[ [ 0x19BF914 ] + 0x38 ] [ [ 0x19BF914 ] + 0x3C ] [ [ 0x19BF914 ] + 0x40 ]
#include <iomanip> #include <Windows.h> #include <iostream> #include <stdio.h> #include <Psapi.h> #include <TlHelp32.h> #pragma comment( lib, "Psapi.lib" )
DWORD getProcessID( LPCSTR lpczProc )
{
DWORD dwRet = 0;
DWORD dwCount = 0;
HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 );
if( hSnapshot != INVALID_HANDLE_VALUE )
{
PROCESSENTRY32 pe = { 0 };
pe.dwSize = sizeof( PROCESSENTRY32 );
BOOL bRet = Process32First( hSnapshot, &pe );
while( bRet )
{
if( !_stricmp( pe.szExeFile, lpczProc ) )
{
dwCount++;
dwRet = pe.th32ProcessID;
}
bRet = Process32Next( hSnapshot, &pe );
}
if( dwCount > 1 )
dwRet = 0xFFFFFFFF;
CloseHandle( hSnapshot );
}
return dwRet;
}
DWORD getLibraryModule( char *szModuleName, DWORD dwProcessID )
{
HANDLE hHandle;
MODULEENTRY32 me32;
if( dwProcessID == 0 )
return 0;
hHandle = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessID );
me32.dwSize = sizeof( MODULEENTRY32 );
if( Module32First( hHandle, &me32 ) )
{
do
{
if ( strcmp( szModuleName, me32.szModule ) == 0 )
{
CloseHandle( hHandle );
return ( DWORD ) me32.modBaseAddr;
}
}
while( Module32Next( hHandle, &me32 ) );
}
CloseHandle( hHandle );
return 0;
}
void WINAPI SKill( void )
{
static DWORD dwSKill;
static float fValue = 120.0f;
DWORD dwCFProcessID = getProcessID( "crossfire.exe" );
if( dwCFProcessID != 0 )
{
HANDLE CFHandle = OpenProcess( PROCESS_ALL_ACCESS, 0, dwCFProcessID );
cout << "Crossfire Handle: 0x" << hex << CFHandle << endl;
if( CFHandle != 0 )
{
DWORD dwCFCShell = GetDLLBase( "cshell.dll", dwCFProcessID );
if( dwCFCShell != 0 )
{
cout << "CShell Base Address: 0x" << hex << dwCFCShell << endl;
ReadProcessMemory( CFHandle, ( LPVOID ) ( dwCFCShell + 0x01AAB11C ), &dwSKill, sizeof( dwSKill ), 0 );
if( dwSKill != 0 )
{
cout << "Model Node Address: 0x" << hex << dwSKill << endl;
WriteProcessMemory( CFHandle, ( LPVOID ) ( dwSKill + 0x38 ), &fValue, sizeof( float ), 0 );
WriteProcessMemory( CFHandle, ( LPVOID ) ( dwSKill + 0x3C ), &fValue, sizeof( float ), 0 );
WriteProcessMemory( CFHandle, ( LPVOID ) ( dwSKill + 0x40 ), &fValue, sizeof( float ), 0 );
}
}
}
}
}
int main( void )
{
static DWORD crossfire, WHAddress;
// Abra o executável quando você estiver no looby do crossfire.
do
{
crossfire = getProcessID( "crossfire.exe" );
cout << "Aguardando crossfire.exe ..." << endl;
Sleep( 100 );
}
while( !crossfire );
SKill( );
system( "pause" );
return 0;
}