unit1.pas

冒险岛吸怪源码ＵＣＥ的制作材料 用于冒险岛游戏的外挂

        athread.Connection.ReadBuffer(output[0],3);
        athread.connection.readbuffer(output[3],output[2]);
        output[3+output[2]]:=0;

        changevalue(pword(@output[0])^,pchar(@output[3]));
      end;

      CS_FREEZEADDRESS:
      begin
        log.Lines.Add('freeze address');
        athread.connection.readbuffer(output[0],2);
        FreezeAddress(pword(@output[0])^);
      end;

      CS_ReadProcessMemory:
      begin
        //log.Lines.add('ReadProcessMemory');

        athread.connection.readbuffer(output[0],6);

        getmem(tempbuf,pword(@output[4])^);
        check:=readprocessmemory(processhandle,pointer(pdword(@output[0])^),tempbuf,pword(@output[4])^,actualread);

        output[0]:=SC_ReadProcessMemoryResult; //readprocess result
        if check then output[1]:=0 else output[1]:=1;
        pword(@output[2])^:=word(actualread);

        copymemory(@output[4],tempbuf,actualread);
        freemem(tempbuf);
        athread.Connection.WriteBuffer(output[0],4+word(actualread));

      end;

      CS_WriteProcessMemory:
      begin
        //log.Lines.add('WriteProcessMemory');

        athread.connection.readbuffer(output[0],4+2);
        athread.connection.readbuffer(output[6],pword(@output[4])^);

        check:=WriteProcessMemory(processhandle,pointer(pdword(@output[0])^),@output[6],pword(@output[4])^,actualwritten);

        output[0]:=12; //writeprocessmemory result
        if check then output[1]:=0 else output[1]:=1;
        pword(@output[2])^:=word(actualwritten);
        athread.Connection.WriteBuffer(output[0],4);

      end;

      CS_FirstScan:
      begin
        log.Lines.add('First Scan');
        athread.connection.readbuffer(output[0],4+4+1+1+1); //start(4),stop(4),scantype(1),vartype(1),stringlength(1)
        athread.connection.readbuffer(output[11],output[10]); //string user typed in
        athread.connection.readbuffer(output[11+output[10]],1); //scanoptions

        SThread:=TScanThread.Create(true);
        //set the scan options
        SThread.firstScan:=True;
        SThread.progressbar:=progressbar1;
        SThread.max:=settings.max;


        SThread.StartAddress:=pdword(@output[0])^;
        SThread.StopAddress:=pdword(@output[4])^;
        SThread.Vartype:=output[8];
        currenttype:=output[8];

        SThread.Scantype:=output[9];
        SThread.ScanOptions:=output[11+output[10]];

        output[11+output[10]]:=0;

        SThread.ScanValue:=pchar(@output[11]);

        //start the scan
        SThread.Resume;
      end;

      CS_NEXTSCAN:
      begin
        log.Lines.add('Next Scan');
        athread.connection.readbuffer(output[0],1+1); //scantype(1),stringlength(1)
        athread.connection.readbuffer(output[2],output[1]); //string user typed in
        athread.connection.readbuffer(output[2+output[1]],1); //scanoptions

        SThread:=TScanThread.Create(true);
        SThread.firstScan:=false;
        SThread.progressbar:=progressbar1;
        SThread.max:=settings.max;

        SThread.Scantype:=output[0];
        SThread.ScanOptions:=output[2+output[1]];
        output[2+output[1]]:=0;
        SThread.Scanvalue:=pchar(@output[2]);
        SThread.Vartype:=currenttype;

        SThread.Resume;
      end;

      CS_NEWSCAN:
      begin
        log.Lines.Add('New Scan');
        closefiles;
        freememory;
      end;

      CS_CANCELSCAN:
      begin
        log.Lines.Add('Client canceled the scan');

        if sthread<>nil then
        begin
          terminatethread(SThread.Handle,0);
          freememory;
          closefiles;


          SThread.Free;
          SThread:=nil;
        end;
      end;

      CS_DELETEADDRESS:
      begin
        log.lines.add('Delete address');
        athread.Connection.ReadBuffer(recordnr,2);


        if numberofrecords-1>=recordnr then
        begin
          for j:=recordnr to numberofrecords-2 do
            memrec[j]:=memrec[j+1];

          dec(numberofrecords);
          setlength(memrec,numberofrecords);
        end;
      end;

      CS_SETTIMERSPEED:
      begin
        log.Lines.Add('Update timer intervals');
        athread.Connection.ReadBuffer(output[0],4);
        updatetimer.Interval:=pword(@output[0])^;
        freezeTimer.Interval:=pword(@output[2])^;
      end;

      CS_UNFREEZEADDRESS:
      begin
        log.lines.Add('Address unfrozen');
        athread.Connection.ReadBuffer(output[0],2);
        memrec[pword(@output[0])^].frozen:=false;
      end;

    {  CS_SetHyperscanState:
      begin

        athread.Connection.ReadBuffer(output[0],1);

        if output[0]=1 then //on
        begin
          log.Lines.Add('enable hyperscan');

          hyperscanenabled:=true;
          try
            if not speedhackenabled then enablehypermode;
          except
            hyperscanenableD:=false;
          end;

        end
        else
        begin
          //off
          log.Lines.Add('disable hyperscan');
          hyperscanenabled:=false;
          try
            If not speedhackenabled then disablehypermode;
          except

          end;

        end;

        output[0]:=SC_Hyperscanstatus;

        if hyperscanenabled and hypermode then
          output[1]:=1 //on
        else
          output[1]:=0;

        athread.Connection.WriteBuffer(output[0],2);
      end;

      CS_EnableSpeedhack:
      begin
        log.Lines.Add('Starting speedhack');
        athread.Connection.ReadBuffer(output[0],8);

        speedhackenabled:=true;
        try
          enableHypermode;
        except
          speedhackenableD:=false;
        end;


         //speed:single;sleeptime:dword)
        dw:=sendmessage(hyperscanwindow,wm_user+6,pdword(@output[4])^,pdword(@output[0])^);
        if dw<>12345 then
        begin
          log.Lines.Add('Failed to start the speedhack');
          speedhackenableD:=false;
        end;

        output[0]:=SC_SpeedhackStatus;
        if speedhackenabled then output[1]:=1 else output[1]:=0;
        athread.Connection.WriteBuffer(output[0],2);

      end;

      cs_disablespeedhack:
      begin
        log.lines.add('Dissable speedhack');
        if speedhackenabled then
          if hyperscanenabled then disablespeedhack else disablehypermode;

        //tell the client the status of the speedhack
        output[0]:=SC_SpeedhackStatus;
        if speedhackenabled then output[1]:=1 else output[1]:=0;
        athread.Connection.WriteBuffer(output[0],2);
      end;       }

      CS_EnableDebugger:
      begin
        output[0]:=SC_Debuggerstatus;
        output[1]:=0;

        try
          log.Lines.Add('Requested to start the debugger if it isn''t working yet');
          if startdebuggerifneeded then output[1]:=1;
          log.lines.add('still allive');
        except
          log.Lines.Add('Bah, an exception occured while enabling the debugger')
        end;

        athread.Connection.WriteBuffer(output[0],2);
      end;

      CS_FindWhatWrites:  //(address: dword,size:word);
      begin
        athread.Connection.ReadBuffer(output[0],6);
        log.lines.add('Find out what writes to '+IntToHex(pdword(@output[0])^,8)+ '(length='+inttostr(pword(@output[4])^)+')');
        SetWriteBreakpoint(pdword(@output[0])^,pword(@output[4])^);
      end;

      CS_FindWhatReads:
      begin
        athread.Connection.ReadBuffer(output[0],6);
        log.lines.add('Find out what reads from '+IntToHex(pdword(@output[0])^,8)+ '(length='+inttostr(pword(@output[4])^)+')');
        SetReadBreakpoint(pdword(@output[0])^,pword(@output[4])^);
      end;

      CS_FindWhatAccesses:
      begin
        athread.Connection.ReadBuffer(output[0],6);
        log.lines.add('Find out what accesses '+IntToHex(pdword(@output[0])^,8)+ '(length='+inttostr(pword(@output[4])^)+')');
        SetReadWriteBreakpoint(pdword(@output[0])^,pword(@output[4])^);
      end;

      CS_StopCodeFinder:
      begin
        log.Lines.Add('Stop the codefinder');

        try
          crdebugging.Acquire;
          with debuggerthread do
          begin
            if (debuggerthread=nil) or (not debuggerthread.attached) then
              continue;

            if findwriter2 then
            begin
              debuggerthread.Suspend;
              zeromemory(@debuggerthread.DRRegs,sizeof(debuggerthread.DRRegs));
              debuggerthread.DRRegs.ContextFlags:=CONTEXT_DEBUG_REGISTERS;
              debuggerthread.DRRegs.Dr7:=reg0set or reg1set or reg2set or reg3set;

              for i:=0 to length(debuggerthread.threadlist)-1 do
              begin
                suspendthread(debuggerthread.threadlist[i][1]);
                if not SetThreadContext(debuggerthread.threadlist[i][1],debuggerthread.DRRegs) then showmessage('I cant seem to remove the breakpoint from one of the threads!');
                resumethread(debuggerthread.threadlist[i][1]);
              end;

              debuggerthread.FindWriter2:=false;
              debuggerthread.Resume;
            end
            else
            begin
              if WaitForSingleObject(semaphore,30000)=WAIT_FAILED then
              begin
                debuggerthread.Terminate;
                debuggerthread.free;
                debuggerthread:=nil;

                closehandle(debugger.Semaphore);
                debugger.Semaphore:=createsemaphore(nil,1,1,nil);
                terminateprocess(processhandle,0);
                close;
                continue;
              end;

              //set the original protection back
              if debuggerthread.readonlyset then
                VirtualProtectEx(processhandle,pointer(readonly.Address),readonly.size,readonly.originalprotection,dw);

              if debuggerthread.findreaderset then
                VirtualProtectEx(processhandle,pointer(findreader.Address),findreader.size,findreader.originalprotection,dw);


              //set the read-only flag to false
              debuggerthread.readonlyset:=false;
              debuggerthread.findreaderset:=false;
              debuggerthread.alsowrites:=false;

              debuggerthread.readonlyremoved:=true;
              debuggerthread.findreaderremoved:=true;

              releasesemaphore(semaphore,1,nil);
            end;
          end;

        finally
          crdebugging.release;
        end;

      end;

      CS_VirtualProtectEx:
      begin
        log.Lines.Add('VirtualProtectEx');
        athread.Connection.ReadBuffer(output[0],12);
        if VirtualProtectEx(processhandle,pointer(pdword(@output[0])^),pdword(@output[4])^,pdword(@output[8])^,dw) then
          output[1]:=1
        else
          output[1]:=0;

        output[0]:=SC_VirtualProtectExResult;
        pdword(@output[2])^:=dw;

        athread.Connection.WriteBuffer(output[0],6);
      end;


      CS_SuspenProcess:
      begin
        debuggerthread.Suspend;
        for i:=0 to length(debuggerthread.threadlist)-1 do
          suspendthread(debuggerthread.threadlist[i][1]);
      end;

      CS_ResumeProcess:
      begin
        debuggerthread.resume;
        for i:=0 to length(debuggerthread.threadlist)-1 do
          resumethread(debuggerthread.threadlist[i][1]);
      end;


      253:
      begin
        log.Lines.Add('data');
        output[0]:=253;
        athread.Connection.WriteBuffer(output[0],1);
      end;


      255:
      begin
        log.lines.add('Keep-alive');
        keepalivesend:=false;
      end;

      else log.Lines.Add('WTF?');
    end;

  end;

  finally
    log.Lines.Add(peerip+' disconnected');
    senddata:=true;
    setlength(memrec,0);
    numberofrecords:=0;
    online:=false;
  end;

  except
    //
  end;
end;

procedure TForm1.Savetofile1Click(Sender: TObject);
begin
  if opendialog1.Execute then
    log.Lines.SaveToFile(opendialog1.filename);
end;

procedure TForm1.disablespeedhack;
begin
{
  speedhackenabled:=false;
  postmessage(hyperscanwindow,wm_user+5,1,0);}
end;


procedure TForm1.disableHypermode;
var i: integer;
begin
{  if not hypermode then exit;

  if speedhackenabled then disablespeedhack;
  hyperscanenabled:=false;
  speedhackenableD:=false;

  if hyperscanwindow<>0 then postmessage(HyperscanWindow,wm_destroy,0,0);

  hyperscanwindow:=0;
  CEScanHook:=0;
  hypermode:=false; }
end;

procedure TForm1.enableHypermode;
var
  CEScanProcAddress:pointer;

  winhandle,possiblewinhandle: thandle;
  winprocess: dword;
  winthreadid: dword;
  i: integer;
begin
(*  if hypermode then exit;

  {$ifdef debug}
  showmessage('hypermode is going to be enabled');
  {$endif}

  //find a window that belongs to the program (preferable the main window, the one with most objects)
  possiblewinhandle:=0;
  hyperscanwindow:=0;

  {$ifdef debug}
  showmessage('Going to find a suitable window');
  {$endif}

  winhandle:=getwindow(getforegroundwindow,GW_HWNDFIRST);
  while winhandle<>0 do
  begin
    winthreadid:=GetWindowThreadProcessId(winhandle,@winprocess);
    if winprocess=processid then
    begin
      possiblewinhandle:=winhandle;
      if GetWindow(possiblewinhandle,GW_CHILD)<>0 then break;  //if we find one that has at least one component then stop searching
    end;
    winhandle:=getwindow(winhandle,GW_HWNDNEXT);
  end;

  if possiblewinhandle=0 then exit;