第一步就是用CE查内存啦，配合魔兽窗口化工具大概需要二十分钟

1.20E     ：0x0045CB8C

1.24E     ：Game.dll+0x0AE8450

1.21       ：War3.exe+5CB8C

1.26       ：Game.dll+AD15F0

其他版本：Game.dll+ABDFE0

//由进程名获取进程ID，【出自百度空间，具体出处无法考证】

DWORD   GetProcessIdFromName(LPCTSTR  name)

{

PROCESSENTRY32   pe;

DWORD   id   =   0;

HANDLE   hSnapshot   =  CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);

pe.dwSize   =   sizeof(PROCESSENTRY32);

if(   !Process32First(hSnapshot,&pe)   )

return   0;

do

{

pe.dwSize   =   sizeof(PROCESSENTRY32);

if(   Process32Next(hSnapshot,&pe)==FALSE   )

break;

if(strcmp(pe.szExeFile,name)   ==   0)

{

id   =   pe.th32ProcessID;

break;

}

}   while(1);

CloseHandle(hSnapshot);

return   id;

}

//枚举进程模块，查找Game.dll基址，【出自MSDN】

DWORD ListProcessModules( DWORD dwPID )

{

HANDLE hModuleSnap = INVALID_HANDLE_VALUE;

MODULEENTRY32 me32;

//  Take a snapshot of all modules in the specified process.

hModuleSnap = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwPID );

if( hModuleSnap == INVALID_HANDLE_VALUE )

{

//printError( "CreateToolhelp32Snapshot (of modules)" );

return( FALSE );

}

//  Set the size of the structure before using it.

me32.dwSize = sizeof( MODULEENTRY32 );

//  Retrieve information about the first module,

//  and exit if unsuccessful

if( !Module32First( hModuleSnap, &me32 ) )

{

//printError( "Module32First" );  // Show cause of failure

CloseHandle( hModuleSnap );     // Must clean up the snapshot object!

return( FALSE );

}

//  Now walk the module list of the process,

//  and display information about each module

CString name;

do

{

name=me32.szModule;

if (name=="Game.dll")

{

CloseHandle( hModuleSnap );

return (DWORD) me32.modBaseAddr;

}

} while( Module32Next( hModuleSnap, &me32 ) );

//  Do not forget to clean up the snapshot object.

CloseHandle( hModuleSnap );

return( 0 );

}

//读取对应内存

int isInput()

{

int IsInput;

DWORD dwProcID;

//提高权限

HANDLE hToken;

HWND _hWnd=::FindWindow(NULL,"Warcraft III");

::OpenProcessToken(::GetCurrentProcess(),TOKEN_ADJUST_PRIVILEGES,&hToken);

LUID uID;

::LookupPrivilegeValue(NULL,SE_DEBUG_NAME,&uID);

TOKEN_PRIVILEGES tp;

tp.PrivilegeCount=1;

tp.Privileges[0].Luid=uID;

tp.Privileges[0].Attributes=SE_PRIVILEGE_ENABLED;

::AdjustTokenPrivileges(hToken,FALSE,&tp,sizeof(tp),NULL,NULL);

::CloseHandle(hToken);

//打开进程

::GetWindowThreadProcessId(_hWnd, &dwProcID);

HANDLE hProc = ::OpenProcess(PROCESS_VM_READ|PROCESS_VM_WRITE, FALSE, dwProcID);

HWND hd=FindWindow(NULL,"WarIIIKey 1.3");

//1.20E

if (IsDlgButtonChecked(hd,IDC_120E))

{

int b=::ReadProcessMemory(hProc, (LPVOID)0x0045CB8C, (LPVOID)&IsInput,4, NULL);

::CloseHandle(hProc);hProc=NULL;

return IsInput;

}

//1.24E

if (IsDlgButtonChecked(hd,IDC_124E))

{

int b=::ReadProcessMemory(hProc, (LPVOID)(hModule+0x0AE8450), (LPVOID)&IsInput,4, NULL);

::CloseHandle(hProc);hProc=NULL;

return IsInput;

}

//1.26

if (IsDlgButtonChecked(hd,IDC_126))

{

//DWORD hModule=ListProcessModules(GetProcessIdFromName("War3.exe"));

int b=::ReadProcessMemory(hProc, (LPVOID)(hModule+0xAD15F0), (LPVOID)&IsInput,4, NULL);

::CloseHandle(hProc);hProc=NULL;

return IsInput;

}else{

//DWORD hModule=ListProcessModules(GetProcessIdFromName("War3.exe"));

int b=::ReadProcessMemory(hProc, (LPVOID)(hModule+0xABDFE0), (LPVOID)&IsInput,4, NULL);

::CloseHandle(hProc);hProc=NULL;

return IsInput;

}

::CloseHandle(hProc);hProc=NULL;

return IsInput;

}