Probelm with Memory World of Warcraft c++

[lustikus12]

Hello i tray Memoryreading with c++ the first time! ok her is my sourche :

// Memory.cpp: Hauptprojektdatei.

#include "stdafx.h"

using namespace System;

#define WIN32_LEAN_AND_MEAN  
#include <windows.h>
#include <iostream>
#include <tchar.h>
#include <string>
#pragma comment(lib, "user32.lib")
#pragma comment(lib, "kernel32.lib")
#define SE_DEBUG_NAME TEXT(*SeDebugPrivilege*)
//#pragma comment(lib, "gdi32.lib")
using namespace std;

int _tmain(int argc, _TCHAR* argv[])// lol, ich nenns immer int main(int argc, char *argv[]) ^^
{ 
	HWND hWindow;
	DWORD dwProcId;
	DWORD rw=0;
	HANDLE hProcess;
	int ID;

	int puffer = 0;
	unsigned int adresse = 0x007E75E4;
	printf("Searching hWnd...\n");                                                                
	while(!(hWindow = FindWindow(NULL, L"World of Warcraft")));     //Das it ein LPWSTR (oder so ähnlich^^) da musst du ein L davorstellen
	{Sleep(50);}
	printf("hWnd: 0x%i\n",hWindow);
	if(!hWindow);
	printf("Searching PocessId...\n");
	do
	{GetWindowThreadProcessId(hWindow, &dwProcId);}while(!dwProcId);
        printf("dwProcId: 0x%i\n", dwProcId);

	printf("Searching Process Handle\n");
	hProcess = OpenProcess(PROCESS_QUERY_INFORMATION|PROCESS_VM_READ|PROCESS_TERMINATE,false,dwProcId);
	if (hProcess) 
                printf("Prozess opend!\n");
	else
		printf("Prozess not opend!\n");
        printf("Porcess Handle: 0x%i\n", hProcess);

       ReadProcessMemory(hProcess, (LPCVOID)adresse, &puffer, sizeof(puffer), &rw);
	   std::cout<< puffer;                                                            
       Sleep(2000);
	   CloseHandle(hProcess);   
	   std::cin >> ID ;
	   return 0;
}

ok test it going until he should atach the Process. i think the best is if you test it by your own. It would be verry nice if you could help me sorry for my bad english =(

[Cromon]

The WoW-process is "protected". You need to give your process SE_DEBUG_PRIVILEGES.

Thats what im using to adjust privs:

BOOL AdjustProcessPrivileges(LPCSTR szPrivilegesName)   
{   
    HANDLE hToken;    
    TOKEN_PRIVILEGES tkp;   
    
    if(!OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))   
    {   
       return FALSE;   
    }   
    
    if(!LookupPrivilegeValue(NULL, szPrivilegesName, &tkp.Privileges[0].Luid))   
    {   
        CloseHandle(hToken);   
        return FALSE;   
    }   
       
    tkp.PrivilegeCount = 1;   
    tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;   
        
    if(!AdjustTokenPrivileges(hToken, FALSE, &tkp, sizeof(tkp), NULL, NULL))   
    {   
        CloseHandle(hToken);   
        return 0;   
    }   
        
    CloseHandle(hToken);   
    return TRUE;   
}

[Ellesar1]

is there a way for warden to find pointers into it's memory and detect those reads / detect when someone attaches to WoW's process?

if yes, are there simple methods to avoid this, or do you have to perform some dll-injections into the winapi or implement a device driver to go into kernel mode?