ProcessModder.cpp

#include "ProcessModder.h"
#include <AclAPI.h> // For modifying process security settings
#include <TlHelp32.h> // For examining currently open processes

bool ProcessModder::openWithProcessID(DWORD processID)
{
	if ( isOpen() )
		close();

	return Hook(processID);
}

bool ProcessModder::openWithProcessName(const char* szProcessName)
{
	if ( isOpen() )
		close();

	DWORD processID;

	return	  FindProcess(szProcessName, processID)
		   && Hook(processID);
}

bool ProcessModder::openWithWindowName(const char* szWindowName)
{
	if ( isOpen() )
		close();

	DWORD processID;

	HWND hWindow = FindWindow(NULL, szWindowName);

	return	  GetWindowThreadProcessId(hWindow, &processID)
		   && Hook(processID);
}

bool ProcessModder::openWithProcessHandle(HANDLE hProcess)
{
	if ( isOpen() )
		close();

	DWORD processID = GetProcessId(hProcess);

	return	  processID != 0
		   && Hook(processID);
}

bool ProcessModder::isOpen()
{
	DWORD lpExitCode;

	return	  hookedProcess != NULL
		   && GetExitCodeProcess(hookedProcess, &lpExitCode)
		   && lpExitCode == STILL_ACTIVE;
}

void ProcessModder::close()
{
	if ( isOpen() )
	{
		CloseHandle(hookedProcess);
		hookedProcess = NULL;
	}
}

template <typename valueType> // Allow writing to different data types
bool ProcessModder::writeMem(UINT address, valueType value)
{
	return WriteProcessMemory(hookedProcess, (LPVOID)address, &value, sizeof(valueType), NULL) == TRUE;
}
template bool ProcessModder::writeMem<UINT>(UINT address, UINT value); // Explicit instantiations
template bool ProcessModder::writeMem<USHORT>(UINT address, USHORT value);
template bool ProcessModder::writeMem<BYTE>(UINT address, BYTE value);

template <typename valueType> // Allow reading from different data types
bool ProcessModder::readMem(UINT address, valueType &value)
{
	if ( ReadProcessMemory(hookedProcess, (LPCVOID)address, &value, sizeof(valueType), NULL) )
		return true;
	else
	{
		value = 0; // Ensure value is initialized for safety
		return false;
	}
}
template bool ProcessModder::readMem<UINT>(UINT address, UINT &value); // Explicit instantiations
template bool ProcessModder::readMem<USHORT>(UINT address, USHORT &value);
template bool ProcessModder::readMem<BYTE>(UINT address, BYTE &value);

bool ProcessModder::Hook(DWORD processID)
{

	HANDLE pHandle = OpenProcess(WRITE_DAC, false, processID); // Open process with DACL access
	if ( pHandle == NULL )
		return false; // Could not open process with DACL access

	PSECURITY_DESCRIPTOR secdesc; // Placeholder (required)
	PACL dacl = NULL; // Pointer to access information (ie: whether you can read the process's memory)

	HANDLE pCurr = GetCurrentProcess();
	if (	( GetSecurityInfo(pCurr, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION,	// Get the security information for this process
							  NULL, NULL, &dacl, NULL, &secdesc) == ERROR_SUCCESS )
		 && ( SetSecurityInfo(pHandle, SE_KERNEL_OBJECT, DACL_SECURITY_INFORMATION | UNPROTECTED_DACL_SECURITY_INFORMATION,
							  NULL, NULL, dacl, NULL) == ERROR_SUCCESS ) ) // Replace the target process's security information with this process's security information
	{
		CloseHandle(pHandle); // Close the process handle with DACL access
		LocalFree(secdesc); // Free the placeholder
		hookedProcess = OpenProcess(PROCESS_ALL_ACCESS, false, processID); // Open process with full access
		if ( hookedProcess == NULL )
			hookedProcess = OpenProcess(PROCESS_ALL_LEGACY_ACCESS, false, processID); // Retry with access compatible with legacy operating systems

		return hookedProcess != NULL; // Return true if successfully opened
	}

	CloseHandle(pHandle); // Close the process handle with DACL access
	LocalFree(secdesc); // Free the placeholder
	return false; // Could not replace security information
}

bool ProcessModder::FindProcess(const char* szProcessName, DWORD &processID)
{
	HANDLE hProcessSnap = NULL;
	PROCESSENTRY32 pe32 = { }; // Holds information about a process
	pe32.dwSize = sizeof(PROCESSENTRY32);

	hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); // Get list of running processes
	if ( hProcessSnap != INVALID_HANDLE_VALUE ) // Got list successfully
	{
		if ( Process32First(hProcessSnap, &pe32) ) // If you can get information about the first process
		{
			do // Step through processes
			{
				if ( strcmp(szProcessName, pe32.szExeFile) == 0 ) // If process name is the name you're searching for
				{
					processID = pe32.th32ProcessID; // Set returned process ID value
					CloseHandle(hProcessSnap); // Cleanup process list
					return true;
				}
			} while ( Process32Next(hProcessSnap, &pe32) ); // While there's more processes
		}

		CloseHandle(hProcessSnap); // Cleanup process list
	}

	return false;
}