[webinject]

Vouch for op. good luck with sales and what not bro.

---

Use WriteProcessMemory.

There are some videos and snippets online if you need more info.

Write process memory isn't necessary once hes in the address space of the injectee.
He can easily dereference the pointer or use memcpy.

[Dispersia]

He's already in the memory. You don't need to externally change it internally, that's useless, just simply do something such as

*(float*)0x09476DAC = 1.0f;

in dllmain, since this isn't an intensive function I doubt you need to start a new thread for it.

[webinject]

what the fuck is injecting dll from kernel mode i'm just curious

[masturbaiter]

No... When you load the DLL that will change the previous address of the float in memory most likely. If he would've just made a call to WriteProcessMemory, he could change memory without injecting any DLL perhaps, however this DLL may be meant to do more than just change a float?

Is this address the one after injection or before then?--is the question

What are you talking about buddy? You seem to be misinterpreting what's going on here....

[masturbaiter]

made something quick that can help you out

Code

typedef struct
{
    void* pFloat;
    float nFloat;
}sFloat;

typedef int (__cdecl* pChangeFloat_t)(void* sFloat_s);
const unsigned char ChangeFloat[] =
{
    0x55,0x8B,0xEC,0x8B,0x45,0x08,0x8B,0x08,0xD9,0x40,
    0x04,0xD9,0x19,0x5D,0xC3,0xCC
};

Usage

Code

DWORD ulOld = 0;
pChangeFloat_t ChangeFloat_o = 0;
float TMP = 1.0f;
sFloat szFloat = {0};

if (VirtualProtect((void*)ChangeFloat,sizeof(ChangeFloat),PAGE_EXECUTE_READWRITE,&ulOld))
{
    ChangeFloat_o = (pChangeFloat_t)(&ChangeFloat);
    szFloat.nFloat = 2.0f;
    szFloat.pFloat = &TMP;
    ChangeFloat_o(&szFloat);
}

If the game is detecting WPM it might be an inline hook. If so you can apply a patch that could easily remove this hook. Better yet if it detects that the hook is being removed just make the hook go to your callback instead.. if all else fails overwrite their callback