HackLibrary v1.0 .NET

HACKLIBRARY 1.0
By Jason

Hey guys, I've spent the last week or so putting together the most definitive and simple hack library I could think of. Before I go any further I need to say thanks to some people

@Void - Gave me some good function ideas
@Lord Voldemort - Constant abuse helps me grow as a person, oh and he had a few ideas too.
@Hell_Demon - Always around to ask for help when I get stuck, love you.
@freedompeace - The idea for the memoryMonitor function, I love that shit.
@master131 - Obfuscation and gave me some ideas...I think.

Alright now that's out of the way, what is the 'HackLibrary'?

The 'HackLibrary' is a collection of functions/structures/classes specifically designed to make hacking as easy as it can possibly be. This library was written entirely in C# and compiled as x86 with .NET Framework version 3.5 (couldn't go any lower due to LINQ). I made use of generics a whole lot in this library, but I don't want anyone to feel that using these functions is beyond them because they don't understand how to use a generic method so I'll be going through a lot of the methods.

IF YOU DON'T WANT TO READ THE REST OF THE WALL OF TEXT, PLEASE READ THE FOLLOWING BEFORE YOU USE THE CLASS:
Okay, there are a few points to note before you dive into this library. The first and foremost is that this library is compiled as "x86", which means any and all projects you make using this library will have to be compiled as "x86" not "Any CPU"/"x64" etc. For more info in changing target CPU see the bottom of this post. The next is that I didn't really spend ages considering every possible exception that could be thrown in the process, so you'll be responsible for catching and handling any exceptions that arise when you try various methods.
Lastly, accompanying the .dll is an XML file. If you want Visual Studio to provide documented Intellisense when you reference the .dll, please keep the .xml and .dll in the same folder at all times.

Okay that's it for "required" reading, you can go off now if you want

Tutorial on using the Library Begins here

Step One, referencing the .dll and setting up appropriate imports.
Now, this should be easy enough for anyone whose used VS before, simply start a new project click the "Project" toolbar then press "Add Reference". Go to the "Browse" tab and locate the .dll, simple as a pimple. If you didn't read the required reading yet, change your build to Target "x86".
Now, the HackLibrary comes with a few namespaces so let's handle those now:
[highlight=C#]
//C# Declarations
using HackLibrary;
using DllImports;
using Snippets;
[/highlight]
[highlight=VB.NET]
'VB.NET Declarations
Imports HackLibrary
Imports DllImports
Imports Snippets
[/highlight]

Alright, that's the HackLibrary set up.

Step two, instantiating a "QuickHack" class.
One thing to know about the QuickHack class is that it does implement the IDisposable interface, so be sure to dispose of it when you're finished, or more simply: wrap it in a Using -> End Using/ Using{} block.

Constructors
There are two constructors for the QuickHack class (1 overload). The first of them requires a ProcessID, which can be obtained with the "Process" class inherent to the .NET Framework (System.Diagnostics namespace). The second constructor accepts a process location (as a string).

Here's an example of constructing a new QuickHack in C#
[highlight=C#]
/**** USING PROCESS ID ****/
using (QuickHack q = new QuickHack(Process.GetProcessesByName("_Mas")[0].Id))
{
if (q.hasWriteAccess)
{
//successfully created a new QuickHack class to Metal Assault
}
}

/**** USING PROCESS LOCATION ****/
using (QuickHack q = new QuickHack(@"C:\testexecutable.exe"))
{
/*created a new QuickHack to that process location, you can now use
q.startProcess() to start the process and obtain write access */
q.startProcess();
if (q.hasWriteAccess)
{
//success.
}
}
[/highlight]

Now you know how to create a new QuickHack class, good job. Here's an image of the functions available to you now!

In this tutorial I'm really only going to cover the core methods, as a lot or simply extensions on each other and there is documentation accompanying the .dll anyway.

Functions, generics and bears...oh my.
Before I get into this section I thought I'd just point out some general things to know about before using the class.

1. The "BitConverter" class. This is a fantastic class in the "System" namespace. Most of my memory searching functions require you to enter a value in bytes. A BitConverter has the static "GetBytes()" method which can be used to convert most values into bytes. Be warned, although it "says" it handles strings, really it doesn't and you should use System.Text.Encoding.ASCII.GetBytes when converting strings to bytes.

2. A bit about generics. I don't want people to be bamboozled by my generic functions, I was really just too lazy to overload the method 50 thousand times, and this way you can use custom structures as well.

What tells you that a method is generic? Well for the most part, the method signature will look something like this "public T functionname <T>()", the < > is a quick way of telling that the method is generic.

What do I do with a generic method? It's very simple really, you call it like a regular function, but you have an extra step to add: The generic type.

So, for example say I have a method which looks like this:
"public T functionname <T>()"
to call it I would do something like this
int result = functionname<int>();

The value to put in for "T" will determine the return type so effectively the function has become
"public int functionname();" because you specified <T> as an int. You can specify T as pretty much any type. That's generics101 for you, they are a really broad and in depth topic, but that should get you going at least.

On to the functions
First up, readMemory<T>(int address). OOOOH, look at that it's a generic function. Now, this function will read the type specified by "T" from the process memory and return it to you. Here's an example of reading an integer from process memory:
[highlight=C#]
//Assume that I have created a QuickHack instance called 'qHack' before this code
int value = qHack.readMemory<int>(0xD61208);
[/highlight]
Wow, that was easy huh? You can read structures etc the same way. Just change the type used.

Next, writeMemory<T>(int address, T value). Another generic function, but this one has a "T" as a parameter. That just means that it will require an object of type "T" to be passed. So say we pass in a "bool" type, the second parameter would ask for a bool value.
[highlight=C#]
//Assume that I have created a QuickHack instance called 'qHack' before this code
qHack.writeMemory<bool>(0xD145612, true)
[/highlight]

easy huh? Don't let generics freak you out.

MemoryMonitor
This is a slightly more complicated feature to grasp, so I figure I'll give it its own little section to explain it. Basically the memory monitor monitors addresses that you tell it, and if the value changes, it will invoke the "OnValueChanged" delegate method that you gave that specific address. I'm not going to get really into delegates and shit now or this post will never end, but here's a really basic example:

[highlight=C#]
// first I create the method that the delegate will invoke. The parameters must match the delegate signature:
//public delegate void OnValueChanged(int address, object oldvalue, object newvalue);
//this method will just spawn a messagebox containing the address that changed, the old value and the new value. Simple shit.
private void valueChangedHandler(int address, object oldvalue, object newvalue)
{
MessageBox.Show(string.join("\r\n", new string[] {"Address: 0x" + address.ToString("X8"), "Old value: " + oldvalue.ToString(), "New Value: " + newvalue.ToString()}));
}

//next we'll use the generic "addToMonitor" function to add our address to the monitor
//Assume that I have created a QuickHack instance called 'qHack' before this code, and we're in a method body
OnValueChanged ovc = new OnValueChanged(valueChangedHandler); //create a new delegate that points to our handler.
int monitorID = qHack.addToMonitor<int>(0xD61208, ovc) //the function returns the ID of the monitor, so that you can remove it later using "removeFromMonitor"
[/highlight]

Okay, we've now added a new address to be monitored. If the value at that address changes, our handler will be invoked and a messagebox will spawn telling us the new value. Handy huh?

Signature Scanning
I added a signature scanning function. It's pretty easy to understand, but I thought I'd just clear up the signature syntax here. Most C++'ers would be familiar with Pattern("\0x00\0xFF", ?x) and shit, my syntax is different. ?? represents a wildcard (any value) byte, and each byte in the sequence must be delimited by a "/". Here's an example of a correct signature:

Code:

0xFF/0xD6/0x15/0x78/??/??/??/??/0x98/0x56/0x13

Now you just need to remember that when using any of the signature scanning functions.

Other than that, there's just some pretty self explanatory method (at least, the XML documentation will explain them).

And here's a little "complete" snippet for you (console application)
[highlight=C#]
using System;
using System.Diagnostics;
using HackLibrary;
using DllImports;
using Snippets;
using System.IO;

namespace MPGHExample
{
class Program
{
static void Main()
{
int procID = 8532; //obtained process id elsewhere
using(QuickHack q = new QuickHack(procID))
{
string signature = "0xFF/0xD6/0x15/0x78/??/??/??/??/0x98/0x56/0x13"; //my signature
string[] modulesToScan = new string[] {"d3d9.dll", "xul.dll"}; //specify which modules to scan
Console.WriteLine("Beginning signature scan for process '" + Process.GetProcessById(procID).ProcessName + ".exe'...");
Console.WriteLine("Limiting scan to: '" + string.Join(", ", modulesToScan) + "'...");
int[] foundAddresses = q.sigScanSpecificModules(modulesToScan, signature); //scan specific modules.
foreach (int address in foundAddresses) //loop through found addresses
{
PROCESS_MODULE enclosingModule = q.getEnclosingModule(address); //find the module that contained this address.
Console.WriteLine("Found Address: 0x{0} --- MODULE: {1} --- RVA: 0x{2}", new object[] {address.ToString("X8"), Path.GetFileName(enclosingModule.Name), (address - enclosingModule.ModuleInfo.lpBaseOfDll).ToString(" X8")});
}
Console.WriteLine("Signature scan complete"); //done, yay
}
}
}
}
[/highlight]

And that's it.
This library was coded completely by me, I don't care where/how you use it, that is up to you, but if you use it, at least mention me in the credits.

Compiling to "x86" with VS Express editions.

Originally Posted by John Wein

To target x86 in the express editions:

Tools --> Options --> Projects and Solutions-->General Check "Show advanced build configurations"
If "Configuration Manager" doesn't show on the Buid menu, add it and click it.
Active Solution Platform --> New --> Type or select the new platform x86

Easy as that.

If you have any questions, comments, criticisms or suggestions, feel free to post them below.

Virus Scans
[x][x]

Cheers,
Jason

HackLibrary v1.0 .NET

Post a Reply

Tags for this Thread