+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] changing value adresses in dll? (/showthread.php?tid=4372565)
Pages: Pages
1
2
changing value adresses in dll? - wat iz dat - Aug 1, 2014
Well. I cant figure one thing. For example: i've got an dll injector (injecting dlls from kernel mode - its public but it should do its job) and i want to inject my dll - it'd be a simple hack for game. There is the stair i need to beat. The game is a multi mod for GTA:San Andreas (mta:sa). I've already got the adresses. The value is float. Addres is 09476DAC. I know how to change the value but i have no clue how to do it when the DLL is injected (when it stars...)
Can any1 help me? Thanks!
* - Tidas - Aug 1, 2014
Use WriteProcessMemory.
There are some videos and snippets online if you need more info.
* - webinject - Aug 1, 2014
Vouch for op. good luck with sales and what not bro.
(Aug 1, 2014 06:52 PM)Tidas Wrote: Use WriteProcessMemory.Write process memory isn't necessary once hes in the address space of the injectee.
There are some videos and snippets online if you need more info.
He can easily dereference the pointer or use memcpy.
* - Dickyb0bSue - Aug 2, 2014
Yeh it can be done externally, you dont need to inject a dll
* - wat iz dat - Aug 2, 2014
Well, because of the AC i need to. :x
* - dberube - Aug 2, 2014
A dll contains a dllmain function that is called when the dll is loaded or removed from a process. From this, call a function that deference the value found at your address and change this value. If you need to add some interactivity, add an infinite loop and use getasynkeystate to trigger the changes.
Code
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
{
switch (fdwReason){
case DLL_PROCESS_ATTACH:
//Procedure to call here.
}
return TRUE;
}If you want an unnecessary complicated example, I created this: https://hackforums.net/showthread.php?tid=4356517
* - Irritiable - Aug 2, 2014
(Aug 1, 2014 06:21 PM)monumento Wrote: Well. I cant figure one thing. For example: i've got an dll injector (injecting dlls from kernel mode - its public but it should do its job) and i want to inject my dll - it'd be a simple hack for game. There is the stair i need to beat. The game is a multi mod for GTA:San Andreas (mta:sa). I've already got the adresses. The value is float. Addres is 09476DAC. I know how to change the value but i have no clue how to do it when the DLL is injected (when it stars...)
Can any1 help me? Thanks!
In short: WriteMemoryProcess() function.
In long: http://www.rohitab.com/discuss/topic/35537-cc-reverse-engineering-tutorial-for-newbies/
Read that tutorial. It'll answer ALL your questions.
* - Dispersia - Aug 2, 2014
He's already in the memory. You don't need to externally change it internally, that's useless, just simply do something such as
Quote:*(float*)0x09476DAC = 1.0f;
in dllmain, since this isn't an intensive function I doubt you need to start a new thread for it.
* - 0xDEAD10CC - Aug 2, 2014
(Aug 2, 2014 05:48 PM)Dispersia Wrote: He's already in the memory. You don't need to externally change it internally, that's useless, just simply do something such as in dllmain, since this isn't an intensive function I doubt you need to start a new thread for it.
No... When you load the DLL that will change the previous address of the float in memory most likely. If he would've just made a call to WriteProcessMemory, he could change memory without injecting any DLL perhaps, however this DLL may be meant to do more than just change a float?
Is this address the one after injection or before then?--is the question
* - webinject - Aug 2, 2014
what the fuck is injecting dll from kernel mode i'm just curious
* - Irritiable - Aug 2, 2014
(Aug 2, 2014 07:44 PM)0xDEAD10CC Wrote: No... When you load the DLL that will change the previous address of the float in memory most likely. If he would've just made a call to WriteProcessMemory, he could change memory without injecting any DLL perhaps, however this DLL may be meant to do more than just change a float?
Is this address the one after injection or before then?--is the question
What is this? I don't even...
Do you know what happens when you call upon LoadLibrary to load a *.dll into a process?
* - masturbaiter - Aug 2, 2014
(Aug 2, 2014 07:44 PM)0xDEAD10CC Wrote: No... When you load the DLL that will change the previous address of the float in memory most likely. If he would've just made a call to WriteProcessMemory, he could change memory without injecting any DLL perhaps, however this DLL may be meant to do more than just change a float?
Is this address the one after injection or before then?--is the question
What are you talking about buddy? You seem to be misinterpreting what's going on here....
* - Irritiable - Aug 2, 2014
(Aug 2, 2014 08:15 PM)masturbaiter Wrote: What are you talking about buddy? You seem to be misinterpreting what's going on here....
In many more ways than just one... And "misinterpreting" isn't even the right word in this case. Ignorance is.
* - dberube - Aug 2, 2014
(Aug 2, 2014 06:51 AM)monumento Wrote: Well, because of the AC i need to. :x
ITT, people not reading this thread.
He clearly stated he needs to inject a dll because the game protection detect WriteProcessMemory.
* - masturbaiter - Aug 2, 2014
made something quick that can help you out
Code
typedef struct
{
void* pFloat;
float nFloat;
}sFloat;
typedef int (__cdecl* pChangeFloat_t)(void* sFloat_s);
const unsigned char ChangeFloat[] =
{
0x55,0x8B,0xEC,0x8B,0x45,0x08,0x8B,0x08,0xD9,0x40,
0x04,0xD9,0x19,0x5D,0xC3,0xCC
};Usage
Code
DWORD ulOld = 0;
pChangeFloat_t ChangeFloat_o = 0;
float TMP = 1.0f;
sFloat szFloat = {0};
if (VirtualProtect((void*)ChangeFloat,sizeof(ChangeFloat),PAGE_EXECUTE_READWRITE,&ulOld))
{
ChangeFloat_o = (pChangeFloat_t)(&ChangeFloat);
szFloat.nFloat = 2.0f;
szFloat.pFloat = &TMP;
ChangeFloat_o(&szFloat);
}If the game is detecting WPM it might be an inline hook. If so you can apply a patch that could easily remove this hook. Better yet if it detects that the hook is being removed just make the hook go to your callback instead.. if all else fails overwrite their callback