ProcMem reading wrong "Client.dll"?

<< Right one

<< Wrong one

I'm not quite sure why this would happen considering ProcMem isn't giving any errors so I'm really confused especially since the initial code is the exact same..

Code:

Mem.Process("csgo.exe");
	Engine = Mem.Module("engine.dll");
	Clients = Mem.Module("client.dll");

Might be why the cheat i'm working isn't fucking working

Post full ProcMem function.

--The only big difference between my two projects is that the working one is CLR but ProcMem doesn't appear to use anyhting CLR related

ProcMem.h

Code:

#ifndef PROCMem_H //If Not Defined
#define PROCMem_H //Define Now

#define WIN32_LEAN_AND_MEAN //Excludes Headers We Wont Use (Increase Compile Time)

#include <windows.h> //Standard Windows Functions/Data Types
#include <iostream> //Constains Input/Output Functions (cin/cout etc..)
#include <TlHelp32.h> //Contains Read/Write Functions
#include <string> //Support For Strings
#include <sstream> //Supports Data Conversion


class ProcMem{
protected:

	//STORAGE
	HANDLE hProcess;
	DWORD dwPID, dwProtection, dwCaveAddress;

	//MISC
	BOOL bPOn, bIOn, bProt;

public:

	//MISC FUNCTIONS
	ProcMem();
	~ProcMem();
    int chSizeOfArray(char *chArray); //Return Size Of External Char Array
	int iSizeOfArray(int *iArray); //Return Size Of External Int Array
	bool iFind(int *iAry, int iVal); //Return Boolean Value To Find A Value Inside An Int Array

#pragma region TEMPLATE MemORY FUNCTIONS

	//REMOVE READ/WRITE PROTECTION
	template <class cData>
	void Protection(DWORD dwAddress)
	{	   
		if(!bProt)
			VirtualProtectEx(hProcess, (LPVOID)dwAddress, sizeof(cData), PAGE_EXECUTE_READWRITE, &dwProtection); //Remove Read/Write Protection By Giving It New Permissions
		else
			VirtualProtectEx(hProcess, (LPVOID)dwAddress, sizeof(cData), dwProtection, &dwProtection); //Restore The Old Permissions After You Have Red The dwAddress

		bProt = !bProt;
	}

	//READ MemORY 
	template <class cData>
	cData Read(DWORD dwAddress)
	{
		cData cRead; //Generic Variable To Store Data
		ReadProcessMemory(hProcess, (LPVOID)dwAddress, &cRead, sizeof(cData), NULL); //Win API - Reads Data At Specified Location 
		return cRead; //Returns Value At Specified dwAddress
	}
    	
	//READ MemORY - Pointer
	template <class cData>
	cData Read(DWORD dwAddress, char *Offset, BOOL Type)
	{
		//Variables
		int iSize = iSizeOfArray(Offset) -1; //Size Of *Array Of Offsets 
        dwAddress = Read<DWORD>(dwAddress); //HEX VAL

		//Loop Through Each Offset & Store Hex Value (Address)
		for (int i = 0; i < iSize; i++)	
			dwAddress = Read<DWORD>(dwAddress + Offset[i]);

		if (!Type)
			return dwAddress + Offset[iSize]; //FALSE - Return Address
		else
			return Read<cData>(dwAddress + Offset[iSize]); //TRUE - Return Value
	}

	//WRITE MemORY
	template <class cData>
    void Write(DWORD dwAddress, cData Value)
	{ 	
		WriteProcessMemory(hProcess, (LPVOID)dwAddress, &Value, sizeof(cData), NULL); 
	}

	//WRITE MemORY - Pointer
	template <class cData>
	void Write(DWORD dwAddress, char *Offset, cData Value)
	{ 
			Write<cData>(Read<cData>(dwAddress, Offset, false), Value); 
	}
	
	//MemORY FUNCTION PROTOTYPES
	virtual void Process(char* ProcessName); //Return Handle To The Process
	virtual void Patch(DWORD dwAddress, char *chPatch_Bts, char *chDefault_Bts); //Write Bytes To Specified Address
	virtual void Inject(DWORD dwAddress, char *chInj_Bts, char *chDef_Bts, BOOL Type); //Jump To A Codecave And Write Memory
	virtual DWORD AOB_Scan(DWORD dwAddress, DWORD dwEnd, char *chPattern); //Find A Byte Pattern
	virtual DWORD Module(LPSTR ModuleName); //Return Module Base Address
	virtual bool DataCompare(const BYTE* pData, const BYTE* pMask, const char* pszMask);
	DWORD FindPattern(DWORD start, DWORD size, const char* sig, const char* mask);
	DWORD FindPatternArr(DWORD start, DWORD size, const char* mask, int count, ...);

	
#pragma endregion	

};
#endif

ProcMem.cpp

Code:

#include "ProcMem.h"

using namespace std;

#pragma region Misc Functions

ProcMem::ProcMem() {
	//Constructor For Class, Do Not Remove!
}

ProcMem::~ProcMem() {
	//De-Constructor
	//Clean Up! (Close Handle - Not Needed Anymore)
	CloseHandle(hProcess);
}

/* This Function Returns The Length Of External Char Arrays, SizeOf(Array) Fails For External Arrays. */
int ProcMem::chSizeOfArray(char *chArray) {

	//Loop Through *chArray To Get Amount Of Bytes
	for (int iLength = 1; iLength < MAX_PATH; iLength++)
		if (chArray[iLength] == '*')
			return iLength;

	cout << "\nLENGTH: Failed To Read Length Of Array\n";
	return 0;
}

/* This Function Returns The Length Of External Int Arrays, SizeOf(Array) Fails For External Arrays. */
int ProcMem::iSizeOfArray(int *iArray) {

	//Loop Through *chArray To Get Amount Of Bytes
	for (int iLength = 1; iLength < MAX_PATH; iLength++)
		if (iArray[iLength] == '*')
			return iLength;

	cout << "\nLENGTH: Failed To Read Length Of Array\n";
	return 0;
}

/* This Function Finds The Specified Value Inside Of Arrays And Returns A Boolean Value,
/* Used For Nnamdibot To Find The Current Crosshair Entity i_NearEntity Inside The Enemy Array. */
bool ProcMem::iFind(int *iAry, int iVal) {

	for (int i = 0; i < 64; i++)
		if (iVal == iAry[i] && iVal != 0)
			return true;

	return false;
}

#pragma endregion

#pragma region Memory Functions

/* This Function Will Return A Handle To The Process So We Can Write & Read Memeory From The Process. */
void ProcMem::Process(char* ProcessName) {

	//Variables
	HANDLE hPID = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, NULL); //Snapshot To View All Active Processes
	PROCESSENTRY32 ProcEntry;
	ProcEntry.dwSize = sizeof(ProcEntry); //Declare Structure Size And Populate It

										  //Loop Through All Running Processes To Find Process
	do
		if (!strcmp(ProcEntry.szExeFile, ProcessName))
		{
			//Store Process ID
			dwPID = ProcEntry.th32ProcessID;
			CloseHandle(hPID);

			//Give Our Handle All Access Rights 
			hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, dwPID);


			return;
		}
	while (Process32Next(hPID, &ProcEntry));

	cout << "\nCouldn't find csgo.exe, make sure csgo.exe is running\n";
	system("pause");
	exit(0);

}

/* This Function Will Write Specified Bytes To The Address, And Can Also Be Reverted Back To Normal
/* Just Call It Again As It Works On A Boolean. */
void ProcMem::Patch(DWORD dwAddress, char *Patch_Bts, char *Default_Bts) {

	//Variables
	int iSize = chSizeOfArray(Default_Bts);

	//Loop Through Addresses Writing Bytes
	if (!bPOn)
		for (int i = 0; i < iSize; i++)
			Write<BYTE>(dwAddress + i, Patch_Bts[i]);
	else
		for (int i = 0; i < iSize; i++)
			Write<BYTE>(dwAddress + i, Default_Bts[i]);

	bPOn = !bPOn;
}

/* This Function Is Similiar To Cheat Engine's Code Injection Function, It's Able To Create JMP's
/* To A Codecave And Write New Memory. Untested CALL Command */
void ProcMem::Inject(DWORD dwAddress, char *Inj_Bts, char *Def_Bts, BOOL Type) {

	//Variables
	int i_ISize = chSizeOfArray(Inj_Bts);
	int i_DSize = chSizeOfArray(Def_Bts);

	if (!bIOn)
	{
		//NOP All Bytes In The Array Past The 5th Byte	
		if (i_DSize > 5)
			for (int i = 6; i < i_DSize; i++)
				Write<BYTE>(dwAddress + i, 0x90);
		else { cout << "\nINJECTION: Default Bytes Must Be More Than 5\n"; return; }

		//Create Codecave
		dwCaveAddress = (DWORD)VirtualAllocEx(hProcess, NULL, i_ISize + 5, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);

		//Calculate Jmp/Return Distances In Bytes To Write
		DWORD dwRetJmp = (dwAddress + i_DSize) - dwCaveAddress - 5; //(NextInstruction - CaveAddress - 5) - is correct equation.
		DWORD dwBaseJmp = dwCaveAddress - dwAddress - 5; //Base Jmp

														 //Loop Through Each Address Writing Inj_Bts Inside The Codecave
		for (int i = 0; i <= i_ISize; i++)
			Write<BYTE>(dwCaveAddress + i, Inj_Bts[i]);

		//Write The Return Distance In Bytes (E9 = Jmp | E8 = Call) To The Original Address
		Write<BYTE>(dwCaveAddress + i_ISize, Type ? 0xE9 : 0xE8);
		Write<DWORD>(dwCaveAddress + i_ISize + 1, dwRetJmp);

		//Write The Jump From The Original Address To The Codecave
		Write<BYTE>(dwAddress, Type ? 0xE9 : 0xE8);
		Write<DWORD>(dwAddress + 1, dwBaseJmp);

	}
	else {
		//Restore Original Bytes
		for (int i = 0; i < i_DSize; i++)
			Write<BYTE>(dwAddress + i, Def_Bts[i]);

		//Clean Up! (DeAllocate CodeCave)
		VirtualFreeEx(hProcess, (LPVOID)dwCaveAddress, i_ISize + 5, MEM_DECOMMIT);
	}
	bIOn = !bIOn;
}

/* Basic Byte Scanner, Will Return The Start Address Of The Specififed Byte Pattern.
/* To-Do: Re-Write Using Memory_Page Functions To Grab Blocks Of Memory And Scan
/* It Inside This Console, Maybe Study Multi-Threading For Faster Scanning. */
DWORD ProcMem::AOB_Scan(DWORD dwAddress, DWORD dwEnd, char *Bytes) {

	//VARIABLES
	int iBytesToRead = 0, iTmp = 0;
	int length = chSizeOfArray(Bytes);
	bool bTmp = false;

	//Check If The Start Of The Array Has Wildcards, So We Can Change The Count
	if (Bytes[0] == '?')
	{
		for (; iBytesToRead < MAX_PATH; iBytesToRead++)
			if (Bytes[iBytesToRead] != '?')
			{
				iTmp = (iBytesToRead + 1);
				break;
			}
	}

	//Increase Start Address Till It Reaches The End Address While Reading Bytes
	for (; dwAddress < dwEnd; dwAddress++)
	{
		if (iBytesToRead == length)
			return dwAddress - iBytesToRead;

		if (Read<BYTE>(dwAddress) == Bytes[iBytesToRead] || (bTmp && Bytes[iBytesToRead] == '?'))
		{
			iBytesToRead++;
			bTmp = true;
		}
		else
		{
			iBytesToRead = iTmp;
			bTmp = false;
		}
	}

	cout << "\nAOB_SCAN: Failed To Find Byte Pattern\n";
	return 0;
}

/* Returns The Base Address Of The Specified Module Inside The Target Process
/* e.g.[ Module("client.dll"); ]. */
DWORD ProcMem::Module(LPSTR ModuleName) {

	//Variables
	HANDLE hModule = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID); //Take A Module Snapshot Of The Process (Grab All Loaded Modules)
	MODULEENTRY32 mEntry; //Declare Module Entry Structure
	mEntry.dwSize = sizeof(mEntry); //Declare Structure Size And Populate It With Loaded Modules

									//Scan For Module By Name
	do
		if (!strcmp(mEntry.szModule, ModuleName))
		{
			CloseHandle(hModule);
			return (DWORD)mEntry.modBaseAddr;
		}
	while (Module32Next(hModule, &mEntry));

	cout << "\nCouldn't find client.dll, retrying...\n";
	return 0;
}

bool ProcMem::DataCompare(const BYTE* pData, const BYTE* pMask, const char* pszMask) {
	for (; *pszMask; ++pszMask, ++pData, ++pMask) {
		if (*pszMask == 'x' && *pData != *pMask) {
			return false;
		}
	}

	return (*pszMask == NULL);
}

DWORD ProcMem::FindPattern(DWORD start, DWORD size, const char* sig, const char* mask) {
	BYTE* data = new BYTE[size];

	unsigned long bytesRead;

	if (!ReadProcessMemory(hProcess, (LPVOID)start, data, size, &bytesRead)) {
		return NULL;
	}

	for (DWORD i = 0; i < size; i++) {
		if (DataCompare((const BYTE*)(data + i), (const BYTE*)sig, mask)) {
			return start + i;
		}
	}

	return NULL;
}

DWORD ProcMem::FindPatternArr(DWORD start, DWORD size, const char* mask, int count, ...) {
	char* sig = new char[count + 1];
	va_list ap;
	va_start(ap, count);
	for (int i = 0; i < count; i++) {
		char read = va_arg(ap, char);
		sig[i] = read;
	}
	va_end(ap);
	sig[count] = ' ';

	return FindPattern(start, size, sig, mask);
}


#pragma endregion

Did you try making your target 32 bit? I had an error with modules that was caused because it was a 64 bit exe and the client.dll was a 32 bit module. Prob not your problem but it wouldn't hurt to try.

Originally Posted by HexMurder

Did you try making your target 32 bit? I had an error with modules that was caused because it was a 64 bit exe and the client.dll was a 32 bit module. Prob not your problem but it wouldn't hurt to try.

CSGO is 32 bit? I don't understand.

Originally Posted by Skips

CSGO is 32 bit? I don't understand.

The target build in visual studios. your dll or exe may be set to 64 by default when you want 32...

Originally Posted by HexMurder

The target build in visual studios. your dll or exe may be set to 64 by default when you want 32...

I've always been building as 32 bit

Originally Posted by Skips

I've always been building as 32 bit

I'm too gay to read through your code

Function GetModuleHandle(ByVal processx As String, ByVal modulex As String) As IntPtr
Dim prs As Process() = Process.GetProcessesByName(processx)
If prs.Length > 0 Then
On Error Resume Next
Dim pi As ProcessModuleCollection = prs(0).Modules
For Each pmod As ProcessModule In pi
If pmod.ModuleName = (modulex) Then
Return pmod.BaseAddress
Else
End If
Next
End If
End function

Don't listen to that 32/64 bit ****** that is nonsense

Originally Posted by CreateMove32

I'm too gay to read through your code

Function GetModuleHandle(ByVal processx As String, ByVal modulex As String) As IntPtr
Dim prs As Process() = Process.GetProcessesByName(processx)
If prs.Length > 0 Then
On Error Resume Next
Dim pi As ProcessModuleCollection = prs(0).Modules
For Each pmod As ProcessModule In pi
If pmod.ModuleName = (modulex) Then
Return pmod.BaseAddress
Else
End If
Next
End If
End function

Don't listen to that 32/64 bit ****** that is nonsense

Says the guy who posts a VB source on a C++ post

ProcMem reading wrong "Client.dll"?

Post a Reply

Similar Threads

Tags for this Thread