My trainer doesn't work

Hello, I've created an AOB trainer recently, dllmain code:

Code:

#include "stdafx.h"
#include <Windows.h>
#include <iostream>  
#include "Memory.h"
using namespace std;

void ChangeMemory(DWORD baseadress, int value, DWORD offset1, DWORD offset2, bool msg)
{
	DWORD d, ds;
	DWORD* adress = (DWORD*)((*(DWORD*)(baseadress + offset1)) + offset2);	

	if (msg)
	{
		char szTest[10] ;
		sprintf_s(szTest, "The final adress is : %X", adress);
		MessageBoxA(NULL,szTest , NULL, NULL);
	}

	*(int*)adress = value;
}
void PatchAOB(char* pattern, char* mask, char* processname, bool msg, char* valuetowrite, int size, int position)
{
	
	DWORD pVariable = FindPattern(processname, pattern, mask);
	pVariable += position;	
	if (pVariable != 0)
	{
		WriteToMemory(pVariable, valuetowrite, size);
	}
	else
	{
		MessageBoxA(NULL,"Something has gone wrong. :/" , NULL, NULL);
	}
	

}

DWORD Patch()
{
	PatchAOB("\xEB\x03\x8B\x45\x08\xC9\xC3\x00\x00\x00\x00\x00\x55\x8B\xEC", "xxxxxxxxxxxxxxx", "Game.exe", true, "\x90\x90", 2, 0);
	return NULL;
}

BOOL APIENTRY DllMain( HMODULE hModule,
                       DWORD  ul_reason_for_call,
                       LPVOID lpReserved
					 )
{
	switch (ul_reason_for_call)
	{
	case DLL_PROCESS_ATTACH:
		CreateThread(0,0,(LPTHREAD_START_ROUTINE)Patch,0,0,0);
            break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		break;
	}
	return TRUE;
}

Memory.h

Code:

#include <iostream>
#include <Windows.h>
#include <tlhelp32.h>
#include <Psapi.h>

void WriteToMemory(uintptr_t addressToWrite, char* valueToWrite, int byteNum)
{
	unsigned long OldProtection;
	VirtualProtect((LPVOID)(addressToWrite), byteNum, PAGE_EXECUTE_READWRITE, &OldProtection);
	memcpy( (LPVOID)addressToWrite, valueToWrite, byteNum);
	VirtualProtect((LPVOID)(addressToWrite), byteNum, OldProtection, NULL);
}

MODULEINFO GetModuleInfo( char *szModule )
{
	MODULEINFO modinfo = {0};
	HMODULE hModule = GetModuleHandle(szModule);
	if(hModule == 0) 
		return modinfo;
	GetModuleInformation(GetCurrentProcess(), hModule, &modinfo, sizeof(MODULEINFO));
	return modinfo;
}

DWORD FindPattern(char *module, char *pattern, char *mask)
{
	MODULEINFO mInfo = GetModuleInfo(module);
	DWORD base = (DWORD)mInfo.lpBaseOfDll;
	DWORD size =  (DWORD)mInfo.SizeOfImage;

	DWORD patternLength = (DWORD)strlen(mask);

	for(DWORD i = 0; i < size - patternLength; i++)
	{
		bool found = true;
		for(DWORD j = 0; j < patternLength; j++)
		{
			found &= mask[j] == '?' || pattern[j] == *(char*)(base + i + j);
		}

		if(found) 
		{
			return base + i;
		}
	}

	return NULL;
}

I'm only using the AOB patching function, ignore the others in dllmain.
It doesn't detect the signature and shows that message box, but I'm sure it does exist. Checked multiple times with OllyDbg.
Note: The game is a Unity3D one.
Any help is appreciated, thanks!

Are you sure your mask is supposed to be 'xxxxxxxxxxxxxxx'? Are there no unknown bytes in the pattern?

Originally Posted by Biesi

Are you sure your mask is supposed to be 'xxxxxxxxxxxxxxx'? Are there no unknown bytes in the pattern?

Yes, the pattern doesn't change each time I restart the game.

Update: Tried "\xEB\x03\x8B\x45\x08\xC9\xC3" with xxxxxxx and didn't work either.
Does it have something to do with Unity?

1) Are you sure that game already unpacked when you trying to inject dll?
2) I just noticed a little bug in PatchAOB:
If you set position argument > 0, even if nothing found, pVariable became that offset, so program will crash because of writing invalid memory
So you can fix it:

Code:

void PatchAOB(char* pattern, char* mask, char* processname, bool msg, char* valuetowrite, size_t size, size_t position)
{
	if (auto addr = pVariable = FindPattern(processname, pattern, mask))
	{
		addr += position;
		WriteToMemory(addr, valuetowrite, size);
	}
	else MessageBoxA(NULL,"Something has gone wrong. :/" , NULL, NULL);
}

Originally Posted by Annet

1) Are you sure that game already unpacked when you trying to inject dll?
2) I just noticed a little bug in PatchAOB:
If you set position argument > 0, even if nothing found, pVariable became that offset, so program will crash because of writing invalid memory
So you can fix it:

Code:

void PatchAOB(char* pattern, char* mask, char* processname, bool msg, char* valuetowrite, size_t size, size_t position)
{
	if (auto addr = pVariable = FindPattern(processname, pattern, mask))
	{
		addr += position;
		WriteToMemory(addr, valuetowrite, size);
	}
	else MessageBoxA(NULL,"Something has gone wrong. :/" , NULL, NULL);
}

Hi, thanks for willing to help.
1) Yes, tried with cheat engine and it detects the pattern.
2) Still showing me the message box. :/

You can use WinApi's mouse_event.
It works perfectly for me

!
https://msdn.microsoft.com/pl-pl/lib...(v=vs.85).aspx

If the pattern is correctly found, the message box should not be shown. Are you sure that your dll is detecting the pattern?

My trainer doesn't work

Post a Reply

Similar Threads

Tags for this Thread