假的你妹啊。。自己做的。/草。骗你妹
下面是源代码：
.386
.model flat,stdcall
option casemap:none
include windows.inc
include kernel32.inc
include user32.inc
includelib user32.lib
includelib kernel32.lib
include C:\RadASM\masm32\Macros\Strings.mac
.data
file db '\cheater.dll',0
pbyte db 068h,0,0,0,0,0B8h,0,0,0,0,0FFh,0D0h,0C3h
.code
start:
Runtime proc
LOCAL toolhelp_handle
LOCAL ppro:PROCESSENTRY32,processhandle:dword,path_root:dword,writebyte
LOCAL remotepath,remotethread
invoke GetCurrentProcessId
invoke CreateToolhelp32Snapshot,TH32CS_SNAPPROCESS,eax
.if eax>0
mov ppro.dwSize,sizeof ppro
mov toolhelp_handle,eax
lea edx,ppro
invoke Process32First,eax,edx
.if eax>0
.while eax>0
mov ebx,0
push ebx
lea edx,ppro
invoke Process32Next,toolhelp_handle,edx
push eax
lea ecx,ppro.szExeFile
invoke lstrcmpi,ecx,$CTA0("cstrike16.exe")
.if eax==0
pop ebx
pop eax
mov ebx,ppro.th32ProcessID
.break
.endif
pop eax
pop ebx
.endw
.if ebx>0
invoke OpenProcess,PROCESS_ALL_ACCESS,FALSE,ebx
.if eax>0
mov processhandle,eax
invoke VirtualAlloc,0,256,MEM_COMMIT,PAGE_EXECUTE_READWRITE
.if eax>0
mov path_root,eax
.endif
invoke GetCurrentDirectory,255,eax
mov ecx,path_root
add ecx,eax
lea edx,writebyte
invoke WriteProcessMemory,-1,ecx,offset file,sizeof file,edx
invoke VirtualAllocEx,processhandle,0,256,MEM_COMMIT,PAGE_EXECUTE_READWRITE
.if eax>0
mov remotepath,eax
mov ecx,path_root
lea ebx,writebyte
invoke WriteProcessMemory,processhandle,eax,ecx,256,ebx
.if eax>0
invoke GetModuleHandle,$CTA0("kernel32.dll")
invoke GetProcAddress,eax,$CTA0("LoadLibraryA")
.if eax>0
mov edx,offset pbyte
inc edx
mov ecx,remotepath
mov [edx],ecx
add edx,5
mov [edx],eax
invoke VirtualAllocEx,processhandle,0,13,MEM_COMMIT,PAGE_EXECUTE_READWRITE
.if eax>0
mov remotethread,eax
lea ebx,writebyte
invoke WriteProcessMemory,processhandle,eax,offset pbyte,13,ebx
mov eax,remotethread
invoke CreateRemoteThread,processhandle,NULL,NULL,eax,NULL,NULL,NULL
.if eax>0
invoke MessageBox,NULL,$CTA0("开启成功,去爽吧go go go~"),$CTA0("Code By 201724"),MB_OK
.endif
.endif
.endif
.endif
.endif
.endif
.else
invoke MessageBox,NULL,$CTA0("未找到cstrike16.exe游戏进程,请先开启游戏"),$CTA0("Code By 201724"),MB_OK
.endif
.endif
.endif
ret
Runtime endp
end start
