private void UpdateByteViews(uint address, int size) { byte[] bytes = TrashMem.ReadChars(address, size); textboxByteView.Text = GenerateByteView(bytes); textboxDecodedByteView.Text = GenerateEncodedByteView(bytes, Encoding.ASCII); labelInt16.Content = $"{BitConverter.ToInt16(bytes, 0)}"; labelInt32.Content = $"{BitConverter.ToInt32(bytes, 0)}"; labelInt64.Content = $"{BitConverter.ToInt64(bytes, 0)}"; labelFloat.Content = $"{BitConverter.ToSingle(bytes, 0)}"; labelDouble.Content = $"{BitConverter.ToDouble(bytes, 0)}"; }
public void MemoryAllocFreeMultiCharsBytesTest() { MemoryAllocation memAlloc = TrashMem.AllocateMemory(32); byte[] sampleBytes = new byte[] { 0x1, 0x2, 0x3, 0x4, 0x5 }; TrashMem.WriteBytes(memAlloc.Address, sampleBytes); byte[] bytesRead = TrashMem.ReadChars(memAlloc.Address, 5); Assert.AreEqual(sampleBytes[0], bytesRead[0]); Assert.AreEqual(sampleBytes[1], bytesRead[1]); Assert.AreEqual(sampleBytes[2], bytesRead[2]); Assert.AreEqual(sampleBytes[3], bytesRead[3]); Assert.AreEqual(sampleBytes[4], bytesRead[4]); Assert.IsTrue(memAlloc.Free()); }
private void SetupEndsceneHook() { // first thing thats 5 bytes big is here // we are going to replace this 5 bytes with // our JMP instruction (JMP (1 byte) + Address (4 byte)) EndsceneAddress += ENDSCENE_HOOK_OFFSET; // if WoW is already hooked, unhook it if (IsWoWHooked) { DisposeHook(); } else { originalEndsceneBytes = TrashMem.ReadChars(EndsceneAddress, 5); } // if WoW is now/was unhooked, hook it if (!IsWoWHooked) { AmeisenBotLogger.Instance.Log($"[{ProcessId.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}]\tHooking EndScene at \"0x{EndsceneAddress.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}\"", LogLevel.Verbose); // the address that we will return to after // the jump wer'e going to inject EndsceneReturnAddress = EndsceneAddress + 0x5; // integer to check if there is code waiting to be executed CodeToExecuteAddress = TrashMem.AllocateMemory(4); TrashMem.Write(CodeToExecuteAddress.Address, 0); // integer to save the address of the return value ReturnValueAddress = TrashMem.AllocateMemory(4); TrashMem.Write(ReturnValueAddress.Address, 0); // codecave to check if we need to execute something CodecaveForCheck = TrashMem.AllocateMemory(128); AmeisenBotLogger.Instance.Log($"[{ProcessId.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}]\tCCCheck is at \"0x{CodecaveForCheck.Address.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}\"", LogLevel.Verbose); // codecave for the code we wa't to execute CodecaveForExecution = TrashMem.AllocateMemory(2048); AmeisenBotLogger.Instance.Log($"[{ProcessId.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}]\tCCExecution is at \"0x{CodecaveForExecution.Address.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}\"", LogLevel.Verbose); TrashMem.Asm.Clear(); // save registers TrashMem.Asm.AddLine("PUSHFD"); TrashMem.Asm.AddLine("PUSHAD"); // check for code to be executed TrashMem.Asm.AddLine($"MOV EBX, [0x{CodeToExecuteAddress.Address.ToString("X")}]"); TrashMem.Asm.AddLine("TEST EBX, 1"); TrashMem.Asm.AddLine("JE @out"); // execute our stuff and get return address TrashMem.Asm.AddLine($"MOV EDX, 0x{CodecaveForExecution.Address.ToString("X")}"); TrashMem.Asm.AddLine("CALL EDX"); TrashMem.Asm.AddLine($"MOV [0x{ReturnValueAddress.Address.ToString("X")}], EAX"); // finish up our execution TrashMem.Asm.AddLine("@out:"); TrashMem.Asm.AddLine("MOV EDX, 0"); TrashMem.Asm.AddLine($"MOV [0x{CodeToExecuteAddress.Address.ToString("X")}], EDX"); // restore registers TrashMem.Asm.AddLine("POPAD"); TrashMem.Asm.AddLine("POPFD"); byte[] asmBytes = TrashMem.Asm.Assemble(); // needed to determine the position where the original // asm is going to be placed int asmLenght = asmBytes.Length; // inject the instructions into our codecave TrashMem.Asm.Inject(CodecaveForCheck.Address); // --------------------------------------------------- // End of the code that checks if there is asm to be // executed on our hook // --------------------------------------------------- // Prepare to replace the instructions inside WoW TrashMem.Asm.Clear(); // do the original EndScene stuff after we restored the registers // and insert it after our code TrashMem.WriteBytes(CodecaveForCheck.Address + (uint)asmLenght, originalEndsceneBytes); // return to original function after we're done with our stuff TrashMem.Asm.AddLine($"JMP 0x{EndsceneReturnAddress.ToString("X")}"); TrashMem.Asm.Inject(CodecaveForCheck.Address + (uint)asmLenght + 5); TrashMem.Asm.Clear(); // --------------------------------------------------- // End of doing the original stuff and returning to // the original instruction // --------------------------------------------------- // modify original EndScene instructions to start the hook TrashMem.Asm.AddLine($"JMP 0x{CodecaveForCheck.Address.ToString("X")}"); TrashMem.Asm.Inject(EndsceneAddress); AmeisenBotLogger.Instance.Log($"[{ProcessId.ToString("X", CultureInfo.InvariantCulture.NumberFormat)}]\tInjected Hook [IsWoWHooked = {IsWoWHooked}]", LogLevel.Verbose); // we should've hooked WoW now } }