Pinball Hack

#include <windows.h>
#include <iostream>
#include <string>
#include <tlhelp32.h>
using namespace std;

void ErrorExit(char* lpszFunction)
{
    LPVOID lpMsgBuf;
    DWORD dw = GetLastError();

    FormatMessage( FORMAT_MESSAGE_ALLOCATE_BUFFER |
        FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL, dw, MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT),
        (LPTSTR) &lpMsgBuf, 0, NULL );

    char buf[512];
    sprintf(buf, "%s failed with error %d: %s", lpszFunction, dw, lpMsgBuf);
    cout << buf << endl;
    ExitProcess(dw);
}

int main()
{
    DWORD ProcessID;

    PROCESSENTRY32 PE;

    HANDLE Snapshot;

    PE.dwSize = sizeof(PROCESSENTRY32);

    Snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);

    if (Process32First(Snapshot, &PE))
    {
          while (Process32Next(Snapshot, &PE))
          {
                if (!strcmp(PE.szExeFile, "pinball.exe"))
                {
                  ProcessID = PE.th32ProcessID;
                }
          }
    }

    if (!ProcessID)
    {
        ErrorExit("Process ID");
    }
    else
    {
        HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, ProcessID);

        if (!hProcess)
        {
            ErrorExit("Open Process");
        }
        else
        {
            int CurScore, Read;

            DWORD NewScore;

            cout << "\nEnter the current score: "; cin >> CurScore; cout << endl;
            cout << "Enter your new score: "; cin >> NewScore; cout << endl;

            MEMORY_BASIC_INFORMATION MBI;

            SIZE_T S, BytesRead;

            SYSTEM_INFO SI;

            GetSystemInfo(&SI);

            DWORD lpStartAddress, lpStopAddress;

            lpStartAddress = (DWORD) SI.lpMinimumApplicationAddress;
            lpStopAddress = (DWORD) SI.lpMaximumApplicationAddress;

            for (DWORD i = lpStartAddress; i <= lpStopAddress; i++)
            {
                S = VirtualQueryEx(hProcess, (LPCVOID) i, &MBI, sizeof(MEMORY_BASIC_INFORMATION));

                if ((S == sizeof(MEMORY_BASIC_INFORMATION)) && (MBI.State == MEM_COMMIT) && (MBI.Type == MEM_PRIVATE) && (MBI.RegionSize > 0))
                {
                       ReadProcessMemory(hProcess, (PCVOID) i, &Read, 4, &BytesRead);

                       if (Read == CurScore)
                       {
                                cout << "Found: " << (LPVOID) i << endl;

                                SIZE_T BytesWritten;

                                WriteProcessMemory(hProcess, (LPVOID) i, &NewScore, sizeof(NewScore), &BytesWritten);
                       }
                }
                else
                {
                    i = (DWORD) MBI.BaseAddress + (DWORD) MBI.RegionSize;
                }
            }


        }
    }


    system("PAUSE");

    return 0;
}