[HELP] Visual Basic.NET 05/08 - Read Memory

[Zeelia]

Hi!
I want to learn how to read the memory of Conquer (later in the future i want to learn how to write aswell but i can figure that out later).

So what i need help with is this source i have found.
It's hard to find Conquer cheat sources which actually are written in Visual Basic.NET so thats why i took this Warcraft III example and i thought of using it to read from Conquer.

I ripped it and changed the process name from "war3" to "Conquer" and tried to use it right away but as you might think, it didn't work.

So if someone please can help me to use this code (or any other code) to read the memory to get access to things such as HP, [Mana], Stamina, EXP, and more basic stuff.

Thanks!
//Zeelia

    Private Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As Integer
    Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Private Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Integer, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Private Declare Function CloseHandle Lib "kernel32" (ByVal hObject As Integer) As Integer
    Const PROCESS_ALL_ACCESS = &H1F0FFF

    Public Sub GetName()
        'From here too where I put END, is where its the same as above.
        Try
            Dim Address As Integer, vBuffer As Long
            Dim enc As New System.Text.ASCIIEncoding
            Dim myProcesses As Process() = Process.GetProcessesByName("war3")
            If myProcesses.Length = 0 Then
                Status.Text = "Warcraft III is not running."
                Exit Sub
            End If
            Dim processHandle As IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, myProcesses(0).Id)
            If processHandle = IntPtr.Zero Then
                Status.Text = "Failed to open Warcraft III process."
                Exit Sub
            End If
            Address = 724
            Do
                ReadProcessMemory(processHandle, Address, vBuffer, 4, 0)
                If vBuffer = 1463898675 Then
                    Me.Icon = My.Resources.ROC
                    NotifyIcon.Icon = My.Resources.ROC
                    Address -= 32
                    Exit Do
                ElseIf vBuffer = 1462982736 Then
                    Me.Icon = My.Resources.TFT
                    NotifyIcon.Icon = My.Resources.TFT
                    Address -= 32
                    Exit Do
                Else
                    Address += 65536
                End If
            Loop
            'END
            'Below this is what has changed from WriteName.
            'We declare ret as a Byte Array. We declare it as an array by putting () after Byte.
            Dim ret As Byte() = Nothing
            'We make sure that the CurrentName textbox is nothing. That way when we are converting the integer to a string, we arent &='ing onto the textbox.
            CurrentName.Text = ""
            'We are now going to start our loop, increase the Address by 1 each time, and read the process memory.
            For i As Integer = 0 To 15
                'Read the memory.
                ReadProcessMemory(processHandle, Address + i, vBuffer, 1, 0)
                'Now we need to take vBuffer and get the bytes from it.
                ret = BitConverter.GetBytes(vBuffer)
                'Then convert ret to a readable string.
                'Then we add the new string to the Current Name textbox.
                CurrentName.Text &= System.Text.Encoding.ASCII.GetString(ret).Replace("RAW", "")
            Next
            'Then we close the process so warcraft III doesnt get any errors.
            CloseHandle(processHandle)
            'Then we need to let the user know that Warcraft III is running fine.
            Status.Text = "Warcraft III is running."
        Catch ex As Exception
            'If we happen to get any errors, we will set the status label's text to the exceptions (error) (ex.message).
            Status.Text = ex.Message
            'Then we need to exit the sub so we dont get any more errors.
            Exit Sub
        End Try
    End Sub

You can find the whole source at:

[high7]

If you are still in the copy/paste stage of programming then you really need to start smaller...

[Zeelia]

Hi!
Yes I know but I have no idea where or how to start, I might be able to find something about reading memory but its hard to find for VB.NET and people usually connect this with hacks/cheats so there isn't much information out there.

However, I will go on and search the basics on how to read memory in VB.NET but I'm gonna need help on which addresses to read. Maybe you can give me some tips?
Thanks!
//Zeelia

[Birthday Cake]

zeelia , take my advice, first try to start with some simpler things such as making and caculator or something like that ...

[Zeelia]

@Birthday_Cake
Hi! I am not an beginner in programming VB.NET, nor am I advanced programmer. You could say I'm an intermediate.

So I just need some help to figure out how to read from the memory, thats all.
I just pasted that piece of code in my first post because in it, there is a readmemory function. However, I don't know how to apply this code to work with Conquer.
//Zeelia

[high7]

Originally Posted by Zeelia

@Birthday_Cake
Hi! I am not an beginner in programming VB.NET, nor am I advanced programmer. You could say I'm an intermediate.

So I just need some help to figure out how to read from the memory, thats all.
I just pasted that piece of code in my first post because in it, there is a readmemory function. However, I don't know how to apply this code to work with Conquer.
//Zeelia

That sounds no where near intermediate... Sounds like you are still a beginner.

[ookamocka]

as everyone here has said... if ur trying to copy from another program, and just simply change it from warcarft to conquer... then u have a loooooooong way to go before understanding how reading/writing memory works... go back, and start with something simpler

[Zeelia]

Hi!
No I don't think I should do something simpler, I want to do this to learn.
So as I usually do when I want to learn, try things out.

So please, c'mon, help me out on this one.

I created a new project, googled a bit and read the MSDN library about memory reading.
This is what I have so far:

    Function Hook()
        aProcess = Process.GetProcessesByName("Conquer") ''Give the ID MY WAY
        ProcessID = aProcess(0).Id

        If OpenProcess(PROCESS_ALL_ACCESS, False, ProcessID) Then
            ProcessHandle = OpenProcess(PROCESS_ALL_ACCESS, False, ProcessID)
            If debugmode = True Then MsgBox("Success hooking!" & vbCrLf & "Hooked: " & aProcess(0).ProcessName & "(" & ProcessID & ")")
            MsgBox(OpenProcess(PROCESS_ALL_ACCESS, False, ProcessID))
            fReadProcessMemory("&H56D134")
        End If
        Return Nothing
    End Function

    Function fReadProcessMemory(ByVal MemAddress As String, Optional ByVal BufferSize As Integer = 16)
        Dim Addresses As Integer = CInt(MemAddress)
        Dim VarHolder(BufferSize) As Byte
        Call ReadProcessMemory(ProcessHandle, Addresses, VarHolder(0), BufferSize, NULL)
        ''Final Return (IN MSGBOX)
        MsgBox(System.Text.UnicodeEncoding.Unicode.GetString(VarHolder))
        Return Nothing
    End Function

And simply, what I do is to call the function Hook() when my application loads.
But the function ReadProcessMemory returns null value so I think I've got the memory address wrong. I got the memory address I'm using above from Cheat Engine. I've also tried to use the 5065 CO version memory address which I got from ma-global.inf but of course, that wouldn't work.

So if someone only could tell me if the code I'm using above is correct, I would be happy. I know that I need to find the correct pointer to the memory address.

By the way: I'm trying to find out the character name with the code above.

Thanks!
//Zeelia

[high7]

Originally Posted by Zeelia

No I don't think I should do something simpler, I want to do this to learn.

You are not going to learn to ride a bike when you don't even know how to crawl yet...

[ookamocka]

Originally Posted by high7

You are not going to learn to ride a bike when you don't even know how to crawl yet...

this

[Zeelia]

Okay first of all i already know how to crawl
2. You're right... i don't know how to bike =(

And if you guys don't wanna help me that's okay, I'm not gonna put down this project, I'm going to continue with or without your help.

That's my 3 cents.

I've read Michael's source (you know, *M* Multihack) and the code I have in post #8 is really all you need to read from the memory so I know I'm on the right track and I'm going to figure it out.
//Zeelia

[ookamocka]

ur using a honda's key to try and open a ford and all you did was write ford on the key hoping it'll open the ford. . . the keys both do the same thing, but it's for 2 different things! -_-

[ookamocka]

ne way... here's one for AutoIt... should be very similar to VB...

#include-once
#region _Memory
;==================================================================================
; AutoIt Version:	3.1.127 (beta)
; Language:			English
; Platform:			All Windows
; Author:			Nomad
; Requirements:		These functions will only work with beta.
;==================================================================================
; Credits:	wOuter - These functions are based on his original _Mem() functions.
;			But they are easier to comprehend and more reliable.  These
;			functions are in no way a direct copy of his functions.  His
;			functions only provided a foundation from which these evolved.
;==================================================================================
;
; Functions:
;
;==================================================================================
; Function:			_MemoryOpen($iv_Pid[, $iv_DesiredAccess[, $iv_InheritHandle]])
; Description:		Opens a process and enables all possible access rights to the
;					process.  The Process ID of the process is used to specify which
;					process to open.  You must call this function before calling
;					_MemoryClose(), _MemoryRead(), or _MemoryWrite().
; Parameter(s):		$iv_Pid - The Process ID of the program you want to open.
;					$iv_DesiredAccess - (optional) Set to 0x1F0FFF by default, which
;										enables all possible access rights to the
;										process specified by the Process ID.
;					$iv_InheritHandle - (optional) If this value is TRUE, all processes
;										created by this process will inherit the access
;										handle.  Set to 1 (TRUE) by default.  Set to 0
;										if you want it FALSE.
; Requirement(s):	None.
; Return Value(s): 	On Success - Returns an array containing the Dll handle and an
;								 open handle to the specified process.
;					On Failure - Returns 0
;					@Error - 0 = No error.
;							 1 = Invalid $iv_Pid.
;							 2 = Failed to open Kernel32.dll.
;							 3 = Failed to open the specified process.
; Author(s):		Nomad
; Note(s):
;==================================================================================
Func _MemoryOpen($iv_Pid, $iv_DesiredAccess = 0x1F0FFF, $iv_InheritHandle = 1)
	
	If Not ProcessExists($iv_Pid) Then
		SetError(1)
        Return 0
	EndIf
	
	Local $ah_Handle[2] = [DllOpen('kernel32.dll')]
	
	If @Error Then
        SetError(2)
        Return 0
    EndIf
	
	Local $av_OpenProcess = DllCall($ah_Handle[0], 'int', 'OpenProcess', 'int', $iv_DesiredAccess, 'int', $iv_InheritHandle, 'int', $iv_Pid)
	
	If @Error Then
        DllClose($ah_Handle[0])
        SetError(3)
        Return 0
    EndIf
	
	$ah_Handle[1] = $av_OpenProcess[0]
	
	Return $ah_Handle
	
EndFunc

;==================================================================================
; Function:			_MemoryRead($iv_Address, $ah_Handle[, $sv_Type])
; Description:		Reads the value located in the memory address specified.
; Parameter(s):		$iv_Address - The memory address you want to read from. It must
;								  be in hex format (0x00000000).
;					$ah_Handle - An array containing the Dll handle and the handle
;								 of the open process as returned by _MemoryOpen().
;					$sv_Type - (optional) The "Type" of value you intend to read.
;								This is set to 'dword'(32bit(4byte) signed integer)
;								by default.  See the help file for DllStructCreate
;								for all types.  An example: If you want to read a
;								word that is 15 characters in length, you would use
;								'char[16]' since a 'char' is 8 bits (1 byte) in size.
; Return Value(s):	On Success - Returns the value located at the specified address.
;					On Failure - Returns 0
;					@Error - 0 = No error.
;							 1 = Invalid $ah_Handle.
;							 2 = $sv_Type was not a string.
;							 3 = $sv_Type is an unknown data type.
;							 4 = Failed to allocate the memory needed for the DllStructure.
;							 5 = Error allocating memory for $sv_Type.
;							 6 = Failed to read from the specified process.
; Author(s):		Nomad
; Note(s):			Values returned are in Decimal format, unless specified as a
;					'char' type, then they are returned in ASCII format.  Also note
;					that size ('char[size]') for all 'char' types should be 1
;					greater than the actual size.
;==================================================================================
Func _MemoryRead($iv_Address, $ah_Handle, $sv_Type = 'dword')
	
	If Not IsArray($ah_Handle) Then
		SetError(1)
        Return 0
	EndIf
	
	Local $v_Buffer = DllStructCreate($sv_Type)
	
	If @Error Then
		SetError(@Error + 1)
		Return 0
	EndIf
	
	DllCall($ah_Handle[0], 'int', 'ReadProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
	
	If Not @Error Then
		Local $v_Value = DllStructGetData($v_Buffer, 1)
		Return $v_Value
	Else
		SetError(6)
        Return 0
	EndIf
	
EndFunc

;==================================================================================
; Function:			_MemoryWrite($iv_Address, $ah_Handle, $v_Data[, $sv_Type])
; Description:		Writes data to the specified memory address.
; Parameter(s):		$iv_Address - The memory address which you want to write to.
;								  It must be in hex format (0x00000000).
;					$ah_Handle - An array containing the Dll handle and the handle
;								 of the open process as returned by _MemoryOpen().
;					$v_Data - The data to be written.
;					$sv_Type - (optional) The "Type" of value you intend to write.
;								This is set to 'dword'(32bit(4byte) signed integer)
;								by default.  See the help file for DllStructCreate
;								for all types.  An example: If you want to write a
;								word that is 15 characters in length, you would use
;								'char[16]' since a 'char' is 8 bits (1 byte) in size.
; Return Value(s):	On Success - Returns 1
;					On Failure - Returns 0
;					@Error - 0 = No error.
;							 1 = Invalid $ah_Handle.
;							 2 = $sv_Type was not a string.
;							 3 = $sv_Type is an unknown data type.
;							 4 = Failed to allocate the memory needed for the DllStructure.
;							 5 = Error allocating memory for $sv_Type.
;							 6 = $v_Data is not in the proper format to be used with the
;								 "Type" selected for $sv_Type, or it is out of range.
;							 7 = Failed to write to the specified process.
; Author(s):		Nomad
; Note(s):			Values sent must be in Decimal format, unless specified as a
;					'char' type, then they must be in ASCII format.  Also note
;					that size ('char[size]') for all 'char' types should be 1
;					greater than the actual size.
;==================================================================================
Func _MemoryWrite($iv_Address, $ah_Handle, $v_Data, $sv_Type = 'dword')
	
	If Not IsArray($ah_Handle) Then
		SetError(1)
        Return 0
	EndIf
	
	Local $v_Buffer = DllStructCreate($sv_Type)
	
	If @Error Then
		SetError(@Error + 1)
		Return 0
	Else
		DllStructSetData($v_Buffer, 1, $v_Data)
		If @Error Then
			SetError(6)
			Return 0
		EndIf
	EndIf
	
	DllCall($ah_Handle[0], 'int', 'WriteProcessMemory', 'int', $ah_Handle[1], 'int', $iv_Address, 'ptr', DllStructGetPtr($v_Buffer), 'int', DllStructGetSize($v_Buffer), 'int', '')
	
	If Not @Error Then
		Return 1
	Else
		SetError(7)
        Return 0
	EndIf
	
EndFunc

;==================================================================================
; Function:			_MemoryClose($ah_Handle)
; Description:		Closes the process handle opened by using _MemoryOpen().
; Parameter(s):		$ah_Handle - An array containing the Dll handle and the handle
;								 of the open process as returned by _MemoryOpen().
; Return Value(s):	On Success - Returns 1
;					On Failure - Returns 0
;					@Error - 0 = No error.
;							 1 = Invalid $ah_Handle.
;							 2 = Unable to close the process handle.
; Author(s):		Nomad
; Note(s):
;==================================================================================
Func _MemoryClose($ah_Handle)
	
	If Not IsArray($ah_Handle) Then
		SetError(1)
        Return 0
	EndIf
	
	DllCall($ah_Handle[0], 'int', 'CloseHandle', 'int', $ah_Handle[1])
	If Not @Error Then
		DllClose($ah_Handle[0])
		Return 1
	Else
		DllClose($ah_Handle[0])
		SetError(2)
        Return 0
	EndIf
	
EndFunc

;==================================================================================
; Function:			SetPrivilege( $privilege, $bEnable )
; Description:		Enables (or disables) the $privilege on the current process
;                   (Probably) requires administrator privileges to run
;
; Author(s):		Larry (from autoitscript.com's Forum)
; Notes(s):
; [url=http://www.autoitscript.com/forum/index.php?s=&showtopic=31248&view=findpost&p=223999]Memory reads and 3.2 (not beta) - AutoIt Forums[/url]
;==================================================================================

Func SetPrivilege( $privilege, $bEnable )
    Const $TOKEN_ADJUST_PRIVILEGES = 0x0020
    Const $TOKEN_QUERY = 0x0008
    Const $SE_PRIVILEGE_ENABLED = 0x0002
    Local $hToken, $SP_auxret, $SP_ret, $hCurrProcess, $nTokens, $nTokenIndex, $priv
    $nTokens = 1
    $LUID = DLLStructCreate("dword;int")
    If IsArray($privilege) Then    $nTokens = UBound($privilege)
    $TOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $NEWTOKEN_PRIVILEGES = DLLStructCreate("dword;dword[" & (3 * $nTokens) & "]")
    $hCurrProcess = DLLCall("kernel32.dll","hwnd","GetCurrentProcess")
    $SP_auxret = DLLCall("advapi32.dll","int","OpenProcessToken","hwnd",$hCurrProcess[0],   _
            "int",BitOR($TOKEN_ADJUST_PRIVILEGES,$TOKEN_QUERY),"int_ptr",0)
    If $SP_auxret[0] Then
        $hToken = $SP_auxret[3]
        DLLStructSetData($TOKEN_PRIVILEGES,1,1)
        $nTokenIndex = 1
        While $nTokenIndex <= $nTokens
            If IsArray($privilege) Then
                $priv = $privilege[$nTokenIndex-1]
            Else
                $priv = $privilege
            EndIf
            $ret = DLLCall("advapi32.dll","int","LookupPrivilegeValue","str","","str",$priv,   _
                    "ptr",DLLStructGetPtr($LUID))
            If $ret[0] Then
                If $bEnable Then
                    DLLStructSetData($TOKEN_PRIVILEGES,2,$SE_PRIVILEGE_ENABLED,(3 * $nTokenIndex))
                Else
                    DLLStructSetData($TOKEN_PRIVILEGES,2,0,(3 * $nTokenIndex))
                EndIf
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,1),(3 * ($nTokenIndex-1)) + 1)
                DLLStructSetData($TOKEN_PRIVILEGES,2,DllStructGetData($LUID,2),(3 * ($nTokenIndex-1)) + 2)
                DLLStructSetData($LUID,1,0)
                DLLStructSetData($LUID,2,0)
            EndIf
            $nTokenIndex += 1
        WEnd
        $ret = DLLCall("advapi32.dll","int","AdjustTokenPrivileges","hwnd",$hToken,"int",0,   _
                "ptr",DllStructGetPtr($TOKEN_PRIVILEGES),"int",DllStructGetSize($NEWTOKEN_PRIVILEGES),   _
                "ptr",DllStructGetPtr($NEWTOKEN_PRIVILEGES),"int_ptr",0)
        $f = DLLCall("kernel32.dll","int","GetLastError")
    EndIf
    $NEWTOKEN_PRIVILEGES=0
    $TOKEN_PRIVILEGES=0
    $LUID=0
    If $SP_auxret[0] = 0 Then Return 0
    $SP_auxret = DLLCall("kernel32.dll","int","CloseHandle","hwnd",$hToken)
    If Not $ret[0] And Not $SP_auxret[0] Then Return 0
    return $ret[0]
EndFunc   ;==>SetPrivilege

#endregion

[IAmHawtness]

Originally Posted by ookamocka

ne way... here's one for AutoIt... should be very similar to VB...

That's not really similar to VB, we don't need to use DLLCall. Just declare it.

Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As Long, ByVal lpBaseAddress As Long, lpBuffer As Any, ByVal nSize As Long, lpNumberOfBytesRead As Long) As Long

Then you'd have to have a timer or something to check the memory address like:

Private Sub ReadCharName_Timer()

Dim ProcessHandle as long

ProcessHandle = OpenProcess(ProcessID, false, PROCESS_ALL_ACCESS)

ReadProcessMemory ProcessHandle, PlayerBaseAddrPtr, MyChar.BaseAddr, 8, 0
ReadProcessMemory ProcessHandle, MyChar.BaseAddr + NamePtrOffset, MyChar.NamePtr, 8, 0
ReadProcessMemory ProcessHandle, MyChar.NamePtr, MyChar.NameString(0), 16, 0

CharacterName.Text = StrConv(MyChar.NameString, vbUnicode)

CloseHandle ProcessHandle

Of course you'd need to find the CO window first. You could use CreateToolhelp32Snapshot, Process32First, and Process32Next - or simply just use FindWindow, GetForegroundWindow, or whatever you like.

That's VB6 though, I think there's an easier way to look for processes by name in VB.net.

[Zeelia]

Thanks guys, finally receiving some help ^.^
And thanks for the code examples, ookamocka and IAmHawtness, this will really help me to proceed with my code.

I hope you can help me if i get some more errors. I really want to do this since there is no (known) application which uses VB.NET, which really is the easiest language (except English).

Okay so first I don't know how to find the player base address.
But for the charname, I have the memory address which isn't static, and I'm having troubles finding the pointer and offset because nothing writes to the memory address while I'm logged in so I have to do a pointer scan which really takes long time... Maybe its here that the player base address comes in?

But the XP was easier to find since conquer writes to it simultaneously. However I'm still having troubles finding the correct memory address and how to use the pointers.

And as for the handle for the CO window, I'm now using FindWindow and then I use GetWindowThreadProcessId to give the process id from the handle to a variable.

Thanks!
//Zeelia