自己动手制作植物大战僵尸简单修改器

获取植物大战僵尸进程

我用的是植物大战僵尸汉化第二版，基址是0x006A9EC0
编译器是VC++6.0
（注：未经说明且不是函数定义的代码添加于按钮处）
声明基址

const int baseaddr = 0x006A9EC0;

首先是获取植物大战僵尸进程

	PROCESSENTRY32 pe32;
	pe32.dwSize = sizeof(pe32);
	HANDLE hProcessSnap = ::CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0);
	BOOL have_more = ::Process32First(hProcessSnap,&pe32);
	int processid = -1;
	while(have_more)
	{
		if(!_tcscmp(pe32.szExeFile,_T("PlantsVsZombies.exe")))
		{
			processid = pe32.th32ProcessID;
			break;
		}
		have_more = ::Process32Next(hProcessSnap,&pe32);
	}
	if(processid == -1)
	{
		AfxMessageBox("找不到游戏进程");
		ExitThread(-1);
	}
	CloseHandle(hProcessSnap);
	HANDLE hprocess = ::OpenProcess(PROCESS_ALL_ACCESS,FALSE,processid);

hprocess就是植物大战僵尸进程了

改变阳光数

接着就要改变阳光数了,阳光地址是0x006A9EC0 + 0x786 + 0x5560
（即0x006A9EC0的值加上0x786后作为地址，取值加0x5560为阳光地址，之后的不另做解释）

	CString ssun;
	DWORD sun = 0;
	m_edit1.GetWindowText(ssun);//获取增加阳光数
	int addr;
	//改变阳光数
	::ReadProcessMemory(hprocess,(LPVOID)(baseaddr),&addr,4,0);
	::ReadProcessMemory(hprocess,(LPVOID)(addr+0x768),&addr,4,0);
	::ReadProcessMemory(hprocess,(LPVOID)(addr+0x5560),&sun,4,0);
	sun += atoi(ssun);
	::WriteProcessMemory(hprocess,(LPVOID)(addr+0x5560),&sun,4,0);

改变金币数

再其次是改变金币数，金币数地址是0x006A9EC0 + 0x82c+ 0x28
（注：实际金币数为该地址的值乘上10后的结果）

	CString smoney;
	DWORD money = 0;
	m_edit2.GetWindowText(smoney);
	//改变金币数
	::ReadProcessMemory(hprocess,(LPVOID)(baseaddr),&addr,4,0);
	::ReadProcessMemory(hprocess,(LPVOID)(addr+0x82c),&addr,4,0);
	::ReadProcessMemory(hprocess,(LPVOID)(addr+0x28),&money,4,0);
	money += atoi(smoney)/10;
	::WriteProcessMemory(hprocess,(LPVOID)(addr+0x28),&money,4,0);

CD循环清零

再接着是CD循环清零，每个格子CD地址0x006A9EC0 + 0x768+ 0x144 +(0x70+0x50i) (0<=i<10)
（注：(0x70+0x50i)表示括号内为直接运算即可）
先在构造函数处添加如下代码

hthread = INVALID_HANDLE_VALUE;

再在按钮事件添加如下代码

//判断是否启动/终止CD循环清零
	if(m_check1.GetCheck() == 1 && hthread == INVALID_HANDLE_VALUE)
	{
		hthread = CreateThread(NULL,0,hackthread,&hprocess,0,NULL);
	}else if(m_check1.GetCheck() != 1 && hthread != INVALID_HANDLE_VALUE)
	{
		TerminateThread(hthread,0);
		hthread = INVALID_HANDLE_VALUE;
	}

DWORD _stdcall hackthread(LPVOID lpparam)
{
	const int baseaddr = 0x006A9EC0;
	HANDLE hprocess = *((HANDLE*)lpparam);
	int value = 1;
	int addr;
	while(true)
	{
		ReadProcessMemory(hprocess,(LPVOID)(baseaddr),&addr,4,0);
		ReadProcessMemory(hprocess,(LPVOID)(addr+0x768),&addr,4,0);
		ReadProcessMemory(hprocess,(LPCVOID)(addr+0x144),&addr,4,0);
		for(int i = 0;i < 10;i++)//利用循环每次加50，循环10次实现10个方框无冷却
		{
			WriteProcessMemory(hprocess,(LPVOID)(addr+0x70+(0x50)*i),&value,4,0);
		}
	}
	return 0;
}

运行结果