Cheat Engine :: View topic - [?] Bruteforcing processes

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

[?] Bruteforcing processes
Goto page 1, 2 Next

Cheat Engine Forum Index -> General programming

View previous topic :: View next topic

Author

Message

talkerzero
Grandmaster Cheater

Reputation: 1

Joined: 24 Jul 2008
Posts: 560
Location: California

Posted: Sun Mar 15, 2009 2:32 pm Post subject: [?] Bruteforcing processes

This is blankrider/banme's code.. (edited by me a bit)

Code:

#include <windows.h>
#pragma comment(lib, "ntdll.lib")

void LoopProcesses()
{
UNICODE_STRING uTemp = {0};
DWORD pid = 0x0;
while(pid <= 0x41DC)
{
HANDLE temp = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
if(temp != INVALID_HANDLE_VALUE)
{
ZwQueryInformationProcess(temp, 27, &uTemp, sizeof(UNICODE_STRING), 0);
if(wcscmp(uTemp, "MapleStory.exe") == NULL)
{
//inject DLL
}
if(temp)
CloseHandle(temp);
}
pid += 0x4;
}
}

Here are the errors I'm getting..

Code:

error C2065: 'UNICODE_STRING' : undeclared identifier
error C2146: syntax error : missing ';' before identifier 'uTemp'
error C2065: 'uTemp' : undeclared identifier
error C2059: syntax error : '{'
error C2143: syntax error : missing ';' before '{'
error C2143: syntax error : missing ';' before '}'
error C2065: 'uTemp' : undeclared identifier
error C2065: 'UNICODE_STRING' : undeclared identifier
error C2070: ''unknown-type'': illegal sizeof operand
error C3861: 'ZwQueryInformationProcess': identifier not found
error C2065: 'uTemp' : undeclared identifier

I think the problem is that I'm missing some header file or library that I need to include.. help?

And, as a side note, what's kernelmode?

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Sun Mar 15, 2009 2:49 pm Post subject:

You'll need to make a wrapper for ZwQueryInformationProcess.

TraxMate
Master Cheater

Reputation: 0

Joined: 01 Mar 2008
Posts: 363

Posted: Sun Mar 15, 2009 2:52 pm Post subject:

S3NS4 wrote:

You'll need to make a wrapper for ZwQueryInformationProcess.

What's a wrapper?

talkerzero
Grandmaster Cheater

Reputation: 1

Joined: 24 Jul 2008
Posts: 560
Location: California

Posted: Sun Mar 15, 2009 2:53 pm Post subject:

Could you give me an example? Googling didn't help..

dnsi0
I post too much

Reputation: 0

Joined: 04 Jan 2007
Posts: 2674

Posted: Sun Mar 15, 2009 2:54 pm Post subject:

TraxMate wrote:

S3NS4 wrote:

You'll need to make a wrapper for ZwQueryInformationProcess.

What's a wrapper?

Fail >.<

I don't know how to cast C++ types but heres the delphi cast:
var
QueryInfo:function(parameters);

@QueryInfo:=nil;
@QueryInfo:=GetProcAddress(LoadLibrary('ntdll.dll'),'ZwQueryInformationProcess');

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Sun Mar 15, 2009 2:55 pm Post subject:

Code:

typedef NTSTATUS (__stdcall *sZwQueryInformationProcess)(
__in HANDLE ProcessHandle,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID ProcessInformation,
__in ULONG ProcessInformationLength,
__out_opt PULONG ReturnLength
);

sZwQueryInformationProcess myZw = (sZwQueryInformationProcess)GetProcAddress( GetModuleHandle("ntdll.dll"), "ZwQueryInformationProcess" );

Call it like... myZw(...);

talkerzero
Grandmaster Cheater

Reputation: 1

Joined: 24 Jul 2008
Posts: 560
Location: California

Posted: Sun Mar 15, 2009 3:01 pm Post subject:

Here's my new code..

Code:

#include <windows.h>
#pragma comment(lib, "ntdll.lib")

typedef NTSTATUS (__stdcall *sZwQueryInformationProcess)(
__in HANDLE ProcessHandle,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID ProcessInformation,
__in ULONG ProcessInformationLength,
__out_opt PULONG ReturnLength
);
sZwQueryInformationProcess myZw = (sZwQueryInformationProcess)GetProcAddress( GetModuleHandle("ntdll.dll"), "ZwQueryInformationProcess" );

void LoopProcesses()
{
UNICODE_STRING uTemp = {0};
DWORD pid = 0x0;
while(pid <= 0x41DC)
{
HANDLE temp = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
if(temp != INVALID_HANDLE_VALUE)
{
ZwQueryInformationProcess(temp, 27, &uTemp, sizeof(UNICODE_STRING), 0);
if(wcscmp(uTemp, "MapleStory.exe") == NULL)
{
//inject DLL
}
if(temp)
CloseHandle(temp);
}
pid += 0x4;
}
}

errors..

Code:

error C2061: syntax error : identifier 'PROCESSINFOCLASS'
error C2065: 'UNICODE_STRING' : undeclared identifier
error C2146: syntax error : missing ';' before identifier 'uTemp'
error C2065: 'uTemp' : undeclared identifier
error C2065: 'uTemp' : undeclared identifier
error C2065: 'UNICODE_STRING' : undeclared identifier
error C2070: ''unknown-type'': illegal sizeof operand
error C2065: 'uTemp' : undeclared identifier

Anything else I need to include, header files, libraries, etc.?

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Sun Mar 15, 2009 3:06 pm Post subject:

You haven't defined uTemp <.<

Code:

typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING,
*PLSA_UNICODE_STRING,
UNICODE_STRING,
*PUNICODE_STRING;

& dnsi0 I saw that last post of yours you dumbshit. PWSTR & USHORT are already defined.

talkerzero
Grandmaster Cheater

Reputation: 1

Joined: 24 Jul 2008
Posts: 560
Location: California

Posted: Sun Mar 15, 2009 3:21 pm Post subject:

Ugh.. my code now (or rather, 1/32 my code, 31/32 pasted code.. I just want to get it working first, then learn how it all works..)

Code:

#include <windows.h>
#pragma comment(lib, "ntdll.lib")

typedef NTSTATUS (__stdcall *sZwQueryInformationProcess)(
__in HANDLE ProcessHandle,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID ProcessInformation,
__in ULONG ProcessInformationLength,
__out_opt PULONG ReturnLength
);
sZwQueryInformationProcess myZw = (sZwQueryInformationProcess)GetProcAddress( GetModuleHandle("ntdll.dll"), "ZwQueryInformationProcess" );

typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING,
*PLSA_UNICODE_STRING,
UNICODE_STRING,
*PUNICODE_STRING;

void LoopProcesses()
{
UNICODE_STRING uTemp = {0};
DWORD pid = 0x0;
while(pid <= 0x41DC)
{
HANDLE temp = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
if(temp != INVALID_HANDLE_VALUE)
{
myZw(temp, 27, &uTemp, sizeof(UNICODE_STRING));
if(wcscmp(uTemp,"TheProcessWeLookingFor") == 0)
{
//more code here
}
if(temp)
CloseHandle(temp);
}
pid += 0x4;
}
}

errors..

Code:

error C2061: syntax error : identifier 'PROCESSINFOCLASS'
error C2197: 'sZwQueryInformationProcess' : too many arguments for call
error C2664: 'wcscmp' : cannot convert parameter 1 from 'UNICODE_STRING' to 'const wchar_t *'
No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called

BanMe
Master Cheater

Reputation: 0

Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA

Posted: Sun Mar 15, 2009 3:40 pm Post subject:

Code:

#include <windows.h>
#pragma comment(lib, "ntdll.lib")
typedef struct _LSA_UNICODE_STRING {
USHORT Length;
USHORT MaximumLength;
PWSTR Buffer;
} LSA_UNICODE_STRING,
*PLSA_UNICODE_STRING,
UNICODE_STRING,
*PUNICODE_STRING;

// Expanded definition from <ntddk.h> DDK 3790
typedef enum _PROCESSINFOCLASS {

ProcessBasicInformation,

ProcessQuotaLimits,

ProcessIoCounters,

ProcessVmCounters,

ProcessTimes,

ProcessBasePriority,

ProcessRaisePriority,

ProcessDebugPort,

ProcessExceptionPort,

ProcessAccessToken,

ProcessLdtInformation,

ProcessLdtSize,

ProcessDefaultHardErrorMode,

ProcessIoPortHandlers, // Note: this is kernel mode only

ProcessPooledUsageAndLimits,

ProcessWorkingSetWatch,

ProcessUserModeIOPL,

ProcessEnableAlignmentFaultFixup,

ProcessPriorityClass,

ProcessWx86Information,

ProcessHandleCount,

ProcessAffinityMask,

ProcessPriorityBoost,

ProcessDeviceMap,

ProcessSessionInformation,

ProcessForegroundInformation,

ProcessWow64Information,

ProcessImageFileName,

ProcessLUIDDeviceMapsEnabled,

ProcessBreakOnTermination,

ProcessDebugObjectHandle,

ProcessDebugFlags,

ProcessHandleTracing,

MaxProcessInfoClass
} PROCESSINFOCLASS;
NTSYSAPI
NTSTATUS
NTAPI
ZwQueryInformationProcess(
__in HANDLE ProcessHandle,
__in PROCESSINFOCLASS ProcessInformationClass,
__out PVOID ProcessInformation,
__in ULONG ProcessInformationLength,
__out_opt PULONG ReturnLength
);

void LoopProcesses()
{
UNICODE_STRING uTemp = {0};
DWORD pid = 0x0;
while(pid <= 0x41DC)
{
HANDLE temp = OpenProcess(PROCESS_ALL_ACCESS, 0, pid);
if(temp != INVALID_HANDLE_VALUE)
{
ZwQueryInformationProcess(temp, 27, &uTemp, sizeof(UNICODE_STRING), 0);
if(wcscmp(uTemp, "MapleStory.exe") == NULL)
{
//inject DLL
}
if(temp)
CloseHandle(temp);
}
pid += 0x4;
}
}

credit to S3NS4 too ..
regards BanMe

talkerzero
Grandmaster Cheater

Reputation: 1

Joined: 24 Jul 2008
Posts: 560
Location: California

Posted: Sun Mar 15, 2009 4:04 pm Post subject:

@Banme: Your code gives me this one final error..

Code:

error C2664: 'wcscmp' : cannot convert parameter 1 from 'UNICODE_STRING' to 'const wchar_t *'
No user-defined-conversion operator available that can perform this conversion, or the operator cannot be called

lurc
Grandmaster Cheater Supreme

Reputation: 2

Joined: 13 Nov 2006
Posts: 1900

Posted: Sun Mar 15, 2009 4:08 pm Post subject:

Change uTemp to uTemp.Buffer. Edit: S3NS4, I saw that dumb post, haha It obviously shows that you should not be giving programming advice. _________________

&Vage
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Jul 2008
Posts: 1053

Posted: Sun Mar 15, 2009 4:15 pm Post subject:

lurc wrote:

Change uTemp to uTemp.Buffer.

Edit: S3NS4, I saw that dumb post, haha Wink

It obviously shows that you should not be giving programming advice.

Lolololol

Never messed with the UNICODE_STRING struct before.

talkerzero
Grandmaster Cheater

Reputation: 1

Joined: 24 Jul 2008
Posts: 560
Location: California

Posted: Sun Mar 15, 2009 4:18 pm Post subject:

Yay, it compiled! Now it can't link.. Sad

Code:

error LNK2019: unresolved external symbol "__declspec(dllimport) long __stdcall ZwQueryInformationProcess(void *,enum _PROCESSINFOCLASS,void *,unsigned long,unsigned long *)" (__imp_?ZwQueryInformationProcess@@YGJPAXW4_PROCESSINFOCLASS@@0KPAK@Z) referenced in function "void __cdecl LoopProcesses(void)" (?LoopProcesses@@YAXXZ)

dnsi0
I post too much

Reputation: 0

Joined: 04 Jan 2007
Posts: 2674

Posted: Sun Mar 15, 2009 4:25 pm Post subject:

Wow... Spoon fed and still have problems.

Display posts from previous:

	Cheat Engine Forum Index -> General programming	All times are GMT - 6 Hours Goto page 1, 2 Next
Page 1 of 2

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum