Option Explicit
'Dim T As New 游戏外挂类
'Private Sub Command1_Click()
' T.加载窗口 "植物大战僵尸中文版"
'End Sub
'Private Sub Form_Unload(Cancel As Integer)
' T.卸载进程
'End Sub
'Private Sub Timer1_Timer()
' Text3 = T.读取字符(ByVal &HF9715C, 8) '显示帐号
' Base = T.读取内存(ByVal &HDA81F8) '显示阳光值
' Base = T.读取内存(ByVal Base + &H5560) '显示阳光值
' Form1.Caption = Base
'End Sub
'---------------声明函数-----------------------'
Private Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal lpClassName As String, ByVal lpWindowName As String) As Long '得到窗体控件句柄的函数
'得到进程标识符的函数
Private Declare Function FindWindowEx Lib "user32" Alias "FindWindowExA" (ByVal hWnd1 As Long, ByVal hWnd2 As Long, ByVal lpsz1 As String, ByVal lpsz2 As String) As Long
'得到目标进程句柄的函数
Private Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
'关闭句柄的函数
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
'读取进程内存的函数
Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
'读取内存数据的函数
Private Declare Function ReadProcessMemory Lib "Kernel32.dll" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
'写入内存数据的函数
Private Declare Function WriteProcessMemory Lib "Kernel32.dll" (ByVal hProcess As Long, ByRef lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, ByRef lpNumberOfBytesWritten As Long) As Long
Private Declare Function SendMessage Lib "user32" Alias "SendMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, lParam As Any) As Long
Private Declare Function PostMessage Lib "user32" Alias "PostMessageA" (ByVal hwnd As Long, ByVal wMsg As Long, ByVal wParam As Long, ByVal lParam As Long) As Long '延迟函数Public Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Private Declare Sub Sleep Lib "kernel32" (ByVal dwMilliseconds As Long)
Private Const PROCESS_ALL_ACCESS = &H1F0FFF
Private 进程句柄 As Long, PID As Long, 窗口句柄 As Long, 字符串() As Byte, 状态 As Boolean

Public Function 写入内存(ByVal 基址 As Long, ByVal 写入值 As Long) As Long '写入内存的过程
If 状态 = False Then Exit Function
WriteProcessMemory 进程句柄, ByVal 基址, 写入值, 4, 0&
End Function

Public Function 读取内存(ByVal 基址 As Long) As Long '读取内存的过程
If 状态 = False Then Exit Function
ReadProcessMemory 进程句柄, ByVal 基址, 读取内存, 4, 0&
End Function

Public Function 读取字符(ByVal 基址 As Long, 字符长度 As Long) As String '读取内存的过程
If 状态 = False Then Exit Function
ReDim 字符串(字符长度) As Byte
ReadProcessMemory 进程句柄, ByVal 基址, 字符串(0), 字符长度 + 1, 0&
读取字符 = StrConv(字符串(), vbUnicode)
End Function

Public Function 加载窗口(窗口标题 As String) As Boolean
窗口句柄 = FindWindow(vbNullString, 窗口标题)
If 窗口句柄 = 0 Then GoTo 错误2
加载窗口 = True
GetWindowThreadProcessId 窗口句柄, PID '获取进程标识符'将进程标识符做为参数，返回目标进程PID的句柄，得到此句柄后'即可对目标进行读写操,PROCESS_ALL_ACCESS表示完全控制,权限最大
进程句柄 = OpenProcess(&H1F0FFF, False, PID)
If 进程句柄 = 0 Then GoTo 错误
状态 = True
加载窗口 = True
Exit Function
错误:
状态 = False
加载窗口 = False
Debug.Print "不能打开进程！"
Exit Function
错误2:
状态 = False
加载窗口 = False
Debug.Print "未启动游戏！！"
End Function

Public Function 卸载进程() As Boolean
If 状态 = False Then Exit Function
CloseHandle 进程句柄
卸载进程 = True
End Function

Public Function 模拟按键(键 As String) As Long
Dim KEY As String
Select Case UCase(键)
Case "F1"
KEY = &H70
Case "F2"
KEY = &H71
Case "F3"
KEY = &H72
Case "F4"
KEY = &H73
Case "F5"
KEY = &H74
Case "F6"
KEY = &H75
Case "F7"
KEY = &H76
Case "F8"
KEY = &H77
Case "F9"
KEY = &H78
Case "F10"
KEY = &H79
Case "F11"
KEY = &H7A
Case "F12"
KEY = &H7B
Case "0"
KEY = &H30
Case "1"
KEY = &H31
Case "2"
KEY = &H32
Case "3"
KEY = &H33
Case "4"
KEY = &H34
Case "5"
KEY = &H35
Case "6"
KEY = &H36
Case "7"
KEY = &H37
Case "8"
KEY = &H38
Case "9"
KEY = &H39
Case "TAB"
KEY = &H9
Case "~"
KEY = &H96
End Select
If KEY = "" Then Exit Function
SendMessage HWD, &H100, KEY, 0&
SendMessage HWD, &H101, KEY, 0&
End Function