Hack Forums
[.NET] [VB.net] Small 'MemoryEngine' for Duming and and Writing - Printable Version

+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [VB.net] Small 'MemoryEngine' for Duming and and Writing (/showthread.php?tid=916290)

Pages: Pages 1 2


[VB.net] Small 'MemoryEngine' for Duming and and Writing - pr0t0typ3 - Dec 22, 2010

  • A small 'MemoryEngine' for dumping and modifying a process memory.

  • The FullDump Function will dump the whole process to a byte array.

  • The PartDump Function will dump a part of the process within the address bounds you enter.

  • The WriteToAbsoluteAddress will write to a absolute address in memory (There is no guarantee that it is within the process memory region.) The Buffer paramter contains the data to write.

  • The WriteToDynamicAddress will write to a specific address that is calcualted using the following formula Baseaddress of the Process + Your Address = ReadAddress. The Buffer Paramter contains the data to write.

  • Give Credits and don't leech


Code
Module MemoryEngine
#Region "Dumping"
    Public Function FullDump(ByVal ID As Integer) As Byte()
        Try
            Dim p As Process = Process.GetProcessById(ID)
            Dim data(p.MainModule.ModuleMemorySize - 1) As Byte
            ReadProcessMemory(p.Handle, p.MainModule.BaseAddress, data, data.Length, 0)
            Return data
        Catch ex As Exception
            Return Nothing
        End Try
    End Function
    Public Function PartDump(ByVal ID As Integer, ByVal Address As Integer, ByVal lenght As Integer) As Byte()
        Try
            Dim p As Process = Process.GetProcessById(ID)
            Dim data(lenght - 1) As Byte
            ReadProcessMemory(p.Handle, New IntPtr(p.MainModule.BaseAddress.ToInt32 + Address), data, data.Length, 0)
            Return data
        Catch ex As Exception
            Return Nothing
        End Try
    End Function

#End Region
#Region "Writing"
    Public Function WriteToAbsoluteAddress(ByVal ID As Integer, ByVal Address As Integer, ByVal Buffer As Byte()) As Boolean
        Try
            Dim p As Process = Process.GetProcessById(ID)
            Return WriteProcessMemory(p.Handle, New IntPtr(Address), Buffer, Buffer.Length, IntPtr.Zero)
        Catch ex As Exception
            Return False
        End Try
    End Function
    Public Function WriteToDynamicAddress(ByVal ID As Integer, ByVal Address As Integer, ByVal Buffer As Byte()) As Boolean
        Try
            Dim p As Process = Process.GetProcessById(ID)
            Return WriteProcessMemory(p.Handle, New IntPtr(p.MainModule.BaseAddress.ToInt32 + Address), Buffer, Buffer.Length, IntPtr.Zero)
        Catch ex As Exception
            Return False
        End Try
    End Function

#End Region
#Region "APIs"
    <DllImportAttribute("kernel32.dll", EntryPoint:="ReadProcessMemory", SetLastError:=True)> _
    Private Function ReadProcessMemory(<InAttribute()> ByVal hProcess As System.IntPtr, <InAttribute()> ByVal lpBaseAddress As System.IntPtr, <Out()> ByVal lpBuffer As Byte(), ByVal nSize As UInteger, <OutAttribute()> ByRef lpNumberOfBytesRead As UInteger) As <System.Runtime.InteropServices.MarshalAsAttribute(System.Runtime.InteropServices.UnmanagedType.Bool)> Boolean
    End Function
    <DllImportAttribute("kernel32.dll", EntryPoint:="ReadProcessMemory", SetLastError:=True)> _
    Private Function WriteProcessMemory(<InAttribute()> ByVal hProcess As System.IntPtr, <InAttribute()> ByVal lpBaseAddress As System.IntPtr, <Out()> ByVal lpBuffer As Byte(), ByVal nSize As UInteger, <OutAttribute()> ByRef lpNumberOfBytesWritten As UInteger) As <System.Runtime.InteropServices.MarshalAsAttribute(System.Runtime.InteropServices.UnmanagedType.Bool)> Boolean
    End Function
#End Region

End Module



* - The-One - Dec 22, 2010

Thanks, I was looking for this :)


* - 6e756c6c - Dec 22, 2010

I never noticed the Process.MainModule.ModuleMemorySize property. Nice post Proto, thanks.


* - My Life - Dec 22, 2010

Really great post pr0t0typ3 . At last someting new I see :)


* - pr0t0typ3 - Dec 22, 2010

(Dec 22, 2010 07:51 AM)Aeonhack Wrote:  I never noticed the Process.MainModule.ModuleMemorySize property. Nice post Proto, thanks.

No Problem. I'm glad some of you like it. I made this when I tried to make my RunPE-Detector and so I found this nice property.


* - d3c0mpil3r - Dec 22, 2010

Will take a look for sure.
Thanks proto. :)



* - pr0t0typ3 - Dec 22, 2010

No Problem. I also found a way of Stealing Steam Password when I tried developing something new. The only bad thing is, that it only works if the current steam session was started with the password entered. Should I sell it ?


* - StarZ - Dec 22, 2010

Proto;

Clear Steam Cache > Steal the pass on login > ??? > Profit?!?!


* - pr0t0typ3 - Dec 22, 2010

(Dec 22, 2010 08:34 AM)StarZ Wrote:  Proto;

Clear Steam Cache > Steal the pass on login > ??? > Profit?!?!

Nice idea but that would need steam to restart and I could read from the running processes also if it contains the entered password.


* - The-One - Dec 22, 2010

Read out the bytes or something using hex viewer? :P


* - Rotana - Dec 22, 2010

Damm very usefull code. Thanks for this


* - pr0t0typ3 - Dec 22, 2010

No Problem. Just give credits and I gonna post more sources like this.


* - MCart - Dec 23, 2010

Great post! I will start to study these usefuls functions asap.
Thanks a lot for sharing :)


* - pr0t0typ3 - Dec 23, 2010

(Dec 23, 2010 05:17 AM)MCart Wrote:  Great post! I will start to study these usefuls functions asap.
Thanks a lot for sharing :)
Enjoy it. I'll post more stuff soon.



* - DaRkReD - Dec 23, 2010

(Dec 22, 2010 08:05 AM)pr0t0typ3 Wrote:  No Problem. I also found a way of Stealing Steam Password when I tried developing something new. The only bad thing is, that it only works if the current steam session was started with the password entered. Should I sell it ?

You should release it privately to people you know and trust or we will have 9001 LEETSTEAMSTEALOR's in 10 minutes