Guest User

Untitled

a guest
Jan 19th, 2018
94
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 5.78 KB | None | 0 0
  1. ## MemoryAddress - Base abstract class
  2. using System;
  3. using System.Collections.Generic;
  4. using System.Linq;
  5. using System.Text;
  6. using System.Diagnostics;
  7.  
  8. namespace ParseCT
  9. {
  10. public abstract class MemoryAddress
  11. {
  12. public IntPtr Address { get; protected set; }
  13. public IntPtr BaseAddress { get; protected set; }
  14. public Object Tag { get; set; }
  15. public String Description {get; set;}
  16. public IntPtr hProcess { get; protected set; }
  17.  
  18. protected bool CloseProcess = false;
  19. protected Process Proc = null;
  20.  
  21. public abstract void Calculate();
  22. public bool Read(byte[] buffer)
  23. {
  24. if (Address == null || Address == IntPtr.Zero)
  25. {
  26. throw new Exception("Address not properly initilized");
  27. }
  28. int outf;
  29. return WinAPI.ReadProcessMemory(hProcess, Address, buffer, buffer.Length, out outf);
  30. }
  31. public bool Write(byte[] data)
  32. {
  33. if (Address == null || Address == IntPtr.Zero)
  34. {
  35. throw new Exception("Address not properly initilized");
  36. }
  37. int outf;
  38. return WinAPI.WriteProcessMemory(hProcess, Address, data, (uint)data.Length, out outf);
  39. }
  40. }
  41. }
  42.  
  43. ##BasicAddress - Basic address
  44. using System;
  45. using System.Collections.Generic;
  46. using System.Linq;
  47. using System.Text;
  48. using System.Diagnostics;
  49.  
  50. namespace ParseCT
  51. {
  52. class BasicAddress : MemoryAddress
  53. {
  54. private bool Recalculate = true;
  55.  
  56. public BasicAddress(IntPtr BaseAddress, IntPtr hProcess, Process p, bool Recalc = true)
  57. {
  58. this.Recalculate = Recalc;
  59. this.hProcess = hProcess;
  60. this.Proc = p;
  61. this.BaseAddress = BaseAddress;
  62. Calculate();
  63. }
  64.  
  65. public BasicAddress(IntPtr BaseAddress, Process p, bool Recalc = true)
  66. {
  67. this.Recalculate = Recalc;
  68. this.Proc = p;
  69. this.BaseAddress = BaseAddress;
  70. this.CloseProcess = true;
  71. this.hProcess = WinAPI.OpenProcess(WinAPI.ProcessAccess.VMRead | WinAPI.ProcessAccess.VMWrite, false, (uint)p.Id);
  72. if (this.hProcess == IntPtr.Zero)
  73. {
  74. throw new Exception("Error opening process");
  75. }
  76. Calculate();
  77. }
  78.  
  79. public override void Calculate()
  80. {
  81. if (this.Recalculate)
  82. {
  83. this.Address = new IntPtr(this.Proc.MainModule.BaseAddress.ToInt64() + this.BaseAddress.ToInt64());
  84. }
  85. else
  86. {
  87. this.Address = BaseAddress;
  88. }
  89. }
  90. }
  91. }
  92.  
  93. ##Pointer Address - Pass it an address and a list of offsets, it will find the end address
  94. using System;
  95. using System.Collections.Generic;
  96. using System.Linq;
  97. using System.Text;
  98. using System.Diagnostics;
  99.  
  100. namespace ParseCT
  101. {
  102. public class PointerAddress : MemoryAddress
  103. {
  104. public PointerAddress(IntPtr BaseAddress, List<int> Offsets, IntPtr hProcess, Process p)
  105. {
  106. this.hProcess = hProcess;
  107. this.Proc = p;
  108. this.BaseAddress = BaseAddress;
  109. Calculate(Offsets);
  110. }
  111.  
  112. public void Calculate(List<int> Offsets)
  113. {
  114. BasicAddress addr = new BasicAddress(BaseAddress, hProcess, Proc);
  115. byte[] ptr = new byte[4];
  116. int a = 0;
  117. for (int i = 0; i < Offsets.Count; i++)
  118. {
  119. if (addr.Read(ptr))
  120. {
  121. a = BitConverter.ToInt32(ptr, 0) + Offsets[i];
  122. addr = new BasicAddress(new IntPtr(a), hProcess, Proc, false);
  123. }
  124. else
  125. {
  126. throw new Exception("Could not read memory from base pointer");
  127. }
  128. }
  129. this.Address = new IntPtr(a);
  130. }
  131.  
  132. public override void Calculate()
  133. {
  134. Calculate(new List<int>(new int[] { 0 }));
  135. }
  136. }
  137. }
  138.  
  139. ##Test program
  140. using System;
  141. using System.Collections.Generic;
  142. using System.Linq;
  143. using System.Text;
  144. using System.IO;
  145. using System.Threading;
  146. using System.Diagnostics;
  147.  
  148. namespace ParseCT
  149. {
  150. class Program
  151. {
  152. static void Main(string[] args)
  153. {
  154.  
  155. Process[] ps = null;
  156. do
  157. {
  158. if (ps == null)
  159. {
  160. Console.WriteLine("Waiting for CO GameClient");
  161. }
  162. ps = Process.GetProcessesByName("GameClient");
  163. if (ps.Length == 0)
  164. {
  165. Thread.Sleep(250);
  166. }
  167. } while (ps.Length == 0);
  168.  
  169. IntPtr hProcess = WinAPI.OpenProcess(WinAPI.ProcessAccess.VMRead | WinAPI.ProcessAccess.VMWrite, false, (uint)ps[0].Id);
  170. if (hProcess != IntPtr.Zero)
  171. {
  172. Console.WriteLine("GameClient Process Accessed");
  173. BasicAddress ba = new BasicAddress(new IntPtr(0x1AA7174), hProcess, ps[0]);
  174. Console.WriteLine("Target address: {0:X}", ba.Address.ToInt32());
  175.  
  176. PointerAddress pa = new PointerAddress(new IntPtr(0x006EE218), new List<int>(new int[] { 0x30 }), hProcess, ps[0]);
  177. Console.WriteLine("Found address: {0:X}", pa.Address.ToInt32());
  178.  
  179. PointerAddress pa2 = new PointerAddress(new IntPtr(0x01D17800), new List<int>(new int[] { 0x6BC, 0x28C, 0x43C, 0x684, 0xD8 }), hProcess, ps[0]);
  180. Console.WriteLine("Found address: {0:X}", pa2.Address.ToInt32());
  181. }
  182. WinAPI.CloseHandle(hProcess);
  183.  
  184. Console.Read();
  185. }
  186. }
  187. }
Add Comment
Please, Sign In to add comment