| View previous topic :: View next topic |
| Author |
Message |
ukgee Newbie cheater
Reputation: 0
Joined: 13 May 2012 Posts: 15
|
Posted: Sun May 13, 2012 12:59 pm Post subject: C++ assistance |
|
|
Hey folks, I have an application which I wish to tinker with a little.... when I open it in CE I have a memory address e.g 0x12345678
This line is basically a "JNE" to another pointer, I am wondering how I would go about changing the JNE to a JMP within a C++ DLL as this is an array of bytes.
I can change it manually each time however I would prefer this to be automated via the injection of the DLL and the memory address is static and does not change when I re-open the EXE
Any help would be greatly appreciated.
Edit: since this makes no sense
I have an address value of 0x12345678
I look at this in CE and it says (JNE 98765432)
how do I define that memory address within a C++ DLL and alter it
so that when I inject the DLL the address now equals (JMP 98765432)
|
|
| Back to top |
|
 |
Innovation Grandmaster Cheater
Reputation: 12
Joined: 14 Aug 2008 Posts: 617
|
Posted: Sun May 13, 2012 2:07 pm Post subject: |
|
|
| How many bytes does the offset take up?
|
|
| Back to top |
|
 |
ukgee Newbie cheater
Reputation: 0
Joined: 13 May 2012 Posts: 15
|
Posted: Sun May 13, 2012 2:28 pm Post subject: |
|
|
| O_o how would I find out.... the address I am referencing is static it is always the same even after restarting the app...
|
|
| Back to top |
|
 |
661089799107 Expert Cheater
Reputation: 3
Joined: 25 Jan 2009 Posts: 186
|
Posted: Sun May 13, 2012 3:01 pm Post subject: |
|
|
First step would be to change the protection of the region by using VirtualProtect.
Then you modify the instruction depending on the type of jump.
Assuming a short jump (2 byte):
| Code: |
unsigned char* targetAddress = reinterpret_cast<unsigned char*>(0x123456789);
// EB = JMP SHORT
targetAddress[0] = 0xEB;
|
For a long jump (5 byte):
| Code: |
unsigned char* targetAddress = reinterpret_cast<unsigned char*>(0x123456789);
// E9 = 5 byte jmp
targetAddress[0] = 0xE9;
|
You then revert to the original protection by using VirtualProtect again.
|
|
| Back to top |
|
 |
ukgee Newbie cheater
Reputation: 0
Joined: 13 May 2012 Posts: 15
|
Posted: Sun May 13, 2012 3:48 pm Post subject: |
|
|
Ahhh I see, I have changed it to EB in CE from 75 which was JNE.... am I right in presuming it may be 2 byte? I will look into it more and do some research so as to understand things a bit better.
so far I have mainly focused on message handling and creation of child objects but not directly influenced the memory via the DLL.
|
|
| Back to top |
|
 |
661089799107 Expert Cheater
Reputation: 3
Joined: 25 Jan 2009 Posts: 186
|
Posted: Sun May 13, 2012 3:58 pm Post subject: |
|
|
| ukgee wrote: | | Ahhh I see, I have changed it to EB in CE from 75 which was JNE.... am I right in presuming it may be 2 byte? |
Yes, it is.
|
|
| Back to top |
|
 |
ukgee Newbie cheater
Reputation: 0
Joined: 13 May 2012 Posts: 15
|
Posted: Sun May 13, 2012 5:04 pm Post subject: |
|
|
Thanks, I'll get right to it... is there a defined array size for each? I'm just curious as I noticed you used targetAddress[0] meaning the first entry in the array which in this case if I am comprehending this correctly would be the first byte in the array of bytes.
Curious to know how else it can be used... will get learning
|
|
| Back to top |
|
 |
661089799107 Expert Cheater
Reputation: 3
Joined: 25 Jan 2009 Posts: 186
|
Posted: Sun May 13, 2012 6:14 pm Post subject: |
|
|
| ukgee wrote: | | Thanks, I'll get right to it... is there a defined array size for each? |
There is no defined size. The index is just an offset from the defined address (0x123456789).
| Quote: | I noticed you used targetAddress[0] meaning the first entry in the array which in this case if I am comprehending this correctly would be the first byte in the array of bytes.
|
That is correct.
You could also do:
| Code: |
*targetAddress = 0xEB;
|
Which would have the same result.
| Quote: | | Curious to know how else it can be used... will get learning |
In anyway you want. The only thing that would probably change is the type (unsigned char).
|
|
| Back to top |
|
 |
|