- 注册时间
- 2011-3-6
- 最后登录
- 1970-1-1
该用户从未签到
|
var
Ader, Szy: DWORD;
N1,N2: DWORD;
function APILoader(): DWORD;
var
NTDLL: THandle;
Address: Pointer;
begin
Result := 0;
NTDLL := GetModuleHandle('NTDLL.DLL');
if NTDLL = 0 then Exit;
Address := GetProcAddress(NTDLL, 'ZwProtectVirtualMemory');
Result := Dword(Address);
end;
procedure KillMoney3();
begin
asm
MOV EAX,N1
MOV EDX,N2
CALL DWORD PTR DS:[EDX]
ret $14
end;
end;
procedure KillMoney2();
begin
asm
pushad
PUSH offset dwOldProtect
PUSH $40
PUSH offset szy
PUSH offset Ader
PUSH $-1
CALL KillMoney3
popad
end;
end;
procedure KillMoney1(aa, bb: DWORD);
var
Apiadder: DWORD;
begin
ader := aa;
szy := bb;
Apiadder := APILoader;
asm
pushad
mov eax,Apiadder
add eax,$1
mov ecx,[eax]
mov n1,ecx
add eax,$5
mov ecx,[eax]
mov n2,ecx
CALL KillMoney2
popad
end;
end;
procedure TForm1.Button5Click(Sender: TObject);
begin
KillMoney1($00445000, $5);
asm
mov eax,$00445000
mov [eax],$10000
end;
end;
希望有朋友把它改的更完善,记得发出来学习一下!
GetProcAddress GetModuleHandle 有Code 的朋友发出来学习下!改善下 |
|