[VB.NET] detecting the flash player process in browser

04/07/2015 20:48 Majin123456#1

Alright. so i have been working on a trainer for a flash browser-based game. everything is simple enough. write process memory and blah blah blah.

but the flash player detection is killing me..
because i'm trying to hack a flash browser game i would need to get the correct process that handles ShockWaveFlash. which in my case i used Maxthon. now maxthon has 4 processes. the last one is the one that has the NPSWF.DLL (for shockwaveflash)

04/07/2015 21:05 Requi#2

Get the module handle of the dll in each process. If it's not Null it should be the right one.

04/07/2015 21:40 YatoDev#3

Its a Process Array so you need to make a for loop to search for the name

04/07/2015 22:10 Majin123456#4

ok i tried this

Code:

  Private Sub Timer2_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer2.Tick



        Dim MyProcess As Process() = Process.GetProcessesByName("Maxthon")
        For Each Process In MyProcess
            Dim hAddress As Integer = VirtualAllocEx(MyProcess(0).Handle, IntPtr.Zero, 11, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
            







        Next



    End Sub

the values doesn't change anymore. (the address is correct) so the browser isn't hooked.
sorry if this is noobish but i'm really not that good :P

a bit different code

Code:

Private Sub Timer2_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer2.Tick



        Dim MyProcess As Process() = Process.GetProcessesByName("Maxthon")
        For Each thread As ProcessThread In Process.GetProcessesByName("Maxthom")(0).Threads
            Dim hAddress As Integer = VirtualAllocEx(MyProcess(0).Handle, IntPtr.Zero, 22, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
            






        Next



    End Sub

still. the values doesn't change

04/08/2015 00:00 Requi#5

Code:

Dim MyProcess As Process() = Process.GetProcessesByName("Maxthon")

This is an array.

Itereate it. Get the module (not thread!) handle of "NPSWF.dll" of each process. If the handle does not equal 0, you have the right process. Use that process.

04/08/2015 12:30 Majin123456#6

Quote:
Originally Posted by Requi
Code:
Dim MyProcess As Process() = Process.GetProcessesByName("Maxthon")
This is an array.

Itereate it. Get the module (not thread!) handle of "NPSWF.dll" of each process. If the handle does not equal 0, you have the right process. Use that process.

is this possible in VB.NET?
i did a long research on google. i only found C/C++ methods

04/08/2015 12:40 tolio#7

Quote:

Originally Posted by Majin123456

i did a long research on google.

maybe you should do a research how to research with google...

"msdn process modules"
first result:
[Only registered and activated users can see links. Click Here To Register...]

04/08/2015 18:08 Majin123456#8

i tried this

Code:

 Dim a As Process = Process.GetProcessesByName("Maxthon")

        Dim myProcessModule As ProcessModule
        Dim myProcessModuleCollection As ProcessModuleCollection = a.Modules
       Dim i As Integer
        For i = 0 To myProcessModuleCollection.Count - 1
            myProcessModule = myProcessModuleCollection(i)
            MsgBox(myProcessModule.ModuleName + " : " + myProcessModule.FileName)
        Next i
        If a.Modules("NPSWF.DLL") Then

i got 2 errors

Code:

Value of type '1-dimensional array of System.Diagnostics.Process' cannot be converted to 'System.Diagnostics.Process'.


Value of type 'System.Diagnostics.ProcessModule' cannot be converted to 'Boolean'.

it wouldn't work when i call maxthon by process.getprocessesbyname right?
i don't know how to make it search for maxthon other then name or id.
i tried process.startinfo but i got (a 32 process cannot access a 64 process) and it would have to open maxthon again in order to do that

04/09/2015 00:46 YatoDev#9

dafuq learn to code. the error tells you exactly what you have done wrong.
And you still dont know what you need to do

04/09/2015 15:13 Requi#10

Quote:
Originally Posted by Majin123456
i tried this
Code:
 Dim a As Process = Process.GetProcessesByName("Maxthon")

        Dim myProcessModule As ProcessModule
        Dim myProcessModuleCollection As ProcessModuleCollection = a.Modules
       Dim i As Integer
        For i = 0 To myProcessModuleCollection.Count - 1
            myProcessModule = myProcessModuleCollection(i)
            MsgBox(myProcessModule.ModuleName + " : " + myProcessModule.FileName)
        Next i
        If a.Modules("NPSWF.DLL") Then
i got 2 errors
Code:
Value of type '1-dimensional array of System.Diagnostics.Process' cannot be converted to 'System.Diagnostics.Process'.


Value of type 'System.Diagnostics.ProcessModule' cannot be converted to 'Boolean'.
it wouldn't work when i call maxthon by process.getprocessesbyname right?
i don't know how to make it search for maxthon other then name or id.
i tried process.startinfo but i got (a 32 process cannot access a 64 process) and it would have to open maxthon again in order to do that

Copy-Pasta

Spoiler

If you can't implement it, you should rather learn to code before trying to create such kind of programs.

04/11/2015 12:43 Majin123456#11

Quote:
Originally Posted by Requi
Copy-Pasta
Spoiler
Code:
Public myProcess As Process
If you can't implement it, you should rather learn to code before trying to create such kind of programs.

well yeah. that works :P
thanks alot for Requi and tolio.

01/16/2016 18:54 hemersonkl#12

hello! Hello. I need something for chrome. I need to find the pepflashplayer.dll
I could give an example of how to find it and inject a code on it?
I want to make a simple trainer in a game. but I do not know which module to use. thank you

Hello. I need something for chrome. I need to find the pepflashplayer.dll
I could give an example of how to find it and inject a code on it?
I want to make a simple trainer in a game. but I do not know which module to use.
I need an example with a button to send a cheat engine code oab the button. for example pepflashplayer.dll autoAssemble ([[
Aobscan (_aob2, 63 6F 64 65 3D 22 41 43 46 22)

_aob2:
db 63 6F 64 65 3D 22 41 39 54 22

]]
)

I want to inject it in a facebook game. Thank you for your help. Sorry my English'm from Brazil,