Advertisement
StefanWilkinson

Untitled

Jan 18th, 2020
82
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 1.39 KB | None | 0 0
  1. #include "driver.h"
  2. #include <iostream>
  3. #include <TlHelp32.h>
  4.  
  5. std::uint32_t find_process_by_id(const std::string& name)
  6. {
  7.     const auto snap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  8.     if (snap == INVALID_HANDLE_VALUE) {
  9.         return 0;
  10.     }
  11.  
  12.     PROCESSENTRY32 proc_entry{};
  13.     proc_entry.dwSize = sizeof proc_entry;
  14.  
  15.     auto found_process = false;
  16.     if (!!Process32First(snap, &proc_entry)) {
  17.         do {
  18.             if (name == proc_entry.szExeFile) {
  19.                 found_process = true;
  20.                 break;
  21.             }
  22.         } while (!!Process32Next(snap, &proc_entry));
  23.     }
  24.  
  25.     CloseHandle(snap);
  26.     return found_process
  27.         ? proc_entry.th32ProcessID
  28.         : 0;
  29. }
  30.  
  31. void example()
  32. {
  33.     const auto connection = driver::connect();
  34.     if (connection == INVALID_SOCKET)
  35.     {
  36.         std::cout << "Connection failed.\n";
  37.         return;
  38.     }
  39.  
  40.     // Cheat stuff
  41.     const auto pid = find_process_by_id("notepad.exe");
  42.     std::printf("Process id: %p.\n", pid);
  43.  
  44.     const auto base_address = driver::get_process_base_address(connection, pid);
  45.     std::printf("Process base address: %p.\n", (void*)base_address);
  46.  
  47.     const auto dos_magic = driver::read<uint16_t>(connection, pid, base_address);
  48.     std::printf("DOS signature: %X.\n", dos_magic);
  49.  
  50.     driver::readtype>(connection, pid, address)
  51.  
  52.     driver::write<type>(connection, pid, address, size)
  53.  
  54.     driver::disconnect(connection);
  55. }
  56.  
  57. int main()
  58. {
  59.     driver::initialize();
  60.  
  61.     example();
  62.  
  63.     driver::deinitialize();
  64. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement