Weist du überhaupt wie du Warden später umgehen willst.
PHP Code:
#include-once
#Region CONSTANTS
Const $PROCESS_ALL_ACCESS = 0x1F0FFF
Const $PROCESS_SUSPEND_RESUME = 0x0800
Const $PROCESS_TERMINATE = 0x0001
Const $PROCESS_VM_OPERATION = 0x0008
Const $PROCESS_VM_READ = 0x0010
Const $PROCESS_VM_WRITE = 0x0020
Const $SYNCHRONIZE = 0x00100000
#EndRegion
Global $m_Kernel32, $m_User32
Global $m_IsInitialized = False
;-------------------------------------------------
; _BMInitialize()
;-------------------------------------------------
; Desc: This function needs to be called before
; using any other functions contained in
; this UDF.
;-------------------------------------------------
Func _BMInitialize()
$m_Kernel32 = DllOpen("kernel32.dll")
If $m_Kernel32 = -1 Then
MsgBox(0x10, "Error Opening Kernel32.dll", "Could not open Kernel32.dll")
Return
EndIf
$m_User32 = DllOpen("user32.dll")
If $m_User32 = -1 Then
MsgBox(0x10, "Error Opening User32.dll", "Could not open User32.dll")
Return
EndIf
__SetPrivilege("SeDebugPrivilege", 1)
$m_IsInitialized = True
EndFunc ;End _BMInitialize
;-------------------------------------------------
; _BMDispose()
;-------------------------------------------------
; Desc: This function should be called after the
; user is done with the functions in this
; UDF.
;-------------------------------------------------
Func _BMDispose()
If $m_Kernel32 <> -1 Then DllClose($m_Kernel32)
If $m_User32 <> -1 Then DllClose($m_User32)
$m_IsInitialized = False
EndFunc ;End _BMDispose
;-------------------------------------------------
; _BMOpenProcess()
;-------------------------------------------------
; Desc: This should be called before manipulating
; the process' memory.
;-------------------------------------------------
Func _BMOpenProcess($PID, $UsePID = True, $AccessRights = $PROCESS_ALL_ACCESS)
If Not $m_IsInitialized Then
SetError(1)
Return 0
EndIf
Local $l_ret
If Not $UsePID Then
Local $l_hWnd = $PID
$l_ret = DllCall($m_User32, "dword", "GetWindowThreadProcessId", "hwnd", $l_hWnd, "dword*", 0)
If Not @error Then
$PID = $l_ret[2]
If $PID = 0 Then
MsgBox(0x10, "Null Process ID", "Start WoW before starting NinjaSkid!")
Return 0
EndIf
Else
MsgBox(0x10, "Error Getting ProcessId", "Could not obtain the ID of the process in question.")
Return 0
EndIf
EndIf
Local $l_hProcess
$l_ret = DllCall($m_Kernel32, "ptr", "OpenProcess", "dword", $AccessRights, "int", 0, "dword", $PID)
If Not @error Then
$l_hProcess = $l_ret[0]
If $l_hProcess = 0 Then
MsgBox(0x10, "Null Process Handle", "The process handle obtained is null.")
Return 0
EndIf
Else
MsgBox(0x10, "Error Getting Process Handle", "Could not obtain a handle to the process in question.")
Return 0
EndIf
Return $l_hProcess
EndFunc
;-------------------------------------------------
; _BMCloseHandle()
;-------------------------------------------------
; Desc: This should be called on the handle that
; is returned by _BMOpenProcess().
;-------------------------------------------------
Func _BMCloseHandle($Handle)
If $m_IsInitialized Then
DllCall($m_Kernel32, "dword", "CloseHandle", "ptr", $Handle)
EndIf
EndFunc
#Region Read Memory
Func _BMReadRawMemory($Handle, $Address, ByRef $Struct)
If Not $m_IsInitialized Then
SetError(1)
Return 0
EndIf
If DllStructGetPtr($Struct) = 0 Or DllStructGetSize($Struct) = 0 Then
SetError(2)
Return 0
EndIf
Local $l_ret
$l_ret = DllCall($m_Kernel32, "int", "ReadProcessMemory", _
"ptr", $Handle, _
"dword", $Address, _
"ptr", DllStructGetPtr($Struct), _
"dword", DllStructGetSize($Struct), _
"dword*", 0)
If @error Then
$l_Buffer = 0
MsgBox(0x10, "ReadProcessMemory Error", "Could not read process' memory.")
SetError(3)
Return 0
EndIf
Return 1
EndFunc
Func _BMReadMemory($Handle, $Address, $Type)
If Not $m_IsInitialized Then
SetError(1)
MsgBox(0x10, "Success!!!!", "Error1")
Return 0
EndIf
Local $l_Buffer = DllStructCreate($Type)
;MsgBox(0x10, "OH NO!")
_BMReadRawMemory($Handle, $Address, $l_Buffer)
If @error Then
$l_Buffer = 0
SetError(2 + BitShift(@error, -16))
MsgBox(0x10, "Success!!!!", "Error2")
Return 0
EndIf
Local $l_Ret = DllStructGetData($l_Buffer, 1)
$l_Buffer = 0
Return $l_Ret
EndFunc
Func _BMReadBytes($Handle, $Address, $Length)
If Not $m_IsInitialized Then
SetError(1)
MsgBox(0x10, "Success!!!!", "Error1b")
Return 0
EndIf
Local $l_Buffer = DllStructCreate("ubyte[" & $Length & "]")
_BMReadRawMemory($Handle, $Address, $l_Buffer)
If @error Then
$l_Buffer = 0
SetError(2 + BitShift(@error, -16))
MsgBox(0x10, "Success!!!!", "Error2b")
Return 0
EndIf
Dim $l_ret[$Length]
For $i = 1 To UBound($l_ret)
$l_ret[$i - 1] = DllStructGetData($l_Buffer, 1, $i)
Next
$l_Buffer = 0
Return $l_ret
EndFunc
Func _BMReadASCIIString($Handle, $Address, $Length)
Local $l_Ret = _BMReadMemory($Handle, $Address, "char[" & $Length & "]")
Return $l_Ret ;Maybe check for occurrence of \0 and autotrim?
EndFunc
Func _BMReadUnicodeString($Handle, $Address, $Length)
Return _BMReadMemory($Handle, $Address, "wchar[" & $Length & "]")
EndFunc
Func _BMReadDouble($Handle, $Address)
Return _BMReadMemory($Handle, $Address, "double")
EndFunc
Func _BMReadFloat($Handle, $Address)
$returnValue = _BMReadMemory($Handle, $Address, "float")
if IsFloat($ReturnValue) then
Return $returnValue
EndIf
msgbox(0x10,"","isfloat failed")
EndFunc
Func _BMReadUInt($Handle, $Address)
$returnValue = _BMReadMemory($Handle, $Address, "uint")
if IsInt($ReturnValue) then
Return $returnValue
EndIf
msgbox(0x10,"","isint failed on uint")
EndFunc
Func _BMReadInt($Handle, $Address)
$returnValue = _BMReadMemory($Handle, $Address, "int")
if IsInt($ReturnValue) then
Return $returnValue
EndIf
msgbox(0x10,"","isint failed")
EndFunc
Func _BMReadUShort($Handle, $Address)
Return _BMReadMemory($Handle, $Address, "ushort")
EndFunc
Func _BMReadShort($Handle, $Address)
Return _BMReadMemory($Handle, $Address, "short")
EndFunc
Func _BMReadUByte($Handle, $Address)
Return _BMReadMemory($Handle, $Address, "ubyte")
EndFunc
Func _BMReadByte($Handle, $Address)
Return _BMReadMemory($Handle, $Address, "byte")
EndFunc
#EndRegion
#Region Write Memory
Func _BMWriteRawMemory($Handle, $Address, ByRef $Struct)
If Not $m_IsInitialized Then
SetError(1)
Return False
EndIf
If DllStructGetPtr($Struct) = 0 Or DllStructGetSize($Struct) = 0 Then
SetError(2)
Return False
EndIf
Local $l_ret
$l_ret = DllCall($m_Kernel32, "int", "WriteProcessMemory", _
"ptr", $Handle, _
"dword", $Address, _
"ptr", DllStructGetPtr($Struct), _
"dword", DllStructGetSize($Struct), _
"dword*", 0)
If @error Then
MsgBox(0x10, "WriteProcessMemory Error", "Could not write to process' memory.")
SetError(3)
Return False
EndIf
Return ($l_ret[0] <> 0)
EndFunc
Func _BMWriteMemory($Handle, $Address, $Value, $Type)
If Not $m_IsInitialized Then
SetError(1)
Return False
EndIf
Local $l_Buffer = DllStructCreate($Type)
DllStructSetData($l_Buffer, 1, $Value)
Local $l_ret = _BMWriteRawMemory($Handle, $Address, $l_Buffer)
If @error Or $l_ret = 0 Then
$l_Buffer = 0
SetError(2 + BitShift(@error, -16))
Return False
EndIf
Return $l_ret
EndFunc
Func _BMWriteBytes($Handle, $Address, $ByteArray)
If Not $m_IsInitialized Then
SetError(1)
Return False
EndIf
If Not IsArray($ByteArray) Then
SetError(2)
Return False
EndIf
Local $l_Buffer = DllStructCreate("ubyte[" & UBound($ByteArray) & "]")
For $i = 1 To UBound($ByteArray)
DllStructSetData($l_Buffer, $i, $ByteArray[$i - 1])
Next
Local $l_ret = _BMWriteRawMemory($Handle, $Address, $l_Buffer)
$l_Buffer = 0
Return $l_ret
EndFunc
Func _BMWriteDouble($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "double")
EndFunc
Func _BMWriteFloat($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "float")
EndFunc
Func _BMWriteUInt($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "dword")
EndFunc
Func _BMWriteInt($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "int")
EndFunc
Func _BMWriteUShort($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "ushort")
EndFunc
Func _BMWriteShort($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "short")
EndFunc
Func _BMWriteUByte($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "ubyte")
EndFunc
Func _BMWriteByte($Handle, $Address, $Value)
Return _BMWriteMemory($Handle, $Address, $Value, "byte")
EndFunc
#EndRegion
;==================================================================================
; Function: SetPrivilege( $privilege, $bEnable )
; Description: Enables (or disables) the $privilege on the current process
; (Probably) requires administrator privileges to run
;
; Author(s): Larry (from autoitscript.com's Forum)
; Notes(s):
; http://www.autoitscript.com/forum/index.php?s=&showtopic=31248&view=findpost&p=223999
;==================================================================================
Func __SetPrivilege( $privilege, $bEnable )
Const $MY_TOKEN_ADJUST_PRIVILEGES = 0x0020
Const $MY_TOKEN_QUERY = 0x0008
Const $MY_SE_PRIVILEGE_ENABLED = 0x0002
Local $hToken, $SP_auxret, $SP_ret, $hCurrProcess, $nTokens, $nTokenIndex, $priv
$nTokens = 1
$LUID = DLLStructCreate("dword;int")
If IsArray($privilege) Then $nTokens = UBound($privilege)
$TOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
$NEWTOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
$hCurrProcess = DLLCall("kernel32.dll","hwnd","GetCurrentProcess")
$SP_auxret = DLLCall("advapi32.dll","int","OpenProcessToken","hwnd",$hCurrProcess[0], _
"int",BitOR($MY_TOKEN_ADJUST_PRIVILEGES,$MY_TOKEN_QUERY),"int*",0)
If $SP_auxret[0] Then
$hToken = $SP_auxret[3]
DLLStructSetData($TOKEN_PRIVILEGES,1,1)
$nTokenIndex = 1
While $nTokenIndex <= $nTokens
If IsArray($privilege) Then
$priv = $privilege[$nTokenIndex-1]
Else
$priv = $privilege
EndIf
$ret = DLLCall("advapi32.dll","int","LookupPrivilegeValue","str","","str",$priv, _
"ptr",DLLStructGetPtr($LUID))
If $ret[0] Then
If $bEnable Then
DLLStructSetData($TOKEN_PRIVILEGES,2,$MY_SE_PRIVILEGE_ENABLED,(3 * $nTokenIndex))
Else
DLLStructSetData($TOKEN_PRIVILEGES,2,0,(3 * $nTokenIndex))
EndIf
DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,1),(3 * ($nTokenIndex-1)) + 1)
DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,2),(3 * ($nTokenIndex-1)) + 2)
DLLStructSetData($LUID,1,0)
DLLStructSetData($LUID,2,0)
EndIf
$nTokenIndex += 1
WEnd
$ret = DLLCall("advapi32.dll","int","AdjustTokenPrivileges","hwnd",$hToken,"int",0, _
"ptr",DllStructGetPtr($TOKEN_PRIVILEGES),"int",DllStructGetSize($NEWTOKEN_PRIVILEGES), _
"ptr",DllStructGetPtr($NEWTOKEN_PRIVILEGES),"int*",0)
$f = DLLCall("kernel32.dll","int","GetLastError")
EndIf
$NEWTOKEN_PRIVILEGES=0
$TOKEN_PRIVILEGES=0
$LUID=0
If $SP_auxret[0] = 0 Then Return 0
$SP_auxret = DLLCall("kernel32.dll","int","CloseHandle","hwnd",$hToken)
If Not $ret[0] And Not $SP_auxret[0] Then Return 0
return $ret[0]
EndFunc ;==>SetPrivilege