Memory Editor

[brhvitor6]

Hey guys i'm new in the forum and i like to share one of my works (this is used to off-line games)

Downloads

First you'll need the Visual Studio 2010 (or 2008)
And my DLL (with the functions): At the end of post | Scan
And the CE 6.1 by DarkByte Download

Creating the project

After download the VS create a new Windows Forms Application.


Click in Save All... (or Ctrl + Shift + S), Press OK, Go to Documents > Visual Studio 2010 > Project > *Name of your poject* > *Name of your poject* > Bin > Debug And plaste the DLL here

Now lets import the DLL go to: Project > Add Reference...


Now Click in Browse then go to your Project folder > Bin > Debug and Double-Click in DLL

Start the programming

Double-Click in your Form, now import let's put the DLL in the project:


Now we go to create the function of DLL

Memorys mem = new Memorys("Your process");

Pointers, Address and CE

First find the address who contains the value of your need, Right click on it and Click on Pointer Scan for this Address


Now click in OK, Choose one local to save the table of Pointers

Selelect one of the list (Double-Click), and close the Pointer Scanner


If you click on the address in your address list you'll se the address's and the offset's of the Adress.


(Take a picture of this "table" or just let the CE open to the next step)

Modules, Pointer Calcule and Final Address

Back to the VS, now we can bring this informations to ouer trainer.

Frist on Form1 Load we will make the address calcule.

If you look very (very) closer will see that one of the values are a text and not a Hex, that's because it's a module and a module has a Base Address
(in my case "minesweeper.exe" + 000824AC)

To calcule this base address we will use the first function of my DLL

uint base_address = mem.baseaddress("minesweeper.exe");

(uint its the variable type, base_address it's the name of variable , mem.baseaddress it's the function and minesweeper.exe it's the name of module)

But in the CE it's "minesweeper.exe" + 000824AC, well now we need to add this value to the base_address, like this:


Don't forget of the 0x before the value.

Now we got the base address of the module, now we will set the offset's

When we found the pointer did you noticed of a second colun who contais small numbers?


Put their in order like in my code:


Another pic to help you

    uint base_address = mem.baseaddress("minesweeper.exe");
    base_address = base_address + 0x000824AC;
    uint address = (uint)mem.ReadPointer(base_address) + 0x6a4;
    address = (uint)mem.ReadPointer(address) + 0x4b4;
    address = (uint)mem.ReadPointer(address) + 0x98;
    address = (uint)mem.ReadPointer(address) + 0x94;
    address = (uint)mem.ReadPointer(address) + 0x4;

You can see if you calc is correct whth:

MessageBox.Show(address.ToString("x"));

The X transforms to Hex, now just compare to the CE

Writing and Reading the Address

To Write:

mem.Write(address, 10);

The "10" it's the new value (just int)

To Read:

mem.ReadPointer(address);

Retrun int but you can use:

mem.ReadPointer(address).ToString();

To write in a label or wathaver

And to read a string:

mem.ReadString(address).ToString();

That's all guys i hope you like and help whith your's hack's.

Credits: brhvitor6

[Hassan]

Zip and upload the DLL to MPGH by editing your post. Then add a virus scan of the zip and append to your post.

Edit: Since this is in C#, I will check your DLL for malicious code. Be sure you do not obfuscate (protect) it.

[brhvitor6]

Ok, the DLL it'snot protected.. Now i'll upload the dll on mpgh
Edit---
Ready

[Hassan]

Ok, the DLL it'snot protected.. Now i'll upload the dll on mpgh
Edit---
Ready

Alright. Approved !

GJ !

[Paul]

@Hassan if this is C#, shouldn't this be in C# Programming - MPGH - MultiPlayer Game Hacking ? just wondering..

[Hell_Demon]

Because C# section is dead as fuck and noone actually visits it. We've allowed C# releases in here before.

[JustTrollin]

Because C# section is dead as fuck and noone actually visits it. We've allowed C# releases in here before.

Thank you for explaining that.

[cabalsync]

I tried to do a loop with the function "mem.write", but the application hangs and stays "not responding"

private void checkBox1_CheckedChanged(object sender, EventArgs e)
{
uint base_address = mem.baseaddress("process.exe");
base_address = base_address + 0x00125150;
uint address = (uint)mem.ReadPointer(base_address) + 0x74;
while (checkBox1.Checked == true)
{
mem.Write(address, 1);
}
}

this loop to work as freeze value in the address

u help me?

[Broderick]

I tried to do a loop with the function "mem.write", but the application hangs and stays "not responding"

private void checkBox1_CheckedChanged(object sender, EventArgs e)
{
uint base_address = mem.baseaddress("process.exe");
base_address = base_address + 0x00125150;
uint address = (uint)mem.ReadPointer(base_address) + 0x74;
while (checkBox1.Checked == true)
{
mem.Write(address, 1);
}
}

this loop to work as freeze value in the address

u help me?

You've just consumed all the thread resources by putting that code in an infinite loop. The application cannot update or respond because its thread is currently stuck repeating your "freeze". You have a few options here, either put your freeze code in a BackgroundWorker (or another thread), or assign it to a timer. Never use large-volume while-loops in your main application's thread, it will lock the application up until it finishes the loop. Seeing as the application is now locked, you can never toggle the checkbox, essentially making this an infinite loop.

['Bruno]

In another words, your application is not drawing the user interface nor checking the controls, etc... (Its stuck there)

[pDevice]

good job

[stevonator]

EDIT: nvm, i was wrong so nvm this post

good job dude, thx a lot

EDIT 2
if i do MessageBox.Show(mem.ReadString(address).ToString() );
it just gives an empty messagebox, and if i do the readpointer i do get the right value...

EDIT 3
always if i do with ce, i get the same pointer, and if i do with c# the MessageBox.Show(address.ToString("x"));
isn't the same ?
here's what i've got: ce gives 08AA6D50 and c# gives 08AA6DA6

[univex]

Its great library, thanks alot!

[Jhem]

W0w! THis IS Very Good Job!

[brhvitor6]

thx guys.. i'm working on the second version