Attaching to apps/games to read/write in RAM

BlitzMax Forums/BlitzMax Programming/Attaching to apps/games to read/write in RAM

kronholm (Posted 2009) [#1]

Hey guys :) I'm trying to make something close to the software called "Cheat Engine", where it is possible to scan the system memory for values, and change them on the fly. For instance granting unlimited lives and whatnot in games. I've tried in vain now for a couple days to find any info on this, on how to accomplish it in BlitzMax. I thought I'd make a post and see if anyone could be kind enough to throw a bone my way, and point me in the right direction? Maybe someone has a snippet to look at, or knows if I should "just" do this via Extern? (Not too savvy with that yet)

ziggy (Posted 2009) [#2]

Modern OS prevent applications for writting and reading to non shared memory areas of other applications. These attempts are called memory access violation, and you shoudn't be able to do it, unless there's a vulnerability on the OS.

theHand (Posted 2009) [#3]

This is a very advanced topic, and you might do better to stick with Cheat Engine for Windows or scanmem for Linux.

kronholm (Posted 2009) [#4]

@ziggy: I can attach fine to game processes with Cheat Engine, AutoIT, AutoHotkey and similar apps, so should be possible to do the same via. BlitzMax. @theHand: Yeah I realize it's advanced, but I can't find any info on how to even get started, trying to make this happen with BlitzMax. And I really want to :)

Czar Flavius (Posted 2009) [#5]

You could just get good at the game like a real pro, and not need to cheat ;)

kronholm (Posted 2009) [#6]

Trust me, I'm a pro gamer, I don't need to cheat :) Besides, it's not specifically for gaming. It's more of a learning thing for me really, for future projects, and also to get started on a new skillset. It interests me a lot. I'd like to be able to poke around in memory and know what I'm doing, and I want to do it from within BlitzMax, which I prefer for coding :)

Zeke (Posted 2009) [#7]

this is what i made... SuperStrict Rem typedef struct tagPROCESSENTRY32 { 4 DWORD dwSize; 4 DWORD cntUsage; 4 DWORD th32ProcessID; ULONG_PTR th32DefaultHeapID; 4 DWORD th32ModuleID; 4 DWORD cntThreads; 4 DWORD th32ParentProcessID; 8 Long pcPriClassBase; 4 DWORD dwFlags; TCHAR szExeFile[MAX_PATH]; } PROCESSENTRY32, *PPROCESSENTRY32; typedef struct tagMODULEENTRY32 { DWORD dwSize; DWORD th32ModuleID; DWORD th32ProcessID; DWORD GlblcntUsage; DWORD ProccntUsage; BYTE* modBaseAddr; DWORD modBaseSize; HMODULE hModule; TCHAR szModule[MAX_MODULE_NAME32 + 1]; TCHAR szExePath[MAX_PATH]; } MODULEENTRY32, *PMODULEENTRY32; typedef struct tagTHREADENTRY32 { DWORD dwSize; DWORD cntUsage; DWORD th32ThreadID; DWORD th32OwnerProcessID; LONG tpBasePri; LONG tpDeltaPri; DWORD dwFlags; } THREADENTRY32, *PTHREADENTRY32; EndRem Import "-luser32" Import "-lkernel32" Extern "Win32" 'Pmem_FindWindow%(class%,name$):"FindWindowA" 'Pmem_GetWindowThreadProcessId%(hwnd%,processid*):"GetWindowThreadProcessId" 'Pmem_GetClassName%(hwnd%,classname*,Max%):"GetClassNameA" Function FindWindowA:Int(class:Int,title$z) Function GetWindowThreadProcessId:Int(hwnd:Int,processid:Byte Ptr) Function GetCalssNameA:Int(hwnd:Int,classname:Byte Ptr,_Max:Int) Function GetProcAddress:Byte Ptr(lib%,fname$z) Function LoadLibraryA(lib$z) Function GetCurrentProcess%() Rem .lib "Kernel32.dll" Pmem_OpenProcess%(access%,inherit%,processid%):"OpenProcess" Pmem_ReadProcessMemory%(process%,address%,buffer*,size%,numberofbytesread%):"ReadProcessMemory" Pmem_WriteProcessMemory%(process%,address%,buffer*,size%,numberofbytesread%):"WriteProcessMemory" Pmem_CloseHandle%(Object%):"CloseHandle" Pmem_GetLastError%():"GetLastError" Pmem_CreateToolhelp32Snapshot%(flags%,processid%):"CreateToolhelp32Snapshot" Pmem_Process32First%(snapshot%,entry*):"Process32First" Pmem_Process32Next%(snapshot%,entry*):"Process32Next" DWORD WINAPI FormatMessage( __in DWORD dwFlags, __in_opt LPCVOID lpSource, __in DWORD dwMessageId, __in DWORD dwLanguageId, __out LPTSTR lpBuffer, __in DWORD nSize, __in_opt va_list* Arguments ); EndRem Function OpenProcess%(access%,inherit%,processid%) Function ReadProcessMemory%(process%,address%,buffer:Byte Ptr,size%,numberofbytesread%) Function WriteProcessMemory%(process%,address%,buffer:Byte Ptr,size%,numberofbytesread%) Function CloseHandle%(obj%) Function GetLastError%() Function CreateToolhelp32Snapshot%(flags%,processid%) Function Process32First%(snapshot%,entry:Byte Ptr) Function Process32Next%(snapshot%,entry:Byte Ptr) Function GetPriorityClass%(process%) Function Module32First%(snapshot%,entry:Byte Ptr) Function Module32Next%(snapshot%,entry:Byte Ptr) Function Thread32First%(snapshot%,entry:Byte Ptr) Function Thread32Next%(snapshot%,entrty:Byte Ptr) End Extern Const PROCESS_ALL_ACCESS% =$1F0FFF 'Specifies all possible access flags For the process Object. Const PROCESS_CREATE_THREAD% =$2 'Enables using the process handle in the CreateRemoteThread Function To Create a thread in the process. Const PROCESS_DUP_HANDLE% =$40 'Enables using the process handle as either the source Or target process in the DuplicateHandle Function To duplicate a handle. Const PROCESS_QUERY_INFORMATION% =$400 'Enables using the process handle in the GetExitCodeProcess And GetPriorityClass functions To read information from the process Object. Const PROCESS_SET_INFORMATION% =$200 'Enables using the process handle in the SetPriorityClass Function To set the priority class of the process. Const PROCESS_TERMINATE% =$1 'Enables using the process handle in the TerminateProcess Function To terminate the process. Const PROCESS_VM_OPERATION% =$8 'Enables using the process handle in the VirtualProtectEx And WriteProcessMemory functions To modify the virtual memory of the process. Const PROCESS_VM_READ% =$10 'Enables using the process handle in the ReadProcessMemory Function To read from the virtual memory of the process. Const PROCESS_VM_WRITE% =$20 'Enables using the process handle in the WriteProcessMemory Function To write To the virtual memory of the process. Const SYNCHRONIZE% =$100000 'Enables using the process handle in any of the wait functions To wait For the process To terminate. Const TH32CS_INHERIT% =$80000000 'Indicates that the snapshot handle is To be inheritable. Const TH32CS_SNAPHEAPLIST% =$00000001 'Includes all heaps of the process specified in th32ProcessID in the snapshot. To enumerate the heaps, see Heap32ListFirst. Const TH32CS_SNAPMODULE% =$00000008 'Includes all modules of the process specified in th32ProcessID in the snapshot. To enumerate the modules, see Module32First. '64-bit Windows: Using this flag in a 32-bit application includes 32-bit modules, While using it in a 64-bit application includes 64-bit modules. Const TH32CS_SNAPMODULE32% =$00000010 'Includes all 32-bit modules of the process specified in th32ProcessID in the snapshot when run on 64-bit Windows. This flag can be combined with TH32CS_SNAPMODULE Or TH32CS_SNAPALL. Const TH32CS_SNAPPROCESS% =$00000002 'Includes all processes in the system in the snapshot. To enumerate the processes, see Process32First. Const TH32CS_SNAPTHREAD% =$00000004 'Includes all threads in the system in the snapshot. To enumerate the threads, see Thread32First. 'To identify the threads that belong To a specific process, compare its process identifier To the th32OwnerProcessID member of the THREADENTRY32 structure when enumerating the threads. Const TH32CS_SNAPALL% =TH32CS_INHERIT | TH32CS_SNAPHEAPLIST | TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32 | TH32CS_SNAPPROCESS | TH32CS_SNAPTHREAD ''Includes all processes And threads in the system, plus the heaps And modules of the process specified in th32ProcessID. Equivalent To specifying the TH32CS_SNAPHEAPLIST, TH32CS_SNAPMODULE, TH32CS_SNAPPROCESS, And TH32CS_SNAPTHREAD values combined using an Or operation ('|'). 'Const INVALID_HANDLE VALUE = 6 Rem miten toimimaan Proc.Open("game.exe") 'TAI Proc.Open("window title") 'eka yritt aukaista EXE . jos ei l ydy niin ikkunaa for i=0 to 255 print proc.readbyte(offset=-1) proc.writebyte(5,offset=-1) 'jos ei anna offsetia niin laitetaan nykyiseen kohtaan 'ja kasvatetaan offset next EndRem Global pmem_bank:TBank = CreateBank(4) Global pmem_proc32:TBank = CreateBank(296) PokeInt(pmem_proc32,0,296) Const MAX_PATH:Int = 260 Const MAX_MODULE_NAME32:Int = 255 Type TPROCESSENTRY32 Field dwSize:Int Field cntUsage:Int Field th32ProcessID:Int Field th32DefaultHeapID:Int 'not used always 0 Field th32ModuleID:Int Field cntThreads:Int Field th32ParentProcessID:Int Field pcPriClassBase:Int Field dwFlags:Int 'not used always 0 Field szExeFile:Int '4 260 ' print String.FromCString( szExeFile ) Field pad0:Long '12 Field pad1:Long '20 Field pad2:Long '28 Field pad3:Long '36 Field pad4:Long '44 Field pad5:Long '52 Field pad6:Long '60 Field pad7:Long ' Field pad8:Long Field pad9:Long Field pad10:Long Field pad11:Long Field pad12:Long Field pad13:Long Field pad14:Long Field pad15:Long Field pad16:Long Field pad17:Long Field pad18:Long Field pad19:Long Field pad20:Long Field pad21:Long Field pad22:Long Field pad23:Long Field pad24:Long Field pad25:Long Field pad26:Long Field pad27:Long Field pad28:Long Field pad29:Long Field pad30:Long Field pad31:Long End Type Type TMODULEENTRY32 Field dwSize:Int Field th32ModuleID:Int 'not used always 0 Field th32ProcessID:Int Field glblcntUsage:Int Field ProccntUsage:Int Field modBaseAddr:Byte Ptr Field modBaseSize:Int Field hModule:Int Field szModule:Int '256 Field spad0:Long '12 Field spad1:Long '20 Field spad2:Long '28 Field spad3:Long '36 Field spad4:Long '44 Field spad5:Long '52 Field spad6:Long '60 Field spad7:Long ' Field spad8:Long Field spad9:Long Field spad10:Long Field spad11:Long Field spad12:Long Field spad13:Long Field spad14:Long Field spad15:Long Field spad16:Long Field spad17:Long Field spad18:Long Field spad19:Long Field spad20:Long Field spad21:Long Field spad22:Long Field spad23:Long Field spad24:Long Field spad25:Long Field spad26:Long Field spad27:Long Field spad28:Long Field spad29:Long Field spad30:Long Field szExePath:Int Field pad0:Long '12 Field pad1:Long '20 Field pad2:Long '28 Field pad3:Long '36 Field pad4:Long '44 Field pad5:Long '52 Field pad6:Long '60 Field pad7:Long ' Field pad8:Long Field pad9:Long Field pad10:Long Field pad11:Long Field pad12:Long Field pad13:Long Field pad14:Long Field pad15:Long Field pad16:Long Field pad17:Long Field pad18:Long Field pad19:Long Field pad20:Long Field pad21:Long Field pad22:Long Field pad23:Long Field pad24:Long Field pad25:Long Field pad26:Long Field pad27:Long Field pad28:Long Field pad29:Long Field pad30:Long Field pad31:Int End Type Type TTHREADENTRY32 Field dwSize:Int Field cntUsage:Int 'not used always 0 Field th32ThreadID:Int Field th32OwnerProcessID:Int Field tpBasePri:Int Field tpDeltaPri:Int 'not used always 0 Field dwFlags:Int 'not uset always 0 End Type Function GetWindowProcessId%(name$) Local hwnd%,bank% hwnd = FindWindowA(0,name$) If hwnd = 0 Return False GetWindowThreadProcessId(hwnd,BankBuf(pmem_bank)) Return PeekInt(pmem_bank,0) End Function Function GetProcessId%(name$) Local snapshot%,processid%,offset%,processname$,char:Byte snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,0) If snapshot = 0 Return False If Process32First(snapshot,BankBuf(pmem_proc32)) While Process32Next(snapshot,BankBuf(pmem_proc32)) processid = PeekInt(pmem_proc32,8) processname$ = "" offset = 36 char = PeekByte(pmem_proc32,offset) If char <> 0 While char <> 0 processname$:+ Chr$(char) offset :+ 1 char = PeekByte(pmem_proc32,offset) Wend If Lower(processname$) = Lower(name$) CloseHandle(snapshot) Return processid End If End If Wend End If CloseHandle(snapshot) Return False End Function Type T_Process Field Name:String 'prosessin nimi. Field ProcessID:Int 'prosessin ID Field Offset:Int 'paikka Field Handle:Int Field Error:Int Function Create:t_process(Name:String,access%=PROCESS_ALL_ACCESS) 'Try to Get ProcessID Local _procID:Int=0 _procid=GetProcessID(name) If _procid=0 _procid=GetWindowProcessID(name) If _ProcId=0 Return Null 'jos ei mit n niin pois Local p:t_process=New t_process p.name=name p.ProcessID=_ProcID p.offset=0 p.handle=OpenProcess(access,False,p.processid) If p.handle=0 Return Null Return p End Function Method Close() CloseHandle(handle) End Method Method ReadByte:Byte(offset%=-1) Local _offset% If offset=-1 _offset=Self.offset Else _offset=offset EndIf If ReadProcessMemory(handle,_offset,BankBuf(pmem_bank),1,0)=0 error=getlasterror() If offset=-1 Self.offset:+1 Return 0 EndIf If offset=-1 Self.offset:+1 error=0 Return PeekByte(pmem_bank,0) End Method Method ReadShort:Short(offset%=-1) Local _offset% If offset=-1 _offset=Self.offset Else _offset=offset EndIf If ReadProcessMemory(handle,_offset,BankBuf(pmem_bank),2,0)=0 error=getlasterror() If offset=-1 Self.offset:+2 Return 0 EndIf error=0 If offset=-1 Self.offset:+2 Return PeekShort(pmem_bank,0) End Method Method ReadInt:Int(offset%=-1) Local _offset% If offset=-1 _offset=Self.offset Else _offset=offset EndIf If ReadProcessMemory(handle,_offset,BankBuf(pmem_bank),4,0)=0 error=getlasterror() If offset=-1 Self.offset:+4 Return 0 EndIf error=0 If offset=-1 Self.offset:+4 Return PeekByte(pmem_bank,0) End Method End Type 'Local Proc:t_process 'proc=T_process.Create("testi.exe") 'proc=t_process.Create("BLITZMAX PROCESS - Muistio") 'Base Address : 0x00400000 'eli ohjelman muisti alkaa yleens (aina?) 0x00400000 osoitteesta '4194304 <= kohdasta :O 'ohjelmasta pit isi etsi my s kaikki "modulit" mit ohjelma k ytt ... 'ja modulista pit isi l yty my s TESTI.exe. ja sielt tiedoista pit isi 'l yty TESTI.EXE alkuosoite. ja muistin koko.. 'eli sit muistia kun k yd n l pi.. 'pit isi l yty ohjelman kaikki muistissa olevat "koodit". 'jos etsii teksti niin muista UNICODE muodossa :O 'proc.close GetProcessList() 'Listaa prosessit :O Function GetProcessList() Local hProcessSnap:Int = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0) Local pe32:TPROCESSENTRY32 = New TPROCESSENTRY32 pe32.dwSize = SizeOf(TPROCESSENTRY32) If Not Process32First(hprocesssnap, Byte Ptr(pe32)) Print "PROCESS32 ERROR" CloseHandle(hprocesssnap) Return End If Repeat Print "================================" Print "Process name: " + String.FromCString(Varptr pe32.szExeFile) Print "================================" Local dwPriorityClass:Int = 0 Local hProcess:Int = OpenProcess(PROCESS_ALL_ACCESS, False, pe32.th32ProcessID) If hprocess = Null Print "OpenProcess ERROR!" Else dwpriorityclass = GetPriorityClass(hprocess) If Not dwpriorityclass Print "GetPriorityclass ERROR!" End If CloseHandle(hprocess) End If Print " Process ID = " + pe32.th32ParentProcessID Print " Thread count = " + pe32.cntThreads Print " Parent Process ID = " + pe32.th32ParentProcessID Print " Priority base = " + pe32.pcPriClassBase If dwpriorityclass Print " Priority class = " + dwpriorityclass End If ListProcessModules(pe32.th32ProcessID) ListProcessThreads(pe32.th32ProcessID) Until Not Process32Next(hprocesssnap, Byte Ptr(pe32)) CloseHandle(hprocesssnap) 'Return True End Function Function ListProcessModules(dwPID:Int) Local hModuleSnap:Int = 6 Local me32:TMODULEENTRY32 = New TMODULEENTRY32 hmodulesnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwpid) If hmodulesnap = 6 Print "Createtoolhelp32snapshot(module)" Return End If me32.dwSize = SizeOf(TMODULEENTRY32) If Not Module32First(hmodulesnap, Byte Ptr(me32)) Print "Module32First ERROR" CloseHandle(hmodulesnap) Return End If Repeat Print " Module Name: " + String.FromCString(Varptr me32.szModule) Print " Executable = " + String.FromCString(Varptr me32.szExePath) Print " Process ID = " + me32.th32ProcessID Print " Ref count (g) = " + me32.glblcntUsage Print " Ref count (p) = " + me32.ProccntUsage Print " Base address = " + Int(me32.modBaseAddr) Print " Base size = " + me32.modBaseSize Until Not Module32Next(hmodulesnap, Byte Ptr(me32)) CloseHandle(hmodulesnap) Return End Function Function ListProcessThreads(dwOwnerPID:Int) Local hThreadSnap:Int = 6 Local te32:TTHREADENTRY32 = New TTHREADENTRY32 hthreadsnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0) If hthreadSnap = 6 Return End If te32.dwSize = SizeOf(TTHREADENTRY32) If Not Thread32First(hthreadsnap, Byte Ptr(te32)) Print "Thread32First Error" CloseHandle(hthreadsnap) Return End If Repeat If te32.th32OwnerProcessID = dwownerpid Print " THREAD ID = " + te32.th32ThreadID Print " Base priority = " + te32.tpBasePri Print " Delta priority = " + te32.tpDeltaPri End If Until Not Thread32Next(hthreadsnap, Byte Ptr(te32)) CloseHandle(hthreadsnap) Return End Function i dont know if this help you anything...

kronholm (Posted 2009) [#8]

Super! That will definitely help me get started, by the looks of it :) Thank you thank you thank you!! Is there any chance I could persuade you to translate the comments in finnish to english? :) No biggie if not, just thought I'd ask ;)