进销存软件版1楼: //说明:以下代码是写在DLL里面的C++代码，那位熟悉C和Delphi的朋友帮忙翻译一下！
//======================================================
DWORD ob=*(DWORD*)0x01232d5c;
DWORD bod=*(DWORD*)0x01232d48;

void _DispFunc();
BOOL setob();
void oo();

DWORD WINAPI testfunction(LPVOID lpParam)
{
DWORD dwOldFlag;
VirtualProtect((void*)0x0043D3C2,5,PAGE_READWRITE,&dwOldFlag);
*((DWORD*)0x0043D3C2)=(DWORD)0x59585a59;
*((BYTE *)0x0043D3C6)=(BYTE )0x5f;
VirtualProtect((void*)0x0043D3C2,5,dwOldFlag,&dwOldFlag);



FARPROC p=(FARPROC)_DispFunc;
DWORD dwP=(DWORD)p-0x0043D3CE-0x5;
VirtualProtect((void*)0x0043D3Cf,4,PAGE_READWRITE,&dwOldFlag);
*((DWORD*)0x0043D3Cf)=(DWORD)dwP;
VirtualProtect((void*)0x0043D3Cf,4,dwOldFlag,&dwOldFlag);
setob();
return 1;
}

BOOL APIENTRY DllMain( HANDLE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch(ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
CloseHandle(CreateThread(NULL,NULL,testfunction,NULL,NULL,NULL));
default:
return TRUE;
}
return TRUE;
}

float x=-330.0,y=1500.0;
float * lx=&x,*ly=&y;

void __declspec(naked) _DispFunc()
{

_asm
{
//mov ob,[01232d5ch];
/*call setob
test al,al
jnz ok
mov eax,[lx]
mov [ebp-2ch],eax
mov eax,[ly]
mov [ebp-24h],eax
jmp back
ok:*/
call oo
//mov eax,ob
//mov edx,[eax+4bch]
//mov [ebp-2ch],edx
//mov eax,[eax+4c4h]
//mov [ebp-24h],eax

mov eax,ob
mov eax,[eax+8]
mov edx,bod
mov [edx+3840],eax
//back:
mov al,01h
ret
}
}

void getob()
{
DWORD tob,temp=0x01232d4c,tmy=*(DWORD *)0x1232d48;
float mx=*(float*)(tmy+0x1010)
,my=*(float*)(tmy+0x1018)
,gx=*(float*)((*(DWORD*)temp)+0x4c8)
,gy=*(float*)((*(DWORD*)temp)+0x4d0)
,ox=*(float*)(ob+0x4c8)
,oy=*(float*)(ob+0x4d0)
;

tob=*((DWORD *)temp);
for(int i=0;i<34;i+=4)
{
temp=temp+i;
if
(
sqrt((mx-ox)*(mx*ox)+(my-oy)*(my-oy))>
sqrt((mx-gx)*(mx-gx)+(my-gy)*(my-gy))

//(*((DWORD *)temp))
)
tob=*((DWORD *)temp);
}
ob=tob ;
}

void oo()
{
if(*(DWORD*)(ob+0x270)==0x00000000)
setob();
}

BOOL setob()
{
DWORD temp=0x01232d4c;
while(*(DWORD*)temp!=0x000000)
{
if(*(DWORD*)(*(DWORD *)temp+0x260)==0x00002712)
{
ob=*(DWORD*)temp;
return 1;
}
temp=temp+4;
}
return 0;
//ob=*(DWORD*)0x01232d4c;
//getob();
}

2楼: 很深奥,又是C,又是汇编,不懂 如记账本软件免费版

3楼: 帮顶。。
我刚学C++，不会C

4楼: 用这个东东试试：
http://www.astonshell.com/freeware/c2pas32/

5楼: library Project1;

{ Important note about DLL memory management: ShareMem must be the
first unit in your library＇＇s USES clause AND your project＇＇s (select

Project-View Source) USES clause if your DLL exports any procedures or
functions that pass strings as parameters or function results. This
applies to all strings passed to and from your DLL--even those that
are nested in records and classes. ShareMem is the interface unit to
the BORLNDMM.DLL shared memory manager, which must be deployed along
with your DLL. To avoid using BORLNDMM.DLL, pass string information
using PChar or ShortString parameters. }

uses
SysUtils,
Types,
Classes;

{$R *.res}
type
PDWORD = ^DWORD;
PFloat = ^Single;
PByte = ^Byte;
FARPROC = procedure ;

var
ob, bod : DWORD;
x, y : Single ; //float;
lx, ly : ^Single ;//^float;

function setob : boolean;
var
temp : DWORD;
begin
temp := $01232d4c;
while PDWORD(temp)^ <>0 do
begin
if PDWORD((PDWORD(temp)^+$260))^ = $00002712 then
begin
ob := PDWORD(temp)^;
Result := true ;
Exit;
end;
temp := temp+4;
end;
result := false;
end;

procedure oo;
var
p : PDWORD; //cardinal;
begin
p := PDWORD(ob + $270);
if p^=00000000 then setob;
end;

procedure _DispFunc;
asm
call oo
mov eax,ob
mov eax,[eax+8]
mov edx,bod
mov [edx+3840],eax
mov al,01h
ret
end;

procedure getob;
var
i,tob,temp, tmy : DWORD;
mx, my, gx, gy, ox, oy : single;
begin
temp := $01232d4c;
tmy := PDWORD($1232d48)^;
mx := PFloat(tmy+$1010)^;
my := PFloat(tmy+$1018)^;
gx := PFloat(PDWORD(temp)^+$4c8)^;
gy := PFloat(PDWORD(temp)^+$4d0)^;
ox := PFloat(ob+$4c8)^;
oy := PFloat(ob+$4d0)^;

tob := PDWORD(temp)^ ;

i := 0;
while i<=34 do
begin
temp := temp+i;
if sqrt((mx-ox)*(mx*ox)+(my-oy)*(my-oy))>sqrt((mx-gx)*(mx-gx)+(my-gy)*(my-gy)) then tob := tob*PDWORD(temp)^;
Inc(i,4);
end ;
ob := tob ;
end;

function testfunction(lpParam:Pointer) : DWORD ; stdcall ;
var dwOldFlag : DWORD;
p : FARPROC ;
dwp : DWORD;
begin
VirtualProtect(Pointer($0043D3C2),5,PAGE_READWRITE,@dwOldFlag); //这个过程没找到
PDWORD($0043D3C2)^ := $59585a59;
PByte($0043D3C6)^ := $5f;
VirtualProtect(Pointer($0043D3C2),5,dwOldFlag,@dwOldFlag);

p := @_DispFunc;
dwP := DWORD(@_DispFunc) - $0043D3CE - $5;
VirtualProtect(Pointer($0043D3Cf),4,PAGE_READWRITE,@dwOldFlag);
PDWORD($0043D3Cf)^ := dwP;
VirtualProtect(Pointer($0043D3Cf,4,dwOldFlag,@dwOldFlag);
setob;
result := 1;
end ;

var
pInt : PDWORD;
begin
pInt := PDWORD($01232d5c) ;
ob := pInt^ ;
pInt := PDWORD($01232d48) ;
bod := pInt^ ;
x := -330.0 ;
y := 1500.0 ;
lx := @x ;
ly := @y ;
end.

6楼: TO pascal! 佩服！

进销存软件版7楼: hook api的？没必要这么复杂吧。

8楼: 接受答案了.