🙂 Pinball Hack

I was really bored, so I coded this in half a second, it automatically scans for the addresses so there is no need to obtain static addresses or pointers, dynamic is just fine

Source:

Code:

#include <windows.h>
#include <iostream>
#include <string>
#include <tlhelp32.h>

using namespace std;

int main()
{
    DWORD ProcessID;
    
    PROCESSENTRY32 PE;
    
    HANDLE Snapshot;
    
    PE.dwSize = sizeof(PROCESSENTRY32);
    
    Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    
    if (Process32First(Snapshot, &PE))
    {
          while (Process32Next(Snapshot, &PE))
          {
                if (!strcmp(PE.szExeFile, "pinball.exe"))
                {
                  ProcessID = PE.th32ProcessID;
                }
          }
    }
    
    if (!ProcessID)
    {
                   cout << "Error #01: Failed to obtain Process ID" << endl;
    }
    else
    {
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);
        
        if (!hProcess)
        {
                      cout << "Error #02: Failed to open handle!" << endl;
        }
        else
        {
            int CurScore, Read;
            
            DWORD NewScore;
            
            cout << "\nEnter the current score: "; cin >> CurScore; cout << endl;
            cout << "Enter your new score: "; cin >> NewScore; cout << endl;        
            
            MEMORY_BASIC_INFORMATION MBI;
            
            SIZE_T S, BytesRead;
            
            SYSTEM_INFO SI;
            
            GetSystemInfo(&SI);
            
            DWORD lpStartAddress, lpStopAddress;
            
            lpStartAddress = (DWORD) SI.lpMinimumApplicationAddress;
            lpStopAddress = (DWORD) SI.lpMaximumApplicationAddress;
            
            for (DWORD i = lpStartAddress; i <= lpStopAddress; i++)
            {
                S = VirtualQueryEx(hProcess, (LPCVOID) i, &MBI, sizeof(MEMORY_BASIC_INFORMATION));
                
                if ((S == sizeof(MEMORY_BASIC_INFORMATION)) && (MBI.State == MEM_COMMIT) && (MBI.Type == MEM_PRIVATE) && (MBI.RegionSize > 0))
                {
                       ReadProcessMemory(hProcess, (PCVOID) i, &Read, 4, &BytesRead);
                       
                       if (Read == CurScore)
                       {
                                cout << "Found: " << (LPVOID) i << endl;
                                
                                SIZE_T BytesWritten;
                                
                                WriteProcessMemory(hProcess, (LPVOID) i, &NewScore, sizeof(NewScore), &BytesWritten);
                       }                       
                } 
                else
                {
                    i = (DWORD) MBI.BaseAddress + (DWORD) MBI.RegionSize;
                }               
            }    
            
                   
        }
    }
                   
    
    system("PAUSE");
                                 
    return 0;
}

Nice technique. Though you might want to tell people to play the game first. Wouldn't want to look for a score of zero. =P

On a side note I must figure out how to use this CreateToolhelp32Snapshot() somseday. Its seems very helpful :l

why06 add my msn:

Hussain_al@live.ca

yo I made a H4x0rZ

but when I run it, it says

"Error #02: Failed to open handle!"

In case the user decides to read a huge block of memory, you should let ReadProcessMemory read bigger sizes and store it into a buffer. Then check the buffer. Calling ReadProcessMemory a bunch of times will only slow everything down.

[php]
DWORD dwBytesRead,dwAddress;
unsigned char buffer[SizeOfPage]; //use VirtualQueryEx to get the size of the page

if(ReadProcessMemory(ProcessHandle,(LPVOID)dwStart Address,buffer,SizeOfPage,&dwBytesRead))
{
for(int i=0;i<dwBytesRead;i++)
{
if(buffer[i] == CurScore) {
dwAddress = buffer[i];
break;
}
}
}
[/php]

Something like that..

I'm not using ReadProcessMemory() all the time, i'm using it for every address in a readable memory block and listing down the addesses whose values equal up to what i'm searching for. Your method and my method is equivlant.

Hehe, nice one but you also can make it very simple. Just find the address for score wich are two. And make them a value off 999999 and inject it. More simple.

They're dynamic addresses.

what to do when i get this error????

"Error #02: Failed to open handle!"

Originally Posted by lalakijilp

what to do when i get this error????

"Error #02: Failed to open handle!"

Perhaps try running as admin. =/

Originally Posted by ipromise

They're dynamic addresses.

They must have a reference somewhere

Originally Posted by why06

Perhaps try running as admin. =/

nope doesn't work

Originally Posted by ipromise

They're dynamic addresses.

shit -.- ...........

Originally Posted by lalakijilp

what to do when i get this error????

"Error #02: Failed to open handle!"

It might be because he used PROCESS_ALL_ACCESS in open process, which in newer versions of windows got altered so it's too big or something.

Replace it with STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF

Originally Posted by simondaking

It might be because he used PROCESS_ALL_ACCESS in open process, which in newer versions of windows got altered so it's too big or something.

Replace it with STANDARD_RIGHTS_REQUIRED | SYNCHRONIZE | 0xFFF

nope srry doesn't work

🙂 Pinball Hack

Similar Threads