| View previous topic :: View next topic |
| Author |
Message |
NuclearPowered
Master Cheater
 Reputation: 0
Joined: 30 Dec 2007
Posts: 345
|
 Posted: Sun Feb 03, 2008 10:15 am Post subject: C++ WriteProcessmemory help needed |
 |
|
Hey guys, I'm focussing on building a trainer with C++ now and I need some help with WriteProcessMemory.
I know how to attach the program to minesweeper but now I want to know how I can freeze the value of the 4byte timer addressand how I can change the opcode of a certain address to stop it from making me lose when I hit a mine.
I have the addresses of these already and hacked them with cheat engine (most simple stuff there is) but the point is I want to know how to change them in C++ using WriteProcessMemory.
I already used the search functions but I only found threads with whole program's where I didn't understand a thing of :/
|
|
| Back to top |
|
 |
Reak
I post too much
 Reputation: 0
Joined: 15 May 2007
Posts: 3496
|
| Posted: Sun Feb 03, 2008 11:24 am Post subject: |
|
|
Freezing an address is nothing else than using WriteProcessMemory in a timer with low interval.
I don't know C++ (only hello world program 1337!) but take a look at this:
http://forum.cheatengine.org/viewtopic.php?t=189372
|
|
| Back to top |
|
|
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Sun Feb 03, 2008 12:15 pm Post subject: |
|
|
I wrote a tut that goes over the basics for writing a trainer via a dialog:
http://www.extalia.com/forums/viewtopic.php?f=32&t=2829
Which also has a hotkey thread inside it. You can add the code inside the thread to continuously write to an address, in theory freezing it.
As for changing an opcode, simply write the new byte(s) to the given memory location where the old opcode is at.
_________________
- Retired. |
|
| Back to top |
|
|
hcavolsdsadgadsg
I'm a spammer
![]() Reputation: 26
Joined: 11 Jun 2007
Posts: 5801
|
| Posted: Sun Feb 03, 2008 2:25 pm Post subject: |
|
|
SetTimer then just respond to WM_TIMER.
or you can just NOP out the instruction.
|
|
| Back to top |
|
|
NuclearPowered
Master Cheater
Reputation: 0
Joined: 30 Dec 2007
Posts: 345
|
| Posted: Sun Feb 03, 2008 4:12 pm Post subject: |
|
|
| Wiccaan wrote: | I wrote a tut that goes over the basics for writing a trainer via a dialog:
http://www.extalia.com/forums/viewtopic.php?f=32&t=2829
Which also has a hotkey thread inside it. You can add the code inside the thread to continuously write to an address, in theory freezing it.
As for changing an opcode, simply write the new byte(s) to the given memory location where the old opcode is at. |
Yeah but how do you make it write the bytes?
I know this (correct me if I'm wrong:
WriteProcessMemory(ProcessID, (LPVOID)address, (LPVOID) value, 4, 0);
Process ID is the process ID you want to write to (for example 1828)
Address is the memory address you want to make changes at (for example 0x400000)
Value is the value of the address you want the value changed in (for example 100)
but what do the LPVOIDS's do and is the 4 the size of bytes the address is?
and what is that last 0 for?
and where do the bytes go you want to write to that address?
thanks alot for helping me out guys 
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
|
| Back to top |
|
|
NuclearPowered
Master Cheater
Reputation: 0
Joined: 30 Dec 2007
Posts: 345
|
| Posted: Sun Feb 03, 2008 5:03 pm Post subject: |
|
|
| Oh my gosh flyte that helped me so much, I checked MSDN before but I never could find my way on the site.
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Mon Feb 04, 2008 11:23 am Post subject: |
|
|
Create the bytes in an array that you want to write, say for Minesweeper. For example, for the timer, you can just nop out the instruction that ticks the timer by doing the following:
Firstly, find the timer address that ticks the timer which is located at:
1002ff5 : inc [100579C]
This instruction is 6 bytes long: 0xff,0x05,0x9c,0x57,0x00,01
So we can nop it out with 6 nops, make an array of nops like this:
BYTE btTimerNops[] = {0x90,0x90,0x90,0x90,0x90,0x90};
Then you can write them to memory using WriteProcessMemory like this:
| Code: | #include <windows.h>
#include <iostream>
BYTE btTimerNops[] = {0x90,0x90,0x90,0x90,0x90,0x90};
int main()
{
//
// Get Window Handle
//
HWND hWnd = FindWindow( NULL, "Minesweeper" );
if( !hWnd )
{
std::cout << "Failed to locate Minesweeper window. Press enter to exit.";
std::cin.ignore();
std::cin.sync();
return 0;
}
//
// Get Proc Id
//
DWORD dwProcId = NULL;
GetWindowThreadProcessId( hWnd, &dwProcId );
if( dwProcId == 0 )
{
std::cout << "Failed to obtain process id. Press enter to exit.";
std::cin.ignore();
std::cin.sync();
return 0;
}
//
// Get Proc Handle
//
HANDLE hHandle = OpenProcess( PROCESS_ALL_ACCESS, FALSE, dwProcId );
if( hHandle == INVALID_HANDLE_VALUE || hHandle == NULL )
{
std::cout << "Failed to open process for valid handle. Press enter to exit.";
std::cin.ignore();
std::cin.sync();
return 0;
}
//
// Write Nops To Address
//
if( !WriteProcessMemory( hHandle, (BYTE*)0x1002ff5, &btTimerNops, sizeof(btTimerNops), NULL ) )
{
CloseHandle( hHandle );
std::cout << "Failed to write nops to memory. Press enter to exit.";
std::cin.ignore();
std::cin.sync();
return 0;
}
//
// Successfully wrote to memory.
//
CloseHandle( hHandle );
std::cout << "Successfully wrote nops to memory! Press enter to close this window.";
std::cin.ignore();
std::cin.sync();
return ERROR_SUCCESS;
} |
_________________
- Retired. |
|
| Back to top |
|
|
NuclearPowered
Master Cheater
Reputation: 0
Joined: 30 Dec 2007
Posts: 345
|
| Posted: Tue Feb 05, 2008 4:12 am Post subject: |
|
|
I spoke kittonkicker on msn and he explained me the [] array thing already pretty logical actually.
he said it's easier to save the array in a char though, dunno why
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Tue Feb 05, 2008 5:32 pm Post subject: |
|
|
| NuclearPowered wrote: | I spoke kittonkicker on msn and he explained me the [] array thing already pretty logical actually.
he said it's easier to save the array in a char though, dunno why |
unsigned char
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
