+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [C] Read/Write Process Memory as another process? (/showthread.php?tid=5776636)
Pages: Pages
1
2
Read/Write Process Memory as another process? - Meterpreter - Dec 30, 2017
Hey guys, I know this is possible, and I don't want to be babied, merely want to know the technical name for it so I can research.
Attach to process -> Attach to another process from that process -> tunnel read/write back and forth.
So my program attaches to chrome.exe, then attaches to bobthebuilder.exe, reads and writes data. Bobthebuilder.exe thinks chrome.exe is reading/writing data.... I'm over explaining...
Any help would be much appreciated, haven't coded in a little while.
Again, don't want to be bottle fed how to do it, just the name of it, and perhaps a helpful link if you can be bothered.
Thank you <3
RE: Read/Write Process Memory as another process? - _Pr0xy - Dec 30, 2017
I'm not sure if this is what you mean, but in C you can hook a functions API calls and "listen" for them, which a lot of banking trojans such as Zeus take advantage of in order to view plaintext bank credentials - https://blog.didierstevens.com/2008/03/19/bpmtk-spying-on-ie/ - that site gives an example on how you can hook Internet Explorer 8, but I am sure it can be applied to other applications, so one program listens for the API calls and passes it onto another. If I misunderstood what you are trying to ask then completely ignore this post 😁
RE: Read/Write Process Memory as another process? - jammy47 - Dec 30, 2017
is this something to do with handles or a debugger?
You need to create 2 processes. 1 will read data from chrome and write to its own space and the 2nd one will read from the process that is reading from chrome. You'll need handles. Openprocess can be used to get handle.
RE: Read/Write Process Memory as another process? - SIM-3475829 - Dec 30, 2017
I am pretty sure he is trying to make cheats?
Correct me if i am wrong
RE: Read/Write Process Memory as another process? - movsx - Dec 30, 2017
Yes, look into interprocess communication. It is a standard technique for bypassing anticheat ObRegisterCallbacks handle stripping (BattlEye, EAC)- as they don't strip handles from system processes like lsass, csrss, svchost, etc.
Inject code into the system process, then use interprocess communication to do reading/writing.
RE: Read/Write Process Memory as another process? - Meterpreter - Dec 30, 2017
I think I found it, I believe it is CreateRemoteThread.... Putting a segment of my code into another processes memory with MemoryAloc function, then from there my segment runs inside the other process.
Please correct me if I am wrong, don't want to create a useless program :')
RE: Read/Write Process Memory as another process? - aeiro - Dec 30, 2017
try process hollowing or forking.
RE: Read/Write Process Memory as another process? - morph - Jan 2, 2018
My suggestion is that you allocate remote memory in Chrome.exe and call Read/WriteProcessMemory through creating a thread in Chrome.exe. I'll wildly assume that it's CS:GO you are creating a cheat for, and if that's true, don't bother doing this if it's for "safety". Won't help.
RE: Read/Write Process Memory as another process? - Meterpreter - Jan 2, 2018
(Jan 2, 2018 09:00 AM)n0ctua Wrote: My suggestion is that you allocate remote memory in Chrome.exe and call Read/WriteProcessMemory through creating a thread in Chrome.exe. I'll wildly assume that it's CS:GO you are creating a cheat for, and if that's true, don't bother doing this if it's for "safety". Won't help.
Yeh I have recently looked up and studied multiple methods. Found RunPE methods to be useless.
Guess I’d be moderately safe considering my code is actually mine with zero public headers.
Next step would be to great a ring0 unsigned driver? But is that necessary for VAC? From what I’ve found ring0 is harder to accomplish on Windows 10? Not many resources and such
RE: Read/Write Process Memory as another process? - Vyxn - Jan 2, 2018
(Jan 2, 2018 04:57 PM)Meterpreter Wrote: Yeh I have recently looked up and studied multiple methods. Found RunPE methods to be useless.
Guess I’d be moderately safe considering my code is actually mine with zero public headers.
Next step would be to great a ring0 unsigned driver? But is that necessary for VAC? From what I’ve found ring0 is harder to accomplish on Windows 10? Not many resources and such
So you want your cheat to be internal? I'd say that's one thing VAC love to find on their process but good luck. 🤝
RE: Read/Write Process Memory as another process? - Meterpreter - Jan 2, 2018
(Jan 2, 2018 05:04 PM)Vyxn Wrote: So you want your cheat to be internal? I'd say that's one thing VAC love to find on their process but good luck. 🤝
My cheat is currently external.
I was thinking of making a driver, not injecting a DLL. I want to operate at system level (ring0), meaning I have direct access to memory. Which would keep me safe from any level 3 anti-cheat protection.
I'm not too sure about the specifics of VAC, but from what I have read VAC operates at user level (3).
Regardless, I'm still new to C++, highly doubt I'll be able to make a fully functioning driver to pass memory info back to a fully functioning program. :')
RE: Read/Write Process Memory as another process? - morph - Jan 3, 2018
Man.. I'm getting A LITTLE tired on people giving advice about VAC when they don't know shit. No offense Vyxn, but you are completely fucking wrong. When it comes to VAC, it doesn't matter at all if the cheat is external or internal. If VAC has access to the cheats memory (which, SURPRISE, it has in both cases) it can get detected.
To OP:
As long as you will not be selling this cheat or giving it out to loads of people, you honestly shouldn't care about security. It will stay undetected as long as you built it from scratch.
RE: Read/Write Process Memory as another process? - int main() - Jan 3, 2018
What you're trying to do is steal a handle from another process to read & write
I suggest you post your questions on unknowncheats most people on here will lead you astray like all posts besides the one above mine, but before you do make sure you're proficient enough to know what to ask, you seemed to have an error getting the base address of a module which gives me the idea that you're not very experienced, so by all means do not try to do this until you have a good grasp of what you're doing.
annnnnnnnd no it's not createremotethread
RE: Read/Write Process Memory as another process? - morph - Jan 3, 2018
(Jan 3, 2018 09:58 AM)int main() Wrote: What you're trying to do is steal a handle from another process to read & write
I suggest you post your questions on unknowncheats most people on here will lead you astray like all posts besides the one above mine, but before you do make sure you're proficient enough to know what to ask, you seemed to have an error getting the base address of a module which gives me the idea that you're not very experienced, so by all means do not try to do this until you have a good grasp of what you're doing.
annnnnnnnd no it's not createremotethread
You say that I'm the only one posting something that won't lead him astray.. And below that paragraph, you say that you can't use CreateRemoteThread? Eh.. Did you even read what I wrote? You can very well use CreateRemoteThread for what he wants to do.
RE: Read/Write Process Memory as another process? - int main() - Jan 3, 2018
(Jan 3, 2018 12:14 PM)n0ctua Wrote: You say that I'm the only one posting something that won't lead him astray.. And below that paragraph, you say that you can't use CreateRemoteThread? Eh.. Did you even read what I wrote? You can very well use CreateRemoteThread for what he wants to do.
He actually can, I'm dumb