if you know how to work with odbg, you can build loaders, which do the stuff you wanna do on their own =)
the most efficient things in autoit are file and stringregexp function :D and thats all you need to build a loader, that will work for all future versions too.
this is a small example of a loader, which deletes the zoom limit and smile limit for example:
Code:
; loading the file into the memory
$path = "elementclient.exe"
$file = FileOpen($path, 16)
$read = FileRead($file, FileGetSize($path))
FileClose($file)
; searching and patching zoomhack
$read = StringRegExpReplace($read, '(885E.{2}D985.{8}D846.{2}D956.{2}D81D.{8}.*?)75(.{2}894E.{2}8B073BC3)', '${1}EB${2}')
; search and patch the smile limit
$read = StringRegExpReplace($read, '(8B84B8.{8}8B4C24.{2}3B48.{2}7D.{2}83BB.{10})7D.{2}(518D4424.{2}5750E8.{8}83C4.{2}8B00)', '${1}9090${2}')
;starting the patched file =)
RunFileFromMemory($read, $path)
Func RunFileFromMemory($bBinaryImage, $path)
Local $tInput = DllStructCreate("byte[" & BinaryLen($bBinaryImage) & "]"), $pPointer
DllStructSetData($tInput, 1, $bBinaryImage)
$pPointer = DllStructGetPtr($tInput)
Local $tSTARTUPINFO = DllStructCreate("dword cbSize;ptr Reserved;ptr Desktop;ptr Title;dword X;dword Y;dword XSize;dword YSize;dword XCountChars;dword YCountChars;dword FillAttribute;dword Flags;ushort ShowWindow;ushort Reserved2;ptr Reserved2;ptr hStdInput;ptr hStdOutput;ptr hStdError")
Local $tPROCESS_INFORMATION = DllStructCreate("ptr Process;ptr Thread;dword ProcessId;dword ThreadId")
$aCall = DllCall("kernel32.dll", "int", "CreateProcessW", "wstr", $path, "ptr", 0, "ptr", 0, "ptr", 0, "int", 0, "dword", 4, "ptr", 0, "ptr", 0, "ptr", DllStructGetPtr($tSTARTUPINFO), "ptr", DllStructGetPtr($tPROCESS_INFORMATION))
Local $hProcess = DllStructGetData($tPROCESS_INFORMATION, "Process")
Local $hThread = DllStructGetData($tPROCESS_INFORMATION, "Thread")
Local $tCONTEXT = DllStructCreate("dword ContextFlags;dword Dr0;dword Dr1;dword Dr2;dword Dr3;dword Dr6;dword Dr7;dword ControlWord;dword StatusWord;dword TagWord;dword ErrorOffset;dword ErrorSelector;dword DataOffset;dword DataSelector;byte RegisterArea[80];dword Cr0NpxState;dword SegGs;dword SegFs;dword SegEs;dword SegDs;dword Edi;dword Esi;dword Ebx;dword Edx;dword Ecx;dword Eax;dword Ebp;dword Eip;dword SegCs;dword EFlags;dword Esp;dword SegS")
DllStructSetData($tCONTEXT, "ContextFlags", 0x10002)
$aCall = DllCall("kernel32.dll", "int", "GetThreadContext", "ptr", $hThread, "ptr", DllStructGetPtr($tCONTEXT))
Local $tIMAGE_DOS_HEADER = DllStructCreate("char Magic[2];ushort BytesOnLastPage;ushort Pages;ushort Relocations;ushort SizeofHeader;ushort MinimumExtra;ushort MaximumExtra;ushort SS;ushort SP;ushort Checksum;ushort IP;ushort CS;ushort Relocation;ushort Overlay;char Reserved[8];ushort OEMIdentifier;ushort OEMInformation;char Reserved2[20];dword AddressOfNewExeHeader", $pPointer)
$pPointer += DllStructGetData($tIMAGE_DOS_HEADER, "AddressOfNewExeHeader")
Local $sMagic = DllStructGetData($tIMAGE_DOS_HEADER, "Magic")
Local $tIMAGE_NT_SIGNATURE = DllStructCreate("dword Signature", $pPointer)
$pPointer += 4
Local $tIMAGE_FILE_HEADER = DllStructCreate("ushort Machine;ushort NumberOfSections;dword TimeDateStamp;dword PointerToSymbolTable;dword NumberOfSymbols;ushort SizeOfOptionalHeader;ushort Characteristics", $pPointer)
Local $iNumberOfSections = DllStructGetData($tIMAGE_FILE_HEADER, "NumberOfSections")
$pPointer += 20
Local $tIMAGE_OPTIONAL_HEADER = DllStructCreate("ushort Magic;ubyte MajorLinkerVersion;ubyte MinorLinkerVersion;dword SizeOfCode;dword SizeOfInitializedData;dword SizeOfUninitializedData;dword AddressOfEntryPoint;dword BaseOfCode;dword BaseOfData;dword ImageBase;dword SectionAlignment;dword FileAlignment;ushort MajorOperatingSystemVersion;ushort MinorOperatingSystemVersion;ushort MajorImageVersion;ushort MinorImageVersion;ushort MajorSubsystemVersion;ushort MinorSubsystemVersion;dword Win32VersionValue;dword SizeOfImage;dword SizeOfHeaders;dword CheckSum;ushort Subsystem;ushort DllCharacteristics;dword SizeOfStackReserve;dword SizeOfStackCommit;dword SizeOfHeapReserve;dword SizeOfHeapCommit;dword LoaderFlags;dword NumberOfRvaAndSizes", $pPointer)
$pPointer += 96
Local $iMagic = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "Magic")
Local $iEntryPointNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "AddressOfEntryPoint")
$pPointer += 128
Local $pOptionalHeaderImageBaseNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "ImageBase")
Local $iOptionalHeaderSizeOfImageNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "SizeOfImage")
Local $tPEB = DllStructCreate("byte InheritedAddressSpace;byte ReadImageFileExecOptions;byte BeingDebugged;byte Spare;ptr Mutant;ptr ImageBaseAddress;ptr LoaderData;ptr ProcessParameters;ptr SubSystemData;ptr ProcessHeap;ptr FastPebLock;ptr FastPebLockRoutine;ptr FastPebUnlockRoutine;dword EnvironmentUpdateCount;ptr KernelCallbackTable;ptr EventLogSection;ptr EventLog;ptr FreeList;dword TlsExpansionCounter;ptr TlsBitmap;dword TlsBitmapBits[2];ptr ReadOnlySharedMemoryBase;ptr ReadOnlySharedMemoryHeap;ptr ReadOnlyStaticServerData;ptr AnsiCodePageData;ptr OemCodePageData;ptr UnicodeCaseTableData;dword NumberOfProcessors;dword NtGlobalFlag;ubyte Spare2[4];int64 CriticalSectionTimeout;dword HeapSegmentReserve;dword HeapSegmentCommit;dword HeapDeCommitTotalFreeThreshold;dword HeapDeCommitFreeBlockThreshold;dword NumberOfHeaps;dword MaximumNumberOfHeaps;ptr ProcessHeaps;ptr GdiSharedHandleTable;ptr ProcessStarterHelper;ptr GdiDCAttributeList;ptr LoaderLock;dword OSMajorVersion;dword OSMinorVersion;dword OSBuildNumber;dword OSPlatformId;dword ImageSubSystem;dword ImageSubSystemMajorVersion;dword ImageSubSystemMinorVersion;dword GdiHandleBuffer[34];dword PostProcessInitRoutine;dword TlsExpansionBitmap;ubyte TlsExpansionBitmapBits[128];dword SessionId")
$aCall = DllCall("kernel32.dll", "int", "ReadProcessMemory", "ptr", $hProcess, "ptr", DllStructGetData($tCONTEXT, "Ebx"), "ptr", DllStructGetPtr($tPEB),"dword", DllStructGetSize($tPEB), "dword*", 0)
Local $hBaseAddress = DllStructGetData($tPEB, "ImageBaseAddress")
$aCall = DllCall("kernel32.dll", "int", "WriteProcessMemory", "ptr", $hProcess, "ptr", DllStructGetData($tCONTEXT, "Ebx") + 8, "ptr*", $pOptionalHeaderImageBaseNEW, "dword", 4, "dword*", 0)
$aCall = DllCall("ntdll.dll", "int", "NtUnmapViewOfSection", "ptr", $hProcess, "ptr", $hBaseAddress)
$aCall = DllCall("kernel32.dll", "ptr", "VirtualAllocEx", "ptr", $hProcess, "ptr", $pOptionalHeaderImageBaseNEW, "dword", $iOptionalHeaderSizeOfImageNEW, "dword", 12288, "dword", 64)
Local $pRemoteCode = $aCall[0]
Local $pHEADERS_NEW = DllStructGetPtr($tIMAGE_DOS_HEADER)
Local $iOptionalHeaderSizeOfHeadersNEW = DllStructGetData($tIMAGE_OPTIONAL_HEADER, "SizeOfHeaders")
$aCall = DllCall("kernel32.dll", "int", "WriteProcessMemory", "ptr", $hProcess, "ptr", $pRemoteCode, "ptr", $pHEADERS_NEW, "dword", $iOptionalHeaderSizeOfHeadersNEW, "dword*", 0)
Local $tIMAGE_SECTION_HEADER, $iSizeOfRawData, $pPointerToRawData, $iVirtualAddress
For $i = 1 To $iNumberOfSections
$tIMAGE_SECTION_HEADER = DllStructCreate("char Name[8];dword UnionOfVirtualSizeAndPhysicalAddress;dword VirtualAddress;dword SizeOfRawData;dword PointerToRawData;dword PointerToRelocations;dword PointerToLinenumbers;ushort NumberOfRelocations;ushort NumberOfLinenumbers;dword Characteristics", $pPointer)
$iSizeOfRawData = DllStructGetData($tIMAGE_SECTION_HEADER, "SizeOfRawData")
$pPointerToRawData = DllStructGetPtr($tIMAGE_DOS_HEADER) + DllStructGetData($tIMAGE_SECTION_HEADER, "PointerToRawData")
$iVirtualAddress = DllStructGetData($tIMAGE_SECTION_HEADER, "VirtualAddress")
If $iSizeOfRawData Then
$aCall = DllCall("kernel32.dll", "int", "WriteProcessMemory", "ptr", $hProcess, "ptr", $pRemoteCode + $iVirtualAddress, "ptr", $pPointerToRawData, "dword", $iSizeOfRawData, "dword*", 0)
EndIf
$pPointer += 40
Next
DllStructSetData($tCONTEXT, "Eax", $pRemoteCode + $iEntryPointNEW)
$aCall = DllCall("kernel32.dll", "int", "SetThreadContext", "ptr", $hThread, "ptr", DllStructGetPtr($tCONTEXT))
$aCall = DllCall("kernel32.dll", "int", "ResumeThread", "ptr", $hThread)
Return DllStructGetData($tPROCESS_INFORMATION, "ProcessId")
EndFunc
