| View previous topic :: View next topic |
| Author |
Message |
tanjiajun_34 Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006 Posts: 786 Location: Singapore
|
Posted: Wed Jan 20, 2010 2:46 am Post subject: Coding Delphi DLL Trainer |
|
|
I only have idea about creating a exe.
Do we still use read or writeprocessmemory like exe?
|
|
| Back to top |
|
 |
Slugsnack Grandmaster Cheater Supreme
Reputation: 71
Joined: 24 Jan 2007 Posts: 1857
|
Posted: Wed Jan 20, 2010 5:20 am Post subject: |
|
|
| no once your dll is in the target's memory space you have direct access to its memory
|
|
| Back to top |
|
 |
tanjiajun_34 Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006 Posts: 786 Location: Singapore
|
Posted: Wed Jan 20, 2010 5:58 am Post subject: |
|
|
| How to code to make my dll read and write own memory then?
|
|
| Back to top |
|
 |
Stylo Grandmaster Cheater Supreme
Reputation: 3
Joined: 16 May 2007 Posts: 1073 Location: Israel
|
Posted: Wed Jan 20, 2010 7:17 am Post subject: |
|
|
use the asm keyword to execute assembler code that edits the memory of the current process
that's one way
|
|
| Back to top |
|
 |
tanjiajun_34 Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006 Posts: 786 Location: Singapore
|
Posted: Wed Jan 20, 2010 8:48 pm Post subject: |
|
|
If you inject to dll to a gamguard game example sa or gb.
Then, will you be able to bypass the ring0 hooks thingy?
And also how to write to the pointed addresses using asm?
I tried a lot of methods........
Note:I used 00400000 as pointer address. 100 as offset. And the value I wanted it to change to is 1.
Method 1 (Got access violation error, no effect too)
| Code: | mov eax, dword [$00400000]
mov byte ptr [eax+$100],$1 |
Method 2 (No error, no effect too....)
| Code: | procedure TForm1.Button5Click(Sender: TObject);
var
back:dword;
begin
asm
mov eax, dword [$00400000]
mov dword [back], eax
end;
back:=dword(back+$100);
asm
mov byte ptr [back],$1
end;
end; |
Method 3 (Got access violation error, no effect too)
| Code: | mov eax, dword [$00400000]
lea ebx, [eax+$100]
mov byte ptr [ebx],$1 |
Method 4 (Got access violation error, no effect)
| Code: | mov eax, dword [$00400000]
mov ecx, $100
lea ebx, [eax+ecx]
mov byte ptr [ebx],$1 |
Method 5 (Got access violation, no effect)
| Code: | mov eax,dword [$00400000]
add eax,$100
mov byte ptr [eax],$1 |
|
|
| Back to top |
|
 |
Hologram How do I cheat?
Reputation: 0
Joined: 07 Jan 2010 Posts: 8
|
Posted: Fri Jan 22, 2010 1:31 pm Post subject: |
|
|
If you mean you can access your value this way:
[[00400000] + 100]
than try following:
| Code: |
var
pb: PBYTE;
const
addr = $00400000;
offset = 100;
begin
pb := PBYTE(DWORD(addr^) + offset);
pb^ := 1;
|
assuming your value is type of Byte
|
|
| Back to top |
|
 |
tanjiajun_34 Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006 Posts: 786 Location: Singapore
|
Posted: Fri Jan 22, 2010 11:34 pm Post subject: |
|
|
I changed to
| Code: | var
pb: PBYTE;
const
addr = $00400000;
offset = 100;
begin
pb := PBYTE(DWORD(pointer(addr)^) + offset);
pb^ := 1;
end; |
And try but access violation no effect.
|
|
| Back to top |
|
 |
hcavolsdsadgadsg I'm a spammer
Reputation: 26
Joined: 11 Jun 2007 Posts: 5801
|
|
| Back to top |
|
 |
Hologram How do I cheat?
Reputation: 0
Joined: 07 Jan 2010 Posts: 8
|
Posted: Sat Jan 23, 2010 4:56 am Post subject: |
|
|
...or the shorthand PBYTE(PDWORD($00400000)^ + 100)^ := 1;
if it doesn't work than it seems you don't have the right address-offset pair
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 474
Joined: 09 May 2003 Posts: 25952 Location: The netherlands
|
Posted: Sat Jan 23, 2010 7:30 am Post subject: |
|
|
perhaps it's giving an access violation because the pointer you are giving is just wrong ?
00400000 contains a pointer to a valid address? I really doubt it
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
tanjiajun_34 Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006 Posts: 786 Location: Singapore
|
Posted: Sun Jan 24, 2010 3:46 am Post subject: |
|
|
| Dark Byte wrote: | perhaps it's giving an access violation because the pointer you are giving is just wrong ?
00400000 contains a pointer to a valid address? I really doubt it |
Oh I am just using the address to test. Dunno if it is correct. I just thought I add address in ce and it points to some address with a value means ok... But I tried reading the value of the pointed address is ok. It is just writing I having problems.
Edit: Solved. DB is right.
Also other question
If you inject to dll to a gamguard game example sa or gb.
Then, will you be able to bypass the ring0 hooks thingy?
|
|
| Back to top |
|
 |
|