Pointers + DLL

Hi,

I'm currently working on a project, which need to use pointer.
For the moment, i placed a codecave somewhere in the code, which call a function at the end for modify the pointer.
The only problem is i don't know how to modify a multi-level pointer.

I actually do by this way :

Code:

#define BASE_CLIENT	 0x00400000
#define BASE_ADDRESS BASE_CLIENT+0x00E6B42C
#define OFFSET1 0x2C
#define OFFSET2 0xE0
#define OFFSET3 0x1C
#define OFFSET4 0x354
#define OFFSET5 0x130

for(;;Sleep(20000))
{
*(int*) *( *( *( *( *( (DWORD*****) BASE_ADDRESS + OFFSET1 ) + OFFSET2) + OFFSET3) + OFFSET4) + OFFSET5) = 0;
}

My pointer in CE : http://img841.imageshack.us/img841/3154/pointere.png
It's not working :/

Does anyone have an idea about this ?

Thanks you

Jesus, dude, why are you doing it this way?! How did you create your code cave and what did you put in it that causes you to have to use crazy pointers like this?

i give u complette dll source codes

Code:

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdio.h>
#include <stdlib.h>


#define BASE_ADDRESS 0x00E6B42C
#define OFFSET5      0x2C
#define OFFSET4      0xE0
#define OFFSET3      0x1C
#define OFFSET2      0x354
#define OFFSET1      0x130


LPTSTR ModulGame = "client.exe";


void Patch(void *adr, void *ptr, int size)
{
DWORD OldProtection;
VirtualProtect(adr,size,PAGE_EXECUTE_READWRITE, &OldProtection);
memcpy(adr,ptr,size);
VirtualProtect(adr,size,OldProtection, &OldProtection);
}


DWORD WINAPI MemPacth(LPVOID param)
{

int __stdcall HACK(void)
{
DWORD base = (DWORD)GetModuleHandleA("client.exe") + (DWORD)BASE_ADDRESS;; 
DWORD Pointer0 = *(PDWORD)((DWORD)(base))+(DWORD)OFFSET1;
DWORD Pointer1 = *(PDWORD)((DWORD)(Pointer0))+(DWORD)OFFSET2;
DWORD Pointer2 = *(PDWORD)((DWORD)(Pointer1))+(DWORD)OFFSET3;
DWORD Pointer3 = *(PDWORD)((DWORD)(Pointer2))+(DWORD)OFFSET4;
DWORD Pointer4 = *(PDWORD)((DWORD)(Pointer3))+(DWORD)OFFSET5;
Patch((void *)(Pointer4),(void*)(PBYTE)"\x00\x00\x00\x00",4);// IF U WANT CHANGE VALUE TO 0
return 0;
ExitThread(0);
}

while (1) {

if (GetAsyncKeyState(VK_F3)&1) {
MessageBeep(MB_ICONINFORMATION);
HACK();

}
Sleep(5);
}
return (0);
}


BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved )
{
if (dwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hDll);
if(dwReason == DLL_PROCESS_ATTACH){
MessageBox(0, "CONTENT INFO", "CAPTION", MB_OK + MB_ICONINFORMATION );

CreateThread(0, 0, (LPTHREAD_START_ROUTINE)MemPacth, 0, 0, 0);

char strDLLName [_MAX_PATH];
GetModuleFileName(hDll, strDLLName , _MAX_PATH);
if (strstr(strDLLName, "yourname.dll") <= 0) {
LPTSTR ModulGame = "client.exe";
}
}
else if(dwReason == DLL_PROCESS_DETACH)
{
}
}
return TRUE;
}

VK_F3 its a sample hotkey ,if u give hotkey F3 to activate hack

@neozen that's true.,
build in Dev Cpp / MVC ++

---------- Post added at 08:36 AM ---------- Previous post was at 08:35 AM ----------

@neozen that's true.,
build in Dev Cpp / MVC ++

How is your post helping him in any way? As for S.P.A.C.E you don't add off sets to your pointer. Think of it logically. Create a pointer array, then move the bits to the array using strcat.

Originally Posted by Verstehen

How is your post helping him in any way? As for S.P.A.C.E you don't add off sets to your pointer. Think of it logically. Create a pointer array, then move the bits to the array using strcat.

I don't really understand what you mean, maybe you could elaborate.

But it looks like S.P.A.C.E. has the idea down, but he just isn't doing it correctly.

The way it works is, you have an address and an offset for your first pointer. This pointer points to the next address and an offset, and so on and so forth.

Code:

DWORD pointer = { 0x00E6B42C };
DWORD offsets[] = { 0x130, 0x354, 0x1C, 0xE0, 0x2C  };

ReadProcessMemory(handle, (LPCVOID)pointer, &pointer, sizeof(pointer), 0);
pointer += offset[0];
ReadProcessMemory(handle, (LPCVOID)pointer, &pointer, sizeof(pointer), 0);
pointer += offset[1];
ReadProcessMemory(handle, (LPCVOID)pointer, &pointer, sizeof(pointer), 0);
pointer += offset[2];
ReadProcessMemory(handle, (LPCVOID)pointer, &pointer, sizeof(pointer), 0);
pointer += offset[3];
ReadProcessMemory(handle, (LPCVOID)pointer, &pointer, sizeof(pointer), 0);
pointer += offset[4];
ReadProcessMemory(handle, (LPCVOID)pointer, &pointer, sizeof(pointer), 0);

I would use ReadProcessMemory to evaluate the data at the base address, the add the first offset.. then evaluate again, add the second offset, evaluate again, etc..

Pointers + DLL

Post a Reply

Similar Threads

Tags for this Thread