Cheat Engine

dnsi0

Don't Flame.
This program I made is suppose to be able to create a exe from the process in the memory that is identical to it.
I have included the program here.

So It basically loops through the memory and stores it into a byte array then saving it later. But after I checked the binary of the file I discover that the file length is different between the 2 files and some bytes are corrupt.

This is made in visual basic. So see if you can get this to work.

Oh sorry forgot to include source...

Flyte · Posted: Wed Jul 30, 2008 2:04 pm Post subject:

It's because the PE loader has to fix the imports, fix relocation (if there is any) and align the sections. The .exe in the process is no where near the same as the image on disk.

In order to make a dump of the process you have to reverse all of those operations.

dnsi0 · Posted: Wed Jul 30, 2008 2:46 pm Post subject:

Hmm. Guess I excluded alot of those things.Cause I only compared the first like 10 bytes... o.o

Flyte · Posted: Wed Jul 30, 2008 2:51 pm Post subject:

dnsi0 · Posted: Wed Jul 30, 2008 3:00 pm Post subject:

Yea the THis cannot be run under dos thingy.

Ksbunker · Posted: Wed Jul 30, 2008 5:30 pm Post subject: re:

Easiest way would be to use MapFileAndCheckSumA (in imagehlp.dll)... what this does is compute a checksum using the array of bytes from the .TEXT (i.e. the code) section.

Once you have this dword, you can read the PE Header offset CheckSum, whose checksum is calculated using the same API that you just used (i.e. MapFileAndCheckSum). If there's a difference, modfied, if same, perfect.

To obtain the dword from PE header, its as simple as (assuming eax=imagebase);