Login

Santasgaming · (Dieser Beitrag wurde zuletzt bearbeitet: 04.05.2014, 12:45 von Santasgaming.)

I wonder if anyone could help me solve some problems with jumping to a cave, i am trying to make my code work so i can make a valid jump to my code cave, I use virtualallocEx to do so. but the jump code i have does not jump to the correct cave address, it always shoortens the address, like jumping , lets say i jump from &H12000000 and my allocation address is 140123456, then my jump will look like this JMP 123456, you see only the lower part of the address is getting writen as the destination address to my allocated cave.

The game i am working on is a game called Outlast and it is in 64 bit the exe i use, but i am not an expert on this so any help would be appreciated.

Code:

    Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click
        Try

   Dim TargetProcess As Process() = Process.GetProcessesByName(TextBox1.Text)
        TargetProcessHandle = OpenProcess(PROCESS_CREATE_THREAD Or PROCESS_VM_OPERATION Or PROCESS_VM_WRITE, False, TargetProcess(0).Id)
    
                       


                        Dim CaveAddr As Long = VirtualAllocEx(TargetProcessHandle, 0, &H1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE)
                        TextBox2.Text = Hex(CaveAddr)

                        MakeJmp(&H104C40FF0, "&H" & CaveAddr)


            

                        Exit For
                    End If
                Next
            End If

        Catch ex As Exception
            MessageBox.Show(ex.Message)
        End Try

    End Sub

DNA · 04.05.2014, 13:48

Hey,

i'll use your example addresses.

[code=VB]Dim CaveAddr As Long = VirtualAllocEx(TargetProcessHandle, 0, &H1024, MEM_COMMIT, PAGE_EXECUTE_READWRITE)[/code]
CaveAddr is now 140123456 = 85A1D40 Hex

[code=VB]MakeJmp(&H104C40FF0, "&H" & CaveAddr)[/code]
Your code jumps from &H104C40FF0 to &H140123456 but it should jump to &H85A1D40

If your MakeJmp Function works properly (which i don't know, unless i see it), you've to delete the "&H" &
[code=VB]MakeJmp(&H104C40FF0, CaveAddr)[/code]

Oh, and try to use the "newer" declarations...
Dim CaveAddr as Int32

Santasgaming · 04.05.2014, 13:58

I just need to eat and i will explain abit betterm, the address though is a very high one, its not like the addresses on a 32 byte process, its at for example 120C30110 and 1404562A3 like those high addresses,
cause i make jumps work fine for the 32 bit game versions, but for 64 i am making something wrong, i will try to post soon. thank you for helping.

Santasgaming · 04.05.2014, 14:30

Code:

    Public Function MakeJmp(ByVal lpAddress As Long, ByVal lpJmpAddress As Long, Optional ByVal lpNops As Long = 0) As Long
        Dim JmpByte As Byte() = {&HE9}
        MakeJmp = CBool(WriteByte(lpAddress, JmpByte)) And CBool(WriteLong(lpAddress + 1, lpJmpAddress - lpAddress - 5))
        If lpNops = 0 Then Exit Function
        Return MakeJmp
    End Function

This is the function i use here to jump to cave.
But i dont get it to work right i use this in the main module.

I think i maby are missing some declerations , also i thought int32 was only to be used on a 32 bit process. so i have changed my declerations to int64 and also tried to change them to long but still it makes the jump wrong.

Santasgaming · 04.05.2014, 23:59

I have this in a module now and i am stuck as to why i can not jump to alloccave on my game.

Code:

     

Imports System.ComponentModel
Module Module1
#Region "Declarations"
    Declare Function VirtualAllocEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As IntPtr
    Declare Function VirtualProtectEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal newProtect As Integer, ByRef oldProtect As Integer) As Boolean

    Public Declare Function CloseHandle Lib "KERNEL32" _
   (ByVal hObject As Int32) _
   As Boolean

    Public Declare Function GetAsyncKeyState Lib "USER32" _
    (ByVal vKey As Int32) _
    As Int16

    Public Declare Function IsDebuggerPresent Lib "KERNEL32" () As Boolean

    Public Declare Function OpenProcess Lib "KERNEL32" _
    (ByVal DesiredAccess As Int32, _
     ByVal InheritHandle As Boolean, _
     ByVal ProcessId As Int32) _
    As Int32

    Private Declare Function WriteProcessMemory Lib "kernel32" _
    (ByVal Handle As Integer, _
     ByVal address As Long, _
     ByRef Value As Int32, _
     ByVal Size As Integer, _
     ByRef lpNumberOfBytesWritten As Long) _
    As Long

    Private Declare Function ReadProcessMemory Lib "kernel32" _
    (ByVal Handle As Int32, _
     ByVal address As Int32, _
     ByRef Value As Int32, _
     Optional ByVal Size As Int32 = 4, _
     Optional ByVal lpNumberOfBytesWritten As Int64 = 0) _
    As Integer

    'PROCESS ACCESS RIGHTS.
    Public PROCESS_TERMINATE As Int32 = 1
    Public PROCESS_CREATE_THREAD As Int32 = 2
    Public PROCESS_VM_OPERATION As Int32 = 8
    Public PROCESS_VM_READ As Int32 = 16
    Public PROCESS_VM_WRITE As Int32 = 32
    Public PROCESS_DUP_HANDLE As Int32 = 64
    Public PROCESS_CREATE_PROCESS As Int32 = 128
    Public PROCESS_SET_QUOTA As Int32 = 256
    Public PROCESS_SET_INFORMATION As Int32 = 512
    Public PROCESS_QUERY_INFORMATION As Int32 = 1024
    Public PROCESS_SUSPEND_RESUME As Int32 = 2048
    Public PROCESS_ALL_ACCESS As Int32 = 4091

    'ALLOCATION TYPES.
    Public MEM_COMMIT As Int32 = 4096
    Public MEM_RESERVE As Int32 = 8192
    Public MEM_RESET As Int32 = 524288
    Public MEM_TOP_DOWN As Int32 = 1048576
    Public MEM_PHYSICAL As Int32 = 4194304

    'MEMORY PROTECTION TYPES.
    Public PAGE_NOACCESS As Int32 = 1
    Public PAGE_READONLY As Int32 = 2
    Public PAGE_READWRITE As Int32 = 4
    Public PAGE_WRITECOPY As Int32 = 8
    Public PAGE_EXECUTE As Int32 = 16
    Public PAGE_EXECUTE_READ As Int32 = 32
    Public PAGE_EXECUTE_READWRITE As Int32 = 64
    Public PAGE_EXECUTE_WRITECOPY As Int32 = 128

    Private Const ACCESS_RIGHTS_ALL = &H1F0FFF
    Private process_id As Int32 = 0
    Public pHandle As Integer = 0
    Dim FlagValue As Integer
    Public Function GetProcessId(ByVal game_name As String) As Boolean 'Checks to see if the game is running (returns True or False) and sets th pHandle *REQUIRED TO USE*
        For Each p As Process In Process.GetProcessesByName(game_name)
            process_id = p.Id
            pHandle = OpenProcess(56, False, process_id)
            Return True
        Next
        Return False
    End Function
#End Region
#Region "Memory Allocations"
    Public Function AllocMem() As Integer 'Allocates memory in the process and returns the starting address of the allocated area
        Dim pBlob As IntPtr = VirtualAllocEx(pHandle, New IntPtr(), New IntPtr(2048), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
        If pBlob = IntPtr.Zero Then
            Return 0
            MsgBox("The trainer couldn't implant the cheats. Please restart the trainer.", MsgBoxStyle.Critical, "Error")

        Else : Return pBlob
        End If
    End Function
    Sub RemoveProtection(ByVal AddressOfStart As Integer) 'Changes the protection of the page with the specified starting address to PAGE_EXECUTE_READWRITE
        Dim oldProtect As Integer
        If Not VirtualProtectEx(pHandle, New IntPtr(AddressOfStart), New IntPtr(2048), PAGE_EXECUTE_READWRITE, oldProtect) Then Throw New Win32Exception
    End Sub
#End Region
#Region "Write"
    Public Sub WriteByte(ByVal address As Int64, ByVal Value As Byte) 'Writes a single byte value
        WriteProcessMemory(pHandle, address, Value, 1, 0)
    End Sub
    Public Sub WriteInt32(ByVal address As IntPtr, ByVal Value As Int32) 'Writes a 4 bytes value
        WriteProcessMemory(pHandle, address, Value, 4, 0)
    End Sub
    Public Sub WriteASM(ByVal address As Int64, ByVal Value As Byte()) 'Writes assembly using bytes
        For i As Long = LBound(Value) To UBound(Value)
            WriteByte(address + i, Value(i))
        Next
    End Sub
    Public Function WritePointer(ByVal Pointer As Long, ByVal Buffer As Int32, ByVal OffSet() As Int32) 'Writes to a pointer
        For Each I As Integer In OffSet
            ReadProcessMemory(pHandle, Pointer, Pointer)
            Pointer += I
        Next
        WriteProcessMemory(pHandle, Pointer, Buffer, 4, 0)
        Return 0
    End Function
    Public Function WriteAddPointer(ByVal Pointer As Int32, ByVal Buffer As Int32, ByVal OffSet() As Int32) 'Adds a value to a pointer
        For Each I As Integer In OffSet
            ReadProcessMemory(pHandle, Pointer, Pointer)
            Pointer += I
        Next
        WriteProcessMemory(pHandle, Pointer, ReadInt32(Pointer) + Buffer, 4, 0)
        Return 0
    End Function
    ' 8 Bytes in den Przess schreiben
    Public Sub Write_Float(ByVal address As Int32, ByVal value As Int64)
        Dim process_handle As Int32
        process_handle = OpenProcess(ACCESS_RIGHTS_ALL, False, process_id)
        If process_handle <> 0 Then
            WriteProcessMemory(process_handle, address, value, 8, 0)
        End If
        CloseHandle(process_handle)
    End Sub
    ' Für die CodeInjection
    Public Sub autopatcher(ByVal address As Int32, ByVal value As Byte())
        Dim i As Byte
        For i = LBound(value) To UBound(value)
            WriteByte(address + i, value(i))
        Next
    End Sub
#End Region



    Public Function AllocJump(ByVal source As Int32, ByVal destination As Int32, Optional ByVal Nops As Integer = 0) As Boolean 'Creates a jump from the specified address to a destination address
        WriteByte(source, &HE9)
        WriteInt32(source + 1, destination - source - 5)
        If Nops = 0 Then
            Return 0
        End If
        For i As Int32 = 1 To Nops
            WriteByte(source + 4 + i, &H90)
        Next
        Return 0
    End Function

And This is in the form class

Code:

Public Class Form1


    Private Const ProcName = "Outlast"
    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        GetProcessId(ProcName)
        'WriteASM(&H140446285, New Byte() {&H90, &H90, &H90, &H90, &H90})
        Dim pBlob As UInt64 = VirtualAllocEx(pHandle, New IntPtr(), New IntPtr(2048), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
        TextBox1.Text = Hex(pBlob)' i use this to see the address in hex only
        Dim caveAddr = pBlob

        AllocJump(&H13CF0006, caveAddr)  'This Works fine 


    End Sub


End Class

I get the following error if i do this

AllocJump(&H13CA00000, caveAddr) This does not work , the address from my code is this high in the address so how do i do the jump?

"constant expression not representable in type 'integer'"

on 32 bit process if i jump from a lower address it works fine like this

AllocJump(&H13CA0000, caveAddr) This works fine , but why not for the higher address on 64 bit game?

Please help, i buy you a game on steam as thank you.

Santasgaming · 05.05.2014, 04:07

Dont allocjump not work on 64 bit games? how do you guys do it?
i see trainers for 64 bit games on such palce as gamecopy world but how do they do it?

Santasgaming · 05.05.2014, 11:19

i use cheat engine trainer maker, that works ok.

Will have to learn more of it but its good enough.

Smiling

DNA · 06.05.2014, 19:38

Hey,
could you make some screenshots of the MemoryViewer from CheatEngine
while your code is injected?

DerBaum · 06.05.2014, 22:22

(05.05.2014, 04:07)Santasgaming schrieb: Dont allocjump not work on 64 bit games? how do you guys do it?
i see trainers for 64 bit games on such palce as gamecopy world but how do they do it?

VirtualAllocEx doesn't work on 64 bit processes or to be clear: it does not handle 64 bit integers. Some 64 bit processes contain main modules inside of the "32 bit area" where VirtualAllocEx still work.

Personally I'm searching for code caves on my own and change the protection of this area to read/write.

Another solution (like Caliber from Cheathappens handles it) is to inject a dll file. You can use for example CreateRemoteThread or something similar.

Santasgaming · 07.05.2014, 05:53

(06.05.2014, 19:38)DNA schrieb: Hey,
could you make some screenshots of the MemoryViewer from CheatEngine
while your code is injected?

I got it to work for 32 bit trainer i'm making in vb, i code a simple game trainer in ce only for when i need it to work for 64 bit, but i would greatfull to get some help on how to use the sigscanner code i saw in another post, i'm trying to get it to work, but i'm not great for coding but trying to learn. so how could i call it and use a textbox to add my own array on the form when i after i run it, i see poster says you call it this way. where is sigscanner in module code? MsgBox(sigscanner.FindPattern(New Byte() {&H83, &H96, &H5C, &H6, &H0, &H0, &H8B, &H7, &H8B, &H90, &HB4, &H5, &H0, &H0}, "xx????xxxx????", &H0))

I mostly want this for my trainer i make for my emulation games. i'm more for making trainers for emulators and need the sigscanner to work so i can search for value with it with pattern.

if any can example of how i can call it from my form1 on a button to a text and i will be done with my simple cheat tool.
I found a dll that i can call from vb but i dont want to have any extra files with my project, i also try to learn about vb resource for my option sounds so i'm learning more.

Login
Benutzername:
Passwort:	Passwort vergessen?
	Merken