Spider Patch

// SpiderPatch.cpp : Defines the entry point for the console application.
//

#include "stdafx.h"

UCHAR InjCode[] = { 0x50, 0x41, 0x8B, 0x43, 0x14, 0x83, 0xE8, 0x05, 0x41, 0x89, 0x43, 0x14, 0x48, 0x8B, 0xCE, 0x58, 0x41, 0xFF, 0x4B, 0x14, 0x48, 0x8B, 0xCE, 0x90, 0x90, 0x90, 0x90, 0x90 };
UCHAR PointsSignature[] = { 0x41, 0xFF, 0x4B, 0x14, 0x48, 0x8B, 0xCE, 0xE8, 0xDA, 0x1B, 0x00, 0x00 };

VOID MakeJump( int from, int to, CHAR* jmpbytes )
{
    jmpbytes[0] = 0xE9;

    *(int*)(jmpbytes + 1) = to - from - 5;
}

CHAR* FindSignature( CHAR* dwStart, CHAR* dwEnd, UCHAR* szSignature, DWORD dwSize )
{
    do
    {
        if( memcmp( reinterpret_cast< void* >( dwStart ), szSignature, dwSize ) == NULL )
        {
            return dwStart;
        }
    } while( ++dwStart < dwEnd - dwSize );

    return ( CHAR* ) -1;
}

BOOL FindProcessByName( TCHAR* ProcessName, PROCESSENTRY32* processEntry )
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, NULL );

    if( Process32First( hSnapshot, processEntry ) )
    {
        do
        {
            if( !_tcscmp( processEntry->szExeFile, ProcessName ) )
            {
                CloseHandle( hSnapshot );
                return TRUE;
            }
        } while ( Process32Next( hSnapshot, processEntry ) );
    }

    CloseHandle( hSnapshot );
    return FALSE;
}

BOOL FindModuleByName( TCHAR* ModuleName, MODULEENTRY32* moduleEntry, DWORD dwProcessId )
{
    HANDLE hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, dwProcessId );

    if( hSnapshot == INVALID_HANDLE_VALUE )
    {
        std::wcout << L"Something went wrong with ToolHelp func. Code: " << GetLastError( ) << L"\n";
        return FALSE;
    }

    if( Module32First( hSnapshot, moduleEntry ) )
    {
        do
        {
            std::wcout << moduleEntry->szModule << L"\n";

            if( !_tcscmp( moduleEntry->szModule, ModuleName ) )
            {
                return TRUE;
            }
        } while( Module32Next( hSnapshot, moduleEntry ) );
    }
    else
    {
        std::wcout << L"Could not find first module. " <<  GetLastError() << "\n";
    }

    CloseHandle( hSnapshot );
    return FALSE;
}


int _tmain(int argc, _TCHAR* argv[])
{
    TCHAR* szProcessName = _T( "SpiderSolitaire.exe" );
    PROCESSENTRY32 *pProcessEntry = new PROCESSENTRY32;

    pProcessEntry->dwSize = sizeof( PROCESSENTRY32 );


    if( FindProcessByName( szProcessName, pProcessEntry ) )
    {
        MODULEENTRY32* moduleEntry = new MODULEENTRY32;

        moduleEntry->dwSize = sizeof( MODULEENTRY32 );

        if( FindModuleByName( szProcessName, moduleEntry, pProcessEntry->th32ProcessID ) )
        {
            HANDLE hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pProcessEntry->th32ProcessID );

            CHAR* ucModule = new CHAR[ moduleEntry->modBaseSize ];

            if( ReadProcessMemory( hProcess, moduleEntry->modBaseAddr, ucModule, moduleEntry->modBaseSize, NULL ) )
            {
                CHAR* cOffset = (CHAR*)(moduleEntry->modBaseAddr + (DWORD)FindSignature( ucModule, ucModule + moduleEntry->modBaseSize, PointsSignature, sizeof( PointsSignature ) ) - (DWORD)ucModule );

                if( ( DWORD )cOffset != -1 )
                {
                    CHAR* cFuncAddress = (CHAR*)VirtualAllocEx( hProcess, NULL, sizeof( InjCode ) + 5, MEM_COMMIT, PAGE_READWRITE );
                    CHAR cJmpCode[5];

                    MakeJump( (DWORD) cFuncAddress + sizeof( InjCode ) - sizeof( cJmpCode ), (DWORD) cOffset, cJmpCode );

                    memcpy_s( InjCode + sizeof( InjCode ) - 5, 5, cJmpCode, 5 );

                    if( WriteProcessMemory( hProcess, cFuncAddress, InjCode, sizeof( InjCode ), NULL ) )
                    {
                        CHAR cJmpToFunc[5];

                        MakeJump( (DWORD) cOffset, (DWORD) cFuncAddress, cJmpToFunc );

                        if( WriteProcessMemory( hProcess, cOffset, cJmpToFunc, sizeof( cJmpToFunc ), NULL ) )
                        {
                            std::cout << "Memory patched!\n";
                        }
                    }
                    else
                    {
                        std::cout << "Could not write function to a process!\n";
                    }
                }
                else
                {
                    std::cout << "Could not find offset. Ask author to update this programm.\n";
                }
            }

            delete [] ucModule;
            CloseHandle( hProcess );
        }

        getchar();
    }

    return 0;
}