能否向EXE程序发送数据包或对其进行控制？后台控制游戏的实现方案咨询

Hey there! Let’s break down your questions about background game control step by step—this is a super common scenario for automation or remote control, so I’ll walk you through actionable steps and clarify your core questions.

First, let’s align on why avoiding window focus matters: most standard input methods (like SendKeys or physical keyboard emulation) rely on the game being in the foreground. To bypass this, your two proposed approaches are valid, but each has different requirements and use cases.

Option 1: Sending ENet Packets to the Game #

ENet is a lightweight UDP-based networking library used by tons of games, so this approach works great if the game uses networked input (even for single-player, some games use local network loops for input handling). Here’s how to get started:

• Reverse-engineer the game’s ENet protocol first
  • Use Wireshark or TShark to capture UDP traffic while playing the game—filter for ENet’s default port range (or find the exact port the game uses via Task Manager > Details > Open Ports).
  • Analyze captured packets to map player actions (like moving left, jumping, or using an ability) to specific byte sequences. Pay attention to packet headers, payload structure, and any encryption/obfuscation (many games scramble packets to prevent tampering).
  • If encryption is an issue, attach a debugger like x64dbg to the game process and trace calls to enet_host_send or enet_peer_send—you can often catch plaintext data right before it’s encrypted.
• Build a custom ENet client
  • Use the ENet library (C/C++ is native, but there are bindings for Python/Go if you prefer) to create a client that mimics the game’s own network behavior.
  • First, replicate the game’s connection handshake: most games require sending a client version, authentication token, or session ID before accepting commands. Skip this step, and your packets will be ignored.
  • Once connected, send the packet sequences you mapped earlier. For online games, this tells the server to apply your actions (so the game client will update even if it’s in the background). For single-player games using local ENet, this directly triggers the game’s input logic.
• Critical note: Online games with anti-cheat (like Easy Anti-Cheat or Battle Eye) will flag custom ENet clients as suspicious—this could lead to account bans, so proceed with extreme caution.

Option 2: Direct Background Control of the Game Process #

This approach skips networking entirely and interacts directly with the game’s process memory or internal functions. It’s ideal for single-player games or situations where network protocol reverse-engineering is too complex. Here’s how:

• Find the game’s input handling points
  • Use Cheat Engine to scan for memory addresses that track input state (e.g., a byte where specific bits represent pressed keys). For example, when you press the W key, scan for a value that changes, then narrow it down until you find the exact address.
  • Use x64dbg to debug the game and locate input-handling functions. Windows games often use GetAsyncKeyState, DirectInput, or engine-specific functions (like Unity’s Input.GetKey). Set breakpoints on these functions to see how the game processes input.
• Manipulate memory or inject code
  • Memory writing: Use Windows APIs like WriteProcessMemory (C++) or pywin32 (Python) to directly modify the input state addresses you found. This lets you simulate key presses/releases without the game needing focus.
  • DLL injection: If the game’s input logic is tied to internal functions (e.g., PlayerMove(Vector2 direction)), write a small DLL that calls these functions, then inject it into the game process. This gives you direct control over the game’s logic, bypassing input systems entirely.
  • Skip SendInput for background control—most games ignore this API unless they’re in the foreground. Memory manipulation is far more reliable here.
• Critical note: You’ll need administrator privileges to modify another process’s memory. Also, anti-cheat systems aggressively detect DLL injection and memory tampering.

Your Additional Questions Answered #

Can you send packets to an EXE directly? #

It depends on the game’s architecture:

• Single-player games without network support: Probably not—they don’t listen for incoming network traffic, so there’s no port to send packets to.
• Networked games (client-server or local network): Yes! If the game’s EXE communicates with a server or local peer, you can send packets to its network port. You’ll just need to reverse-engineer the protocol first (as outlined in Option 1).
• Some single-player games use local ENet loops: These listen on a local port, so you can send packets to that port to trigger actions.

Can you control an EXE directly? #

Absolutely! This is exactly what Option 2 covers. You can:

• Modify the EXE’s memory to simulate input or change game state.
• Inject code to call the EXE’s internal functions.
• Use Windows APIs to interact with the process (e.g., pause/resume it, read/write memory).

• Start small: Pick a simple single-player game first (no anti-cheat) to practice reverse-engineering and memory manipulation.
• Use free tools: Wireshark, x64dbg, and Cheat Engine are all free and powerful enough for most use cases.
• Prioritize safety: For online games, always research the anti-cheat system first—many have zero-tolerance policies for custom clients or memory tampering.

内容的提问来源于stack exchange，提问作者abood sabbag