Question

我有它可以防止鼠标控制的机器人。（如果点击是由人或非人）。

有人有想法吗？

代码：

HHOOK MouseHook;

LRESULT CALLBACK MouseHookProc(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode == HC_ACTION)
    {
        if(wParam == WM_RBUTTONDOWN || wParam == WM_LBUTTONDOWN)
        {
            MSLLHOOKSTRUCT *info=(MSLLHOOKSTRUCT*)lParam;     
            if((info->flags & LLMHF_INJECTED) == LLMHF_INJECTED)
            {
                ExitProcess(-1);
            }
        }
    }
    return CallNextHookEx(MouseHook,nCode,wParam,lParam);
}


void AntiShotbotLogger()
{
    HINSTANCE hInstance = GetModuleHandle(NULL);

    MouseHook = SetWindowsHookEx( WH_MOUSE_LL, MouseHookProc, hInstance, NULL );
    MSG message;
    while (GetMessage(&message,NULL,0,0)) {
        TranslateMessage( &message );
        DispatchMessage( &message );
    }

    UnhookWindowsHookEx(MouseHook);

旁路：

HHOOK MouseHook;


LRESULT CALLBACK ReplaceMousehook(int nCode, WPARAM wParam, LPARAM lParam)
{
    if (nCode == HC_ACTION && (wParam  == WM_RBUTTONDOWN || wParam == WM_LBUTTONDOWN))
    {
        reinterpret_cast<MSLLHOOKSTRUCT*>(lParam)->flags = 0;
        std::cout << "Injection bypassed!" << std::endl;
    }
    return CallNextHookEx(MouseHook,nCode,wParam,lParam);
}


void ShotbotBypassExample()
{
    while(true)
    {
        if (GetAsyncKeyState(VK_NUMPAD0)&1)
        {
            std::cout << "Sending input now." << std::endl;
            INPUT input[2];
            input[0].type = INPUT_MOUSE;
            input[0].mi.dwFlags = MOUSEEVENTF_LEFTDOWN;    
            input[1].type = INPUT_MOUSE;
            input[1].mi.dwFlags = MOUSEEVENTF_LEFTUP;
            SendInput(2, input, sizeof(INPUT));
        }


        Sleep(1);
    }
}


int main(int argc, char** argv)
{
    std::thread keybind(ShotbotBypassExample);
    keybind.joinable();


    HHOOK hook = SetWindowsHookEx( WH_MOUSE_LL, ReplaceMousehook, GetModuleHandle(0), NULL );
    MSG message;
    while (GetMessage(&message,NULL,0,0)) {
        TranslateMessage( &message );
        DispatchMessage( &message );
    }
    return 0;
}

Answer 1

安装自己的挂钩，不要致电CallNextHookEx。那时他们的钩子不会被调用（如果它更旧）。

此外，当您安装挂钩时，请检查您的进程是否已加载DLL。以后加载的任何DLL都可能包含一个覆盖你的钩子的钩子。

我怎样才能防止这种旁路？

1 个答案: