88 lines
4.8 KiB
Python
88 lines
4.8 KiB
Python
|
import win32gui
|
|||
|
|
import win32process
|
|||
|
|
import win32api
|
|||
|
|
import ctypes
|
|||
|
|
import time
|
|||
|
|
# 参考资料 https://www.52pojie.cn/thread-1132032-1-1.html
|
|||
|
|
|
|||
|
|
def change_sun(Phand, sun_num):
|
|||
|
|
sun_date = ctypes.c_long()
|
|||
|
|
# kernel32.ReadProcessMemory(int(Phand), 0x03F8A9C0, ctypes.byref(sun_date), 4, None)
|
|||
|
|
kernel32.ReadProcessMemory(int(Phand), 0x6A9EC0, ctypes.byref(sun_date), 4, None)
|
|||
|
|
"""
|
|||
|
|
0x03F8A9C0 是基础地址，假设这里存储了一个指向阳光数值的指针。
|
|||
|
|
ctypes.byref(sun_date) 是一个指向sun_date变量的引用，用于接收从内存中读取的数据。
|
|||
|
|
4 表示读取数据的大小，这里是4字节，即一个整数。
|
|||
|
|
None 是一个可选参数，用来接收实际读取的字节数，但在这里我们不关心这个值。
|
|||
|
|
"""
|
|||
|
|
kernel32.ReadProcessMemory(int(Phand), sun_date.value + 0x768, ctypes.byref(sun_date), 4, None)
|
|||
|
|
# 写入新的数值
|
|||
|
|
new_sun_date = ctypes.c_long(sun_num)
|
|||
|
|
print(sun_date)
|
|||
|
|
print(new_sun_date)
|
|||
|
|
return kernel32.WriteProcessMemory(int(Phand), sun_date.value + 0x5560, ctypes.byref(new_sun_date), 4, None)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def change_cooling(Phand, cooling):
|
|||
|
|
"""
|
|||
|
|
修改冷却
|
|||
|
|
:param Phand:
|
|||
|
|
:param cooling: 0 冷却 1 无冷却
|
|||
|
|
:return:
|
|||
|
|
"""
|
|||
|
|
time.sleep(0.5)
|
|||
|
|
|
|||
|
|
cooling_data = ctypes.c_long()
|
|||
|
|
kernel32.ReadProcessMemory(int(Phand), 0x6A9EC0, ctypes.byref(cooling_data), 4, None)
|
|||
|
|
kernel32.ReadProcessMemory(int(Phand), cooling_data.value + 0x768, ctypes.byref(cooling_data), 4, None)
|
|||
|
|
kernel32.ReadProcessMemory(int(Phand), cooling_data.value + 0x144, ctypes.byref(cooling_data), 4, None)
|
|||
|
|
# kernel32.ReadProcessMemory(int(Phand),cooling_data.value,ctypes.byref(cooling_data),4,None)
|
|||
|
|
new_cooling_date = ctypes.c_long(cooling)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x70, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0xC0, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x110, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x160, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x1B0, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x200, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x250, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x2A0, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x2F0, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x340, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
# 可以看出，从第二个地址开始，每个地址与其前一个地址之间的差值是固定的，为0x50（80）。这种模式表明，每个卡槽的冷却时间数据在内存中是以固定间隔排列的。
|
|||
|
|
#
|
|||
|
|
# 推测剩余卡槽的冷却时间地址
|
|||
|
|
# 既然已知前十个卡槽的冷却时间地址遵循0x50的增量规律，那么我们可以轻易地推测出后五个卡槽的冷却时间地址：
|
|||
|
|
#
|
|||
|
|
# 第11个卡槽：0x340 + 0x50 = 0x390 （944）
|
|||
|
|
# 第12个卡槽：0x390 + 0x50 = 0x3E0 （992）
|
|||
|
|
# 第13个卡槽：0x3E0 + 0x50 = 0x430 （1072）
|
|||
|
|
# 第14个卡槽：0x430 + 0x50 = 0x480 （1168）
|
|||
|
|
# 第15个卡槽：0x480 + 0x50 = 0x4D0 （1232）
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x390, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x3E0, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x430, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
kernel32.WriteProcessMemory(int(Phand), cooling_data.value + 0x480, ctypes.byref(new_cooling_date), 4, None)
|
|||
|
|
|
|||
|
|
|
|||
|
|
def change(Phand, param):
|
|||
|
|
while(1000):
|
|||
|
|
change_sun(Phand,param)
|
|||
|
|
change_cooling(Phand,1)
|
|||
|
|
|
|||
|
|
|
|||
|
|
if __name__ == '__main__':
|
|||
|
|
# 调用动态链接库
|
|||
|
|
kernel32 = ctypes.windll.LoadLibrary('kernel32.dll')
|
|||
|
|
# 调用最高权限执行
|
|||
|
|
PROCESS_ALL_ACCESS = (0x000F0000 | 0x00100000 | 0xFFF)
|
|||
|
|
# 获取窗口句柄
|
|||
|
|
windos_handle = win32gui.FindWindow(None, "植物大战僵尸v2.2 ")
|
|||
|
|
# 获取进程PID
|
|||
|
|
read, pid = win32process.GetWindowThreadProcessId(windos_handle)
|
|||
|
|
# 获取进程句柄
|
|||
|
|
Phand = win32api.OpenProcess(PROCESS_ALL_ACCESS, False, pid)
|
|||
|
|
# 调用修改函数
|
|||
|
|
print("PID:",pid)
|
|||
|
|
print("进程句柄：",Phand)
|
|||
|
|
print(change(Phand,9999))
|
|||
|
|
print("end")
|