猫史档案馆

【作品展示】

 

【作品介绍】

此程序能让你在植物大战僵尸中作弊~

使用方法：

1.下载中文版植物大战僵尸，如喵download/55136.html

2.开始游戏，点击开始按钮。

3.输入数字，开始作弊。

 

【作品源代码】

#  j:\谷歌浏览器下载文件\jfsky.com-Plants_vs_Zombies\Plants vs. Zombies
from ctypes import *
from ctypes.wintypes import *

###################################
class CUSTOMTYPE:
    class MODULEENTRY32(Structure): #MODULEENTRY32数据结构 具体可以百度
        _fields_ = [
        ('dwSize',DWORD),
        ('th32ModuleID',DWORD),
        ('th32ProcessID',DWORD),
        ('GlblcntUsage',DWORD),
        ('ProccntUsage',DWORD),
        ('modBaseAddr',POINTER(BYTE)),
        ('modBaseSize',DWORD),
        ('hModule',HMODULE),
        ('szModule',CHAR * 256), 
        ('szExePath',CHAR * 260) 
            ]
        
    class PROCESSENTRY32(Structure): #PROCESSENTRY32数据结构 具体可以百度
        _fields_ = [
        ('dwSize',DWORD),
        ('cntUsage',DWORD),
        ('th32ProcessID',DWORD),
        ('th32DefaultHeapID',HMODULE),
        ('th32ModuleID',DWORD),
        ('cntThreads',DWORD),
        ('th32ParentProcessID',DWORD),
        ('pcPriClassBase',DWORD),
        ('dwFlags',DWORD), 
        ('szExeFile',CHAR*256) #CHAR型 长度256
            ]
#####################################   寻找进程名为Name的PID标识符
def take_proc(Name): 
    procsnapshot = windll.kernel32.CreateToolhelp32Snapshot(0x2,0)  #进程快照句柄 0x2十六进制
    porcinfo = CUSTOMTYPE.PROCESSENTRY32() #赋值PROCESSENTRY32数据结构给porcinfo
    porcinfo.dwSize= DWORD(512)  #地址页长度，太小会报错
    while windll.kernel32.Process32Next(procsnapshot,byref(porcinfo)):  #Process32Next 寻找下一个进程，byref=指针
        if str(porcinfo.szExeFile,'gbk')==Name: #等于要寻找的Name则返回 否则返回0
            windll.kernel32.CloseHandle(procsnapshot) #关闭 进程快照
            return porcinfo.th32ProcessID
    windll.kernel32.CloseHandle(procsnapshot)
    return 0
#####################################  取进程模块句柄
def module_address(ProcessID,Name): 
    procsnapshot = windll.kernel32.CreateToolhelp32Snapshot(0x8,ProcessID)
    procinfo = CUSTOMTYPE.MODULEENTRY32()
    procinfo.dwSize = DWORD(1024)  #地址页长度，太小会报错
    while windll.kernel32.Module32Next(procsnapshot,byref(procinfo)): #Module32Next 寻找下一个模块
        if str(procinfo.szModule,'gbk')==Name:
            windll.kernel32.CloseHandle(procsnapshot) #关闭 进程快照
            return procinfo.hModule #返回 hModule值
    windll.kernel32.CloseHandle(procsnapshot) #关闭 进程快照
    return procinfo.hModule
#####################################  写地址中内存值
def WriteMemory(ProcessID,address,value): #输入字节
    types = type(value)
    if types==int:
        newdate = c_long(value)
        length = 4
    elif types == list:
        newdate = c_buffer(bytes(value)) #list转bytse转c_byts缓存区
        length = len(value)
    else:
        return False
    Handle = windll.kernel32.OpenProcess(0x1F0FFF,False,ProcessID) #OpenProcess打开进程  0x1F0FFF十六进制 表示十进制2035711 ProcessID = 进程PID
    if windll.kernel32.WriteProcessMemory(Handle,address,byref(newdate),length,None): #WriteProcessMemory  Handle=进程句柄 address=地址 newdate=写内存地址值 length=写入长度
        rebool = True
    else:
        rebool = False
    windll.kernel32.CloseHandle(Handle)    
    return rebool
#####################################  读地址中内存值
def ReadMemory(ProcessID,address,bytelength=None): #length留空读4字节整数型，不等于空读字节串
    Handle = windll.kernel32.OpenProcess(0x1F0FFF,False,ProcessID)    #OpenProcess打开进程  0x1F0FFF十六进制 表示十进制2035711 ProcessID = 进程PID
    if bytelength == None: 
        newdate = c_long()
        length = 4 
    else:
        newdate = c_buffer(bytelength) #缓冲区
        length = bytelength
    windll.kernel32.ReadProcessMemory(Handle,address,byref(newdate),length,None)  #ReadProcessMemory  Handle=进程句柄 address=地址 newdate=写内存地址值 length=读取长度
    windll.kernel32.CloseHandle(Handle)
    if bytelength == None: 
        return newdate.value
    else:
         return list(newdate[::]) #c_buffer(ASCII)转list(数字)返回
#####################################
while True:
    print('================')
    number = int(input('1.99990阳光\n2.植物无冷却\n3.退出\n：'))
    if number == 1:
        pid = take_proc('PlantsVsZombies.exe') #读游戏进程PID
        address = module_address(pid,'PlantsVsZombies.exe')+0x2A9EC0 #读模块地址+0x2A9EC0=基址(静态地址)
        address = ReadMemory(pid,address)+0x768   #偏移一 0x768
        address = ReadMemory(pid,address)+0x5560  #偏移一 0x5560
        WriteMemory(pid,address,99990) #写入值
        print('修改阳光完成')
    elif number == 2:
        pid = take_proc('PlantsVsZombies.exe')
        address = module_address(pid,'PlantsVsZombies.exe')+0x88E73 #读模块地址+0x88E73=基址(静态地址)
        WriteMemory(pid,address,[198,69,72,1]) #写字节串
        print('修改冷却完成')
    elif number == 3:
        break

 

【提示】

部分含有Python第三方库相关内容的作品，在海龟编辑器网页端无法运行哦！如遇到这种情况，可以打开下面的链接，下载海龟编辑器客户端：

https://python.codemao.cn