| View previous topic :: View next topic |
| Author |
Message |
kb3z0n
Grandmaster Cheater
![]() Reputation: 0
Joined: 13 Mar 2007
Posts: 542
|
 Posted: Tue Aug 12, 2008 10:28 pm Post subject: Delphi 7 WriteProcessMemory? |
 |
|
Learning to tick ZF, for a godmode for a private server to learn the basics of writeprocessmemory,
looking through the CE source i found
writeprocessmemory(processhandle,pointer(realaddress),addr(write1),1,write);
How would that help to tick ZF? D=
BTW, cant find anything on SetContextThread. |
|
| Back to top |
|
 |
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Tue Aug 12, 2008 11:32 pm Post subject: |
|
|
If you download CE's source it uses SetContextThread. And if you search there is also a thread almost exactly like yours.
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
h4c0r-BG
Master Cheater
 Reputation: 0
Joined: 29 Nov 2006
Posts: 449
Location: The yogurt country
|
| Posted: Wed Aug 13, 2008 5:01 am Post subject: |
|
|
| Code: | ############################################################
############################################################
#### ####
#### Trainer +1 For MTC's Prog Test ####
#### Source Code (Delphi 4) ####
#### Copyright 1999 By CheatMagic ####
#### ####
############################################################
############################################################
Var WindowName : integer;
ProcessId : integer;
ThreadId : integer;
buf : PChar;
HandleWindow : Integer;
write : cardinal;
Const WindowTitle = 'prog test';
Address = $41D090;
PokeValue = $32;
NumberOfBytes = 1;
###########################################################
# (Put the following code inside a command button routine)#
###########################################################
begin
WindowName := FindWindow(nil,WindowTitle);
If WindowName = 0 then
begin
MessageDlg('The game must be running in the background.
Run it now, and then try again.', mtwarning,[mbOK],0);
end;
ThreadId := GetWindowThreadProcessId(WindowName,@ProcessId);
HandleWindow := OpenProcess(PROCESS_ALL_ACCESS,False,ProcessId);
GetMem(buf,1);
buf^ := Chr(PokeValue);
WriteProcessMemory(HandleWindow,ptr(Address),buf,NumberOfBytes,write);
FreeMem(buf);
closehandle(HandleWindow);
end; |
Const WindowTitle = 'prog test'; //change this to the Maple caption
Address = $41D090; // change this to the address of your godmode
PokeValue = $32; // change this to $eb (JMP in ASM)
_________________
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Wed Aug 13, 2008 12:37 pm Post subject: |
|
|
Function:
DeviceIOControl.
Figure out how to use it yourself.
Edit: *Hint* How to use it is in cheatengine's source.
Edit2: And no cheatengine uses DeviceIOControl. |
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Wed Aug 13, 2008 2:03 pm Post subject: |
|
|
| dnsi0 wrote: | Function:
DeviceIOControl.
Figure out how to use it yourself.
Edit: *Hint* How to use it is in cheatengine's source.
Edit2: And no cheatengine uses DeviceIOControl. |
What the fuck...
DeviceIoControl has nothing to do with setting the ZF flag.
DeviceIoControl simply allows you to communicate with a specific device driver.
_________________
|
|
| Back to top |
|
|
kb3z0n
Grandmaster Cheater
![]() Reputation: 0
Joined: 13 Mar 2007
Posts: 542
|
| Posted: Wed Aug 13, 2008 2:07 pm Post subject: |
|
|
| My bad, i never knew D= |
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Wed Aug 13, 2008 2:24 pm Post subject: |
|
|
You coudn't find anything because oib mixed up the API.
It's SetThreadContext, not SetContextThread.
MSDN - SetThreadContext
Btw, "Ticking ZF" is simply setting the Zero Flag (EFLAG) to 1 when that instruction is executed. Each instruction affects certain flags and registers. When a jump occurs the ZF flag is utilized. When you set ZF on something like JNE/JNZ (Jump short if not equal (ZF=0)), it acts as JE/JZ (Jump short if zero (ZF = 1))
If you can memory edit, its easier just to change JNE/JNZ (0x75) to JE/JZ (0x74), via WriteProcessMemory.
_________________
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Wed Aug 13, 2008 2:38 pm Post subject: |
|
|
Yea my bad. The actucal stuff is in the drivers.
| lurc wrote: | You coudn't find anything because oib mixed up the API.
It's SetThreadContext, not SetContextThread.
MSDN - SetThreadContext
Btw, "Ticking ZF" is simply setting the Zero Flag (EFLAG) to 1 when that instruction is executed. Each instruction affects certain flags and registers. When a jump occurs the ZF flag is utilized. When you set ZF on something like JNE/JNZ (Jump short if not equal (ZF=0)), it acts as JE/JZ (Jump short if zero (ZF = 1))
If you can memory edit, its easier just to change JNE/JNZ (0x75) to JE/JZ (0x74), via WriteProcessMemory. |
NO I think hes trying to use it so that you can bypass crcs. So modifing memory causes crc to catch you. |
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Wed Aug 13, 2008 3:07 pm Post subject: |
|
|
That's why I said if you can. 
_________________
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Wed Aug 13, 2008 3:52 pm Post subject: |
|
|
lol if he's trying to do something like this with GG running, I really don't think GG is going to give you debug privileges on MS.
Besides, he mentioned it was for a private server, so I don't think GG's running.
_________________
|
|
| Back to top |
|
|
kb3z0n
Grandmaster Cheater
![]() Reputation: 0
Joined: 13 Mar 2007
Posts: 542
|
| Posted: Wed Aug 13, 2008 3:57 pm Post subject: |
|
|
Yeah, i'm only trying to do it for a private server for now,
http://msdn.microsoft.com/en-us/library/ms680632.aspx
doesn't really help me at all, isn't there any tuts or examples on this?
@h4c0r
Const WindowTitle = 'prog test'; //change this to the Maple caption
Address = $41D090; // change this to the address of your godmode
PokeValue = $32; // change this to $eb (JMP in ASM)
I'm not pro with ASM, so how would i change the pokevalue.
PokeValue = $EB; // ? |
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Wed Aug 13, 2008 4:30 pm Post subject: |
|
|
| kb3z0n wrote: | Yeah, i'm only trying to do it for a private server for now,
http://msdn.microsoft.com/en-us/library/ms680632.aspx
doesn't really help me at all, isn't there any tuts or examples on this?
@h4c0r
Const WindowTitle = 'prog test'; //change this to the Maple caption
Address = $41D090; // change this to the address of your godmode
PokeValue = $32; // change this to $eb (JMP in ASM)
I'm not pro with ASM, so how would i change the pokevalue.
PokeValue = $EB; // ? |
No. JMP in asm is E9.
For delphi you do:
var
bytes:pbytearray;
begin
bytes:=pointer($41D090);
bytes[0]:=$E9
end;
if u get a access violatione rror you need to set the page access to read write. |
|
| Back to top |
|
|
h4c0r-BG
Master Cheater
Reputation: 0
Joined: 29 Nov 2006
Posts: 449
Location: The yogurt country
|
| Posted: Wed Aug 13, 2008 4:33 pm Post subject: |
|
|
kb3z0n, you go to memory view, right click on the address and tick [ZF] (zero flag) am I right?
The private server has no protection so you can do "more powerful/stable" method instead of "ticking ZF" which i shared with you.
At the start of the application you declare as a const values:
WindowTitle = 'prog test'; //name of the program you will hack
Address = $41D090; //the address which you want to "tick ZF"
PokeValue = $EB; //$EB = JMP = should do the job "tick ZF"
NumberOfBytes = 1; //shows how much bytes you will ...
And let me tell you that if it does not work with $EB you will need to do it with $90 (NOP in asm, and it will be 2 bytes if it's short jump  )
Edit1:
dnsi0, wasn't $e9 for long jump and $eb is for short one?
Edit2:
_________________
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Wed Aug 13, 2008 4:47 pm Post subject: |
|
|
| h4c0r-BG wrote: | kb3z0n, you go to memory view, right click on the address and tick [ZF] (zero flag) am I right?
The private server has no protection so you can do "more powerful/stable" method instead of "ticking ZF" which i shared with you.
At the start of the application you declare as a const values:
WindowTitle = 'prog test'; //name of the program you will hack
Address = $41D090; //the address which you want to "tick ZF"
PokeValue = $EB; //$EB = JMP = should do the job "tick ZF"
NumberOfBytes = 1; //shows how much bytes you will ...
And let me tell you that if it does not work with $EB you will need to do it with $90 (NOP in asm, and it will be more than 1 byte but 2 if it's short jump )
Edit1:
dnsi0, wasn't $e9 for long jump and $eb is for short one?
Edit2:
|
Yea I guess your right. Test it in a cheatengine before writing the code. |
|
| Back to top |
|
|
DeletedUser14087
I post too much
![]() Reputation: 2
Joined: 21 Jun 2006
Posts: 3069
|
| Posted: Wed Aug 13, 2008 5:07 pm Post subject: |
|
|
h4c0r-BG, worst example from Torry's EVER!
try this: (Function i wrote for PiN Hunter, to inject PT)
It works by patching 1 byte, which means it overwrites 2 bytes to get
no need Get/FreeMem At All, only WPM that's all (i used GWTID to obtain the id of the process, and OP to obtain the handle, you could juse use Process32First/Next to obtain ID or CreateProcess for the Handle (Without using OP/etc))
| Code: | Procedure InjectPinTyper(Address:Cardinal; nCase:ShortInt); export;
const aInject:Array [0..2] of byte = ($0F, $83, $6C); //Modifies 1 BYTE, 85 to 83
aEject:Array [0..2] of byte = ($0F, $85, $6C);
Access = PROCESS_VM_WRITE or PROCESS_VM_OPERATION;
Begin
hWindow:=FindWindow('MapleStoryClass', nil);
if hWindow<>0 then
case nCase of
1: //Inject PT
Try
GetWindowThreadProcessId(hWindow, @PID);
hProcess:=OpenProcess(Access, FALSE, PID);
WriteProcessMemory(hProcess, Ptr(Address), @aInject, sizeof(aInject), lpBytes);
CloseHandle(hProcess);
except
ShowMessageFmt('GetLastError Code: %.d', [IntToStr(GetLastError())]);
End;
2: //Eject PT
Try
GetWindowThreadProcessId(hWindow, @PID);
hProcess:=OpenProcess(Access, FALSE, PID);
WriteProcessMemory(hProcess, Ptr(Address), @aEject, sizeof(aEject), lpBytes);
CloseHandle(hProcess);
except
ShowMessageFmt('GetLastError Code: %.d', [IntToStr(GetLastError())]);
End;
End;
End; |
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
