1、首先看看C#的,我封装了一个ECHelper.cs工具类,代码如下 //打开进程获取句柄 [DllImport("kernel32.dll", EntryPoint = "OpenProcess")] public static extern IntPtr OpenProcess(int desiredAccess, bool heritHandle, int pocessID);//访问权限（16进制），是否继承句柄，进程ID
2、//关闭句柄 [DllImport("kernel32.dll", E艘绒庳焰ntryPoint = &qu泠贾高框ot;CloseHandle")] public static extern void CloseHandle(IntPtr hObject); //读取内存 [DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")] public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr baseadress, IntPtr buffer, int nsize, IntPtr bytesread); //写入内存 [DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")] public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr baseadress, long[] buffer, int nSize, IntPtr byteswrite);
3、//根据进程名获得PID public static int GetPIDByProcessName(string name) { Process[] pros = Process.GetProcessesByName(name); if (pros.Count() > 0) { return pros[0].Id; } else { return 0; } } public static int ReadMemoryValue(string name, IntPtr baseadress) { try { byte[] buffer = new byte[4]; IntPtr bufferadress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0); IntPtr hprocess = OpenProcess(0x1F0FFF, false, ECHelper.GetPIDByProcessName(name));
4、ReadProcessMemory(hprocess, baseadress, bufferadress, 4, IntPtr.Zero); CloseHandle(hprocess); return Marshal.ReadInt32(bufferadress); } catch { return 0; } } public static void WriteMemoryValue(string name, IntPtr baseadress, long value) { IntPtr hprocess = OpenProcess(0x1F0FFF, false, ECHelper.GetPIDByProcessName(name)); WriteProcessMemory(hprocess, baseadress, new long [] { value }, 4, IntPtr.Zero); CloseHandle(hprocess); }
5、调用方法如下string name = "cstrike";int baseadress = 0x02506刻八圄俏9BC;private void btnShoot_Click(object sender, EventArgs e) { timShoot.Start(); }private void timShoot_Tick(object sender, EventArgs e) { timShoot.Interval = 300; int adress1 = ECHelper.ReadMemoryValue(name, (IntPtr)baseadress); adress1 = adress1 + 0x7C; int adress2 = ECHelper.ReadMemoryValue(name, (IntPtr)adress1); adress2 = adress2 + 0x5EC; int adress3 = ECHelper.ReadMemoryValue(name, (IntPtr)adress2); adress3 = adress3 + 0xCC; ECHelper.WriteMemoryValue(name, (IntPtr)adress3, 0x64); //cs子弹无线
