_masta_的 Win95 汇编教程 part 2

                          -         
          -----=========-----
           -------==========================================----------
----------=====_masta_的 Win95 汇编教程 part 2 修正版  1=====-----------
           -------==========================================----------

( I called this revision 1 because it contains new sourcecode without errors
  _masta_ found when going through it again - fungus )

             --==介绍==--

Hi,
Part0 和 part1 相对比较成功，我也很高兴发表 part 2了。
实际上我很想做一些关于 GUI 的东西，可是最近我很忙，所以现在只能让你们
看到这些没有 GUI 代码的东西。不管怎样，这也是一个很有趣的东西。
从这篇教程开始我不再会解释一些诸如 MessageBox 之类简单的东东了，
这在头两篇都是解释的非常详细的。我想这也不会给你带来什么不便，如果你看过
头两篇的话。

          --==我们需要什么?==--

 1. 文本编辑器
 2. TASM 5.0 和库文件等等。
 3. Windows API 参考手册 (WIN32.HLP)
 4. 星际争霸(StarCraft) (ONLY for testing purposes!;])  (Sendfree:MyGod,他要做什么？)
 5. 一些脑细胞 ;)
 6. 一些基本的汇编知识 (前面两课)
        7. Numega Softice 3.xx (并不是必需的) (Sendfree: 这么暴力的工具也用！做什么？！
                                               你的周围有没有Cracker 啊，向他们要一个。)

           --==这次我们要做什么?==--

哪一个游戏迷不想有下面的这些东西呢？

more lives
more money
more energy
more gas            (sendfree: gas 是星际中的一种资源(就是钞票)，下面的 mineral 也是)
more ...

我说的就是游戏修改器(Trainer)，这在C64-/Amiga-/PC-DOS-times 是非常常见的，
但是现在却越来越少了，真让人怀念那段美好的岁月。
所以这次拿星际开刀(当然我也知道已经有好些修改器了！

理由：-这个游戏眼下非常流行
      -我是在玩这个游戏的时候得到写这篇教程的灵感 :)

             --==LET'S GO==--

开始工作之前先仔细考虑一下。

游戏修改器的定义：-一个小程序，可以改变游戏的部分内存数据，例如
                   这样可以得到更多的 money ...

一般说来，在windows 中一个程序不能读写其他程序的内存空间。幸运的是
我们最亲爱的朋友 Billy 作了一些本来用于 debug 的函数，我们可以用这些
东东达到我们目的。

它们就是：OpenProcess, WriteProcessMemory 和 ReadProcessMemory.
通过这组函数我们就可以读写其他程序的内存空间。
最基本的，我们的程序就像一个除错器(debugger)，存取其他程序的内存
并改变它。

             --==结构==--

1. 介绍 (用 MessageBox 显示)

2. 得到要修改的程序的 Process_ID
  (找到 Starcraft 的主窗口; 然后再找到进程号)

3. 打开进程

4. 改变值

5. 关闭进程, 结束 (成功)

             --==重要的 API 函数==--

我们可以用 FindWindowA 得到主窗口的句柄，然后得到窗口类的名字("SWarrClass")和
窗口的名字("Starcraft")。这些东西可以从 Softice (TASK->HWND)中获取。
(sendfree:没有用过 softice 的朋友可以一支雪糕贿赂Cracker 们，然后取点经。)

由窗口句柄(windowshandle)可以得到相应的进程，再用 GetWindowThreadProcessId得到
进程ID(PID).

现在我们可以通过 PID->OpenProcess 的帮助抓住进程内存空间的句柄。
现在一切都变得容易了，我们通过 WriteProcessMemory函数操作程序的句柄就像
通常的文件操作一样操作程序的内存。

最后也是很重要的，调用 CloseHandle 关闭进程的句柄。这在 Win95 中不是真的很重要的，但是谁会
相信一个来自 Redmont(sendfree:雷蒙得，MS的总部)的软件呢 ;-)?

最后一个函数就是 ExitProcess.

              --==内存地址==--

我们能够很轻松的通过 debugger搜索显示在屏幕上的十进制数相应的十六进制数
来得到minerals 的地址，在我的系统里是这样的：

   Minerals = 04EFE08h
   Gas      = 04EFE38h

                   --==THE SOURCE==--

代码并不长，而且结构也不是很好，但是不管怎样，应该是很容易看懂的...

;This is a slightly edited source to my tutorial (Part 2)
;I did a mistake while searching the informations for the memory locations
;not taking care, that starcraft uses different locations ...

;Only change is that the million-value is written 2 times
;and 8 bytes instead of 4

                                        ; Set some params for the assembler
.386P
Locals
jumps

.Model Flat ,StdCall
PROCESS_VM_WRITE    equ 020h            ; Flags for the write-access
PROCESS_VM_OPERATION    equ 008h        ; to the process

mb_ok      equ 0
minerals_pos       equ 04efe08h
gas_pos        equ 04efe38h

; declaration of used API-functions

extrn     MessageBoxA      : PROC       ; Show a Messagebox
extrn     FindWindowA      : PROC       ; Find Window with the name
extrn     GetWindowThreadProcessId :Proc; Find PID with the HWND
extrn     OpenProcess      : PROC       ; Procedure to access the process
extrn     WriteProcessMemory: PROC      ; Write into memory of the running
                                        ; program
extrn     CloseHandle      : PROC       ; Close the handle again
                                        ; Cleanup, after use ;)
extrn     ExitProcess      : PROC       ; Procedure to exit the program

; here begins our Data
.Data

caption  db "_masta_'s essay on Win32-ASM-Coding, part 2",0
              ;Captionstring, 0-terminated

text     db "Hi, here we are at part 2",13,10
     db "This tut will describe you how to make",13,10
     db "Win32-ASM Trainer",0

                                ; Introtext , 0-terminated

err_cap  db "ERROR",0           ; Caption for Errormessages

notrun   db "Sorry, Starcraft is not running",0 ; Error if SC isn't running

no_write db "Mmmhhhh, a problem, by writing",13,10
     db "to Starcrafts memory",13,10,0

readycap db "Ready",0           ; Caption for "ready"

readytxt db "Ok, now you have 1000000 Minerals and Gas",0

                                ; Text for "ready"

million  dd 1000000             ; How much do you want??? ;]
         dd 1000000

wnd_name db "Starcraft",0       ; Name of the Starcraft-window
cls_name db "SWarClass",0       ; Class of the Starcraft-window

pid_sc   dd ?                   ; Here we save the PID ...

p_hand   dd ?                   ; and here the handle to the
                                ; process

; And here we start with our code

.Code
Main:
        push mb_ok
        push offset caption
        push offset text
        push 0
        call MessageBoxA        ;Startmessage

is_SC_RUN:

    push offset wnd_name
    push offset cls_name
    call FindWindowA    ; Find Window handle with Windowclass and
                        ; -name

    cmp  eax,0          ; if 0, window is not existing
    jz   SC_isnt_run_end; --> Starcraft is not launched

    push offset pid_sc            ; Where to save the PID ?
    push eax                      ; PUSH Windowhandle
    call GetWindowThreadProcessId ; Determine PID with Windowhandle

open_the_process:
    push pid_sc                                   ; PUSH PID
    push 0                                        ; only used when
                                                  ; building new
                                                  ; processes
    push PROCESS_VM_WRITE OR PROCESS_VM_OPERATION ; activate write-access

    call OpenProcess    ; Get handle of Starcraft
    mov  p_hand,eax     ; Save handle to p_hand

change_Minerals:

    push 0                 ; Can be zero mostly
    push 8                 ; Write 8 Bytes (2 Dwords)
    push offset million    ; How much ? (1 Million)
    push minerals_pos      ; 1st Memoryaddress
    push p_hand            ; Handle to the process
    call WriteProcessMemory; write minerals 
    cmp  eax,0
    jz   error_on_write    ; If any error while writing (eax=0) -> end

change_gas:                ; the same again for gas, but this time
                           ; the memory address of the gas is PUSHed
    push 0
    push 8
    push offset million
    push gas_pos
    push p_hand
    call WriteProcessMemory
    cmp  eax,0
    jz   error_on_write

Trainer_ready:

        push mb_ok             
        push offset readycap   
        push offset readytxt   
        push 0                 
        call MessageBoxA    ; Everything OK

close_the_PID_Handle:
    push p_hand
    Call CloseHandle    ; CloseHandle
    jmp  end_           ; Go to End

error_on_write:

        push mb_ok             
        push offset err_cap    
        push offset no_write   
        push 0              
        call MessageBoxA          ; Mmmhhh, Error while writing
        jmp  close_the_PID_Handle ; Close handle before quit

SC_isnt_run_end:

        push mb_ok             
        push offset err_cap    
        push offset notrun     
        push 0              
        call MessageBoxA        ; nothing there to train =(
   
end_:

        CALL    ExitProcess     ; Exit program
End Main                        ; End of Code Determination
                                  of Jump-point (Main)

;--------------------------==END OF SOURCE==----------------------------

;--------------------------------START---------------------------make.bat
@echo off
echo assembling your trainer
tasm32 /mx /m3 /z /q w95asm_2
tlink32 -x /Tpe /aa /c w95asm_2,w95asm_2,, import32.lib
del *.obj
del *.map
;---------------------------------END----------------------------make.bat

                   --==FINAL WORDS==--

OK, as I told you before this was a little tutorial, but I think very
interesting anyway. I guess there is not much to optimize (sorry fungus),
maybe the routine for writing into memory (use of a procedure).
I hope my mailbox (masta_t@usa.net) is flodded soon (CRITICS ARE WELCOME)
and you are all here next time. I promise the next one will be about GUI,
because many people told me to do so.
BTW, I am trying to build an IRC channel (EFNET) on this (#win32asm) and
finally there is a project-page 'HTTP://win32asm.cjb.net'!
If anyone is interested, any contribution to this subject is very welcome,
we are waiting for it ...
I really hope there are enough people, who spend their time on this
subject and who are willing to give their knowledge to others, too.

                   --==WISE WORDS==--

  ------===========================================================-------
-----=====A hardcoded serial is as common as a 25-year-old virgin=====------
  ------===========================================================-------
                          -----=========-----
       -