Since decompiling a .dll in vb, and change it afterwards, wasn't possible. I tried to make it connect to a ftp server, and download the new .dll file from there, it worked... but this is against the (mpgh) rules, so i cant release it. I asked dave, and he told me i have to use sig scanning for this. Can anyone tell me how to do such in VB?
Thanks (btw: you can close the other one now, @Jason)
[highlight=vb.net]
Public Shared Function SignatureScan(ByVal signature As String, ByVal buffer As Byte(), ByVal dwAddress As Integer, ByVal dwSize As Integer) As Integer()
'Will return an array of all the addresses where the signature was found.
'Signature is in the form: "xFF/x19/x87/??/??/??/??/x98/xDE/xAD/xBE/xEF" etc (or leading 0x)
Dim addressList As New List(Of Integer) 'keep track of the addresses
Dim sig As Integer() = New Integer() {}
If (ParseSignature(signature, sig)) Then
For i As Integer = dwAddress To dwSize - 1
For a As Integer = 0 To sig.Length - 1
If (sig(a) = -256 OrElse sig(a) = buffer(i + a)) Then
If (a = sig.Length - 1) Then addressList.Add(i)
Else
Exit For
End If
Next
Next
End If
Return addressList.ToArray()
End Function
Private Shared Function ParseSignature(ByVal pattern As String, ByRef dest As Integer()) As Boolean
pattern = pattern.Trim("/"c) ' trim any leading/trailing slashes.
Dim bytes As String() = pattern.Split("/"c).Select(Function(s As String) s.Replace("0x", "").Replace("x", "")).ToArray() 'split and filter
Dim holder As Integer = 0 'temp variable to hold values
ReDim dest(bytes.Length - 1) 'redeclare the destination to the proper size now it's known.
For i As Integer = 0 To bytes.Length - 1
Dim curByte As String = bytes(i) 'obtain the current byte as string
If (curByte <> "??" AndAlso Not Integer.TryParse(curByte, 515, Nothing, holder)) Then ' (515 is HexNumber style)
Return False 'oh dear, it wasn't a wildcard, and an int could not be parsed so there is an invalid value.
Else
If (curByte <> "??" AndAlso (holder < 0 OrElse holder > 255)) Then Return False 'Value was outside byte range (0-255 for unsigned)
If (curByte = "??") Then holder = -256 'cheeky, I just mark wildcards with a value outside of the byte range.
dest(i) = holder 'add our recently parsed int into the array.
End If
Next
Return True 'parsing was a success, so return true. The array was passed ByRef so it's already updated.
End Function
[/highlight]
Now to use it in a filescanning context:
[highlight=vb.net]
Dim fileBytes As Byte() = IO.File.ReadAllBytes("C:\example.exe") 'load the bytes up
Dim sigAddresses As Integer() = SignatureScan("x6A/??/x73/x6F/x6E", fileBytes, 0, fileBytes.Length) 'scan the whole file
'NOTE: if you want to scan more specific areas, just change dwAddress and dwSize values (dwSize is NOT the "end address", the end address is dwAddress + dwSize - 1
[/highlight]
Thanks! Its Awsum! i hope i get my program finished soon!
Sorry, i don't know how to use this for updating my program i don't get anything of sig scanning, i'm really sorry you could answer tommorow if you want, since your going to sleep now
Signature scanning is a method of finding addresses in a way that you don't need to update the DLL itself. You will need to find a distinctive pattern (an array of bytes) in memory as a 'base' and then you will need to add the relative offset to get your final address.
Example - I have a pattern that gives me 0x1234 but my address us supposed to be, 0x1235, my final address = signature scan result + 0x01.
That's all assuming you have a good pattern that exists in all versions of the game you're trying to hack.
Well, i give up then, i expected something way different... i'll just release my .dll, and update it myself, and release it again. there goes 7 hours of work...
Originally Posted by Jason
Gimme 2 seconds I'll write one up.
why are you so good @ VB.
But how to put the Address of the pattern on textbox? is it possible?
[highlight=vb.net]
Dim foundAddresses As Integer() = SignatureScan("xDE/xAD/??/xEF", New Byte() {1, 2, 3, 4}, 0, 4)
TextBox1.Text = String.Join(", ", foundAddresses.Select(Function( i As Integer ) "0x" + i.ToString("X8")).ToArray())
[/highlight]
Originally Posted by Jason
[highlight=vb.net]
Dim foundAddresses As Integer() = SignatureScan("xDE/xAD/??/xEF", New Byte() {1, 2, 3, 4}, 0, 4)
TextBox1.Text = String.Join(", ", foundAddresses.Select(Function( i As Integer ) "0x" + i.ToString("X8")).ToArray())
[/highlight]
Nothings happen?
You did add a Textbox and name it textbox1 right?
Btw: Jason, sorry for letting you write all this for nothing, you can close this
Originally Posted by Exquizyth
Nothings happen?
Obviously you need to change the signature and the buffer and the range from what I put in there.
[highlight=vb.net]
Dim foundAddresses As Integer() = SignatureScan("xDE/xAD/??/xEF", New Byte() {&HDE, &HAD, &HBE, &HEF}, 0, 4)
TextBox1.Text = String.Join(", ", foundAddresses.Select(Function( i As Integer ) "0x" + i.ToString("X8")).ToArray())
[/highlight]
That will work as-is.
Originally Posted by Jason
Obviously you need to change the signature and the buffer and the range from what I put in there.
[highlight=vb.net]
Dim foundAddresses As Integer() = SignatureScan("xDE/xAD/??/xEF", New Byte() {&HDE, &HAD, &HBE, &HEF}, 0, 4)
TextBox1.Text = String.Join(", ", foundAddresses.Select(Function( i As Integer ) "0x" + i.ToString("X8")).ToArray())
[/highlight]
That will work as-is.
But where to put the the process to get the address
ex:"warrock.exe" then i launch warrock then address autmatically go to textbox.
Originally Posted by Exquizyth
But where to put the the process to get the address
ex:"warrock.exe" then i launch warrock then address autmatically go to textbox.
i don't get anything of sig scanning, i'm really sorry 
Originally Posted by Jason
