Thread: [C++] Example of patching pointers

Example of patching pointers

Auto-updates address using signature scanning and patches the game for console.

neverfail.cpp

 /******************************************

*  Mess with the best die like the rest.  *

*    Project opened 11th August 2007~~    *

*                                         *

*              Mr. Novocain!              *

*           <novcain@gmail.com>           *

* neverfail.cpp            Main functions *

******************************************/

#include <Windows.h>

#include <fstream>

#include "sigsearch.h"

#include "siggehs.h"

using namespace std;



//GetDirectoryFile from azorbix' D3D8 starterkit

char dlldir[320];

char *GetDirectoryFile(char *filename){ static char path[320]; strcpy(path, dlldir); strcat(path, filename); return path; }

//add_log from azorbix' D3D8 starterkit

ofstream ofile;

void __cdecl add_log (const char *fmt, ...){ if(ofile != NULL){ if(!fmt) { return; } va_list va_alist; char logbuf[256] = {0}; va_start (va_alist, fmt); _vsnprintf (logbuf+strlen(logbuf), sizeof(logbuf) - strlen(logbuf), fmt, va_alist); va_end (va_alist); ofile << logbuf << endl; } }



//the main thread

void MainThread()

{

	//long lAddress = 0x63B3D0;

	//00430350  /$ A1 D0B36300    MOV EAX,DWORD PTR DS:[63B3D0]

	BYTE FindPointerAddress[5];

	memcpy(FindPointerAddress,(void*)ConsoleAddr,4);

	//add_log("FindPointerAddress[0] is 0x%XnFindPointerAddress[1] is 0x%XnFindPointerAddress[2] is 0x%XnFindPointerAddress[3] is 0x%XnFindPointerAddress[4] is 0x%X",FindPointerAddress[0],FindPointerAddress[1],FindPointerAddress[2],FindPointerAddress[3],FindPointerAddress[4]);

	long Part3 = FindPointerAddress[3] * 0x10000;

	//add_log("Multiplying FindPointerAddress[3] by 0x10000..");

	long Part2 = FindPointerAddress[2] * 0x100;

	long Part1 = FindPointerAddress[1];

	//add_log("Multiplying FindPointerAddress[4] by 0x100..");

	long lFirstAddress = ((Part3+Part2)+Part1);

	//add_log("Part 1 is 0x%XnPart 2 is 0x%XnPart 3 is 0x%X",Part1,Part2,Part3);

	add_log("Address: 0x%X",lFirstAddress);



	long lPointer = 0x18;

	add_log("Pointer: 0x%X",lPointer);



	long* pAddress = (long*)lFirstAddress;

	long lBuffer = *pAddress;

	long lRealAddress = lBuffer + lPointer;	//add together 'buffert' and the pointer then we get the address it points to

	add_log("Address it points to: 0x%X",lRealAddress);



	int* pConsole = (int*)lRealAddress;	//make a pointer of our own ;)

	add_log("Console is currently: %d",pConsole);



	*pConsole = 18;		//change the value

	add_log("Console patched to: %d (should be 18.. else error :/)",pConsole);



	return;

}



//entry point

bool APIENTRY DllMain(HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)

{

	if(dwReason == DLL_PROCESS_ATTACH){

		GetModuleFileName(hModule, dlldir, 512);

		for(int i = strlen(dlldir); i > 0; i--) { if(dlldir[i] == '\') { dlldir[i+1] = 0; break; } }

		ofile.open(GetDirectoryFile("logophile.txt"), ios::app);

		add_log("n~ DLL attached!!n~ Mr. Novocain!n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~  ~~~~~");



		DisableThreadLibraryCalls(hModule);

		CreateThread(NULL, 0, (unsigned long(__stdcall*)(void*))MainThread, NULL, 0, NULL);

	}

	return true;

}//I know I'm not perfect but I'm pretty ****ing close. EoF. 

siggehs.h

 BYTE ConsoleSig[] = {0x5E,0xC2,0x04,0x00,0xCC,0xCC,0xA1,0xDD,0xDD,0xDD  ,0x00,0xC3,0xCC,0xCC};

DWORD ConsoleAddr = (FindAddress(ConsoleSig, 14) + 0x00000006); 

sigsearch.h

 DWORD dwBaseAddress = 0x00400000;

DWORD dwLength = 0x001C5000;



//function which checks if current offset is the sig

bool DataCompare(const BYTE* pData, const BYTE* bMask, int iLength)

{

	for (int i=0;i<iLength;i++){ //search the whole length

		if((pData[i] != bMask[i]) && (bMask[i] != 0xDD)) //if they don't match & the mask is not 0x99

			return false; //they are not equal, return false

	}

	return true; //they are equal, return true

}



//function to search for signature

DWORD FindAddress(BYTE *bMask,int iLength)

{

	for(DWORD i=0;i<(dwLength-iLength);i++) //while we're searching

		if( DataCompare( (BYTE*)( dwBaseAddress+i ),bMask,iLength) ) //compare bytes

			return (DWORD)(dwBaseAddress+i); //address found! return it

	return 0; //no address found, return nothing

} 

Archive with example contains workspace for Visual Studio 2003 .NET