CoSMOS Changelog v1.4.1



[+] Added an additional page to the wizard letting users know where they can find video tutorials for CoSMOS
[+] Added a checkbox to the first wizard page to skip all pages for experienced users
[+] Added a new 'Video tutorials' context item to the help button
[+] Added custom exception when enabling speedhack has failed
[+] Added messagebox when trying to attach to a secured process. Many people have reported this issue/crash but in fact, it is caused by multiplayer anti-cheats.



Updated Devexpress components to 16.1.7


[!] [REPORTED] Fixed exception in several cases when CoSMOS is launched by another program instead
[!] Fixed some paths in ignored process file aren't affecting the process list
[!] Fixed crash in .NET viewer
[!] Fixed mono features are still active when attaching to a mono based game first and then to a non-mono based game


CoSMOS Changelog v1.4.0.0

Big changes in 1.4.0:

- Added 'Find out what addresses this instruction accesses' to memory viewer
- Changed the way addresses are stored in CoSMOS to CE's method
- Settings are stored in a setting file now and lots of additional settings have been added
- You can pause/resume the target process now
- CoSMOS uses now Capstone disassembler

-----------------------------------------------------------------------------------------

[+] You can change nearly all colors of the script editor now in settings
[+] You can change syntax highlighting color of memory viewer now in settings
[+] Pressing ESC key will now close the Find AOB dialog
[+] You can change the forecolor of scripts and pointers in stored items in settings now
[+] Added information about the current lines of self written code in about dialog
[+] You can change the register values in memory viewer on breakpoint hit now (or copy them)
[+] In memory viewer the comment section is now auto-filled by Cosmos if no comment has been set. It will read out pointers and convert hex values to decimal
[+] Inspired by x64dbg, added jump/call preview window on mouse hover and/or on selection to memory viewer, visible only if target location is outside of screen
[+] Re-added bookmarks to memory viewer
[+] Added 'Previous' column to scan results used for auto-refreshing values
[+] You can change type of multiple items in scan results at once by selecting them and edit one
[+] [REQUESTED] Added the possibility to (un)pause the selected process
[+] Added a copy button to exception report form
[+] Added support of pointer and strings in DotNet viewer which will be added on double click to stored item list
[+] [REQUESTED] Added possibility to change the temp folder for scan files of CoSMOS in settings
[+] Added pause/unpause on scan checkbox to advanced options
[+] Added a way to hide processes in cosmos. Enter the process name you want to be hidden in the _hideProcesses.txt file in CoSMOS directory
[+] Added an alternative method to retrieve a process icon in case the default method has failed
[+] Added auto complete to process list. When opened you can start typing to quickly select the process you are looking for
[+] Toast notification if a CoSMOS update is available
[+] Inspired by a CE request: Added 'Increase By Enumeration' context menu item where you can increase all selected items by +1 + the incremental of the previous item. So +1 for the first, +2 for the second, +3 for the thirst and so on.


Changed the way of working with addresses. From now on it works the way as CheatEngine. For example by adding addresses you can modify the base like 'address+20'. This however will break some old CoSMOS scripts, sadly. But it improved the support of CheatEngine table and makes it easier for people to work with CoSMOS if they have worked with CheatEngine before
The go to address dialog will now have the current selection address as default text
Separation between addresses and symbols has been removed. You can add them in the same single step.
The address field is now focused when opening the add address dialog so you can start typing immediately
Addresses in 32bit range of a 64bit process will no longer be displayed as a 64bit range. Less zeros making it easier to read
Replaced SharpDisasm disassembler by Capstone disassembler
[REQUESTED] Find AOB dialog will now start by searching within the module you are currently browsing in memory viewer. If you are not within a module it will use the default settings
All settings are now saved in installation directory and all settings can be changed on settings tab
Hide help button on prompts as it is without function
Exception handling on mono injection
Decreased comments column size and increased address column size in memory viewer
Jump line is now dashed and thinner
Auto-refreshing values in scan results is on by default
Changed tab order on exception report form
Improved recognition of hotkeys especially hotkey combinations
Heavily improved speed of opening process list
Process selection window is now resizeable
Small performance improvements here and there
Find out what access/writes will now increase the breakpoint window instead of registers window when changing the window size

[!] Ribbon and some bars no longer reacts to alt key pressed causing some issues with menu hotkeys where alt key was used
[!] [REPORTED] Added an information messagebox if trying to use 'Find out what' on 32-bit process, fixed a possible crash
[!] [REPORTED] CoSMOS freezes on attaching debugger. Please note that the debugger part is still very experimental!
[!] Fixed color changes in scan results disappear to fast
[!] Fixed 'Injection here' marker in scripts goes one opcode too far
[!] [REPORTED] Fixed multiple shortcuts in programs folder created by installer on upgrades
[!] [REPORTED] Added a messagebox if trying to use dotNET feature when the proxy process file does not exist in installation directory, fixed exception [!] Fixed setting breakpoints when debugger is not attached in memory viewer
[!] Fixed messagebox spam if attached process is closed and you scroll to end of line in memory viewer
[!] Fixed crash in memory viewer if you wanted to jump to unexpected addresses
[!] Fixed memory viewer not starts at main module when attached for the first time
[!] Exception is no longer url formatted when copied to clipboard
[!] Fixed add new address dialog can cause a huge lag if not attached to a process
[!] Fixed type of scan result cannot be changed when auto-refresh is active
[!] Fixed pressing CTRL+A in scan results will add all selected items to the stored item list instead of selecting all scan results
[!] Fixed some exceptions when a read value is invalid in several locations in CoSMOS
[!] Fixed if you copy and paste an entry in stored items and modify one, both gets modified
[!] Fixed a rare issue where the exception reporter cannot be closed
[!] Fixed crash/freeze when attaching debugger to a Unity based game
[!] Fixed find out what access/writes sometimes shows null as address/opcode
[!] Fixed possible exception in memory dump viewer


CoSMOS Changelog v1.3.5.0

[+] Added first implementation of a debugger. You can set a breakpoint in memory viewer, view registers and resume. 64-Bit only!
[+] Added 'Find out what accesses to' and 'Find out what writes to'. 64-Bit only!
[+] Added a toggle for even/odd rows having different color schemes in memory viewer
[+] Added a menu button to insert a register symbol snippet to the script editor
[+] Added a bunch of hotkeys to several buttons


Replaced dock panels in scanner with split panels
Script will be checked for errors before adding to stored item list
Do not inform user that the table is saved on crash when the table is not saved because it was empty
Odd lines in memory viewer have a different background color making it easier to read. This can be toggled.
Selected cell in memory viewer is no longer highlighted
If it fails to send a crash, it asks now whether to copy the information to clipboard
Tab header of memory dump is hidden now
For skilled and experts the default scan value is now 4 bytes
Add new symbol item uses now the default add new item form where symbol is checked by default
Add new stored item or add new symbol item is now at 8 bytes if attached to a 64bit process
Hotkey to start the tutorial has changed from F2 to ALT+F2
The list of processes shows more items at once now
Jump lines have been improved and point to the correct line in memory viewer if this line is visible

[!] Setting for showing jump lines isn't loaded properly
[!] Color of tabs at the bottom hasn't changed until you mouse hover after changing experience level
[!] Fixed rare crash when using go to address due to SharpDisasm bug
[!] Fixed crash on some .NET games where .NET viewer is used
[!] Fixed jump lines are not fully drawn when memory viewer window is maximized



CoSMOS Changelog v1.3.0.0

[+] Added description why a script injection has failed (if the reason is known)
[+] Added notification if you try to use the  .NET viewer on non-dotnet based games
[+] Completely reworked value converter, application wide hotkey: SHIFT+F3
[+] Added a button to launch windows calculator, application wide hotkey: CTRL+SHIFT+F3
[+] Completely reworked the FAQ part
[+] Added a 'Nop selected opcodes' to memory viewer
[+] Added button to turn off auto-complete on go to address including a hotkey CTRL+ALT+A
[+] Added hotkey to toggle module names in memory viewer: CTRL+M
[+] Added an option to toggle horizontal and vertical lines in memory viewer
[+] Added preview to Add Address window showing the final address and value
[+] Added browse in dump context menu item to stored item list
[+] Added basic jump line support to memory viewer which currently only shows the direction
[+] Added more FAQ videos
[+] Added RPG Maker scan type, see FAQ for more information


Removed UPX to reduce false flags from AVs
Changed routine on address conversion to hopefully fixed the not comprehensible overflow crash some users have reported
Horizontal and verticles lines in memory viewer are disabled by default now
Hex in memory viewer is displayed in upper case and without leading "0x" now
Code cleanup

[!] Fixed go-to-address history appeared in AOB finder
[!] Fixed copy offset in memory viewer hasn't worked on symbol addresses (it copies the module offset now)
[!] Fixed following jumps was broken in last version
[!] Fixed .NET viewer crash
[!] Fixed speedhack crashes 64-bit games on some computers



CoSMOS Changelog v1.2.8.1

[!] Possible crash when saving table and attached process has exited
[!] Fixed freezing values stopped working



CoSMOS Changelog v1.2.8.0

[+] Added CTRL+C and CTRL+V in stored item list to copy and paste items
[+] DotNet Viewer


Moving items in stored item list has been changed so you can either add items to existing items or just change the index.

[!] Added check if external files exist before using them
[!] Fix script injection on some 64-bit games



CoSMOS Changelog v1.2.7.0

[+] Added all missing jump instructions to syntax highlighting
[+] Added 'ah,bh,ch,dh' register to syntax highlighting
[+] Added links to help menu
[+] Added CTRL+R hotkey to memory viewer to refresh
[+] Added notifications if beginner and scan takes longer than 15 seconds to remind switching to skilled or expert and change data type


All tabs are shown by default and tabs are disabled accorded your experience level
Re-enabled toast notifications

[!] Fixed speedhack freezes 64-bit games in some circumstances
[!] Fixed crash if you enable speedhack twice on the same process.
[!] Fixed some script problems if key words are written in upper- or mixed-case.
[!] Fixed unity engine detection may fail on 32bit games
[!] Possibly fixed reported overflow crash on UpdateNode in stored items list
[!] Fixed crash if trying to jump to a negative address in dump viewer (why would someone do that at all?)



CoSMOS Changelog v1.2.6.0

[+] Option to turn off the disclaimer on table import -> check settings tab
[+] Added hotkeys and tooltips to script editor menu items
[+] Added if you add a script that contains registered symbols you'll be asked if CoSMOS should add these symbols to the list as well. This should save some time on table creation


The header field 'Offsets' in adding new address dialog can no longer be filled (which value was ignored anyway)
Increased the animation speed when switching between the tabs to make it feel less laggy
Requested: Show everything at start without requiring to attach to a process first (since we have an in-app tutorial, this is indeed not really required anymore)

[!] Fixed several crashes if you start CoSMOS for the first time with tutorial enabled and use various options without attaching CoSMOS to a process. Thanks for report!
[!] Fixed out of order columns in dump view in some circumstances
[!] Fixed crash when using dumpview options when no dump is shown
[!] Fixed missing check if offset is valid on adding an address dialog
[!] Fixed error message when trying to add an address with address value of zero.
[!] Fixed game freezes when injecting speedhack in some circumstances



CoSMOS Changelog v1.2.5.0

[+] Added 'Ctrl+Space' hotkey to synchronize the views in memory viewer
[+] Added popup menu toggle item 'Show as hex' to dump viewer
[+] Dump viewer is now writeable
[+] Added Mono (unity engine) support (memory viewer + script editor)
[+] Added a 'Check Syntax' button to script editor. It checks if the script can be injected without actually injecting code
[+] Added 'jnp' and 'jbe' to syntax highlighting
[+] Added [Enable] and [Disable] to syntax highlighting
[+] Added if you press 'right' arrow key on Go To Address dialog it jumps to the end of auto completion now
[+] Added license files for third party tools


CoSMOS default table name on import/export is now the process name cosmos is attached to
Default dump view is now in HEX
Speedhack has been moved into a new ribbon group and becomes visible after you've attached to a process
Improved startup time a little bit
Improved cleanup
Improved recognition if memory viewer or dump viewer has got focus
Dump view will now show values not equal to 0 in bold font
If you edit an existing item in stored items the depending nodes are expanded if the content is set. Means address node is expanded if it is a Symbol and offset node is expanded if it contains offsets.
Experience level has been moved back into ribbon menu as requested


[!] Fixed reported OverflowException crash
[!] Fixed reported crash on importing corrupted settings file
[!] Fixed CoSMOS can start outside of screen
[!] Fixed float and double values are displayed incorrectly in scan results when auto-refresh is not active
[!] Fixed register syntax highlight in script editor not works if assembly register is start or end of line
[!] Not a bug but should have been by default: CoSMOS now deactivate all scripts if you close CoSMOS and the game is still running to restore the original game memory



CoSMOS Changelog v1.2.4.0

[+] Added pointer import from CE tables
[+] Unique color for pointers in stored items (Blue)
[+] If you double click on a stored item it lets you edit (and overwrite) this item in a dialog


Removed memorysharp reference and replaced the two functions used with self-written code
Changed the green color of scripts in table so you can read it better when using a bright theme
Fixed some small memory leaks on registered symbols

[!] Fixed crash in GetPointer function reported by multiple users
[!] Fixed a crash on importing CE tables in some circumstances



CoSMOS Changelog v1.2.3.0

[!] Fixed add address dialog was sizeable
[!] Fixed registered symbol weren't registered when attaching to a process first and then loading a cosmos table
[!] Fixed editing values on pointers



CoSMOS Changelog v1.2.2.0

[+] Added support to search AOB within 64-bit modules
[+] Added pointer support
[+] Added a new dialog for adding addresses to the stored items which you can use to add pointer

[!] Fixed script templates in memory viewer will use module+offset instead of module only for aob and 64bit parts
[!] Fixed when going to a module address in memory viewer and you select multiple rows it also selects the row before the module address as well
[!] Fixed go to address via context menu in memory viewer is not centered to CoSMOS
[!] Fixed registered symbol addresses aren't registered if you add them and attach to a(nother) process afterwards
[!] Fixed crash on startup on CoSMOS 1.2.1



CoSMOS Changelog v1.2.1.0

[+] Added symbol support to stored items (Script makers: Click on the add item menu in the stored item list and choose "Add a symbol item" and enter the name of the registered symbol you have used in your script)
[+] Added "Find AOB" dialog to memory viewer. Press CTRL+F to open or click on the new menu button.
[+] Added 11 additional themes
[+] Added a new "AOB Module" injection template for script editor
[+] Creating scripts from memory viewer will now create a comment at the bottom of the script containing the injection location
[+] Added a proper dump view to memory viewer (currently read-only)
[+] Added more in-app FAQs


Improved CE table support for custom registered symbols + Addresses are now imported from CE tables as well as long as they're not pointers
Improved performance when adding huge amount of scan results to stored items
Process/window list is now sorted by memory usage. Process with highest memory usage are on top.
Revert change from only visible items in stored item list gets updated. Added new method to update all items with nearly zero performance loss
Moved experience level settings into new 'Menu' in the top left of CoSMOS
Script editor templates are now properly set up if target process is 64bit
Removed auto-complete on address cell in stored items
Compressed FAQ videos to reduce the file size

[!] Fixed memory leak on stored items
[!] Fixed always the default CH theme is loaded on start (if you have set another theme you had to set it again on every start)
[!] Fixed memory viewer table layout isn't saved properly
[!] Fixed merging of existing settings does not work properly
[!] Fixed changing between hex/decimal in stored items affects all items and not the selected items as expected



CoSMOS Changelog v1.2.0.0

[+] Added two additional themes including a new setting where you can choose between all themes
[+] Added copy offset context menu item and hotkey to memory viewer
[+] Memory viewer shows addresses as symbols now if exist
[+] Added Speedhack (32-Bit & 64-Bit supported)
[+] Added more hotkeys to assign in settings


Stored items get updated only when visible like scan results
Upgraded to DevExpress 16.1.5 controls

[!] Fixed crash if you add a search result to stored item list in some circumstances
[!] Fixed syntax highlighting in memory viewer sometimes draw registers in transparent color
[!] Fixed following jumps/calls in memory viewer doesn't work if the address is shown as symbol/module name
[!] Fixed new settings were hidden when upgrading from an older CoSMOS version



CoSMOS Changelog v1.1.16.0

[+] Added tutorial videos
[+] Added value showing the amount of items after a filter has been applied comparing to the amount of unfiltered nodes
[+] Added crash report form
[+] Added feedback form
[+] Added 'View module names' item for memory viewer
[+] Added 'Refresh' menu item for memory viewer
[+] Improved symbol handling. 'Go To Address' works now with 32-bit modules as well.
[+] 'Go To Address' works with symbol functions now, for example "kernel32.terminateprocess" will bring you to the address of this function.
[+] Added register syntax highlighting in memory viewer and script editor
[+] Added 'Overwrite' menu item if you edit a script
[+] Added module list to memory viewer
[+] Added symbol list to memory viewer (double click on module to load its symbols)
[+] Added update notification
[+] Added more in-app FAQ entries


Auto-refresh is off by default now (revert change from previous version)
Module names in memory viewer are now in quotes when necessary to avoid issues on script creation
Table is no longer backup'd if it is empty
Changed color table on memory viewer & call/returns are separately colored
Adding scripts to table will automatically switch view to table, unless shift key is pressed
Opcodes containing values which are addresses within a module are now shown as 'Module+Offset' unless you disable 'View module names'

[!] Comments in memory viewer weren't saved. Now they are.
[!] Fixed values are not displayed on ArrayOfByte search



CoSMOS Changelog v1.1.15.0


Reverted selection change on scan and stored list. Selection stays now on click.
Removed indicator on stored item list
If you enable value sorting on scan results, it will disable the auto refresh automatically otherwise it may happen that, due to the nature how it works, it constantly sorts the values and the application heavily lags. The user gets notified by a tooltip.
Undo button is now disabled until the 2nd next scan has been performed
Header items are now underlined and bolded and scripts have a differen forecolor instead of both have different backcolor.
 
[+] Disclaimer on importing CoSMOS table
[+] Added info in wizard to press F1 if you need help
[+] Added context menu item 'Edit Value' to stored item list
[+] Added feedback form
[+] Added a messagebox that asks the user if he really wants to clear the stored item list if he clicks that button to avoid accidentally delete all items.
[+] Added a messagebox that asks the user if sorting should be disabled when it is enabled and too many results have been found because the application takes very long with sorting then.
[+] Tooltip on launch about additional help if user is beginner
 
[!] Fixed value filtering in scan results. Values are recognized as decimal now, so if you filter: Value between 20 and 25, you will no longer get values like 2055 etc.
[!] 'Create aob injection' menu item was shown on popup in lower memory viewer
[!] Fixed an 'Indexoutofrange' exception in memory viewer
[!] Null exception reference when adding addresses to the list and a header item exist

It has been one month only, and here i come with another big update.
And yes, it's worth it.

I am doing a quick overview of what has changed.

I am introducing the first tool that detects Hooks of VTables.
It does so by tracing certain assembly patterns and relocated blocks in the data section, that might be a table of virtual method-pointers.

If you set the verbosity high HookShark will also list all changed relocated function ptrs. in data sections.

Also all found global instances of polymorphic classes with VTables are listed in one section for your convinience to ease the analysis of your target.

So feel free to test around some stuff. HookShark might not find all virtual function tables. But this is hardly avoidable.



Next up is the new built-in Disassembler. Not much functionality. Just to grant a quick look at the area, if this is something worth exploring further with a debugger.

Some targets might fuck with us, guarding pages or even the modulelists. Also time-attacks to detect thread suspensions is a common technique.
So if the target crashes on scan or doesn't seem to be scannable, play around with the new Troubleshooting options in the Global Options Tab.

Also check out the new Credits Dialog. I included the old Chiptune, that you might know from 0.6.

Abso insisted on testing out the new bug-tracking system. So if you want to report bugs, then try it out:
http://forum.gamedeception.net/project.php?projectid=2

I don't know if i will use it. But it doesn't hurt to check it put. If you want to be extra sure, mention the bug here in this thread.



PS: Yeah i know. The pictures show version "0.8" :P
That's because im lazy to make new pictures.

Download:
http://rapidshare.com/files/416679944/Ho...k.rar.html

Changelog:

09-02-2010 - 1 -- Fixed memory leak. Thx to MiDoX

Instead of a closed BETA, i thought to myself, an open BETA would just be as good.

We are back at 0.1 with the postfix "64" added to "HookShark". All following releases will support x64. HookShark is dead. HookShark64 is the new "product-line".

But HookShark 0.9 might not become obsolete right away. Not every feature was reimplemented. So in some cases, falling back to 0.9 is the only choice.

Disadvantages of HookShark64 0.1 in comparison with 0.9:
- Hooks of relocated .data pointers are not detected
- rudimentary vtable-hook detection not implemented yet
- No scanning for Code Injections takes place
- no disassembler, no hex editor
- no Class Instance Browser
- No Listing of code references
- Cant null a region (why would you need hookshark for this anyway?)
- Showing Pageguard Candidates (which was broken anyway)
- no unhook support yet

Advantages of HookShark64 0.1:
- Full support of x64 processes
- like a 15 times faster or something (you will need at least SSE2)
- dumping modules from the module window
- sorting the process list (PID/ImageName)
- Exempt modules from being scanned (checkboxes in module window)
- a lot of Win7 fixes (ApiSetMap, thx to deroko)
- show function name of hook destination if available
- multithreading (IAT/EAT Hooks and Patchscanner have an own thread)
- it saves all settings/filters, window position and size in an ini file

You will get a lot of errors and bogus access violations in your log window. Why? Because checking everything carefully is slow. In 0.9 more checks were implented, which slowed the process down. In 64 0.1 many checks are omitted and simply wrapped around an exception handler. If an exception occurs, the next dll or the next codesection wil be scanned, without losing any results.


However, if HookShark really crashes, or the logwindow output is more suspicous than it should be, for example if you happen to know that it should have picked up something, then feel free to bugreport it right here in this thread.

Also: Beware using the Unchecking function for modules too carelessly. It can have some unwanted implications.
For example: If the unchecked module is the destination of a hook elsewhere, the listing in the hook-result-window might not be as detailed.
Another case would be: If the module has exports, which other modules import, it will show errors in the log and you might miss IAT hooks.

At last: A screenshot:



Version History
0.1.0.0
- Initial Release
0.1.0.3
- Fixed unchecking and checking an unlinked module being displayed as linked module (red -> blue)
- Show exact HookShark Version Number and Build in Log at startup
0.1.0.5
- fixed attempt to start x64server process on x86 platforms, when CPU was 64bit capable
- allow more user interactions with GUI while scanning
0.1.0.6
- the offset within a symbol is now shown (example:ntdll.dll!LdrLoadDll+0x15 )