C++ wolftü Otomatik Adres Bulma (External Pattern Scan)

#include <Windows.h>
#include <iostream>
#include <TlHelp32.h>

#pragma region Functions
DWORD iGMBase(DWORD dwProcessID, std::string strModulAd, bool retEndOfModule = false) {
        MODULEENTRY32 lpModuleEntry = { 0 };
        HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessID);
        if (!hSnapShot)
        {
                return NULL;
        }
        lpModuleEntry.dwSize = sizeof(lpModuleEntry);
        BOOL bModule = Module32First(hSnapShot, &lpModuleEntry);
        while (bModule) {
            std::string gelenVeri = lpModuleEntry.szModule;
            unsigned ModuleDogrula = gelenVeri.find(strModulAd);
                if (ModuleDogrula != std::string::npos) {
                    CloseHandle(hSnapShot);
                if(!retEndOfModule)
                    return (DWORD)lpModuleEntry.modBaseAddr;
                else
                    return (DWORD)lpModuleEntry.modBaseAddr + (DWORD)lpModuleEntry.modBaseSize;
            }
            bModule = Module32Next(hSnapShot, &lpModuleEntry);
        }
        CloseHandle(hSnapShot);
        return NULL;
}

DWORD pEx(char * pAd)
{
    HANDLE hProcessSnap;
    PROCESSENTRY32 pe32;
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    pe32.dwSize = sizeof(PROCESSENTRY32);
 
    do
    {
        if (strcmp(pAd, pe32.szExeFile) == 0)
        {
            DWORD ProcessId = pe32.th32ProcessID;
            CloseHandle(hProcessSnap);
            return ProcessId;
        }
    } while (Process32Next(hProcessSnap, &pe32)); 
    CloseHandle(hProcessSnap);
    return 0;         
}
uintptr_t FindPattern(char* base, unsigned int size, char* pattern, char *mask)
{
    size_t patternLength = strlen(mask);

    for (uintptr_t i = 0; i < size - patternLength; i++)
    {
        bool found = true;
        for (uintptr_t j = 0; j < patternLength; j++)
        {
            if (mask[j] != '?' && pattern[j] != *(char*)(base + i + j))
            {
                found = false;
                break;
            }
        }

        if (found)
        {
            return (uintptr_t)base + i;
        }
    }
    return 0;
}
uintptr_t FindPatternEx(HANDLE hProcess, uintptr_t start, uintptr_t end, char *pattern, char *mask)
{
    uintptr_t currentChunk = start;
    SIZE_T bytesRead;

    while (currentChunk < end)
    {
        DWORD oldprotect;
        VirtualProtectEx(hProcess, (void*)currentChunk, 4096, PROCESS_VM_READ, &oldprotect);
        byte buffer[4096];
        ReadProcessMemory(hProcess, (void*)currentChunk, &buffer, 4096, &bytesRead);
        if (bytesRead == 0)
        {
            return 0;
        }
        uintptr_t InternalAddress = FindPattern((char*)&buffer, bytesRead, pattern, mask);
        if (InternalAddress != 0)
        {
            uintptr_t offsetFromBuffer = InternalAddress - (uintptr_t)&buffer;
            return currentChunk + offsetFromBuffer;
        }
        else
        {
            currentChunk = currentChunk + bytesRead;
        }
    }
    return 0;
}
typedef LONG (NTAPI *NtSuspendProcess)(IN HANDLE ProcessHandle);

void suspend(DWORD processId)
{
    HANDLE processHandle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, processId);
    NtSuspendProcess pfnNtSuspendProcess = (NtSuspendProcess)GetProcAddress(
        GetModuleHandle("ntdll"), "NtSuspendProcess");

    pfnNtSuspendProcess(processHandle);
    CloseHandle(processHandle);
}
#pragma endregion
int _tmain(int argc, _TCHAR* argv[])
{
    static int pdx = 0; 
    HANDLE hProcess;
    while(true)
    {
        if(pdx != 0)
        {
            std::cout << "wolftü Found. Stopping Game And Starting Search Patterns" << std::endl;
            Sleep(2500);
            hProcess = OpenProcess(PROCESS_ALL_ACCESS, false, pdx);
            Sleep(1500);
            suspend(pdx);
            break;
        }else
        {
            Sleep(200);
            pdx = pEx("wolftü.bin");
        }
    }
    uintptr_t CShellBase = iGMBase(pdx,"csh");
    uintptr_t CShellSize = iGMBase(pdx,"csh",true);
    uintptr_t dwNameEspPtr = FindPatternEx(hProcess, CShellBase, CShellSize, "\x75\x31\x38\x00\x00\x00\x00\x00\x75\x29", "xxx?????xx");
    CloseHandle(hProcess);
    printf("\nCShell Base = 0x%X",CShellBase);
    printf("\nCShell Size = 0x%X",CShellSize);
    char iout[50];
    sprintf(iout,"\nName Esp : Cshxxxx.tmp + 0x%X",dwNameEspPtr - CShellBase);
    std::cout << iout << std::endl;
    system("pause");
    return 0;
}

Imports Microsoft.VisualBasic
Imports System

'MBCS Needed & Doesn't Support VS2015 or 2017


#Region "Functions"
Private Function iGMBase(ByVal dwProcessID As UInteger, ByVal strModulAd As String, Optional ByVal retEndOfModule As Boolean = False) As UInteger
        Dim lpModuleEntry As New MODULEENTRY32()
        Dim hSnapShot As System.IntPtr = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessID)
        If Not hSnapShot Then
                Return Nothing
        End If
'C++ TO VB CONVERTER TODO TASK: There is no VB equivalent to 'sizeof':
        lpModuleEntry.dwSize = sizeof(lpModuleEntry)
        Dim bModule As Integer = Module32First(hSnapShot, lpModuleEntry)
        Do While bModule <> 0
            Dim gelenVeri As String = lpModuleEntry.szModule
            Dim ModuleDogrula As UInteger = gelenVeri.IndexOf(strModulAd)
                If ModuleDogrula <> String.npos Then
                    CloseHandle(hSnapShot)
                If Not retEndOfModule Then
                    Return CUInt(lpModuleEntry.modBaseAddr)
                Else
                    Return CUInt(lpModuleEntry.modBaseAddr) + CUInt(lpModuleEntry.modBaseSize)
                End If
                End If
            bModule = Module32Next(hSnapShot, lpModuleEntry)
        Loop
        CloseHandle(hSnapShot)
        Return Nothing
End Function

Private Function pEx(ByVal pAd As String) As UInteger
    Dim hProcessSnap As System.IntPtr
    Dim pe32 As New PROCESSENTRY32()
    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0)
'C++ TO VB CONVERTER TODO TASK: There is no VB equivalent to 'sizeof':
    pe32.dwSize = sizeof(PROCESSENTRY32)

    Do
        If String.Compare(pAd, pe32.szExeFile) = 0 Then
            Dim ProcessId As UInteger = pe32.th32ProcessID
            CloseHandle(hProcessSnap)
            Return ProcessId
        End If
    Loop While Process32Next(hProcessSnap, pe32)
    CloseHandle(hProcessSnap)
    Return 0
End Function
Private Function FindPattern(ByVal base As String, ByVal size As UInteger, ByVal pattern As String, ByVal mask As String) As UShort
    Dim patternLength As UInteger = mask.Length

    For i As UShort = 0 To size - patternLength - 1
        Dim found As Boolean = True
        For j As UShort = 0 To patternLength - 1
            If mask.Chars(j) <> "?"c AndAlso pattern.Chars(j) <> CSByte(base.Substring(i) + j) Then
                found = False
                Exit For
            End If
        Next j

        If found Then
            Return CUShort(base) + i
        End If
    Next i
    Return 0
End Function
Private Function FindPatternEx(ByVal hProcess As System.IntPtr, ByVal start As UShort, ByVal [end] As UShort, ByVal pattern As String, ByVal mask As String) As UShort
    Dim currentChunk As UShort = start
    Dim bytesRead As System.IntPtr

    Do While currentChunk < [end]
        Dim oldprotect As UInteger
        VirtualProtectEx(hProcess, CType(currentChunk, System.IntPtr), 4096, PROCESS_VM_READ, oldprotect)
        Dim buffer(4095) As byte
        ReadProcessMemory(hProcess, CType(currentChunk, System.IntPtr), buffer, 4096, bytesRead)
        If bytesRead = 0 Then
            Return 0
        End If
        Dim InternalAddress As UShort = FindPattern(CSByte(buffer), bytesRead, pattern, mask)
        If InternalAddress <> 0 Then
            Dim offsetFromBuffer As UShort = InternalAddress - CUShort(buffer)
            Return currentChunk + offsetFromBuffer
        Else
            currentChunk = currentChunk + bytesRead
        End If
    Loop
    Return 0
End Function
'C++ TO VB CONVERTER TODO TASK: The original C++ function pointer contained an unconverted modifier:
'ORIGINAL LINE: typedef Integer(NTAPI *NtSuspendProcess)(IN System.IntPtr ProcessHandle);
Private Delegate Function NtSuspendProcess(ByVal ProcessHandle As IN) As Integer

Private Sub suspend(ByVal processId As UInteger)
    Dim processHandle As System.IntPtr = OpenProcess(PROCESS_ALL_ACCESS, 0, processId)
    Dim pfnNtSuspendProcess As NtSuspendProcess = AddressOf NtSuspendProcess

    pfnNtSuspendProcess(processHandle)
    CloseHandle(processHandle)
End Sub
#End Region
Private Function _tmain(ByVal argc As Integer, ByVal argv() As _TCHAR) As Integer
    Static pdx As Integer = 0
    Dim hProcess As System.IntPtr
    Do
        If pdx <> 0 Then
            Console.Write("wolftü Found. Stopping Game And Starting Search Patterns")
            Console.Write(vbLf)
            Sleep(2500)
            hProcess = OpenProcess(PROCESS_ALL_ACCESS, False, pdx)
            Sleep(1500)
            suspend(pdx)
            Exit Do
        Else
            Sleep(200)
            pdx = pEx("wolftü.bin")
        End If
    Loop
    Dim CShellBase As UShort = iGMBase(pdx, "csh")
    Dim CShellSize As UShort = iGMBase(pdx, "csh", True)
    Dim dwNameEspPtr As UShort = FindPatternEx(hProcess, CShellBase, CShellSize, ChrW(&H75).ToString() & ChrW(&H31).ToString() & ChrW(&H38).ToString() & ChrW(&H00).ToString() & ChrW(&H00).ToString() & ChrW(&H00).ToString() & ChrW(&H00).ToString() & ChrW(&H00).ToString() & ChrW(&H75).ToString() & ChrW(&H29).ToString(), "xxx?????xx")
    CloseHandle(hProcess)
    Console.Write(vbLf & "CShell Base = 0x{0:X}",CShellBase)
    Console.Write(vbLf & "CShell Size = 0x{0:X}",CShellSize)
    Dim iout As New String(New Char(49){})
    iout = String.Format(vbLf & "Name Esp : Cshxxxx.tmp + 0x{0:X}", dwNameEspPtr - CShellBase)
    Console.Write(iout)
    Console.Write(vbLf)
    system("pause")
    Return 0
End Function

    <System.Runtime.InteropServices.DllImport("ntdll")> _
    Friend Shared Function NtSuspendProcess(ByVal ProcessHandle As IN) As Integer
    End Function

std::string gelenVeri = lpModuleEntry.szModule;