首页 > 代码库 > VB6之扫雷克星
VB6之扫雷克星
很久之前，那时候我还不太会玩（现在也不厉害）扫雷这个游戏，同学总在我面前炫耀自己的技术有多叼。“高级，99颗雷，只需三分钟。。。”，如此这般。也许确实需要天赋，我总要排查个半天才敢点下左键，然后就BOOM！
偶然一天，在网上浏览网页看到了一篇关于“扫雷外挂”的文章，记得那个人是用汇编写的，没记错的话应该是MASM32。文章大概意思是雷的布局是有标志的，雷区内目标值为0x8F的就是雷。要想找到所有雷的坐标，前提是先找到雷区的边界，即起始点、宽度和长度。如果不会反汇编（最起码能看懂二进制码），恐怕很难搞清楚。幸运的是那个高手就是这样的：他提供了雷区的基址。我这样的菜手只好拾人牙慧，拿来改改，用VB6实现了个“扫雷克星”。
注意：雷区的分布应该是在你点击第一下之后才确立的，所以玩的时候先打开扫雷随便点一个，再使用“扫雷克星”。
原理很简单，就不在赘述了，直接上代码：
‘_killboom.basPrivate Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, _ ByVal lpWindowName As String) As LongPrivate Declare Function GetWindowDC Lib "user32" (ByVal hwnd As Long) As LongPrivate Declare Function BitBlt Lib "gdi32" (ByVal hDestDC As Long, _ ByVal x As Long, _ ByVal y As Long, _ ByVal nWidth As Long, _ ByVal nHeight As Long, _ ByVal hSrcDC As Long, _ ByVal xSrc As Long, _ ByVal ySrc As Long, _ ByVal dwRop As Long) As LongPrivate Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, _ lpdwProcessId As Long) As LongPrivate Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, _ ByVal bInheritHandle As Long, _ ByVal dwProcessId As Long) As LongPrivate Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, _ lpBaseAddress As Any, _ lpBuffer As Any, _ ByVal nSize As Long, _ lpNumberOfBytesWritten As Long) As LongPrivate Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As LongPrivate Declare Function ReleaseDC Lib "user32" (ByVal hwnd As Long, _ ByVal hdc As Long) As LongPrivate Declare Function SetForegroundWindow Lib "user32" (ByVal hwnd As Long) As LongPrivate Declare Function PostMessage Lib "user32" Alias "PostMessageA" (ByVal hwnd As Long, _ ByVal wMsg As Long, _ ByVal wParam As Long, _ ByVal lParam As Long) As LongPrivate Const PROCESS_ALL_ACCESS = &H1F0FFFPrivate Const WM_LBUTTONDOWN = &H201Private Const WM_LBUTTONUP = &H202Private Const WM_RBUTTONDOWN = &H204Private Const WM_RBUTTONUP = &H205‘这些既是雷区的基址Private Const total_addr = &H10056A4Private Const height_addr = &H10056A8Private Const width_addr = &H10056ACPrivate Const area_addr = &H1005361Public Function KillBoom() As Boolean ‘这个就是驱雷的函数了，废话 o.O!! Dim hwnd As Long hwnd = FindWindow("扫雷", vbNullString) If hwnd = 0 Then KillBoom = False Exit Function End If Dim hdc As Long Dim pid As Long Dim hp As Long hdc = GetWindowDC(hwnd) Call GetWindowThreadProcessId(hwnd, pid) hp = OpenProcess(PROCESS_ALL_ACCESS, 0&, pid) Dim total As Long Dim height As Long Dim width As Long Call ReadProcessMemory(hp, ByVal total_addr, ByVal VarPtr(total), 4&, 0&) Call ReadProcessMemory(hp, ByVal height_addr, ByVal VarPtr(height), 4&, 0&) Call ReadProcessMemory(hp, ByVal width_addr, ByVal VarPtr(width), 4&, 0&) Dim size As Long Dim mem() As Byte size = 32 * height + 16 ReDim mem(size) As Byte Call ReadProcessMemory(hp, ByVal area_addr, ByVal VarPtr(mem(0)), size, 0&) Dim i As Long Dim x As Long Dim y As Long For i = 0 To size - 1 ‘至于为什么这么算，我也忘了，因为写这个代码时候太久远了 ‘应该是一点点测算出来的 ‘比如，16是距离窗体左侧的距离 ‘97是距离窗体上方的距离 x = i Mod 32 y = i \ 32 x = 16 + x * 16 y = 97 + y * 16 - 32 If mem(i) = &H8F Then ‘如是雷，就插小红旗 Call PostMessage(hwnd, WM_RBUTTONDOWN, 0&, MakeParam(x, y)) Call PostMessage(hwnd, WM_RBUTTONUP, 0&, MakeParam(x, y)) Else ‘不是雷，就点开它吧 Call PostMessage(hwnd, WM_LBUTTONDOWN, 0&, MakeParam(x, y)) Call PostMessage(hwnd, WM_LBUTTONUP, 0&, MakeParam(x, y)) End If Next Erase mem Call CloseHandle(hp) Call ReleaseDC(hwnd, hdc) Call SetForegroundWindow(hwnd) KillBoom = TrueEnd FunctionPrivate Function MakeParam(ByVal LoWord As Long, ByVal HiWord As Long) As Long MakeParam = (HiWord * &H10000) Or (LoWord And &HFFFF&)End Function
为了更优雅些，再加上热键。这样玩的时候，输入快捷键（Alt+Shift+K）就秒杀，哈哈（略邪恶）：
‘_hotkey.bas‘这个模块就是在网上找到，链接如下‘@http://www.cnblogs.com/rosesmall/archive/2012/09/19/2693707.htmlPublic Declare Function SetWindowLong Lib "user32" Alias "SetWindowLongA" (ByVal hwnd As Long, _ ByVal nIndex As Long, _ ByVal dwNewLong As Long) As LongPublic Declare Function GetWindowLong Lib "user32" Alias "GetWindowLongA" (ByVal hwnd As Long, _ ByVal nIndex As Long) As LongPublic Declare Function CallWindowProc Lib "user32" Alias "CallWindowProcA" (ByVal lpPrevWndFunc As Long, _ ByVal hwnd As Long, _ ByVal Msg As Long, _ ByVal wParam As Long, _ ByVal lParam As Long) As LongPublic Declare Function RegisterHotKey Lib "user32" (ByVal hwnd As Long, _ ByVal id As Long, _ ByVal fskey_Modifiers As Long, _ ByVal vk As Long) As LongPublic Declare Function UnregisterHotKey Lib "user32" (ByVal hwnd As Long, ByVal id As Long) As LongPublic Const WM_HOTKEY = &H312Public Const MOD_ALT = &H1Public Const MOD_CONTROL = &H2Public Const MOD_SHIFT = &H4Public Const GWL_WNDPROC = (-4)Private Type taLong ll As LongEnd TypePrivate Type t2Int lWord As Integer hword As IntegerEnd TypePublic preWinProc As LongPublic Modifiers As Long, uVirtKey As Long, idHotKey As LongPublic Function CallbackWndproc(ByVal hwnd As Long, _ ByVal Msg As Long, _ ByVal wParam As Long, _ ByVal lParam As Long) As Long If Msg = WM_HOTKEY Then If wParam = idHotKey Then Dim lp As taLong, i2 As t2Int lp.ll = lParam LSet i2 = lp If (i2.lWord = Modifiers) And i2.hword = uVirtKey Then Call KillBoom End If End If End If CallbackWndproc = CallWindowProc(preWinProc, hwnd, Msg, wParam, lParam)End Function
最后是窗体部分，注册热键然后隐藏自己：
Private Sub Form_Load()‘this code refered from following link‘@http://www.cnblogs.com/rosesmall/archive/2012/09/19/2693707.html preWinProc = GetWindowLong(Me.hwnd, GWL_WNDPROC) Call SetWindowLong(Me.hwnd, GWL_WNDPROC, AddressOf CallbackWndproc) idHotKey = 1 ‘in the range &h0000 through &hBFFF Modifiers = MOD_ALT + MOD_SHIFT uVirtKey = vbKeyK Call RegisterHotKey(Me.hwnd, idHotKey, Modifiers, uVirtKey) Call Me.HideEnd SubPrivate Sub Form_Unload(Cancel As Integer) Call SetWindowLong(Me.hwnd, GWL_WNDPROC, preWinProc) Call UnregisterHotKey(Me.hwnd, uVirtKey)End Sub
搞定收工！另外，那个汇编大神请原谅我，因为实在记不清你文章的网址了，这里就没法贴出来了。
贴张图炫耀下：
终于能打败我同学了，可惜我已经毕业了。。。
PS：差点忘了，最好还是另外注册个热键（如Alt+Shift+Q）关闭自己，否则窗体隐藏了你也许会忘掉它的存在。我因为是在调试模式下，所以不需要 Orz
声明：以上内容来自用户投稿及互联网公开渠道收集整理发布，本网站不拥有所有权，未作人工编辑处理，也不承担相关法律责任，若内容有误或涉及侵权可进行投诉： 投诉/举报 工作人员会在5个工作日内联系你，一经查实，本站将立刻删除涉嫌侵权内容。