独钓寒江雪由于我的C用的比较少，所以大部分都用的汇编，部分地方用汇编写不是很方便，所以我用的C，由于只是学习，所以内核地址我没有计算都是硬编码的。过DNF主要分为三步，也许我的思路不太正确，反正可以OD调试，下断。程序没怎么修边幅，因为只是测试，所以一般都没有写更改内核后的恢复，不过不妨碍使用。第一步，这也是最起码的，你必须要能够打开游戏进程和线程，能够开打进程和线程后不被检测到第二步，能够读写进村内存第三步，能够用OD附加游戏进程第四步，能够下硬件断点而不被检测跳过NtReadVirtualMemory，NtWriteVirtualMemory函数头的钩子代码:#include<ntddk.h>typedefstruct_SERVICE_DESCRIPTOR_TABLE{PVOIDServiceTableBase;PULONGServiceCounterTableBase;ULONGNumberOfService;ULONGParamTableBase;}SERVICE_DESCRIPTOR_TABLE,*PSERVICE_DESCRIPTOR_TABLE;//由于KeServiceDescriptorTable只有一项,这里就简单点了externPSERVICE_DESCRIPTOR_TABLEKeServiceDescriptorTable;//KeServiceDescriptorTable为导出函数/////////////////////////////////////VOIDHook();VOIDUnhook();VOIDOnUnload(INPDRIVER_OBJECTDriverObject);//////////////////////////////////////ULONGJmpAddress;//跳转到NtOpenProcess里的地址ULONGJmpAddress1;//跳转到NtOpenProcess里的地址ULONGOldServiceAddress;//原来NtOpenProcess的服务地址---本文来源于网络，仅供参考，勿照抄，如有侵权请联系删除---ULONGOldServiceAddress1;//原来NtOpenProcess的服务地址//////////////////////////////////////__declspec(naked)NTSTATUS__stdcallMyNtReadVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGNumberOfBytesToRead,PULONGNumberOfBytesReaded){//跳过去__asm{push0x1cpush804eb560h//共十个字节jmp[JmpAddress]}}__declspec(naked)NTSTATUS__stdcallMyNtWriteVirtualMemory(HANDLEProcessHandle,PVOIDBaseAddress,PVOIDBuffer,ULONGNumberOfBytesToWrite,PULONGNumberOfBytesReaded){//跳过去__asm{push0x1cpush804eb560h//共十个字节jmp[JmpAddress1]}}///////////////////////////////////////////////////NTSTATUSDriverEntry(INPDRIVER_OBJECTDriverObject,PUNICODE_STRINGRegistryPath){DriverObject->DriverUnload=OnUnload;DbgPrint("Unhookerload");Hook();returnSTATUS_SUCCESS;}/////////////////////////////////////////////////////VOIDOnUnload(INPDRIVER_OBJECTDriverObject){DbgPrint("Unhookerunload!");---本文来源于网络，仅供参考，勿照抄，如有侵权请联系删除---Unhook();}/////////////////////////////////////////////////////VOIDHook(){ULONGAddress,Address1;Address=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0xBA*4;//0x7A为NtOpenProcess服务IDAddress1=(ULONG)KeServiceDescriptorTable->ServiceTableBase+0x115*4;//0x7A为NtOpenProcess服务IDDbgPrint("Address:0x%08X",Address);OldServiceAddress=*(ULONG*)Address;//保存原来NtOpenProcess的地址OldServiceAddress1=*(ULONG*)Address1;//保存原来NtOpenProcess的地址DbgPrint("OldServiceAddress:0x%08X",OldServiceAddress);DbgPrint("OldServiceAddress1:0x%08X",OldServiceAddress1);DbgPrint("MyNtOpenProcess:0x%08X",MyNtReadVirtualMemory);DbgPrint("MyNtOpenProcess:0x%08X",MyNtWriteVirtualMemory);JmpAddress=(ULONG)0x805b528a+7;//跳转到NtOpenProcess函数头＋10的地方，这样在其前面写的JMP都失效了JmpAddress1=(ULONG)0x805b5394+7;DbgPrint("JmpAddress:0x%08X",JmpAddress);DbgPrint("JmpAddress1:0x%08X",JmpAddress1);__asm{//去掉内存保护climoveax,cr0andeax,not10000hmovcr0,eax}*((ULONG*)Address)=(ULONG)MyNtReadVirtualMemory;//HOOKSSDT*((ULONG*)Address1)=(ULONG)MyNtWriteVirtualMemory;__asm{//恢复内存保护moveax,cr0oreax,10000hmovcr0,eaxsti---本文来源于网络，仅供参考，勿照抄...