 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Studio80
Advanced Cheater
![]() Reputation: 2
Joined: 12 Sep 2012
Posts: 83
|
 Posted: Wed Sep 12, 2012 9:17 am Post subject: [VB6.0] Multi Pointer from DLL |
 |
|
Hello guys I have been facing a real nasty problem which I can't solve. I hope some one here can help me out.
I'm trying to train a game, its my first time doing pointers. I have done Code Injections many times. This game has a multi pointer which holds the value of the ammo, in a DLL file (mono.dll).
Check attachment 2
Now the problem lies with the trainer template I'm using. Normally I find the name of the window and I can write the new values to the adresses. But with this DLL file there is no Window, I came accross some other websites but it didn't really help.
Here is the source of my template:
| Code: | Public Const PROCESS_ALL_ACCESS = &H1F0FFF
Dim f1holder As Integer
Dim timer_pos As Long
'API Declaration
Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hwnd As Long, lpdwProcessId As Long) As Long
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) As Long
Public Declare Function GetKeyPress Lib "user32" Alias "GetAsyncKeyState" (ByVal key As Long) As Integer
Public Declare Function ReadProcessMem Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Function WriteAByte(gamewindowtext As String, address As Long, value As Byte)
Dim hwnd As Long
Dim pid As Long
Dim phandle As Long
hwnd = FindWindow(vbNullString, gamewindowtext)
If (hwnd = 0) Then
'MsgBox "The Game Is Not Working", vbCritical, "Error"
'End
Exit Function
End If
GetWindowThreadProcessId hwnd, pid
phandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If (phandle = 0) Then
'MsgBox "Can't get ProcessId", vbCritical, "Error"
Exit Function
End If
WriteProcessMemory phandle, address, value, 1, 0&
CloseHandle hProcess
End Function
Public Function WriteAnInt(gamewindowtext As String, address As Long, value As Integer)
Dim hwnd As Long
Dim pid As Long
Dim phandle As Long
hwnd = FindWindow(vbNullString, gamewindowtext)
If (hwnd = 0) Then
'MsgBox "The Game Is Not Working", vbCritical, "Error"
'End
End If
GetWindowThreadProcessId hwnd, pid
phandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If (phandle = 0) Then
'MsgBox "Can't get ProcessId", vbCritical, "Error"
Exit Function
End If
WriteProcessMemory phandle, address, value, 2, 0&
CloseHandle hProcess
End Function
Public Function WriteALong(gamewindowtext As String, address As Long, value As Long)
Dim hwnd As Long
Dim pid As Long
Dim phandle As Long
hwnd = FindWindow(vbNullString, gamewindowtext)
If (hwnd = 0) Then
'MsgBox "The Game Is Not Working", vbCritical, "Error"
'End
Exit Function
End If
GetWindowThreadProcessId hwnd, pid
phandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If (phandle = 0) Then
'MsgBox "Can't get ProcessId", vbCritical, "Error"
Exit Function
End If
WriteProcessMemory phandle, address, value, 4, 0&
CloseHandle hProcess
End Function |
Normally I would write for the options something like this:
| Code: | | Call WriteAByte("Game Window Name", &H403BE8, &H90) |
When I try to do that for the DLL file:
| Code: | | Call WriteAnInt("mono.dll+ &H11EE684", &HF0, &H2F4, &H14, &H10, &H64) |
I get the following error:
Check attachment 1
So my question is how can I simply write the correct line so the trainer writes the new value to the pointer which is located in the mono.dll. Sorry if I sound noobish but it seems like I couldn't find an anwser on my question anywhere.
| Description: |
|
| Filesize: |
27.21 KB |
| Viewed: |
10173 Time(s) |
![2d0z71d[1].jpg](files/2d0z71d_1__135.jpg)
|
| Description: |
|
| Filesize: |
52.82 KB |
| Viewed: |
10173 Time(s) |
![2rwnh51[1].jpg](files/2rwnh51_1__900.jpg)
|
|
|
| Back to top |
|
 |
atom0s
Moderator
 Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Wed Sep 12, 2012 3:02 pm Post subject: |
|
|
Look into using CreateToolhelp32Snapshot to iterate the list of processes and their modules.
_________________
- Retired. |
|
| Back to top |
|
|
Studio80
Advanced Cheater
![]() Reputation: 2
Joined: 12 Sep 2012
Posts: 83
|
| Posted: Wed Sep 12, 2012 3:41 pm Post subject: |
|
|
| Thank you for your reply. I just took a look at the MSDN page of MS about the API you have mentioned but I still don't know how I could implement this into the trainer. If I succeed with this I will create a massive n00b friendly video tutorial about it.
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
|
| Back to top |
|
|
Studio80
Advanced Cheater
![]() Reputation: 2
Joined: 12 Sep 2012
Posts: 83
|
| Posted: Wed Sep 12, 2012 4:48 pm Post subject: |
|
|
I found an old post from you were you posted something interesting:
| Code: | Option Explicit
'//
'// Constants
'//
Private Const MAX_PATH = 260
Private Const TH32CS_SNAPPROCESS = &H2
Private Const PROCESS_ALL_ACCESS As Long = &H1F0FFF
'//
'// Process Entry Type
'//
Private Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szexeFile As String * MAX_PATH
End Type
'//
'// API Declarations
'//
Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Private Declare Sub CloseHandle Lib "kernel32" (ByVal hPass As Long)
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As Any) As Long
Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapshot As Long, lppe As Any) As Long
'//============================================================================
'// @Function: ProcessScan
'// @Params : None
'// @Returns : None
'// @Purpose : Scans for calc.exe in the process list and if found,
'// terminates the running instance.
'//============================================================================
Public Sub ProcessScan()
Dim pe32 As PROCESSENTRY32
Dim hSnapshot As Long
Dim bFoundProc As Boolean
pe32.dwSize = Len(pe32)
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
bFoundProc = Process32First(hSnapshot, pe32)
Do While bFoundProc
If Right$(LCase$(Left$(pe32.szexeFile, InStr(1, pe32.szexeFile, Chr(0)) - 1)), Len("calc.exe")) = LCase$("calc.exe") Then
'// Found calc.exe, terminating.
Dim hProcHandle As Long
hProcHandle = OpenProcess(PROCESS_ALL_ACCESS, False, pe32.th32ProcessID)
Call TerminateProcess(hProcHandle, 0)
Call CloseHandle(hProcHandle)
End If
bFoundProc = Process32Next(hSnapshot, pe32)
DoEvents
Loop
Call CloseHandle(hSnapshot)
End Sub |
| Code: | Private Sub Timer1_Timer()
'//
'// Monitor Processes
'//
Call ProcessScan
End Sub |
I removed the terminate API etc, but it did work (closing the process). The only thing I dont understand is the second code part. The thing I want to know is how do I write a value to the pointer of it. I can change the calc.exe to mono.dll, but what about the pointer? How to I write the value to it? Man, I think I'm so close. Thank you for your comments. I will check out that link. This the code I have now:
| Code: | Public Const PROCESS_ALL_ACCESS = &H1F0FFF
Dim f1holder As Integer
Dim timer_pos As Long
Private Const MAX_PATH = 260
Private Const TH32CS_SNAPPROCESS = &H2
'//
'// Process Entry Type
'//
Private Type PROCESSENTRY32
dwSize As Long
cntUsage As Long
th32ProcessID As Long
th32DefaultHeapID As Long
th32ModuleID As Long
cntThreads As Long
th32ParentProcessID As Long
pcPriClassBase As Long
dwFlags As Long
szexeFile As String * MAX_PATH
End Type
Private Declare Function CreateToolhelp32Snapshot Lib "kernel32" (ByVal lFlags As Long, ByVal lProcessID As Long) As Long
Private Declare Function Process32First Lib "kernel32" (ByVal hSnapshot As Long, lppe As Any) As Long
Private Declare Function Process32Next Lib "kernel32" (ByVal hSnapshot As Long, lppe As Any) As Long
Private Declare Function TerminateProcess Lib "kernel32" (ByVal hProcess As Long, ByVal uExitCode As Long) As Long
Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As Long, lpdwProcessId As Long) As Long
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Long, ByVal bInheritHandle As Long, ByVal dwProcessId As Long) As Long
Public Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Long) As Long
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) As Long
Public Declare Function GetKeyPress Lib "user32" Alias "GetAsyncKeyState" (ByVal key As Long) As Integer
Public Declare Function ReadProcessMem Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Long, ByVal lpBaseAddress As Any, ByRef lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
'//============================================================================
'// @Function: ProcessScan
'// @Params : None
'// @Returns : None
'// @Purpose : Scans for calc.exe in the process list and if found,
'// terminates the running instance.
'//============================================================================
Public Sub ProcessScan()
Dim pe32 As PROCESSENTRY32
Dim hSnapshot As Long
Dim bFoundProc As Boolean
pe32.dwSize = Len(pe32)
hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
bFoundProc = Process32First(hSnapshot, pe32)
Do While bFoundProc
If Right$(LCase$(Left$(pe32.szexeFile, InStr(1, pe32.szexeFile, Chr(0)) - 1)), Len("calc.exe")) = LCase$("calc.exe") Then
'// Found calc.exe, terminating.
Dim hProcHandle As Long
hProcHandle = OpenProcess(PROCESS_ALL_ACCESS, False, pe32.th32ProcessID)
End If
bFoundProc = Process32Next(hSnapshot, pe32)
DoEvents
Loop
Call CloseHandle(hSnapshot)
End Sub
Public Function WriteAByte(gamewindowtext As String, address As Long, value As Byte)
Dim hWnd As Long
Dim pid As Long
Dim phandle As Long
hWnd = FindWindow(vbNullString, gamewindowtext)
If (hWnd = 0) Then
'MsgBox "The Game Is Not Working", vbCritical, "Error"
'End
Exit Function
End If
GetWindowThreadProcessId hWnd, pid
phandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If (phandle = 0) Then
'MsgBox "Can't get ProcessId", vbCritical, "Error"
Exit Function
End If
WriteProcessMemory phandle, address, value, 1, 0&
CloseHandle hProcess
End Function
Public Function WriteAnInt(gamewindowtext As String, address As Long, value As Integer)
Dim hWnd As Long
Dim pid As Long
Dim phandle As Long
hWnd = FindWindow(vbNullString, gamewindowtext)
If (hWnd = 0) Then
MsgBox "The Game Is Not Working", vbCritical, "Error"
End
End If
GetWindowThreadProcessId hWnd, pid
phandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If (phandle = 0) Then
MsgBox "Can't get ProcessId", vbCritical, "Error"
Exit Function
End If
WriteProcessMemory phandle, address, value, 2, 0&
CloseHandle hProcess
End Function
Public Function WriteALong(gamewindowtext As String, address As Long, value As Long)
Dim hWnd As Long
Dim pid As Long
Dim phandle As Long
hWnd = FindWindow(vbNullString, gamewindowtext)
If (hWnd = 0) Then
'MsgBox "The Game Is Not Working", vbCritical, "Error"
'End
Exit Function
End If
GetWindowThreadProcessId hWnd, pid
phandle = OpenProcess(PROCESS_ALL_ACCESS, False, pid)
If (phandle = 0) Then
'MsgBox "Can't get ProcessId", vbCritical, "Error"
Exit Function
End If
WriteProcessMemory phandle, address, value, 4, 0&
CloseHandle hProcess
End Function
|
So instead of terminating the process I want to know how to write a new value to the "mono.dll"+0011EE684 on this part:
| Code: | Private Sub Timer1_Timer()
'//
'// Monitor Processes
'//
Call ProcessScan
End Sub |
|
|
| Back to top |
|
|
Studio80
Advanced Cheater
![]() Reputation: 2
Joined: 12 Sep 2012
Posts: 83
|
| Posted: Thu Sep 13, 2012 1:51 pm Post subject: |
|
|
Also the DLL file doesn't show up in taskbar, Wiccaan I have used your tool but the the value returns always 0 when I enter the mono.dll 
|
|
| Back to top |
|
|
Pingo
Grandmaster Cheater
![]() Reputation: 8
Joined: 12 Jul 2007
Posts: 571
|
| Posted: Thu Sep 13, 2012 2:37 pm Post subject: |
|
|
| Studio80 wrote: | | Also the DLL file doesn't show up in taskbar, Wiccaan I have used your tool but the the value returns always 0 when I enter the mono.dll |
You'l need to get the process (.exe) and loop the process modules to
get mono.dll base then add &H11EE684 to it.
Thats for the base though, you'l still need to make a function for multi level pointers.
_________________
|
|
| Back to top |
|
|
Studio80
Advanced Cheater
![]() Reputation: 2
Joined: 12 Sep 2012
Posts: 83
|
| Posted: Thu Sep 13, 2012 3:05 pm Post subject: |
|
|
| Well thats the whole problem, I have no clue on how to achieve that. I guess I was looking in the wrong direction when I thought I could do it with the template I have now. Thats the problem if you don't know where to start or where to look for help
|
|
| Back to top |
|
|
Pingo
Grandmaster Cheater
![]() Reputation: 8
Joined: 12 Jul 2007
Posts: 571
|
| Posted: Fri Sep 14, 2012 1:34 am Post subject: |
|
|
I can probably help you further with it. Iv never coded in vb6, the syntax looks alittle different but i might beable to help with the code.
I'll code up some functions so we can update your memory class.
Fingers crossed it works.
_________________
|
|
| Back to top |
|
|
atom0s
Moderator
Reputation: 205
Joined: 25 Jan 2006
Posts: 8588
Location: 127.0.0.1
|
| Posted: Fri Sep 14, 2012 5:08 am Post subject: |
|
|
You need to adjust the code from the toolkit I posted to suite your needs.
Such as the code you posted for ProcessScan is still looking for Calc.exe
I really recommend you look into learning another language as well. VB6 is long gone and dead.
_________________
- Retired. |
|
| Back to top |
|
|
Studio80
Advanced Cheater
![]() Reputation: 2
Joined: 12 Sep 2012
Posts: 83
|
| Posted: Fri Sep 14, 2012 9:56 am Post subject: |
|
|
I agree with both of you. VB6.0 is really outdated. I knew some VB.NET longtime ago but I think I all forgot about it. And also when it comes out to programming you can go in all directions like database, gfx, algo's/encryptions, memory hacking. Thats the problem if you want to start there isn't really a good book that pushes you into the right direction.
I have made an another topic about a VB.NET template. That one works but I cannot read from the pointer
If I succeed with this I'm going to start a short game hacking tutorial series for beginners.
forum.cheatengine.org/viewtopic.php?t=557211
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
