Create a PC Memory Editor (Trainer , Hack Tool)

Hey everyone! Today I will be teaching you on how to make a PC Memory Editor...

First you will need to research the game (process) that you want to modify and obtain offsets from it..
I have already done my research in MW2 :

Code:

//Research by : MW2TopTenWORLD
//Research for MW2 Steam version 1.2.208

XP : 0x01B2C89C
Score : 0x01B2C8AC
Wins : 0x01B2C8E4
Losses : 0x01B2C8E8
Ties : 0x01B2C8EC
Win Streak : 0x01B2C8F0
Kills : 0x01B2C8B0
Headshots : 0x01B2C8C4
Assists : 0x01B2C8B0
Killstreak : 0x01B2C8B4
Deaths : 0x01B2C8B8
Prestige : 0x01B2C8A4

Now let´s head to the actual coding...

NOTE : THIS WAS COPY AND PASTED FROM MY BLOG!!!!

So let´s start...

First add some includes...

Code:

#include <iostream>
#include <windows.h>

Now just add the usual namespace :P

Code:

using namespace std;

Now add your main function

Code:

int main()
{

}

Alright now let´s make a cout...

Code:

cout << "Make sure Modern Warfare 2 is Opened before opening the tool! << endl;
system("Pause");

Now let´s create a FindWindow function (WINDOW NAME NOT PROCESS NAME!!)!

Code:

LPCWSTR Fuck = L"Modern Warfare 2";
HWND hwnd = FindWindow(0, Fuck);

Now we need to create some basic if code to determinate if the Window is opened or not...

Code:

if (hwnd == 0)
 {
  cout << "The game has not been found... please open it before opening the tool next time..." << endl;
  system("Pause");
 }
 else
 {
             cout << "Modern Warfare 2 has been found... Enjoy the tool!" << endl;
        }

Great!

Now you need to add a DWORD , a Function that gets the process ID and writes it to the DWORD and a
Handle function...

Code:

DWORD process_ID;
GetWindowThreadProcessId(hwnd, &process_ID);
HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_ID);

Now populate it with options!

I will just be doing XP here...

Code:

cout << "Type 1 for XP" << endl;
cout << "Type : ";
int Option;
cin >> Option;

Now let´s make the options if code and the actual write memory code

Code:

if (Option > 1)
  {
   cout << "There is no option higher than 1..." << endl;
   system("Pause");
  }
  if (Option == 1)
  {
...
                }

Now let´s make a cout that ask us how much XP do we want to write..

Code:

cout << "What do you want to set your XP as?" << endl;
cout << "Type : ";
int XP;
cin >> XP;

Alright now you need to convert the XP to a byte....

by doing this :

Code:

DWORD newdatasize = sizeof(XP);

Now finally we are going to write process memory!!

Code:

if (WriteProcessMemory(hProcess, (LPVOID)0x01B2C89C, &XP, newdatasize, NULL))
   {
    cout << "The XP has been written sucessfully!!" << endl;
    system("Pause");
   }
   else
   {
    cout << "There was an error writing the XP..." << endl;
    system("Pause");
   }

Basicly we are doing if code so we dont get a nasty error when something goes wrong..
Also il explain the WriteProcessMemory syntax... :
WriteProcessMemory(ToThisProcessID, (LPVOID)ToThisOffset, &XP , WithTheseBytes, NULL))...

Now just add the "looping" main(); and a return 0; code

...

You have just made a memory editor!!!

Final source : [C++] #include <iostream> #include <windows.h> using namespace std; int main() - Pastebin.com (If this goes against the "no outside links" rule il delete this link)

Video version :

Original (Blog) Version : MPGH doesnt allow out side links.... sorry

The final tool can be found here : http://www.mpgh.net/forum/191-call-d...tats-tool.html

Alright now you need to convert the XP to a byte....

by doing this :
Code:

DWORD newdatasize = sizeof(XP);

Also il explain the WriteProcessMemory syntax... :
WriteProcessMemory(ToThisProcessID, (LPVOID)ToThisOffset, &XP , WithTheseBytes, NULL))...

WriteProcessMemory(targetProcessHandle ....). Handle, not ID.

[C++] #include <iostream> #include <windows.h> using namespace std; int main() - Pastebin.com

Code:

....
        main();
        return 0;

Since you're recursively calling main() from within its self, you should call CloseHandle() (assuming OpenProcess() was successful). Otherwise the handles won't be freed until the program is terminated.
^^Use some type of loop instead of recursion...something along the lines of while (userInput != "quit") { ... }

Originally Posted by abuckau907

to a byte? DWORD = 4 bytes.
'newdatasize' will be the same regardless of XP's value --> "convert the XP" was maybe not the best way to phrase that.. we're not converting xp at all, we're simply getting the size of it.

WriteProcessMemory(targetProcessHandle ....). Handle, not ID.

[C++] #include <iostream> #include <windows.h> using namespace std; int main() - Pastebin.com

Code:

....
        main();
        return 0;

Yh x.x I forgot of CloseHandle().. even tough it is on the final tool -.-.. and this was my first C++ tool and 2nd C++ tutorial

so im not experienced

hey i need help, ive only had this problem with world at war and all my other games ive been able to find the window. idk ive tried every name i can think of

Code:

#include <iostream>
#include <windows.h>

using namespace std;

int main()
{
	system("color 0A");
	cout << "Make sure World at War is opened before pressing ENTER..." << endl;
	system("Pause");
	LPCWSTR Waw = L"CoDWaW.exe";
	HWND hwnd = FindWindow(0, Waw);
	if (hwnd == 0)
	{
		cout << "The game has not been found... please open it before opening the tool next time..." << endl;
		system("Pause");
	}
	else
	{
		DWORD process_ID;
		GetWindowThreadProcessId(hwnd, &process_ID);
		HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_ID);
		cout << "World at War was found, have fun losers!" << endl;
		system("Pause");
		cout << "Type 1 for points: " << endl;
		int Option;
		cin >> Option;
		if (Option > 1)
		{
			cout << "There is no option higher than 1..." << endl;
			system("Pause");
		}
		if (Option == 1)
		{
			cout << "What do you want to set your points as: " << endl;
			int Points;
			cin >> Points;
			DWORD newdatasize = sizeof(Points);
			if (WriteProcessMemory(hProcess, (LPVOID)0x01B2C89C, &Points, newdatasize, NULL))
			{
				cout << "Go spend your points already\n";
				system("Pause");
			}
			else
			{
				cout << "There was an error writing the Points\n";
				system("Pause");
			}

		}
	}
	main();
	return 0;
}

Originally Posted by gogogokitty

hey i need help, ive only had this problem with world at war and all my other games ive been able to find the window. idk ive tried every name i can think of

#include <iostream>
#include <windows.h>

using namespace std;

int main()
{
system("color 0A");
cout << "Make sure World at War is opened before pressing ENTER..." << endl;
system("Pause");
LPCWSTR Waw = L"CoDWaW.exe";
HWND hwnd = FindWindow(0, Waw);
if (hwnd == 0)
{
cout << "The game has not been found... please open it before opening the tool next time..." << endl;
system("Pause");
}
...
}

Window Title vs. Process Name ..

Originally Posted by abuckau907

Window Title vs. Process Name ..

yea there was more to it than that, thats just what i tried last. turns out i forgot the ® -_- anyways all good now

I know that..was just pointing you in the right direction. You're welcome.

any idea how i would go about doing say ammo and points together? im not sure how to combine multiple addresses and change the values, for instance i want to have points first and after you enter the points it gives you the option to change the ammount of ammo in your primary

Code:

#include <iostream>
#include <windows.h>

using namespace std;

int main()
{
	system("color 0A");
	cout << "Make sure World at War is opened before pressing ENTER..." << endl;
	system("Pause");
	LPCWSTR Waw = L"Call of Duty®";
	HWND hwnd = FindWindow(0, Waw);
	if (hwnd == 0)
	{
		cout << "The game has not been found... please open it before opening the tool next time..." << endl;
		system("Pause");
	}
	else
	{
		DWORD process_ID;
		GetWindowThreadProcessId(hwnd, &process_ID);
		HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, process_ID);
		cout << "World at War was found, have fun losers!" << endl;
		system("Pause");
		cout << "Type 1 for points: " << endl;
		int Option;
		cin >> Option;
		if (Option > 1)
		{
			cout << "There is no option higher than 1..." << endl;
			system("Pause");
		}
		if (Option == 1)
		{
			cout << "What do you want to set your points as: " << endl;
			int Points;
			cin >> Points;
			DWORD newdatasize = sizeof(Points);
			if (WriteProcessMemory(hProcess, (LPVOID)0x018EF124, &Points, newdatasize, NULL))
			{
				cout << "Go spend your points already\n";
				cin.get();
			}
			else
			{
				cout << "There was an error writing the Points\n";
				cin.get();
			}

		}
	}

	main();
	return 0;
}

Originally Posted by gogogokitty

if (Option == 1)
{
//CHANGE POINTS
cout << "What do you want to set your points as: " << endl;
int Points;
cin >> Points;
DWORD newdatasize = sizeof(Points);
if (WriteProcessMemory(hProcess, (LPVOID)0x018EF124, &Points, newdatasize, NULL))
{
cout << "Go spend your points already\n";
cin.get();
}
else
{
cout << "There was an error writing the Points\n";
cin.get();
}
//CHANGE AMMO. TODO: add code here.
//quote: i want to have points first and after you enter the points it gives you the option to change the ammount of ammo
// cout <<"Would you like to change ammo amount?" << endl;
// Get Input
// If yes, do same as above - collect user input and writeprocessmemory

}

? ?

@MW2TopTenWORLD
Hey mate, thanks for tutorial, I'm still learing C++, so It will really help me!!!
Thanks again

Originally Posted by coca12345

@MW2TopTenWORLD
Hey mate, thanks for tutorial, I'm still learing C++, so It will really help me!!!
Thanks again

Thanks

If you do this in a injectable dll you do not need to use WriteProcessMemory or worry about any windows/processIDs since we are running our code in the same address space. You will need the Psapi.lib though since I use GetModuleInformation.

Code:

#include <windows.h>
#include <Psapi.h>

DWORD BaseAddr;
DWORD ValueOffset = 0xFFFFF;


void WriteDwToMem (DWORD Addr, DWORD valueToWrite)
{
    *(DWORD*)Addr = valueToWrite;
}

DWORD GetBaseAddr(LPCSTR ModuleName)
{
    HMODULE hModule = GetModuleHandle(ModuleName);
    if(hModule==NULL)
    {
        return NULL;
    }
    else
    {
        MODULEINFO modInf;
        GetModuleInformation(GetCurrentProcess(), hModule, &modInf, sizeof(MODULEINFO));
        return (DWORD)modInf.lpBaseOfDll;
    }
}

BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
        case DLL_PROCESS_ATTACH:
            BaseAddr = GetBaseAddr("SomeApp.exe");
	    WriteDwToMem((BaseAddr+ValueOffset), 0xFF);
            break;
    }
    return TRUE; // succesful
}

As you can see this will write the value 255 to the base of SomeApp.exe + 0xFFFFF.

Originally Posted by Harava

Code:

#include <windows.h>
#include <Psapi.h>

DWORD BaseAddr;
DWORD ValueOffset = 0xFFFFF;


void WriteDwToMem (DWORD Addr, DWORD valueToWrite)
{
    *(DWORD*)Addr = valueToWrite;
}

DWORD GetBaseAddr(LPCSTR ModuleName)
{
    HMODULE hModule = GetModuleHandle(ModuleName);
    if(hModule==NULL)
    {
        return NULL;
    }
    else
    {
        MODULEINFO modInf;
        GetModuleInformation(GetCurrentProcess(), hModule, &modInf, sizeof(MODULEINFO));
        return (DWORD)modInf.lpBaseOfDll;
    }
}

BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
    switch (fdwReason)
    {
        case DLL_PROCESS_ATTACH:
            BaseAddr = GetBaseAddr("SomeApp.exe");
	    WriteDwToMem((BaseAddr+ValueOffset), 0xFF);
            break;
    }
    return TRUE; // succesful
}

As you can see this will write the value 255 to the base of SomeApp.exe + 0xFFFFF.

This tutorial was intended to make an application , not an injectable dll... still thanks for the info

Good tutorial, just bad that everything gets reseted after game has been restarted

Create a PC Memory Editor (Trainer , Hack Tool)

Post a Reply

Similar Threads

Tags for this Thread