
Originally Posted by
Renamon Toast Crunch
..
Yes, the windows api WriteProcessMemory() (
after you get a valid handle from OpenProcess())
The 2 instructions will be different by only one byte.
So to "change" the instruction, you just have to overwrite the correct byte into the instruction. Probably the first byte of it..
so, I didn't look up the actual bytecodes but pretend
00463279 DEC DWORD PTR DS:[ESI] = 8B 2A
00463279 INC DWORD PTR DS:[ESI] = 44 2A
So to change it from dec to inc, write the byte 0x44 to the address 00463279. Replacing the first byte. Just an example. Look up the actual byte codes.
edit: There are several public memory libraries floating around mpgh; maybe even one in c#. (I wrote 2 tuts. about it in the vb.net section. A lot of the background information is the same. Code is 99% the same also)
edit2: It's not always the front byte that is changed...here are 3 example. Spot the byte that changes?
MOV
:Health:
0042CA7E (Working on this one, i dont know what MOV is)
MOV is like the equal sign; used to assign/move a value.
The format is:
MOV destination, source
mov eax, 14 ;// set eax to 14
...
mov eax, ecx ;// set eax to whatever ecx is currently
^^there are rules about what the destination and source can be: a register, a memory location, or a numeric constant. Read assembly tut. to know more.