Hello, I'm having a little problem with patching an array of bytes in a running process.
What am I trying to achieve :
A game launcher has a web browser that loads the official website of the game, I want to patch the URL to load my, or any random website instead.
What have I achieved so far :
I am able to attach OllyDbg to the game launcher and patch the bytes maually, then when I continue te execution of the launcher the brower successfully loads my website.
the problem :
I cannot seem to be able to make this work in VB. I have managed to obtain the following piece of code with which I am experimenting.
Code:
Public Function FindPattern(ByVal ProcessName As String, ByVal Pattern As Byte(), ByVal SearchRange As Integer) As Integer
Dim P As Process() = Process.GetProcessesByName(ProcessName)
If P.Length = 0 Then
Return -1
End If
Dim _Buffer As Byte() = New Byte(SearchRange) {}
ReadProcessMemory(P(0).Handle, P(0).MainModule.BaseAddress, _Buffer, _Buffer.Length, 0)
Dim sBytes As Integer() = New Integer(255) {}
Dim Len As Integer = Pattern.Length - 1, Dex = 0
For i As Integer = 255 To 0 Step -1
sBytes(i) = Pattern.Length
Next
For i As Integer = Len To 0 Step -1
sBytes(Pattern(i)) = Len
Next
While Dex <= _Buffer.Length - Pattern.Length
Dim i As Integer = Len
While _Buffer(Dex + i) = Pattern(i)
If i = 0 Then
Return P(0).MainModule.BaseAddress.ToInt32 + Dex
End If
i -= 1
End While
Dex += sBytes(_Buffer(Dex + Len))
End While
Return -1
End Function
Usage :
Code:
MsgBox(FindPattern("ClientLoader", url, &H3DF000).ToString)
Unfortunately I feel as though I do not fully comprehend what is does. More specifically then what the SearchRange should be, as I have tried the size of the module from olly, hoping it would scan throuh the whole process memory. Unfortunaly it always returns -1, meaning it has not found anything ..
I would appreciate if you could help me understand what am I doing wrong, possibly edit the code or show other examples.
I believe that if I am able to search for and find a pattern of bytes in the memory, patching it will be a straight forward process. I am able to patch an .exe, read/write from and into addresses etc. Unfortunately the address of the URL in the memory of this game launcher is always different and for the life of me I cannot find a pointer or a static address. Which is why I am hoping to find the address using pattern scanning. Or just patch the pattern if found.
Thank you