1. 首頁 > 生活百科 > >

【C++】從零開始的CS:GO逆向分析3——寫出一個透視( 二 )

生活百科


void get_moduel_info(DWORD process_id, const char *name, OUT module_information&info){HANDLE snap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, process_id);if (is_error())error("創建快照錯誤");MODULEENTRY32 module_info;ZeroMemory(&module_info, sizeof(module_info));module_info.dwSize = sizeof(module_info);char target[1024];ZeroMemory(target, 1024);strncpy(target, name, strlen(name));_strupr(target);bool status = Module32First(snap, &module_info);while (status){if (strncmp(_strupr(module_info.szModule), target, sizeof(target)) == 0){info.module_address = (UINT_PTR)module_info.modBaseAddr;info.module_handle = module_info.hModule;info.alloc(module_info.modBaseSize);DWORD size = read_memory(g_process_handle, info.module_address, info.module_data, info.module_size);//TODOCloseHandle(snap);return;}status = Module32Next(snap, &module_info);}error("未找到模塊");return;}讀取游戲內存函數例如之前得到 上下角度 = [[engine.dll+58CFDC]+00004D90] ，則可以
ReadProcessMemory(g_process_handle, (LPVOID)(engine.dll+58CFDC), recv, size, &readsize);
ReadProcessMemory(g_process_handle, (LPVOID)recv, recv, size, &readsize);
函數的使用方法：ReadProcessMemory(句柄,地址,讀到哪里,讀多少,具體讀了多少);
則可以讀到上下角度
通過ReadProcessMemory函數讀取內存，對這個函數進行打包，方便使用（好吧，我承認這個打包的很爛 ， 幾乎沒有方便使用）
DWORD read_memory(HANDLE process, DWORD address, void *recv, int size){DWORD readsize;ReadProcessMemory(process, (LPVOID)address, recv, size, &readsize);return readsize;if (is_error())error("讀取內存失敗");}重寫了一個我覺得比較好用的 ， 各位可以酌情對其進行改寫
template<class T>T ReadMem(HANDLE ProcessHandle, UINT_PTR Address, int size){T Reader;ReadProcessMemory(ProcessHandle, (LPVOID)Address, &Reader, size, NULL);return Reader;}三維坐標轉二維坐標創建兩個結構體來儲存二維坐標 ， 一個用來儲存三維坐標
struct Vec2{public:float x, y;};struct Vec3{public:float x, y, z;};傳入一個三維坐標和視角矩陣，算出人物在屏幕上的坐標 VecScreen
bool WorldToScreen(const Vec3& VecOrgin, Vec2& VecScreen, float* Matrix){VecScreen.x = VecOrgin.x *Matrix[0] + VecOrgin.y*Matrix[1] + VecOrgin.z*Matrix[2] + Matrix[3];VecScreen.y = VecOrgin.x *Matrix[4] + VecOrgin.y*Matrix[5] + VecOrgin.z*Matrix[6] + Matrix[7];float w = VecOrgin.x*Matrix[12] + VecOrgin.y*Matrix[13] + VecOrgin.z*Matrix[14] + Matrix[15];if (w < 0.01f){return false;}Vec2 NDC;NDC.x = VecScreen.x / w;NDC.y = VecScreen.y / w;VecScreen.x = (g_client_width / 2 * NDC.x) + (NDC.x + g_client_width / 2);VecScreen.y = (g_client_height / 2 * NDC.y) + (NDC.y + g_client_height / 2);ConvertToRange(VecScreen);return true;}void ConvertToRange(Vec2 &Point){Point.x /= g_client_width;Point.x *= 2.0f;Point.x -= 1.0f;Point.y /= g_client_height;Point.y *= 2.0f;Point.y -= 1.0f;}GLFW畫線使用glVertex2f函數，第一個glVertex2f是開始的位置，第二個glVertex2f是結束的位置
void DrawLine(Vec2& start, Vec2& end){glLineWidth(1.2);glBegin(GL_LINES);glColor4f(255, 255, 255, 100);glVertex2f(start.x, start.y);glVertex2f(end.x, end.y);glEnd();}寫一個init函數，實現初始化void init_address(const char*process_name){std::cout << "請先啟動游戲"<< std::endl;DWORD process_id = get_process_id(process_name);HANDLE process_handle = get_process_handle(process_id);g_process_id = process_id; //將pid保存到全局變量g_process_handle = process_handle;//將process_handle保存到全局變量//獲取模塊信息get_moduel_info(process_id, "engine.dll", engine_module);get_moduel_info(process_id, "client.dll", client_module);get_moduel_info(process_id, "server.dll", server_module);UINT_PTR temp_address;float Matrix[16];UINT_PTR matrix_address = client_module.module_address + dwViewMatrix; //獲取視角矩陣地址g_matrix_address = matrix_address; //將視角矩陣地址保存到全局變量//獲取人物視角地址ReadProcessMemory(g_process_handle, (LPVOID)(engine_module.module_address + 0x58CFDC), &temp_address, 4, NULL);//[engine.dll + 58CFDC]+00004D90g_angle_address = temp_address + dwClientState_ViewAngles;//獲取本地人物地址 [client.dll+0xDC04CC]+100 = 生命值ReadProcessMemory(g_process_handle, (LPVOID)(client_module.module_address + dwLocalPlayer), &temp_address, 4, NULL);g_local_player = temp_address; //[g_local_player+100] = 生命值//獲得ENtitylist地址[client.dll+0x4DDC90C + i *0x10]+100 = 敵人生命值g_player_list_address = client_module.module_address + dwEntityList;}先說一下整體的思路：
通過進程名（csgo.exe）獲取進程ID
↓
通過進程ID獲取進程句柄、client.dll模塊的信息
↓
通過進程句柄讀取人物視角矩陣地址、本地人物對象地址、敵人對象地址 并保存到全局變量（初始化完成）

推薦閱讀