1 172
Subscribers
+824 hours
+537 days
+14530 days
Posts Archive
1 172
Repost from N/a
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/wait.h>
int getPID(const char *name)
{
char cmd[256];
snprintf(cmd, sizeof(cmd), "pidof %s", name);
FILE *fp = popen(cmd, "r");
if (fp == NULL)
return -1;
int pid = -1;
fscanf(fp, "%d", &pid);
pclose(fp);
return pid;
}
void runRootCmd(const char *cmd)
{
printf("执行命令: %s\n", cmd);
pid_t pid = fork();
if (pid == 0)
{
execl("/system/bin/su", "su", "-c", cmd, NULL);
_exit(0);
}
waitpid(pid, NULL, 0);
}
unsigned long get_module_base(int pid, const char *module_name)
{
char path[128];
char line[1024];
unsigned long base = 0;
snprintf(path, sizeof(path), "/proc/%d/maps", pid);
FILE *fp = fopen(path, "r");
if (fp != NULL)
{
while (fgets(line, sizeof(line), fp))
{
if (!strstr(line, module_name))
continue;
if (!strstr(line, "r-xp"))
continue;
char *addr = strtok(line, "-");
base = strtoul(addr, NULL, 16);
break;
}
fclose(fp);
}
return base;
}
int WriteAddress_DWORD(int pid, long addr, int value)
{
char path[128];
snprintf(path, sizeof(path), "/proc/%d/mem", pid);
int fd = open(path, O_RDWR);
if (fd < 0)
return -1;
int ret = pwrite64(fd, &value, 4, addr);
close(fd);
return ret;
}
int main()
{
const char *pkg = "com.tencent.tmgp.pubgmhd";
const char *splash = "com.epicgames.ue4.SplashActivity";
puts("【1】检测游戏进程");
int pid = getPID(pkg);
printf("当前PID = %d\n", pid);
if (pid > 0)
{
puts("✅检测到游戏正在运行,执行 force-stop");
char cmd[256];
snprintf(cmd, sizeof(cmd), "am force-stop %s", pkg);
runRootCmd(cmd);
sleep(3);
printf("杀完,再次检测PID:%d\n", getPID(pkg));
}
else
{
puts("ℹ️游戏本来没有运行");
}
puts("【2】启动和平精英");
char startCmd[512];
snprintf(startCmd, sizeof(startCmd), "am start -f 0x10000000 --activity-clear-task -n %s/%s", pkg, splash);
runRootCmd(startCmd);
puts("【3】马上hook");
sleep(3);
pid = getPID(pkg);
char ue4[] = "libUE4.so";
unsigned long ue4Base = get_module_base(pid, ue4);
WriteAddress_DWORD(pid, ue4Base, -1);
char tersafe[] = "libtersafe.so";
unsigned long tersafeBase = get_module_base(pid, tersafe);
WriteAddress_DWORD(pid, tersafeBase + 0x52C55C);
puts("hook成功");
return 0;
}
sz乱糟未发布的sh全防
最少百分之80相似
有多乱炖你们自己看就行了😂
1 172
Repost from N/a
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <fcntl.h>
#include <sys/wait.h>
int getPID(const char *name)
{
char cmd[256];
snprintf(cmd, sizeof(cmd), "pidof %s", name);
FILE *fp = popen(cmd, "r");
if (fp == NULL)
return -1;
int pid = -1;
fscanf(fp, "%d", &pid);
pclose(fp);
return pid;
}
void runRootCmd(const char *cmd)
{
printf("执行命令: %s\n", cmd);
pid_t pid = fork();
if (pid == 0)
{
execl("/system/bin/su", "su", "-c", cmd, NULL);
_exit(0);
}
waitpid(pid, NULL, 0);
}
unsigned long get_module_base(int pid, const char *module_name)
{
char path[128];
char line[1024];
unsigned long base = 0;
snprintf(path, sizeof(path), "/proc/%d/maps", pid);
FILE *fp = fopen(path, "r");
if (fp != NULL)
{
while (fgets(line, sizeof(line), fp))
{
if (!strstr(line, module_name))
continue;
if (!strstr(line, "r-xp"))
continue;
char *addr = strtok(line, "-");
base = strtoul(addr, NULL, 16);
break;
}
fclose(fp);
}
return base;
}
int WriteAddress_DWORD(int pid, long addr, int value)
{
char path[128];
snprintf(path, sizeof(path), "/proc/%d/mem", pid);
int fd = open(path, O_RDWR);
if (fd < 0)
return -1;
int ret = pwrite64(fd, &value, 4, addr);
close(fd);
return ret;
}
int main()
{
const char *pkg = "com.tencent.tmgp.pubgmhd";
const char *splash = "com.epicgames.ue4.SplashActivity";
puts("【1】检测游戏进程");
int pid = getPID(pkg);
printf("当前PID = %d\n", pid);
if (pid > 0)
{
puts("✅检测到游戏正在运行,执行 force-stop");
char cmd[256];
snprintf(cmd, sizeof(cmd), "am force-stop %s", pkg);
runRootCmd(cmd);
sleep(3);
printf("杀完,再次检测PID:%d\n", getPID(pkg));
}
else
{
puts("ℹ️游戏本来没有运行");
}
puts("【2】启动和平精英");
char startCmd[512];
snprintf(startCmd, sizeof(startCmd), "am start -f 0x10000000 --activity-clear-task -n %s/%s", pkg, splash);
runRootCmd(startCmd);
puts("【3】马上hook");
sleep(3);
pid = getPID(pkg);
char ue4[] = "libUE4.so";
unsigned long ue4Base = get_module_base(pid, ue4);
WriteAddress_DWORD(pid, ue4Base, -1);
char tersafe[] = "libtersafe.so";
unsigned long tersafeBase = get_module_base(pid, tersafe);
WriteAddress_DWORD(pid, tersafeBase + 0x52C55C);
puts("hook成功");
return 0;
}
sz乱糟未发布的sh全防
有多乱炖你们自己看就行了😂
