#include <windows.h>
#include <stdio.h>
float MoveSpeed;
DWORD lv;
//DWORD L1=0x6F35C259,L2=0x6F35C25E;//1.24b
DWORD L1=0x6F35C319,L2=0x6F35C31E;//1.24e
char ll[200];
char *LEVEL = ll;
void WINAPI LV()
{
sprintf_s(ll,"\xE7\xAD\x89\xE7\xBA\xA7:%d \xE7\xA7\xBB\xE9\x80\x9F:%.0f",lv,MoveSpeed);
}
__declspec (naked)void p1()
{__asm{
sub esp,4
pop lv
pushad
mov eax, dword ptr ds:[esp+0x28]
//mov ecx, dword ptr [eax+0x1E8]//1.24c
mov ecx, dword ptr [eax+0x1EC]//1.24e
sub esp,8
push esi
push edi
lea eax, dword ptr [esp+0xC]
push eax
//mov eax,0x6F2024A0//1.24c
mov eax,0x6F202500//1.24e
call eax
mov eax, dword ptr [esp+0xC]
mov MoveSpeed,eax
add esp,0x10
}
LV();//字符转换
__asm{
popad
*/
/////////////////////////
mov edx,LEVEL
push edx
jmp L2
}}
BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
DWORD dwJmpAddr = 0;
char szJmp[5] = {(char)0xE9};
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
DWORD dwOldProtect;
VirtualProtect((LPVOID)L1, 5, PAGE_EXECUTE_READWRITE, &dwOldProtect);
dwJmpAddr = (DWORD)p1 - (DWORD)L1- 5;
memcpy(szJmp + 1, &dwJmpAddr, 4);
memcpy((void*)L1,szJmp, 5);
break;
case DLL_THREAD_ATTACH:
break;
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}