
Originally Posted by
Biesi
helping you = giving you a source code to copy and paste ?
Let's make him sad with pseudocode:
1. Get the baseaddress of the executable with GetModuleInformation
2. (optional) Get addresses from multi-level pointers
3. Write to memory with the power of ugly ass c casts
EDIT: So I wrote a simple dll memory hack for you...
This is the target source:
Code:
#include <windows.h>
#include <cstdio>
#pragma comment(lib, "User32.lib")
class Player
{
public:
int GetHP();
void Hurt();
Player();
private:
int HP;
};
int Player::GetHP()
{
return HP;
}
void Player::Hurt()
{
HP -= 3;
}
Player::Player()
{
HP = 100;
}
int main()
{
Player p;
while(!GetAsyncKeyState(VK_ESCAPE))
{
printf("Health is at %d\n", p.GetHP());
getchar();
p.Hurt();
}
return 0;
}
And here is the source for the hack:
Code:
#include <windows.h>
#include <Psapi.h>
#pragma comment(lib, "Kernel32.lib")
#pragma comment(lib, "Psapi.lib")
void Hack()
{
MODULEINFO mi;
if(!GetModuleInformation(GetCurrentProcess(), GetModuleHandle(NULL), &mi, sizeof(MODULEINFO)))
{
ExitProcess(-1);
}
else
{
DWORD oldProtection;
DWORD HPDecreaseAddress = (DWORD)mi.lpBaseOfDll + 0x101C;
if(!VirtualProtect((LPVOID)HPDecreaseAddress, 3, PAGE_EXECUTE_READWRITE, &oldProtection))
{
ExitProcess(-1);
}
else
{
for(int n = 0; n < 3; n++)
*(BYTE*)(HPDecreaseAddress + n) = 0x90;
}
}
}
BOOL APIENTRY DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason)
{
case DLL_PROCESS_ATTACH:
Hack();
break;
}
return FALSE;
}