Perfect World Bot PWI-Prophet Bot Recoded

Quote:

Originally Posted by vuduy What kind of design are you doing? Keep it simple. Here's a simple design using memory mapped files without any synchronization. The layout of the memory map is as follow: In the DLL, create a memory file mapping of say 64k in size with Code: HANDLE hMap = CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, 64000, "Name"); unsigned int *data = (unsigned int*) MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 64000); *data = command value *(data+1) = base address *(data+2) = send function address *(data+10) = size of byte[] data (data+11) = the start address of byte[] data then in your loop Code: while (1) { if (*data == 99) break; // command 99 = exit thread and unload the DLL if (*data == 1) // send function command { unsigned int base = *(data+1); unsigned int send = *(data+2); unsigned int length = *(data+10); unsigned int *buffer = data+11; __asm { pushad push length push buffer mov eax, base mov edx, [eax] mov ecx, [edx + 0x20] mov esi, send call esi popad ret } *data = 0; } Sleep(5); } From the C#, you create a memory map view: Code: IntPtr hMap = OpenFileMapping(FILE_MAP_ALL_ACCESS, false, "Name"); IntPtr pData = MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 64000); Then, to setup the base address and send address do: Code: Marshal.WriteInt32(pData, 4, baseaddress); Marshal.WriteInt32(pData, 8, sendaddress); To send some opcodes, build the opcodes first (example to select target id): Code: uint targetid = 0x8000000; MemoryStream stream = new MemoryStream(); stream.Write(BitConverter.GetBytes(2), 0, 2); // 02 00 stream.Write(BitConverter.GetBytes(targetid), 0, 4); byte[] data = stream.ToArray(); Marshal.Copy(data, 0, (IntPtr)(pData.ToInt64() + 44), data.Length); // writing the buffer to (data+11) position Marshal.WriteInt32(pData, 40, data.Length); // writing the buffer size to *(data+10) Marshal.WriteInt32(pData, 0, 1) // writing command 1

#pragma managed(push,off)
			void dostuff(){
				HANDLE  hMap = CreateFileMapping(INVALID_HANDLE_VALUE, NULL, PAGE_READWRITE, 0, 64000, TEXT("FileMapping"));
				unsigned int *data = (unsigned int*) MapViewOfFile(hMap, FILE_MAP_ALL_ACCESS, 0, 0, 64000);
				while (true)
				{
					if (*data == 99)  break; // command 99 = exit thread and unload the DLL
					if (*data == 1) // send function command
					{
						unsigned int base = *(data+1);
						unsigned int send = *(data+2);
						unsigned int lengthP = *(data+10);
						unsigned int *buffer = data+11;
						__asm
						{
							pushad;
							push lengthP;
							push buffer;
							mov eax, base;
							mov edx, [eax];
							mov ecx, [edx+0x20];
							mov esi, send;
							call esi;
							popad;
							ret;
						}
						*data = 0;
					}
					Sleep(5);
                            }
		}
#pragma managed(pop)

void FileMappingService::inject(){
		// open process
		HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pID);
		// allocate memory for thread
		LPVOID ThreadCodeAddr = VirtualAllocEx(hProcess, 0, 68096, MEM_COMMIT, PAGE_READWRITE);
		// write the thread function into it
		LPVOID Func = dostuff;
		WriteProcessMemory(hProcess, ThreadCodeAddr, Func, 68096, 0); 
		//start thread
		HANDLE hThread = CreateRemoteThread(hProcess, 0, 0,(LPTHREAD_START_ROUTINE)ThreadCodeAddr, 0, 0, 0); 
		//wait for thread to execute
		WaitForSingleObject(hThread, INFINITE);
		// cleanup
		CloseHandle(hThread);
		VirtualFreeEx(hProcess, ThreadCodeAddr, 68096, MEM_RELEASE);
		CloseHandle(hProcess);
	}

service = new FileMappingService(pID);
                service.inject();

Quote:

Originally Posted by serpentmind Hi Interest07, thanks for your help. The auto follow is now working as expected ^_^