Vb.net Memory Hacking Problem

[steveroseik]

Pingo didn't open from long time ago .

@mamo007 Who else Can Help Me ?

[steveroseik]

Now When I Tried Making it with Bytes :
MODULE :

Option Strict On

Imports System.Runtime.InteropServices
Imports System.Text

Module MemoryModule
    
    <DllImport("kernel32.dll")> _
    Private Function OpenProcess(ByVal dwDesiredAccess As UInteger, <MarshalAs(UnmanagedType.Bool)> ByVal bInheritHandle As Boolean, ByVal dwProcessId As Integer) As IntPtr
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)> _
    Private Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As IntPtr, <Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)> _
    Private Function ReadProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, <Out()> ByVal lpBuffer() As Byte, ByVal dwSize As IntPtr, ByRef lpNumberOfBytesRead As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Function CloseHandle(ByVal hObject As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
    End Function

    Private Const PROCESS_VM_WRITE As UInteger = &H20
    Private Const PROCESS_VM_READ As UInteger = &H10
    Private Const PROCESS_VM_OPERATION As UInteger = &H8
    Private Const TargetProcess As String = "crossfire"
    Private ProcessHandle As IntPtr = IntPtr.Zero
    Private LastKnownPID As Integer = -1

    Public Function ReadMemory(Of T)(ByVal address As Integer) As T
        Return ReadMemory(Of T)(address, 0, False)
    End Function

    Public Function ReadMemory(ByVal address As Integer, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(address, length, False)
    End Function

    Private Function ProcessIDExists(ByVal pID As Integer) As Boolean
        For Each p As Process In Process.GetProcessesByName(TargetProcess)
            If p.Id = pID Then Return True
        Next
        Return False
    End Function

    Private Function UpdateProcessHandle() As Boolean
        If LastKnownPID = -1 OrElse Not ProcessIDExists(LastKnownPID) Then
            If ProcessHandle <> IntPtr.Zero Then CloseHandle(ProcessHandle)
            Dim p() As Process = Process.GetProcessesByName(TargetProcess)
            If p.Length = 0 Then Return False
            LastKnownPID = p(0).Id
            ProcessHandle = OpenProcess(PROCESS_VM_READ Or PROCESS_VM_WRITE Or PROCESS_VM_OPERATION, False, p(0).Id)
            If ProcessHandle = IntPtr.Zero Then Return False
        End If
        Return True
    End Function

    Public Function ReadMemory(Of T)(ByVal address As Integer, ByVal length As Integer, ByVal unicodeString As Boolean) As T
        Dim buffer() As Byte
        If GetType(T) Is GetType(String) Then
            If unicodeString Then buffer = New Byte(length * 2 - 1) {} Else buffer = New Byte(length - 1) {}
        ElseIf GetType(T) Is GetType(Byte()) Then
            buffer = New Byte(length - 1) {}
        Else
            buffer = New Byte(Marshal.SizeOf(GetType(T)) - 1) {}
        End If
        If Not UpdateProcessHandle() Then Return Nothing
        Dim success As Boolean = ReadProcessMemory(ProcessHandle, New IntPtr(address), buffer, New IntPtr(buffer.Length), IntPtr.Zero)
        If Not success Then Return Nothing
        If GetType(T) Is GetType(Byte()) Then Return CType(CType(buffer, Object), T)
        If GetType(T) Is GetType(String) Then
            If unicodeString Then Return CType(CType(Encoding.Unicode.GetString(buffer), Object), T)
            Return CType(CType(Encoding.ASCII.GetString(buffer), Object), T)
        End If
        Dim gcHandle As GCHandle = gcHandle.Alloc(buffer, GCHandleType.Pinned)
        Dim returnObject As T
        returnObject = CType(Marshal.PtrToStructure(gcHandle.AddrOfPinnedObject, GetType(T)), T)
        gcHandle.Free()
        Return returnObject
    End Function

    Private Function GetObjectBytes(ByVal value As Object) As Byte()
        If value.GetType() Is GetType(Byte()) Then Return CType(value, Byte())
        Dim buffer(Marshal.SizeOf(value) - 1) As Byte
        Dim ptr As IntPtr = Marshal.AllocHGlobal(buffer.Length)
        Marshal.StructureToPtr(value, ptr, True)
        Marshal.Copy(ptr, buffer, 0, buffer.Length)
        Marshal.FreeHGlobal(ptr)
        Return buffer
    End Function

    Public Function WriteMemory(ByVal address As Integer, ByVal value As Object) As Boolean
        Return WriteMemory(address, value, False)
    End Function

    Public Function WriteMemory(ByVal address As Integer, ByVal value As Object, ByVal unicode As Boolean) As Boolean
        If Not UpdateProcessHandle() Then Return False
        Dim buffer() As Byte
        If TypeOf value Is String Then
            If unicode Then buffer = Encoding.Unicode.GetBytes(value.ToString()) Else buffer = Encoding.ASCII.GetBytes(value.ToString())
        Else
            buffer = GetObjectBytes(value)
        End If


        Dim result As Boolean = WriteProcessMemory(ProcessHandle, New IntPtr(address), buffer, New IntPtr(buffer.Length), IntPtr.Zero)
        Return result
    End Function
End Module

Timer Code:

Private Sub Timer1_Tick(sender As Object, e As EventArgs) Handles Timer1.Tick
        'Hotkeys
        For i = 6 To 255


            result = 0
            result = GetAsyncKeyState(i)
            If GetAsyncKeyState(Keys.F7) Then
                'Action
                Me.Hide()
                System.Threading.Thread.Sleep(4000)
                WriteMemory(&H743AD4, New Byte() {0, 0, 0, 0, 0})
                End
            End If
        Next
        'Showing Form when CF Closes
        If Process.GetProcessesByName("crossfire").Length >= 1 Then

        Else
            Me.Show()
        End If

    End Sub

Now even This Bytes Way Gets Xtrapped
ANY Suggestions also here ?

[mamo007]

@mamo007 Who else Can Help Me ?

i'm really don't know

[steveroseik]

i'm really don't know

Okai

Thank You anyways

[I2espect]

Any Other IDEAS ??

<DllImport("psapi.dll", CharSet:=CharSet.Auto, SetLastError:=True)> _
Public Shared Function EnumProcessModules(ByVal handle As SafeProcessHandle, ByVal modules As IntPtr, ByVal size As Integer, ByRef needed As Integer) As Boolean
End Function

that can help u to get all modules in a process to get CShell

[steveroseik]

<DllImport("psapi.dll", CharSet:=CharSet.Auto, SetLastError:=True)> _
Public Shared Function EnumProcessModules(ByVal handle As SafeProcessHandle, ByVal modules As IntPtr, ByVal size As Integer, ByRef needed As Integer) As Boolean
End Function

that can help u to get all modules in a process to get CShell

But What does SafeProcessHandle stands for
and When I Put it, How Can it Make Xtrap Pass The Hack

[abuckau907]

 
 Dim Tval As String = "20"
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        ...
        Dim Adr As Int32 = &H743AD4
        Try
            If WriteInt32(p, Adr, Tval) Then

            Else
                MessageBox.Show("Writing memory failed!", "Error", MessageBoxButtons.OK, MessageBoxIcon.Warning)
            End If
        Catch ex As Exception
            MessageBox.Show("Writing memory failed: " & vbCrLf & ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Warning)
        End Try

    End Sub

1. Why is Tval a string? Why does WriteInt32 expect a string, not an Int32 ??
2. Does WriteInt32 use VirtualQueryEx() to make sure the memory region is writable?
Post code.


So xtrap is stopping the WriteProcessMemory() from working, and you get the error message "Writing memory failed!", or does it take some time and the game closes, or what?

[steveroseik]

1. Why is Tval a string? Why does WriteInt32 expect a string, not an Int32 ??
2. Does WriteInt32 use VirtualQueryEx() to make sure the memory region is writable?
Post code.


So xtrap is stopping the WriteProcessMemory() from working, and you get the error message "Writing memory failed!", or does it take some time and the game closes, or what?

I'm Going to tell :

I Made The App Sleeps for 3 seconds and Then writeMemory.
so I can Press the Button or shortcut while watching My char in the storage
and the hack works and the memory is written and the char changes some parts into transparent or this shape for characters when wallhack is on
then after it for a 1 second exactly xtrap error comes out

[abuckau907]

Apparently xtrap is reading that address, and making sure it doesn't get changed?

You have to find the xtrap code and stop it : D ..easier said than done.

Not really sure what else to say --> If the game is actively scanning that memory location to make sure it's original code is there, anything that changes the code (writeprocessmemory, or even from within the gamecode) will cause it to alert. But again, I don't know xtrap, sry. Hopefully someone w/ xtrap experience will comment.

[steveroseik]

Apparently xtrap is reading that address, and making sure it doesn't get changed?

You have to find the xtrap code and stop it : D ..easier said than done.

Not really sure what else to say --> If the game is actively scanning that memory location to make sure it's original code is there, anything that changes the code (writeprocessmemory, or even from within the gamecode) will cause it to alert. But again, I don't know xtrap, sry. Hopefully someone w/ xtrap experience will comment.

Thank You