Skip to content
体验新版
项目
组织
正在加载...
登录
切换导航
打开侧边栏
夜猫逐梦
MyOpen
提交
201149a8
M
MyOpen
项目概览
夜猫逐梦
/
MyOpen
通知
2
Star
0
Fork
1
代码
文件
提交
分支
Tags
贡献者
分支图
Diff
Issue
0
列表
看板
标记
里程碑
合并请求
0
DevOps
流水线
流水线任务
计划
Wiki
0
Wiki
分析
仓库
DevOps
项目成员
Pages
M
MyOpen
项目概览
项目概览
详情
发布
仓库
仓库
文件
提交
分支
标签
贡献者
分支图
比较
Issue
0
Issue
0
列表
看板
标记
里程碑
合并请求
0
合并请求
0
Pages
DevOps
DevOps
流水线
流水线任务
计划
分析
分析
仓库分析
DevOps
Wiki
0
Wiki
成员
成员
收起侧边栏
关闭侧边栏
动态
分支图
创建新Issue
流水线任务
提交
Issue看板
提交
201149a8
编写于
3月 19, 2024
作者:
K
Knine
浏览文件
操作
浏览文件
下载
电子邮件补丁
差异文件
frida 课程8-11
上级
d082be9c
变更
7
隐藏空白更改
内联
并排
Showing
7 changed file
with
698 addition
and
1 deletion
+698
-1
course/frida/08_将目标窗口切换到前台/index.ts
course/frida/08_将目标窗口切换到前台/index.ts
+79
-0
course/frida/09_获取软件窗口位置,设置鼠标指针位置/index.ts
course/frida/09_获取软件窗口位置,设置鼠标指针位置/index.ts
+105
-0
course/frida/10_设置鼠标位置,自动点击鼠标/index.ts
course/frida/10_设置鼠标位置,自动点击鼠标/index.ts
+129
-0
course/frida/11_用鼠标自动标记棋盘上的雷区/index.ts
course/frida/11_用鼠标自动标记棋盘上的雷区/index.ts
+132
-0
course/frida/package.json
course/frida/package.json
+5
-1
course/frida/winapi/kernel32.ts
course/frida/winapi/kernel32.ts
+39
-0
course/frida/winapi/user32.ts
course/frida/winapi/user32.ts
+209
-0
未找到文件。
course/frida/08_将目标窗口切换到前台/index.ts
0 → 100644
浏览文件 @
201149a8
import
User32
from
'
../winapi/user32
'
class
L07
{
private
module_name_winmine
=
"
winmine.exe
"
;
private
module_winmine
:
Module
;
private
offset地雷数量
:
number
=
0x56a4
;
private
offset棋盘高度
:
number
=
0x56a8
;
private
offset棋盘宽度
:
number
=
0x56ac
;
private
height
:
number
=
0
;
private
width
:
number
=
0
;
private
mine_count
:
number
=
0
;
private
head
:
NativePointer
=
ptr
(
0
);
private
hWnd
:
NativePointer
=
ptr
(
0
);
constructor
()
{
console
.
log
(
"
======================
"
,
new
Date
().
toISOString
(),
"
==========================
"
);
console
.
log
(
"
Frida.version
"
,
Frida
.
version
);
//获取模块基址
this
.
module_winmine
=
Process
.
getModuleByName
(
this
.
module_name_winmine
);
// 初始化游戏相关数据
this
.
height
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘高度
).
readU32
();
this
.
width
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘宽度
).
readU32
();
this
.
mine_count
=
this
.
module_winmine
.
base
.
add
(
this
.
offset地雷数量
).
readU32
();
this
.
head
=
this
.
module_winmine
.
base
.
add
(
0x5340
);
this
.
hWnd
=
this
.
module_winmine
.
base
.
add
(
0x5B24
).
readPointer
();
}
board_repaint
()
{
const
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetClientRect
(
this
.
hWnd
,
lpRect
);
User32
.
InvalidateRect
(
this
.
hWnd
,
lpRect
,
1
);
}
将目标窗口切换到前台
()
{
let
hForeWnd
=
User32
.
GetForegroundWindow
();
let
dwCurID
=
User32
.
GetCurrentThreadId
();
let
dwForeID
=
User32
.
GetWindowThreadProcessId
(
hForeWnd
,
ptr
(
0
));
// User32.AttachThreadInput(dwCurID, dwForeID, 1);
User32
.
ShowWindow
(
this
.
hWnd
,
User32
.
Const
.
SW_RESTORE
);
User32
.
SetForegroundWindow
(
this
.
hWnd
)
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_TOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_NOTOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.AttachThreadInput(dwCurID, dwForeID, 0);
}
run
()
{
//遍历棋盘,按行遍历
for
(
let
i
=
0
;
i
<
this
.
height
+
2
;
i
++
)
{
//按列遍历
let
data
=
[];
for
(
let
j
=
0
;
j
<
this
.
width
+
2
;
j
++
)
{
let
byte_data
=
this
.
head
.
add
(
j
+
0x20
*
i
).
readU8
();
data
.
push
(
byte_data
.
toString
(
16
).
padStart
(
2
,
"
0
"
));
// 如果是地雷,将其状态改为标记
if
(
byte_data
==
0x8F
)
{
this
.
head
.
add
(
j
+
0x20
*
i
).
writeU8
(
0x8E
);
}
}
console
.
log
(
data
.
join
(
"
"
));
}
// 重绘窗口区域
this
.
board_repaint
()
this
.
将目标窗口切换到前台
()
}
}
let
l07
=
new
L07
();
l07
.
run
();
course/frida/09_获取软件窗口位置,设置鼠标指针位置/index.ts
0 → 100644
浏览文件 @
201149a8
import
User32
from
'
../winapi/user32
'
import
Kernel32
from
'
../winapi/kernel32
'
class
L07
{
private
module_name_winmine
=
"
winmine.exe
"
;
private
module_winmine
:
Module
;
private
offset地雷数量
:
number
=
0x56a4
;
private
offset棋盘高度
:
number
=
0x56a8
;
private
offset棋盘宽度
:
number
=
0x56ac
;
private
height
:
number
=
0
;
private
width
:
number
=
0
;
private
mine_count
:
number
=
0
;
private
head
:
NativePointer
=
ptr
(
0
);
private
hWnd
:
NativePointer
=
ptr
(
0
);
constructor
()
{
console
.
log
(
"
======================
"
,
new
Date
().
toISOString
(),
"
==========================
"
);
console
.
log
(
"
Frida.version
"
,
Frida
.
version
);
//获取模块基址
this
.
module_winmine
=
Process
.
getModuleByName
(
this
.
module_name_winmine
);
// 初始化游戏相关数据
this
.
height
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘高度
).
readU32
();
this
.
width
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘宽度
).
readU32
();
this
.
mine_count
=
this
.
module_winmine
.
base
.
add
(
this
.
offset地雷数量
).
readU32
();
this
.
head
=
this
.
module_winmine
.
base
.
add
(
0x5340
);
this
.
hWnd
=
this
.
module_winmine
.
base
.
add
(
0x5B24
).
readPointer
();
}
board_repaint
()
{
const
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetClientRect
(
this
.
hWnd
,
lpRect
);
User32
.
InvalidateRect
(
this
.
hWnd
,
lpRect
,
1
);
}
将目标窗口切换到前台
()
{
let
hForeWnd
=
User32
.
GetForegroundWindow
();
let
dwCurID
=
Kernel32
.
GetCurrentThreadId
();
let
dwForeID
=
User32
.
GetWindowThreadProcessId
(
hForeWnd
,
ptr
(
0
));
// User32.AttachThreadInput(dwCurID, dwForeID, 1);
User32
.
ShowWindow
(
this
.
hWnd
,
User32
.
Const
.
SW_RESTORE
);
User32
.
SetForegroundWindow
(
this
.
hWnd
)
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_TOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_NOTOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.AttachThreadInput(dwCurID, dwForeID, 0);
}
获取软件窗口位置_设置鼠标指针位置
()
{
let
lpOrgRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetCursorPos
(
lpOrgRect
);
// typedef struct tagRECT {
// LONG left;
// LONG top;
// LONG right;
// LONG bottom;
// } RECT, *PRECT, *NPRECT, *LPRECT;
let
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetWindowRect
(
this
.
hWnd
,
lpRect
);
console
.
log
(
"
left
"
,
lpRect
.
readU32
());
console
.
log
(
"
top
"
,
lpRect
.
add
(
4
).
readU32
());
console
.
log
(
"
right
"
,
lpRect
.
add
(
8
).
readU32
());
console
.
log
(
"
bottom
"
,
lpRect
.
add
(
12
).
readU32
());
User32
.
SetCursorPos
(
lpRect
.
readU32
(),
lpRect
.
add
(
4
).
readU32
());
Kernel32
.
Sleep
(
2000
);
User32
.
SetCursorPos
(
lpOrgRect
.
readU32
(),
lpOrgRect
.
add
(
4
).
readU32
());
}
run
()
{
//遍历棋盘,按行遍历
for
(
let
i
=
0
;
i
<
this
.
height
+
2
;
i
++
)
{
//按列遍历
let
data
=
[];
for
(
let
j
=
0
;
j
<
this
.
width
+
2
;
j
++
)
{
let
byte_data
=
this
.
head
.
add
(
j
+
0x20
*
i
).
readU8
();
data
.
push
(
byte_data
.
toString
(
16
).
padStart
(
2
,
"
0
"
));
// 如果是地雷,将其状态改为标记
if
(
byte_data
==
0x8F
)
{
this
.
head
.
add
(
j
+
0x20
*
i
).
writeU8
(
0x8E
);
}
}
console
.
log
(
data
.
join
(
"
"
));
}
// 重绘窗口区域
this
.
board_repaint
()
this
.
将目标窗口切换到前台
()
this
.
获取软件窗口位置_设置鼠标指针位置
()
}
}
let
l07
=
new
L07
();
l07
.
run
();
course/frida/10_设置鼠标位置,自动点击鼠标/index.ts
0 → 100644
浏览文件 @
201149a8
import
User32
from
'
../winapi/user32
'
import
Kernel32
from
'
../winapi/kernel32
'
class
L07
{
private
module_name_winmine
=
"
winmine.exe
"
;
private
module_winmine
:
Module
;
private
offset地雷数量
:
number
=
0x56a4
;
private
offset棋盘高度
:
number
=
0x56a8
;
private
offset棋盘宽度
:
number
=
0x56ac
;
private
height
:
number
=
0
;
private
width
:
number
=
0
;
private
mine_count
:
number
=
0
;
private
head
:
NativePointer
=
ptr
(
0
);
private
hWnd
:
NativePointer
=
ptr
(
0
);
// 设置鼠标位置_自动点击鼠标
private
start_x
=
0
;
private
start_y
=
0
;
private
step
=
16
;
constructor
()
{
console
.
log
(
"
======================
"
,
new
Date
().
toISOString
(),
"
==========================
"
);
console
.
log
(
"
Frida.version
"
,
Frida
.
version
);
//获取模块基址
this
.
module_winmine
=
Process
.
getModuleByName
(
this
.
module_name_winmine
);
// 初始化游戏相关数据
this
.
height
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘高度
).
readU32
();
this
.
width
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘宽度
).
readU32
();
this
.
mine_count
=
this
.
module_winmine
.
base
.
add
(
this
.
offset地雷数量
).
readU32
();
this
.
head
=
this
.
module_winmine
.
base
.
add
(
0x5340
);
this
.
hWnd
=
this
.
module_winmine
.
base
.
add
(
0x5B24
).
readPointer
();
}
board_repaint
()
{
const
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetClientRect
(
this
.
hWnd
,
lpRect
);
User32
.
InvalidateRect
(
this
.
hWnd
,
lpRect
,
1
);
}
将目标窗口切换到前台
()
{
let
hForeWnd
=
User32
.
GetForegroundWindow
();
let
dwCurID
=
Kernel32
.
GetCurrentThreadId
();
let
dwForeID
=
User32
.
GetWindowThreadProcessId
(
hForeWnd
,
ptr
(
0
));
// User32.AttachThreadInput(dwCurID, dwForeID, 1);
User32
.
ShowWindow
(
this
.
hWnd
,
User32
.
Const
.
SW_RESTORE
);
User32
.
SetForegroundWindow
(
this
.
hWnd
)
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_TOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_NOTOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.AttachThreadInput(dwCurID, dwForeID, 0);
}
获取软件窗口位置_设置鼠标指针位置
()
{
let
lpOrgRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetCursorPos
(
lpOrgRect
);
// typedef struct tagRECT {
// LONG left;
// LONG top;
// LONG right;
// LONG bottom;
// } RECT, *PRECT, *NPRECT, *LPRECT;
let
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetWindowRect
(
this
.
hWnd
,
lpRect
);
console
.
log
(
"
left
"
,
lpRect
.
readU32
());
console
.
log
(
"
top
"
,
lpRect
.
add
(
4
).
readU32
());
console
.
log
(
"
right
"
,
lpRect
.
add
(
8
).
readU32
());
console
.
log
(
"
bottom
"
,
lpRect
.
add
(
12
).
readU32
());
this
.
start_x
=
lpRect
.
readU32
()
+
7
;
this
.
start_y
=
lpRect
.
add
(
4
).
readU32
()
+
92
;
console
.
log
(
"
start_x
"
,
this
.
start_x
);
console
.
log
(
"
start_y
"
,
this
.
start_y
);
// User32.SetCursorPos(lpRect.readU32(), lpRect.add(4).readU32());
// Kernel32.Sleep(2000);
// User32.SetCursorPos(lpOrgRect.readU32(), lpOrgRect.add(4).readU32());
}
mouse_click
(
x
:
number
,
y
:
number
,
left_click
:
boolean
=
true
)
{
User32
.
SetCursorPos
(
this
.
start_x
+
this
.
step
*
x
,
this
.
start_y
+
this
.
step
*
y
);
if
(
left_click
)
{
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_LEFTDOWN
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_LEFTUP
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
}
else
{
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_RIGHTDOWN
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_RIGHTUP
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
}
}
设置鼠标位置_自动点击鼠标
()
{
this
.
mouse_click
(
2
,
2
,
false
);
}
run
()
{
//遍历棋盘,按行遍历
for
(
let
i
=
0
;
i
<
this
.
height
+
2
;
i
++
)
{
//按列遍历
let
data
=
[];
for
(
let
j
=
0
;
j
<
this
.
width
+
2
;
j
++
)
{
let
byte_data
=
this
.
head
.
add
(
j
+
0x20
*
i
).
readU8
();
data
.
push
(
byte_data
.
toString
(
16
).
padStart
(
2
,
"
0
"
));
// 如果是地雷,将其状态改为标记
if
(
byte_data
==
0x8F
)
{
this
.
head
.
add
(
j
+
0x20
*
i
).
writeU8
(
0x8E
);
}
}
console
.
log
(
data
.
join
(
"
"
));
}
// 重绘窗口区域
this
.
board_repaint
()
this
.
将目标窗口切换到前台
()
this
.
获取软件窗口位置_设置鼠标指针位置
()
this
.
设置鼠标位置_自动点击鼠标
()
}
}
let
l07
=
new
L07
();
l07
.
run
();
course/frida/11_用鼠标自动标记棋盘上的雷区/index.ts
0 → 100644
浏览文件 @
201149a8
import
User32
from
'
../winapi/user32
'
import
Kernel32
from
'
../winapi/kernel32
'
class
L07
{
private
module_name_winmine
=
"
winmine.exe
"
;
private
module_winmine
:
Module
;
private
offset地雷数量
:
number
=
0x56a4
;
private
offset棋盘高度
:
number
=
0x56a8
;
private
offset棋盘宽度
:
number
=
0x56ac
;
private
height
:
number
=
0
;
private
width
:
number
=
0
;
private
mine_count
:
number
=
0
;
private
head
:
NativePointer
=
ptr
(
0
);
private
hWnd
:
NativePointer
=
ptr
(
0
);
// 设置鼠标位置_自动点击鼠标
private
start_x
=
0
;
private
start_y
=
0
;
private
step
=
16
;
constructor
()
{
console
.
log
(
"
======================
"
,
new
Date
().
toISOString
(),
"
==========================
"
);
console
.
log
(
"
Frida.version
"
,
Frida
.
version
);
//获取模块基址
this
.
module_winmine
=
Process
.
getModuleByName
(
this
.
module_name_winmine
);
// 初始化游戏相关数据
this
.
height
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘高度
).
readU32
();
this
.
width
=
this
.
module_winmine
.
base
.
add
(
this
.
offset棋盘宽度
).
readU32
();
this
.
mine_count
=
this
.
module_winmine
.
base
.
add
(
this
.
offset地雷数量
).
readU32
();
this
.
head
=
this
.
module_winmine
.
base
.
add
(
0x5340
);
this
.
hWnd
=
this
.
module_winmine
.
base
.
add
(
0x5B24
).
readPointer
();
}
board_repaint
()
{
const
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetClientRect
(
this
.
hWnd
,
lpRect
);
User32
.
InvalidateRect
(
this
.
hWnd
,
lpRect
,
1
);
}
将目标窗口切换到前台
()
{
let
hForeWnd
=
User32
.
GetForegroundWindow
();
let
dwCurID
=
Kernel32
.
GetCurrentThreadId
();
let
dwForeID
=
User32
.
GetWindowThreadProcessId
(
hForeWnd
,
ptr
(
0
));
// User32.AttachThreadInput(dwCurID, dwForeID, 1);
User32
.
ShowWindow
(
this
.
hWnd
,
User32
.
Const
.
SW_RESTORE
);
User32
.
SetForegroundWindow
(
this
.
hWnd
)
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_TOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.SetWindowPos(this.hWnd, User32.Const.HWND_NOTOPMOST, 0, 0, 0, 0, User32.Const.SWP_NOSIZE | User32.Const.SWP_NOMOVE);
// User32.AttachThreadInput(dwCurID, dwForeID, 0);
}
获取软件窗口位置_设置鼠标指针位置
()
{
let
lpOrgRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetCursorPos
(
lpOrgRect
);
// typedef struct tagRECT {
// LONG left;
// LONG top;
// LONG right;
// LONG bottom;
// } RECT, *PRECT, *NPRECT, *LPRECT;
let
lpRect
=
Memory
.
alloc
(
4
*
4
);
User32
.
GetWindowRect
(
this
.
hWnd
,
lpRect
);
console
.
log
(
"
left
"
,
lpRect
.
readU32
());
console
.
log
(
"
top
"
,
lpRect
.
add
(
4
).
readU32
());
console
.
log
(
"
right
"
,
lpRect
.
add
(
8
).
readU32
());
console
.
log
(
"
bottom
"
,
lpRect
.
add
(
12
).
readU32
());
this
.
start_x
=
lpRect
.
readU32
()
+
7
;
this
.
start_y
=
lpRect
.
add
(
4
).
readU32
()
+
92
;
console
.
log
(
"
start_x
"
,
this
.
start_x
);
console
.
log
(
"
start_y
"
,
this
.
start_y
);
// User32.SetCursorPos(lpRect.readU32(), lpRect.add(4).readU32());
// Kernel32.Sleep(2000);
// User32.SetCursorPos(lpOrgRect.readU32(), lpOrgRect.add(4).readU32());
}
mouse_click
(
x
:
number
,
y
:
number
,
left_click
:
boolean
=
true
)
{
User32
.
SetCursorPos
(
this
.
start_x
+
this
.
step
*
x
,
this
.
start_y
+
this
.
step
*
y
);
if
(
left_click
)
{
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_LEFTDOWN
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_LEFTUP
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
}
else
{
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_RIGHTDOWN
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
User32
.
MouseEvent
(
User32
.
Const
.
MOUSEEVENTF_RIGHTUP
,
0
,
0
,
0
,
User32
.
GetMessageExtraInfo
());
}
}
设置鼠标位置_自动点击鼠标
()
{
this
.
mouse_click
(
2
,
2
,
false
);
}
run
()
{
this
.
将目标窗口切换到前台
()
this
.
获取软件窗口位置_设置鼠标指针位置
()
//遍历棋盘,按行遍历
for
(
let
i
=
0
;
i
<
this
.
height
+
2
;
i
++
)
{
//按列遍历
let
data
=
[];
for
(
let
j
=
0
;
j
<
this
.
width
+
2
;
j
++
)
{
let
byte_data
=
this
.
head
.
add
(
j
+
0x20
*
i
).
readU8
();
data
.
push
(
byte_data
.
toString
(
16
).
padStart
(
2
,
"
0
"
));
// 标记地雷
if
(
byte_data
==
0x8F
)
{
this
.
mouse_click
(
j
,
i
,
false
);
}
// 点击无雷区
if
(
byte_data
==
0x0F
)
{
this
.
mouse_click
(
j
,
i
);
}
}
console
.
log
(
data
.
join
(
"
"
));
}
// 重绘窗口区域
this
.
board_repaint
()
}
}
let
l07
=
new
L07
();
l07
.
run
();
course/frida/package.json
浏览文件 @
201149a8
...
...
@@ -9,7 +9,11 @@
"watch05"
:
"frida-compile ./05_读取棋盘数据/index.ts -o ./build/05.js -w"
,
"watch06"
:
"frida-compile ./06_分析扫雷游戏的数据,显示地雷位置/index.ts -o ./build/06.js -w"
,
"watch07"
:
"frida-compile ./07_让系统重新绘制指定窗口/index.ts -o ./build/07.js -w"
,
"runx"
:
"D:/Python/Python371/Scripts/frida.exe -n winmine.exe -l ./build/07.js -q"
"watch08"
:
"frida-compile ./08_将目标窗口切换到前台/index.ts -o ./build/08.js -w"
,
"watch09"
:
"frida-compile ./09_获取软件窗口位置,设置鼠标指针位置/index.ts -o ./build/09.js -w"
,
"watch10"
:
"frida-compile ./10_设置鼠标位置,自动点击鼠标/index.ts -o ./build/10.js -w"
,
"watch11"
:
"frida-compile ./11_用鼠标自动标记棋盘上的雷区/index.ts -o ./build/11.js -w"
,
"runx"
:
"D:/Python/Python371/Scripts/frida.exe -n winmine.exe -l ./build/11.js -q"
},
"keywords"
:
[],
"author"
:
""
,
...
...
course/frida/winapi/kernel32.ts
0 → 100644
浏览文件 @
201149a8
/*
@param moduleName — Module name or path.
@param exportName
@param retType
@param argTypes
@param abiOrOptions
*/
function
EZ生成NativeFunction
(
exportName
:
string
,
retType
:
NativeFunctionReturnType
,
argTypes
:
[]
|
NativeFunctionArgumentType
[],
abiOrOptions
:
NativeABI
|
NativeFunctionOptions
=
"
default
"
,
moduleName
:
string
=
"
Kernel32.dll
"
,
)
{
let
address
=
Module
.
findExportByName
(
moduleName
,
exportName
);
return
new
NativeFunction
(
address
!
,
retType
,
argTypes
,
abiOrOptions
);
}
export
default
class
Kernel32
{
private
static
address_GetCurrentThreadId
:
NativePointerValue
|
null
;
static
GetCurrentThreadId
():
number
{
if
(
this
.
address_GetCurrentThreadId
==
null
)
{
this
.
address_GetCurrentThreadId
=
Module
.
findExportByName
(
"
Kernel32.dll
"
,
"
GetCurrentThreadId
"
);
}
return
new
NativeFunction
(
this
.
address_GetCurrentThreadId
!
,
"
int
"
,
[])();
}
private
static
func_Sleep
:
AnyFunction
;
static
Sleep
(
dwMilliseconds
:
number
):
void
{
// void Sleep(
// [in] DWORD dwMilliseconds
// );
if
(
this
.
func_Sleep
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
Kernel32.dll
"
,
"
Sleep
"
);
this
.
func_Sleep
=
new
NativeFunction
(
address
!
,
"
void
"
,
[
"
int
"
]);
}
return
this
.
func_Sleep
(
dwMilliseconds
);
}
}
\ No newline at end of file
course/frida/winapi/user32.ts
浏览文件 @
201149a8
/*
@param moduleName — Module name or path.
@param exportName
@param retType
@param argTypes
@param abiOrOptions
*/
function
EZ生成NativeFunction
(
exportName
:
string
,
retType
:
NativeFunctionReturnType
,
argTypes
:
[]
|
NativeFunctionArgumentType
[],
abiOrOptions
:
NativeABI
|
NativeFunctionOptions
=
"
default
"
,
moduleName
:
string
=
"
User32.dll
"
,
)
{
let
address
=
Module
.
findExportByName
(
moduleName
,
exportName
);
return
new
NativeFunction
(
address
!
,
retType
,
argTypes
,
abiOrOptions
);
}
export
default
class
User32
{
static
Const
=
{
SW_RESTORE
:
9
,
HWND_TOPMOST
:
-
1
,
HWND_NOTOPMOST
:
-
2
,
SWP_NOSIZE
:
0x0001
,
SWP_NOMOVE
:
0x0002
,
MOUSEEVENTF_LEFTDOWN
:
0x0002
,
MOUSEEVENTF_LEFTUP
:
0x0004
,
MOUSEEVENTF_RIGHTDOWN
:
0x0008
,
MOUSEEVENTF_RIGHTUP
:
0x0010
,
}
// BOOL GetClientRect(
// [in] HWND hWnd,
// [out] LPRECT lpRect
...
...
@@ -23,4 +53,183 @@ export default class User32 {
}
return
new
NativeFunction
(
this
.
address_InvalidateRect
!
,
"
bool
"
,
[
"
pointer
"
,
"
pointer
"
,
'
bool
'
])(
hWnd
,
lpRect
,
bErase
);
}
// BOOL SetForegroundWindow(
// [in] HWND hWnd
// );
private
static
func_SetForegroundWindow
:
AnyFunction
;
static
SetForegroundWindow
(
hWnd
:
NativePointerValue
):
number
{
if
(
this
.
func_SetForegroundWindow
==
null
)
{
this
.
func_SetForegroundWindow
=
EZ生成NativeFunction
(
"
SetForegroundWindow
"
,
"
bool
"
,
[
"
pointer
"
]);
}
return
this
.
func_SetForegroundWindow
(
hWnd
);
}
// BOOL ShowWindow(
// [in] HWND hWnd,
// [in] int nCmdShow
// );
private
static
address_ShowWindow
:
NativePointerValue
|
null
;
static
ShowWindow
(
hWnd
:
NativePointerValue
,
nCmdShow
:
number
):
number
{
if
(
this
.
address_ShowWindow
==
null
)
{
this
.
address_ShowWindow
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
ShowWindow
"
);
}
return
new
NativeFunction
(
this
.
address_ShowWindow
!
,
"
bool
"
,
[
"
pointer
"
,
"
int
"
])(
hWnd
,
nCmdShow
);
}
// BOOL SetWindowPos(
// [in] HWND hWnd,
// [in, optional] HWND hWndInsertAfter,
// [in] int X,
// [in] int Y,
// [in] int cx,
// [in] int cy,
// [in] UINT uFlags
// );
private
static
address_SetWindowPos
:
NativePointerValue
|
null
;
static
SetWindowPos
(
hWnd
:
NativePointerValue
,
hWndInsertAfter
:
number
,
X
:
number
,
Y
:
number
,
cx
:
number
,
cy
:
number
,
uFlags
:
number
):
number
{
if
(
this
.
address_SetWindowPos
==
null
)
{
this
.
address_SetWindowPos
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
SetWindowPos
"
);
}
return
new
NativeFunction
(
this
.
address_SetWindowPos
!
,
"
bool
"
,
[
"
pointer
"
,
"
int
"
,
"
int
"
,
"
int
"
,
"
int
"
,
"
int
"
,
"
int
"
])(
hWnd
,
hWndInsertAfter
,
X
,
Y
,
cx
,
cy
,
uFlags
);
}
private
static
address_GetForegroundWindow
:
NativePointerValue
|
null
;
static
GetForegroundWindow
():
NativePointerValue
{
// HWND GetForegroundWindow();
if
(
this
.
address_GetForegroundWindow
==
null
)
{
this
.
address_GetForegroundWindow
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
GetForegroundWindow
"
);
}
return
new
NativeFunction
(
this
.
address_GetForegroundWindow
!
,
"
pointer
"
,
[])();
}
private
static
address_GetCurrentThreadId
:
NativePointerValue
|
null
;
static
GetCurrentThreadId
():
number
{
if
(
this
.
address_GetCurrentThreadId
==
null
)
{
this
.
address_GetCurrentThreadId
=
Module
.
findExportByName
(
"
Kernel32.dll
"
,
"
GetCurrentThreadId
"
);
}
return
new
NativeFunction
(
this
.
address_GetCurrentThreadId
!
,
"
int
"
,
[])();
}
// DWORD GetWindowThreadProcessId(
// [in] HWND hWnd,
// [out, optional] LPDWORD lpdwProcessId
// );
private
static
func_GetWindowThreadProcessId
:
AnyFunction
;
static
GetWindowThreadProcessId
(
hWnd
:
NativePointerValue
,
lpdwProcessId
:
NativePointerValue
):
number
{
if
(
this
.
func_GetWindowThreadProcessId
==
undefined
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
GetWindowThreadProcessId
"
);
this
.
func_GetWindowThreadProcessId
=
new
NativeFunction
(
address
!
,
"
int
"
,
[
"
pointer
"
,
"
pointer
"
]);
}
return
this
.
func_GetWindowThreadProcessId
(
hWnd
,
lpdwProcessId
);
}
// BOOL AttachThreadInput(
// [in] DWORD idAttach,
// [in] DWORD idAttachTo,
// [in] BOOL fAttach
// );
private
static
func_AttachThreadInput
:
AnyFunction
;
static
AttachThreadInput
(
idAttach
:
number
,
idAttachTo
:
number
,
fAttach
:
number
):
number
{
if
(
this
.
func_AttachThreadInput
==
null
)
{
let
address_AttachThreadInput
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
AttachThreadInput
"
);
this
.
func_AttachThreadInput
=
new
NativeFunction
(
address_AttachThreadInput
!
,
"
int
"
,
[
"
int
"
,
"
int
"
,
"
int
"
]);
}
return
this
.
func_AttachThreadInput
(
idAttach
,
idAttachTo
,
fAttach
);
}
// 获取软件窗口位置_设置鼠标指针位置()
private
static
func_GetWindowRect
:
AnyFunction
;
static
GetWindowRect
(
hWnd
:
NativePointerValue
,
lpRect
:
NativePointerValue
):
number
{
// BOOL GetWindowRect(
// [in] HWND hWnd,
// [out] LPRECT lpRect
// );
if
(
this
.
func_GetWindowRect
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
GetWindowRect
"
);
this
.
func_GetWindowRect
=
new
NativeFunction
(
address
!
,
"
bool
"
,
[
"
pointer
"
,
"
pointer
"
]);
}
return
this
.
func_GetWindowRect
(
hWnd
,
lpRect
);
}
private
static
func_SetCursorPos
:
AnyFunction
;
static
SetCursorPos
(
X
:
number
,
Y
:
number
):
number
{
// BOOL SetCursorPos(
// [in] int X,
// [in] int Y
// );
if
(
this
.
func_SetCursorPos
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
SetCursorPos
"
);
this
.
func_SetCursorPos
=
new
NativeFunction
(
address
!
,
"
bool
"
,
[
"
int
"
,
"
int
"
]);
}
return
this
.
func_SetCursorPos
(
X
,
Y
);
}
private
static
func_GetCursorPos
:
AnyFunction
;
static
GetCursorPos
(
lpPoint
:
NativePointerValue
):
number
{
// BOOL GetCursorPos(
// [out] LPPOINT lpPoint
// );
if
(
this
.
func_GetCursorPos
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
GetCursorPos
"
);
this
.
func_GetCursorPos
=
new
NativeFunction
(
address
!
,
"
bool
"
,
[
"
pointer
"
]);
}
return
this
.
func_GetCursorPos
(
lpPoint
);
}
private
static
func_Sleep
:
AnyFunction
;
static
Sleep
(
dwMilliseconds
:
number
):
void
{
// void Sleep(
// [in] DWORD dwMilliseconds
// );
if
(
this
.
func_Sleep
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
Kernel32.dll
"
,
"
Sleep
"
);
this
.
func_Sleep
=
new
NativeFunction
(
address
!
,
"
void
"
,
[
"
int
"
]);
}
return
this
.
func_Sleep
(
dwMilliseconds
);
}
//mouse_event
private
static
func_MouseEvent
:
AnyFunction
;
static
MouseEvent
(
dwFlags
:
number
,
dx
:
number
,
dy
:
number
,
dwData
:
number
,
dwExtraInfo
:
NativePointerValue
):
void
{
// void mouse_event(
// [in] DWORD dwFlags,
// [in] DWORD dx,
// [in] DWORD dy,
// [in] DWORD dwData,
// [in] ULONG_PTR dwExtraInfo
// );
if
(
this
.
func_MouseEvent
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
mouse_event
"
);
this
.
func_MouseEvent
=
new
NativeFunction
(
address
!
,
"
void
"
,
[
"
int
"
,
"
int
"
,
"
int
"
,
"
int
"
,
"
pointer
"
]);
}
return
this
.
func_MouseEvent
(
dwFlags
,
dx
,
dy
,
dwData
,
dwExtraInfo
);
}
//GetMessageExtraInfo
private
static
func_GetMessageExtraInfo
:
AnyFunction
;
static
GetMessageExtraInfo
():
NativePointerValue
{
// LPARAM GetMessageExtraInfo();
if
(
this
.
func_GetMessageExtraInfo
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
GetMessageExtraInfo
"
);
this
.
func_GetMessageExtraInfo
=
new
NativeFunction
(
address
!
,
"
pointer
"
,
[]);
}
return
this
.
func_GetMessageExtraInfo
();
}
private
static
func_MessageBox
:
AnyFunction
;
static
MessageBox
(
hWnd
:
NativePointerValue
,
lpText
:
NativePointerValue
,
lpCaption
:
NativePointerValue
,
uType
:
number
):
number
{
// int MessageBox(
// [in, optional] HWND hWnd,
// [in, optional] LPCTSTR lpText,
// [in, optional] LPCTSTR lpCaption,
// [in] UINT uType
// );
if
(
this
.
func_MessageBox
==
null
)
{
let
address
=
Module
.
findExportByName
(
"
User32.dll
"
,
"
MessageBoxW
"
);
this
.
func_MessageBox
=
new
NativeFunction
(
address
!
,
"
int
"
,
[
"
pointer
"
,
"
pointer
"
,
"
pointer
"
,
'
int
'
]);
}
return
this
.
func_MessageBox
(
hWnd
,
lpText
,
lpCaption
,
uType
);
}
}
\ No newline at end of file
编辑
预览
Markdown
is supported
0%
请重试
或
添加新附件
.
添加附件
取消
You are about to add
0
people
to the discussion. Proceed with caution.
先完成此消息的编辑!
取消
想要评论请
注册
或
登录