public void AttachToProcess() { var process = Process.GetProcessesByName(_ggprocname).FirstOrDefault(); if (process == null) { throw new Exception("GG process not found!"); } _memorySharp = new MemorySharp(process); _nonRelativeScriptOffset = IntPtr.Add(_memorySharp.Modules.MainModule.BaseAddress, (int)_scriptOffset); _newmem = _memorySharp.Memory.Allocate(128); _newmembase = _newmem.Information.AllocationBase; var originalCodeAOB = _memorySharp.Assembly.Assembler.Assemble("mov ebp,[ebp+0x0C]\n" + "test [edx],ebp\n" + String.Format("jmp 0x{0}", (_nonRelativeScriptOffset + 5).ToString("X8")), _newmembase); _originalCodeAOB = new byte[originalCodeAOB.Length + 20]; originalCodeAOB.CopyTo(_originalCodeAOB, 0); _remoteCodeAOB = _memorySharp.Assembly.Assembler.Assemble(String.Format("mov ebp,[ebp+0x0C]\n" + "cmp edi,3\n" + "jne 0x{0}\n" + "mov ebp,[edx]\n" + "test [edx],ebp\n" + "jmp 0x{1}", IntPtr.Add(_newmembase, 0xA).ToString("X8"), (_nonRelativeScriptOffset.ToInt32() + 5).ToString("X8")), _newmembase); _memorySharp.Write <byte>(_newmembase, _originalCodeAOB, false); }
public void AttachToProcess() { var process = Process.GetProcessesByName(_ggprocname).FirstOrDefault(); if (process == null) { throw new Exception("GG process not found!"); } _memorySharp = new MemorySharp(process); _nonRelativeScriptOffset = IntPtr.Add(_memorySharp.Modules.MainModule.BaseAddress, (int)_scriptOffset); _newmem = _memorySharp.Memory.Allocate(128); _newmembase = _newmem.Information.AllocationBase; _flagmem = _memorySharp.Memory.Allocate(128); _flagmembase = _flagmem.Information.AllocationBase; var remoteASMstring = String.Format("mov ebp,[eax+0x40]\n" + "mov ebp,[ebp+0x0C]\n" + "cmp edi,3\n" + "jne 0x{0}\n" + "cmp BYTE [0x{2}], 1\n" + "je 0x{3}\n" + "mov DWORD [0x{4}], 0x200\n" + "and DWORD [0x{4}], eax\n" + "cmp DWORD [0x{4}], 0x200\n" + "jne 0x{0}\n" + "mov DWORD [0x{4}], eax\n" + "mov BYTE [0x{2}], 1\n" + "jmp 0x{0}\n" + "cmp DWORD [0x{4}], eax\n" + "jne 0x{0}\n" + "cmp BYTE [0x{1}],0\n" + "jne 0x{0}\n" + "mov ebp,[edx]\n" + "mov BYTE [0x{1}], 1\n" + "jmp 0x{0}", (_nonRelativeScriptOffset.ToInt32() + 6).ToString("X8"), _flagmembase.ToString("X8"), IntPtr.Add(_flagmembase, 1).ToString("X8"), IntPtr.Add(_newmembase, 0x49).ToString("X8"), IntPtr.Add(_flagmembase, 4).ToString("X8")); _remoteCodeAOB = _memorySharp.Assembly.Assembler.Assemble(remoteASMstring, _newmembase); _memorySharp.Write <byte>(_newmembase, _remoteCodeAOB, false); }