创世战车透视自瞄源码

  1 #include <Windows.h>
  2 #include <stdio.h>
  3 #include <WINBASE.H>
  4 #include <string.h>
  5 #include <tchar.h>
  6 #include <psapi.h>
  7 #include <tlhelp32.h>
  8 #include <math.h>
  9 //定义全局变量
 10 COLORREF SnapLineCOLOR;
 11 COLORREF TextCOLOR;
 12 HANDLE _hGameHandle;
 13 RECT m_rect;
 14 DWORD ProcessId;
 15 HDC HDC_Desktop;
 16 HBRUSH EnemyBrush = CreateSolidBrush(RGB(255, 0, 0));
 17 HWND Handle;
 18 HFONT Font;
 19 float cx=1380;
 20 float fovX = 3.1415 * 84 / 180;
 21 float fovY = 3.1415 * 60 / 180;
 22 #define BasePtr 0x204D6D0
 23 #define ArrayPtr 0x2635890
 24 #define mousexptr 0x264AAA4
 25 #define crmeraptr 0x264A4A0
 26 
 27 void DrawFilledRect(int x, int y, int w, int h)
 28 {
 29     //We create our rectangle to draw on screen
 30     RECT rect = { x, y, x + w, y + h };
 31     //We clear that portion of the screen and display our rectangle
 32     FillRect(HDC_Desktop, &rect, EnemyBrush);
 33 }
 34 
 35 
 36 void DrawBorderBox(int x, int y, int w, int h, int thickness)
 37 {
 38     //Top horiz line
 39     DrawFilledRect(x, y, w, thickness);
 40     //Left vertical line
 41     DrawFilledRect(x, y, thickness, h);
 42     //right vertical line
 43     DrawFilledRect((x + w), y, thickness, h);
 44     //bottom horiz line
 45     DrawFilledRect(x, y + h, w + thickness, thickness);
 46 }
 47 
 48 
 49 //Here is where we draw our line from point A to Point B
 50 void DrawLine(float StartX, float StartY, float EndX, float EndY, COLORREF Pen)
 51 {
 52     int a, b = 0;
 53     HPEN hOPen;
 54     // penstyle, width, color
 55     HPEN hNPen = CreatePen(PS_SOLID, 2, Pen);
 56     hOPen = (HPEN)SelectObject(HDC_Desktop, hNPen);
 57     // starting point of line
 58     MoveToEx(HDC_Desktop, StartX, StartY, NULL);
 59     // ending point of line
 60     a = LineTo(HDC_Desktop, EndX, EndY);
 61     DeleteObject(SelectObject(HDC_Desktop, hOPen));
 62 }
 63 
 64 //Draw our text with this function
 65 void DrawString(int x, int y, COLORREF color, const char* text)
 66 {
 67     SetTextAlign(HDC_Desktop, TA_CENTER | TA_NOUPDATECP);
 68 
 69     SetBkColor(HDC_Desktop, RGB(0, 0, 0));
 70     SetBkMode(HDC_Desktop, TRANSPARENT);
 71 
 72     SetTextColor(HDC_Desktop, color);
 73 
 74     SelectObject(HDC_Desktop, Font);
 75 
 76     TextOutA(HDC_Desktop, x, y, text, strlen(text));
 77 
 78     DeleteObject(Font);
 79 }
 80 
 81 //**********************************************************************************************************************************
 82 
 83 //自己封装的函数
 84 
 85 //取进程ID函数
 86 DWORD _GetProcessId(char* ClassName, char* WindowName)
 87 {
 88     //取游戏窗口的句柄
 89     DWORD _pid;
 90     HWND hGameWindow;
 91     hGameWindow = FindWindowA(ClassName, WindowName);
 92     GetWindowThreadProcessId(hGameWindow, &_pid);
 93     return _pid;
 94 }
 95 
 96 //获取进程的句柄
 97 HANDLE _GetProcessHandle(DWORD _pid)
 98 {
 99     HANDLE hGameHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, _pid);
100     return hGameHandle;
101 }
102 
103 //读内存4字节整数型
104 DWORD _ReadMemeryInt(HANDLE hGameHandle, DWORD _address)
105 {
106     DWORD buffer;
107     ReadProcessMemory(hGameHandle, LPCVOID(_address), &buffer, sizeof(buffer), NULL);
108     return buffer;
109 }
110 
111 //读内存小数型
112 FLOAT _ReadMemeryFloat(HANDLE hGameHandle, DWORD _address)
113 {
114     FLOAT buffer;
115     ReadProcessMemory(hGameHandle, LPCVOID(_address), &buffer, sizeof(buffer), NULL);
116     return buffer;
117 }
118 
119 //读内存文本型
120 char* _ReadMemeryString(HANDLE hGameHandle, DWORD _address)
121 {
122     char read[256];
123     char* pa;
124 
125     pa = read;
126 
127     ReadProcessMemory(hGameHandle, LPCVOID(_address), read, sizeof(read), NULL);
128 
129     for (pa; *pa != ‘\0‘; pa++)
130     {
131         return pa;
132     }
133     
134 }
135 
136 //写内存整数型
137 BOOL WriteMemeryInt(HANDLE hGameHandle, DWORD _address, DWORD Data)
138 {
139     return WriteProcessMemory(hGameHandle, LPVOID(_address), &Data, sizeof(Data), NULL);
140 }
141 
142 //写内存小数型
143 BOOL WriteMemeryFloat(HANDLE hGameHandle, DWORD _address, FLOAT Data)
144 {
145     return WriteProcessMemory(hGameHandle, LPVOID(_address), &Data, sizeof(Data), NULL);
146 }
147 
148 //写内存字节数组
149 BOOL WriteMemeryBytes(HANDLE hGameHandle, DWORD _address, BYTE Data[], SIZE_T Bytes)
150 {
151     return WriteProcessMemory(hGameHandle, LPVOID(_address), Data, Bytes, NULL);
152 }
153 
154 //取本程序模块地址
155 DWORD_PTR GetProcessBaseAddress(DWORD processID)
156 {
157     DWORD_PTR   baseAddress = 0;
158     HANDLE      processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processID);
159     HMODULE     *moduleArray;
160     LPBYTE      moduleArrayBytes;
161     DWORD       bytesRequired;
162 
163     if (processHandle)
164     {
165         if (EnumProcessModules(processHandle, NULL, 0, &bytesRequired))
166         {
167             if (bytesRequired)
168             {
169                 moduleArrayBytes = (LPBYTE)LocalAlloc(LPTR, bytesRequired);
170 
171                 if (moduleArrayBytes)
172                 {
173                     unsigned int moduleCount;
174 
175                     moduleCount = bytesRequired / sizeof(HMODULE);
176                     moduleArray = (HMODULE *)moduleArrayBytes;
177 
178                     if (EnumProcessModules(processHandle, moduleArray, bytesRequired, &bytesRequired))
179                     {
180                         baseAddress = (DWORD_PTR)moduleArray[0];
181                     }
182                     LocalFree(moduleArrayBytes);
183                 }
184             }
185         }
186         CloseHandle(processHandle);
187     }
188     return baseAddress;
189 }
190 
191 //通杀调用Call
192 void MyCall_All(DWORD Pid, DWORD _CallAddress, LPVOID FuncName)
193 {
194     //获取进程句柄
195     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, Pid);
196 
197     //有参数的Call
198     if (_CallAddress == NULL)
199     {
200         //申请一块内存给整个Call
201         LPVOID MyCallAddress = VirtualAllocEx(hProcess, NULL, 0x1000, MEM_COMMIT, PAGE_READWRITE);
202         //写入Call的数据到上一行代码申请的内存中
203         WriteProcessMemory(hProcess, MyCallAddress, FuncName, 0x1000, NULL);
204         //创建远程线程-并获取线程的句柄
205         HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)MyCallAddress, NULL, 0, NULL);
206         //等待线程事件
207         WaitForSingleObject(hThread, 2000);
208         //防止内存泄露
209         CloseHandle(hThread);
210         CloseHandle(hProcess);
211     }
212     else
213     {
214         //创建远程线程-并获取线程的句柄
215         HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)_CallAddress, NULL, 0, NULL);
216         //等待线程事件
217         WaitForSingleObject(hThread, 2000);
218         //防止内存泄露
219         CloseHandle(hThread);
220         CloseHandle(hProcess);
221     }
222 }
223 
224 
225 //**********************************************************************************************************************************
226 
227 
228 //修改口袋西游血量函数
229 BOOL ChangeBlood()
230 {
231     DWORD Address = 0x2e2626b8;
232     BYTE Code[] = { 0x00,0x23,0x24,0x25,0xAE,0x04,0x04,0x04,0x04,0x04 };
233     //字节数组
234     return WriteMemeryBytes(_hGameHandle, Address, Code, 10);
235 }
236 
237 //插件初始化
238 VOID Begin()
239 {
240     SetConsoleTitleA("创世战车人物遍历 cmd版本");
241 
242     //取进程ID
243     ProcessId = _GetProcessId(NULL,(char*)"Crossout 0.10.48.109594");
244 
245     printf("\n进程ID：%d\n", ProcessId);
246 
247     //获取进程的句柄
248     _hGameHandle = _GetProcessHandle(ProcessId);
249 
250     printf("进程句柄：%x\n", (unsigned int)_hGameHandle);
251 
252     //_ReadMemeryString(_hGameHandle, 0x04389308);
253 
254     //printf("\n字符串：%s\n", _ReadMemeryString(_hGameHandle, 0x04389308));
255 
256 
257 }
258 
259 bool worldtosc(float mousex, float mousey, float juli, float nowx, float nowy, float scX, float scY)
260 {
261     int flagX = 0;
262     int entryX = 0;
263     float leftborderX = nowx - 3.14 / 4;
264     if (leftborderX < -3.14) {
265         leftborderX += 3.14;
266         flagX = 1;
267     }
268     float rightborderX = nowx + 3.14 / 4;
269     if (rightborderX > 3.14) {
270         rightborderX -= 3.14;
271         flagX = 1;
272     }
273     if (flagX == 1)
274     {
275         if (mousex > leftborderX || mousex < rightborderX)
276         {
277             entryX = 1;
278         }
279     }
280     else if(mousex>leftborderX&&mousex<rightborderX)
281     {
282         entryX = 1;
283     }
284     if (fabs(nowy - mousey)<=fovY/2&&entryX==1)
285     {
286         //printf("nowx = %f \nnowy= %f\nmousex=%f\nmousey=%f\n宽=%d\n高=%d\n", nowx, nowy, mousex, mousey, m_rect.right - m_rect.left, m_rect.bottom - m_rect.top);
287         //float lineA = juli * sin(mousex-nowx);
288         //float lineB = juli * sin(nowy -mousey);
289         //float lineAA = cos(nowx - mousex)*juli;
290         //float lineBB = cos(nowy - mousey)*juli;
291         //float lineAAA = tan(fovX / 2)*lineAA;
292         //float lineBBB = tan(fovY / 2)*lineBB;
293         float len = (m_rect.right - m_rect.left) / 2;
294         float high = (m_rect.bottom - m_rect.top) / 2;
295         //printf("%f %f", len*2, high*2);
296         //printf("x=%d y=%d\n", m_rect.left, m_rect.top);
297         scX = tan(mousex - nowx)*len / tan(fovX / 2) + len+ m_rect.left;
298         scY = tan(nowy - mousey)*high / tan(fovY / 2) + high + m_rect.top;
299         //printf("scX = %f\nscY = %f \n", scX, scY);
300         //printf("lineA = %f   lineB = %f \n line AA = %f ,lineBB = %f \n line AAA = %f   lineBBB = %f  \n scX = %f  scY = %f \n", lineA, lineB,lineAA,lineBB,lineAAA,lineBBB,scX,scY);
301         //DrawString((int)(scX-cx/juli), (int)(scY - cx / juli - 48), RGB(255, 0, 0), "Miraculous_B");
302         DrawBorderBox((int)(scX-cx/juli), (int)(scY-cx/juli-48), (int)2500.0/juli, (int)2500.0/juli, (int)8.0);
303         //DrawFilledRect((int)scX, (int)scY - 48, (int)2500.0);
304         return 1;
305     }
306 }
307 void SetupDrawing(HDC hDesktop, HWND handle)
308 {
309     HDC_Desktop = hDesktop;
310     Handle = handle;
311     EnemyBrush = CreateSolidBrush(RGB(0, 255, 0));
312     //Color
313     SnapLineCOLOR = RGB(0, 0, 255);
314     TextCOLOR = RGB(0, 255, 0);
315 }
316 VOID ReadValue()
317 {
318     HWND h_wnd = ::FindWindow(_T("Crossout 0.10.48.109594"), NULL);
319     HDC HDC_Desktop = GetDC(h_wnd);
320     SetupDrawing(HDC_Desktop, h_wnd);
321     DWORD_PTR modbase = GetProcessBaseAddress(ProcessId);
322     DWORD TempAddress, RetTemp, GetBase, ObjectAddress, ObjectValue;
323     HWND qwq = FindWindow(NULL, "Crossout 0.10.48.109594");
324     GetWindowRect(qwq, &m_rect);
325     printf("x=%d y=%d\n",m_rect.left, m_rect.top);
326     //基地址
327     //DWORD BaseAddress = modbase + BasePtr;
328     //DWORD BaseAddress = 0x2D5D6D0;
329     DWORD BaseAddress = GetProcessBaseAddress(ProcessId) + BasePtr;
330     //数组基地址
331     //DWORD Address_Array = modbase + ArrayPtr;
332     //DWORD Address_Array = 0x3345890;
333     DWORD Address_Array = GetProcessBaseAddress(ProcessId) + ArrayPtr;
334     printf("%x\n%x\n", BaseAddress, Address_Array);
335     char* Name = NULL;
336     int Count = 1;
337     int n=-1;
338     int duiyou[50];
339     memset(duiyou, 0, sizeof(duiyou));
340     while (1) {
341         float minjuli = 9999999999;
342         float x1 = 0, y1 = 0, z1 = 0; // 最近敌人位置
343         float x0 = 0, y0 = 0, z0 = 0; // 摄像机位置
344         y0 = _ReadMemeryFloat(_hGameHandle, modbase + 0x264A4A8);
345         x0 = _ReadMemeryFloat(_hGameHandle, modbase + 0x264A4A0);
346         z0 = _ReadMemeryFloat(_hGameHandle, modbase + 0x264A4A4);
347         int xiabiao = 0;
348         for (int i = 0; i < 16; i++)
349         {
350             //地址解密
351             TempAddress = i * 0x870 + Address_Array + 0x3638;
352             RetTemp = _ReadMemeryInt(_hGameHandle, TempAddress);
353             //计算数组遍历地址
354             RetTemp = ((RetTemp & 0x0fff) + 0x2AAD) * 0x0c;
355             //基地址
356             GetBase = _ReadMemeryInt(_hGameHandle, BaseAddress);
357             //[[2D5D6D0] + (([03345890 + ((i * 870) + 3638)] & 0fff) + 2aad) * 3 * 4] + 0C0
358             //计算人物对象地址
359             ObjectAddress = GetBase + RetTemp;
360             //读人物对象地址
361             ObjectValue = _ReadMemeryInt(_hGameHandle, ObjectAddress);
362             //判断对象是否存在
363             if (ObjectValue != NULL&&duiyou[i]==0)
364             {
365                 //读取人物血量
366                 float Bloat = _ReadMemeryFloat(_hGameHandle, ObjectValue + 0xc0);
367                 float y = _ReadMemeryFloat(_hGameHandle, ObjectValue + 0x2b8);
368                 float x = _ReadMemeryFloat(_hGameHandle, ObjectValue + 0x2b0);
369                 float z = _ReadMemeryFloat(_hGameHandle, ObjectValue + 0x2b4);
370                 float juli = sqrt((y - y0)*(y - y0) + (x - x0)*(x - x0) + (z - z0)*(z - z0));
371 
372                 if (minjuli > juli&&x!=0&&i!=n&&Bloat>0.00001)//获得最小距离以选中最近敌人自瞄,  不选中自己 , 去噪x2
373                 {
374                     xiabiao = i;
375                     minjuli = juli;
376                     x1 = x;
377                     y1 = y;
378                     z1 = z;
379                 }
380                 if (Bloat != 0&&x!=0) {
381                     if (n == -1) //标记队友
382                     {
383                         duiyou[i] = 0;
384                     }
385                     ObjectAddress = GetBase + RetTemp;
386                     printf("下标:%d  血量：%.3f  坐标:(%.0f,%.0f,%.0f)，人物阵营:%x\n",i, Bloat, x, y,z, _ReadMemeryFloat(_hGameHandle, ObjectValue - 0x38));
387                 }
388                 //-------------------------------------------------------------获得mousex,mousez
389                 float x11 = x, y11 = y, z11 = z;
390                 x11 -= x0;
391                 x11 = -x11;
392                 y11 -= y0;
393                 y11 = -y11;
394                 z11 = z11 - z0;
395                 float k = fabs(atan(y11 / x11));
396                 float mousex = 0;
397                 float mousez = 0;
398                 if (x11 > 0 && y11 > 0) //第一向量
399                     mousex = 1.57 - (k * 2 / 3.1415926*1.57);
400                 if (x11 > 0 && y11 < 0)  //4
401                     mousex = 1.57 + (k * 2 / 3.1415926*1.57);
402                 if (x11 < 0 && y11 < 0)  //3
403                     mousex = -1.57 - (k * 2 / 3.1415926*1.57);
404                 if (x11 < 0 && y11 > 0)  //2
405                     mousex = -1.57 + (k * 2 / 3.1415926*1.57);
406                 if (z11 > 0)
407                     mousez = atan(z11 / sqrt((x11*x11 + y11 * y11)));
408                 else
409                     mousez = atan(z11 / sqrt((x11*x11 + y11 * y11)));
410                     //mousez = -fabs(atan(z11 / juli) * 2 / 3.1415926)*1.57;
411                 //-------------------------------------------------------------获得mousex,mousez
412 
413                 //-------------------------------------------------------------方框透视
414                 float nowx = _ReadMemeryFloat(_hGameHandle, modbase + mousexptr);
415                 float nowy = _ReadMemeryFloat(_hGameHandle, modbase + mousexptr + 4);
416                 float scx = 0;
417                 float scy = 0;
418                 worldtosc(mousex, mousez, juli, nowx, nowy,scx, scy);
419                 //-------------------------------------------------------------方框透视
420                 ObjectAddress = NULL;
421                 ObjectValue = NULL;
422             }
423 
424         }
425         //-------------------------------------------------------------获得本人下标
426         if (n == -1)
427         {
428             scanf_s("%d",&n);
429             Sleep(3*1000);
430             continue;
431         }
432         //-------------------------------------------------------------获得本人下标
433         //float y2 = y1;
434         //float x2 = x1;
435         /*
436         //-------------------------------------------------------------获得mousex,mousez
437         x1 -= x0;
438         x1 = -x1;
439         y1 -= y0;
440         y1 = -y1;
441         float k = fabs(atan(y1 / x1));
442         float mousex=0;
443         if (x1 > 0 && y1 > 0) //第一向量
444             mousex = 1.57 - (k * 2 / 3.1415926*1.57);
445         if (x1 > 0 && y1 < 0)  //4
446             mousex = 1.57 + (k * 2 / 3.1415926*1.57);
447         if (x1 < 0 && y1 < 0)  //3
448             mousex = -1.57 - (k * 2 / 3.1415926*1.57);
449         if (x1 < 0 && y1 > 0)  //2
450             mousex = -1.57+(k * 2 / 3.1415926*1.57);
451         float z2 = z1;
452         z1 = z1 - z0;
453         float mousez = 0;
454         if (z1 > 0)
455             mousez = fabs(atan(z1 / minjuli) * 2 / 3.1415926)*1.57;
456         else
457             mousez = -fabs(atan(z1 / minjuli) * 2 / 3.1415926)*1.57;
458         //-------------------------------------------------------------获得mousex,mousez
459 
460         //-------------------------------------------------------------方框透视
461         float nowx = _ReadMemeryFloat(_hGameHandle, modbase + mousexptr);
462         float nowy = _ReadMemeryFloat(_hGameHandle, modbase + mousexptr + 4);
463         float scx = 0;
464         float scy = 0;
465         worldtosc(mousex, mousez, minjuli, nowx, nowy, scx, scy);
466         //-------------------------------------------------------------方框透视
467 
468         //-------------------------------------------------------------自瞄
469         //if (duiyou[xiabiao] == 0&& GetAsyncKeyState(VK_RBUTTON)) {
470         //    WriteMemeryFloat(_hGameHandle, modbase + mousexptr, mousex);
471         //    WriteMemeryFloat(_hGameHandle, modbase + mousexptr + 4, mousez);
472         //}
473         //-------------------------------------------------------------自瞄
474 
475         */
476 
477         //printf("离最近的人的鼠标X值：%f    k=%f ,x1=%f,y1=%f,z1 = %f minjuli=%f\n", mousex,k,x1,y1,z1,minjuli);
478         //printf("最近的那个人的坐标：%f %f %f\n", x2, y2,z2);
479         //printf("我的坐标:%f  , %f  , %f\n ", x0, y0,z0);
480         system("cls");
481     }
482 }
483 
484 
485 int main()
486 {
487     //辅助的初始化
488     //scanf_s("%f", &cx);
489     Begin();
490     ReadValue();
491     getchar();
492     return 0;
493     /*
494     DWORD qwq = _GetProcessId(NULL, (char*)"Crossout 0.10.48.109594");
495     HANDLE pwp = _GetProcessHandle(qwq);
496     printf("%x\n", pwp);
497     */
498 
499 }