PHP Code:
//Conquer.exe+5FE0E8
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Runtime.InteropServices;
using System.Diagnostics;
namespace ConsoleApplication1
{
class Program
{
// 0x009FE0E8
const int PROCESS_VM_WRITE = 0x0020;
const int PROCESS_VM_OPERATION = 0x0008;
const int PROCESS_WM_READ = 0x0010;
[DllImport("kernel32.dll")]
public static extern IntPtr OpenProcess(int dwDesiredAccess,
bool bInheritHandle, int dwProcessId);
[DllImport("kernel32.dll", SetLastError = true)]
static extern bool WriteProcessMemory(int hProcess, int lpBaseAddress,
byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesWritten);
[DllImport("kernel32.dll")]
public static extern bool ReadProcessMemory(int hProcess,
int lpBaseAddress, byte[] lpBuffer, int dwSize, ref int lpNumberOfBytesRead);
public static void Main()
{
Process process = Process.GetProcessesByName("conquer")[0];
IntPtr processHandle = OpenProcess(PROCESS_WM_READ, false, process.Id);
int bytesRead = 0;
byte[] buffer = new byte[10]; //'Hello World!' takes 12*2 bytes because of Unicode
// 0x0046A3B8 is the address where I found the string, replace it with what you found
ReadProcessMemory((int)processHandle, 0x009FE0E8, buffer, buffer.Length, ref bytesRead);
Console.WriteLine(Encoding.Default.GetString(buffer) +
" (" + bytesRead.ToString() + "bytes)");
string ServerName = Encoding.Default.GetString(buffer);
while (true)
{
if (!ServerName.Contains("MaTrix"))
{
process = Process.GetProcessesByName("conquer")[0];
processHandle = OpenProcess(0x1F0FFF, false, process.Id);
int bytesWritten = 0;
buffer = Encoding.Default.GetBytes("MaTrix\0");
// '\0' marks the end of string
// replace 0x0046A3B8 with your address
WriteProcessMemory((int)processHandle, 0x009FE0E8, buffer, buffer.Length, ref bytesWritten);
Console.WriteLine("Done");
}
}
}
}
}
