|
马上注册,结交更多好友,享用更多功能,让你轻松玩转社区。
您需要 登录 才可以下载或查看,没有账号?立即注册
x
头
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9A 99 19 3E 0.15初始值
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9A 99 19 0.6
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 33 33 33 0.7
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 CD CC 4C 0.8
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 66 66 66 0.9
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3F 1
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 CD CC 8C 1.1
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9A 99 99 1.2
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 2
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 40 3
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 40 4
hyxd.exe+6F97AF
甲
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 3F 00 00 00 00 CD CC CC 3D 0.1初始值
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 2
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 40 3
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 40 4
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 A0 3F 5
01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 C0 3F 6
.版本 2
内存搜索 (进程ID, 十六进制到字节集 (“01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 9A 99 19 3E”), 伤害)
.计次循环首 (取数组成员数 (伤害), iii)
写内存字节集 (进程ID, 伤害 [iii], 还原字节集2 (“01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 40”)) ' 头 范围3
.计次循环尾 ()
其他的就那样改!
.版本 2
写内存字节集 (进程ID, GetProcAddress (ntdll, “DbgUiRemoteBreakin”), 还原字节集2 (“7B”))
写内存字节集 (进程ID, GetProcAddress (ntdll, “NtSuspendProcess”), 还原字节集2 (“70”))
写内存字节集 (进程ID, GetProcAddress (GDI32, “BitBlt”), 还原字节集2 (“C2 24 00”))
写内存字节集 (进程ID, GetProcAddress (GDI32, “DeleteDC”), 还原字节集2 (“C2 04 00”))
写内存字节集 (进程ID, GetProcAddress (GDI32, “GetBoundsRect”), 还原字节集2 (“C2 1E 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “ChildWindowFromPoint”), 还原字节集2 (“C2 0C 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “DragDetect”), 还原字节集2 (“C2 0C 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “EnumDesktopWindows”), 还原字节集2 (“C2 0C 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “EnumThreadWindows”), 还原字节集2 (“C2 0C 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “EnumWindows”), 还原字节集2 (“C2 08 00 62 8A”))
写内存字节集 (进程ID, GetProcAddress (User32, “EqualRect”), 还原字节集2 (“C2 08 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “FindWindowA”), 还原字节集2 (“C2 08 00 62 8A”))
写内存字节集 (进程ID, GetProcAddress (User32, “FindWindowExA”), 还原字节集2 (“C2 10 00 8B 8A”))
写内存字节集 (进程ID, GetProcAddress (User32, “FindWindowExW”), 还原字节集2 (“C2 10 00 8B 8A”))
写内存字节集 (进程ID, GetProcAddress (User32, “FindWindowW”), 还原字节集2 (“E9 E5 9B 62 8A”))
写内存字节集 (进程ID, GetProcAddress (User32, “GetActiveWindow”), 还原字节集2 (“C3 01 E8 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “GetDC”), 还原字节集2 (“C2 04 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “GetWindowDC”), 还原字节集2 (“C2 04 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “PrintWindow”), 还原字节集2 (“C2 0C 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “ReleaseDC”), 还原字节集2 (“C2 08 00”))
写内存字节集 (进程ID, GetProcAddress (User32, “WindowFromPoint”), 还原字节集2 (“C2 08 00 00 8A B9”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “Heap32ListNext”), 还原字节集2 (“C2 08 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32EnumPageFilesA”), 还原字节集2 (“C2 08 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32EnumPageFilesW”), 还原字节集2 (“C2 10 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32GetMappedFileNameA”), 还原字节集2 (“C2 10 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32GetMappedFileNameW”), 还原字节集2 (“C2 10 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32GetModuleBaseNameW”), 还原字节集2 (“C2 10 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32GetModuleFileNameExA”), 还原字节集2 (“C2 10 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “K32GetModuleFileNameExW”), 还原字节集2 (“C2 10 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “Module32First”), 还原字节集2 (“C2 08 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “Module32Next”), 还原字节集2 (“C2 08 00”))
写内存字节集 (进程ID, GetProcAddress (kernel32, “Thread32First”), 还原字节集2 (“C2 08 00”))
黄小鸭检测 大厅修改
|
|