给破解后的S-Demo做补丁[Delphi]

首先使用spy++获取需要打补丁程序的句柄。

program s_Demo;

uses
  Windows,TlHelp32;

const
  OldData : array[0..1] of byte = ($74,$5B);  //Je判断为真跳转
  NewData : array[0..1] of byte = ($EB,$5B);  //JMP强行跳转

var
  StartInfo: TStartupInfo;
  ProcInfo: TProcessInformation;
  ProcessHndle,PID: HWND;
  BytesRead : DWORD;
  TmpData : array[0..1] of Byte;
  FilePath:String;

function FindPath(PID:longword):String;
var
  ModuleSnapshot: THandle;
  Module32: TModuleEntry32;
begin
  Result:='';
  ModuleSnapshot := CreateToolHelp32SnapShot(TH32CS_SNAPMODULE,PID);
  if ModuleSnapshot>0 then
  begin
    Module32.dwSize := sizeof(Module32);
    Module32First(ModuleSnapshot, Module32);
    Result:=Module32.szExePath;
  end;
end;

begin
  GetWindowThreadProcessId(FindWindow('#32770','信息'), @PID);  //通过句柄获取PID
  if PID<=0 then Exit;  //如果为空，即程序没有运行则不再执行
  FilePath:=FindPath(PID); //获取程序路径
  if FilePath='' then Exit;  //为空则退出
  ProcessHndle:=OpenProcess(PROCESS_TERMINATE,FALSE,PID);
  if ProcessHndle<= 0 then Exit;
  TerminateProcess(ProcessHndle, 0);
  CloseHandle(ProcessHndle);

  ZeroMemory(@StartInfo, SizeOf(TStartupInfo));
  StartInfo.cb := SizeOf(TStartupInfo);
  if not CreateProcess(nil,Pchar(FilePath), nil, nil, False, Create_Suspended, nil, nil, StartInfo, ProcInfo) then Exit;
  ReadProcessMemory(ProcInfo.hProcess,Pointer($401FF9),@TmpData,2,BytesRead);  //内存当中的地址
  if (TmpData[0] = OldData[0]) and (TmpData[1] = OldData[1]) then
  begin
    if WriteProcessMemory(ProcInfo.hProcess, Pointer($401FF9), @NewData, 2, BytesRead) then  //进行打补丁
      MessageBox(0,'恭喜补丁成功',nil,0) else MessageBox(0,'不好意思补丁失败',nil,0);
  end else
  begin
    MessageBox(0,'不好意思补丁失败',nil,0)
  end;
  ResumeThread(ProcInfo.hThread);
  CloseHandle(ProcInfo.hProcess);
  CloseHandle(ProcInfo.hThread);
end.