CE汇编转C++语言 大佬给个例子

gx15x5

  

[ENABLE]
//code from here to ' [DISABLE]' will be used to enable the cheat
alloc (newmem,2048,"AMo.exe"+106BB2)
label (returnhere)
label (originalcode)
label (exit)
newmem: //this is allocated memory, you have read,write,execute access
//place your code here
originalcode:
mov [r14+00002534], (float)0
exit:
jmp returnhere
"AMo.exe"+106BB2:
jmp newmem
nop 4
returnhere:
[DISABLE]
//code from here till the end of the code will be used to disable the cheat

[ENABLE]<br /> //code from here to '[DISABLE]' will be used to enable the cheat<br /> <br /> alloc(newmem,2048,"AMo.exe"+106BB2)<br /> label(returnhere)<br /> label(originalcode)<br /> label(exit)<br /> <br /> newmem: //this is allocated memory, you have read,write,execute access<br /> //place your code here<br /> <br /> originalcode:<br /> mov [r14+00002534],(float)0<br /> <br /> exit:<br /> jmp returnhere<br /> <br /> "AMo.exe"+106BB2:<br /> jmp newmem<br /> nop 4<br /> returnhere:<br /> <br /> <br /> <br /> [DISABLE]<br /> //code from here till the end of the code will be used to disable the cheat

这汇编完的 怎么用C开启功能啊？？？

是永乐哟

这是CE改游戏的吗？代码是
改AMo.exe偏移106BB2的地址
把[r14+00002534]改成0
然后无条件跳到哪里
C++要弄的话感觉应该是hook

是永乐哟

github上面有别人封装好的库
https://github.com/TsudaKageyu/minhook

哈哈哈1哈

你找到的话跟我说说 我需要把CT脚本 给易语言调用 谢谢 QQ297222024

gx15x5

哈哈哈1哈 发表于 2026-7-5 12:55
你找到的话跟我说说 我需要把CT脚本 给易语言调用 谢谢 QQ297222024

易语言用CEAA就行 跟CE脚本一样都不用改 直接粘贴

woaini8023

#include <Windows.h>
#include <cstdint>

#pragma region HookBase

uintptr_t g_ModuleBase = 0;
uintptr_t g_HookAddr   = 0;
BYTE      g_OriginalBytes[5] = { 0 };

// 跳转回原代码
void* g_ReturnAddress = nullptr;

__declspec(naked) void HookStub()
{
    __asm {
        // 模拟原代码
        movss dword ptr [r14 + 02534h], xmm0

        // 跳回原地址 + 5
        jmp [g_ReturnAddress]
    }
}

BOOL PatchMemory()
{
    g_ModuleBase = reinterpret_cast<uintptr_t>(GetModuleHandleA("AMo.exe"));
    if (!g_ModuleBase)
        return FALSE;

    g_HookAddr = g_ModuleBase + 0x106BB2;

    DWORD oldProtect;
    VirtualProtect((LPVOID)g_HookAddr, 5, PAGE_EXECUTE_READWRITE, &oldProtect);

    // 保存原始字节
    memcpy(g_OriginalBytes, (void*)g_HookAddr, 5);

    // 计算 JMP 偏移
    DWORD offset = (DWORD)((uintptr_t)&HookStub - (g_HookAddr + 5));

    // 写入 jmp HookStub
    *reinterpret_cast<BYTE*>(g_HookAddr) = 0xE9;
    *reinterpret_cast<DWORD*>(g_HookAddr + 1) = offset;

    // NOP 4 字节（对应 CE 的 nop 4）
    memset((void*)(g_HookAddr + 5), 0x90, 4);

    VirtualProtect((LPVOID)g_HookAddr, 5, oldProtect, nullptr);
    return TRUE;
}

BOOL UnpatchMemory()
{
    if (!g_HookAddr)
        return FALSE;

    DWORD oldProtect;
    VirtualProtect((LPVOID)g_HookAddr, 5, PAGE_EXECUTE_READWRITE, &oldProtect);
    memcpy((void*)g_HookAddr, g_OriginalBytes, 5);
    VirtualProtect((LPVOID)g_HookAddr, 5, oldProtect, nullptr);
    return TRUE;
}

#pragma endregion

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        DisableThreadLibraryCalls(hModule);
        PatchMemory();          // ENABLE
        break;

    case DLL_PROCESS_DETACH:
        UnpatchMemory();       // DISABLE
        break;
    }
    return TRUE;
}    AI一下就给你转了。

gx15x5

woaini8023 发表于 2026-7-5 14:25
#include
#include

AI转的 启动功能 直接就闪退了

RainCharm

  

#include
#include
#include
#include  
uintptr_t GetModuleBaseAddress (DWORD procId, const wchar_t* modName) {
uintptr_t baseAddress = 0;
HANDLE hSnap = CreateToolhelp32Snapshot (TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);
if (hSnap != INVALID_HANDLE_VALUE) {
MODULEENTRY32W modEntry;
modEntry.dwSize = sizeof (modEntry);
if (Module32FirstW (hSnap, &modEntry)) {
do {
if (!_wcsicmp (modEntry.szModule, modName)) {
baseAddress = (uintptr_t)modEntry.modBaseAddr;
break;
}
} while (Module32NextW (hSnap, &modEntry));
}
}
CloseHandle (hSnap);
return baseAddress;
}
int main () {

DWORD procId = 0;
HWND hGame = FindWindowW (NULL, L"窗口标题");
if (!hGame) {
std::cerr << "未找到游戏窗口！" << std::endl;
return -1;
}
GetWindowThreadProcessId (hGame, &procId);
HANDLE hProcess = OpenProcess (PROCESS_ALL_ACCESS, FALSE, procId);
if (!hProcess) {
std::cerr << "无法打开进程！" << std::endl;
return -1;
}
uintptr_t baseAddress = GetModuleBaseAddress (procId, L"AMo.exe");
if (!baseAddress) {
std::cerr << "无法获取模块基地址！" << std::endl;
CloseHandle (hProcess);
return -1;
}
uintptr_t injectAddress = baseAddress + 0x106BB2;
LPVOID newMem = VirtualAllocEx (hProcess, NULL, 2048, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
if (!newMem) {
std::cerr << "内存分配失败！" << std::endl;
CloseHandle (hProcess);
return -1;
}

std::vector newMemCode = {
0xC7, 0x86, 0x34, 0x25, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00            
};

WriteProcessMemory (hProcess, newMem, newMemCode.data (), newMemCode.size (), NULL);
int32_t jmpOffset = (int32_t) ( (uintptr_t)newMem - (injectAddress + 5));
std::vector jmpInstruction = { 0xE9 };
jmpInstruction.insert (jmpInstruction.end (),
(uint8_t*)&jmpOffset,
(uint8_t*)&jmpOffset + sizeof (jmpOffset));
jmpInstruction.insert (jmpInstruction.end (), 4, 0x90);
DWORD oldProtect;
VirtualProtectEx (hProcess, (LPVOID)injectAddress, jmpInstruction.size (), PAGE_EXECUTE_READWRITE, &oldProtect);
WriteProcessMemory (hProcess, (LPVOID)injectAddress, jmpInstruction.data (), jmpInstruction.size (), NULL);
VirtualProtectEx (hProcess, (LPVOID)injectAddress, jmpInstruction.size (), oldProtect, &oldProtect);
std::cout << "代码注入成功！" << std::endl;
system ("pause");
CloseHandle (hProcess);
return 0;
}

#include <br /> #include <br /> #include <br /> #include  <br /> <br /> <br /> uintptr_t GetModuleBaseAddress(DWORD procId, const wchar_t* modName) {<br />     uintptr_t baseAddress = 0;<br />     HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId);<br />     if (hSnap != INVALID_HANDLE_VALUE) {<br />         MODULEENTRY32W modEntry;<br />         modEntry.dwSize = sizeof(modEntry);<br />         if (Module32FirstW(hSnap, &modEntry)) {<br />             do {<br />                 if (!_wcsicmp(modEntry.szModule, modName)) {<br />                     baseAddress = (uintptr_t)modEntry.modBaseAddr;<br />                     break;<br />                 }<br />             } while (Module32NextW(hSnap, &modEntry));<br />         }<br />     }<br />     CloseHandle(hSnap);<br />     return baseAddress;<br /> }<br /> <br /> int main() {<br /> <br />     DWORD procId = 0;<br />     HWND hGame = FindWindowW(NULL, L"窗口标题"); <br />     if (!hGame) {<br />         std::cerr << "未找到游戏窗口！" << std::endl;<br />         return -1;<br />     }<br />     GetWindowThreadProcessId(hGame, &procId);<br /> <br />     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procId);<br />     if (!hProcess) {<br />         std::cerr << "无法打开进程！" << std::endl;<br />         return -1;<br />     }<br /> <br />     uintptr_t baseAddress = GetModuleBaseAddress(procId, L"AMo.exe");<br />     if (!baseAddress) {<br />         std::cerr << "无法获取模块基地址！" << std::endl;<br />         CloseHandle(hProcess);<br />         return -1;<br />     }<br /> <br />     uintptr_t injectAddress = baseAddress + 0x106BB2;<br /> <br />     LPVOID newMem = VirtualAllocEx(hProcess, NULL, 2048, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);<br />     if (!newMem) {<br />         std::cerr << "内存分配失败！" << std::endl;<br />         CloseHandle(hProcess);<br />         return -1;<br />     }<br /> <br /> <br />     std::vector newMemCode = {<br />         0xC7, 0x86, 0x34, 0x25, 0x00, 0x00, <br />         0x00, 0x00, 0x00, 0x00            <br />     };<br /> <br />   <br />     WriteProcessMemory(hProcess, newMem, newMemCode.data(), newMemCode.size(), NULL);<br /> <br />     int32_t jmpOffset = (int32_t)((uintptr_t)newMem - (injectAddress + 5));<br /> <br />     std::vector jmpInstruction = { 0xE9 }; <br />     jmpInstruction.insert(jmpInstruction.end(),<br />         (uint8_t*)&jmpOffset,<br />         (uint8_t*)&jmpOffset + sizeof(jmpOffset));<br /> <br />     jmpInstruction.insert(jmpInstruction.end(), 4, 0x90);<br /> <br />     DWORD oldProtect;<br />     VirtualProtectEx(hProcess, (LPVOID)injectAddress, jmpInstruction.size(), PAGE_EXECUTE_READWRITE, &oldProtect);<br />     WriteProcessMemory(hProcess, (LPVOID)injectAddress, jmpInstruction.data(), jmpInstruction.size(), NULL);<br />     VirtualProtectEx(hProcess, (LPVOID)injectAddress, jmpInstruction.size(), oldProtect, &oldProtect);<br /> <br />     std::cout << "代码注入成功！" << std::endl;<br /> <br />     system("pause");<br /> <br />     CloseHandle(hProcess);<br /> <br />     return 0;<br /> }

你试下这个，希望能帮到你