Patching bytes without knowing the address

Hello, I'm having a little problem with patching an array of bytes in a running process.

What am I trying to achieve :

A game launcher has a web browser that loads the official website of the game, I want to patch the URL to load my, or any random website instead.

What have I achieved so far :

I am able to attach OllyDbg to the game launcher and patch the bytes maually, then when I continue te execution of the launcher the brower successfully loads my website.

the problem :

I cannot seem to be able to make this work in VB. I have managed to obtain the following piece of code with which I am experimenting.

Code:

 Public Function FindPattern(ByVal ProcessName As String, ByVal Pattern As Byte(), ByVal SearchRange As Integer) As Integer

        Dim P As Process() = Process.GetProcessesByName(ProcessName)
        If P.Length = 0 Then
            Return -1
        End If

        Dim _Buffer As Byte() = New Byte(SearchRange) {}
        ReadProcessMemory(P(0).Handle, P(0).MainModule.BaseAddress, _Buffer, _Buffer.Length, 0)

        Dim sBytes As Integer() = New Integer(255) {}
        Dim Len As Integer = Pattern.Length - 1, Dex = 0

        For i As Integer = 255 To 0 Step -1
            sBytes(i) = Pattern.Length
        Next

        For i As Integer = Len To 0 Step -1
            sBytes(Pattern(i)) = Len
        Next

        While Dex <= _Buffer.Length - Pattern.Length
            Dim i As Integer = Len
            While _Buffer(Dex + i) = Pattern(i)
                If i = 0 Then
                    Return P(0).MainModule.BaseAddress.ToInt32 + Dex
                End If
                i -= 1
            End While
            Dex += sBytes(_Buffer(Dex + Len))
        End While

        Return -1
    End Function

Usage :

Code:

MsgBox(FindPattern("ClientLoader", url, &H3DF000).ToString)

Unfortunately I feel as though I do not fully comprehend what is does. More specifically then what the SearchRange should be, as I have tried the size of the module from olly, hoping it would scan throuh the whole process memory. Unfortunaly it always returns -1, meaning it has not found anything ..
I would appreciate if you could help me understand what am I doing wrong, possibly edit the code or show other examples.
I believe that if I am able to search for and find a pattern of bytes in the memory, patching it will be a straight forward process. I am able to patch an .exe, read/write from and into addresses etc. Unfortunately the address of the URL in the memory of this game launcher is always different and for the life of me I cannot find a pointer or a static address. Which is why I am hoping to find the address using pattern scanning. Or just patch the pattern if found.

Thank you

Try to dump a memory region and try to find the pattern there.

Patternscan

Code:

Public Function patternscan(ByVal startindex As Long, ByVal pattern As Byte(), ByVal mask As String, ByVal bytearraytoscan() As Byte) As IntPtr

        Dim maskk(0 To mask.Length - 1) As String
        For i As Integer = 0 To mask.Length - 1
            maskk(i) = mask.Substring(i, 1)
        Next
        For i As Integer = 0 To bytearraytoscan.Length - pattern.Length
            Dim n(pattern.Length - 1) As Byte
            Array.Copy(bytearraytoscan, i, n, 0, pattern.Length)
            For k As Integer = 0 To n.Length - 1
                If maskk(k).ToLower = "x" Then
                    If pattern(k) = n(k) Then
                        If k = n.Length - 1 Then
                            Return startindex + i
                        Else
                            Continue For
                        End If
                    Else
                        Exit For
                    End If
                    Continue For
                End If
            Next
        Next
        Return 0
    End Function

Code:

 Dim bytearraytoscan() as Byte = ReadMemory(Of Byte())(BaseAdress, dumpSize), False)
 Dim pattern As Byte() = {&H0, &H0, &H0, &H60, &H9D, &H0}
 Dim mask As String = "x??xx?"
    
 Dim address As Integer = patternscan(0, pattern, mask, bytearraytoscan())

If this isn't working, try to find basicly a static pointer. I'm sure there is one.

Patching bytes without knowing the address

Post a Reply

Similar Threads

Tags for this Thread