植物大戰殭屍 輔助 總結

第一   :   刷陽光刷金幣無冷卻 輔助

首先用CE工具找到基址和陽光,金幣,物品欄的偏移量, 算出各個的地址, 而後經過api往內存中寫入數據便可.

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Runtime.InteropServices;
using System.Diagnostics;

namespace ZhiWuDaZhanJiangShi
{
    public partial class Form1 : Form
    {
        public Form1()
        {
            InitializeComponent();
        }

        #region API

        //從指定內存中讀取字節集數據
        [DllImportAttribute("kernel32.dll", EntryPoint = "ReadProcessMemory")]
        public static extern bool ReadProcessMemory(IntPtr hProcess,IntPtr lpBaseAddress,IntPtr lpBuffer,int nSize,IntPtr lpNumberOfBytesRead);

        //從指定內存中寫入字節集數據
        [DllImportAttribute("kernel32.dll", EntryPoint = "WriteProcessMemory")]
        public static extern bool WriteProcessMemory(IntPtr hProcess,IntPtr lpBaseAddress,int[] lpBuffer,int nSize, IntPtr lpNumberOfBytesWritten );

        //打開一個已存在的進程對象，並返回進程的句柄
        [DllImportAttribute("kernel32.dll", EntryPoint = "OpenProcess")]
        public static extern IntPtr OpenProcess(int dwDesiredAccess, bool bInheritHandle, int dwProcessId);

        //關閉一個內核對象。其中包括文件、文件映射、進程、線程、安全和同步對象等。
        [DllImport("kernel32.dll")]
        private static extern void CloseHandle(IntPtr hObject);

        #endregion

        #region 使用方法

        //根據進程名獲取PID
        public static int GetPidByProcessName(string processName)
        {
            Process[] arrayProcess = Process.GetProcessesByName(processName);
            foreach (Process p in arrayProcess)
            {
                return p.Id;
            }
            return 0;
        }

        //讀取內存中的值
        public static int ReadMemoryValue(int baseAddress, string processName)
        {
            try
            {
                byte[] buffer = new byte[4];
                //獲取緩衝區地址
                IntPtr byteAddress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);
                //打開一個已存在的進程對象  0x1F0FFF 最高權限
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName));
                //將制定內存中的值讀入緩衝區
                ReadProcessMemory(hProcess, (IntPtr)baseAddress, byteAddress, 4, IntPtr.Zero); 
                //關閉操做
                CloseHandle(hProcess);
                //從非託管內存中讀取一個 32 位帶符號整數。
                return Marshal.ReadInt32(byteAddress);
            }
            catch
            {
                return 0;
            }
        }

        //將值寫入指定內存地址中
        public static void WriteMemoryValue(int baseAddress, string processName, int value)
        {
            try
            {
                //打開一個已存在的進程對象  0x1F0FFF 最高權限
                IntPtr hProcess = OpenProcess(0x1F0FFF, false, GetPidByProcessName(processName));
                //從指定內存中寫入字節集數據
                WriteProcessMemory(hProcess, (IntPtr)baseAddress, new int[] { value }, 4, IntPtr.Zero);
                //關閉操做
                CloseHandle(hProcess);
            }
            catch { }
        }

        #endregion

        //遊戲內存基址
        private int baseAddress = 0x007794f8;//0x0015E944;
        //遊戲進程名字
        private string processName = "PlantsVsZombies";

        private void QieHuan()
        {
            if (radioButton2.Checked)//年度
            {
                baseAddress = 0x007794f8;

                p1 = 0x868;
                p2 = 0x5578;

                p3 = 0x950;
                p4 = 0x50;

                p5 = 0x868;
                p6 = 0x15c;
                p7 = 0x24;

                p8 = 0x4c;

            }
            else//漢化
            {
                baseAddress = 0x006a9ec0;

                p1 = 0x768;
                p2 = 0x5560;

                p3 = 0x82c;
                p4 = 0x28;

                p5 = 0x768;
                p6 = 0x144;
                p7 = 0x24;

                p8 = 0x2c;
            }
        }

        //開啓/關閉 功能 的按鈕
        private void button1_Click(object sender, EventArgs e)
        {
            if (GetPidByProcessName(processName) == 0)
            {
                MessageBox.Show("遊戲沒有運行!");
                return;
            }
            QieHuan();
            if (button1.Text == "開啓")
            {
                button1.Text = "關閉";
                timer1.Enabled = true;
            }
            else
            {
                button1.Text = "開啓";
                timer1.Enabled = false;
            }
        }

        int p1, p2, p3, p4, p5, p6, p7, p8;
        //定時器
        private void timer1_Tick(object sender, EventArgs e)
        {
            if (GetPidByProcessName(processName) == 0)
            {
                timer1.Enabled = false;
            }
            //baseAddress : 遊戲內存基址   processName : 遊戲進程名
            //讀取 基址1 中存放的值
            int address = ReadMemoryValue(baseAddress, processName);
            //計算 基址2的地址 = 基址1中的值 + 偏移量1
            address = address + p1;
            //讀取 基址2 中存放的值
            address = ReadMemoryValue(address, processName);
            //計算 陽光的地址 = 基址2中的值 + 偏移量2
            address = address + p2;
            //給陽光地址中寫入數值,0x378 : 888
            int vl = ReadMemoryValue(address, processName);
            if (vl < GetInt(textBox1.Text))
            {
                WriteMemoryValue(address, processName, GetInt(textBox1.Text));
            }
        }

        private void button2_Click(object sender, EventArgs e)
        {
            if (GetPidByProcessName(processName) == 0)
            {
                MessageBox.Show("遊戲沒有運行!");
                return;
            }
            QieHuan();
            //baseAddress : 遊戲內存基址   processName : 遊戲進程名
            //讀取 基址1 中存放的值
            int address = ReadMemoryValue(baseAddress, processName);
            //計算 基址2的地址 = 基址1中的值 + 偏移量1
            address = address + p3;
            //讀取 基址2 中存放的值
            address = ReadMemoryValue(address, processName);
            //計算 陽光的地址 = 基址2中的值 + 偏移量2
            address = address + p4;
            //給陽光地址中寫入數值,0x378 : 888
            WriteMemoryValue(address, processName, GetInt(textBox2.Text));
        }

        private int GetInt(string s)
        {
            int n = 0;
            int.TryParse(s, out n);
            if (n <= 0)
            {
                n = 100;
            }
            return n;
        }

        int count = 0;
        private void Form1_Load(object sender, EventArgs e)
        {
            QieHuan();
            if (GetPidByProcessName(processName) != 0)
            {
                int address = ReadMemoryValue(baseAddress, processName);
                address = address + p5;
                address = ReadMemoryValue(address, processName);
                address = address + p6;
                address = ReadMemoryValue(address, processName);
                address = address + p7;
                address = ReadMemoryValue(address, processName);
                count = address;
                label3.Text = "植物欄個數: " + address.ToString() + " 個";
            }
        }

        private void timer2_Tick(object sender, EventArgs e)
        {
            if (GetPidByProcessName(processName) == 0)
            {
                timer2.Enabled = false;
            }

            int address = ReadMemoryValue(baseAddress, processName);
            address = address + p5;//一級地址
            address = ReadMemoryValue(address, processName);
            address = address + p6;//二級地址
            address = ReadMemoryValue(address, processName);
            int adrs = address;
            int cs = address + p7;//卡槽數
            count = ReadMemoryValue(cs, processName);
            label3.Text = "植物欄個數: " + count.ToString() + " 個";
            if (count > 0)
            {
                for (int i = 0; i < count; i++)
                {
                    address = adrs + p8;//第一欄 植物的地址
                    // 每後一個植物 地址 偏移 50 (在十進制裏是80)
                    //偏移 0x24 的地址 是標示是否在冷卻中 值 :( 0 :  爲冷卻中, 1 爲冷卻完成)
                    address = address + 80 * i + p7;
                    int vl = ReadMemoryValue(address, processName);
                    if (vl != 1)
                    {
                        WriteMemoryValue(address, processName, 1);
                    }
                    //若是不偏移 0x24 的地址爲冷卻時間地址, 值不肯定, 通常最大設爲6000  也能夠完成此功能
                    //address = address + 80 * i;
                    //WriteMemoryValue(address, processName, 6000);
                }
            }
        }

        private void button3_Click(object sender, EventArgs e)
        {
            if (GetPidByProcessName(processName) == 0)
            {
                MessageBox.Show("遊戲沒有運行!");
                return;
            }
            QieHuan();
            if (button3.Text == "有冷卻")
            {
                button3.Text = "無冷卻";
                timer2.Enabled = true;
            }
            else
            {
                button3.Text = "有冷卻";
                timer2.Enabled = false;
            }
        }
    }

}

View Code

第二   :   模擬鼠標放置植物 輔助

首先在第一個輔助的前提下植物無冷卻纔能使用, 使用api函數, 獲取鼠標位置, 設置鼠標位置, 獲取座標點的窗口句柄, 經過句柄得到窗口文本, 經過窗口句柄獲取窗口的大小位置信息, 設置窗口句柄爲激活窗口, 模擬鼠標點擊事件等, 用到的api比較多, 可是都是最基本的API函數, 窗體設計的比較凌亂, 代碼無註釋, 還請見諒.

 

使用時: 點擊尋找窗口,在三秒內鼠標放到遊戲窗口位置, 等待倒計時完後, 顯示的提示窗口文字和遊戲窗體文字同樣, 而後添加物品欄放置的行或列, 添加完以後在確保無冷卻的狀況下點擊啓動.

c# 項目文件 輔助.zip

運行輔助工具前:

運行後: 自動刷新陽光, 無冷卻, 自動擺放植物.