PK #Z} main.cpp#include #include #include "imgui/imgui.h" #include "imgui/imgui_impl_android.h" #include "imgui/imgui_impl_opengl3.h" #include "font.h" #include "Syscall读写.h" #include #include "SDK.hpp" #include using namespace SDK; bool initImGui=false; bool 开关=true; int screenWidth=2400,screenHeight=1080,glWidth,glHeight,gWidth,gHeight; float density=-1; uintptr_t UE4; android_app*g_App=0; TNameEntryArray*GetGNames(){ return(TNameEntryArray*)getPointer(UE4+0x4431ae4); } UWorld*GetWorld(){ return(UWorld*)getPointer(getPointer(getPointer(UE4+0x4634ef0)+0x38)+0x58); } UWorld*GetWorld2(){ return(UWorld*)getPointer(getPointer(getPointer(getPointer(UE4+0x4634ef0)+0x38)+0x58)+0x20); } bool(*ogm)(); bool gm(){ return true; } std::vector getActors() { auto World = GetWorld2(); if (!World) return std::vector(); auto Actors = *(TArray *)((uintptr_t) World + 0x70); std::vector actors; for (int i = 0; i < Actors.Num(); i++) { auto Actor = Actors[i]; if (Actor) { actors.push_back(Actor); } } return actors; } struct sRegion { uintptr_t start, end; }; std::vector trapRegions; bool isObjectInvalid(UObject *obj) { if (!IsPtrValid(obj)) { return true; } if (!IsPtrValid(obj->ClassPrivate)) { return true; } if (obj->InternalIndex <= 0) { return true; } if (obj->NamePrivate.ComparisonIndex <= 0) { return true; } if ((uintptr_t)(obj) % sizeof(uintptr_t) != 0x0 && (uintptr_t)(obj) % sizeof(uintptr_t) != 0x4) { return true; } if (std::any_of(trapRegions.begin(), trapRegions.end(), [obj](sRegion region) { return ((uintptr_t) obj) >= region.start && ((uintptr_t) obj) <= region.end; }) || std::any_of(trapRegions.begin(), trapRegions.end(), [obj](sRegion region) { return ((uintptr_t) obj->ClassPrivate) >= region.start && ((uintptr_t) obj->ClassPrivate) <= region.end; })) { return true; } return false; } ASTExtraPlayerController *STExtraPlayerController = 0; void GetActor(){ auto Actors = getActors(); for (int i = 0; i < Actors.size(); i++) { auto Actor = Actors[i]; if (isObjectInvalid(Actor)) continue; if (Actor->IsA(ASTExtraPlayerController::StaticClass())) { STExtraPlayerController = (ASTExtraPlayerController *) Actor; break; } } } #include "菜单.h" EGLBoolean(*orig_eglSwapBuffers)(EGLDisplay dpy,EGLSurface surface); EGLBoolean _eglSwapBuffers(EGLDisplay dpy,EGLSurface surface){ eglQuerySurface(dpy,surface,EGL_WIDTH,&glWidth); eglQuerySurface(dpy,surface,EGL_HEIGHT,&glHeight); if(glWidth<=0||glHeight<=0){ return orig_eglSwapBuffers(dpy,surface); } if(!g_App){ return orig_eglSwapBuffers(dpy,surface); } screenWidth=ANativeWindow_getWidth(g_App->window); screenHeight=ANativeWindow_getHeight(g_App->window); density=AConfiguration_getDensity(g_App->config); if(!initImGui){ initImGui=true; gWidth=glWidth/2; gHeight=glHeight/2; ImGui::CreateContext(); ImGui::StyleColorsLight(); ImGuiStyle&style=ImGui::GetStyle(); style.WindowRounding=3.3f; style.FrameRounding=3.3f; style.ScrollbarRounding=3; style.ScrollbarSize=25.3f; style.WindowTitleAlign=ImVec2(0.5,0.5); ImGui_ImplAndroid_Init(); ImGui_ImplOpenGL3_Init("#version 300 es"); ImGuiIO&io=ImGui::GetIO(); const ImWchar icons_ranges[]={0xf000,0xf3ff,0}; ImFontConfig icons_config; ImFontConfig CustomFont; CustomFont.FontDataOwnedByAtlas=false; icons_config.MergeMode=true; icons_config.PixelSnapH=true; icons_config.OversampleH=2.5; icons_config.OversampleV=2.5; io.Fonts->AddFontFromMemoryTTF((void*)Custom_data,Custom_size,35.0f,NULL,io.Fonts->GetGlyphRangesChineseFull()); io.ConfigWindowsMoveFromTitleBarOnly=true; } ImGui_ImplOpenGL3_NewFrame(); ImGui_ImplAndroid_NewFrame(glWidth,glHeight); ImGui::NewFrame(); 初始化菜单(); if(开关){ ImGui::GetBackgroundDrawList()->AddText({gWidth+200,650},ImColor(255,0,0),"Telegram:IceTeam_Studio"); } ImGui::Render(); ImGui_ImplOpenGL3_RenderDrawData(ImGui::GetDrawData()); return orig_eglSwapBuffers(dpy,surface); } int32_t(*orig_onInputEvent)(struct android_app*app,AInputEvent*inputEvent); int32_t onInputEvent(struct android_app*app,AInputEvent*inputEvent){ ImGui_ImplAndroid_HandleInputEvent(inputEvent,{(float)screenWidth/(float)glWidth,(float)screenHeight/(float)glHeight}); return orig_onInputEvent(app,inputEvent); } extern "C"{ void android_main(struct android_app*state){ app_dummy(); } } void*main_thread(void*){ UE4=get_Module_Base("libUE4.so"); while(!UE4){ UE4=get_Module_Base("libUE4.so"); sleep(1.5); } while(!g_App){ g_App=*(android_app**)(UE4+0x4249ca4); sleep(1.5); } orig_onInputEvent=decltype(orig_onInputEvent)(g_App->onInputEvent); g_App->onInputEvent=onInputEvent; FName::GNames=GetGNames(); UObject::GUObjectArray=(FUObjectArray*)(UE4+0x454dd28); DobbyHook((void*)DobbySymbolResolver(("/system/lib/libEGL.so"),("eglSwapBuffers")),(void*)_eglSwapBuffers,(void**)&orig_eglSwapBuffers); DobbyHook((void*)(UE4+0xc5ebbc),(void*)gm,(void**)&ogm); return 0; } __attribute__((constructor))void _init(){ pthread_t pid; pthread_create(&pid,0,main_thread,0); } PK ZQeSyscall读写.hup9 [Syscall读写.h#include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include using namespace std; typedef long ADDRESS; typedef char PACKAGENAME; typedef unsigned short UTF16; typedef char UTF8; // syscall内存读写 #if defined(__arm__) int process_vm_readv_syscall = 376; int process_vm_writev_syscall = 377; #elif defined(__aarch64__) int process_vm_readv_syscall = 270; int process_vm_writev_syscall = 271; #elif defined(__i386__) int process_vm_readv_syscall = 347; int process_vm_writev_syscall = 348; #else int process_vm_readv_syscall = 310; int process_vm_writev_syscall = 311; #endif ssize_t process_v1(pid_t __pid, const struct iovec *__local_iov, unsigned long __local_iov_count, const struct iovec *__remote_iov, unsigned long __remote_iov_count, unsigned long __flags, bool iswrite) { return syscall((iswrite ? process_vm_writev_syscall : process_vm_readv_syscall), __pid, __local_iov, __local_iov_count, __remote_iov, __remote_iov_count, __flags); } // 进程读写内存 bool pvm1(void *address, void *buffer, size_t size, bool iswrite) { struct iovec local[1]; struct iovec remote[1]; local[0].iov_base = buffer; local[0].iov_len = size; remote[0].iov_base = address; remote[0].iov_len = size; ssize_t bytes = process_v1(getpid(), local, 1, remote, 1, 0, iswrite); return bytes == size; } // 读取内存 bool vm_readv(long address, void *buffer, size_t size) { return pvm1(reinterpret_cast < void *>(address), buffer, size, false); } // 写入内存 bool vm_writev(long address, void *buffer, size_t size) { return pvm1(reinterpret_cast < void *>(address), buffer, size, true); } // 获取F类内存 float getfloat(long addr) { float var = 0; vm_readv(addr, &var, 4); return (var); } // 获取 int getdword(long addr) { int var = 0; vm_readv(addr, &var, 4); return (var); } // 获取 bool getbool(long addr) { bool var = 0; vm_readv(addr, &var, 4); return (var); } // 获取指针 long getPointer(long addr) { long var = 0; vm_readv(addr, &var, 4); return (var); } // 写入F类内存 void writefloat(long addr, float data) { vm_writev(addr, &data, 4); } // 写入D类内存 void writedword(long addr, int data) { vm_writev(addr, &data, 4); } // 获取进程 int getProcessID(const char *packageName) { int id = -1; DIR *dir; FILE *fp; char filename[64]; char cmdline[64]; struct dirent *entry; dir = opendir("/proc"); while ((entry = readdir(dir)) != NULL) { id = atoi(entry->d_name); if (id != 0) { sprintf(filename, "/proc/%d/cmdline", id); fp = fopen(filename, "r"); if (fp) { fgets(cmdline, sizeof(cmdline), fp); fclose(fp); if (strcmp(packageName, cmdline) == 0) { return id; } } } } closedir(dir); return -1; } // 获取基址 long get_Module_Base(const char *module_name) { FILE *fp; long addr = 0; char *pch; char filename[64]; char line[1024]; snprintf(filename, sizeof(filename), "/proc/%d/maps", getpid()); fp = fopen(filename, "r"); if (fp != NULL) { while (fgets(line, sizeof(line), fp)) { if (strstr(line, module_name)) { pch = strtok(line, "-"); addr = strtoul(pch, NULL, 16); if (addr == 0x8000) addr = 0; break; } } fclose(fp); } return addr; } // 读取字符信息 void getUTF8(char * buf, long namepy) { UTF16 buf16[16] = { 0 }; vm_readv(namepy, buf16, 32); UTF16 *pTempUTF16 = buf16; UTF8 *pTempUTF8 = buf; UTF8 *pUTF8End = pTempUTF8 + 32; while (pTempUTF16 < pTempUTF16 + 28) { if (*pTempUTF16 <= 0x007F && pTempUTF8 + 1 < pUTF8End) { *pTempUTF8++ = (UTF8) * pTempUTF16; } else if (*pTempUTF16 >= 0x0080 && *pTempUTF16 <= 0x07FF && pTempUTF8 + 2 < pUTF8End) { *pTempUTF8++ = (*pTempUTF16 >> 6) | 0xC0; *pTempUTF8++ = (*pTempUTF16 & 0x3F) | 0x80; } else if (*pTempUTF16 >= 0x0800 && *pTempUTF16 <= 0xFFFF && pTempUTF8 + 3 < pUTF8End) { *pTempUTF8++ = (*pTempUTF16 >> 12) | 0xE0; *pTempUTF8++ = ((*pTempUTF16 >> 6) & 0x3F) | 0x80; *pTempUTF8++ = (*pTempUTF16 & 0x3F) | 0x80; } else { break; } pTempUTF16++; } } bool IsPtrValid(void *addr) { if (!addr) { return false; } static int fd = -1; if (fd == -1) { fd = open("/dev/random", O_WRONLY); } return write(fd, addr, 4) >= 0; }PK 5)ZiٲTT菜单.hup \m菜单.hint show_ChildMenu; void 初始化菜单(){ // 标题更改 static int num=0; ImGui::Begin("PUBGM（Server Dev）-by IceTeam Studio"); //定位 ImGui 位置 if(num==0){ num=1; ImGui::SetWindowSize({800,500}); ImGui::SetWindowPos(ImVec2(150,40),ImGuiCond_Always); } // Debug 按钮 if(ImGui::BeginChild("左侧主菜单",ImVec2(150,0),false,ImGuiWindowFlags_NoScrollbar|ImGuiWindowFlags_NoScrollbar|ImGuiWindowFlags_NavFlattened)){ if(ImGui::Button("Debug",ImVec2(150,70))){ show_ChildMenu=0; } ImGui::Text("%.1fFPS",ImGui::GetIO().Framerate); ImGui::EndChild(); } // 地图功能 if (ImGui::CollapsingHeader("地图")){ if(ImGui::Button("艾伦格",ImVec2(-1,80))){ UKismetSystemLibrary::ExecuteConsoleCommand(GetWorld(),"open /Game/Maps/PUBG_Forest/PUBG_Forest?listen?Game=/Game/BluePrints/Core/BP_BattleRoyalTrainingGameMode.BP_BattleRoyalTrainingGameMode_C",UGameplayStatics::GetPlayerController(GetWorld(),0)); SDK::UGameBackendHUD*hud=UGameBackendHUD::GetInstance(); SDK::UGameFrontendHUD*hd=hud->GetFirstGameFrontendHUD(); hd->PendingGameStatus="Fighting"; } if(ImGui::Button("米拉玛",ImVec2(-1,80))){ UKismetSystemLibrary::ExecuteConsoleCommand(GetWorld(),"open /Game/Maps/PUBG_Desert/PUBG_Desert?listen?Game=/Game/BluePrints/Core/BP_BattleRoyalTrainingGameMode.BP_BattleRoyalTrainingGameMode_C",UGameplayStatics::GetPlayerController(GetWorld(),0)); SDK::UGameBackendHUD*hud=UGameBackendHUD::GetInstance(); SDK::UGameFrontendHUD*hd=hud->GetFirstGameFrontendHUD(); hd->PendingGameStatus="Fighting"; } if(ImGui::Button("维寒迪",ImVec2(-1,80))){ UKismetSystemLibrary::ExecuteConsoleCommand(GetWorld(),"open /Game/Maps/PUBG_DihorOtok/DihorOtok_Main?listen?Game=/Game/BluePrints/Core/BP_BattleRoyalTrainingGameMode.BP_BattleRoyalTrainingGameMode_C",UGameplayStatics::GetPlayerController(GetWorld(),0)); SDK::UGameBackendHUD*hud=UGameBackendHUD::GetInstance(); SDK::UGameFrontendHUD*hd=hud->GetFirstGameFrontendHUD(); hd->PendingGameStatus="Fighting"; } if(ImGui::Button("萨诺",ImVec2(-1,80))){ UKismetSystemLibrary::ExecuteConsoleCommand(GetWorld(),"open /Game/Maps/PUBG_Savage/PUBG_Savage_Main?listen?Game=/Game/BluePrints/Core/BP_BattleRoyalTrainingGameMode.BP_BattleRoyalTrainingGameMode_C",UGameplayStatics::GetPlayerController(GetWorld(),0)); SDK::UGameBackendHUD*hud=UGameBackendHUD::GetInstance(); SDK::UGameFrontendHUD*hd=hud->GetFirstGameFrontendHUD(); hd->PendingGameStatus="Fighting"; } if(ImGui::Button("训练场",ImVec2(-1,80))){ UKismetSystemLibrary::ExecuteConsoleCommand(GetWorld(),"open /Game/Maps/Shooting_Range/shooting_test/shooting_range4?listen?Game=/Game/BluePrints/Core/BP_BattleRoyalTrainingGameMode.BP_BattleRoyalTrainingGameMode_C",UGameplayStatics::GetPlayerController(GetWorld(),0)); SDK::UGameBackendHUD*hud=UGameBackendHUD::GetInstance(); SDK::UGameFrontendHUD*hd=hud->GetFirstGameFrontendHUD(); hd->PendingGameStatus="Fighting"; } } // 控制服务器功能 if (ImGui::CollapsingHeader("服务器")){ ImGui::Text("刷新常见物资"); if (ImGui::Button("AKM-x10", ImVec2(-1,80))){ FTransform Transform = UGameplayStatics::GetPlayerController(GetWorld(),0)->Pawn->GetTransform(); Transform.Translation = UGameplayStatics::GetPlayerController(GetWorld(),0)->Pawn->RootComponent->RelativeLocation; AActor* SpawnedPickup = SpawnActorFromClass(GetWorld(),APickUpWrapperActor::StaticClass(),Transform, ESpawnActorCollisionHandlingMethod::ESpawnActorCollisionHandlingMethod__AlwaysSpawn, UGameplayStatics::GetPlayerController(GetWorld(),0)); APickUpWrapperActor* _SpawnedPickup = static_cast (SpawnedPickup); if (!_SpawnedPickup->IsA(APickUpWrapperActor::StaticClass())) { ALOGD( "AttemptSpawnEquipableAtPlayer():: " "!SpawnedPickup->IsA(APickUpWrapperActor::StaticClass())"); } static TArray FoundActors; static auto APlayerCharacter = UObject::FindObject("Class ShadowTrackerExtra.STExtraVehicleBase"); SDK::UGameplayStatics::GetAllActorsOfClass(GetWorld(), APlayerCharacter, &FoundActors); // 设置物资类型和特定ID（根据提供的结构体，ID可能为TypeSpecificID） FItemDefineID ItemID; ItemID.Type = 1; // 根据需要设置物品类别（根据游戏的定义，设置正确的值） ItemID.TypeSpecificID = 101001; // 设置物品ID _SpawnedPickup->SetDefineID(ItemID); // 设置物资数量 _SpawnedPickup->SetCountOnServerAfterSpawn(10); // 显示物资 _SpawnedPickup->ShowMesh(true); _SpawnedPickup->ShowActor(); // 注册到玩家拾取列表 _SpawnedPickup->RegisterToPlayerPickUpList(); } } } PK ZQeSyscall读写.hup9 [Syscall读写.hPK #Z} main.cppPK 5)ZiٲTT'菜单.hup \m菜单.hPKc: