遊戲輔助 | 小朋友下樓梯 (C# 血量、階層修改器)

EAX=002BBBD8
EBX=00000000
ECX=002BBBD8
EDX=00000000
ESI=00401C96
EDI=00000000
EBP=0018FD64
ESP=0018FD4C
EIP=00406212

Probable base pointer =002BBBD8

00406203 - jl 0040621F
00406209 - mov eax,[ebp+08]
0040620C - inc [eax+00001300]
00406212 - mov eax,[ebp+08]
00406215 - sub [eax+000012F4],00000080

using System;
using System.Diagnostics;
using System.Runtime.InteropServices;

namespace DownCheat
{
    class DownHelper
    {
        #region API

        //從指定內存中讀取字節集資料
        [DllImportAttribute("kernel32.dll", EntryPoint = "ReadProcessMemory")]
        public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, IntPtr lpBuffer, int nSize, IntPtr lpNumberOfBytesRead);

        //從指定內存中寫入字節集資料
        [DllImportAttribute("kernel32.dll", EntryPoint = "WriteProcessMemory")]
        public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, int[] lpBuffer, int nSize, IntPtr lpNumberOfBytesWritten);

        //打開一個已存在的進程對象，並返回進程的句柄
        [DllImportAttribute("kernel32.dll", EntryPoint = "OpenProcess")]
        public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        //關閉一個內核對象。其中包括文件、文件映射、進程、線程、安全和同步對象等。
        [DllImport("kernel32.dll")]
        private static extern void CloseHandle(IntPtr hObject);

        #endregion

        #region 使用方法

        //根據進程名獲取PID
        public static int GetPidByProcessName(string processName)
        {
            Process[] arrayProcess = Process.GetProcessesByName(processName);
            foreach (Process p in arrayProcess)
            {
                return p.Id;
            }
            return 0;
        }

        //讀取內存中的值
        public static int ReadMemoryValue(int baseAddress, string processName)
        {
            try
            {
                byte[] buffer = new byte[4];
                //獲取緩沖區地址
                IntPtr byteAddress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);
                //打開一個已存在的進程對象  0x1F0FFF 最高權限
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName));
                //將制定內存中的值讀入緩沖區
                ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 4, IntPtr.Zero);
                //關閉操作
                CloseHandle(hProcess);
                //從非托管內存中讀取一個 32 位帶符號整數。
                return Marshal.ReadInt32(byteAddress);
            }
            catch
            {
                return 0;
            }
        }

        //將值寫入指定內存地址中
        public static void WriteMemoryValue(int baseAddress, string processName, int value)
        {
            try
            {
                //打開一個已存在的進程對象  0x1F0FFF 最高權限
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName));
                //從指定內存中寫入字節集資料
                WriteProcessMemory(hProcess, (IntPtr)baseAddress, new int[] { value }, 4, IntPtr.Zero);
                //關閉操作
                CloseHandle(hProcess);
            }
            catch { }
        }

        #endregion
    }
}

using System;
using System.Windows.Forms;

namespace DownCheat
{
    public partial class Form1 : Form
    {
        //遊戲基址
        private int baseAddress = 0x0018FDA0;
        //遊戲名字
        private string processName = "down";
        //遊戲血量地址
        private int bloodAddress;
        //遊戲階層地址
        private int stageAddress;

        public Form1()
        {
            InitializeComponent();
            //讀取 基址
            baseAddress = DownHelper.ReadMemoryValue(baseAddress, processName);
            //計算 血量的地址 = 基址中的值 + 偏移量
            bloodAddress = baseAddress + 0x1170;
            //計算 階層的地址 = 基址中的值 + 偏移量
            stageAddress = baseAddress + 0x1300;
        }

        private void button1_Click(object sender, EventArgs e)
        {
            if (DownHelper.GetPidByProcessName(processName) == 0)
            {
                MessageBox.Show("遊戲沒有運行!");
                return;
            }
            //給血量地址中寫入數值,TextBox裡面的值
            DownHelper.WriteMemoryValue(bloodAddress, processName, int.Parse(this.textBox1.Text));
        }
        
        private void button2_Click(object sender, EventArgs e)
        {
            if (DownHelper.GetPidByProcessName(processName) == 0)
            {
                MessageBox.Show("遊戲沒有運行!");
                return;
            }
            //給階層地址中寫入數值,TextBox裡面的值
            DownHelper.WriteMemoryValue(stageAddress, processName, int.Parse(this.textBox2.Text));
        }
    }
}