#include <Masm.au3>
#include <Array.au3>
#AutoIt3Wrapper_run_debug_mode=Y
;$jcid=WinGetProcess ( "Element Client")
Dim $v_ProcessID,$v_EAX,$v_EBX,$v_ECX,$v_EDX,$v_ESI,$tmp_Addr
$guaiwu=2147488188;怪物ID
$Hawd = WinGetHandle("Element Client")
GetWindowThreadProcessId($Hawd, $pid)
$hd = OpenProcess($PROCESS_ALL_ACCESS, False, $pid)
$v_ProcessID=$hd
;NoCall(0x005B0A80)
$PGetGwCallParam=DllStructCreate ( "dword EDX;dword EAX;ulong zx;ulong zy;ulong zz")
DllStructSetData($PGetGwCallParam,"EDX",$guaiwu);把怪物ID送入結構中
$c=DllStructGetPtr ( $PGetGwCallParam,"EDX");獲得EDX的地址
$vhandle=DllCallbackRegister ( "GetGwCall", "int", "hwnd;lparam" )
$d=DllCallbackGetPtr($vhandle);獲得函數的地址
Funin($Hawd,$d,$c,StringLen($guaiwu))
DllCallbackFree ( $vhandle )
;Mov_EAX_DWORD_Ptr($address) 這樣纔對Mov eax,[$address] 的意思!
;然後再Call_Eax()
Func Nocall($pDaima)
Local $v_TempppHandle,$v_Num
$v_TempppHandle = CreateRemoteThread($v_ProcessID, 0, 0,$pDaima, 0, 0, $v_num)
WaitForSingleObject($v_TempppHandle, $INFINITE);
CloseHandle($v_TempppHandle);
CloseHandle($v_ProcessID);
EndFunc
Func Funin($InHWND,$Funcv,$Param,$ParamSize)
Local $ThreadAdd, $ParamAdd,$hThread,$ThreadID,$lpNumberOfBytes
; $v_ProcessID = OpenProcess($PROCESS_ALL_ACCESS, False, $v_ProcessID);//打開被注入的進程
$ThreadAdd = VirtualAllocEx($v_ProcessID, 0, 4096, $MEM_COMMIT, $PAGE_READWRITE);
$tmp_Addr=$ThreadAdd
WriteProcessMemory($v_ProcessID, $ThreadAdd, $Funcv, 4096, $lpNumberOfBytes); //寫入函數地址
$ParamAdd = VirtualAllocEx($v_ProcessID, 0, $ParamSize, $MEM_COMMIT, $PAGE_READWRITE);
WriteProcessMemory($v_ProcessID, $ParamAdd, $Param, $ParamSize, $lpNumberOfBytes); //寫入參數地址
$hThread = CreateRemoteThread($v_ProcessID,0, 0, $ThreadAdd, $ParamAdd, 0, $lpNumberOfBytes); //創建遠程線程
WaitForSingleObject($hThread, $INFINITE);//等待線程結束
VirtualFreeEx($v_ProcessID, $ThreadAdd, 0, $MEM_RELEASE);
VirtualFreeEx($v_ProcessID, $ParamAdd, 0, $MEM_RELEASE); //釋放申請的地址
CloseHandle($hThread);
CloseHandle($v_ProcessID); //關閉打開的句柄
EndFunc
Func GetGwCall()
Local $edx1,$address
$address=Ptr(0x583980)
;$edx1 = DllStructGetData ( $PGetGwCallParam, "EDX");DllStructGetPtr ( $PGetGwCallParam,"EDX");
$edx1=DllStructGetPtr ( $PGetGwCallParam,"EDX");
Pushad()
Mov_ESI($edx1)
;mov esi, edx1
Push_ESI()
;push esi
Mov_ECX_DWORD_Ptr(0x009497B4)
;mov ecx, dword ptr [$009497B4]
Mov_ECX_DWORD_Ptr_ECX_Add(0x20)
;mov ecx, dword ptr [ecx+$20]
Add_ECX(0x0D4)
;add ecx,$D4
;Mov_EAX($address)
;Call_EAX()
Call_Ptr($address)
;call address
Popad()
;popad;
ret()
Run_ASM($Hawd)
Return(0)
EndFunc
Func Call_Ptr($i) ;Call 地址
;~算法:要調用代碼的地址 - 自身地址 - 5 =e8後面的數
;~例:OD裏:0042AAFC|E8 D7790000|Call 004324D8
;~要調用代碼的地址=004324D8
;~自身地址=0042AAFC
;最終算法爲:004324D8-0042AAFC-5=79D7
;再把79D7高地位轉換,就得出了D7790000
;再加上E8這個CALL代碼,得出:E8 D7790000
$x="0x"&Hex($i-$tmp_Addr-5)
$OPcode=$OPcode & "E8" & Exchange($x, 8)
$OPcode=$OPcode & "E8" & $i
EndFunc