PHP Code:
Func cek_rep($PROCESS_ID)
;Declare local variables
Local $pRemoteThread, $vBuffer, $loop, $result, $OPcode, $processHandle, $packetAddress, $functionSize, $QuestFunctionAddress, $PlayerOffSet, $QuestFunctionOffset, $QuestId, $returnValue
$functionSize = '100'
$QuestFunctionAddress = '0x0073D780'
$QuestFunctionOffset = '0x1058'
$PlayerOffSet = '0x34'
$QuestId = '53762'
;Open process for given processId
$processHandle = $PROCESS_INFORMATION[1]
;Allocate memory for the OpCode and retrieve address for this
$functionAddress = DllCall($KERNEL32, 'int', 'VirtualAllocEx', 'int', $processHandle, 'int', 0, 'int', 0x4, 'int', 0x1000, 'int', 0x40)
;Allocate memory for the packet to be sent and retrieve the address for this
$packetAddress = DllCall($KERNEL32, 'VirtualAllocEx', 'int', $processHandle, 'int', 0, 'int', $functionSize, 'int', 0x1000, 'int', 0x40)
$OPcode &= '60' ;PUSHAD
$OPcode &= 'B8'&_hex($QuestFunctionAddress) ;MOV EAX, questFunction
$OPcode &= '8B0D'&_hex($APP_BASE_ADDRESS) ;MOV ECX, DWORD PTR [baseAddress]
$OPcode &= '8B491C' ;MOV ECX, DWORD PTR [ECX+1C]
$OPcode &= '8B49'&_hex($PlayerOffSet) ;MOV ECX, DWORD PTR [ECX+playerOffSet]
$OPcode &= '8B89'&_hex($QuestFunctionOffset) ;MOV ECX, DWORD PTR [ECX+questFuncOffset]
$OPcode &= '68'&_hex($QuestId) ;PUSH questId
$OPcode &= 'FFD0' ;CALL NEAR EAX
$OPcode &= 'A3'&_hex($functionAddress) ;MOV DWORD PTR [returnAddress], EAX
$OPcode &= '61' ;POPAD
$OPcode &= 'C3' ;RET
;Put the OpCode into a struct for later memory writing
$vBuffer = DllStructCreate('byte[' & StringLen($OPcode) / 2 & ']')
For $loop = 1 To DllStructGetSize($vBuffer)
DllStructSetData($vBuffer, 1, Dec(StringMid($OPcode, ($loop - 1) * 2 + 1, 2)), $loop)
Next
;Write the OpCode to previously allocated memory
DllCall($KERNEL32, 'int', 'WriteProcessMemory', 'int', $processHandle, 'int', $functionAddress[0], 'int', DllStructGetPtr($vBuffer), 'int', $functionSize, 'int *', 0)
;Create a remote thread in order to run the OpCode
$hRemoteThread = DllCall($KERNEL32, 'int', 'CreateRemoteThread', 'int', $processHandle, 'int', 0, 'int', 0, 'int', $functionAddress, 'int', 0, 'int', 0, 'int', 0)
;Wait for the remote thread to finish
Do
$result = DllCall('kernel32.dll', 'int', 'WaitForSingleObject', 'int', $hRemoteThread[0], 'int', 50)
;"WaitForSingleObject", int,hThrd, int,50
Until $result[0] <> 258
;Close the handle to the previously created remote thread
DllCall($KERNEL32, 'int', 'CloseHandle', 'int', $hRemoteThread[0])
;Free the previously allocated memory
DllCall($KERNEL32, 'ptr', "VirtualFreeEx", "int", $processHandle, "int", $functionAddress, "int", 0, "int", 0x8000)
$returnValue = _MemoryRead($functionAddress, $PROCESS_ID)
Return $returnValue
EndFunc
These functions using procedures adopted from checkQuestPresentWQBOT function. I tried to check whether the quest with id:53762 active or not. But when I try to run the function that happens is elementclient going crash.
Did I forget something.?
Btw, that quest id is only in private servers (ko2w-Ultimate and h2w-Revo) :rolleyes:.
