WoW Memory Edition start [C#]

**xalcon** · 10-11-2012

I suggest you to check the return value of your 'process.ReadUInt(pEndScene + 3)' before compiling and injecting it into the process. It looks like you're getting zero pointer. (and the +3 also don't makes any sense for me o.O) But well, currently I don't need stuff like Lua_DoString or TerrainClick, so I don't have a working injection code.

**Pandu91** · 10-11-2012

Hey,

I have made progress.

I changed to Win 7 to get it there running, I used new code & my progress is, that I am able to send the /dance command, but the client crashed before I can see it. But when I now restart the client and login, my Character is dancing. I am getting this WoW Error:

This is my new Code:

PHP Code:


using System;
using System.Threading;
using Magic;
using System.Text;
using System.Collections.Generic;
using System.Diagnostics;

namespace ConsoleApplication2
{
    class Program
    {
        static Hook MyHook = null;

        static void Main(string[] args)
        {
            Process[] Processes = Process.GetProcessesByName("Wow");

            if (Processes.Length > 0)
            {
                Console.WriteLine("Select wow process " + Processes[0].Id);

                MyHook = new Hook((uint)Processes[0].Id);
                Console.WriteLine("Hook status: " + MyHook.threadHooked);

                if (MyHook.threadHooked)
                {
                    LuaDoString("DoEmote(\"Dance\")");
                    Console.WriteLine("INJECT LuaDoString(\"DoEmote(\"Dance\")\")");

                  
                    Console.WriteLine("Dispose Hooking");
                }
            }
            else
                Console.WriteLine("WoW process not found.");
            Console.ReadKey();
        }

        public static void LuaDoString(string command)
        {
            var proc = Process.GetProcessesByName("Wow");
            IntPtr WoWBase = proc[0].MainModule.BaseAddress;
            // Allocate memory
            uint DoStringArg_Codecave = MyHook.Memory.AllocateMemory(Encoding.UTF8.GetBytes(command).Length + 1);
            // offset:
            uint FrameScript__Execute = 0x75350;


            // Write value:
            MyHook.Memory.WriteBytes(DoStringArg_Codecave, Encoding.UTF8.GetBytes(command));

            // Write the asm stuff for Lua_DoString
            String[] asm = new String[] 
            {
                "mov eax, " + DoStringArg_Codecave,
                "push 0",
                "push eax",
                
                "push eax",
                "mov eax, " + ((uint)WoWBase + (uint)FrameScript__Execute), // Lua_DoString
                
                "call eax",
                "add esp, 0xC",
                "retn",    
            };

            // Inject
            MyHook.InjectAndExecute(asm);
            // Free memory allocated 
            MyHook.Memory.FreeMemory(DoStringArg_Codecave);
        }

    }

    class Hook
    {
        // Addresse Inection code:
        uint injected_code = 0;
        uint addresseInjection = 0;
        public bool threadHooked = false;
        uint retnInjectionAsm = 0;
        bool InjectionUsed = false;
        public BlackMagic Memory = new BlackMagic();
        public uint _processId = 0;
        public Hook(uint processId)
        {
            _processId = processId;
            Hooking();
        }

        public void Hooking()
        {
            var proc = Process.GetProcessesByName("Wow");
            IntPtr WoWBase = proc[0].MainModule.BaseAddress;
            // Offset:
            uint DX_DEVICE = 0xAD773C;
            uint DX_DEVICE_IDX = 0x27F8;
            uint ENDSCENE_IDX = 0xA8;

            // Process Connect:
            if (!Memory.IsProcessOpen)
            {
                Memory = new BlackMagic((int)_processId);
            }

            if (Memory.IsProcessOpen)
            {
                // Get address of EndScene
                uint pDevice = Memory.ReadUInt((uint)WoWBase + DX_DEVICE);
                uint pEnd = Memory.ReadUInt(pDevice + DX_DEVICE_IDX);
                uint pScene = Memory.ReadUInt(pEnd);
                uint pEndScene = Memory.ReadUInt(pScene + ENDSCENE_IDX);

                if (Memory.ReadByte(pEndScene) == 0xE9 && (injected_code == 0 || addresseInjection == 0)) // check if wow is already hooked and dispose Hook
                {
                    DisposeHooking();
                }

                if (Memory.ReadByte(pEndScene) != 0xE9) // check if wow is already hooked
                {
                    try
                    {
                        threadHooked = false;
                        // allocate memory to store injected code:
                        injected_code = Memory.AllocateMemory(2048);
                        // allocate memory the new injection code pointer:
                        addresseInjection = Memory.AllocateMemory(0x4);
                        Memory.WriteInt(addresseInjection, 0);
                        // allocate memory the pointer return value:
                        retnInjectionAsm = Memory.AllocateMemory(0x4);
                        Memory.WriteInt(retnInjectionAsm, 0);

                        // Generate the STUB to be injected
                        Memory.Asm.Clear(); // $Asm

                        // save regs
                        Memory.Asm.AddLine("pushad");
                        Memory.Asm.AddLine("pushfd");

                        // Test if you need launch injected code:
                        Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");

                        Memory.Asm.AddLine("test eax, eax");
                        Memory.Asm.AddLine("je @out");

                        // Launch Fonction:
                        Memory.Asm.AddLine("mov eax, [" + addresseInjection + "]");
                        Memory.Asm.AddLine("call eax");

                        // Copie pointer return value:
                        Memory.Asm.AddLine("mov [" + retnInjectionAsm + "], eax");

                        // Enter value 0 of addresse func inject
                        Memory.Asm.AddLine("mov edx, " + addresseInjection);

                        Memory.Asm.AddLine("mov ecx, 0");
                        Memory.Asm.AddLine("mov [edx], ecx");

                        // Close func
                        Memory.Asm.AddLine("@out:");

                        // load reg
                        Memory.Asm.AddLine("popfd");
                        Memory.Asm.AddLine("popad");


                        // injected code
                        uint sizeAsm = (uint)(Memory.Asm.Assemble().Length);
                        Memory.Asm.Inject(injected_code);

                        // Size asm jumpback
                        int sizeJumpBack = 5;

                        // copy and save original instructions
                        Memory.Asm.Clear();
                        Memory.Asm.AddLine("mov edi, edi");
                        Memory.Asm.AddLine("push ebp");
                        Memory.Asm.AddLine("mov ebp, esp");
                        Memory.Asm.Inject(injected_code + sizeAsm);

                        // create jump back stub
                        Memory.Asm.Clear();
                        Memory.Asm.AddLine("jmp " + (pEndScene + sizeJumpBack));
                        Memory.Asm.Inject(injected_code + sizeAsm + (uint)sizeJumpBack);

                        // create hook jump
                        Memory.Asm.Clear(); // $jmpto
                        Memory.Asm.AddLine("jmp " + (injected_code));
                        Memory.Asm.Inject(pEndScene);
                    }
                    catch { threadHooked = false; return; }
                }
                threadHooked = true;
            }

        }

        public void DisposeHooking()
        {
            try
            {
                var proc = Process.GetProcessesByName("Wow");
                IntPtr WoWBase = proc[0].MainModule.BaseAddress;

                // Offset:
                uint DX_DEVICE = 0xAD773C;
                uint DX_DEVICE_IDX = 0x27F8;
                uint ENDSCENE_IDX = 0xA8;

                uint pDevice = Memory.ReadUInt((uint)WoWBase + DX_DEVICE);
                uint pEnd = Memory.ReadUInt(pDevice + DX_DEVICE_IDX);
                uint pScene = Memory.ReadUInt(pEnd);
                uint pEndScene = Memory.ReadUInt(pScene + ENDSCENE_IDX);

                if (Memory.ReadByte(pEndScene) == 0xE9) // check if wow is already hooked and dispose Hook
                {
                    // Restore origine endscene:
                    Memory.Asm.Clear();
                    Memory.Asm.AddLine("mov edi, edi");
                    Memory.Asm.AddLine("push ebp");
                    Memory.Asm.AddLine("mov ebp, esp");
                    Memory.Asm.Inject(pEndScene);
                }

                // free memory:
                Memory.FreeMemory(injected_code);
                Memory.FreeMemory(addresseInjection);
                Memory.FreeMemory(retnInjectionAsm);

            }
            catch { }
        }

        public byte[] InjectAndExecute(string[] asm)
        {
            while (InjectionUsed)
            { Thread.Sleep(5); }
            InjectionUsed = true;

            // Hook Wow:
            Hooking();

            byte[] tempsByte = new byte[0];

            // reset return value pointer
            Memory.WriteInt(retnInjectionAsm, 0);

            if (Memory.IsProcessOpen && threadHooked)
            {
                // Write the asm stuff
                Memory.Asm.Clear();
                foreach (string tempLineAsm in asm)
                {
                    Memory.Asm.AddLine(tempLineAsm);
                }

                // Allocation Memory
                uint injectionAsm_Codecave = Memory.AllocateMemory(Memory.Asm.Assemble().Length);


                try
                {
                    // Inject
                    Memory.Asm.Inject(injectionAsm_Codecave);
                    Memory.WriteInt(addresseInjection, (int)injectionAsm_Codecave);
       
                    while (Memory.ReadInt(addresseInjection) > 0) { Thread.Sleep(5); } // Wait to launch code
                   


                    byte Buf = new Byte();
                    List<byte> retnByte = new List<byte>();
                    uint dwAddress = Memory.ReadUInt(retnInjectionAsm);
                    Buf = Memory.ReadByte(dwAddress);
                    while (Buf != 0)
                    {
                        retnByte.Add(Buf);
                        dwAddress = dwAddress + 1;
                        Buf = Memory.ReadByte(dwAddress);
                    }
                    tempsByte = retnByte.ToArray();
                }
                catch { }

                // Free memory allocated 
                Memory.FreeMemory(injectionAsm_Codecave);
            }
            DisposeHooking();
            InjectionUsed = false;
            // return
            return tempsByte;
            
        }
    }
}

Of course I am not that lazy that I am just posting this code and I haven't done some investigation...

I found out with debug messages that it does not go past the following snippet and is crashing somewhere there.

PHP Code:


while (Memory.ReadInt(addresseInjection) > 0) { Thread.Sleep(5); } // Wait to launch code

Does anyone have an advice?

Thanks!

Best regards

**eracer** · 10-11-2012

for the windows 8 version

Code:

// Size asm jumpback
int sizeJumpBack = 7;

Code:

                        // create hook jump
                        Memory.Asm.Clear(); // $jmpto
                        Memory.Asm.AddLine("jmp " + (injected_code));
                        Memory.Asm.AddLine("nop");
                        Memory.Asm.AddLine("nop");
                        Memory.Asm.Inject(pEndScene);

xalcon, the process.ReadUInt(pEndScene + 3) code is basically just reading the address from the mov instruction in the original endscene, it works on my test version here but I am using GreyMagic instead of BlackMagic.. should still be fine though, definitely nothing wrong with debuging i and making sure though of course

push 0x14 // 2 bytes
mov eax, ADDRESSWEWANT // mov eax is 1 byte

so thats why its pEndScene+3

Edit:
doing this for each function is really not a good idea IMHO

Code:

var proc = Process.GetProcessesByName("Wow");
IntPtr WoWBase = proc[0].MainModule.BaseAddress;

you could hook one process and then end up trying to remove the hook from another process because proc[0] may not be the same one you started with.
I would recommend getting the process once reusing it.

**Pandu91** · 10-11-2012

Hi,

I replaced

PHP Code:


                        // create hook jump
                        Memory.Asm.Clear(); // $jmpto
                        Memory.Asm.AddLine("jmp " + (injected_code));
                        Memory.Asm.Inject(pEndScene);

with your code but I am getting this error:

(I am using Win 7 at the moment,)

I am trying to get this work for over 10 hours now, it injects the /dance command but I do not know why the client is crashing.

I am very thankful for all of your help.

Best regards

**eracer** · 10-11-2012

for windows 7 this code is fine

Code:

                        // create hook jump
                        Memory.Asm.Clear(); // $jmpto
                        Memory.Asm.AddLine("jmp " + (injected_code));
                        Memory.Asm.Inject(pEndScene);

for windows 8 you need the 2 extra nops to make it 7 bytes long

Code:

// create hook jump
                        Memory.Asm.Clear(); // $jmpto
                        Memory.Asm.AddLine("jmp " + (injected_code));
                        Memory.Asm.AddLine("nop");
                        Memory.Asm.AddLine("nop");
                        Memory.Asm.Inject(pEndScene);

The error messages you're getting is just telling me that some memory can't be written, i can't actually tell what that memory address is though.

**Pandu91** · 10-11-2012

Ah okay, understood.

Thanks for the snippet.

First thing I want to get running is the Hook under Win 7 - after that I am making it compatible with win 8.

Well I am out of ideas at the moment I have tried everything what came to my mind.

Can you please check your PM?

Best regards