-
Notifications
You must be signed in to change notification settings - Fork 2
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
ProcManager Class to edit memory of a process
- Loading branch information
faceslog
committed
Apr 20, 2021
1 parent
21650d3
commit 5057aa8
Showing
5 changed files
with
161 additions
and
5 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,92 @@ | ||
| #include "ProcManager.h" | ||
|
|
||
| // Process ID is a DWORD type in Windows API | ||
| DWORD ProcManager::GetProcId(const wchar_t* procName) | ||
| { | ||
| DWORD procId = 0; | ||
| // Snapshot of the processes | ||
| HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); | ||
|
|
||
| // When it does not fail | ||
| if (hSnap != INVALID_HANDLE_VALUE) | ||
| { | ||
| PROCESSENTRY32 procEntry; | ||
| procEntry.dwSize = sizeof(procEntry); | ||
|
|
||
| if (Process32First(hSnap, &procEntry)) | ||
| { | ||
| do | ||
| { | ||
| if (!_wcsicmp(procEntry.szExeFile, procName)) | ||
| { | ||
| procId = procEntry.th32ProcessID; | ||
| break; | ||
| } | ||
|
|
||
| } while (Process32Next(hSnap, &procEntry)); | ||
| } | ||
| } | ||
|
|
||
| CloseHandle(hSnap); | ||
| return procId; | ||
| } | ||
|
|
||
| uintptr_t ProcManager::GetModuleBaseAddress(DWORD procId, const wchar_t* modNamme) | ||
| { | ||
| uintptr_t modBaseAdrr = 0; | ||
| HANDLE hSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE | TH32CS_SNAPMODULE32, procId); | ||
|
|
||
| if (hSnap != INVALID_HANDLE_VALUE) | ||
| { | ||
| MODULEENTRY32 modEntry; | ||
| modEntry.dwSize = sizeof(modEntry); | ||
|
|
||
| if (Module32First(hSnap, &modEntry)) | ||
| { | ||
| do | ||
| { | ||
| if (!_wcsicmp(modEntry.szModule, modNamme)) | ||
| { | ||
| modBaseAdrr = (uintptr_t)modEntry.modBaseAddr; | ||
| break; | ||
| } | ||
|
|
||
| } while (Module32Next(hSnap, &modEntry)); | ||
| } | ||
| } | ||
|
|
||
| CloseHandle(hSnap); | ||
| return modBaseAdrr; | ||
| } | ||
|
|
||
| // Find Dynamic Memory Allocation | ||
| uintptr_t ProcManager::FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets) | ||
| { | ||
| uintptr_t addr = ptr; | ||
|
|
||
| for (auto const& curr_off : offsets) | ||
| { | ||
| ReadProcessMemory(hProc, (BYTE*)addr, &addr, sizeof(addr), 0); | ||
| addr += curr_off; | ||
| } | ||
|
|
||
| return addr; | ||
| } | ||
|
|
||
| ProcManager::ProcManager(const wchar_t* target_process_name) | ||
| { | ||
| this->procId = GetProcId(target_process_name); | ||
| this->moduleBase = GetModuleBaseAddress(procId, target_process_name); | ||
| this->hProcess = OpenProcess(PROCESS_ALL_ACCESS, NULL, procId); | ||
| } | ||
|
|
||
| uintptr_t ProcManager::GetDynamicBaseAddress(const unsigned int& relative_offset) | ||
| { | ||
| return moduleBase + relative_offset; | ||
| } | ||
|
|
||
| uintptr_t ProcManager::GetResolvedPointerChain(const unsigned int& relative_offset, std::vector<unsigned int> offsets) | ||
| { | ||
| return FindDMAAddy(hProcess, GetDynamicBaseAddress(relative_offset), offsets); | ||
| } | ||
|
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,56 @@ | ||
| #pragma once | ||
|
|
||
| #include <vector> | ||
| #include <Windows.h> | ||
| #include <TlHelp32.h> | ||
|
|
||
| class ProcManager | ||
| { | ||
|
|
||
| public: | ||
|
|
||
| static DWORD GetProcId(const wchar_t* procName); | ||
| static uintptr_t GetModuleBaseAddress(DWORD procID, const wchar_t* modNamme); | ||
| static uintptr_t FindDMAAddy(HANDLE hProc, uintptr_t ptr, std::vector<unsigned int> offsets); | ||
|
|
||
| ProcManager(const wchar_t* target_process_name); | ||
| // Resolve base address of the pointer chain | ||
| uintptr_t GetDynamicBaseAddress(const unsigned int& relative_offset); | ||
| // Resolve our pointer chain from offsets | ||
| uintptr_t GetResolvedPointerChain(const unsigned int& relative_offset, std::vector<unsigned int> offsets); | ||
|
|
||
| // Read a Process Memory value | ||
| template<typename T> | ||
| void ReadValueFromMemory(T& value, uintptr_t address) | ||
| { | ||
| ReadProcessMemory(hProcess, (BYTE*)address, &value, sizeof(value), nullptr); | ||
| } | ||
|
|
||
| // Read a Process Memory value Redefinition using offsets is gonna call Get Resolved Pointer Chain | ||
| template<typename T> | ||
| void ReadValueFromMemory(T& value, const unsigned int& relative_offset, std::vector<unsigned int> offsets) | ||
| { | ||
| uintptr_t address = GetResolvedPointerChain(relative_offset, offsets); | ||
| ReadProcessMemory(hProcess, (BYTE*)address, &value, sizeof(value), nullptr); | ||
| } | ||
|
|
||
| // Write to a Process Memory Address | ||
| template<typename T> | ||
| void WriteValueToMemory(T& value, uintptr_t address) | ||
| { | ||
| WriteProcessMemory(hProcess, (BYTE*)address, &value, sizeof(value), nullptr); | ||
| } | ||
|
|
||
| // Write to a Process Memory Address Redefinition using offsets is gonna call Get Resolved Pointer Chain | ||
| template<typename T> | ||
| void WriteValueToMemory(T& value, const unsigned int& relative_offset, std::vector<unsigned int> offsets) | ||
| { | ||
| uintptr_t address = GetResolvedPointerChain(relative_offset, offsets); | ||
| WriteProcessMemory(hProcess, (BYTE*)address, &value, sizeof(value), nullptr); | ||
| } | ||
|
|
||
| private: | ||
| DWORD procId; | ||
| HANDLE hProcess; | ||
| uintptr_t moduleBase; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters