-
Notifications
You must be signed in to change notification settings - Fork 26
Expand file tree
/
Copy pathAOBScanner.cpp
More file actions
127 lines (113 loc) · 2.96 KB
/
Copy pathAOBScanner.cpp
File metadata and controls
127 lines (113 loc) · 2.96 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
#include "AOBScanner.h"
#include <windows.h>
#include <Psapi.h>
AOBScanner* AOBScanner::mSingleton = nullptr;
AOBScanner::AOBScanner()
{
// Get process regions
HANDLE procHandle = GetCurrentProcess();
unsigned char *ptr = NULL;
MEMORY_BASIC_INFORMATION info;
for (ptr = NULL; VirtualQueryEx(procHandle, ptr, &info, sizeof(info)) == sizeof(info); ptr += info.RegionSize)
{
if (info.State == MEM_COMMIT)
{
info.BaseAddress = ptr;
mMemoryList.push_back(info);
}
}
MODULEINFO moduleInfo;
PIMAGE_DOS_HEADER dosHeader;
PIMAGE_NT_HEADERS ntHeader;
IMAGE_FILE_HEADER header;
if (GetModuleInformation(GetCurrentProcess(), GetModuleHandle(NULL), &moduleInfo, sizeof(moduleInfo)))
{
mBaseOffset = (LPVOID)moduleInfo.lpBaseOfDll;
}
wprintf(L"[ModEngine] Detected base module offset at 0x%#p\r\n", mBaseOffset);
wprintf(L"[ModEngine] AOB Scanner Initialized\r\n");
}
AOBScanner::~AOBScanner()
{
}
AOBScanner* AOBScanner::GetSingleton()
{
if (mSingleton == nullptr)
{
mSingleton = new AOBScanner();
}
return mSingleton;
}
void* AOBScanner::Scan(unsigned short aob[], int numberOfBytes)
{
DWORD oldProtect;
for (auto meminfo : mMemoryList)
{
// Only scan exe memory
if (((UINT64)meminfo.BaseAddress & 0xFFFFFFFF00000000) != ((UINT64)mBaseOffset & 0xFFFFFFFF00000000))
{
continue;
}
if (!VirtualProtect(meminfo.BaseAddress, meminfo.RegionSize, PAGE_EXECUTE_READWRITE, &oldProtect))
{
continue;
}
for (auto addr = (unsigned char*)meminfo.BaseAddress;
addr < (unsigned char*)meminfo.BaseAddress + meminfo.RegionSize - numberOfBytes; addr++)
{
bool found = true;
for (int j = 0; j < numberOfBytes; j++)
{
if (aob[j] < 256 && addr[j] != (unsigned char)(aob[j] & 0xFF))
{
found = false;
break;
}
}
if (found)
{
if (!VirtualProtect(meminfo.BaseAddress, meminfo.RegionSize, oldProtect, &oldProtect))
return NULL;
return addr;
}
}
if (!VirtualProtect(meminfo.BaseAddress, meminfo.RegionSize, oldProtect, &oldProtect))
return NULL;
}
return NULL;
}
void AOBScanner::FindAndReplace(unsigned short aob[], unsigned char replace[], int numberOfBytes)
{
DWORD oldProtect;
for (auto meminfo : mMemoryList)
{
// Only scan exe memory
if (((UINT64)meminfo.BaseAddress & 0xFFFFFFFFF0000000) != (UINT64)mBaseOffset)
{
continue;
}
if (!VirtualProtect(meminfo.BaseAddress, meminfo.RegionSize, PAGE_EXECUTE_READWRITE, &oldProtect))
{
continue;
}
for (auto addr = (unsigned char*)meminfo.BaseAddress;
addr < (unsigned char*)meminfo.BaseAddress + meminfo.RegionSize - numberOfBytes; addr++)
{
bool found = true;
for (int j = 0; j < numberOfBytes; j++)
{
if (aob[j] < 256 && addr[j] != (unsigned char)(aob[j] & 0xFF))
{
found = false;
break;
}
}
if (found)
{
wprintf(L"[ModEngine] AOB scan found %#p\r\n", addr);
memcpy(addr, replace, numberOfBytes);
}
}
VirtualProtect(meminfo.BaseAddress, meminfo.RegionSize, oldProtect, &oldProtect);
}
}