Vb.Net Hack (S4League)

[Vishay]

Hello Today =)

I need your help!

I have written an hack in VB.Net and used this modul:

 

(Tag's by me)

Option Strict On

Imports System.Runtime.InteropServices
Imports System.Text

Module MemoryModule

    ' API
    <DllImport("kernel32.dll")> _
    Private Function OpenProcess(ByVal dwDesiredAccess As UInteger, <MarshalAs(UnmanagedType.Bool)> ByVal bInheritHandle As Boolean, ByVal dwProcessId As Integer) As IntPtr
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)> _
    Private Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As IntPtr, <Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)> _
    Private Function ReadProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, <Out()> ByVal lpBuffer() As Byte, ByVal dwSize As IntPtr, ByRef lpNumberOfBytesRead As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Function CloseHandle(ByVal hObject As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
    End Function

    Private Const PROCESS_VM_WRITE As UInteger = &H20
    Private Const PROCESS_VM_READ As UInteger = &H10
    Private Const PROCESS_VM_OPERATION As UInteger = &H8
    Private TargetProcess As String = "S4Client"
    Private ProcessHandle As IntPtr = IntPtr.Zero
    Private LastKnownPID As Integer = -1


    ' Function Process Id Exists: pID as Integer
    Private Function ProcessIDExists(ByVal pID As Integer) As Boolean
        For Each p As Process In Process.GetProcessesByName(TargetProcess)
            If p.Id = pID Then Return True
        Next
        Return False
    End Function

    ' Function Set Process Name: ProcessName as String
    Public Sub SetProcessName(ByVal processName As String)
        TargetProcess = processName
        If ProcessHandle <> IntPtr.Zero Then CloseHandle(ProcessHandle)
        LastKnownPID = -1
        ProcessHandle = IntPtr.Zero
    End Sub

    ' Function Get Current Process Name, as String
    Public Function GetCurrentProcessName() As String
        Return TargetProcess
    End Function

    ' Function Update Process Handle, as Boolean
    Public Function UpdateProcessHandle() As Boolean
        If LastKnownPID = -1 OrElse Not ProcessIDExists(LastKnownPID) Then
            If ProcessHandle <> IntPtr.Zero Then CloseHandle(ProcessHandle)
            Dim p() As Process = Process.GetProcessesByName(TargetProcess)
            If p.Length = 0 Then Return False
            LastKnownPID = p(0).Id
            ProcessHandle = OpenProcess(PROCESS_VM_READ Or PROCESS_VM_WRITE Or PROCESS_VM_OPERATION, False, p(0).Id)
            If ProcessHandle = IntPtr.Zero Then Return False
        End If
        Return True
    End Function

    ' Function Read Memory: Address as Object
    Public Function ReadMemory(Of T)(ByVal address As Object) As T
        Return ReadMemory(Of T)(CLng(address))
    End Function

    ' Function Read Memory: Address as Integer
    Public Function ReadMemory(Of T)(ByVal address As Integer) As T
        Return ReadMemory(Of T)(New IntPtr(address), 0, False)
    End Function

    ' Function Read Memory: Address as Long
    Public Function ReadMemory(Of T)(ByVal address As Long) As T
        Return ReadMemory(Of T)(New IntPtr(address), 0, False)
    End Function

    ' Function Read Memory: Address as IntPtr
    Public Function ReadMemory(Of T)(ByVal address As IntPtr) As T
        Return ReadMemory(Of T)(address, 0, False)
    End Function

    ' Function Read Memory: Address as IntPtr, Length as Integer
    Public Function ReadMemory(ByVal address As IntPtr, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(address, length, False)
    End Function

    ' Function Read Memory: Address as Integer, Length as Integer
    Public Function ReadMemory(ByVal address As Integer, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(New IntPtr(address), length, False)
    End Function

    ' Function Read Memory: Address as Long, Length as Integer
    Public Function ReadMemory(ByVal address As Long, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(New IntPtr(address), length, False)
    End Function

    ' Function Read Memory: Address as IntPtr, Length as Integer, UnicodeString as Boolean
    Public Function ReadMemory(Of T)(ByVal address As IntPtr, ByVal length As Integer, ByVal unicodeString As Boolean) As T
        Dim buffer() As Byte
        If GetType(T) Is GetType(String) Then
            If unicodeString Then buffer = New Byte(length * 2 - 1) {} Else buffer = New Byte(length - 1) {}
        ElseIf GetType(T) Is GetType(Byte()) Then
            buffer = New Byte(length - 1) {}
        Else
            buffer = New Byte(Marshal.SizeOf(GetType(T)) - 1) {}
        End If
        If Not UpdateProcessHandle() Then Return Nothing
        Dim success As Boolean = ReadProcessMemory(ProcessHandle, address, buffer, New IntPtr(buffer.Length), IntPtr.Zero)
        If Not success Then Return Nothing
        If GetType(T) Is GetType(Byte()) Then Return CType(CType(buffer, Object), T)
        If GetType(T) Is GetType(String) Then
            If unicodeString Then Return CType(CType(Encoding.Unicode.GetString(buffer), Object), T)
            Return CType(CType(Encoding.ASCII.GetString(buffer), Object), T)
        End If
        Dim gcHandle As GCHandle = gcHandle.Alloc(buffer, GCHandleType.Pinned)
        Dim returnObject As T = CType(Marshal.PtrToStructure(gcHandle.AddrOfPinnedObject, GetType(T)), T)
        gcHandle.Free()
        Return returnObject
    End Function

    ' Function Get Object Bytes
    Private Function GetObjectBytes(ByVal value As Object) As Byte()
        If value.GetType() Is GetType(Byte()) Then Return CType(value, Byte())
        Dim buffer(Marshal.SizeOf(value) - 1) As Byte
        Dim ptr As IntPtr = Marshal.AllocHGlobal(buffer.Length)
        Marshal.StructureToPtr(value, ptr, True)
        Marshal.Copy(ptr, buffer, 0, buffer.Length)
        Marshal.FreeHGlobal(ptr)
        Return buffer
    End Function

    ' Function Write Memory: Addres as Object, Value as T
    Public Function WriteMemory(Of T)(ByVal address As Object, ByVal value As T) As Boolean
        Return WriteMemory(CLng(address), value)
    End Function

    ' Function Write Memory: Address as Object, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As Object, ByVal value As Object) As Boolean
        Return WriteMemory(CLng(address), CType(value, T))
    End Function

    ' Function Write Memory: Address as Integer, Value as T
    Public Function WriteMemory(Of T)(ByVal address As Integer, ByVal value As T) As Boolean
        Return WriteMemory(New IntPtr(address), value)
    End Function

    ' Function Write Memory: Address as Integer, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As Integer, ByVal value As Object) As Boolean
        Return WriteMemory(address, CType(value, T))
    End Function

    ' Function Write Memory: Address as Long, Value as T
    Public Function WriteMemory(Of T)(ByVal address As Long, ByVal value As T) As Boolean
        Return WriteMemory(New IntPtr(address), value)
    End Function

    ' Function Write Memory: Address as Long, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As Long, ByVal value As Object) As Boolean
        Return WriteMemory(address, CType(value, T))
    End Function

    ' Function Write Memory: Address as IntPtr, Value as T
    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As T) As Boolean
        Return WriteMemory(address, value, False)
    End Function

    ' Function Write Memory: Address as IntPtr, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As Object) As Boolean
        Return WriteMemory(address, CType(value, T), False)
    End Function

    ' Function Write Memory: Address as Object, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As Object, ByVal value As T, ByVal unicode As Boolean) As Boolean
        Return WriteMemory(CLng(address), value, unicode)
    End Function

    ' Function Write Memory: Address as Integer, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As Integer, ByVal value As T, ByVal unicode As Boolean) As Boolean
        Return WriteMemory(New IntPtr(address), value, unicode)
    End Function

    ' Function Write Memory: Address as Long, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As Long, ByVal value As T, ByVal unicode As Boolean) As Boolean
        Return WriteMemory(New IntPtr(address), value, unicode)
    End Function

    ' Function Write Memory: Address as IntPtr, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As T, ByVal unicode As Boolean) As Boolean
        If Not UpdateProcessHandle() Then Return False
        Dim buffer() As Byte
        If TypeOf value Is String Then
            If unicode Then buffer = Encoding.Unicode.GetBytes(value.ToString()) Else buffer = Encoding.ASCII.GetBytes(value.ToString())
        Else
            buffer = GetObjectBytes(value)
        End If
        Dim result As Boolean = WriteProcessMemory(ProcessHandle, address, buffer, New IntPtr(buffer.Length), IntPtr.Zero)
        Return result
    End Function
End Module

So now i tryd this:

    Private Sub GodMode_CheckedChanged(sender As Object, e As EventArgs) Handles GodMode.CheckedChanged
       If UpdateProcessHandle() Then
          WriteMemory(Of Long)(&H3Bxxxxx, 791xxxxx)
     End If
    End Sub

Nothing Happens

And i Tried:

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        If UpdateProcessHandle() Then
            WriteMemory(Of Long)(&H53xxxx, 234856xxxx)
        End If
    End Sub

    Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click
        WriteMemory(Of Long)(&H53xxxx, 234856xxxx)
    End Sub

Nothing Happens ...

And at the end i tried:

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        If UpdateProcessHandle() Then ' Check if the game is running
            ' Do stuff here, like writing/reading memory or telling a user in a Label the game is open.
            Dim LongValue As Long = ReadMemory(Of Single)(&H3BAxxxx)
            ReadMemory(Of Long)(&H53xxxx)
        End If

        If GodMode.Checked Then
            WriteMemory(Of Long)(&H53xxxx, 234856xxxx)
        End If
     End Sub

Also nothing Happens.

My Question is:

WriteMemory(Of Long)

is this wrong? (The Long declaration)

Thx for upcomming Help

[abuckau907]

What do you mean is 'long' wrong? ...how many bytes in ram are you trying to change?

2,348,56x,xxx
4,294,967,295 == UInt32.Max (2^32 - 1)

so your value could fit into 4 bytes and be an uint32 data type

-----------------------------------------------------------------------

IF you're trying to modify game code, the memory region is probably marked as EXECUTE_READ , so any attempt to write to it will fail.
Use the function VirtualQueryEx() to check the protection of a memory region, and use VirtualProtectEx() to change the protection. (You should probably restore the protection when finished, but maybe not always)

    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As T, ByVal unicode As Boolean) As Boolean
        If Not UpdateProcessHandle() Then Return False
        Dim buffer() As Byte
        If TypeOf value Is String Then
            If unicode Then buffer = Encoding.Unicode.GetBytes(value.ToString()) Else buffer = Encoding.ASCII.GetBytes(value.ToString())
        Else
            buffer = GetObjectBytes(value)
        End If
 '' HERE. Check mem region protection type (likely EXECUTE_READ) and change it (to EXECUTE_READ_WRITE) if needed.
        Dim result As Boolean = WriteProcessMemory(ProcessHandle, address, buffer, New IntPtr(buffer.Length), IntPtr.Zero)
 '' restore protection if we changed it. 
        Return result
    End Function

'^^If you'd have written (ie. tested) your own memory library..you'd probably have figured this out : |

VirtualQueryEx(): https://msdn.microsof*****m/en-us/libr...=vs.85%29.aspx
VirtualProtectEx(): https://msdn.microsof*****m/en-us/libr...=vs.85%29.aspx

//C++ MEMORY_BASIC_INFO structure declaration
https://msdn.microsof*****m/en-us/libr...=vs.85%29.aspx  

typedef struct _MEMORY_BASIC_INFORMATION {
  PVOID  BaseAddress;
  PVOID  AllocationBase;
  DWORD  AllocationProtect;
  SIZE_T RegionSize;
  DWORD  State;
  DWORD  Protect;
  DWORD  Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

[Vishay]

What do you mean is 'long' wrong? ...how many bytes in ram are you trying to change?

2,348,56x,xxx
4,294,967,295 == UInt32.Max (2^32 - 1)

so your value could fit into 4 bytes and be an uint32 data type

-----------------------------------------------------------------------

IF you're trying to modify game code, the memory region is probably marked as EXECUTE_READ , so any attempt to write to it will fail.
Use the function VirtualQueryEx() to check the protection of a memory region, and use VirtualProtectEx() to change the protection. (You should probably restore the protection when finished, but maybe not always)

    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As T, ByVal unicode As Boolean) As Boolean
        If Not UpdateProcessHandle() Then Return False
        Dim buffer() As Byte
        If TypeOf value Is String Then
            If unicode Then buffer = Encoding.Unicode.GetBytes(value.ToString()) Else buffer = Encoding.ASCII.GetBytes(value.ToString())
        Else
            buffer = GetObjectBytes(value)
        End If
 '' HERE. Check mem region protection type (likely EXECUTE_READ) and change it (to EXECUTE_READ_WRITE) if needed.
        Dim result As Boolean = WriteProcessMemory(ProcessHandle, address, buffer, New IntPtr(buffer.Length), IntPtr.Zero)
 '' restore protection if we changed it. 
        Return result
    End Function

'^^If you'd have written (ie. tested) your own memory library..you'd probably have figured this out : |

VirtualQueryEx():
VirtualProtectEx():

//C++ MEMORY_BASIC_INFO structure declaration


typedef struct _MEMORY_BASIC_INFORMATION {
  PVOID  BaseAddress;
  PVOID  AllocationBase;
  DWORD  AllocationProtect;
  SIZE_T RegionSize;
  DWORD  State;
  DWORD  Protect;
  DWORD  Type;
} MEMORY_BASIC_INFORMATION, *PMEMORY_BASIC_INFORMATION;

It's an 4 byte Value (long)
0x005367E4 as &H005367E4 and modified 2348565979

but thx for this information
and my question was WriteMemory(Of Long) i have changet the Of Single to Of Long does it works?
Or i need to Open the process first??

================================================
SO now i have This:

    Private Declare Function VirtualProtectEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal lpSize As IntPtr, ByVal dwNewProtect As UInt32, ByRef dwOldProtect As UInt32) As Boolean
    Declare Function VirtualAllocEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As IntPtr


    Sub RemoveProtection(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeToRemoveProtectionInBytes As Integer) (<- CHanged this to Long)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim oldProtect As Integer
            If Not VirtualProtectEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeToRemoveProtectionInBytes), PAGE_EXECUTE_READWRITE, oldProtect) Then Throw New Exception
            p.Dispose()
        Next
    End Sub

    Sub AllocMem(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeOfAllocationInBytes As Integer)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const MEM_COMMIT As Integer = &H1000
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim pBlob As IntPtr = VirtualAllocEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeOfAllocationInBytes), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
            If pBlob = IntPtr.Zero Then Throw New Exception
            p.Dispose()
        Next
    End Sub

and now need to write in the class form

RemoveProtection("Process name", &H400258, 512)

and is this needed to? (I think not^^)

AllocMem("Process name", &H500003, 1024)

If it Right i need to write

RemoveProtection("S4Client", &H5367E4, 9223372036854775807)

or? (Bytes to Remove Protection in Long = 9223372036854775807) ???

[R3DDOT]

It's an 4 byte Value (long)
0x005367E4 as &H005367E4 and modified 2348565979

but thx for this information
and my question was WriteMemory(Of Long) i have changet the Of Single to Of Long does it works?
Or i need to Open the process first??

================================================
SO now i have This:

    Private Declare Function VirtualProtectEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal lpSize As IntPtr, ByVal dwNewProtect As UInt32, ByRef dwOldProtect As UInt32) As Boolean
    Declare Function VirtualAllocEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As IntPtr


    Sub RemoveProtection(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeToRemoveProtectionInBytes As Integer) (<- CHanged this to Long)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim oldProtect As Integer
            If Not VirtualProtectEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeToRemoveProtectionInBytes), PAGE_EXECUTE_READWRITE, oldProtect) Then Throw New Exception
            p.Dispose()
        Next
    End Sub

    Sub AllocMem(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeOfAllocationInBytes As Integer)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const MEM_COMMIT As Integer = &H1000
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim pBlob As IntPtr = VirtualAllocEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeOfAllocationInBytes), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
            If pBlob = IntPtr.Zero Then Throw New Exception
            p.Dispose()
        Next
    End Sub

and now need to write in the class form

RemoveProtection("Process name", &H400258, 512)

and is this needed to? (I think not^^)

AllocMem("Process name", &H500003, 1024)

If it Right i need to write

RemoveProtection("S4Client", &H5367E4, 9223372036854775807)

or? (Bytes to Remove Protection in Long = 9223372036854775807) ???

A 4 byte value is a int(Integer) not long(long = 8 bytes).

[Vishay]

A 4 byte value is a int(Integer) not long(long = 8 bytes).

okay ^^ =D sorry for fail.

But it still doesend work why?

 

Public Class Form1

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        If UpdateProcessHandle() Then ' Check if the game is running
            ' Do stuff here, like writing/reading memory or telling a user in a Label the game is open.
            Dim LongValue As Long = ReadMemory(Of Single)(&H3BA8E07)
            ReadMemory(Of Long)(&H5367E4)
        End If

        If GodMode.Checked Then
            WriteMemory(Of Long)(&H5367E4, 2348565979)
        End If
        If CheckState.Unchecked Then
            WriteMemory(Of Long)(&H5367E4, 2348565977)
        End If
    End Sub

    Private Sub Label1_Click(sender As Object, e As EventArgs) Handles detectProcess.TextChanged
        detectProcess.ForeColor = Color.Red
        detectProcess.Text = "S4Client.exe  -" & UpdateProcessHandle()
        ' Changing The Color if the Process was Found
        If detectProcess.Text = "S4Client.exe  -" & UpdateProcessHandle() = True Then
            detectProcess.ForeColor = Color.Green
        End If
    End Sub

    Private Sub Label1_Click_1(sender As Object, e As EventArgs) Handles Label1.TextChanged
        Label1.Text = ReadMemory(Of Long)(&H5367E4)
    End Sub

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        If UpdateProcessHandle() Then
            RemoveProtection("S4Client", &H5367E4, 9223372036854775807)
            ReadMemory(Of Long)(&H5367E4)
            WriteMemory(Of Long)(&H5367E4, 2348565979)
        End If
    End Sub

    Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click
        RemoveProtection("S4Client", &H5367E4, 2348565979)
        ReadMemory(Of Long)(&H5367E4)
        WriteMemory(Of Long)(&H5367E4, 2348565979)
    End Sub
End Class

 

'Option Strict On

Imports System.Runtime.InteropServices
Imports System.Text

Module MemoryModule

    ' API
    <DllImport("kernel32.dll")> _
    Private Function OpenProcess(ByVal dwDesiredAccess As UInteger, <MarshalAs(UnmanagedType.Bool)> ByVal bInheritHandle As Boolean, ByVal dwProcessId As Integer) As IntPtr
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)> _
    Private Function WriteProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, ByVal lpBuffer As Byte(), ByVal nSize As IntPtr, <Out()> ByRef lpNumberOfBytesWritten As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)> _
    Private Function ReadProcessMemory(ByVal hProcess As IntPtr, ByVal lpBaseAddress As IntPtr, <Out()> ByVal lpBuffer() As Byte, ByVal dwSize As IntPtr, ByRef lpNumberOfBytesRead As IntPtr) As Boolean
    End Function

    <DllImport("kernel32.dll", SetLastError:=True)>
    Private Function CloseHandle(ByVal hObject As IntPtr) As <MarshalAs(UnmanagedType.Bool)> Boolean
    End Function

    Private Declare Function VirtualProtectEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal lpSize As IntPtr, ByVal dwNewProtect As UInt32, ByRef dwOldProtect As UInt32) As Boolean
    Declare Function VirtualAllocEx Lib "kernel32.dll" (ByVal hProcess As IntPtr, ByVal lpAddress As IntPtr, ByVal dwSize As IntPtr, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As IntPtr
   

    Private Const PROCESS_VM_WRITE As UInteger = &H20
    Private Const PROCESS_VM_READ As UInteger = &H10
    Private Const PROCESS_VM_OPERATION As UInteger = &H8
    Private TargetProcess As String = "S4Client"
    Private ProcessHandle As IntPtr = IntPtr.Zero
    Private LastKnownPID As Integer = -1


    ' Function Process Id Exists: pID as Integer
    Private Function ProcessIDExists(ByVal pID As Integer) As Boolean
        For Each p As Process In Process.GetProcessesByName(TargetProcess)
            If p.Id = pID Then Return True
        Next
        Return False
    End Function

    ' Function Set Process Name: ProcessName as String
    Public Sub SetProcessName(ByVal processName As String)
        TargetProcess = processName
        If ProcessHandle <> IntPtr.Zero Then CloseHandle(ProcessHandle)
        LastKnownPID = -1
        ProcessHandle = IntPtr.Zero
    End Sub

    ' Function Get Current Process Name, as String
    Public Function GetCurrentProcessName() As String
        Return TargetProcess
    End Function

    ' Function Update Process Handle, as Boolean
    Public Function UpdateProcessHandle() As Boolean
        If LastKnownPID = -1 OrElse Not ProcessIDExists(LastKnownPID) Then
            If ProcessHandle <> IntPtr.Zero Then CloseHandle(ProcessHandle)
            Dim p() As Process = Process.GetProcessesByName(TargetProcess)
            If p.Length = 0 Then Return False
            LastKnownPID = p(0).Id
            ProcessHandle = OpenProcess(PROCESS_VM_READ Or PROCESS_VM_WRITE Or PROCESS_VM_OPERATION, False, p(0).Id)
            If ProcessHandle = IntPtr.Zero Then Return False
        End If
        Return True
    End Function

    ' Function Read Memory: Address as Object
    Public Function ReadMemory(Of T)(ByVal address As Object) As T
        Return ReadMemory(Of T)(CLng(address))
    End Function

    ' Function Read Memory: Address as Integer
    Public Function ReadMemory(Of T)(ByVal address As Integer) As T
        Return ReadMemory(Of T)(New IntPtr(address), 0, False)
    End Function

    ' Function Read Memory: Address as Long
    Public Function ReadMemory(Of T)(ByVal address As Long) As T
        Return ReadMemory(Of T)(New IntPtr(address), 0, False)
    End Function

    ' Function Read Memory: Address as IntPtr
    Public Function ReadMemory(Of T)(ByVal address As IntPtr) As T
        Return ReadMemory(Of T)(address, 0, False)
    End Function

    ' Function Read Memory: Address as IntPtr, Length as Integer
    Public Function ReadMemory(ByVal address As IntPtr, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(address, length, False)
    End Function

    ' Function Read Memory: Address as Integer, Length as Integer
    Public Function ReadMemory(ByVal address As Integer, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(New IntPtr(address), length, False)
    End Function

    ' Function Read Memory: Address as Long, Length as Integer
    Public Function ReadMemory(ByVal address As Long, ByVal length As Integer) As Byte()
        Return ReadMemory(Of Byte())(New IntPtr(address), length, False)
    End Function

    ' Function Read Memory: Address as IntPtr, Length as Integer, UnicodeString as Boolean
    Public Function ReadMemory(Of T)(ByVal address As IntPtr, ByVal length As Integer, ByVal unicodeString As Boolean) As T
        Dim buffer() As Byte
        If GetType(T) Is GetType(String) Then
            If unicodeString Then buffer = New Byte(length * 2 - 1) {} Else buffer = New Byte(length - 1) {}
        ElseIf GetType(T) Is GetType(Byte()) Then
            buffer = New Byte(length - 1) {}
        Else
            buffer = New Byte(Marshal.SizeOf(GetType(T)) - 1) {}
        End If
        If Not UpdateProcessHandle() Then Return Nothing
        Dim success As Boolean = ReadProcessMemory(ProcessHandle, address, buffer, New IntPtr(buffer.Length), IntPtr.Zero)
        If Not success Then Return Nothing
        If GetType(T) Is GetType(Byte()) Then Return CType(CType(buffer, Object), T)
        If GetType(T) Is GetType(String) Then
            If unicodeString Then Return CType(CType(Encoding.Unicode.GetString(buffer), Object), T)
            Return CType(CType(Encoding.ASCII.GetString(buffer), Object), T)
        End If
        Dim gcHandle As GCHandle = gcHandle.Alloc(buffer, GCHandleType.Pinned)
        Dim returnObject As T = CType(Marshal.PtrToStructure(gcHandle.AddrOfPinnedObject, GetType(T)), T)
        gcHandle.Free()
        Return returnObject
    End Function

    ' Function Get Object Bytes
    Private Function GetObjectBytes(ByVal value As Object) As Byte()
        If value.GetType() Is GetType(Byte()) Then Return CType(value, Byte())
        Dim buffer(Marshal.SizeOf(value) - 1) As Byte
        Dim ptr As IntPtr = Marshal.AllocHGlobal(buffer.Length)
        Marshal.StructureToPtr(value, ptr, True)
        Marshal.Copy(ptr, buffer, 0, buffer.Length)
        Marshal.FreeHGlobal(ptr)
        Return buffer
    End Function

    ' Function Write Memory: Addres as Object, Value as T
    Public Function WriteMemory(Of T)(ByVal address As Object, ByVal value As T) As Boolean
        Return WriteMemory(CLng(address), value)
    End Function

    ' Function Write Memory: Address as Object, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As Object, ByVal value As Object) As Boolean
        Return WriteMemory(CLng(address), CType(value, T))
    End Function

    ' Function Write Memory: Address as Integer, Value as T
    Public Function WriteMemory(Of T)(ByVal address As Integer, ByVal value As T) As Boolean
        Return WriteMemory(New IntPtr(address), value)
    End Function

    ' Function Write Memory: Address as Integer, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As Integer, ByVal value As Object) As Boolean
        Return WriteMemory(address, CType(value, T))
    End Function

    ' Function Write Memory: Address as Long, Value as T
    Public Function WriteMemory(Of T)(ByVal address As Long, ByVal value As T) As Boolean
        Return WriteMemory(New IntPtr(address), value)
    End Function

    ' Function Write Memory: Address as Long, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As Long, ByVal value As Object) As Boolean
        Return WriteMemory(address, CType(value, T))
    End Function

    ' Function Write Memory: Address as IntPtr, Value as T
    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As T) As Boolean
        Return WriteMemory(address, value, False)
    End Function

    ' Function Write Memory: Address as IntPtr, Value as Object
    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As Object) As Boolean
        Return WriteMemory(address, CType(value, T), False)
    End Function

    ' Function Write Memory: Address as Object, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As Object, ByVal value As T, ByVal unicode As Boolean) As Boolean
        Return WriteMemory(CLng(address), value, unicode)
    End Function

    ' Function Write Memory: Address as Integer, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As Integer, ByVal value As T, ByVal unicode As Boolean) As Boolean
        Return WriteMemory(New IntPtr(address), value, unicode)
    End Function

    ' Function Write Memory: Address as Long, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As Long, ByVal value As T, ByVal unicode As Boolean) As Boolean
        Return WriteMemory(New IntPtr(address), value, unicode)
    End Function

    ' Function Write Memory: Address as IntPtr, Value as T, Unicode as Boolean
    Public Function WriteMemory(Of T)(ByVal address As IntPtr, ByVal value As T, ByVal unicode As Boolean) As Boolean
        If Not UpdateProcessHandle() Then Return False
        Dim buffer() As Byte
        If TypeOf value Is String Then
            If unicode Then buffer = Encoding.Unicode.GetBytes(value.ToString()) Else buffer = Encoding.ASCII.GetBytes(value.ToString())
        Else
            buffer = GetObjectBytes(value)
        End If
        Dim result As Boolean = WriteProcessMemory(ProcessHandle, address, buffer, New IntPtr(buffer.Length), IntPtr.Zero)
        Return result
    End Function

    Private Function EXECUTE_READ() As Boolean
        Throw New NotImplementedException
    End Function

    Sub RemoveProtection(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeToRemoveProtectionInBytes As Integer)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim oldProtect As Integer
            If Not VirtualProtectEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeToRemoveProtectionInBytes), PAGE_EXECUTE_READWRITE, oldProtect) Then Throw New Exception
            p.Dispose()
        Next
    End Sub

    Sub RemoveProtection(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeToRemoveProtectionInBytes As Long)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim oldProtect As Integer
            If Not VirtualProtectEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeToRemoveProtectionInBytes), PAGE_EXECUTE_READWRITE, oldProtect) Then Throw New Exception
            p.Dispose()
        Next
    End Sub

    Sub AllocMem(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeOfAllocationInBytes As Integer)
        For Each p As Process In Process.GetProcessesByName(ProcessName)
            Const MEM_COMMIT As Integer = &H1000
            Const PAGE_EXECUTE_READWRITE As Integer = &H40
            Dim pBlob As IntPtr = VirtualAllocEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeOfAllocationInBytes), MEM_COMMIT, PAGE_EXECUTE_READWRITE)
            If pBlob = IntPtr.Zero Then Throw New Exception
            p.Dispose()
        Next
    End Sub

End Module

What's wrong? -.-

[abuckau907]

You never call MemoryManager.SetProcessName( )

It doesn't know which process is the target. ??

The real problem is you're using someone else's memory library w/o understanding it...

[Vishay]

You never call MemoryManager.SetProcessName( )

It doesn't know which process is the target. ??

The real problem is you're using someone else's memory library w/o understanding it...

Yes 'right and it's target to S4Client.exe

I use and memory library whos doesend got any declaration... ^^

    Private TargetProcess As String = "S4Client"

Here is the target

===============================

(Sorry for german^^)

 

Informationen über das Aufrufen von JIT-Debuggen
anstelle dieses Dialogfelds finden Sie am Ende dieser Meldung.

************** Ausnahmetext **************
System.OverflowException: Die arithmetische Operation hat einen Überlauf verursacht.
bei System.IntPtr..ctor(Int64 value)
bei WindowsApplication2.MemoryModule.RemoveProtection( String ProcessName, Int32 AddressOfStart, Int64 SizeToRemoveProtectionInBytes) in C:\Users\Kowan San\documents\visual studio 2013\Projects\WindowsApplication2\WindowsApplicati on2\MemoryModul.vb:Zeile 226.
bei WindowsApplication2.Form1.Button1_Click(Object sender, EventArgs e) in C:\Users\Kowan San\documents\visual studio 2013\Projects\WindowsApplication2\WindowsApplicati on2\Form1.vb:Zeile 45.
bei System.Windows.Forms.Control.OnClick(EventArgs e)
bei System.Windows.Forms.Button.OnClick(EventArgs e)
bei System.Windows.Forms.Button.OnMouseUp(MouseEventAr gs mevent)
bei System.Windows.Forms.Control.WmMouseUp(Message& m, MouseButtons button, Int32 clicks)
bei System.Windows.Forms.Control.WndProc(Message& m)
bei System.Windows.Forms.ButtonBase.WndProc(Message& m)
bei System.Windows.Forms.Button.WndProc(Message& m)
bei System.Windows.Forms.Control.ControlNativeWindow.O nMessage(Message& m)
bei System.Windows.Forms.Control.ControlNativeWindow.W ndProc(Message& m)
bei System.Windows.Forms.NativeWindow.Callback(IntPtr hWnd, Int32 msg, IntPtr wparam, IntPtr lparam)


************** Geladene Assemblys **************
mscorlib
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.34014 built by: FX45W81RTMGDR.
CodeBase: file:///C:/Windows/Microsoft.NET/Framework/v4.0.30319/mscorlib.dll.
----------------------------------------
WindowsApplication2
Assembly-Version: 1.0.0.0.
Win32-Version: 1.0.0.0.
CodeBase: file:///C:/Users/Kowan%20San/Documents/Visual%20Studio%202013/Projects/WindowsApplication2/WindowsApplication2/bin/Debug/WindowsApplication2.exe.
----------------------------------------
Microsoft.VisualBasic
Assembly-Version: 10.0.0.0.
Win32-Version: 12.0.20806.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/Microsoft.VisualBasic/v4.0_10.0.0.0__b03f5f7f11d50a3a/Microsoft.VisualBasic.dll.
----------------------------------------
System
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.34003 built by: FX45W81RTMGDR.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll.
----------------------------------------
System.Core
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Core/v4.0_4.0.0.0__b77a5c561934e089/System.Core.dll.
----------------------------------------
System.Windows.Forms
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms/v4.0_4.0.0.0__b77a5c561934e089/System.Windows.Forms.dll.
----------------------------------------
System.Drawing
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Drawing/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Drawing.dll.
----------------------------------------
System.Configuration
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Configuration/v4.0_4.0.0.0__b03f5f7f11d50a3a/System.Configuration.dll.
----------------------------------------
System.Xml
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.34230 built by: FX452RTMGDR.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Xml/v4.0_4.0.0.0__b77a5c561934e089/System.Xml.dll.
----------------------------------------
System.Runtime.Remoting
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.34107 built by: FX45W81RTMGDR.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Runtime.Remoting/v4.0_4.0.0.0__b77a5c561934e089/System.Runtime.Remoting.dll.
----------------------------------------
mscorlib.resources
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/mscorlib.resources/v4.0_4.0.0.0_de_b77a5c561934e089/mscorlib.resources.dll.
----------------------------------------
System.Windows.Forms.resources
Assembly-Version: 4.0.0.0.
Win32-Version: 4.0.30319.33440 built by: FX45W81RTMREL.
CodeBase: file:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Windows.Forms.resources/v4.0_4.0.0.0_de_b77a5c561934e089/System.Windows.Forms.resources.dll.
----------------------------------------

************** JIT-Debuggen **************
Um das JIT-Debuggen (Just-In-Time) zu aktivieren, muss in der
Konfigurationsdatei der Anwendung oder des Computers
(machine.config) der jitDebugging-Wert im Abschnitt system.windows.forms festgelegt werden.
Die Anwendung muss mit aktiviertem Debuggen kompiliert werden.

Zum Beispiel:

<configuration>
<system.windows.forms jitDebugging="true" />
</configuration>

Wenn das JIT-Debuggen aktiviert ist, werden alle nicht behandelten
Ausnahmen an den JIT-Debugger gesendet, der auf dem
Computer registriert ist, und nicht in diesem Dialogfeld behandelt.

Now i have written
Private TargetProcess As String = "S4Client"
In the main class and get the error/warning and now the label is displaying an value =) but why the error?^^

[Vishay]

Sub RemoveProtection(ByVal ProcessName As String, ByVal AddressOfStart As Integer, ByVal SizeToRemoveProtectionInBytes As Integer)
For Each p As Process In Process.GetProcessesByName(ProcessName)
Const PAGE_EXECUTE_READWRITE As Integer = &H40
Dim oldProtect As Integer
If Not VirtualProtectEx(p.Handle, New IntPtr(AddressOfStart), New IntPtr(SizeToRemoveProtectionInBytes), PAGE_EXECUTE_READWRITE, oldProtect) Then Throw New Exception
p.Dispose()
Next
End Sub
Gibt einen Error aus mit:
Zitat:
Ein Ausnahmefehler des Typs "System.OverflowException" ist in WindowsApplication2.exe aufgetreten.

Zusätzliche Informationen: Die arithmetische Operation hat einen Überlauf verursacht.

Hinweis zur Fehlerbehebung:
Dividieren Sie nicht durch 0
Any Idea?

Changing 9223372036854775807 to an Integer Got an error as Output
Changing the Integer to 512 Works without an Error bot now the Client is crashing ^^

[abuckau907]

I'll say it one more time...

Form1 code

Public Class Form1

    Private Sub Timer1_Tick(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Timer1.Tick
        If UpdateProcessHandle() Then ' Check if the game is running
            ' Do stuff here, like writing/reading memory or telling a user in a Label the game is open.
            Dim LongValue As Long = ReadMemory(Of Single)(&H3BA8E07)
            ReadMemory(Of Long)(&H5367E4)
        End If

        If GodMode.Checked Then
            WriteMemory(Of Long)(&H5367E4, 2348565979)
        End If
        If CheckState.Unchecked Then
            WriteMemory(Of Long)(&H5367E4, 2348565977)
        End If
    End Sub

    Private Sub Label1_Click(sender As Object, e As EventArgs) Handles detectProcess.TextChanged
        detectProcess.ForeColor = Color.Red
        detectProcess.Text = "S4Client.exe  -" & UpdateProcessHandle()
        ' Changing The Color if the Process was Found
        If detectProcess.Text = "S4Client.exe  -" & UpdateProcessHandle() = True Then
            detectProcess.ForeColor = Color.Green
        End If
    End Sub

    Private Sub Label1_Click_1(sender As Object, e As EventArgs) Handles Label1.TextChanged
        Label1.Text = ReadMemory(Of Long)(&H5367E4)
    End Sub

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        If UpdateProcessHandle() Then
            RemoveProtection("S4Client", &H5367E4, 9223372036854775807)
            ReadMemory(Of Long)(&H5367E4)
            WriteMemory(Of Long)(&H5367E4, 2348565979)
        End If
    End Sub

    Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click
        RemoveProtection("S4Client", &H5367E4, 2348565979)
        ReadMemory(Of Long)(&H5367E4)
        WriteMemory(Of Long)(&H5367E4, 2348565979)
    End Sub
End Class

I don't see where you called SetProcess() to tell the MemoryManager class what the target process name is..
(edit: it's not a class..you're using a module... another thing you *should* change)

In your post above you declared a string...but you still didn't call SetProcess() and tell the memory library the name :/

I'm not even going to comment on your protect/unprotect functions....there are some obvious design flaws.. it seems you don't know anything about what you're doing.

much h4xor...

[Vishay]

LoL i cant edit my first post why???

Now it Works i have written my own modul and now works like a pro ^^

And i know a bit what i am doing

(It's not Protected i doesend need that. THE PROCCESS NAME IS CALLED xD!! I have not postet the FULL form)

(I dont use a Class i use an Module!! (See first post (Spoiler=Modul)) (MemoryModul.vb))

    Dim curProcess As Process = Process.GetCurrentProcess()
    Dim Open = Process.GetProcessesByName(ProcName)

Here is the Process target and i recall it with

GetProcessId(ProcName)