僅提供研究，使用後果自行負責
作者是sd333221
//SimpleWc3Hack for Warcraft 3 Patch 1.23...
#include
#include
#include
using namespace std;
DWORD GetPIDForProcess (char* process);
void EnableDebugPriv();
DWORD GetDLLBase(char* DllName, DWORD tPid);
#define PATCH(i,w,l) WriteProcessMemory(hProc,reinterpret_cast
#define NPATCH(i,w,l) WriteProcessMemory(hProc,reinterpret_cast
int main()
{
cout << "SimpleWc3Hack v2.1 by sd333221 loaded (for WC3 v1.23)!" << endl << endl; cout << "Searching Wc3..." << endl; if(GetPIDForProcess("WAR3.EXE") == 0) { cout << "Warcraft 3 was not found..." << endl; system("Pause"); exit(0); } else { cout << "Getting debug privileges..." << endl; EnableDebugPriv(); cout << "Opening Warcraft 3 Process..." << endl; HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, false, GetPIDForProcess("WAR3.EXE")); if(hProc) { cout << "Process opened... Patching" << endl; DWORD gameBase = GetDLLBase("Game.dll",GetPIDForProcess("WAR3.EXE")); DWORD dSize = 0; PATCH(0x3A1E9B,"\x90\x90",2); //Patch 6F3A1E9B to nop nop :-) if(dSize == 0) { cout << "Failed to patch showunitsingame" << endl; } PATCH(0x361DFC,"\x00",1); if(dSize == 0) { cout << "Failed to patch showunitsmap" << endl; } PATCH(0x285B8C,"\x90\x90",2); if(dSize == 0) { cout << "Failed to patch clickableunits" << endl; } PATCH(0x285BA2,"\xEB\x29",2); if(dSize == 0) { cout << "Failed to patch clickableunits (2nd patch)" << endl; } PATCH(0x28345C,"\x40\xc3",2); if(dSize == 0) { cout << "Failed to patch revealillu" << endl; } PATCH(0x73DEC9,"\xB2\x00\x90\x90\x90\x90",6); if(dSize == 0) { cout << "Failed to patch removefogingame" << endl; } PATCH(0x431556,"\x3B\xC0\x0F\x85\xC0\x00\x00\x00\x8D\x8B\xF0\x00\x00\x00\xE8\x07\x3D\x03\x00\x3B\xC0\x0F\x85\xAD\x00\x00\x00",27); if(dSize == 0) { cout << "Failed to patch pingsignal" << endl; } PATCH(0x362211,"\x3B\xC0\x0F\x85\x30\x04\x00\x00",8); if(dSize == 0) { cout << "Failed to patch showinvisiblemap" << endl; } PATCH(0x356E7E,"\x90\x90\x90",3); if(dSize == 0) { cout << "Failed to patch showinvisiblemap" << endl; } PATCH(0x3C5C22,"\xEB",1); PATCH(0x3C135C,"\xB8\xFF\x00\x00\x00\xEB",6); if(dSize == 0) { cout << "Failed to bypass DotA -ah command" << endl; } PATCH(0x3F92CA,"\x90\x90",2); PATCH(0x3A1DDB,"\xEB",1); if(dSize == 0) { cout << "Failed to enable viewable items" << endl; } NPATCH(0x4559EC,"\x60\x0B\xC0\x75\x2F\x8A\x8E\xD0\x02\x00\x00\x80\xF9\x01\x74\x51\xC6\x86\xD0\x02\x00\x00\x01\xC6\x86\xD1\x02\x00\x00\x01\xC6\x86\xD2\x02\x00\x00\xFF\x8B\xCE\xB8\xFF\x01\x01\xFF\xFF\x15\x60\x5A\x45\x00\xEB\x2D\x8A\x8E\xD0\x02\x00\x00\x80\xF9\xFF\x74\x22\xC6\x86\xD0\x02\x00\x00\xFF\xC6\x86\xD1\x02\x00\x00\xFF\xC6\x86\xD2\x02\x00\x00\xFF\x8B\xCE\xB8\xFF\xFF\xFF\xFF\xFF\x15\x60\x5A\x45\x00\x61\xB8\x01\x00\x00\x00\x23\xD8\x89\x44\x24\xE4\xFF\x35\x65\x5A\x45\x00\xC3",116); DWORD addr[3]; addr[0] = gameBase + 0x29E270; //References to the Game.dll addr[1] = gameBase + 0x39A3BF; // addr[2] = 0x4559EC; //Detour NPATCH(0x455A60,&addr[0],sizeof(DWORD)); NPATCH(0x455A65,&addr[1],sizeof(DWORD)); NPATCH(0x455A6A,&addr[2],sizeof(DWORD)); PATCH(0x39A3B9,"\xFF\x25\x6A\x5A\x45\x00",6); //Plant detour if(dSize == 0) { cout << "Failed to enable colored invisibles" << endl; } PATCH(0x2030DC,"\x90\x90\x90\x90\x90\x90",6); PATCH(0x34FC68,"\x90\x90",2); if(dSize == 0) { cout << "Failed to enable view skills" << endl; } PATCH(0x28EBCE,"\xEB",1); PATCH(0x34FCA6,"\x90\x90\x90\x90",4); if(dSize == 0) { cout << "Failed to enable view cooldowns" << endl; } PATCH(0x285BA2,"\xEB",1); if(dSize == 0) { cout << "Failed to enable click invisible units" << endl; } //Tradeamount disabled /*PATCH(0x34E762,"\xB8\x00\x00\x00\x00\x90",6); DWORD highTradeAmount = 200; PATCH(0x34E763,&highTradeAmount,sizeof(DWORD)); PATCH(0x34E76A,"\xB8\x00\x00\x00\x00\x90",6); DWORD lowTradeAmount = 100; PATCH(0x34E76B,&lowTradeAmount,sizeof(DWORD)); if(dSize == 0) { cout << "Failed to patch tradeamount" << endl; }*/ cout << "Show hero icons: " << endl; cout << "Press F1 to view all hero icons, F2 for enemy icons, F3 for ally icons, any key for nothing!" << endl; system("Pause"); if(GetAsyncKeyState(VK_F1)) { PATCH(0x371581, "\x5B\x26",2); PATCH(0x371587, "\x90\x90\x90\x90\x90\x90",6); if(dSize == 0) { cout << "Failed to patch view all icons" << endl; } } else if(GetAsyncKeyState(VK_F2)) { PATCH(0x371581, "\x5B\x26",2); PATCH(0x371587, "\x0F\x85\x8F\x02\x00\x00",6); if(dSize == 0) { cout << "Failed to patch view enemy icons" << endl; } } else if(GetAsyncKeyState(VK_F3)) { PATCH(0x371581, "\x5B\x26",2); PATCH(0x371587, "\x0F\x84\x8F\x02\x00\x00",6); if(dSize == 0) { cout << "Failed to patch view ally icons" << endl; } } else { cout << "View hero icons not enabled!" << endl; } Sleep(1000); cout << "Unlimited camera zoom" << endl; cout << "Press F1 to enable camera zoom" << endl; system("Pause"); if(GetAsyncKeyState(VK_F1)) { float zoom = 0; cout << "Please enter zoom: "; cin >> zoom;
PATCH(0x285B68, "\xE9\x04\xA3\x5E\x00",5);
PATCH(0x86FE71, "\xE8\xDA\x13\xCC\xFF\x6A\x01\x6A\x00\x68\xCC\xCC\xCC\xCC\x6A\x00\x8B\x0D\xD8\xA7\xAB\x6F\x8B\x89\x54\x02\x00\x00\xE8\x8E\x65\xA9\xFF\xE9\xD6\x5C\xA1\xFF",38);
PATCH(0x86FE7B,&zoom,sizeof(DWORD));
}
cout << "Done, goodbye!" << endl;
system("Pause");
exit(1);
}
else
{
cout << "Warcraft 3 could not be opened..." << endl;
system("Pause");
exit(0);
}
}
return 0;
}
//Queries the ProcessId of a certain process
DWORD GetPIDForProcess (char* process)
{
BOOL working=0;
PROCESSENTRY32 lppe= {0};
DWORD targetPid=0;
HANDLE hSnapshot=CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS ,0);
if (hSnapshot)
{
lppe.dwSize=sizeof(lppe);
working=Process32First(hSnapshot,&lppe);
while (working)
{
if(_stricmp(lppe.szExeFile,process)==0)
{
targetPid=lppe.th32ProcessID;
break;
}
working=Process32Next(hSnapshot,&lppe);
}
}
CloseHandle( hSnapshot );
return targetPid;
}
//Enables to open other processes
void EnableDebugPriv()
{
HANDLE hToken;
LUID sedebugnameValue;
TOKEN_PRIVILEGES tkp;
if ( ! OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
return;
if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &sedebugnameValue ) ){
CloseHandle( hToken );
return;
}
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Luid = sedebugnameValue;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tkp, sizeof tkp, NULL, NULL ) )
CloseHandle( hToken );
}
//Gets the base of our dll
DWORD GetDLLBase(char* DllName, DWORD tPid)
{
HANDLE snapMod;
MODULEENTRY32 me32;
if (tPid == 0) return 0;
snapMod = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, tPid);
me32.dwSize = sizeof(MODULEENTRY32);
if (Module32First(snapMod, &me32)){
do{
if (strcmp(DllName,me32.szModule) == 0){
CloseHandle(snapMod);
return (DWORD) me32.modBaseAddr;
}
}while(Module32Next(snapMod,&me32));
}
CloseHandle(snapMod);
return 0;
}
Posts
