Java外挂开发入门示例

由于原文较长，图又比较多，且CSDN博客图片目前无法外部访问|||，所以仅发来部分，全文请去鄙人CSDN的博客：http://blog.csdn.net/cping1982 ，希望51cto能早日提供博客迁移功能……

  示例运行结果如下图：
 

package org.loon.test.os;

/**
        * Copyright 2008
        *
        * Licensed under the Apache License, Version 2.0 (the "License"); you may not
        * use this file except in compliance with the License. You may obtain a copy of
        * the License at
        *
        * http://www.apache.org/licenses/LICENSE-2.0
        *
        * Unless required by applicable law or agreed to in writing, software
        * distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
        * WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
        * License for the specific language governing permissions and limitations under
        * the License.
        *
        * @project loonframework
        * @author chenpeng
        * @email：[e-mail]
        * @version 0.1
        */
import java.awt.Dimension;
import javax.swing.JButton;
import java.awt.Rectangle;
import java.awt.event.WindowAdapter;
import java.awt.event.WindowEvent;
import java.awt.EventQueue;
import java.awt.SystemColor;
import java.awt.Color;

import javax.swing.JOptionPane;
import javax.swing.JPanel;
import javax.swing.JFrame;
import javax.swing.JTextField;
import javax.swing.JLabel;

import org.loon.framework.os.ASM;
import org.loon.framework.os.OSProcess;


public class TestCallForm extends JFrame {

                 private static final long serialVersionUID = 1L;

                 private JPanel jContentPane = null;

                 private JButton btnHP = null;

                 private JButton btnHome = null;

                 private JButton btnBaseEax = null;

                 private JButton btnIce = null;

                 private JButton btnFire = null;

                 private JButton btnSP = null;

                 private JTextField txtIntPtr = null;

                 private JLabel jLabel = null;

                 public TestCallForm() {
                                 super();
                                 initialize();
                 }

                 private void initialize() {

                                 this.setResizable(false);
                                 this.setSize(238, 315);
                                 this.setContentPane(getJContentPane());
                                 this.setTitle("Java外挂开发入门示例");
                                 this.setLocationRelativeTo(null);
                                 this.addWindowListener(new WindowAdapter() {
                                                 public void windowClosing(WindowEvent e) {
                                                                 System.exit(0);
                                                 }
                                 });
                 }

                 private JPanel getJContentPane() {
                                 if (jContentPane == null) {
                                                 jLabel = new JLabel();
                                                 jLabel.setBounds(new Rectangle(30, 20, 180, 30));
                                                 jLabel.setForeground(Color.white);
                                                 jLabel.setText("寄存器EAX值（针对本机环境）");
                                                 jContentPane = new JPanel();
                                                 jContentPane.setLayout(null);
                                                 jContentPane.setSize(new Dimension(236, 241));
                                                 jContentPane.setBackground(SystemColor.activeCaption);
                                                 jContentPane.add(getBtnHP(), null);
                                                 jContentPane.add(getBtnHome(), null);
                                                 jContentPane.add(getBaseIntPtr(), null);
                                                 jContentPane.add(getBtnIce(), null);
                                                 jContentPane.add(getBtnFire(), null);
                                                 jContentPane.add(getBtnSP(), null);
                                                 jContentPane.add(getTxtIntPtr(), null);
                                                 jContentPane.add(jLabel, null);
                                 }
                                 return jContentPane;
                 }

                 private JButton getBtnHP() {
                                 if (btnHP == null) {
                                                 btnHP = new JButton();
                                                 btnHP.setBounds(new Rectangle(15, 106, 95, 30));
                                                 btnHP.setText("吃血");
                                                 btnHP.addMouseListener(new java.awt.event.MouseAdapter() {
                                                                 public void mouseClicked(java.awt.event.MouseEvent e) {
                                                                                 clickEvent("hp");
                                                                 }
                                                 });
                                 }
                                 return btnHP;
                 }

                 private JButton getBtnHome() {
                                 if (btnHome == null) {
                                                 btnHome = new JButton();
                                                 btnHome.setBounds(new Rectangle(15, 195, 200, 30));
                                                 btnHome.setText("回城");
                                                 btnHome.addMouseListener(new java.awt.event.MouseAdapter() {
                                                                 public void mouseClicked(java.awt.event.MouseEvent e) {
                                                                                 clickEvent("home");
                                                                 }
                                                 });
                                 }
                                 return btnHome;
                 }

                 private JButton getBtnIce() {
                                 if (btnIce == null) {
                                                 btnIce = new JButton();
                                                 btnIce.setBounds(new Rectangle(120, 150, 95, 30));
                                                 btnIce.setText("冰系魔法");
                                                 btnIce.addMouseListener(new java.awt.event.MouseAdapter() {
                                                                 public void mouseClicked(java.awt.event.MouseEvent e) {
                                                                                 clickEvent("ice");
                                                                 }
                                                 });
                                 }
                                 return btnIce;
                 }

                 private JButton getBtnFire() {
                                 if (btnFire == null) {
                                                 btnFire = new JButton();
                                                 btnFire.setBounds(new Rectangle(15, 150, 95, 30));
                                                 btnFire.setText("火系魔法");
                                                 btnFire.addMouseListener(new java.awt.event.MouseAdapter() {
                                                                 public void mouseClicked(java.awt.event.MouseEvent e) {
                                                                                 clickEvent("fire");
                                                                 }
                                                 });
                                 }
                                 return btnFire;
                 }

                 private JButton getBtnSP() {
                                 if (btnSP == null) {
                                                 btnSP = new JButton();
                                                 btnSP.setBounds(new Rectangle(120, 106, 95, 30));
                                                 btnSP.setText("加蓝");
                                                 btnSP.addMouseListener(new java.awt.event.MouseAdapter() {
                                                                 public void mouseClicked(java.awt.event.MouseEvent e) {
                                                                                 clickEvent("sp");
                                                                 }
                                                 });
                                 }
                                 return btnSP;
                 }

                 private JButton getBaseIntPtr() {
                                 if (btnBaseEax == null) {
                                                 btnBaseEax = new JButton();
                                                 btnBaseEax.setBounds(new Rectangle(15, 235, 200, 30));
                                                 btnBaseEax.setText("获得本机EAX数值");
                                                 btnBaseEax.addMouseListener(new java.awt.event.MouseAdapter() {
                                                                 public void mouseClicked(java.awt.event.MouseEvent e) {
                                                                                 clickEvent("find");
                                                                 }
                                                 });
                                 }
                                 return btnBaseEax;
                 }

                 private JTextField getTxtIntPtr() {
                                 if (txtIntPtr == null) {
                                                 txtIntPtr = new JTextField();
                                                 txtIntPtr.setBounds(new Rectangle(18, 57, 199, 30));
                                                 txtIntPtr.setText("00D52070");
                                 }
                                 return txtIntPtr;
                 }

                 /**
                        * 触发事件
                        *
                        * @param eventName
                        */
                 private void clickEvent(final String eventName) {
                                 int pid = OSProcess.findWindowProcessId("TForm1", "游戏找CALL练习实例one");
                                 if (pid == 0) {
                                                 JOptionPane.showMessageDialog(this, "您的游戏程序尚未启动，外挂无法加载！");
                                                 return;
                                 }
                                 int eaxPtr = 0;
                                 try {
                                                 eaxPtr = ASM.getHexStringToInt(this.txtIntPtr.getText().trim());
                                 } catch (Exception ex) {
                                                 JOptionPane.showMessageDialog(this, "寄存器数值设定格式有误，外挂无法加载！");
                                                 return;
                                 }
                                 // 从基址获取寄存器中eax数值
                                 if ("find".equalsIgnoreCase(eventName)) {
                                                 this.txtIntPtr.setText(OSProcess.readProcessMemory(pid, 0x456D68));
                                 }
                                 // 实例化asm类以进行java与汇编混合操作
                                 ASM asm = new ASM();

                                 // 保存所有寄存器，即全部进栈
                                 asm._PUSHAD();
                                 // 示例程序执行时，目标寄存器eax中的必备数值(PS:在我的机器上是00D52070,
                                 // 而找Call测试程序作者提供的是00D51FE4,请自行查找。错误时目标程序将崩溃。)
                                 asm._MOV_EAX(eaxPtr);
                                 // 吃红
                                 if ("hp".equalsIgnoreCase(eventName)) {
                                                 asm._MOV_EDX(0x453028);
                                                 asm._CALL(0x452E98);
                                 }
                                 // 吃蓝
                                 else if ("sp".equalsIgnoreCase(eventName)) {
                                                 asm._MOV_EDX(0x453040);
                                                 asm._CALL(0x452E98);
                                 }
                                 // 火系魔法
                                 else if ("fire".equalsIgnoreCase(eventName)) {
                                                 asm._MOV_ECX(0x45309C);
                                                 asm._MOV_EDX(2);
                                                 asm._CALL(0x452DF8);
                                                 // 冰系魔法
                                 } else if ("ice".equalsIgnoreCase(eventName)) {
                                                 asm._MOV_ECX(0x45307C);
                                                 asm._MOV_EDX(1);
                                                 asm._CALL(0x452DF8);
                                 }
                                 // 回城
                                 else if ("home".equalsIgnoreCase(eventName)) {
                                                 asm._MOV_EDX(0x45305C);
                                                 asm._CALL(0x452E98);
                                 }
                                 // 还原所有寄存器，即全部出栈
                                 asm._POPAD();
                                 // 结尾标记，操作开始执行
                                 asm._RET();

                                 // 要求进行代码注入的进程id
                                 asm.doInject(pid);

                 }


                 public static void main(String[] args) {

                                 EventQueue.invokeLater(new Runnable() {
                                                 public void run() {
                                                                 TestCallForm callForm = new TestCallForm();
                                                                 callForm.setVisible(true);
                                                 }
                                 });

                 }

}

最后,再额外补充两点:

一,示例程序和真正的CALL外挂开发虽然原理上一样,工作量却是天差地别的,时间不充裕者请不要轻易尝试--|||

二,这个示例仅仅演示了localos的一部分功能,比如dll注入的接口在其中也提供了, 有兴趣者可以尝试一下,但要注意权限问题.          

程序源码及示例下载地址:http://code.google.com/p/greenvm/downloads/list (暂时先丢这里,源码在jar内)

OD下载地址:http://download.csdn.net/source/940795

PS:由于本例中有些敏感API的调用,运行时杀软对Javaw.exe报警请不要少见多怪...下个版本争取干掉杀软^^
本文出自 “Java究竟怎么玩” 博客，请务必保留此出处http://cping1982.blog.51cto.com/601635/125588

评论

1 楼 coreymylife 2010-04-01  

我丝毫没看出来JAVA在这里面有什么作用。。。。