname) == 0)
            {
                messagebox.show("游戏没有运行!");
                return;
            }
 
            //baseaddress : 游戏内存基址   processname : 游戏进程名
            //读取 基址1 中存放的值
            int address = readmemoryvalue(baseaddress, processname);
            //计算 基址2的地址 = 基址1中的值 + 偏移量1
            address = address + 0x950;
            //读取 基址2 中存放的值
            address = readmemoryvalue(address, processname);
            //计算 阳光的地址 = 基址2中的值 + 偏移量2
            address = address + 0x50;
            //给阳光地址中写入数值,0x378 : 888
            writememoryvalue(address, processname, getint(textbox2.text));
        }
 
        private int getint(string s)
        {
            int n = 0;
            int.tryparse(s, out n);
            if (n <= 0)
            {
                n = 100;
            }
            return n;
        }

今天又增加了无植物无冷却时间的功能

C# 操作地址 从内存中读取写入数据(初级)

int count = 0;
        private void form1_load(object sender, eventargs e)
        {
            if (getpidbyprocessname(processname) != 0)
            {
                int address = readmemoryvalue(baseaddress, processname);
                address = address + 0x868;
                address = readmemoryvalue(address, processname);
                address = address + 0x15c;
                address = readmemoryvalue(address, processname);
                address = address + 0x24;
                address = readmemoryvalue(address, processname);
                count = address;
                label3.text = "植物栏个数: " + address.tostring() + " 个";
            }
        }
 
        private void timer2_tick(object sender, eventargs e)
        {
            if (getpidbyprocessname(processname) == 0)
            {
                timer2.enabled = false;
            }
            if (count > 0)
            {
                for (int i = 0; i < count; i++)
                {
                    int address = readmemoryvalue(baseaddress, processname);
                    address = address + 0x868;//一级地址
                    address = readmemoryvalue(address, processname);
                    address = address + 0x15c;//二级地址
                    address = readmemoryvalue(address, processname);
                    address = address + 0x4c;//第一栏 植物的地址
                    // 每后一个植物 地址 偏移 50 (在十进制里是80)
                    //偏移 0x24 的地址 是标示是否在冷却中 值 :( 0 :  为冷却中, 1 为冷却完成)
                    address = address + 80 * i + 0x24;
                    writememoryvalue(address, processname, 1);
                    //如果不偏移 0x24 的地址为冷却时间地址, 值不确定, 一般最大设为6000  也可以完成此功能
                    //address = address + 80 * i;
                    //writememoryvalue(address, processname, 6000);
                }
            }
            else
            {
                int address = readmemoryvalue(baseaddress, processname);
                address = address + 0x868;
                address = readmemoryvalue(address, processname);
                address = address + 0x15c;
                address = readmemoryvalue(address, processname);
                address = address + 0x24;
                address = readmemoryvalue(address, processname);
                count = address;
                label3.text = "植物栏个数: " + address.tostring() + " 个";
            }
        }
 
        private void button3_click(object sender, eventargs e)
        {
            if (getpidbyprocessname(processname) == 0)
            {
                messagebox.show("游戏没有运行!");
                return;
            }
            if (button3.text == "有冷却")
            {
                button3.text = "无冷却";
                timer2.enabled = true;
            }
            else
            {
                button3.text = "有冷却";
                timer2.enabled = false;
            }
        }

转自:https://blog.csdn.net/changblade/article/details/82027440