Cheat Engine :: View topic - Detecting Valid PE Files

Cheat Engine
The Official Site of Cheat Engine

FAQ

Memberlist

Usergroups

Profile

Detecting Valid PE Files
Goto page Previous 1, 2

Cheat Engine Forum Index -> General programming

View previous topic :: View next topic

Author

Message

sponge
I'm a spammer

Reputation: 1

Joined: 07 Nov 2006
Posts: 6009

Posted: Sun Jul 20, 2008 11:54 pm Post subject:

oib111 wrote:

I'm actually reading various things, and if you haven't noticed, Iczelion is for assembly, which I don't really know at all (I know like mov, cmp, jmp Laughing

the api names are right there. the rest are basic mnemonics which you have listed. theres even macros. if/else shit.
_________________

oib111
I post too much

Reputation: 0

Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?

Posted: Mon Jul 21, 2008 12:02 pm Post subject:

I finalized my code, and I'm getting errors, about how it can't convert from LPVOID to IMAGE_DOS_HEADER and to IMAGE_NT_HEADERS which then makes it so that e_magic, e_lfanew, and Signature don't have a structure behind them, they're just there.
_________________

8D wrote:

cigs dont make people high, which weed does, which causes them to do bad stuff. like killing

UnLmtD
Grandmaster Cheater

Reputation: 0

Joined: 13 Mar 2007
Posts: 894
Location: Canada

Posted: Mon Jul 21, 2008 1:40 pm Post subject:

Flyte wrote:

For fuck sakes oib, I gave you a perfectly good tutorial outlining everything from start to finish (Iczelion) and you still just can't read the fucking thing. Stop asking for handouts, stop asking for help, and use google or read a fucking tutorial for a change! In fact half of this shit is common sense, and you wouldn't even be having these problems if you actually did everything yourself without asking someone for fucking permission first.

FUUUUUUUUUUCCCCKKKKKKKKKKKKKKKK

Reminds me of Penn & Teller, especially the last line. Smile

_________________

oib111
I post too much

Reputation: 0

Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?

Posted: Mon Jul 21, 2008 11:38 pm Post subject:

UnLmtD wrote:

Flyte wrote:

Reminds me of Penn & Teller, especially the last line. Smile

o.o? Pen and Teller? And anyway to get this so that it can convert LPVOID to IMAGE_DOS_HEADER and IMAGE_NT_HEADERS or do it a different way?
_________________

8D wrote:

cigs dont make people high, which weed does, which causes them to do bad stuff. like killing

Zand
Master Cheater

Reputation: 0

Joined: 21 Jul 2006
Posts: 424

Posted: Tue Jul 22, 2008 1:10 am Post subject:

Try typecast?

oib111
I post too much

Reputation: 0

Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?

Posted: Tue Jul 22, 2008 1:25 am Post subject:

Zand wrote:

Try typecast?

oib111 wrote:

x0r wrote:

Here's a quick example I coded:

Code:

#include <stdio.h>
#include <windows.h>
#include <Dbghelp.h>

ULONG_PTR GetImageBase(__in LPCWSTR lpFileName)
{
PIMAGE_NT_HEADERS pImageNtHeaders;
HANDLE hFile, hFileMapping;
LPVOID lpBaseAddress;
ULONG_PTR ulImageBase = 0;

hFile = CreateFile(lpFileName, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
if (hFile != INVALID_HANDLE_VALUE)
{
hFileMapping = CreateFileMapping(hFile, NULL, PAGE_READONLY|SEC_IMAGE, 0, 0, NULL);
if (hFileMapping != NULL)
{
lpBaseAddress = MapViewOfFile(hFileMapping, FILE_MAP_READ, 0, 0, 0);
if (lpBaseAddress != NULL)
{
pImageNtHeaders = ImageNtHeader(lpBaseAddress);
if (pImageNtHeaders != NULL)
ulImageBase = pImageNtHeaders->OptionalHeader.ImageBase;
UnmapViewOfFile(lpBaseAddress);
}
CloseHandle(hFileMapping);
}
CloseHandle(hFile);
}
return ulImageBase;
}

int __cdecl wmain(int argc, wchar_t* argv[], wchar_t* envp[])
{
UNREFERENCED_PARAMETER(envp);

if (argc == 2)
{
wprintf(L"ImageBase for %s is: 0x%016X", argv[1], GetImageBase(argv[1]));
return EXIT_SUCCESS;
}
else
{
fwprintf(stderr, L"You fucked it up, you fucking idiot.");
return EXIT_FAILURE;
}
}

NOTE: x64 compliant.

Thank you so much x0r! Btw, where do you learn these APIs o.O
_________________

8D wrote:

cigs dont make people high, which weed does, which causes them to do bad stuff. like killing

Symbol
I'm a spammer

Reputation: 0

Joined: 18 Apr 2007
Posts: 5094
Location: Israel.

Posted: Tue Jul 22, 2008 3:13 am Post subject:

Learn APIs...? In time you'll know more and more APIs.

rapion124
Grandmaster Cheater Supreme

Reputation: 0

Joined: 25 Mar 2007
Posts: 1095

Posted: Tue Jul 22, 2008 6:14 am Post subject:

When in doubt, MSDN.

oib111
I post too much

Reputation: 0

Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?

Posted: Tue Jul 22, 2008 11:37 am Post subject:

Symbol wrote:

Learn APIs...? Shocked

In time you'll know more and more APIs.

Well I know that. But like, there are these obvious APIs that are never where you would expect, so I can't find them when I'm just trying to figure out where it would be.

EDIT:

I have some code. But the only problem it doesn't work at runtime. Well, it works, but it will think that something that isn't valid, is valid. But I think it's because I can't check for the DOS MZ header first. Is there any function like ImageNtHeaders but instead it pertains to the DOS MZ header (IMAGE_DOS_HEADER)?
_________________

8D wrote:

cigs dont make people high, which weed does, which causes them to do bad stuff. like killing

Display posts from previous:

	Cheat Engine Forum Index -> General programming	All times are GMT - 6 Hours Goto page Previous 1, 2
Page 2 of 2

Jump to:

You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum