#ifndef _PPROCESS_HPP_ #define _PPROCESS_HPP_ #include #include #include #include #include #include #include typedef NTSTATUS(WINAPI* pNtReadVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToRead, PULONG NumberOfBytesRead); typedef NTSTATUS(WINAPI* pNtWriteVirtualMemory)(HANDLE ProcessHandle, PVOID BaseAddress, PVOID Buffer, ULONG NumberOfBytesToWrite, PULONG NumberOfBytesWritten); class pMemory { public: pMemory() { pfnNtReadVirtualMemory = (pNtReadVirtualMemory)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtReadVirtualMemory"); pfnNtWriteVirtualMemory = (pNtWriteVirtualMemory)GetProcAddress(GetModuleHandleA("ntdll.dll"), "NtWriteVirtualMemory"); } pNtReadVirtualMemory pfnNtReadVirtualMemory; pNtWriteVirtualMemory pfnNtWriteVirtualMemory; }; struct ProcessModule { uintptr_t base, size; }; class pProcess { public: DWORD pid_; // process id HANDLE handle_; // handle to process HWND hwnd_; // window handle ProcessModule base_client_; public: bool AttachProcess(const char* process_name); bool AttachProcessHj(const char* process_name); bool AttachWindow(const char* window_name); bool UpdateHWND(); void Close(); public: ProcessModule GetModule(const char* module_name); LPVOID Allocate(size_t size_in_bytes); uintptr_t FindCodeCave(uint32_t length_in_bytes); uintptr_t FindSignature(std::vector signature); uintptr_t FindSignature(ProcessModule target_module, std::vector signature); template uintptr_t ReadOffsetFromSignature(std::vector signature, uint8_t offset) // offset example: "FF 05 ->22628B01<-" offset is 2 { uintptr_t pattern_address = this->FindSignature(signature); if (!pattern_address) return 0x0; T offset_value = this->read(pattern_address + offset); return pattern_address + offset_value + offset + sizeof(T); } bool read_raw(uintptr_t address, void* buffer, size_t size) { SIZE_T bytesRead; pMemory cMemory; if (cMemory.pfnNtReadVirtualMemory(this->handle_, (PVOID)(address), buffer, static_cast(size), (PULONG)&bytesRead)) { return bytesRead == size; } return false; } template void write(uintptr_t address, T value) { pMemory cMemory; cMemory.pfnNtWriteVirtualMemory(handle_, (void*)address, &value, sizeof(T), 0); } template T read(uintptr_t address) { T buffer{}; pMemory cMemory; cMemory.pfnNtReadVirtualMemory(handle_, (void*)address, &buffer, sizeof(T), 0); return buffer; } void write_bytes(uintptr_t addr, std::vector patch) { pMemory cMemory; cMemory.pfnNtWriteVirtualMemory(handle_, (void*)addr, &patch[0], patch.size(), 0); } uintptr_t read_multi_address(uintptr_t ptr, std::vector offsets) { uintptr_t buffer = ptr; for (int i = 0; i < offsets.size(); i++) buffer = this->read(buffer + offsets[i]); return buffer; } template T read_multi(uintptr_t base, std::vector offsets) { uintptr_t buffer = base; for (int i = 0; i < offsets.size() - 1; i++) { buffer = this->read(buffer + offsets[i]); } return this->read(buffer + offsets.back()); } private: uint32_t FindProcessIdByProcessName(const char* process_name); uint32_t FindProcessIdByWindowName(const char* window_name); HWND GetWindowHandleFromProcessId(DWORD ProcessId); }; #endif