Returns the Handle of the given Process by Id
Parameter:
-$dwAccess (use $PROCESS_ALL_ACCESS as parameter)
-$bInheritHandle (If this value is TRUE, processes created by this process will inherit the handle. Otherwise, the processes do not inherit this handle.)
-$dwProcessId (The Identifier of the local Process to open. Returned by WinGetProcess and ProcessExists)
CloseHandle
Code:
Closes the given Handle
Parameter:
-$hObject (The handle to close, returned by e.g. OpenProcess)
WriteProcessMemory
Code:
Writes data to an area of memory in a specified process. Must have access
Parameter:
-$hProcess (The handle to the process, returned by OpenProcess)
-$lpAddress (A pointer to the base address in the specified process to which data is written)
-$Value (The value thats written to the specified pointer)
-$Type (The type of Value. default = 'dword')
ReadProcessMemory
Code:
Reads data from an area of memory in a specified process
Parameter:
-$hProcess (The handle to the process, returned by OpenProcess)
-$lpAddress (A pointer to the base address in the specified process to which data is written)
-$Type (The type of the data that should be read)
VirtualAllocEx
Code:
Reserves or commits a region of memory within the virtual address space of a specified process. The function initializes the memory it allocates to zero, unless $MEM_RESET is used.
Parameters:
-$hProcess (The handle to the process, returned by OpenProcess)
-$lpAddress (The pointer that specifies a desired starting address for the region of pages that you want to allocate. If lpAddress is NULL, the function determines where to allocate the region.)
-$iSize (The size in bytes to be allocated)
-$dwAllocationType ($MEM_COMMIT should fit this always)
-$dwProtection ($PAGE_EXECUTE_READWRITE should fit this always)
VirtualFreeEx
Code:
Releases, decommits, or releases and decommits a region of memory within the virtual address space of a specified process.
Parameter:
-$hProcess (The handle to the process, returned by OpenProcess)
-$lpAddress (A pointer to the starting address of the region of memory to be freed. If the dwFreeType parameter is $MEM_RELEASE, lpAddress must be the base address returned by the VirtualAllocEx function when the region is reserved.
-$iSize (The size of the page to be freed)
-$dwFreeType ($MEM_DECOMMIT, $MEM_RELEASE)
VirtualProtectEx
Code:
Changes the protection of given address+size to the desired one.
Return:
Returns old Protection
Parameter:
-$hProcess (The handle to the process. returned by OpenProcess)
-$lpAddress (A pointer an address that describes the starting page of the region of pages whose access protection attributes are to be changed.)
-$iSize (The size of the region whose access protection attributes are to be changed, in bytes)
-$dwNewProtection (see $PAGE_x in Detour.au3)
GetProcAddress
Code:
Retrieves the address of an exported function or variable from the specified dynamic-link library (DLL).
Return: Pointer to the address
Parameter:
-$szFunctionname (duh!)
-$szDLL (The name of the DLL to search for the function)
FindPattern
Code:
Scans the defined region for the given bytes
Return: The start address of the found pattern
Parameter:
-$hProcess (The handle to the process. returned by OpenProcess)
-$Pattern (duh! example: "9090908B00FF")
-$after = false (I don't know.. ignore it)
-$iv_addrStart (Start address)
-$iv_addrEnd (End address)
-$step = 51200 (leave it like that)
Detour
Code:
Detours to the given Function passed as opcode
Return: an array to be used with Retour()
Parameter:
-$hProcess (The handle to the process. Returned by OpenProcess)
-$lpAddress (duh!)
-$szCode (The function to detour to. example: '0xC7/0x40/0x10/0x39/0x05/0x00/0x00/0x8B/0x51/0x14')
-$iLength (explained in the Sample.au3)
Retour
Code:
Removes a detour
Return: none
Parameter:
-$hProcess (The handle to the process. Returned by OpenProcess)
-$arDetour (returned by Detour)
MemSet
Code:
Changes the bytes of the specified region to the specified value.
Return: None
Parameter:
-$hProcess (The handle to the process. Returned by OpenProcess)
-$Address (if u didnt got it yet... )
-$Value (then u must be srsly..)
-$iSize (dumb.)
MemCpy
Code:
Copies the specified region of bytes to the specified destination
Return: None
Parameter:
-$hProcess (The handle to the process. Returned by OpenProcess)
-$Dst (The destination)
-$Src (The source)
-$iSize (duh!)
MemCmp
Code:
Compares 2 regions of bytes
Return: If returnvalue is zero, the regions are equal.
Parameter:
-$hProcess (The handle to the process. Returned by OpenProcess)
-$Reg1 (Region 1)
-$Reg2 (Region 2)
-$iSize (duh!)
Code:
Global Const $PAGE_EXECUTE = 0x10
Global Const $PAGE_EXECUTE_READ = 0x20
Global Const $PAGE_EXECUTE_READWRITE = 0x40
Global Const $PAGE_EXECUTE_WRITECOPY = 0x80
Global Const $PAGE_NOACCESS = 0x1
Global Const $PAGE_READONLY = 0x2
Global Const $PAGE_READWRITE = 0x4
Global Const $PAGE_WRITECOPY = 0x8
Global Const $MEM_COMMIT = 0x1000
Global Const $MEM_RESERVE = 0x2000
Global Const $MEM_RESET = 0x80000
Global Const $MEM_DECOMMIT = 0x4000
Global Const $MEM_RELEASE = 0x8000
Global Const $PROCESS_ALL_ACCESS = 0x1F0FFF
Func OpenProcess($dwAccess, $bInheritHandle, $dwProcessId)
$ret = DllCall('kernel32.dll', 'dword', 'OpenProcess', 'dword', $dwAccess, 'bool', $bInheritHandle, 'dword', $dwProcessId)
Return $ret[0]
EndFunc ;==>OpenProcess
Func CloseHandle($hObject)
$ret = DllCall('kernel32.dll', 'bool', 'CloseHandle', 'handle', $hObject)
Return $ret[0]
EndFunc ;==>CloseHandle
Func ReadProcessMemory($hProcess, $lpBaseAddress, $Type = 'dword')
$dsBuffer = DllStructCreate($Type);
DllCall('kernel32.dll', 'bool', 'ReadProcessMemory', 'handle', $hProcess, 'ptr', $lpBaseAddress, 'ptr', DllStructGetPtr($dsBuffer), 'int', DllStructGetSize($dsBuffer), 'int', 0)
Return DllStructGetData($dsBuffer, 1)
EndFunc ;==>ReadProcessMemory
Func WriteProcessMemory($hProcess, $lpBaseAddress, $Value, $Type = 'dword')
$dsBuffer = DllStructCreate($Type)
DllStructSetData($dsBuffer, 1, $Value)
DllCall('kernel32.dll', 'bool', 'WriteProcessMemory', 'handle', $hProcess, 'ptr', $lpBaseAddress, 'ptr', DllStructGetPtr($dsBuffer), 'int', DllStructGetSize($dsBuffer), 'int', 0)
EndFunc ;==>WriteProcessMemory
Func VirtualAllocEx($hProcess, $lpAddress, $iSize, $dwAllocationType, $dwProtection)
$ret = DllCall('kernel32.dll', 'int', 'VirtualAllocEx', 'handle', $hProcess, 'ptr', $lpAddress, 'int', $iSize, 'dword', $dwAllocationType, 'dword', $dwProtection)
Return $ret[0]
EndFunc ;==>VirtualAllocEx
Func VirtualFreeEx($hProcess, $lpAddress, $iSize, $dwFreeType)
$ret = DllCall('kernel32.dll', 'bool', 'VirtualFreeEx', 'handle', $hProcess, 'ptr', $lpAddress, 'int', $iSize, 'dword', $dwFreeType)
Return $ret[0]
EndFunc ;==>VirtualFreeEx
Func VirtualProtectEx($hProcess, $lpAddress, $iSize, $dwNewProtection)
$dsBuffer = DllStructCreate('dword')
DllCall('kernel32.dll', 'bool', 'VirtualProtectEx', 'handle', $hProcess, 'ptr', $lpAddress, 'int', $iSize, 'dword', $dwNewProtection, 'dword', DllStructGetPtr($dsBuffer))
Return DllStructGetData($dsBuffer, 1)
EndFunc ;==>VirtualProtectEx
Func GetProcAddress($szFunctionname, $szDLL)
$aRet = DllCall('kernel32.dll', 'handle', 'LoadLibrary', 'str', $szDLL)
If $aRet[0] == 0 Then
SetError(1)
Return
EndIf
$pAdd = DllCall('kernel32.dll', 'ptr', 'GetProcAddress', 'handle', $aRet[0], 'str', $szFunctionname)
If $pAdd[0] == 0 Then
SetError(2)
Return
EndIf
DllCall('kernel32.dll', 'bool', 'FreeLibrary', 'handle', $aRet[0])
Return hex(number( $pAdd[0] ))
EndFunc ;==>GetProcAddress
;credits to luzifer (not made by me, just edited to let it work with readprocessmemory)
Func FindPattern($ah_Handle, $pattern, $after = False, $iv_addrStart = 0x00400000, $iv_addrEnd = 0X00FFFFFF, $step = 51200)
$pattern = StringRegExpReplace($pattern, "[^0123456789ABCDEFabcdef.]", "")
If StringLen($pattern) = 0 Then
SetError(2)
Return -2
EndIf
For $addr = $iv_addrStart To $iv_addrEnd Step $step - (StringLen($pattern) / 2)
StringRegExp(ReadProcessMemory($ah_Handle, $addr, "byte[" & $step & "]"), $pattern, 1, 2)
If Not @error Then
If $after Then
Return StringFormat("0x%.8X", $addr + ((@extended - 2) / 2))
Else
Return StringFormat("0x%.8X", $addr + ((@extended - StringLen($pattern) - 2) / 2))
EndIf
EndIf
Next
Return -3
EndFunc ;==>FindPattern
Func Detour($hProcess, $lpAddress, $szCode, $iLength = 5)
If StringLen($szCode) == 0 Then
SetError(1)
Return
EndIf
Local $ret[2] = [$lpAddress, ""]
$oCode = StringSplit($szCode, "/")
$Alloc = VirtualAllocEx($hProcess, 0, $oCode[0] + 12, $MEM_COMMIT, $PAGE_EXECUTE_READWRITE)
If $Alloc == 0 Then
SetError(2)
Return
EndIf
For $i = 1 To $oCode[0] Step 1
WriteProcessMemory($hProcess, $Alloc + $i - 1, $oCode[$i])
Next
$tAddr = $Alloc+$oCode[0]
WriteProcessMemory($hProcess, $Alloc + $oCode[0], 0xE9)
WriteProcessMemory($hProcess, $Alloc + $oCode[0] + 1, ($lpAddress-$tAddr))
$flOldProtect = VirtualProtectEx($hProcess, $lpAddress, $iLength, $PAGE_EXECUTE_READWRITE)
For $i = 0 To $iLength - 1 Step 1
$ret[1] &= '0x' & Hex(ReadProcessMemory($hProcess, $lpAddress + $i, 'byte'), 2) & "/"
Next
WriteProcessMemory($hProcess, $lpAddress, 0xE9)
WriteProcessMemory($hProcess, $lpAddress + 1, ($Alloc - $lpAddress) - $iLength, 'ptr')
VirtualProtectEx($hProcess, $lpAddress, $iLength, $flOldProtect)
For $i = 0 To $iLength - 6 Step 1
WriteProcessMemory($hProcess, $lpAddress + 5 + $i, 0x90, 'byte')
Next
Return $ret
EndFunc ;==>Detour
Func Retour($hProcess, $arDetour)
If Not IsArray($arDetour) Then
SetError(1)
Return
EndIf
Local $oCode = StringSplit($arDetour[1], "/")
Local $flOldProtect = VirtualProtectEx($hProcess, $arDetour[0], $oCode[0], $PAGE_EXECUTE_READWRITE)
For $i = 1 To $oCode[0] Step 1
WriteProcessMemory($hProcess, ($arDetour[0] + $i) - 1, $oCode[$i])
Next
VirtualProtectEx($hProcess, $arDetour[0], $oCode[0], $flOldProtect)
VirtualFreeEx($hProcess, $arDetour[0], $oCode[0] + 12, $MEM_RELEASE)
Return 1
EndFunc ;==>Retour
Func MemSet($hProcess, $Address, $Value, $iSize)
$flOldProtect = VirtualProtectEx($hProcess, $Address, $iSize, $PAGE_EXECUTE_READWRITE)
For $i = 0 To $iSize Step 1
WriteProcessMemory($hProcess, $Address + $i, $Value, 'byte')
Next
VirtualProtectEx($hProcess, $Address, $iSize, $flOldProtect)
Return
EndFunc ;==>MemSet
Func MemCpy($hProcess, $Dst, $Src, $iSize)
If $iSize == 0 Then
SetError(1)
Return
EndIf
For $i = 0 To $iSize
$tByte = ReadProcessMemory($hProcess, $Src + $i, 'byte')
WriteProcessMemory($hProcess, $Dst + $i, $tByte, 'byte')
Next
Return
EndFunc ;==>MemCpy
Func MemCmp($hProcess, $Reg1, $Reg2, $iSize)
If $iSize == 0 Then
SetError(1)
Return
EndIf
Return StringCompare(ReadProcessMemory($hProcess, $Reg1, 'byte[' & $iSize & ']'), ReadProcessMemory($hProcess, $Reg2, 'byte[' & $iSize & ']'))
EndFunc ;==>MemCmp
However, you will never be able to hook as comfortable as in C++.
Die Funktionen sind mehr oder weniger portiert (teilweise leicht modifiziert).
Demnach 'bewirken' sie das gleiche, wie sonst auch. Trotzdem leg ich noch was bei.
Verstehe den Sinn nicht, um C++ oder Inline ASM kommt man doch eh nicht herum.
Und Code Injection via WriteProcessMemory + dann auch noch detouren...da macht eine direkte Dll Injection mehr Sinn und da muss man wenigstens nicht auf evtl. vom Anti Cheat kontrollierte APIs wie WriteProcessMemory zurückgreifen.
Oh und naja wirklich komfortabel ist die Detour Funktion nicht ;/
Ich würde da doch eher zu MS Detours greifen, da muss man keine Länge angeben und es wird wenigstens dafür gesorgt, dass nicht mitten beim Schreiben die Funktion aufgerufen wird.
Alles in allem eine nette Spielerei für die Leute, die mit Autoit immer auf der selben Stufe wie C++ sein wollen, aber eigentlich unnötig.
Wenn man sich schon die Arbeit machen muss, ASM Code in Form von fertig assemblierten Opcodes per WriteProcessMemory in den Prozess zu schreiben, kann man auch gleich den Jump selbst platzieren, da nimmt einem diese Funktion auch nicht mehr viel ab.
dann zeig mir mal wie du den jump, dynamisch natürlich, selbst platzierst. klar ist das ganze aufwändig, jedoch nicht ganz ineffektiv, denn auch mit au3 kannst du nach mustern im speicher suchen.
btw brauche ich, um nen fertigen hook mit au3 zumachen (mit dieser udf) keine 10 minuten. kommt eben immer drauf an wie man sich anstellt.
desweiteren kann ich nur immer wieder wiederholen das das ganze nur ne demo für die ist, die unbedingt au3 für sowas hernehmen wollen.
QUESTION - redirect/detour IP of an .exe 05/05/2011 - General Coding - 3 Replies Someone know how to do it?
redirecting or detour the IP of an executable.. to localhost (127.0.0.1)
---
Weiß einer wie das geht?
umleiten einer IP bzw Verbindung von einer .exe zu localhost (127.0.0.1)
..
[Serach]Detour 02/19/2011 - WarRock Hacks, Bots, Cheats & Exploits - 5 Replies Hi,
Who has and will give the detour?
Suche Detour 01/18/2011 - WarRock - 15 Replies Der titel sagt alles.
Gebe meinetwegen auch e*gold dafür.
[C++]Detour - Register Adressen 08/11/2010 - C/C++ - 11 Replies Hallo,
und zwar möchte ich für ein Spiel einen Packet Logger schreiben.
Jedenfalls hab ich nun ein Problem.
Die Werte werden vor dem Aufruf in's Register geschrieben. (ganz normal eben)
Dann greift meine Funktion per detour ein und überschreibt natürlich jetzt wieder den kompletten Register.
Jetzt springt die Funktion wieder zur Ur-Funktion, allerdings mit den falschen Werten im Register. (D.h. -> Crash).
So, jetzt hab ich versucht bevor meine Funktion aufgerufen wird per inline asm...
[HELP] Detour connections Client 5250. 06/29/2010 - CO2 Private Server - 18 Replies Okay, so I want the client to connect to any IP I want. I can't edit the server.dat, it's encrypted. (Do not send me DatCryptor, I know this isn't working.) I've tried Nullable's ConquerLoader as well, but it simply freezes the client, it's very strange.
So does anyone have a solution?
Its Client patch 5250.
