using namespace std;// 内存区域结构体（64位）struct MemoryRegion { uintptr_t start; // 内存段起始地址（64位） uintptr_t end; // 内存段结束地址（64位）};// 获取进程内存段（仅可读区域）vector get_memory_regions(pid_t pid) { vector regions; char path[256]; sprintf(path, "/proc/%d/maps", pid); FILE* fp = fopen(path, "r"); if (!fp) return regions; char line[1024]; while (fgets(line, sizeof(line), fp)) { uintptr_t start, end; char perm[5]; // 解析格式如 "55b8d2c00000-55b8d2c01000 r-xp ..." if (sscanf(line, "%lx-%lx %4s", &start, &end, perm) == 3 && strchr(perm, 'r')) { regions.push_back({start, end}); } } fclose(fp); return regions;}size_t preadv(long address, void *buffer, size_t size){ struct iovec iov_ReadBuffer, iov_ReadOffset; iov_ReadBuffer.iov_base = buffer; iov_ReadBuffer.iov_len = size; iov_ReadOffset.iov_base = (void *)address; iov_ReadOffset.iov_len = size; return syscall(SYS_process_vm_readv, pid, &iov_ReadBuffer, 1, &iov_ReadOffset, 1, 0);}// 扫描指向目标地址的64位指针std::vector search_pointers_to_address(uintptr_t target_addr, pid_t pid) { std::vector pointers; driver->initialize(pid); // 初始化驱动关联PID auto regions = get_memory_regions(pid); const size_t chunk_size = 0x10000; // 一次读取64KB std::vector buffer(chunk_size); // 缓冲区 for (const auto& region : regions) { uintptr_t current_addr = region.start; while (current_addr < region.end) { size_t to_read = std::min(chunk_size, region.end - current_addr); if (!preadv(current_addr, http://buffer.data/(), to_read)) { current_addr += chunk_size; continue; } // 遍历缓冲区中的每个8字节指针 for (size_t offset = 0; offset + sizeof(uintptr_t) <= to_read; offset += sizeof(uintptr_t)) { uintptr_t value = *reinterpret_cast( http://buffer.data/() + offset); if (value == target_addr) { pointers.push_back(current_addr + offset); } } current_addr += to_read; } } return pointers;}auto pointers = search_pointers_to_address(libGame_base-0x4278000, pid); if (!pointers.empty()) { for (auto ptr_addr : pointers) { if(Driver->读取整数(ptr_addr+0x8)==2000){ for (int j = 0; j <5; j++) { long 算法数组=Driver->读取指针(Driver->读取指针(ptr_addr+0x10)+0x18+0xA8*j); long 坐标x=Driver->读取整数(Driver->读取指针(算法数组+0x90)0x0); long 坐标y=Driver->读取整数(Driver->读取指针(算法数组+0x90)0x8); } } } }
