赞 | 0 |
VIP | 0 |
好人卡 | 0 |
积分 | 1 |
经验 | 2904 |
最后登录 | 2015-12-24 |
在线时间 | 37 小时 |
Lv1.梦旅人
- 梦石
- 0
- 星屑
- 50
- 在线时间
- 37 小时
- 注册时间
- 2015-10-12
- 帖子
- 53
|
6楼
楼主 |
发表于 2015-11-16 03:32:04
|
只看该作者
找到了。。。是这个脚本里的。。
貌似和改名的脚本在一起的。这个一禁用,到了改名的界面就弹框退出了
#encoding:utf-8
# 纯脚本不使用DLL就读取窗口消息
# By 晴兰 form 66RPG
# 功能擴充 By AAM@_@
#==============================================================================
# ■ MainWindow
#------------------------------------------------------------------------------
# 。
#==============================================================================
module MainWindow
#--------------------------------------------------------------------------
# ● 部分Windows消息定义
#--------------------------------------------------------------------------
WM_CREATE = 0x0001
WM_DESTROY = 0x0002
WM_MOVE = 0x0003
WM_SIZE = 0x0005
WM_ACTIVATE = 0x0006
WM_ACTIVATEAPP = 0x001C
WM_GETTEXT = 0x000D
WM_GETTEXTLENGTH = 0x000E
WM_PAINT = 0x000F
WM_CLOSE = 0x0010
WM_QUERYENDSESSION = 0x0011
WM_QUIT = 0x0012
WM_KEYDOWN = 0x0100
WM_KEYUP = 0x0101
WM_CHAR = 0x0102
WM_SYSKEYDOWN = 0x0104
WM_SYSKEYUP = 0x0105
WM_SYSCHAR = 0x0106
WM_COMMAND = 0x0111
WM_SYSCOMMAND = 0x0112
WM_TIMER = 0x0113
WM_MOUSEMOVE = 0x0200
WM_LBUTTONDOWN = 0x0201
WM_LBUTTONUP = 0x0202
WM_LBUTTONDBLCLK = 0x0203
WM_RBUTTONDOWN = 0x0204
WM_RBUTTONUP = 0x0205
WM_RBUTTONDBLCLK = 0x0206
WM_MBUTTONDOWN = 0x0207
WM_MBUTTONUP = 0x0208
WM_MBUTTONDBLCLK = 0x0209
WM_MOUSEWHEEL = 0x020A
RM_F1MENU_OPEN = 0x0112
RM_F1MENU_CLOSE = 0x0125
#--------------------------------------------------------------------------
# ● 其他常量定义
#--------------------------------------------------------------------------
WA_INACTIVE = 0
WA_ACTIVE = 1
WA_CLICKACTIVE = 2
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
@@ShowCursor = :"user32|ShowCursor|i|l".to_api
@@handle = false # 禁用默认窗口过程
@@procs = {}
@@child_procs = {}
@@child_callback = {}
@@child_def_procs = {}
#--------------------------------------------------------------------------
# ● 窗口过程函数 ※ 该名字切勿更改
#--------------------------------------------------------------------------
def self.wnd_proc(hwnd,msg,wparam,lparam)
# 消息分歧
case msg
when WM_CREATE
when WM_MOVE
when WM_ACTIVATEAPP
if wparam == WA_INACTIVE
#SNSER.chn_pause_all
Input.lock_all_key
@@ShowCursor.call(1)
else
#SNSER.chn_resume_all
Input.unlock_all_key
@@ShowCursor.call(0)
end
when WM_LBUTTONDOWN
Input.key_down(Input::M_L)
when WM_LBUTTONUP
Input.key_up(Input::M_L)
when WM_LBUTTONDBLCLK
Input.set_dbclick(Input::M_L)
when WM_RBUTTONDOWN
Input.key_down(Input::M_R)
when WM_RBUTTONUP
Input.key_up(Input::M_R)
when WM_RBUTTONDBLCLK
Input.set_dbclick(Input::M_R)
when WM_MBUTTONDOWN
Input.key_down(Input::M_M)
when WM_MBUTTONUP
Input.key_up(Input::M_M)
when WM_MBUTTONDBLCLK
Input.set_dbclick(Input::M_M)
when WM_MOUSEWHEEL
Input.set_mouse_wheel(wparam)
when WM_MOUSEMOVE
Input.set_mouse_pos(lparam)
when WM_KEYDOWN
Input.key_down(wparam)
when WM_KEYUP
Input.key_up(wparam)
when WM_SYSKEYDOWN
Input.key_down(wparam)
when WM_SYSKEYUP
Input.key_up(wparam)
when WM_SIZE
when RM_F1MENU_OPEN
@@ShowCursor.call(1)
when RM_F1MENU_CLOSE
@@ShowCursor.call(0)
else
end
# 調用其他外插的視窗訊息
if !@@procs.empty?
@@procs.each_value do |i|
begin
i.call(hwnd,msg,wparam,lparam)
rescue
end
end
end
# 调用默认窗口过程
self.use_rm_proc(hwnd,msg,wparam,lparam)
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.add_proc(symbol, method)
@@procs[symbol] = method
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.remove_proc(symbol)
@@procs.delete(symbol)
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.use_rm_proc(hwnd, msg, wp, lp)
return :"user32|CallWindowProc|iiiii|i".apicall(@@oHandle, hwnd, msg, wp, lp) if !@@handle
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.disable_rm_proc
@@handle = true
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.enable_rm_proc
@@handle = false
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.child_def_proc(symbol, hwnd, msg, wp, lp)
return :"user32|CallWindowProc|iiiii|i".apicall(@@child_def_procs[hwnd], hwnd, msg, wp, lp)
end
#--------------------------------------------------------------------------
# ● ??? ※ 该名字切勿更改
#--------------------------------------------------------------------------
def self.child_wnd_proc(symbol, hwnd, msg, wparam, lparam)
begin
@@child_procs[symbol].call(hwnd,msg,wparam,lparam)
rescue
end
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.disableChildWndProc(hwnd)
:"user32|SetWindowLong|iii|i".apicall(hwnd, -4, @@child_def_procs[hwnd])
@@child_def_procs.delete(hwnd)
:"msvcrt|free|i|i".apicall(@@child_callback[hwnd])
@@child_callback.delete(hwnd)
@@child_procs.delete(hwnd)
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.enableChildWndProc(hwnd, proc)
@@child_procs[hwnd] = proc
@malloc = :"msvcrt|malloc|i|i"
@memcpy = :"msvcrt|memcpy|ipi|v"
sprintf = self.findProc("msvcrt", "sprintf")
rgsseval = self.findProc("RGSS300", "RGSSGetInt")
oHandle = :"user32|GetWindowLong|ll|l".apicall(hwnd, -4)
buf = @malloc.apicall(1024)
fmt = @malloc.apicall(2048)
sprintfvar = @malloc.apicall(8)
rgssevalvar= @malloc.apicall(8)
oldvar = @malloc.apicall(8)
fmtvar = @malloc.apicall(8)
bufvar = @malloc.apicall(8)
defvar = @malloc.apicall(8)
@@child_def_procs[hwnd] = oHandle
:"msvcrt|strcpy|pp|p".apicall(fmt, "MainWindow.child_wnd_proc(#{hwnd},%d,%d,%d,%d)")
@memcpy.apicall(sprintfvar, [sprintf].pack("i"), 4)
@memcpy.apicall(rgssevalvar,[rgsseval].pack("i"), 4)
@memcpy.apicall(oldvar, [@@oHandle].pack("i"), 4)
@memcpy.apicall(fmtvar, [fmt].pack("i"), 4)
@memcpy.apicall(bufvar, [buf].pack("i"), 4)
@memcpy.apicall(defvar, [oHandle].pack("i"), 4)
code = [0x55,0x89,0xe5,0xff,0x75,0x14,
0xff,0x75,0x10,0xff,0x75,0x0c,
0xff,0x75,0x08,0xff,0x35].pack('C*')
code << [fmtvar].pack('l') << [0xff, 0x35].pack('C*')
code << [bufvar].pack('l') << [0xff, 0x15].pack('C*')
code << [sprintfvar].pack("l")
code << [0xff, 0x15].pack('C*')
code << [rgssevalvar].pack("l")
code << [0x83,0xc4,0x18].pack('C*')
code << [0xc9,0xc2,0x10,0x00].pack('C*')
#0xD1, 0xE8
shellcode = @malloc.apicall(2048)
@memcpy.apicall(shellcode, code, code.size)
:"user32|SetWindowLong|iii|i".apicall(hwnd, -4, shellcode)
@@child_callback[hwnd] = shellcode
end
#--------------------------------------------------------------------------
# ●
#--------------------------------------------------------------------------
def self.enable
MainWindow.instance_eval do
# 清空 enable 方法(避免重複呼叫)
def self.enable
end
# 取得 HWND
@msg = "\0" * 24
@hwnd = 0
while @hwnd == 0
:"user32|GetMessage|piii|v".apicall(@msg, 0, 0, 0)
@kmsg = @msg
:"user32|TranslateMessage|p|v".apicall(@kmsg)
:"user32|DispatchMessage|p|v".apicall(@kmsg)
@hwnd = @msg.unpack("i*")[0]
end
@hdc = :"user32|GetDC|i|i".apicall(@hwnd)
# 方法:取得HWND
def self.hwnd
return @hwnd
end
# 方法:取得HDC
def self.hdc
return @hdc
end
# 方法:取得HWNDProc
def self.findProc(l, n)
lib = :"kernel32|LoadLibrary|p|i".apicall(l)
ret = :"kernel32|GetProcAddress|ip|l".apicall(lib, n)
:"kernel32|FreeLibrary|l|v".apicall(lib)
return ret
end
# 方法:Hook HWNDProc
def self.enableWndProc
# 清空 enableWndProc 方法(避免重複呼叫)
MainWindow.instance_eval do
def self.enableWndProc
end
end
@malloc = :"msvcrt|malloc|i|i"
@memcpy = :"msvcrt|memcpy|ipi|v"
sprintf = self.findProc("msvcrt", "sprintf")
rgsseval = self.findProc("RGSS300", "RGSSGetInt")
@@oHandle = :"user32|GetWindowLong|ll|l".apicall(@hwnd, -4)
buf = @malloc.apicall(1024)
fmt = @malloc.apicall(2048)
sprintfvar = @malloc.apicall(8)
rgssevalvar= @malloc.apicall(8)
oldvar = @malloc.apicall(8)
fmtvar = @malloc.apicall(8)
bufvar = @malloc.apicall(8)
defvar = @malloc.apicall(8)
:"msvcrt|strcpy|pp|p".apicall(fmt, "MainWindow.wnd_proc(%d,%d,%d,%d)")
@memcpy.apicall(sprintfvar, [sprintf].pack("i"), 4)
@memcpy.apicall(rgssevalvar,[rgsseval].pack("i"), 4)
@memcpy.apicall(oldvar, [@@oHandle].pack("i"), 4)
@memcpy.apicall(fmtvar, [fmt].pack("i"), 4)
@memcpy.apicall(bufvar, [buf].pack("i"), 4)
@memcpy.apicall(defvar, [self.findProc("user32", "DefWindowProcA")].pack("i"), 4)
@code = [0x55,0x89,0xe5,0xff,0x75,0x14,
0xff,0x75,0x10,0xff,0x75,0x0c,
0xff,0x75,0x08,0xff,0x35].pack('C*')
@code << [fmtvar].pack('l') << [0xff, 0x35].pack('C*')
@code << [bufvar].pack('l') << [0xff, 0x15].pack('C*')
@code << [sprintfvar].pack("l")
@code << [0xff, 0x15].pack('C*')
@code << [rgssevalvar].pack("l")
@code << [0x83,0xc4,0x18].pack('C*')
@code << [0xc9,0xc2,0x10,0x00].pack('C*')
#0xD1, 0xE8
@shellcode = @malloc.apicall(2048)
@memcpy.apicall(@shellcode, @code, @code.size)
:"user32|SetWindowLong|iii|i".apicall(@hwnd, -4, @shellcode)
end
end
end
end
MainWindow.enable
MainWindow.enableWndProc
|
|