魔獸maphack其實很簡單

 抱歉，弄這麼一個標題絕無半點鐘狂妄之意，只是純粹的標題作用，希望理解...

 寫這篇文章也只是為了整理一下這些天弄maphack還有lancraft的所得

    看過前幾篇前輩們關於maphack的文章，發現maphack真的很簡單，就幾個函數嘛，EnableDebugPriv()提權，再FindWindow(),OpenProcess(),然後要修改什麼就WriteProcessMemory(),有什麼難的？可難就難在要開啟的一些選項的記憶體位址！像前輩們介紹的那樣，用CE一個一個找，我想說是個人都會哭的(那些最先做maphack的前輩，我只能表示萬分的敬佩)……

    說到這裡我又不得不再次高呼"Tribute to Shadow French”，外國人的開源精神真的是沒的說，雖然Shadow French的MH沒有直接開源，但人家發布的程式都是赤裸裸的，沒有加密啊，而且用的還是native編碼，不像國內的那些高手，加了幾層殼~當然了，人家的著作權嘛！

    不好意思，偏題了。對於native code 的VB程式，用smart check一跟蹤，你會發現世界如此美好！

Visual Basic程式調試器 SmartCheck  http://www.pediy.com/tools/Debuggers.htm

從http://www.securegamers.com/shadowfrench/maphack.php下載一個1.20E的版本，然後勾選一個單一選項點擊On，在Smart Check 裡面已經跟蹤到OnClick事件BOOL WriteProcessMemory(
　　HANDLE hProcess,
　　LPVOID lpBaseAddress,
　　LPVOID lpBuffer,
　　DWORD nSize,
　　LPDWORD lpNumberOfBytesWritten
　　);
再看一下這個操作的C語言原型

1.  BYTE data[] = {0xBF,0x0F,0x00};   
2.  bool success = WriteProcessMemory(hopen,(LPVOID)0x6F2A3B92, &data,3, NULL);   

lpBuffer裡面的內容是至關重要的，要找到0x0013F2A0裡面的內容，只有用OllyDbg了

OllyDbg調試器 OllyDbg[2008.1.1] http://www.pediy.com/tools/Debuggers.htm從Smart Check 右邊的視窗可以找到WriteProcessMemory(HPROCESS:000006B4,DWORD:6F406B30,PTR:0013F2A0,DWORD:00000001,PTR:0013F29C)的位移地址為0000F609用OllyDbg開啟maphack，然後找到0040F609處，發現根本不要調試，lpBuffer的內容就出來了...0040F5DD   .  8B4D 0C                          mov     ecx, dword ptr [ebp+C]
0040F5E0   .  8D95 2CFFFFFF                    lea     edx, dword ptr [ebp-D4]
0040F5E6   .  52                               push    edx
0040F5E7   .  8D85 30FFFFFF                    lea     eax, dword ptr [ebp-D0]
0040F5ED   .  8B51 08                          mov     edx, dword ptr [ecx+8]
0040F5F0   .  6A 01                            push    1
0040F5F2   .  50                               push    eax
0040F5F3   .  52                               push    edx
0040F5F4   .  56                               push    esi
0040F5F5   .  C785 2CFFFFFF 00000000           mov     dword ptr [ebp-D4], 0
0040F5FF   .  C785 30FFFFFF 74000000           mov     dword ptr [ebp-D0], 74
0040F609   .  E8 A23CFFFF                      call    004032B0mov     dword ptr [ebp-D0], 74   lpBuffer指向的內容就是0x74再依葫蘆畫瓢，要找出所有的地址不是件難事！這裡給出我自己寫的樣本MH裡所需要的一些功能的地址/////////////////////////////////////////////////////////////<br />//開啟按住CTRL給錢<br />BYTE val=0x40;<br />int lRet = WriteProcessMemory(hOpen, LPVOID(0x6F127B35), &val, 1, 0);<br />val=0xb8;<br />lRet =WriteProcessMemory(hOpen, LPVOID(0x6F127B36), &val, 1, 0);<br />lRet =WriteProcessMemory(hOpen, LPVOID(0x6F127B37), &num_dclick, 4, 0);<br />////////////////////////////////////////////////////////////////////////<br />//開啟單擊給錢<br />val=0x40;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F127B3D), &val, 1, 0);<br />val=0xb8;<br />lRet =WriteProcessMemory(hOpen, LPVOID(0x6F127B3E), &val, 1, 0);<br />lRet =WriteProcessMemory(hOpen, LPVOID(0x6F127B3F), &num_click, 4, 0);<br />//////////////////////////////////////////////////////////////////////////<br />//小地圖查看隱藏<br />val=0x39;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F1494E0), &val, 1, 0);<br />val=0x85;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F1494E3), &val, 1, 0);<br />//////////////////////////////////////////////////////////////////////////<br />//大地圖查看隱藏<br />val=0x90;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4E8), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4E9), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EA), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EB), &val, 1, 0);<br />val=0xb8;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EC), &val, 1, 0);<br />val=0x1;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4ED), &val, 1, 0);<br />val=0x0;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EE), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4EF), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F17D4F0), &val, 1, 0);<br />////////////////////////////////////////////////////////////////////<br />//顯示單位？？？<br />val= 0x66;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B1), &val, 1, 0);<br />val= 0xBF;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B2), &val, 1, 0);<br />val= 0xF;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B3), &val, 1, 0);<br />val= 0x0;<br /> lRet = WriteProcessMemory(hOpen, LPVOID(0x6F2A08B4), &val, 1, 0);<br />/////////////////////////////////////////////////////////////////////<br />//查看人物技能<br />val=0x90;<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC1A), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC1B), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC5A), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F12DC5B), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F5573FE), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F5573FF), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557400), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557401), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557402), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F557403), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0BF), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C0), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C1), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C2), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C3), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F54C0C4), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F55E15C), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F55E15D), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F4A11A1), &val, 1, 0);<br />lRet = WriteProcessMemory(hOpen, LPVOID(0x6F4A11A0), &val, 1, 0);<br />//////////////////////////////////////////////////////////////////////附上我寫的一個範例maphack，僅僅添加了為了方便玩仙之俠道的一些功能(準備再加上類比按鍵，哈哈 我的鬼魅就無敵啦！)，早期給錢方便，這個是我寫MH最初動力，那個10塊10塊的給太麻煩了，手都點痛！裡面還加了跨網段聯機功能(原理在下篇博文)，= =！程式寫的很亂，見笑了...http://download.csdn.net/source/1819854