用powerbasic和vb 6.0写的CALL的DLL及程序源代码，送给新人做参考

DLL 代码

#DIM ALL '申明所有
#REGISTER ALL '注册所有
#COMPILE DLL "WuLin.DLL" '生成文件类型及名字
#INCLUDE "WIN32API.INC" '引用API

GLOBAL hWnd AS DWORD '全局hwnd，记录游戏的hwnd
GLOBAL hProcess AS DWORD '全局process 记录游戏的线程
GLOBAL hThread AS DWORD '全局thread 代码线程
GLOBAL lpNumberOfBytes AS DWORD '全局函数变量
GLOBAL ThreadAdd AS DWORD POINTER '全局注入线程指针
GLOBAL Pid AS DWORD '线程id

GLOBAL FirstAdr AS DWORD '全局变量 游戏基址

'''''''''''''''''''' DLL文件初始函数 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION LIBMAIN(BYVAL hInstance AS DWORD, _
BYVAL lReason AS LONG, _
BYVAL lReserved AS LONG) AS LONG

SELECT CASE AS LONG lReason
CASE %DLL_PROCESS_ATTACH
LIBMAIN = 1
EXIT FUNCTION
CASE %DLL_PROCESS_DETACH
EXIT FUNCTION
CASE %DLL_THREAD_ATTACH
EXIT FUNCTION
CASE %DLL_THREAD_DETACH
EXIT FUNCTION
END SELECT

LIBMAIN = 0
END FUNCTION

'''''''''''''''''''''''' 游戏检测初始函数 '''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION CheckIn STDCALL ALIAS "CheckIn" () EXPORT AS LONG
hWnd = FindWindow("QElementClient Window", "Element Client") '获取游戏hwnd
GetWindowThreadProcessId(hWnd, Pid) '获取游戏线程
hProcess = OpenProcess(%PROCESS_ALL_ACCESS, %False, Pid) '打开线程
IF hProcess = 0 THEN '如果打开线程为0，即失败退出
FUNCTION = 0
EXIT FUNCTION
END IF
ThreadAdd = VirtualAllocEx(hProcess, BYVAL 0&, 2048, %MEM_COMMIT, %PAGE_READWRITE) '申请内存空间，准备注入

FirstAdr = &H00911B24 '初始化游戏基址

FUNCTION = 1 '设置返回参数
END FUNCTION

'''''''''''''''''''''''' 读取内存 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION ReadM STDCALL ALIAS "ReadM" (BYVAL mAdr AS LONG, _ '读取内存数值
BYVAL mSize AS LONG) EXPORT AS LONG
DIM mValue AS LONG
ReadProcessMemory(hProcess, BYVAL mAdr, BYVAL VARPTR(mValue), mSize, lpNumberOfBytes)

FUNCTION = mValue
END FUNCTION

FUNCTION ReadMf STDCALL ALIAS "ReadMf" (BYVAL mAdr AS LONG, _ '读取内存数值浮点
BYVAL mSize AS LONG) EXPORT AS DOUBLE
DIM mValue AS DOUBLE
ReadProcessMemory(hProcess, BYVAL mAdr, BYVAL VARPTR(mValue), mSize, lpNumberOfBytes)

FUNCTION = mValue
END FUNCTION

''''''''''''''''''''''''''''' 释放内存，退出 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION EndQuit STDCALL ALIAS "EndQuit" () AS LONG
VirtualFreeEx(hProcess, BYVAL ThreadAdd, 2048, %MEM_RELEASE)
SLEEP(1000)
FUNCTION = 1&
END FUNCTION

''''''''''''''''''''''''''' 注入程序 ''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION FuncIn ALIAS "FuncIn" (BYVAL Func AS DWORD POINTER, _
BYVAL CallType AS DWORD, _ '注入类型
BYVAL Param1 AS DWORD, _ '注入参数1
BYVAL Param2 AS DWORD, _ '注入参数2
BYVAL Param3 AS DWORD, _ '注入参数3
BYVAL Param4 AS DWORD) EXPORT AS LONG '注入参数4
DIM TempAdd AS DWORD POINTER

WriteProcessMemory(hProcess, BYVAL ThreadAdd, @Func, 4096, lpNumberOfBytes)

SELECT CASE CallType
CASE 0 '无参数Call
CASE 1 '使用技能
TempAdd = ThreadAdd + 33
WriteProcessMemory(hProcess, BYVAL TempAdd, Param1, 4, lpNumberOfBytes)
CASE 2
TempAdd = ThreadAdd + 43
WriteProcessMemory(hProcess, BYVAL TempAdd, Param1, 4, lpNumberOfBytes)
END SELECT

hThread = CreateRemoteThread(hProcess, BYVAL 0&, 0, ThreadAdd, BYVAL 0&, 0, lpNumberOfBytes)

WaitForSingleObject(hThread, %INFINITE)

CloseHandle(hThread)
FUNCTION = -1&
END FUNCTION

''''''''''''''''''''''' CallType 0 无参数注入''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''''
FUNCTION pAttackCall ALIAS "pAttackCall" () AS LONG '普通攻击
DIM Address AS LONG
Address = &H005A7810
!pushad
!CALL Address
!popad
END FUNCTION

FUNCTION DazuoCall ALIAS "DazuoCall" () AS LONG '运气（打坐）
DIM Address AS LONG
Address = &H005A7E90
!pushad
!CALL Address
!popad
END FUNCTION

FUNCTION UnDazuoCall ALIAS "UnDazuoCall" () AS LONG
DIM Address AS LONG
Address = &H00465680
!pushad
!CALL Address
!popad
END FUNCTION

FUNCTION PressTabCall ALIAS "PressTab" () AS LONG
DIM Address AS LONG
Address = &H0045B4E0
!pushad
!mov ecx, dword ptr [&H911B24]
!mov ecx, dword ptr [ecx + &H24]
!push 0
!call Address
!popad
END FUNCTION

FUNCTION CallSingle ALIAS "CallSingle" (BYVAL wCase AS INTEGER) EXPORT AS LONG '无参数CALL调用函数
SELECT CASE wCase
CASE 1
FuncIn(CODEPTR(DazuoCall), 0, 0, 0, 0, 0)
CASE 2
FuncIn(CODEPTR(UnDazuoCall), 0, 0, 0, 0, 0)
CASE 3
FuncIn(CODEPTR(pAttackCall), 0, 0, 0, 0, 0)
CASE 4
FuncIn(CODEPTR(PressTabCall), 0, 0, 0, 0, 0)
END SELECT
FUNCTION = -1&
END FUNCTION

'''''''''''''''''''' CallType 1 使用技能 ''''''''''''''''''''''''''''''''''''
FUNCTION UseSkillsCall ALIAS "UseSkillsCall" () AS LONG
DIM Address AS LONG
DIM edx1 AS LONG

Address = &H00461E90
edx1 = 999
!pushad
!mov eax, edx1
!mov ecx, dword ptr [&H90E034]
!mov ecx, dword ptr [ecx + &H1C]
!mov ecx, dword ptr [ecx + &H24]
!push -1
!push 0
!push 0
!push eax
!call Address
!popad
END FUNCTION

FUNCTION UseSkills ALIAS "UseSkills" (BYVAL sKillsID AS DWORD) EXPORT AS LONG
FuncIn(CODEPTR(UseSkillsCall), 1, sKillsID, 0, 0, 0)
SLEEP(500)
FUNCTION = -1&
END FUNCTION

VB 代码

Option Explicit

'Win32 API 基本定义
Private Declare Function GetAsyncKeyState Lib "user32" (ByVal vkey As Long) As Integer

'游戏CALL函数定义 特别需要注意，Function 过程名称中的大小写必须与现在的一致，否则将无法找到函数入口而提示错误

'CheckIn 用于检查游戏是否运行和初始化设置的函数，其中包括申请内存区域等操作
Private Declare Function CheckIn Lib "WuLin.Dll" () As Long

'简单的CALL，其中包含了4个基本的call，1 是运气打坐，2 是取消运气打坐，3 是普通攻击，4 是发送TabCall找怪
Private Declare Function CallSingle Lib "WuLin.Dll" (ByVal lpSinglecall As Integer) As Long

'使用技能的Call，其参数为技能的ID，例如清风破ID为2
Private Declare Function UseSkills Lib "WuLin.Dll" (ByVal sKillsID As Long) As Long

'退出的函数，主要用于清理退出后内存中的GHOFFICE过滤词语啊这些东西的
Private Declare Function EndQuit Lib "WuLin.Dll" (ByVal EndType As Long) As Long

Private Sub Form_Load()
Dim gStart As Long

gStart = CheckIn
If gStart = 0 Then
MsgBox "游戏未启动！"
End
End If
THook.Enabled = True
End Sub

Private Function MyHotKey(vKeyCode) As Boolean
MyHotKey = (GetAsyncKeyState(vKeyCode) < 0)
End Function

Private Sub Form_QueryUnload(Cancel As Integer, UnloadMode As Integer)
Call EndQuit(1)
End Sub

'************************热健定义*************************************
Private Sub Thook_Timer()
If MyHotKey(33) Then 'PageUP
Call CallSingle(4) '发TabCall选怪
'Call CallSingle(1) '打坐运气
'Call CallSingle(2) '取消打坐状态
'Call CallSingle(3) '普通攻击
ElseIf MyHotKey(34) Then 'PageDown
Call UseSkills(2) '使用技能 参数2表示清风破的ID
End If
End Sub

程序运行后可以用pageup和pagedown测试