|
|
网易 POPO
http://www.team509.com/modules.php?name=News&file=article&sid=41
操作方法跟UC的那个差不多，唯一的区别就是team509这几个字要放到最前面，那
个dll在这儿下载：http://www.team509.com/popoDos.dll
没什么好写的，把source code贴出来吧,需定义基地址为:0x50000000.
// popoDos.cpp : 定义 DLL 应用程序的入口点。
//
#include "stdafx.h"
#include "Winbase.h"
extern "C" __declspec(dllexport) void __fastcall my_pack(unsigned char *thiscall,unsigned char *nouse,unsigned char * src,unsigned int len);
void __fastcall my_pack(unsigned char *thiscall,unsigned char *nouse,unsigned char * src,unsigned int len)
{
int real_pack = 0xcc5a90 ;
for (int i = 0 ; i< 0xff ; i++)
{
if(memcmp((const void *)(src+i),"team509",7) == 0)
{
*(src+i-1) = 0xff;
*(src+i-2) = 0xff;
}
}
__asm{
mov ecx,thiscall
push len
push src
call real_pack
add esp,0x100
add ebp,0xa0
ret 8
}
}
void writemem()
{
unsigned char packaddr[] = "xe9xe0x34x4f";
HANDLE hProcess = GetCurrentProcess ();
DWORD dwWritten = 0;
WriteProcessMemory (hProcess,
(VOID *)0xcc3689,
(VOID *)packaddr,
4,
&dwWritten);
}
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
unsigned int offset = 0 ;
if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
writemem();
}
return TRUE;
}
|
|
