华夏 call注入

啊冲

unit myDLl;

interface

uses
Windows, Messages, SysUtils, Variants, Classes, Graphics, Controls, Forms,
Dialogs, StdCtrls, ExtCtrls , ComCtrls, XPMan;

type
TForm1 = class(TForm)
    Timer1: TTimer;
    PageControl1: TPageControl;
    TabSheet1: TTabSheet;
    Label1: TLabel;
    Label2: TLabel;
    Label3: TLabel;
    StaticText3: TStaticText;
    StaticText2: TStaticText;
    StaticText1: TStaticText;
    TabSheet2: TTabSheet;
    Button1: TButton;
    Button2: TButton;
    Button3: TButton;
    Button4: TButton;
    TabSheet3: TTabSheet;
    XPManifest1: TXPManifest;
    Button5: TButton;
    Button6: TButton;
    Edit1: TEdit;
    Edit2: TEdit;
    Edit3: TEdit;
    Edit4: TEdit;
    Edit5: TEdit;
    Edit6: TEdit;
    Edit7: TEdit;
    Edit8: TEdit;
    Button7: TButton;
    Button8: TButton;
    Button9: TButton;
    Button10: TButton;
    Button11: TButton;
    procedure Timer1Timer(Sender: TObject);
    procedure Button1Click(Sender: TObject);
    procedure Button2Click(Sender: TObject);
    procedure Button3Click(Sender: TObject);
    procedure Button4Click(Sender: TObject);
    procedure Button5Click(Sender: TObject);

    procedure Button6Click(Sender: TObject);
    procedure Button8Click(Sender: TObject);
    procedure Button7Click(Sender: TObject);
    procedure Button9Click(Sender: TObject);
    procedure Button10Click(Sender: TObject);
    procedure Button11Click(Sender: TObject);

   


private
{ Private declarations }
public
{ Public declarations }
end;

var
Form1: TForm1;
function HookProc(nCode:Integer;WParam: WPARAM;LParamPARAM)RESULT;stdcall;
function HookOn(lpHwnd:HWND;lpTypeongint)ongint;stdcall;export;
function HookOff:Boolean;stdcall;export;

implementation

var
hHk: HHOOK=0;
mhwnd:HWND=0;
bShow:Integer=1;
hThread: Cardinal;
hmod: Pointer; //Hinstance
hProcessId: Cardinal;
mMode:Integer;

{$R *.dfm}

function HookProc(nCode:Integer;WParam: WPARAM;LParamPARAM)RESULT;stdcall;
begin
//接收按键F8开始挂钩DLL
if (bShow=1) And (wParam=VK_MULTIPLY) then
    begin
bShow:=5;
Form1:=TForm1.Create(Application);
Form1.Show;
ShowCursor(true);
end;
if (bShow=2) And (wParam=VK_MULTIPLY) then
    begin
bShow:=6;
  form1.hide;
end;

if (bShow=3) And (wParam=VK_MULTIPLY) then
    begin
bShow:=2;
end;

if (bShow=4) And (wParam=VK_MULTIPLY) then
    begin
bShow:=1;
end;
if (bShow=5) then bShow:=3;
if (bShow=6) then bShow:=4;
Result := CallNextHookEx(hHk,nCode,WParam,LParam);
end;

function HookOn(lpHwnd:HWND;lpTypeongint): Longint;stdcall; export;
begin
hThread :=GetWindowThreadProcessId(lpHwnd,hmod);
//注入开始
hHk :=SetWindowsHookEx(lpType,@HookProc,hInstance,hThread); // WH_KEYBOARD
Result :=hHk
end;

function HookOff:Boolean;stdcall; export;
begin
if hHk<>0 then
begin
//移除挂钩
UnHookWindowsHookEx(hHk);
hHk :=0;
Result :=true;
end
else
Result :=false;

  end;



procedure TForm1.Timer1Timer(Sender: TObject);


var
WHandle:hwnd;
hPID:hwnd;
pHandle:hwnd;
base,addr,num,nameAddr:dword;
hp,maxhp,mp:cardinal;
name:array[0..32]of wideChar;
begin
WHandle := FindWindow(&#39;ZElementClient Window&#39;, &#39;Element Client&#39;);
GetWindowThreadProcessId(WHandle, @hPID);
PHandle := OpenProcess(PROCESS_ALL_ACCESS, False, hPID);
ReadProcessMemory(PHandle, Pointer($9404A4),@Base, 4, Num);
ReadProcessMemory(PHandle, Pointer(Base+$28), @Addr, 4, Num);
ReadProcessMemory(PHandle,Pint(Addr+$254),@HP,4,Num);
ReadProcessMemory(PHandle,Pint(Addr+$26c),@maxhP,4,Num) ;
ReadProcessMemory(PHandle,Pint(Addr+$258),@mP,4,Num) ;

ReadProcessMemory(PHandle,pointer(Addr +$3A4), @nameAddr, 4, Num);
ReadProcessMemory(PHandle,pointer(nameAddr), @name[0], 36, Num);
Form1.Label1.Caption:=inttostr(hp)+&#39;/&#39;+inttostr(maxhp);
Form1.Label2.Caption:=inttostr(mp);
Form1.Label3.Caption:=name;
end;




procedure TForm1.Button1Click(Sender: TObject);
var
neirong:string;
duixiang:string;
fangshi:string;
Addressointer;
begin

  Address:=Pointer($0045B868);
  neirong:=edit3.text;
  duixiang:=&#39;freeb8&#39;;
  fangshi:=&#39;轻声&#39;;
  asm
    pushad
    mov ebx, $00DD7170

    push neirong

    push fangshi

    push duixiang
    push ebx
    call address
    add     esp, $10
    popad
  end;
end;



procedure TForm1.Button2Click(Sender: TObject);
var
Addressointer;
begin
Address:=Pointer($07E77258);
asm
  pushad
  mov ecx,$07F1DC30
  call address
  popad

end;
end;

procedure TForm1.Button3Click(Sender: TObject);
var
Addressointer;
begin
Address:=Pointer($0040A389);   //攻击
asm

  push 50
  push 50
  push 100
  push 100
  push $1c
  push 1
  push 8
  call address
  add esp,$1c

end;
end;
procedure TForm1.Button4Click(Sender: TObject);
var
Addressointer;
str:string;
begin
Address:=Pointer($0040A389);
str:=edit4.text;
asm

  push str
  push 2
  push $1A

  call address
  add esp,$0c
  
end;

end;



procedure TForm1.Button5Click(Sender: TObject);
var
Addressointer;
str:string;
begin
Address:=Pointer($0040a389);
str:=edit5.text;
asm
  pushad
  push str
  push 01
  push $16
  call address
  add esp,$0c
  popad;
end;
end;
procedure TForm1.Button6Click(Sender: TObject);
var
address:pointer;
neirong:string;

begin
  address:=pointer($09394ae1);

  neirong:=edit3.text;

  asm
        pushad

       push neirong
       push $08612B30

       push 1

       mov ecx, $093F0430
       mov edx,$093C17F4
       mov ebx,$C0000000
        call address

        popad
  end;

end;


procedure TForm1.Button8Click(Sender: TObject);

    var
    address:pointer;
neirong: string;
fangshi: string;
duixiang:string;

begin
address:=pointer($0045b868);
neirong:=&#39;第一次说话&#39; ;
fangshi:=&#39;第一次说话&#39;  ;
duixiang:=&#39;老狼&#39;        ;

  asm
pushad
mov ebx,$00e77170
push  neirong             //内容
push  fangshi              //方式
push  duixiang               //对象
push  ebx                 //常量
call address
add esp,$10
popad
end;
end;
procedure TForm1.Button7Click(Sender: TObject);
var
address:pointer;
i,j:integer;

begin
address:=pointer($0045992c);
i:=strtoint(edit1.text);
j:=strtoint(edit2.text);

asm
pushad
mov ebx,$00e77170
push j
push i
push ebx
call address
popad

end;
end;
procedure TForm1.Button9Click(Sender: TObject);
var
address:pointer;

begin
address:=pointer($00451aa8);

asm
pushad
mov eax,$00D91FC4
mov ecx,$00000001
mov edx,$00000032
mov ebx,$00D91FC4

call   address
popad

end;
end;
procedure TForm1.Button10Click(Sender: TObject);

var
address:pointer;
i,j:integer;
begin
address:=pointer($0045aafc);
i:=strtoint(edit1.text);
j:=strtoint(edit2.text);
asm
pushad;
mov ecx,i
mov edx,j
mov eax,$00e77170;
call address
popad;
end;
end;
procedure TForm1.Button11Click(Sender: TObject);
var
address:pointer;
begin
address:=pointer($00581BF0);
asm
pushad
mov ecx,$80012716
call address
popad

end;

end;


end.


http://yunpan.cn/QXhZZC2K8LMVf