 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Ind3siszive
Cheater
![]() Reputation: 0
Joined: 23 Apr 2009
Posts: 43
Location: in a glitch
|
 Posted: Sun May 03, 2009 1:26 pm Post subject: Sigs in C++ |
 |
|
Hey guys, i was wondering how I could make my Ce trainer in c++ and how I would edit a sig. I dont quite understand sigs, but what i do know is that it is an array of bytes. Please explain how an array can have a single address, and how i can use this in C++ to make a trainer
I looked around the forums and found this, is this how its done
#define PATCH_ADDRESS (LPVOID)0x353F1220
| Code: | static const BYTE bPatch[] = {
0x4C, 0xDF, 0x40, 0x35, 0x00, 0x00, 0x00, 0x00, 0x50,
0xDF, 0x40, 0x35, 0x00, 0x00, 0x00, 0x00, 0x70, 0x12,
0x3F, 0x35, 0x06, 0x00, 0x00, 0x00, 0x70, 0xDF, 0x40,
0x35, 0x02, 0x00, 0x00, 0x00, 0xC8, 0xB2, 0x32, 0x35,
0x68, 0xB3, 0x30, 0x35, 0x77, 0x04, 0x00, 0x00, 0xD0,
0x15, 0x3F, 0x35, 0x40, 0x2B, 0x10, 0x35, 0x60, 0x26,
0x10, 0x35, 0x70, 0x26, 0x10, 0x35, 0x80, 0x26, 0x10,
0x35, 0xA0, 0x26, 0x10, 0x35, 0xB0, 0x26, 0x10, 0x35,
0xC0, 0x26, 0x10, 0x35, 0x90, 0x26, 0x10, 0x35, 0x01,
0x00, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0xC0, 0x36,
0x10, 0x35, 0x68, 0xB3, 0x30, 0x35
};
__checkReturn BOOL ApplyPatches()
{
DWORD flOldProtect;
if (VirtualProtect(PATCH_ADDRESS, sizeof(bPatch), PAGE_EXECUTE_READWRITE, &flOldProtect))
{
CopyMemory(PATCH_ADDRESS, bPatch, sizeof(bPatch));
VirtualProtect(PATCH_ADDRESS, sizeof(bPatch), flOldProtect, &flOldProtect);
return TRUE;
}
else
return FALSE;
} |
_________________
|
|
| Back to top |
|
 |
pkedpker
Master Cheater
![]() Reputation: 1
Joined: 11 Oct 2006
Posts: 412
|
| Posted: Sun May 03, 2009 5:17 pm Post subject: |
|
|
yah but whats
__checkReturn ? never heard of that
anyways i'm guessing u could remove that its some retarded shit. 
yah thats how it's done using CopyMemory API or.. even WriteProcessMemory API both do the same process just writeProcessMemory requires more parameters
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun May 03, 2009 6:47 pm Post subject: |
|
|
| pkedpker wrote: | yah but whats
__checkReturn ? never heard of that |
That is a SAL annotation telling the user that he/she should/must check the returned value of the function to make sure it has succeeded or has returned the correct value.
| pkedpker wrote: | | yah thats how it's done using CopyMemory API or.. even WriteProcessMemory API both do the same process just writeProcessMemory requires more parameters |
| Code: | #define RtlCopyMemory(Destination,Source,Length) memcpy((Destination),(Source),(Length))
#define CopyMemory RtlCopyMemory |
CopyMemory isn't an API, it calls the CRT function memcpy.
Well back onto the OP:
A byte signature is the bytes located at a certain VA that make up the instructions of an application.
Like say if you through an application into OllyDbg, it would break on its OEP and OllyDbg would read this:
| Code: | 0041B2F6 <>/$ 55 PUSH EBP
0041B2F7 |. 8BEC MOV EBP,ESP
0041B2F9 |. 6A FF PUSH -1 |
So if we translate this to what each means:
0041B2F6 - Virtual Address
55 - Byte
PUSH EBP - Opcode/Instruction that the byte(s) represent.
Signatures are taking only those bytes that represent addresses/instructions in memory, since VA's are prone to change when a program is recompiled/modified.
55 8B EC 6A FF
Would represent the 3 instructions above, so instead of code-caving that address to jump to function which contains actual instructions we simply modify the bytes entirely.
BYTE PushEbpMovEbpEspPush[] = { 0x55, 0x8B, 0xEC, 0x6A, 0xFF };
If you want to understand what is happening when you copy memory, either go to that patch address before & after you edit and see what changes or throw those bytes into OllyDbg and let it translate... but you have to watch out because that address may be mid-instruction. Double Check that.
_________________
|
|
| Back to top |
|
|
Ind3siszive
Cheater
![]() Reputation: 0
Joined: 23 Apr 2009
Posts: 43
Location: in a glitch
|
| Posted: Sun May 03, 2009 7:13 pm Post subject: |
|
|
I think ive got it figured out,
also the code above wasnt mine i just copied it
but could do something like
BYTE array_of_bytes[5] = 0x0041B2F6
for the code u posted above
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun May 03, 2009 7:16 pm Post subject: |
|
|
Well you could, but only if you know that virtual address won't change.
The good thing about using the bytes is that you don't need that VA, because the bytes make up those instruction.
_________________
|
|
| Back to top |
|
|
Ind3siszive
Cheater
![]() Reputation: 0
Joined: 23 Apr 2009
Posts: 43
Location: in a glitch
|
| Posted: Sun May 03, 2009 7:25 pm Post subject: |
|
|
so i know there is gonna be something wrong with my code cause im a nub but this is my idea of whats goin on
| Code: | #include <iostream>
#include <cstdlib>
#include <windows.h>
using namespace std;
int main ()
{
HWND hwnd;
hwnd = FindWindow(0,L"GAME");
DWORD Id;
HANDLE ProcessHandle;
char hacks;
unsigned long adress[6]= 0x005351BB;
int value;
if(!hwnd) // Checking to see if the hwnd commpand found the window
{
cout << "Game Not Found!" << endl; // it didnt
}
else // It found it
{
cout << "Game Found!" << endl; // It says it found it
value = 90, 90, 90, 90, 90, 90, 90, 90
GetWindowThreadProcessId(hwnd,&Id);
cout << "Process Id: " << Id << endl;
ProcessHandle = OpenProcess(PROCESS_VM_WRITE |PROCESS_VM_OPERATION ,false,Id);
WriteProcessMemory(ProcessHandle,(LPVOID)adress,&value,sizeof(int),NULL);
}
} |
im 99% sure im wrong with the way im writing the new bytes so plz help
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun May 03, 2009 7:36 pm Post subject: |
|
|
Ok, so first off:
unsigned long adress[6]= 0x005351BB;
Just do:
DWORD dwAddress = 0x005351BB;
Second:
value = 90, 90, 90, 90, 90, 90, 90, 90
You want to write 0x90 right? as in a NOP?
Then:
| Code: | BYTE btNops[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
...
WriteProcessMemory(ProcessHandle, (LPVOID)dwAddress, (LPCVOID)btNops, _countof(btNops), NULL); |
_________________
|
|
| Back to top |
|
|
hcavolsdsadgadsg
I'm a spammer
![]() Reputation: 26
Joined: 11 Jun 2007
Posts: 5801
|
| Posted: Sun May 03, 2009 7:36 pm Post subject: |
|
|
| Ind3sisziver wrote: | | im 99% sure im wrong with the way im writing the new bytes so plz help |
Arrays would like a word with you
|
|
| Back to top |
|
|
Ind3siszive
Cheater
![]() Reputation: 0
Joined: 23 Apr 2009
Posts: 43
Location: in a glitch
|
| Posted: Sun May 03, 2009 7:38 pm Post subject: |
|
|
yeah i was noping it
YES THIS IS EXACTYLY WHAT I WANTED TO DO THANKS DUDE 
I would + rep you but i dont think i can
_________________
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
