下面是我寫點擊command1觸發的事:
- Private Sub Command1_Click()
- Dim hwd As Long
- Dim pid As Long
- Dim hProcess As Long
- hwd = FindWindow(vbNullString, "爆爆王")
- GetWindowThreadProcessId hwd, pid
- hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
- If hProcess <> 0 Then
- Label1.Caption = "已偵測到BNB"
- Else
- Label1.Caption = "未偵測到BNB"
- End If
- End Sub
複製代碼
以下是我的API宣告:
- Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long
- Public Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
- Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
- Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
- Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
- Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
- Public Const PROCESS_ALL_ACCESS = &H1F0FFF
複製代碼
執行遊戲後,發現 hwd pid的數值都有抓到,但OpenProcess的返回值→hProcess的值都是0
但是要是抓取普通單機遊戲就抓的道
在論壇裡看到有人說是因為:
HS用了Hide SSDT把爆爆王和HS的Process隱藏起來了
直接用普通windows API的OpenProcess和ReadProcessMemory是無法操作的!
這樣的話要如何才能夠抓取到爆爆王的hProcess呢??? |
|