[6.1.2] GM Cloths - Morpher [Ferib]

[pvpferib]

Hello,

Today im gonne show you a new hack,
Called "GM Cloths" (Works only for Wow.exe!!!)
I have see much people use a morpher.
so i made a morpher that change your cloths to GM Clothes.
Post a comment if you have some good ideas!

How to use:

 Spoiler

1. Open both programmes.
2. copy / paste code (base adresse).
3. start Wow.exe or Wow-64.exe.
4. use a costume or change your cloths to see the GM Cloths. (or use it right before you logg in!)
5. Enjoy!

A pic of the GM Cloth morpher:

 Spoiler

VirusTotal:


Ferib.exe is my main set in wow, GM Cloths are just GM cloths!


Enjoy!

[Crossside]

1) you have scanned it wrong. Your VT is from the download-site url, not from your file.

Fixed VT (5 / 57) :

wowexe base.exe (6 / 57 ):

GMClothes.exe (2 / 57) :

2)
You have 2 Binarys in the Rar.. one for the "Gm Cloths" and one that does.. what?
Find out the Baseadress of WoW or what? Why you dont have implent it in the first binary? Sorry but it looks rly weird.

[pvpferib]

Hello,

Ofc its no malware,
Im just starting with programming and im not good in it.
Im gone change the virus total .
The "wowexe base.exe" get the base adresse.
The "GM Cloths.exe" pop up a window to put the baseadresse in.
I cant find a way to add tha baseadresse in the GM Cloth programme.
GM Cloths.exe

 Spoiler

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
#AutoIt3Wrapper_Version=Beta
#AutoIt3Wrapper_Icon=..\..\pumpkin icons\Iconka-Wicked-Wall-Pumpkin-Potter.ico
#AutoIt3Wrapper_Res_Comment=Its a Ferib progamme!
#AutoIt3Wrapper_Res_Description=GM Cloths
#AutoIt3Wrapper_Res_Fileversion=6.1.2.0
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <NomadMemory1.au3>
#include <MsgBoxConstants.au3>
;#include <pointer1.au3>
;#RequireAdmin
SetPrivilege("SeDebugPrivilege", 1)

;HotKeySet("{home}","_drop")
;FileInstall("Ccinfo.ex",@TempDir & "\Ccinfo.exe")
;fileopen("Ccinfo.exe",0)
local $baseADDR = InputBox("Thanks to: Ferib","What does the msg say?:","0x0040000","",150,130)
global $baseADDR

global $ID = ProcessExists("wow.exe")
Global $Offset1[3] = [0, Dec(4), Dec('f50')] ;head
Global $Offset2[3] = [0, Dec(4), Dec('f80')] ;chest
Global $Offset3[3] = [0, Dec(4), Dec('ff8')] ;cloak
Global $Offset4[3] = [0, Dec(4), Dec('fa4')] ;feet
Global $Offset5[3] = [0, Dec(4), Dec('f68')] ;sholder
Global $Offset6[3] = [0, Dec(4), Dec('fb0')] ;shirt
Global $Offset7[3] = [0, Dec(4), Dec('1028')] ;tabart
Global $Offset8[3] = [0, Dec(4), Dec('fbc')] ;gloves
Global $Offset9[3] = [0, Dec(4), Dec('f8c')] ;belt
Global $Offset10[3] = [0, Dec(4), Dec('f98')] ;pants
Global $Offset11[3] = [0, Dec(4), Dec('1004')] ;main hand
Global $Offset12[3] = [0, Dec(4), Dec('1010')] ;off hand
Global $Offset13[3] = [0, Dec(4), Dec('0')] ;bracer bug
global $StaticOffset = 0x00DC0BC8
global $finalADDR1 = ($baseADDR + $StaticOffset) ;Example::
global $finalADDR2 = ($baseADDR + $StaticOffset) ;$finalADDRy = "0x" & Hex ($baseADDR + $StaticOffsety)
global $finalADDR3 = ($baseADDR + $StaticOffset)
global $finalADDR4 = ($baseADDR + $StaticOffset) ;Example::
global $finalADDR5 = ($baseADDR + $StaticOffset) ;$finalADDRy = "0x" & Hex ($baseADDR + $StaticOffsety)
global $finalADDR6 = ($baseADDR + $StaticOffset)
global $finalADDR7 = ($baseADDR + $StaticOffset) ;Example::
global $finalADDR8 = ($baseADDR + $StaticOffset) ;$finalADDRy = "0x" & Hex ($baseADDR + $StaticOffsety)
global $finalADDR9 = ($baseADDR + $StaticOffset)
global $finalADDR10 = ($baseADDR + $StaticOffset) ;Example::
global $finalADDR11 = ($baseADDR + $StaticOffset) ;$finalADDRy = "0x" & Hex ($baseADDR + $StaticOffsety)
global $finalADDR12 = ($baseADDR + $StaticOffset)
global $finalADDR13 = ($baseADDR + $StaticOffset) ;Example::
global $gme = false

while 1
sleep(100)
if $gme = false Then
_gm()
Else
Exit
EndIf
sleep(10)
WEnd

func _gm()
$kimisgayagain = true
local $openmem = _MemoryOpen($ID)
_MemoryPointerWrite($finalADDR1, $openmem,$Offset1,12064, 'dword')
_MemoryPointerWrite($finalADDR2, $openmem,$Offset2,2586, 'dword')
_MemoryPointerWrite($finalADDR3, $openmem,$Offset3,0, 'dword')
_MemoryPointerWrite($finalADDR4, $openmem,$Offset4,11508, 'dword')
_MemoryPointerWrite($finalADDR5, $openmem,$Offset5,0, 'dword')
_MemoryPointerWrite($finalADDR6, $openmem,$Offset6,0, 'dword')
_MemoryPointerWrite($finalADDR7, $openmem,$Offset7,0, 'dword')
_MemoryPointerWrite($finalADDR8, $openmem,$Offset8,0, 'dword')
_MemoryPointerWrite($finalADDR9, $openmem,$Offset9,0, 'dword')
_MemoryPointerWrite($finalADDR10, $openmem,$Offset10,0, 'dword')
_MemoryPointerWrite($finalADDR11, $openmem,$Offset11,192, 'dword')
_MemoryPointerWrite($finalADDR12, $openmem,$Offset12,192, 'dword')
_MemoryClose($openmem)
msgbox(64,"thanks: Ferib","Enjoy your GM cloths!")
Exit
sleep(300)
EndFunc

I have no idea what the Windows Sockets and FTP Support is .
But i will change that if you can help me with it.
Im working at my own, i can use some help .

wowexe base.exe:

 Spoiler

#Region ;**** Directives created by AutoIt3Wrapper_GUI ****
;#AutoIt3Wrapper_Icon=C:\Users\TX-152\Downloads\Oxygen-Icons.org-Oxygen-Actions-document-save.ico
#EndRegion ;**** Directives created by AutoIt3Wrapper_GUI ****
#include <WinAPI.au3>
#include <NomadMemory.au3>
Global $_COMMON_KERNEL32DLL=DllOpen("kernel32.dll")


$Process = 'wow.exe'

If Not ProcessExists($Process) then
MsgBox(0, "", $Process&" is not running")
Exit
EndIf

;$aTemp[1] contains the base address
MsgBox(0, "",$aTemp[1])




Func _ProcessOpen($vProcessID,$iAccess,$bInheritHandle= False)
Local $aRet
; Special 'Open THIS process' ID? [returns pseudo-handle from Windows]
If $vProcessID=-1 Then
$aRet=DllCall($_COMMON_KERNEL32DLL,"handle","GetCu rrentProcess")
If @error Then Return SetError(2,@error,0)
Return $aRet[0] ; usually the constant '-1', but we're keeping it future-OS compatible this way
ElseIf Not __PFEnforcePID($vProcessID) Then
Return SetError(16,0,0) ; Process does not exist or was invalid
EndIf
$aRet=DllCall($_COMMON_KERNEL32DLL,"handle","OpenP rocess","dword",$iAccess,"bool",$bInheritHandle,"d word",$vProcessID)
If @error Then Return SetError(2,@error,0)
If Not $aRet[0] Then Return SetError(3,@error,0)
Return SetExtended($vProcessID,$aRet[0]) ; Return Process ID in @extended in case a process name was passed
EndFunc

Func _ProcessGetModuleBaseAddress($vProcessID,$sModuleN ame,$bList32bitMods=False,$bGetWow64Instance=False )
Local $i=0,$aModList
If Not $bList32bitMods Then $i=4 ; flag 4 = stop at 1st match (only if 32-bit modules aren't being listed)
$aModList=_ProcessListModules($vProcessID,$sModule Name,$i,$bList32bitMods)
If @error Then Return SetError(@error,@extended,-1)
If $aModList[0][0]=0 Then Return SetError(-1,0,-1)
; If a Wow64 Process (and $bList32bitMods=True), its possible more than one module name will match
If $aModList[0][0]>1 Then
If $bList32bitMods And $bGetWow64Instance Then Return SetExtended($aModList[2][4],$aModList[2][3])
SetError(-16) ; notify caller that >1 match was found, but returning 1st instance since $bGetWow64Instance=False
EndIf
Return SetError(@error,$aModList[1][4],$aModList[1][3]) ; SetExtended() actually clears @error, so we must use SetError()
EndFunc
Func _ProcessMemoryVirtualQuery($hProcess,$pAddress,$iI nfo=-1)
If Not IsPtr($hProcess) Or Ptr($pAddress)=0 Or $iInfo>6 Then Return SetError(1,0,-1)
; MEMORY_BASIC_INFORMATION structure: BaseAddress, AllocationBase, AllocationProtect, RegionSize, State, Protect, Type
Local $aRet,$stMemInfo=DllStructCreate("ptr;ptr;dword;ul ong_ptr;dword;dword;dword"),$iStrSz=DllStructGetSi ze($stMemInfo)
$aRet=DllCall($_COMMON_KERNEL32DLL,"ulong_ptr","Vi rtualQueryEx","handle",$hProcess,"ptr",$pAddress," ptr",DllStructGetPtr($stMemInfo),"ulong_ptr",$iStr Sz)
If @error Then Return SetError(2,@error,-1)
If Not $aRet[0] Then Return SetError(3,@error,-1)
If $aRet[0]<>$iStrSz Then ConsoleWriteError("Size (in bytes) mismatch in VirtualQueryEx: Struct: "&$iStrSz&", Transferred: "&$aRet[0]&@LF)
; Return ALL?
If $iInfo<0 Then
Dim $aMemInfo[7]
For $i=0 To 6
$aMemInfo[$i]=DllStructGetData($stMemInfo,$i+1)
Next
Return $aMemInfo
EndIf
Return DllStructGetData($stMemInfo,$iInfo+1)
EndFunc

#
Func _ProcessListModules($vProcessID,$sTitleFilter=0,$i TitleMatchMode=0,$bList32bitMods=False)
If Not __PFEnforcePID($vProcessID) Then Return SetError(1,0,"")
Local $hTlHlp,$aRet,$sTitle,$bMatchMade=1,$iTotal=0,$bMa tch1=0,$iArrSz=40,$iNeg=0
If $sTitleFilter="" Then $sTitleFilter=0
If BitAND($iTitleMatchMode,8) Then
$iNeg=-1
; 'Stop at first match' flag set?
ElseIf BitAND($iTitleMatchMode,4) And IsString($sTitleFilter) Then
$iArrSz=1
$bMatch1=1
EndIf
$iTitleMatchMode=BitAND($iTitleMatchMode,3)
Dim $aModules[$iArrSz+1][6]
; MAX_MODULE_NAME32 = 255 (+1 = 256), MAX_PATH = 260
; ModuleEntry32: Size, Module ID, Process ID, Global Usage Count, Process Usage Count, Base Address, Module Size, Module Handle, Module Name, Module Path
Local $stModEntry=DllStructCreate("dword;dword;dword;dwo rd;dword;ptr;dword;handle;wchar[256];wchar[260]"),$pMEPointer=DllStructGetPtr($stModEntry)
DllStructSetData($stModEntry,1,DllStructGetSize($s tModEntry))
If $bList32bitMods Then
; TH32CS_SNAPMODULE32 0x00000010 + ; TH32CS_SNAPMODULE 0x00000008
$hTlHlp=__PFCreateToolHelp32Snapshot($vProcessID,0 x18)
Else
; TH32CS_SNAPMODULE 0x00000008
$hTlHlp=__PFCreateToolHelp32Snapshot($vProcessID,8 )
EndIf
If @error Then Return SetError(@error,@extended,"")
; Get first module
$aRet=DllCall($_COMMON_KERNEL32DLL,"bool","Module3 2FirstW","handle",$hTlHlp,"ptr",$pMEPointer)
While 1
If @error Then
Local $iErr=@error
__PFCloseHandle($hTlHlp)
Return SetError(2,$iErr,"")
EndIf
; False returned? Likely no more modules found [LastError should equal ERROR_NO_MORE_FILES (18)]
If Not $aRet[0] Then ExitLoop
$sTitle=DllStructGetData($stModEntry,9) ; file name
If IsString($sTitleFilter) Then
Switch $iTitleMatchMode
Case 0
If $sTitleFilter<>$sTitle Then $bMatchMade=0
Case 1
If StringInStr($sTitle,$sTitleFilter)=0 Then $bMatchMade=0
Case Else
If Not StringRegExp($sTitle,$sTitleFilter) Then $bMatchMade=0
EndSwitch
$bMatchMade+=$iNeg ; toggles match/no-match if 0x8 set
EndIf
If $bMatchMade Then
$iTotal+=1
If $iTotal>$iArrSz Then
$iArrSz+=10
ReDim $aModules[$iArrSz+1][6]
EndIf
$aModules[$iTotal][0]=$sTitle
$aModules[$iTotal][1]=DllStructGetData($stModEntry,10) ; full path
$aModules[$iTotal][2]=DllStructGetData($stModEntry,8) ; module handle/address (normally same as Base Address)
$aModules[$iTotal][3]=DllStructGetData($stModEntry,6) ; module base address
$aModules[$iTotal][4]=DllStructGetData($stModEntry,7) ; module size
$aModules[$iTotal][5]=DllStructGetData($stModEntry,5) ; process usage count (same as Global usage count)
; Process ID is same as on entry, Module ID always = 1, Global Usage Count = Process Usage Count
If $bMatch1 Then ExitLoop
EndIf
$bMatchMade=1
; Next module
$aRet=DllCall($_COMMON_KERNEL32DLL,"bool","Module3 2NextW","handle",$hTlHlp,"ptr",$pMEPointer)
WEnd
__PFCloseHandle($hTlHlp)
ReDim $aModules[$iTotal+1][6]
$aModules[0][0]=$iTotal
Return $aModules
EndFunc

Func __PFCreateToolHelp32Snapshot($iProcessID,$iFlags)
; Parameter checking not done!! (INTERNAL only!)
Local $aRet
; Enter a loop in the case of a Module snapshot returning -1 and LastError=ERROR_BAD_LENGTH. We'll try a max of 10 times
For $i=1 To 10
$aRet=DllCall($_COMMON_KERNEL32DLL,"handle","Creat eToolhelp32Snapshot","dword",$iFlags,"dword",$iPro cessID)
If @error Then Return SetError(2,@error,-1)
; INVALID_HANDLE_VALUE (-1) ?
If $aRet[0]=-1 Then
; Heap (0x1) or Module (0x8 or 0x18) Snapshot? MSDN recommends retrying the API call if LastError=ERROR_BAD_LENGTH (24)
If BitAND($iFlags,0x19) And _WinAPI_GetLastError()=24 Then ContinueLoop
; Else - other error, invalid handle
Return SetError(3,0,-1)
EndIf
Sleep(0) ; delay the next attempt
Next
If $aRet[0]=-1 Then Return SetError(4,0,-1)
Return $aRet[0]
EndFunc
Func __PFCloseHandle(ByRef $hHandle)
If Not IsPtr($hHandle) Or $hHandle=0 Then Return SetError(1,0,False)
Local $aRet=DllCall($_COMMON_KERNEL32DLL,"bool","CloseHa ndle","handle",$hHandle)
If @error Then Return SetError(2,@error,False)
If Not $aRet[0] Then Return SetError(3,@error,False)
; non-zero value for return means success
$hHandle=0 ; invalidate handle
Return True
EndFunc
Func __PFEnforcePID(ByRef $vPID)
If IsInt($vPID) Then Return True
$vPID=ProcessExists($vPID)
If $vPID Then Return True
Return SetError(1,0,False)
EndFunc

A guy helped me with this programme.
No idea how this work but it works .

The "GM Cloths.exe" is like a morpher,
Log in, start the programme, enter world.
and you have a GM hat GM slippers and GM robe.
Other cloths like sholders are not visible.
This is made to troll ppl, take nice screenshots or things like that.

ty for your feedback!

[Crossside]

1) you have the autoit code to get the base adress, it should not be hard to put it in one single binary ( = looks not weird like malware stuff ). but i can´t code autoit so i can't help you with that sorry.

2) That with the Windows Sockets and Ftp should be posted in another Thread, sorry (my fault - have edit it already).

3) you really should learn autoit / code before you make software like this. if you dont know "how it is working", you dont know much enought about it. The idea is nice, but i think you should learn autoit more & recode it (like that the users dont need to input the base-adress, nice gui etc)

greets

[pvpferib]

Well i knowed a code to find the base adresse without that programme.
But taht code dont work,
it give me an error, but im just started with programming,
I know enough of programming to programme.
Memory reading/writing is all i know for so far.

Maybe someone that can give me some advice or maybe i need to learn programming in C++

I will try to make my hack working with 1 programme!


This code would give the base adresse, but it give an error: "undifined function"
Is that cuz there is somthing wrong in "Pointer.au3" ?
help!


greets,

I reporgammed it and maded it 1 binary ^^