From fd5ff1cbf38bc3bc3b2aae338f27fe29a8b77526 Mon Sep 17 00:00:00 2001 From: Nick Cano Date: Thu, 28 Jan 2016 09:36:34 -0800 Subject: [PATCH] git pid from window cleanup --- .../main-accessingMemory.cpp | 45 ++++++++++++------- Chapter7_CodeInjection/main-codeInjection.cpp | 14 +++--- .../Chapter7_CodeInjection_DLL.vcxproj | 3 ++ ...Chapter7_CodeInjection_DLL.vcxproj.filters | 5 +++ Chapter7_CodeInjection_DLL/dllmain.cpp | 15 +++---- GameHackingExamples.sln | 12 +++++ 6 files changed, 61 insertions(+), 33 deletions(-) diff --git a/Chapter6_AccessingMemory/main-accessingMemory.cpp b/Chapter6_AccessingMemory/main-accessingMemory.cpp index 4106c19..ef5edc6 100644 --- a/Chapter6_AccessingMemory/main-accessingMemory.cpp +++ b/Chapter6_AccessingMemory/main-accessingMemory.cpp @@ -3,21 +3,17 @@ #include -void printMyPid() +DWORD getPIDFromWindow(HWND window) { - wchar_t myTitle[1024]; - GetConsoleTitle(&myTitle[0], 1024); - - HWND myWindow = FindWindow(NULL, myTitle); - - DWORD pid; - GetWindowThreadProcessId(myWindow, &pid); - - printf("My pid is %d\n", pid); + DWORD PID; + GetWindowThreadProcessId(window, &PID); + return PID; } -void printExplorerPid() +DWORD getPIDByName(std::wstring name) { + DWORD PID = -1; + PROCESSENTRY32 entry; entry.dwSize = sizeof(PROCESSENTRY32); @@ -28,15 +24,16 @@ void printExplorerPid() while (Process32Next(snapshot, &entry) == TRUE) { std::wstring binaryPath = entry.szExeFile; - if (binaryPath.find(L"explorer.exe") != std::wstring::npos) + if (binaryPath.find(name) != std::wstring::npos) { - printf("Explorer's pid is %d\n", entry.th32ProcessID); + PID = entry.th32ProcessID; break; } } } CloseHandle(snapshot); + return PID; } template @@ -154,11 +151,27 @@ void printMyBaseAddresses(HANDLE Process) int main(void) { - HANDLE proc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, GetCurrentProcessId()); + HANDLE proc = OpenProcess( + PROCESS_VM_OPERATION | + PROCESS_VM_READ | + PROCESS_VM_WRITE | + PROCESS_CREATE_THREAD, + FALSE, GetCurrentProcessId()); printMyBaseAddresses(proc); - printMyPid(); - printExplorerPid(); + + // get my PID from window + wchar_t myTitle[1024]; + GetConsoleTitle(&myTitle[0], 1024); + HWND myWindow = FindWindow(NULL, myTitle); + + auto myPID = getPIDFromWindow(myWindow); + printf("My pid is %d\n", myPID); + + // get explorer PID by process name + auto explorerPID = getPIDByName(L"explorer.exe"); + printf("Explorer pid is %d\n", explorerPID); + // lets do some memory stuff.. to ourself DWORD someValue = 1234; diff --git a/Chapter7_CodeInjection/main-codeInjection.cpp b/Chapter7_CodeInjection/main-codeInjection.cpp index c824cc2..59c003e 100644 --- a/Chapter7_CodeInjection/main-codeInjection.cpp +++ b/Chapter7_CodeInjection/main-codeInjection.cpp @@ -70,7 +70,7 @@ DWORD GetProcessThreadID(HANDLE Process) -void injectCodeUsingThreadRedirection(HANDLE process, LPVOID func, int times, const char* string) +void injectCodeUsingThreadHijacking(HANDLE process, LPVOID func, int times, const char* string) { BYTE codeCave[31] = { 0x60, //PUSHAD @@ -113,7 +113,7 @@ void injectCodeUsingThreadRedirection(HANDLE process, LPVOID func, int times, co WriteProcessMemory(process, remoteCave, codeCave, sizeof(codeCave), NULL); - //redirect the thread + //hijack the thread threadContext.Eip = (DWORD)remoteCave; threadContext.ContextFlags = CONTEXT_CONTROL; SetThreadContext(thread, &threadContext); @@ -123,9 +123,9 @@ void injectCodeUsingThreadRedirection(HANDLE process, LPVOID func, int times, co CloseHandle(thread); } -DWORD WINAPI redirectionThread(LPVOID lpParam) +DWORD WINAPI hijackThread(LPVOID lpParam) { - injectCodeUsingThreadRedirection((HANDLE)lpParam, &printStringManyTimes, 2, "redirected\n"); + injectCodeUsingThreadHijacking((HANDLE)lpParam, &printStringManyTimes, 2, "hijacked\n"); return 1; } @@ -157,11 +157,11 @@ int main(void) // inject code into self using thread injection injectCodeUsingThreadInjection(proc, &printStringManyTimes, 2, "injected\n"); - // inject code into self using thread re-direction + // inject code into self using thread hijacking // we need to do it from a secondary thread or else - // the redirection code would redirect itself.. which + // the hijacking code would hijack itself.. which // doesn't work - CreateThread(NULL, 0, redirectionThread, proc, 0, NULL); + CreateThread(NULL, 0, hijackThread, proc, 0, NULL); LoadDll(proc, L"Chapter7_CodeInjection_DLL.dll"); diff --git a/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj b/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj index 3d2f4a5..aa6399f 100644 --- a/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj +++ b/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj @@ -10,6 +10,9 @@ Win32 + + + {37305F21-BB4B-4492-A713-DDD94653C16E} Win32Proj diff --git a/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj.filters b/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj.filters index d7ef6a1..537701c 100644 --- a/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj.filters +++ b/Chapter7_CodeInjection_DLL/Chapter7_CodeInjection_DLL.vcxproj.filters @@ -14,4 +14,9 @@ rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms + + + Source Files + + \ No newline at end of file diff --git a/Chapter7_CodeInjection_DLL/dllmain.cpp b/Chapter7_CodeInjection_DLL/dllmain.cpp index 7f02844..7453f57 100644 --- a/Chapter7_CodeInjection_DLL/dllmain.cpp +++ b/Chapter7_CodeInjection_DLL/dllmain.cpp @@ -1,10 +1,9 @@ #include -DWORD WINAPI nonTrivialSomething(LPVOID lpParam) -{ - - return 1; +DWORD WINAPI runBot(LPVOID lpParam) { + // run your bot + return 1; } @@ -17,12 +16,8 @@ BOOL APIENTRY DllMain( HMODULE hModule, { case DLL_PROCESS_ATTACH: MessageBoxA(NULL, "DLL Attached!\n", "Game Hacking", MB_OK | MB_TOPMOST); - CreateThread(NULL, 0, &nonTrivialSomething, NULL, 0, NULL); - break; - case DLL_PROCESS_DETACH: - MessageBoxA(NULL, "DLL Detached!\n", "Game Hacking", MB_OK | MB_TOPMOST); + CreateThread(NULL, 0, &runBot, NULL, 0, NULL); break; } return TRUE; -} - +} \ No newline at end of file diff --git a/GameHackingExamples.sln b/GameHackingExamples.sln index 6e6c327..9a6ca5a 100644 --- a/GameHackingExamples.sln +++ b/GameHackingExamples.sln @@ -21,6 +21,10 @@ Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Chapter8_Direct3DHook", "Ch EndProject Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Chapter10_ResponsiveHacks", "Chapter10_ResponsiveHacks\Chapter10_ResponsiveHacks.vcxproj", "{E28E3DC6-2614-43B9-83E4-86D6F9A585B1}" EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Chapter11_StateMachines", "Chapter11_StateMachines\Chapter11_StateMachines.vcxproj", "{F28D01D3-BDE9-4992-B3A9-9803D7294F05}" +EndProject +Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "Chapter11_SearchAlgorithms", "Chapter11_SearchAlgorithms\Chapter11_SearchAlgorithms.vcxproj", "{35470A34-CBB0-41D1-A54B-E1CF3DE9A3B7}" +EndProject Global GlobalSection(SolutionConfigurationPlatforms) = preSolution Debug|Win32 = Debug|Win32 @@ -67,6 +71,14 @@ Global {E28E3DC6-2614-43B9-83E4-86D6F9A585B1}.Debug|Win32.Build.0 = Debug|Win32 {E28E3DC6-2614-43B9-83E4-86D6F9A585B1}.Release|Win32.ActiveCfg = Release|Win32 {E28E3DC6-2614-43B9-83E4-86D6F9A585B1}.Release|Win32.Build.0 = Release|Win32 + {F28D01D3-BDE9-4992-B3A9-9803D7294F05}.Debug|Win32.ActiveCfg = Debug|Win32 + {F28D01D3-BDE9-4992-B3A9-9803D7294F05}.Debug|Win32.Build.0 = Debug|Win32 + {F28D01D3-BDE9-4992-B3A9-9803D7294F05}.Release|Win32.ActiveCfg = Release|Win32 + {F28D01D3-BDE9-4992-B3A9-9803D7294F05}.Release|Win32.Build.0 = Release|Win32 + {35470A34-CBB0-41D1-A54B-E1CF3DE9A3B7}.Debug|Win32.ActiveCfg = Debug|Win32 + {35470A34-CBB0-41D1-A54B-E1CF3DE9A3B7}.Debug|Win32.Build.0 = Debug|Win32 + {35470A34-CBB0-41D1-A54B-E1CF3DE9A3B7}.Release|Win32.ActiveCfg = Release|Win32 + {35470A34-CBB0-41D1-A54B-E1CF3DE9A3B7}.Release|Win32.Build.0 = Release|Win32 EndGlobalSection GlobalSection(SolutionProperties) = preSolution HideSolutionNode = FALSE