内存映射+远线程 调用游戏CALL

 源码中 用到的结构和未公开函数 请到 http://www.cnblogs.com/IMyLife/p/4826286.html 获取

 HANDLE ProcessHandle=NULL;
 DWORD pPID=NULL;
 DWORD TID=NULL;
 HWND i = FindWindowW(NULL, L"游戏窗口名称");
 TID=GetWindowThreadProcessId(i,&pPID);
 ProcessHandle=OpenProcess(PROCESS_ALL_ACCESS,FALSE,pPID);
 /映射字节集到进程
 DWORD MappingBytes(PVOID Address,DWORD BYTE_SIZE,WCHAR Nume[])
 {
     DWORD vaddress=NULL,size=NULL;
     HANDLE hMap=CreateFileMappingW(INVALID_HANDLE_VALUE,NULL,PAGE_EXECUTE_READWRITE,NULL,BYTE_SIZE,Nume);
     if(hMap!=NULL)
     {
         HANDLE pAddress=MapViewOfFile(hMap,FILE_MAP_ALL_ACCESS,NULL,NULL,NULL);
         if(pAddress!=NULL)
         {
             RtlMoveMemory(pAddress,Address,BYTE_SIZE);
             //映射字节集到目标进程
             ZwMapViewOfSection(hMap,ProcessHandle,&vaddress,NULL,NULL,NULL,&size,,,PAGE_EXECUTE_READWRITE);
             UnmapViewOfFile(pAddress);
             return vaddress;
         }
     }
     return ;
 }
 //获取HOOK函数的字节数量//记得HOOK函数最后加上 int 0 不然无法判断
 DWORD GetFunctionLong(DWORD JMPAddress)
 {
     BYTE *p=(BYTE*)JMPAddress;
     int i=;
     while (TRUE)
     {
         if((DWORD)*p==)
         {
             return i;
         }
         p++;
         i++;
     }
     return ;
 }
 //远程调用CALL函数主功能

 //要调用的CALL，参数结构，结构大小    可实现任意个数参数调用(看下面怎么获取参数的) 只测试了DWORD类型参数
 DWORD LoadCALL(DWORD* CALLAddress, DWORD* ParameterStruct, DWORD ParameterStruct_SIZE)
 {
     DWORD vaddress = NULL, size = NULL,lsbuff = ,lenght=,structbuff=;
     lenght = GetFunctionLong((DWORD)CALLAddress);
     HANDLE hMap = CreateFileMappingW(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, NULL, lenght, L"CALL");
     if (hMap != NULL)
     {
         HANDLE pAddress = MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, NULL, NULL, NULL);
         if (pAddress != NULL)
         {
             RtlMoveMemory(pAddress, CALLAddress, lenght);
             //映射CALL字节集到目标进程
             ZwMapViewOfSection(hMap, ProcessHandle, &vaddress, NULL, NULL, NULL, &size, , , );
             //映射参数结构到目标进程
             structbuff=MappingBytes((PVOID)ParameterStruct, ParameterStruct_SIZE, L"struct");
             //修改内存页面保护属性
             VirtualProtectEx(ProcessHandle, (LPVOID)vaddress, lenght, PAGE_EXECUTE_READWRITE, &lsbuff);
             //创建远线程执行CALL
             CreateRemoteThread(ProcessHandle, NULL, NULL, (LPTHREAD_START_ROUTINE)vaddress, (LPVOID)structbuff, NULL, NULL);
             UnmapViewOfFile(pAddress);
             return = vaddress;
         }
     }
     return ;
 }

   //调用远程CALL格式
   /*
  3 参数结构
  4 typedef struct A
  5 {
  6 DWORD a1;
  7 DWORD a2;
  8 DWORD a3;
  9 DWORD a4;
 10 };
 11 typedef struct A A1;
 12 typedef A1 *A2;
 13
 14 要调用的CALL
 15 void __declspec( naked ) ZwGoodsCALL()
 16 {
 17 _asm
 18 {
 19 MOV EAX, [ebp+8]
 20 mov ebx,dword ptr ds : [eax] //取结构第一个参数 第二个+4 第三个+8依次加4
 21 mov ecx,dword ptr ds : [eax+4]//获取第二个参数
 22 retn
 23 int 0// 结尾标识符 给获取函数长度函数做判断
 24 }
 25 }
 26 调用方法
 27 A2 pA2 = NULL;
 28 pA2 = (A2)malloc(sizeof(A1));
 29 pA2->a1 = 1;
 30 pA2->a2 = 2;
 31 pA2->a3 = 3;
 32 pA2->a4 = 4;
 33 LoadCALL((DWORD*)ZwGoodsCALL, (DWORD*)pA2, sizeof(A1));
 34 */ //