undochanges.pas

冒险岛吸怪源码ＵＣＥ的制作材料 用于冒险岛游戏的外挂

        end;

        inc(x,4096);
      end;


      closehandle(p);
    end
    else
    begin
      //normal virtualprotect method     (wont work on newer nprotect games)
      x:=(newuser32dllbase-Olduser32dllbase)+user32dllregions[i].address;

      VirtualProtect(pointer(x),user32dllregions[i].size,page_execute_readwrite,ar);
      try
        CopyMemory(pointer(x),@user32memory[i][0],user32dllregions[i].size);
      except
        result:=false;

      end;
    end;
  end;

  if result then
    mainform.LabelModifiedmem.Caption:='A modification has been found in the memory and Cheat Engine fixed it'
  else
    mainform.LabelModifiedmem.Caption:='A modification has been found in the memory but Cheat Engine failed to fixed it';

  mainform.LabelModifiedmem.Visible:=true;
  mainform.Timer4.Enabled:=true;
end;

function CheckForChanges: boolean;
var kernel32,ntdll: thandle;
    newmem: array [0..19] of byte;

    i: integer;
    found:boolean;
begin
  //call from mainthread
  result:=true;
  InitMem;    //make sure the memory to compare is loaded

  //check the following apis (first 20 bytes):  (thats faster than complete memory compare each time)

  if oldkerneldllbase<>newkerneldllbase then exit;
  if oldntdllbase<>newntdllbase then exit;


  Try
    //check OpenProcess
    copyMemory(@newmem[0],pointer(OpenProcesspos),20);
    found:=false;
    for i:=0 to length(kerneldllregions)-1 do
      if (OpenProcessPos>=kerneldllregions[i].address) and (OpenProcessPos<kerneldllregions[i].address+kerneldllregions[i].size) then
      begin
        found:=true;

        //found the region to check
        //find the offset into the array
        if not Comparemem(@kernelmemory[i][(OpenProcessPos-kerneldllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error


    //check DebugActiveProcess
    copyMemory(@newmem[0],pointer(DebugActiveProcesspos),20);
    found:=false;
    for i:=0 to length(kerneldllregions)-1 do
      if (DebugActiveProcessPos>=kerneldllregions[i].address) and (DebugActiveProcessPos<kerneldllregions[i].address+kerneldllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@kernelmemory[i][(DebugActiveProcessPos-kerneldllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error


    //check SuspendThread
    copyMemory(@newmem[0],pointer(SuspendThreadpos),20);
    found:=false;
    for i:=0 to length(kerneldllregions)-1 do
      if (SuspendThreadPos>=kerneldllregions[i].address) and (SuspendThreadPos<kerneldllregions[i].address+kerneldllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@kernelmemory[i][(SuspendThreadPos-kerneldllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error

    //check ResumeThread
    copyMemory(@newmem[0],pointer(ResumeThreadpos),20);
    found:=false;
    for i:=0 to length(kerneldllregions)-1 do
      if (ResumeThreadPos>=kerneldllregions[i].address) and (ResumeThreadPos<kerneldllregions[i].address+kerneldllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@kernelmemory[i][(ResumeThreadPos-kerneldllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error


    //check ReadProcessMemory
    copyMemory(@newmem[0],pointer(ReadProcessMemorypos),20);
    found:=false;
    for i:=0 to length(kerneldllregions)-1 do
      if (ReadProcessMemoryPos>=kerneldllregions[i].address) and (ReadProcessMemoryPos<kerneldllregions[i].address+kerneldllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@kernelmemory[i][(ReadProcessMemoryPos-kerneldllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error

    //check WriteProcessMemory
    copyMemory(@newmem[0],pointer(WriteProcessMemorypos),20);
    found:=false;
    for i:=0 to length(kerneldllregions)-1 do
      if (WriteProcessMemoryPos>=kerneldllregions[i].address) and (WriteProcessMemoryPos<kerneldllregions[i].address+kerneldllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@kernelmemory[i][(WriteProcessMemoryPos-kerneldllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error

    //check NtOpenProcess (ntdll)
    copyMemory(@newmem[0],pointer(NtOpenProcesspos),20);
    found:=false;
    for i:=0 to length(ntdllregions)-1 do
      if (NtOpenProcessPos>=ntdllregions[i].address) and (NtOpenProcessPos<ntdllregions[i].address+ntdllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@ntdllmemory[i][(NtOpenProcessPos-ntdllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error


    //check SetWindowsHookEx (user32)
    copyMemory(@newmem[0],pointer(SetWindowsHookExApos+(Newuser32dllbase-olduser32dllbase)),20);
    found:=false;
    for i:=0 to length(user32dllregions)-1 do
      if (SetWindowsHookExAPos>=user32dllregions[i].address) and (SetWindowsHookExAPos<user32dllregions[i].address+user32dllregions[i].size) then
      begin
        found:=true;
        //found the region to check
        //find the offset into the array
        if not Comparemem(@user32memory[i][(SetWindowsHookExAPos-user32dllregions[i].address)],@newmem[0],20) then
        begin
          undoMemorychanges;
          exit;
        end;

      end;

    if not found then exit; //error


    result:=false;
  except

  end;
end;

procedure TUndoChangesThread.ShutdownProtection;
begin
  //shutdown the undothread and exit this procedure
  formsettings.cbUndoMemoryChanges.Checked:=false;
  if undothread<>nil then
  begin
    undothread.terminate;
    undothread:=nil;
  end;
end;

function TUndoChangesThread.CheckForChanges:boolean;
{result=true if there was a change}
begin
  result:=false;
  //check the following apis (first 20 bytes):  (thats faster than complete memory compare each time)
  //NtOpenProcess
  //DebugActiveProcess
  //SuspendThread
  //OpenProcess
  //SetWindowsHookEx
  //ReadProcessMemory
  //WriteProcessMemory

  if not InitMem then
  begin
    MessageBox(0,'The protection file couldn''t be loaded. The protector will not run','CE Protector Thread',MB_OK or MB_ICONERROR);
    synchronize(shutdownprotection);
    exit;
  end;

  if result then
  begin
    if not checkedokonce then
    begin
      //WARNING!!!! This is the first time this scan is done and the memory isn't what it should be.
      //This can be caused by 2 thinga
      //1: A anti-cheat or another hook changed the memory
      //2: The user had a update
      if MessageBox(0,'Warning! The memory of at least one key memory location is not what it should be. This can be due to a anti-cheat, a virus, or a windows update.'+#13#10+'Do you want to restore the memory to what it was suposed to be? (Click yes for CE to restore the memory, no to disable the memory restore function)','CE Protector Thread',MB_YESNO	or MB_ICONWARNING ) =IDNO	then
      begin
        synchronize(shutdownprotection);
        exit;
      end;
    end;

    //if it found something wrong it'll write over ALL the memory
  end;

  if not result then checkedokonce:=true;
end;

procedure TUndoChangesThread.ShowModification;
begin
  mainform.LabelModifiedmem.visible:=true;
end;

procedure TUndoChangesThread.HideModification;
begin
  mainform.LabelModifiedmem.visible:=false;
end;


procedure TUndoChangesThread.execute;
begin
  while not terminated do
  begin
    if (CheckForChanges) and (not terminated) then
    begin
      synchronize(ShowModification);
      sleep(2000);
      synchronize(HideModification);
      continue;
    end;
    if not terminated then sleep(5000); //check ebvery 5 seconds for changes
  end;
end;

initialization
  checkedokonce:=false;//i'm not 100% if declared variables are set to 0 (false) or not so let's be sure
  undothread:=nil;
  firstrun:=true;
  protectionloadeD:=false;
  Loadmem:=tcriticalsection.Create;
end.