main3.asm

蜘蛛纸牌作弊器,采用汇编编写,能够在运行蜘蛛纸牌的时候将所有牌透视.

.486 
.model flat,stdcall 
option casemap:none 
include WINDOWS.INC
include user32.inc 
includelib user32.lib            ; calls to functions in user32.lib and kernel32.lib 
include gdi32.inc
includelib gdi32.lib
include kernel32.inc 
includelib kernel32.lib 
include SpiderPoker.inc

GlobalData equ (01010fc8H-01000000H)
GroupNum equ 1aH
ArraySize equ 312*sizeof DWORD
BitmapSize equ 1024*1024
TotolCol equ 0AH

szText MACRO Name, Text:VARARG
        LOCAL lbl
          jmp lbl
            Name db Text,0
          lbl:
        ENDM

POKERLIST struct 
pl_Number DWORD ?
pl_Before DWORD ?
pl_Next DWORD ?
POKERLIST ends

MY_RECT struct
re_col DWORD ?
re_row DWORD ?
re_pokernum DWORD ?
re_state DWORD ?
MY_RECT ends


WinMain proto :DWORD,:DWORD,:DWORD,:DWORD 
wsprintfW proto C:DWORD,:DWORD,:VARARG
_GetBitmap2 proto :DWORD,:DWORD,:DWORD,:DWORD
TraveList proto :DWORD
GetProcID proto
GetPokerArray proto
SEHandler proto :DWORD,:DWORD,:DWORD,:DWORD
CheckWidHei proto :DWORD,:DWORD
CheckCol proto :DWORD
CheckRow proto :DWORD,:DWORD,:DWORD
ReadFirstReadyPoker proto

.CONST
ACARD dw "C","A","R","D","%","d",0
CARDBACK dw "C","A","R","D","B","A","C","K",0

DBGSTRING db "processhandle = %x",0
DBGPOKERARRAY db "%x,%x,%x",0
DBGWIDTH db "width=%x,height=%x",0
DBGINFUNC db "in TraveList func",0

.DATA                     ; initialized data 
ClassName db "SimpleWinClass",0        ; the name of our window class 
AppName db "蜘蛛纸牌作弊器    开发者：付鹤伟",0        ; the name of our window 
WindowName db "蜘蛛",0
WindowClass db "蜘蛛",0
DownPos MY_RECT <0FFFFFFFFh,0FFFFFFFFh,0FFFFFFFFh,0h>
HasQuit dd 00000001h



.DATA?                ; Uninitialized data 
hInstance HINSTANCE ?        ; Instance handle of our program 
CommandLine LPSTR ? 
_lpModuleBase dd  ?          ; base address of the module
_hProcHandle dd ?            ; process handle of spider.exe
														 ; used for read memory of spider.exe
_hThreadHandle dd ?
_dwPokerArray dd ArraySize dup (?)
hwnd dd ?
hwndspider dd ?
@Width dd ?
@Height dd ?


.CODE                ; Here begins our code 
start: 
invoke GetProcID
invoke FindWindow,addr WindowClass,addr WindowName
mov hwndspider,eax
.IF _hProcHandle == 0
   	szText szWarning,"你必须先运行蜘蛛...在开始-->游戏中"
   	invoke MessageBox,NULL,addr szWarning,NULL,MB_OK
   	invoke ExitProcess,0
.ENDIF
invoke GetModuleHandle, NULL            ; get the instance handle of our program. 
                                                                       ; Under Win32, hmodule==hinstance mov hInstance,eax 
mov hInstance,eax 
invoke GetCommandLine                        ; get the command line. You don't have to call this function IF 
                                                                       ; your program doesn't process the command line. 
mov CommandLine,eax 
invoke WinMain, hInstance,NULL,CommandLine, SW_SHOWDEFAULT        ; call the main function 
invoke ExitProcess, eax                           ; quit our program. The exit code is returned in eax from WinMain. 

WinMain proc hInst:HINSTANCE,hPrevInst:HINSTANCE,CmdLine:LPSTR,CmdShow:DWORD 
    LOCAL wc:WNDCLASSEX                                            ; create local variables on stack 
    LOCAL msg:MSG 
    ;LOCAL hwnd:HWND 
    

    mov   wc.cbSize,SIZEOF WNDCLASSEX                   ; fill values in members of wc 
    mov   wc.style, CS_HREDRAW or CS_VREDRAW 
    mov   wc.lpfnWndProc, OFFSET WndProc 
    mov   wc.cbClsExtra,NULL 
    mov   wc.cbWndExtra,NULL 
    push  hInstance 
    pop   wc.hInstance 
    mov   wc.hbrBackground,COLOR_WINDOW+1 
    mov   wc.lpszMenuName,NULL 
    mov   wc.lpszClassName,OFFSET ClassName 
    invoke LoadIcon,NULL,IDI_APPLICATION 
    mov   wc.hIcon,eax 
    mov   wc.hIconSm,eax 
    invoke LoadCursor,NULL,IDC_ARROW 
    mov   wc.hCursor,eax 
    invoke RegisterClassEx, addr wc                       ; register our window class 
    invoke CreateWindowEx,NULL,\ 
                ADDR ClassName,\ 
                ADDR AppName,\ 
                WS_OVERLAPPEDWINDOW,\ 
                CW_USEDEFAULT,\ 
                CW_USEDEFAULT,\ 
                CW_USEDEFAULT,\ 
                CW_USEDEFAULT,\ 
                NULL,\ 
                NULL,\ 
                hInst,\ 
                NULL 
    mov   hwnd,eax 
    invoke ShowWindow, hwnd,CmdShow               ; display our window on desktop 
    invoke UpdateWindow, hwnd                                 ; refresh the client area 

    .WHILE TRUE                                                         ; Enter message loop 
                invoke GetMessage, ADDR msg,NULL,0,0 
                .BREAK .IF (!eax) 
                invoke TranslateMessage, ADDR msg 
                invoke DispatchMessage, ADDR msg 
   .ENDW 
    mov     eax,msg.wParam                                            ; return exit code in eax 
    ret 
WinMain endp 





CheckWidHei proc _lpPoint:DWORD,_lpRetVal:DWORD
LOCAL _Col:DWORD
LOCAL _Row:DWORD
;;LOCAL @DbgBuf[255]:BYTE

pushad

mov ecx,_lpPoint
mov esi,_lpRetVal
assume ecx:ptr POINT,esi:ptr MY_RECT
mov ebx,[ecx].x
xor edx,edx
@@:
		;pushad
		;szText szebx,"ebx=%x"
		;invoke wsprintfA,addr @DbgBuf,addr szebx,ebx
		;invoke MessageBoxA,NULL,addr @DbgBuf,NULL,MB_OK
		;popad
		
		cmp ebx,@Width
		jb @F             ;unsigned
		sub ebx,@Width
		inc edx
		jmp @B
@@:
    mov [esi].re_col,edx
    
    ;szText sz_re_col,"re_col=%x"
    ;pushad
    ;invoke wsprintfA,addr @DbgBuf,addr sz_re_col,edx
    ;invoke MessageBoxA,NULL,addr @DbgBuf,NULL,MB_OK
    ;popad
    
mov ebx,[ecx].y
xor edx,edx
mov eax,@Height
sub eax,40h
@@:
		cmp ebx,eax
		jb @F
		sub ebx,eax
		inc edx
		jmp @B
@@:
		mov [esi].re_row,edx
		
		;szText sz_re_row,"re_row=%x"
    ;pushad
    ;invoke wsprintfA,addr @DbgBuf,addr sz_re_row,edx
    ;invoke MessageBoxA,NULL,addr @DbgBuf,NULL,MB_OK
    ;popad
    
assume ecx:nothing,esi:nothing
popad
ret
CheckWidHei endp 








DownState proc _lpRect:DWORD
LOCAL @PokerD:DWORD
LOCAL @ReadyRow:DWORD
LOCAL @Address:DWORD
LOCAL @FirstReadyPoker:DWORD

pushad
mov esi,_lpRect
assume esi:ptr MY_RECT
mov eax,[esi].re_col
mov DownPos.re_col,eax
mov eax,[esi].re_row
mov DownPos.re_row,eax
assume esi:nothing

invoke CheckCol,DownPos.re_col
.IF eax
		mov @Address,eax
		invoke CheckRow,@Address,DownPos.re_row,addr @PokerD                         ;;;;;
		mov @ReadyRow,eax
		.IF @ReadyRow == 0FFFFFFFFh ;;;;;;this row's poker is in the list
				mov eax,@PokerD
				mov DownPos.re_pokernum,eax
				mov DownPos.re_state,00000001h
		.ELSE  ;;;;;;this row's poker is not in the list
				
				invoke ReadFirstReadyPoker
				mov ecx,@ReadyRow
				mov @FirstReadyPoker,eax
				add eax,DownPos.re_col
				mov @PokerD,eax
				
				LOOPAGAIN:
				.IF @PokerD<68h
						mov ebx,@ReadyRow
						.IF ebx<DownPos.re_row
								inc ebx
								mov @ReadyRow,ebx
								mov eax,@PokerD
								add eax,0Ah
								mov @PokerD,eax
								jmp LOOPAGAIN
						.ELSE
								;;;;;;;yse,the poker you want to find in @PokerB already!!!!
								mov eax,@PokerD
								lea eax,dword ptr [eax+eax*2]
	              mov @PokerD,eax
								mov DownPos.re_pokernum,eax
								mov DownPos.re_state,00000001h
					  .ENDIF
				.ELSE
						mov ebx,@ReadyRow
						.IF ebx == ecx                             ;THE LIST ONE IS LAST
			 					mov eax,ebx
			 					inc eax
			 					.IF eax==DownPos.re_row 
			 					    mov edi,DownPos.re_row
			 					    sub edi,2
			 							invoke CheckRow,@Address,edi,addr @PokerD
			 					.ELSEIF ebx==DownPos.re_row
			 							mov edi,DownPos.re_row
			 							dec edi
			 							invoke CheckRow,@Address,edi,addr @PokerD
			 					.ENDIF
			 					mov eax,@PokerD
			 					mov DownPos.re_pokernum,eax
			 					mov DownPos.re_state,00000001h
			 			.ELSE ;ebx!=ecx ebx must > ecx                   ;THE LIST ONE IS NOT LAST ONE
			 					mov eax,ebx
			 					add eax,2
			 					.IF eax>DownPos.re_row 
			 							mov eax,@PokerD
			 							sub eax,0Ah
			 							lea eax,dword ptr [eax+eax*2]
			 							mov @PokerD,eax
			 							mov DownPos.re_pokernum,eax
			 							mov DownPos.re_state,00000001h
			 					.ELSE
			 							mov ebx,@ReadyRow
										mov DownPos.re_state,0h
										mov DownPos.re_pokernum,0FFFFFFFFh
			 					.ENDIF
			 			.ENDIF
			 	.ENDIF
		.ENDIF
.ELSE
		mov DownPos.re_state,0h
		mov DownPos.re_pokernum,0FFFFFFFFh
.ENDIF
invoke InvalidateRect,hwnd,NULL,TRUE
popad
ret
DownState endp







CheckCol proc _dwCol:DWORD
LOCAL @Buffer:DWORD
LOCAL @ListBaseAddr:DWORD
pushad
.IF _dwCol < 0AH
		mov esi,_lpModuleBase
		add esi,GlobalData
		add esi,8
		invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
		
		mov esi,@Buffer
		mov @ListBaseAddr,esi 
		mov ebx,_dwCol
		lea esi,DWORD PTR [esi+sizeof DWORD *ebx]
		invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
		popad
		mov eax,@Buffer
.ELSE
		popad
		xor eax,eax
.ENDIF
ret
CheckCol endp









CheckRow proc _dwAddress :DWORD,_dwRow:DWORD,_lpPokerNum:DWORD
LOCAL @Buffer:DWORD
LOCAL @Temp:DWORD
LOCAL @List:POKERLIST
LOCAL @Index:DWORD
pushad
mov esi,_dwAddress
invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
mov eax,@Buffer
mov @Temp,eax
mov @Index,0
LoopAgain:
		.IF @Temp
				invoke ReadProcessMemory,_hProcHandle,@Temp,addr @List,sizeof POKERLIST,NULL
				mov eax,@Index
				.IF eax<_dwRow
						inc @Index
						mov eax,@List.pl_Next
						mov @Temp,eax
						jmp LoopAgain
			  .ELSE
						mov eax,@List.pl_Number
						lea eax,[eax+eax*2]
			      mov esi,_lpPokerNum
			      mov dword ptr [esi],eax
			      popad
			      mov eax,0FFFFFFFFh                       ;sucess reture -1
				.ENDIF
		.ELSE
				popad
				mov eax,@Index
		.ENDIF
ret
CheckRow endp









ReadFirstReadyPoker proc
LOCAL @Buffer:dword
pushad
mov esi,_lpModuleBase
add esi,GlobalData
add esi,4
invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
mov esi,@Buffer
add esi,10h
invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
popad
mov eax,@Buffer
ret
ReadFirstReadyPoker endp










GetPokerFromArray proc _dwNum:DWORD
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
;;;;;because this litte function only use eax,so needn't pushad/popad
;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
mov eax,_dwNum
lea eax,dword ptr [eax+eax*2]
mov eax,_dwPokerArray[eax*sizeof DWORD]
ret
GetPokerFromArray endp








WriteToPokerArray proc uses esi 
LOCAL @loc1:DWORD
LOCAL @Buffer:DWORD
mov esi,_lpModuleBase
add esi,GlobalData
add esi,4
invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
mov esi,@Buffer
add esi,0ch
invoke ReadProcessMemory,_hProcHandle,esi,addr @Buffer,sizeof DWORD,NULL
invoke WriteProcessMemory,_hProcHandle,@Buffer,offset _dwPokerArray,ArraySize,NULL
ret
WriteToPokerArray endp