a little bit of c++ and reading process memory..

[arynock]

So i've been trying to work out a simple class for opening processes and reading memory... I'm kinda stuck when it comes to making the call to OpenProcess()... it fails because it says access is denied... So upon google'n that i found that i have to set the privileges in the access token to allow me to open the process..

--------- Function to set SE_DEBUG_NAME privilege -----------
bool MemoryReader::SetDebugPrivilege()
{

TOKEN_PRIVILEGES tp;
LUID luid;
DWORD cbPrevious=sizeof(TOKEN_PRIVILEGES);

if(LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &luid )==0) {
std::cout << "Failed to lookup privilege value...[" << GetLastError() << "]\n";
}

tp.PrivilegeCount = 1;
tp.Privileges[0].Luid = luid;
tp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;


if (AdjustTokenPrivileges(hToken, FALSE,&tp,sizeof(TOKEN_PRIVILEGES),(PTOKEN_PRIVILEGES)NULL,(PDWORD) NULL)==0)
{
std::cout<<"Failed to adjust token privileges...[" << GetLastError() << "]\n";
return FALSE;
}
}
------------------------------------
so i now when i try to actually set the privileges with the token i get another error on the call to AdjustTokenPrivileges... error 6.... the handle is invalid...

[KOS0937]

TokenHandle

    A handle to the access token that contains the privileges to be modified. The handle must have TOKEN_ADJUST_PRIVILEGES access to the token. If the PreviousState parameter is not NULL, the handle must also have TOKEN_QUERY access.

So, where do you set 'hToken'?

[arynock]

eh sorry i meant to reply on this post earlier... i managed to figure out what my problem was and i actually got it to work... but not i'm kinda on pause seeing as my accounts keep getting banned using cheat engine... ugh...

[KOS0937]

Just don't use your real account!
You can get unlimited free trials accounts to test bots / hacks etc. at World of Warcraft Europe or World of Warcraft Community Site .

[arynock]

thats understandable... but has anyone else been having this problem?? 2 days ago i was able to use cheat engine fine with no problem, but today i cant even do one search without one of my trial accounts being banned..

[arynock]

okay, so this is probably gonna get me flammed hardcore... but oh well, i'm still in the learning process...

so using c++ i was able to find the base address, and using the offsets i was able to find the address that holds my current health...

now... lets say i want to update my health in my bot program every second... is it possible to point right to the address that holds my current health? or will i have to use my MemoryRead function to reread the address and save it to the health variable??

[KOS0937]

You have to use your ReadMemory function every time.

[lunitune]

You will have to memory read each time to read the health obviously, however the pointer to that location will stay the same until you zone (eg Zeplin/instance). I have not noticed it change in any other circumstances.

For quick reads I have direct pointers to the x/y/z locs in mem.

--

To gain the right privileges I use wow!sharp's method. I'm using C# but it is using pinvoke.

internal void EnableDebuggerPrivileges()
		{
			int token = 0;
			TOKEN_PRIVILEGES tp = new TOKEN_PRIVILEGES();
			tp.PrivilegeCount = 1;
			tp.Luid = 0;
			tp.Attributes = SE_PRIVILEGE_ENABLED;

			// We just assume this works
			if( OpenProcessToken( GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref token) == 0)
				throw( new Exception( "OpenProcessToken failed"));

			if( LookupPrivilegeValue( null, "SeDebugPrivilege", ref tp.Luid) == 0)
				throw( new Exception( "LookupPrivilegeValue failed"));

			if( AdjustTokenPrivileges( token, 0, ref tp, Marshal.SizeOf(tp), 0, 0) == 0)
				throw( new Exception( "AdjustTokenPrivileges failed"));
		}


[StructLayout(LayoutKind.Sequential, Pack=1)]
		private struct TOKEN_PRIVILEGES
		{
			public int PrivilegeCount;
			public long Luid;
			public int Attributes;
		}

--

With CE try changing the exe name. This is what I've done with tsearch and it has not been a problem so far. I also use Process Guard which stops one process from reading another process.

If you want to take it a little further with CE you can make a few changes to the source and compile it yourself (credit to Greyman for this info).

[arynock]

For quick reads I have direct pointers to the x/y/z locs in mem.

how exactly do i do this?? this was what i was talking about, i was wondering how i can maek a direct pointers to the players data locations in the memory... i've been reading upon pointers, but i think i'm missing something.. heh..

[KOS0937]

In theory you have 2^32 possible pointers that you can form with 4 byte (32bit system).
So you can adress exactly 4GiB of data. As you can see, that is enough to adress every byte in the RAM (actually, a part of those pointers are used for the virtual memory, but thats not so important).
If you - for example - should change a pointers adress to 0x00000000 you'dd read some OS-Variable. So you just have to find the offset for the wow-process (i have no idea how to do that in C++... sry)

[lunitune]

The way I make a direct pointer (in fact I do it to the actual data I want, eg player X, another for player Y etc) is I first read all objects through the TLS method listed in a number of places on this site. During that process I get the base pointer for each object and store it. Then as I read X/Y etc I also record the address in memory for that data as part of my own player object.

If you want more info let me know.