Need help with code injection

Posts 1–6 of 6 · Page 1 of 1
Need help with code injection
Hey guys i'm looking for some help on a problem i'm having with visual basic. I've looked around the forum and can't seem to find a solution to my particular problem so i thought i'd ask about it. I'd like to be able to use a code injection from cheat engine into my visual basic program. I've been able to make almost all of my hacks by noping the code using:
WriteInteger("Process", &HAddress, &H9090, nsize:=2)
But i would like to figure out how to put this code injection into my program:

[ENABLE]
//code from here to '[DISABLE]' will be used to enable the cheat
alloc(newmem,2048) //2kb should be enough
label(returnhere)
label(originalcode)
label(exit)

newmem:
fmul dword ptr [esp+18]
originalcode:
fmul dword ptr [esp+18]
fst dword ptr [esp+3C]

exit:
jmp returnhere

004D636C:
jmp newmem
nop
nop
nop
returnhere:




[DISABLE]
//code from here till the end of the code will be used to disable the cheat
dealloc(newmem)
004D636C:
fmul dword ptr [esp+18]
fst dword ptr [esp+3C]
//Alt: db D8 4C 24 18 D9 54 24 3C

I am using the readwritingmemory.vb for changing the memory and i would like any help i can get. Thanks.
this isn't visual basic, is it?
No it is visual basic. The second code i pasted was from cheat engine. I'm trying to figure out how to put that into visual basic.
There are a few problems. Basically vb.net doesn't support any kind of assembly programming.

That code from CE looks* like regular asm, but at the top it does a function call...while I'm not very good with asm, I'm pretty sure you can't do function calls quite like that.

Anyway, your best bet would be to forget about the CE script for now and focus on what it's actually doing. What goal are you trying to achieve -- you should be able to use writeprocessmemory.

Or maybe even try using fasm_managed (lets you compile asm scripts to bytecode) + writeprocessmemory.

If you have a more specific question I'll try to help, not going to go over the entire process atm.
Looks simple enough to convert to vb.
One issue with the disable part, you should write the default bytes back before deallocating the cave.

This can sometimes cause the game to crash.
Like this instead
Code:
004D636C:
fmul dword ptr [esp+18]
fst dword ptr [esp+3C]
dealloc(newmem)

Heres a simple class i put together for you to test.
 
Create a class called ProcMem and paste this in..
Code:
Public Class ProcMem
#Region "Storage"
    Dim Proc As Process()
    Dim PName As String
    Public ProcActive As Boolean, TimerMade
    '  Dim CodeCave As New List(Of IntPtr)
    ' Dim OldScan As New List(Of String)
#End Region

#Region "API"
    Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As Integer, ByVal buffer As Byte(), ByVal size As Integer, ByVal lpNumberOfBytesWritten As Integer) As Boolean
    Declare Function VirtualAllocEx Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpAddress As Integer, ByVal dwSize As Integer, ByVal flAllocationType As Integer, ByVal flProtect As Integer) As Integer
    Declare Function VirtualFreeEx Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpAddress As Integer, ByVal dwSize As Integer, ByVal dwFreeType As Integer) As Boolean
#End Region

#Region "Get Process"

    Public Sub GetProcess(ByVal ProcessName As String)
        If ProcessName <> String.Empty AndAlso Not TimerMade Then
            PName = If(ProcessName.EndsWith(".exe", StringComparison.OrdinalIgnoreCase), ProcessName.Substring(0, ProcessName.Length - 4), ProcessName)
            MakeTimer(New EventHandler(AddressOf ProcTimer), 500)
            TimerMade = True
        End If
    End Sub

    Private Sub ProcTimer(ByVal sender As Object, ByVal e As EventArgs)
        If (Not ProcActive) Then
            Proc = Process.GetProcessesByName(PName)
            ProcActive = Proc.Length <> 0
        End If
        Try
            ProcActive = Not Proc(0).HasExited
        Catch
            ProcActive = False
        End Try
    End Sub

    Private Sub MakeTimer(ByVal Tmd As EventHandler, ByVal iIntervals As Integer)
        Dim tmr As New Timer
        tmr.Interval = iIntervals
        tmr.Start()
        AddHandler tmr.Tick, New EventHandler(AddressOf Tmd.Invoke)
    End Sub

#End Region

#Region "Allocate"

    Function Allocate() As Integer
        Return If(ProcActive, VirtualAllocEx(Proc(0).Handle, 0, &H200, &H1000, &H40), 0)
    End Function

#End Region

#Region "Deallocate"

    Function DeAllocate(ByVal Address As Integer) As Boolean
        If ProcActive AndAlso Address <> IntPtr.Zero Then
            Return VirtualFreeEx(Proc(0).Handle, Address, 0, &H8000)
        End If
        Return False
    End Function

#End Region

#Region "Write Memory"

    Function WriteBytes(ByVal Address As Integer, ByVal Bytes As Byte()) As Boolean
        Return If(ProcActive, WriteProcessMemory(Proc(0).Handle, Address, Bytes, Bytes.Length, 0), False)
    End Function

    Function WriteBytes(ByVal Address As Integer, ByVal Bytes As String) As Boolean
        Dim byts = HX2Bts(Bytes)
        Return If(ProcActive, WriteProcessMemory(Proc(0).Handle, Address, byts, byts.Length, 0), False)
    End Function

    Function Jmp(ByVal JumpFrom As Integer, ByVal Cave As Integer, ByVal Patched_Bts As String, ByVal DefaultLength As Integer) As Boolean
        If ProcActive Then
            If Cave = 0 Then Return False
            Patched_Bts = TrimSpace(Patched_Bts)
            If WriteBytes(Cave, Patched_Bts + JmpBack(Cave + (Patched_Bts.Length / 2), JumpFrom + DefaultLength)) Then
                WriteBytes(JumpFrom, JmpTo(Cave, JumpFrom, DefaultLength))
            Else
                DeAllocate(Cave)
            End If
        End If
        Return False
    End Function

#End Region

#Region "Misc"

    Private Function HX2Bts(ByVal HXS As String) As Byte()
        HXS = System.Text.RegularExpressions.Regex.Replace(HXS, "[^a-fA-F0-9]", "")
        If HXS.Length Mod 2 <> 0 Then HXS = HXS.Substring(0, HXS.Length - 1)
        Dim buf As Byte() = New Byte((HXS.Length / 2) - 1) {}
        For x = 0 To buf.Length - 1
            buf(x) = Byte.Parse(HXS.Substring(x * 2, 2), System.Globalization.NumberStyles.HexNumber)
        Next
        Return buf
    End Function

    Private Function JmpTo(ByVal Cave As IntPtr, ByVal JumpFrom As Integer, ByVal iLen As Integer) As String
        Dim Ins As String = GetIns(BitConverter.GetBytes(Cave.ToInt32 - JumpFrom - 5))
        For x = 5 To iLen - 1
            Ins += "90"
        Next
        Return "E9" & Ins
    End Function

    Private Function JmpBack(ByVal Cave As Integer, ByVal NextInstruc As Integer) As String
        Return "E9" & GetIns(BitConverter.GetBytes(NextInstruc - Cave - 5))
    End Function

    Private Function GetIns(ByVal BTS As Byte()) As String
        Dim tmp As String = String.Empty
        For x = 0 To BTS.Length - 1
            tmp += String.Format("{0:x2}", BTS(x))
        Next
        Return tmp
    End Function

    Private Function TrimSpace(ByVal txt As String) As String
        Return System.Text.RegularExpressions.Regex.Replace(txt, "\s+", String.Empty)
    End Function

#End Region
End Class


At the top of your main form add this.
Code:
Dim Mem As ProcMem = New ProcMem
Add a form load event and edit it to your process name.
Code:
    Dim Mem As ProcMem = New ProcMem

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Mem.GetProcess("Process Name Here")
    End Sub
Add two variables,one to check if the hack is enabled, the other to store the cave.
Do this again for other hacks. HackTwo HackTwoCave
Code:
    Dim Mem As ProcMem = New ProcMem

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Mem.GetProcess("Process Name Here")
    End Sub

    Dim HackOne As Boolean
    Dim HackOneCave As Integer = 0
Add a button to toggle the hack
Code:
    Dim Mem As ProcMem = New ProcMem

    Private Sub Form1_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Mem.GetProcess("Process Name Here")
    End Sub

    Dim HackOne As Boolean
    Dim HackOneCave As Integer = 0

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        'Jmp(ByVal JumpFrom As Integer, ByVal Cave As Integer, ByVal Patched_Bts As String, ByVal DefaultLength As Integer) As Boolean

        'Default Bytes
        'D8 4C 24 18 - fmul dword ptr [esp+18]
        'D9 54 24 3C - fst dword ptr [esp+3C]

        'Injection
        'D8 4C 24 18 - fmul dword ptr [esp+18]'Not sure why your new instruction is the same as one of the default instructions

        'D8 4C 24 18 - fmul dword ptr [esp+18]
        'D9 54 24 3C - fst dword ptr [esp+3C]

        If Not HackOne Then
            HackOneCave = Mem.Allocate
            Mem.Jmp(&H4D636C, HackOneCave, "D84C2418D84C2418D954243C", 8)
        Else
            If Mem.WriteBytes(&H4D636C, "D84C2418D954243C") Then
                Mem.DeAllocate(HackOneCave)
            End If
        End If

        HackOne = Not HackOne
        CType(sender, Button).ForeColor = If(HackOne, Color.Green, Color.Red)
    End Sub
Just look in CE memory viewer to get the bytes.
You should beable to compare the code to your script.
Thank you so much! Works just fine and solved my problem completely.
Posts 1–6 of 6 · Page 1 of 1

Post a Reply

Similar Threads

Tags for this Thread

None

Need help?