[RELEASE]Der-Gerät + source

[balika01]

Source:

 Spoiler

#include <windows.h>
#define X86_NOP 0x90

void NOPByAddressAndCount(DWORD address, int count)
{
	DWORD oldProtection;
	VirtualProtect((void *)address, count, PAGE_EXECUTE_READWRITE, &oldProtection);
	
	for(int i = 0; i < count; ++i)
		*(BYTE*)(address + i) = X86_NOP;
	
	DWORD dwProtection;
	VirtualProtect((void *)address, count, oldProtection, &dwProtection);
}

DWORD FindAddressInMemory(DWORD startaddress, BYTE* tofind, int size)
{
	DWORD SizeOfCode;

	DWORD i = 0x00400000;
	while((memcmp((void *)i, "PE\0\0", 4)) && (i <= 0x00401000))
		i++;

	if (i <= 0x00401000)
		SizeOfCode = *(DWORD *)(i + 0x50);

	for(DWORD i2=0; i2 < SizeOfCode; ++i2)
	{
		BYTE data = (BYTE*)(startaddress + i2);
		for(; 0 < size; --size,++data,++tofind)
			if(*data!=*tofind) 
				continue;
		return (DWORD)(startaddress+i2); 
	}
	return 0;
}

BOOL APIENTRY DllMain(HMODULE hModule, DWORD  reason, LPVOID lpReserved)
{ 
	switch(reason) 
	{ 
		case DLL_PROCESS_ATTACH:
			DisableThreadLibraryCalls(hModule);

			BYTE tofind1[] = {0x00, '.', 'p', 'y', 'c', 0x00};
			DWORD ADDR1 = FindAddressInMemory(0x00401000, tofind1, 6) + 1;

			BYTE tofind2[] = {0x00, '.', 'p', 'y', 0x00};
			DWORD ADDR2 = FindAddressInMemory(ADDR1, tofind2, 5) + 1;

			BYTE tofind3[] = {0x68, 0x00, 0x00, 0x00, 0x00};
			*(DWORD*)(tofind3+1) = ADDR2;

			DWORD ADDR3 = FindAddressInMemory(0x00401000, tofind3, 5);

			NOPByAddressAndCount(ADDR3, 0x3A);
			return TRUE;
	} 
}

[Red Firestar]

Danke ^^

[Looping78]

More information please ?

[balika01]

Originally Posted by Looping78

More information please ?

working Der-Gerät, no more information needed

[Looping78]

oh you share one dll file with 0 information, thats good

[lucy08]

how to use it?

[LazYGirl.]

useful but its hard way to create it by the simple way you could use patterns it could be more more easier.

simple fix not tested yet because i wrote codes on my bed with my laptop lol.
here it is :

HANDLE hProcess = OpenProcess(PROCESS_VM_READ, false, GetCurrentProcessId());
for(;;)
{
      char* read;
      //ReadProcessMemory(hProcess, (void*)address, &read, sizeof(read), 0); 
      memcpy(read, (void*)address, 2); // edit address according to address of py in the memory.
      if (read != "py") // just controlling py because its main part of it.
          ExitProcess(0);

      Sleep(1000);
}

[balika01]

Originally Posted by lucy08

how to use it?

inject to metin2 process

Originally Posted by Looping78

oh you share one dll file with 0 information, thats good

[EngelEatos]

do you have the permission of crank?

[LazYGirl.]

Originally Posted by EngelEatos

do you have the permission of crank?

no need to have permissions of crank , just name is copied other codes etc. from balika and if you know how to doing it you can create your own der-gerat its public thing.

[KaMeR1337]

i don't get it, what is this even the code doesn't says much

[*Casi*]

balika <3 he is the best.

[LazYGirl.]

Originally Posted by KaMeR1337

i don't get it, what is this even the code doesn't says much

i think der-gerat make you able to get image files etc.

[lucy08]

edit:
it works but the files are corupted, any solution?

[DasSchwarzeT]

Schön und gut, 90% aller Leute können damit nichts anfangen, weil sie keine Ahnung haben wie man es injected

Aber ich finde es gut, dass du KEIN Tutorial gemacht hast, sonst released nächste Woche jeder seinen Entpacker ._.