Advertisement
cos8o

changeStringSize

Oct 13th, 2017
80
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <windows.h>
  2. #include <iostream>
  3. #include <TlHelp32.h>
  4. #include <tchar.h>
  5.  
  6. //this program redirect the twitter button func from twitter to google
  7.  
  8. DWORD dwGetModuleBaseAddress(DWORD dwProcessIdentifier, TCHAR *lpszModuleName)
  9. {
  10.     HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessIdentifier);
  11.     DWORD dwModuleBaseAddress = 0;
  12.     if (hSnapshot != INVALID_HANDLE_VALUE)
  13.     {
  14.         MODULEENTRY32 ModuleEntry32 = { 0 };
  15.         ModuleEntry32.dwSize = sizeof(MODULEENTRY32);
  16.         if (Module32First(hSnapshot, &ModuleEntry32))
  17.         {
  18.             do
  19.             {
  20.                 if (_tcscmp(ModuleEntry32.szModule, lpszModuleName) == 0)
  21.                 {
  22.                     dwModuleBaseAddress = (DWORD)ModuleEntry32.modBaseAddr;
  23.                     break;
  24.                 }
  25.             } while (Module32Next(hSnapshot, &ModuleEntry32));
  26.         }
  27.         CloseHandle(hSnapshot);
  28.     }
  29.     return dwModuleBaseAddress;
  30. }
  31.  
  32. int main()
  33. {
  34.     HWND hWnd = FindWindowA(0, "Geometry Dash");
  35.  
  36.     while (hWnd == NULL)
  37.     {
  38.         std::cout << "Waiting for GD..." << std::endl;
  39.         hWnd = FindWindowA(0, "Geometry Dash");
  40.         Sleep(250);
  41.         system("cls");
  42.     }
  43.  
  44.     DWORD pId;
  45.     GetWindowThreadProcessId(hWnd, &pId);
  46.     HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, 0, pId);
  47.  
  48.     if (hProc == NULL)
  49.     {
  50.         std::cout << "Failed to open gd's handle. Please, retry running this program with higher privileges." << std::endl;
  51.         system("pause>nul");
  52.         return -1;
  53.     }
  54.  
  55.     DWORD bAddr = dwGetModuleBaseAddress(pId, L"GeometryDash.exe");
  56.  
  57.     byte buffer[] = "https://www.google.com/search?q="; //our custom string
  58.  
  59.     DWORD addressOfString = (DWORD)VirtualAllocEx(hProc, NULL, sizeof(buffer), MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); //allocate space
  60.     WriteProcessMemory(hProc, (LPVOID)addressOfString, buffer, sizeof(buffer), NULL); //write custom string to space
  61.  
  62.     DWORD old, backup;
  63.     VirtualProtectEx(hProc, (LPVOID)(bAddr + 0x213068), 6, PAGE_EXECUTE_READWRITE, &old); //change protection
  64.     WriteProcessMemory(hProc, (LPVOID)(bAddr + 0x213068), new byte{ 0x20 }, 1, NULL); //change string length to 32 (no null byte)
  65.     WriteProcessMemory(hProc, (LPVOID)(bAddr + 0x213068 + 0x2), &addressOfString, 4, NULL); //change address of pushed string
  66.     VirtualProtectEx(hProc, (LPVOID)(bAddr + 0x213068), 6, old, &backup); //change protection back
  67.  
  68.     CloseHandle(hProc);
  69.  
  70.     std::cout << "Hack applied." << std::endl;
  71.     system("pause");
  72.     return 0;
  73. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement