WNDPROC g_oldProc = NULL;
DWORD   dwArrOffset = 0xAAA38;   //这是重定向之前全局变量相对于模块基地址的位置
DWORD64 dwMineAddress = 0;       //雷区列数组位置
BYTE    *pMineMap;               //自定义一个数组存储雷的布局，便于访问
DWORD   rows = 0;                //行
DWORD   cols = 0;                //列

LRESULT CALLBACK WindowProc(_In_  HWND hwnd,_In_  UINT uMsg,_In_  WPARAM wParam,_In_  LPARAM lParam
)
{if (uMsg == WM_MOUSEMOVE){int xPos = GET_X_LPARAM(lParam);int yPos = GET_Y_LPARAM(lParam);int x = (xPos - 30) / 18;          //列int y = (yPos - 30) / 18;          //行int nWidth = 30 + 18 * cols;int nHight = 30 + 18 * rows;if (x>=0&&y>=0&&x<nWidth&&y<nHight){if (pMineMap[x*rows + y] == (BYTE)0x01){SetWindowText(hwnd, L"!!!有雷!!!");}else{SetWindowText(hwnd, L"扫雷");}}else{SetWindowText(hwnd, L"扫雷");}}//F12键一键扫雷if (wParam == VK_F12){int i = 0;do{for (int j = 0; j < rows; j++){if (pMineMap[i*rows + j] != (BYTE)0x01){int x = (i * 18) + 30 + 9;//定位到格子中心int y = (j * 18) + 30 + 9;LPARAM point = MAKELPARAM(x, y);//发送鼠标点击消息
                    PostMessage(hwnd, WM_LBUTTONDOWN, NULL, point);PostMessage(hwnd, WM_LBUTTONUP, NULL, point);}}i++;} while (i!=cols);}return CallWindowProc(g_oldProc, hwnd, uMsg, wParam, lParam);
}
// CMineSweeperWaiguaApp 初始化
BOOL CMineSweeperWaiguaApp::InitInstance()
{CWinApp::InitInstance();OutputDebugString(L"已加载!\n");//获得雷区数组地址HMODULE hModule = GetModuleHandle(NULL);// 雷区列数组获得公式 [[[[hModule+0xAAA38]+0x18]+0x58]+0x10]DWORD64 v1 = *(DWORD64*)((DWORD64)hModule + dwArrOffset);//v2+0x8处存储了雷总数（DWORD），v2+0x0C处存储了行总数（DWORD），v2+0x10处存储了列总数（DWORD）DWORD64 v2 = *(DWORD64*)(v1 + 0x18);//申请一个存储雷区的数组空间rows = *(DWORD*)(v2+0x0C);     //行cols = *(DWORD*)(v2+0x10);     //列pMineMap = (BYTE*)VirtualAlloc(NULL,rows*cols, MEM_COMMIT, PAGE_READWRITE);if (pMineMap ==NULL){OutputDebugString(L"申请内存失败!\n");}OutputDebugString(L"申请内存成功!\n");//v1处存储了列总数（DWORD）v1 = *(DWORD64*)(v2 + 0x58);dwMineAddress = *(DWORD64*)(v1 + 0x10);//存储雷区列数组地址，有多少列就有多少数组//数组地址首位显示的是行数for (int i=0;i<*((DWORD*)(v2+0x10));i++){//v1处前4字节（DWORD）储了行总数  ,后边两个内容没搞懂（10 10）v1 = *(DWORD64*)(dwMineAddress + i * 8);BYTE *v5 = (BYTE*)(*(DWORD64*)(v1 + 0x10));for (int j = 0; j < *((DWORD*)(v2 + 0x0C)); j++){//将雷区状态赋值到数组中去 pMineMap[i*rows +j] = *v5;  //第i列第j行       v5++;}}OutputDebugString(L"雷区赋值成功!\n");HWND hWnd = FindWindow(NULL, L"扫雷");if (hWnd == NULL){OutputDebugString(L"未找到目标窗口!\n");return FALSE;}//更改指定窗口的属性//返回值是之前的窗口函数g_oldProc = (WNDPROC)SetWindowLongPtr(hWnd, GWLP_WNDPROC, (LONG_PTR)WindowProc);return TRUE;
}