Windows

A simple and safe-ish memory reading and writing utility made in pure c and a small portion of assembly for syscalls.

As said before the utility uses syscalls for:

  • Opening and Closing the handle

  • Reading and Writing memory

  • Allocating memory

  • Querying memory

Note: This does not mean it's "undetected" it still calls functions like CreateToolhelp32Snapshotwhich can easily be detected

Getting started

This memory library revolves around one main struct called Process. Now when creating a new process the process is manually allocated and returned as a pointer so you will also need to free it. The Process struct inherits the handle, pid, baseAddress and baseSize.

struct Process {
    HANDLE handle;
    DWORD pid;
    uintptr_t baseAddress;
    uintptr_t baseSize;
}

But with a specific macro you can as well choose if the functions that you are gonna use are inside the struct or just a global variable

#define FUNCS // remove if you don't want the functions in the Process struct

struct Process {
    HANDLE handle;
    DWORD pid;
    uintptr_t baseAddress;
    uintptr_t baseSize;

    #ifdef FUNCS
        bool (*ReadMemory)(Process* process, uintptr_t address, void* out_buffer, size_t size);
        bool (*WriteMemory)(Process* process, uintptr_t address, void* data, size_t size);
        uintptr_t (*Rebase)(Process* process, uintptr_t address);
        uintptr_t (*PatternScan)(Process* proc, const char* pattern);
        Module* (*Module)(Process* process, const char* name);
        void* (*Allocate)(Process* process, SIZE_T size);
        void (*Terminate)(Process* process);
    #endif
};

#ifndef FUNCS
    uintptr_t rebase(Process* proc, uintptr_t address);
    bool write_memory(Process* proc, uintptr_t address, const void* data, size_t size);
    bool read_memory(Process* proc, uintptr_t address, void* out_buffer, size_t size);
    void terminate(Process* proc)
    uintptr_t find_pattern(Process* process, const char* pattern);
    Module* get_module(Process* process, const char* name);
    void* allocate_memory(Process* process, SIZE_T size);
#endif

In this example I will be focusing on the option where it is within the struct and not just a normal function.

Creating a new process

Creating a new process only requires it's name and the library will do the rest of it itself

Note that the program will automatically close if the program is not found

Process* proc = new_process("RobloxPlayerBeta.exe");

Reading memory

Reading memory using this library is fairly simple as it requires 4 main variables, the process pointer, the address you want to read, the buffer you want to read into, and the size of the type that you want to read.

uintptr_t fake;
proc->ReadMemory(proc, (proc->Rebase(proc, 0x67633D8)), &fake, sizeof(uintptr_t));

Writing memory

Writing memory is just as easy as reading memory ans it also just requires the same 4 variables, but in this cause there is no out buffer there is a data "buffer" which need to hold a valid value.

uintptr_t newValue = 1;
proc->WriteMemory(proc, fake, &newValue, sizeof(uintptr_t));

Rebase

Now as you have seen in ReadMemory there is also a function that lets you rebase a address.

uintptr_t rebased = proc->Rebase(proc, 0x67633D8);

Pattern scanning

Pattern scanning as well is pretty straight forward since you only need the process pointer and just the pattern you want to scan for 

uintptr_t address = proc->PatternScan(proc, "48 8B C4 44 89 48 ? 4C 89 40 ? 48 89 50 ? 48 89 48 ? 53");

To get the offset from the output address just do it like this

uintptr_t offset = (address - proc->baseAddress);
printf("0x%llx\n", offset);

Getting a module

Getting a loaded (e.g RobloxPlayerBeta.dll) is really simple and it returns a Module struct which contains the entry data itself (MODULEENTRY32) and the baseAddress of the loaded module directly.

typedef struct {
    MODULEENTRY32 entry;
    uintptr_t baseAddress;
} Module;
Module* player = proc->Module(proc, "RobloxPlayerBeta.dll");

Allocating memory

Allocating memory requires the size given in and that was about it

void* allocated = proc->Allocate(proc, 290);

Terminating the process

Terminating the process can be done using the Terminate method

proc->Terminate(proc);
PreviousHashmapNextLinux

Last updated