Basic memoty edit DLL

Hello ppl,

Becouse there are no good tutorials how to make a memory edit code:

Load first the libs we need:

Code:

//#include "stdafx.h" //for a pre file in visual studio remove //
#include <windows.h> //THe lib that we need

make the dll main:

Code:

BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved ) {
    DisableThreadLibraryCalls(hDll);
    
	/*Succesfoll attach*/
    if ( dwReason == DLL_PROCESS_ATTACH ) {
        MessageBoxA(0,"Test injection","test", 0); //Shows a msg so I know that the DLL is injected
		CreateThread(0,0,(LPTHREAD_START_ROUTINE)loadddd,0,0,0);
    }

    return true;
}

Look at my other tuts how to make you own. I use loadddd to look if cshell is loaded. This one is called in the main of the DLL:

Code:

DWORD WINAPI loadddd(LPVOID) {
	while(GetModuleHandleA("CShell.dll") == NULL) { //Looks of CShell is loaded
		Sleep(150); //if It is not loaded sleep for 150 ms
	}

	Sleep(100); //let the proccesor wait for a sec, else if cshell is loaded you are doing changes in 0 ms... Maby it can be buggy

	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)leukstedeel, NULL, NULL, NULL); //load the hack part
    return 0;
}

Make you hack part:

Code:

DWORD WINAPI leukstedeel(LPVOID) { //the hack thread

	//This will add a "switch" so I can test if the GetAsyncKeyState still works
	bool testswitch = false;

	//Cshell, we need it for mem edeting.. Becouse here are the addies located? I think?
	DWORD shell = (DWORD)GetModuleHandleA("CShell.dll"); //Cshell handel
	PDWORD rec = (PDWORD)(shell+0x000000); //addie to somting in cshell. Maby to a class :p
   
	//In a whil loop so we know that it will be runnig for ever. Or on a return false or break it will quite....
    while(true) {

		//Now we are going to enable and disable hacks
		if(GetAsyncKeyState(VK_NUMPAD0) &1) {
			testswitch = !testswitch;
		}

		//No reaload example
		if(testswitch) {
			//Do the memory edeting
		}

		Sleep(100);
    }
	return true;
}

Every thing is basic, i'm going to explane the hack part a littel bit more.

Code:

bool testswitch = false;

This is a bool that you can enable and disable with a short key, if the bool is true then do the hack.

Code:

	DWORD shell = (DWORD)GetModuleHandleA("CShell.dll"); //Cshell handel
	PDWORD rec = (PDWORD)(shell+0x000000); //addie to somting in cshell. Maby to a class :p

shell is a handel to cshell, and google PDWORD if you want to know what that is.

Code:

while(true) {

Just a loop

Code:

		if(GetAsyncKeyState(VK_NUMPAD0) &1) {
			testswitch = !testswitch;
		}

To enable and disable testswitch.

Code:

		if(testswitch) {
			//Do the memory edeting
		}

Look if the testswitch is true, then do the hack.

Code:

Sleep(100);

To spare the cpu, and if you did't do this you need to be very past to enable or disable a hack.

Full code

Code:

//#include "stdafx.h"
#include <windows.h> //THe lib that we need

DWORD WINAPI leukstedeel(LPVOID) { //the hack thread

	//This will add a "switch" so I can test if the GetAsyncKeyState still works
	bool testswitch = false;

	//Cshell, we need it for mem edeting.. Becouse here are the addies located? I think?
	DWORD shell = (DWORD)GetModuleHandleA("CShell.dll"); //Cshell handel
	PDWORD rec = (PDWORD)(shell+0x000000); //addie to somting in cshell. Maby to a class :p
   
	//In a whil loop so we know that it will be runnig for ever. Or on a return false or break it will quite....
    while(true) {

		//Now we are going to enable and disable hacks
		if(GetAsyncKeyState(VK_NUMPAD0) &1) {
			testswitch = !testswitch;
		}

		//No reaload example
		if(testswitch) {
			//Do the memory edeting
		}

		Sleep(100);
    }
	return true;
}

DWORD WINAPI loadddd(LPVOID) {
	while(GetModuleHandleA("CShell.dll") == NULL) { //Looks of CShell is loaded
		Sleep(150); //if It is not loaded sleep for 150 ms
	}

	Sleep(100); //let the proccesor wait for a sec, else if cshell is loaded you are doing changes in 0 ms... Maby it can be buggy

	CreateThread(NULL, NULL, (LPTHREAD_START_ROUTINE)leukstedeel, NULL, NULL, NULL); //load the hack part
    return 0;
}

BOOL WINAPI DllMain ( HMODULE hDll, DWORD dwReason, LPVOID lpReserved ) {
    DisableThreadLibraryCalls(hDll);
    
	/*Succesfoll attach*/
    if ( dwReason == DLL_PROCESS_ATTACH ) {
        MessageBoxA(0,"Test injection","test", 0); //Shows a msg so I know that the DLL is injected
		CreateThread(0,0,(LPTHREAD_START_ROUTINE)loadddd,0,0,0);
    }

    return true;
}

What do you need more?

A anti memory edit bypass, so that you can use this. You can load crossfire in olly dbg if you rename the olly procces and use for exaple advancedolly.

Gl, I hope some one can help me with the bypass becouse I'm not very good in olly (a). I need to learn asm.

Edit:
Yes I made this...

Basic memoty edit DLL

Post a Reply

Tags for this Thread