[Help] Unsafe methods for writing/reading memory?

Unsafe methods for writing/reading memory?

Hello everyone! Greetings.
This is my first post and first of all I'm sorry if I'm asking something pretty obvious or already discussed a million times or w/e. I didn't find enough information about this or maybe I didn't search it right.

I just ended a book of C++ (Teach Yourself C++ in 21 days) and I think I'm ready to move on and learn how to manipulate memory for game hacking, in this case CS-GO, but I have a few questions in my head.
The first one: is there any known unsafe method that I should straightly avoid for reading/writing to memory? I mean, for what I've read VAC detects the signature of known (usually) public hacks, right? But there are maybe thousands of hackers that got detected, is there any chance that I could code something similar (any part of my code that could match for coincidence someone's code in this world who thought exactly like I did and got banned with it)? Is that even possible or I am just being paronoid? Maybe I didn't understand how signatures work.
The second one: I've been told to not use common read/write functions from WIN Api, but why? Is there a safer/better way, how many options do I have for doing it? What is exactly a ProcMem class?

I am sorry for so many question and if I'm being an idiot. I'm just a little bit confused here and trying to learn step by step.
I'm having trouble to move from the base knowledge of C++ too memory hacking.

Cheers and thanks!

The first one: unsafe i guess you can write in most of csgo's memory just stay away from convars like r_drawothermodels, sv_cheats and that shit

The second one: "What is exactly a ProcMem class?" a memory class that gets things like client&engine for you and allows you to do some rpm and wpm

Thanks.
Well, I read something a while go that was pretty clear about not using the win api functions to write/read to cs-go but I just don't understand why.

I see, but what does this ProcMem class do diferent of the windows api function?

Well i cant see why writing your own memory class using win api would harm you in anyway pretty sure its safe

Well ProcMem doesnt really do anything different its just a ready2go class which is also pretty noob friendly

Originally Posted by MrCurie

for what I've read VAC detects the signature of known (usually) public hacks, right? But there are maybe thousands of hackers that got detected, is there any chance that I could code something similar (any part of my code that could match for coincidence someone's code in this world who thought exactly like I did and got banned with it)? Is that even possible or I am just being paronoid? Maybe I didn't understand how signatures work.

A signature doesn't work in any particular way, it just exists from the instructions that your compiler chooses.
The chances that you will have the exact same code as someone else and your compiler choosing the exact permutation as well as memory addresses, alignments, optimizations etc. as someone else are so astronomically slim that you don't have to worry about it.

Originally Posted by MrCurie

is there any known unsafe method that I should straightly avoid for reading/writing to memory?

Originally Posted by MrCurie

I've been told to not use common read/write functions from WIN Api, but why? Is there a safer/better way, how many options do I have for doing it?

That completely depends on the anti cheat you are working against. Some anti cheats like to monitor ReadProcessMemory/WriteProcessMemory, some like to monitor SetWindowsHookEx, some like to monitor all of them, some even like to monitor low level functions such as NtReadVirtualMemory. You have another way to read memory if you're part of the program using raw pointers, though that requires you to be part of the program. But you gotta get your code into the process first, which can all be monitored as well. It always depends on the anti cheat you're against. Find out what it's monitoring and counter or bypass it.

Originally Posted by MrCurie

What is exactly a ProcMem class?

ProcMem is the name of a class someone made who didn't know what he was doing. It's a badly designed class which lets you get a handle to a specified process, query some information about it's modules and read/write memory.

Originally Posted by WasserEsser

A signature doesn't work in any particular way, it just exists from the instructions that your compiler chooses.
The chances that you will have the exact same code as someone else and your compiler choosing the exact permutation as well as memory addresses, alignments, optimizations etc. as someone else are so astronomically slim that you don't have to worry about it.

That completely depends on the anti cheat you are working against. Some anti cheats like to monitor ReadProcessMemory/WriteProcessMemory, some like to monitor SetWindowsHookEx, some like to monitor all of them, some even like to monitor low level functions such as NtReadVirtualMemory. You have another way to read memory if you're part of the program using raw pointers, though that requires you to be part of the program. But you gotta get your code into the process first, which can all be monitored as well. It always depends on the anti cheat you're against. Find out what it's monitoring and counter or bypass it.

ProcMem is the name of a class someone made who didn't know what he was doing. It's a badly designed class which lets you get a handle to a specified process, query some information about it's modules and read/write memory.

Good Information!

Originally Posted by WasserEsser

A signature doesn't work in any particular way, it just exists from the instructions that your compiler chooses.
The chances that you will have the exact same code as someone else and your compiler choosing the exact permutation as well as memory addresses, alignments, optimizations etc. as someone else are so astronomically slim that you don't have to worry about it.

That completely depends on the anti cheat you are working against. Some anti cheats like to monitor ReadProcessMemory/WriteProcessMemory, some like to monitor SetWindowsHookEx, some like to monitor all of them, some even like to monitor low level functions such as NtReadVirtualMemory. You have another way to read memory if you're part of the program using raw pointers, though that requires you to be part of the program. But you gotta get your code into the process first, which can all be monitored as well. It always depends on the anti cheat you're against. Find out what it's monitoring and counter or bypass it.

ProcMem is the name of a class someone made who didn't know what he was doing. It's a badly designed class which lets you get a handle to a specified process, query some information about it's modules and read/write memory.

This is what I was looking for. Thank you, things are much clear now.
But... that means I would have to know how the anti cheat works, but how? Reverse engineering? I bet someone have done it already and I shouldn't bother.
If so, I am going back to my first question: anything I should avoid or should work when talking about VAC?
Thanks again!

Originally Posted by MrCurie

anything I should avoid or should work when talking about VAC?

If you're making your own cheats, you don't have to worry about VAC unless you share it to the public or anyone who might end up sending it to VAC or putting it public.
If you're copying code from sources that has been released with binaries and have the exact same compiler, compiler settings etc. you might end up with having the same detected signature in parts of your code, though even that is kind of unlikely.

Originally Posted by WasserEsser

If you're making your own cheats, you don't have to worry about VAC unless you share it to the public or anyone who might end up sending it to VAC or putting it public.
If you're copying code from sources that has been released with binaries and have the exact same compiler, compiler settings etc. you might end up with having the same detected signature in parts of your code, though even that is kind of unlikely.

Thanks again, that's it! Gonna start codding right away.

Seems it has been solved.

/Closed.

HelpUnsafe methods for writing/reading memory?

Similar Threads

Tags for this Thread