Patching A Processes Memory Without Injecting

Small Tutorial On Patching A Processes Memory Without Injecting A Dll:

Code:

ReadProcessMemory(
hProcess, // handle to the process which you want to patch
(void*)0xOffsetHere, // offset to the function you want to read
(void*)Pointer, // pointer to get the function offset e.g. origin function
4, // size to read most of the time this is 4 or 6 the sizeof(DWORD)
0 ); // number bytes read not really needed

This code is used to read the function out the memory and save the offset so we can call it later.
It is really not needed cause you can make a pointer directly if you like.

Code:

// Typedef Calling
typedef int ( *FuncPtr ) ( void );
FuncPtr Org_Pointer = ( FuncPtr ) ( 0xOffsetHere );
// Nows hold the original function
Org_Pointer( );
// So calling from the hooked is easy which so it doesn't crash the process

// Indirect Calling
DWORD * dwPointer = ( DWORD* ) ( 0xOffsetHere );
DWORD dwOrg_Pointer = NULL;
// Set dwOrg_Pointer as a reference to dwPointer
dwOrg_Pointer = *dwPointer;
// This is a bit more confusing a Indirect Pointer to the function which can be called via inline assemble
_asm
{
call dwPointer // Must be called inside the hooked function
}
// Now if the function you are hooking has Arguments and you want to use the Indirect Pointer you must
// push these Arguments on to the stack before calling the function
_asm
{
push argumentC
push argumentB
push argumentA
call ArgumentFunction
}
// Since the stack is Last In First Out( LIFO ) you have push the arguments on backwards e.g.
// Say this is ArgumentFunction
void ArgumentFunction ( int argumentA, int argumentB, int argumentC );
// Pushing the Arguments goes like so
push argumentC
push argumentB
push argumentA

OK! All the calling methods have been covered now for patching .

Code:

WriteProcessMemory(
hProcess, // handle to the process which you want to patch
(void*)0xOffsetHere, // offset to the function you which was read or the address you want
(void*)Pointer, // pointer to the hooked function
4, // size to read most of the time this is 4 or 6 the sizeof(DWORD)
0 ); // number bytes read not really needed
// This method is more likly to be used with Typedef Calling and not Indirect Calling.
// But still isn't needed at all if you know alot aboput pointer's. Since everything is covered now i'm done
// Indirect Calling Patch
dwPointer = &Hooked_Function;
// Pie?

- RetarT -

example usage (revised from goldfinders basehook)


PHP Code:


#include "mempatcher.h"

void PatchFunc( void )

{

CMemoryPatcher Patcher;

MODULEENTRY32 ProcEntry;



if( Patcher.Init( ) && Patcher.FindModuleInProcess( "process.exe", GetCurrentProcessId( ), &ProcEntry ) )

{

Func_Address = Patcher.FindPattern( ProcEntry.th32ProcessID, ( BYTE * )0xC0DEFEED, Func_Len, ( DWORD )ProcEntry.modBaseAddr, ProcEntry.modBaseSize );

pFunc = ( TypedefOfFunc_t )RedirectFunction( ProcEntry.th32ProcessID, Func_Address, Func_Len, ( DWORD )&NewFunc );

}

}

Attached Files

• 
  
  mempatcher.zip
  (6.0 KB, 304 views)