#include <iostream> #include <Windows.h> #include <TlHelp32.h> #include <tchar.h> #include <vector> using namespace std; DWORD GetModuleBaseAddress(TCHAR* lpszModuleName, DWORD pID) { DWORD dwModuleBaseAddress = 0; HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pID); MODULEENTRY32 ModuleEntry32 = { 0 }; ModuleEntry32.dwSize = sizeof(MODULEENTRY32); if (Module32First(hSnapshot, &ModuleEntry32)) { do { if (_tcscmp(ModuleEntry32.szModule, lpszModuleName) == 0) { dwModuleBaseAddress = (DWORD)ModuleEntry32.modBaseAddr; break; } } while (Module32Next(hSnapshot, &ModuleEntry32)); } CloseHandle(hSnapshot); return dwModuleBaseAddress; } DWORD GetPointerAddress(HWND hwnd, DWORD gameBaseAddr, DWORD address, vector<DWORD> offsets) { DWORD pID = NULL; GetWindowThreadProcessId(hwnd, &pID); HANDLE phandle = NULL; phandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID); if (phandle == INVALID_HANDLE_VALUE || phandle == NULL); DWORD offset_null = NULL; ReadProcessMemory(phandle, (LPVOID*)(gameBaseAddr + address), &offset_null, sizeof(offset_null), 0); DWORD pointeraddress = offset_null; for (int i = 0; i < offsets.size() - 1; i++) { ReadProcessMemory(phandle, (LPVOID*)(pointeraddress + offsets.at(i)), &pointeraddress, sizeof(pointeraddress), 0); } return pointeraddress += offsets.at(offsets.size() - 1); } int main() { setlocale(LC_ALL, "ru"); HWND hwnd_AC= FindWindowA(NULL, "AssaultCube"); if (hwnd_AC != FALSE); DWORD pID = NULL; GetWindowThreadProcessId(hwnd_AC, &pID); HANDLE phandle = NULL; phandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID); if (phandle == INVALID_HANDLE_VALUE || phandle == NULL); char gamemodule1[] = "ac_client.exe"; DWORD gamebaseaddress1 = GetModuleBaseAddress(_T(gamemodule1), pID); DWORD ammoAddr = 0x0094D7D0; vector<DWORD> ammoOffsets{ 0x140 , 0x17E0A8 }; DWORD ammoPtrAddr = GetPointerAddress(hwnd_AC, gamebaseaddress1, ammoAddr, ammoOffsets); while (true) { int ammo = 1000; WriteProcessMemory(phandle, (LPVOID*)(ammoPtrAddr), &ammo, 4, 0); } } C #include <iostream> #include <Windows.h> #include <TlHelp32.h> #include <tchar.h> #include <vector> using namespace std; DWORD GetModuleBaseAddress(TCHAR* lpszModuleName, DWORD pID) { DWORD dwModuleBaseAddress = 0; HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, pID); MODULEENTRY32 ModuleEntry32 = { 0 }; ModuleEntry32.dwSize = sizeof(MODULEENTRY32); if (Module32First(hSnapshot, &ModuleEntry32)) { do { if (_tcscmp(ModuleEntry32.szModule, lpszModuleName) == 0) { dwModuleBaseAddress = (DWORD)ModuleEntry32.modBaseAddr; break; } } while (Module32Next(hSnapshot, &ModuleEntry32)); } CloseHandle(hSnapshot); return dwModuleBaseAddress; } DWORD GetPointerAddress(HWND hwnd, DWORD gameBaseAddr, DWORD address, vector<DWORD> offsets) { DWORD pID = NULL; GetWindowThreadProcessId(hwnd, &pID); HANDLE phandle = NULL; phandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID); if (phandle == INVALID_HANDLE_VALUE || phandle == NULL); DWORD offset_null = NULL; ReadProcessMemory(phandle, (LPVOID*)(gameBaseAddr + address), &offset_null, sizeof(offset_null), 0); DWORD pointeraddress = offset_null; for (int i = 0; i < offsets.size() - 1; i++) { ReadProcessMemory(phandle, (LPVOID*)(pointeraddress + offsets.at(i)), &pointeraddress, sizeof(pointeraddress), 0); } return pointeraddress += offsets.at(offsets.size() - 1); } int main() { setlocale(LC_ALL, "ru"); HWND hwnd_AC= FindWindowA(NULL, "AssaultCube"); if (hwnd_AC != FALSE); DWORD pID = NULL; GetWindowThreadProcessId(hwnd_AC, &pID); HANDLE phandle = NULL; phandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID); if (phandle == INVALID_HANDLE_VALUE || phandle == NULL); char gamemodule1[] = "ac_client.exe"; DWORD gamebaseaddress1 = GetModuleBaseAddress(_T(gamemodule1), pID); DWORD ammoAddr = 0x0094D7D0; vector<DWORD> ammoOffsets{ 0x140 , 0x17E0A8 }; DWORD ammoPtrAddr = GetPointerAddress(hwnd_AC, gamebaseaddress1, ammoAddr, ammoOffsets); while (true) { int ammo = 1000; WriteProcessMemory(phandle, (LPVOID*)(ammoPtrAddr), &ammo, 4, 0); } } оффсет который пытаюсь вставить в код
всмысле, ты что хочешь получить? riffle ammo pointer? тогда ac_client.exe+0x17e0a8+0x140 и кстати тебе не нужно каждый раз получать хендл процесса, открывая его, чтобы считать память, оставляя утечку у себя в проге