//打开进程获取句柄[DllImport("kernel32.dll", EntryPoint = "OpenProcess")]public static extern IntPtr OpenProcess(int desiredAccess, bool heritHandle, int pocessID);//访问权限（16进制），是否继承句柄，进程ID//关闭句柄[DllImport("kernel32.dll", EntryPoint = "CloseHandle")]public static extern void CloseHandle(IntPtr hObject);//读取内存[DllImport("kernel32.dll", EntryPoint = "ReadProcessMemory")]public static extern bool ReadProcessMemory(IntPtr hProcess, IntPtr baseadress, IntPtr buffer, int nsize, IntPtr bytesread);//写入内存[DllImport("kernel32.dll", EntryPoint = "WriteProcessMemory")]public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr baseadress, long[] buffer, int nSize, IntPtr byteswrite);//根据进程名获得PIDpublic static int GetPIDByProcessName(string name){Process[] pros = Process.GetProcessesByName(name);if (pros.Count() > 0){return pros[0].Id;}else{return 0;}}public static int ReadMemoryValue(string name, IntPtr baseadress){try{byte[] buffer = new byte[4];IntPtr bufferadress = Marshal.UnsafeAddrOfPinnedArrayElement(buffer, 0);IntPtr hprocess = OpenProcess(0x1F0FFF, false, ECHelper.GetPIDByProcessName(name));ReadProcessMemory(hprocess, baseadress, bufferadress, 4, IntPtr.Zero);CloseHandle(hprocess);return Marshal.ReadInt32(bufferadress);}catch{return 0;}}public static void WriteMemoryValue(string name, IntPtr baseadress, long value){IntPtr hprocess = OpenProcess(0x1F0FFF, false, ECHelper.GetPIDByProcessName(name));WriteProcessMemory(hprocess, baseadress, new long [] { value }, 4, IntPtr.Zero);CloseHandle(hprocess);}

string name = "cstrike";
int baseadress = 0x025069BC;
private void btnShoot_Click(object sender, EventArgs e)
{timShoot.Start();
}private void timShoot_Tick(object sender, EventArgs e)
{timShoot.Interval = 300;int adress1 = ECHelper.ReadMemoryValue(name, (IntPtr)baseadress);adress1 = adress1 + 0x7C;int adress2 = ECHelper.ReadMemoryValue(name, (IntPtr)adress1);adress2 = adress2 + 0x5EC;int adress3 = ECHelper.ReadMemoryValue(name, (IntPtr)adress2);adress3 = adress3 + 0xCC;ECHelper.WriteMemoryValue(name, (IntPtr)adress3, 0x64);          //cs子弹无线
}

    DWORD  getLastError;  //1.根据窗口名获取窗口  HWND hWinmine = FindWindow(NULL,"Counter-Strike");DWORD dwPID = 0;  //窗口进程标示//2.根据窗口获取pid GetWindowThreadProcessId(hWinmine, &dwPID);  if (dwPID == 0)  {  printf("获取PID失败\n");  return -1;  }  //3.根据pid获取进程HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, dwPID);  if (hProcess == NULL) {  printf("进程打开失败\n");  getLastError = GetLastError();  return -1;  }  DWORD dwNum = 0, dwSize = 0;  //基址  DWORD CSBaseAddress = 0x025069BC;  //基址值  DWORD CSBaseAddressValue = 0;  if (0 == ReadProcessMemory(hProcess, (LPVOID)CSBaseAddress, &CSBaseAddressValue, sizeof(DWORD), &dwSize))  {  printf("静态址获取失败\n");  getLastError = GetLastError();  return -1;  }  //一级偏移  DWORD CSOffsetFirst = 0x7C;  //一级偏移值  DWORD CSOffsetFirstValue = 0;  if (0 == ReadProcessMemory(hProcess, (LPVOID)(CSBaseAddressValue + CSOffsetFirst), &CSOffsetFirstValue, sizeof(DWORD), &dwSize))  {  printf("一级偏移获取失败\n");  getLastError = GetLastError();  return -1;  }  //二级偏移  DWORD CSOffsetSecond =  0x5EC;  //二级偏移值  DWORD CSOffsetSecondValue = 0;  if (0 == ReadProcessMemory(hProcess, (LPVOID)(CSOffsetFirstValue + CSOffsetSecond), &CSOffsetSecondValue, sizeof(DWORD), &dwSize))  {  printf("二级偏移获取失败\n");  getLastError = GetLastError();  return -1;  }//三级偏移  DWORD CSOffsetThird = 0xCC;  DWORD CSNum=0;  //这里是当前子弹值if (0 == ReadProcessMemory(hProcess, (LPVOID)(CSOffsetSecondValue + CSOffsetThird), &CSNum, sizeof(DWORD), &dwSize))  {  printf("三级偏移获取失败\n");  getLastError = GetLastError();  return -1;  }int modifyCS;  printf("CSNum:%d\n", CSNum);  printf("输入你要修改后的值：");  scanf("%d", &modifyCS);  //更改值WriteProcessMemory(hProcess, (LPVOID)(CSOffsetSecondValue + CSOffsetThird), &modifyCS, sizeof(DWORD), &dwSize);  CloseHandle(hProcess);  //关闭进程system("pause");  //窗口停留