View previous topic :: View next topic |
Author |
Message |
aeree Cheater Reputation: 3
Joined: 23 Jan 2010 Posts: 42 Location: Germany
|
Posted: Thu May 19, 2016 11:03 am Post subject: Injected DLL doesn't do anything in while loop |
|
|
I'm trying to get into DLL Injection and so far everything worked quite well.
But this is something really weird:
Code: |
#include <windows.h>
#include <string>
#include <sstream>
void RewriteValues();
BOOL WINAPI DllMain(HINSTANCE hinstDll,DWORD Reason,LPVOID Reserved){
switch(Reason){
case DLL_PROCESS_ATTACH:
MessageBox(NULL,"GL&HF","Thingy",0);
CreateThread(0,0,(LPTHREAD_START_ROUTINE)&RewriteValues,0,0,0);
break;
case DLL_PROCESS_DETACH:
MessageBox(NULL,"DLL Detached","Thingy",0);
break;
}
return TRUE;
}
void RewriteValues(){
DWORD *ptrHP;
ptrHP = (DWORD*)(0x400000 + 0x76F3B8);
ptrHP = (DWORD*)(*ptrHP + 0x438);
ptrHP = (DWORD*)(*ptrHP + 0x50C);
ptrHP = (DWORD*)(ptrHP + 0x540);
float *HP;
unsigned int *foo;
foo = (unsigned int*)0x10600;
HP = (float*)ptrHP;
MessageBox(0,(char*)ptrHP,"HP Address",0);
*foo = 1232121;
while(true)
{
*foo++;
if(GetAsyncKeyState(0x48))
{
*foo++;
*HP = 100;
while(GetAsyncKeyState(0x48))
{
Sleep(5);
}
}
}
*foo = 99999;
}
|
The Messageboxes appear as they should (except that the Address isn't
displayed) and foo is changed to 1232121 (checking 0x10600 with CE). But
once it hits the while loop foo just doesn't change at all and it also doesn't
change my HP. It doesn't skip the loop as foo doesn't get changed to 9999
so it just gets stuck there doing nothing.
Any ideas?
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 138
Joined: 06 Jul 2014 Posts: 4275
|
Posted: Thu May 19, 2016 11:53 am Post subject: |
|
|
The main executable isn't always guaranteed to be loaded at 0x400000, so it's good practice get the base address of that module some other way (e.g. GetModuleHandle).
Are you sure that pointer path is correct? From what I'm seeing, right now that pointer path is this:
Code: | address of HP = [[0x400000+0x76F3B8]+0x438]0x50C+0x540 |
Try dereferencing ptrHP again the last time you're traversing the pointer path: ptrHP = (DWORD*)(*ptrHP + 0x540);
_________________
I don't know where I'm going, but I'll figure it out when I get there. |
|
Back to top |
|
|
aeree Cheater Reputation: 3
Joined: 23 Jan 2010 Posts: 42 Location: Germany
|
Posted: Thu May 19, 2016 12:02 pm Post subject: |
|
|
ParkourPenguin wrote: | The main executable isn't always guaranteed to be
loaded at 0x400000, so it's good practice get the base address of that module some other way (e.g. GetModuleHandle).
Are you sure that pointer path is correct? From what I'm seeing, right now that pointer path is this:
Code: | address of HP = [[0x400000+0x76F3B8]+0x438]0x50C+0x540 |
Try dereferencing ptrHP again the last time you're traversing the pointer path: ptrHP = (DWORD*)(*ptrHP + 0x540); |
Thanks for replying and I didn't know that you could get the address that
way. But that's not really my main problem since foo doesn't work either. I
can change it's value before entering the loop but not inside :/
|
|
Back to top |
|
|
ParkourPenguin I post too much Reputation: 138
Joined: 06 Jul 2014 Posts: 4275
|
|
Back to top |
|
|
aeree Cheater Reputation: 3
Joined: 23 Jan 2010 Posts: 42 Location: Germany
|
Posted: Thu May 19, 2016 2:31 pm Post subject: |
|
|
ParkourPenguin wrote: | Oh, I see why now. See this webpage, section "Pointer arithmetics". |
YAS! You're right
A bit confusing and makes no sense to me but I guess I'll just have to get used to that :/
Anyway it works and that's whats all about.
This is what the loop looks like now and foo increases as it should. And the address for my HP is actually wrong
Code: |
*foo = 123;
DWORD poo = (DWORD)*foo;
while(true)
{
poo++;
*foo = poo;
/*
if(GetAsyncKeyState(0x48))
{
*HP = 100;
if(GetAsyncKeyState(0x48))
{
}
}
*/
}
|
|
|
Back to top |
|
|
|