Örnek olarak bu tarz birşey arıyorsun gibi asm siz imkansız...
private void MultiClient(IntPtr SroProcessHandle)
{
uint MultiClientCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, 45, 0x1000, 0x4);
uint MACCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, 4, 0x1000, 0x4);
uint GTC = GetProcAddress(GetModuleHandle("kernel32.dll"), "GetTickCount");
byte[] CallBack = BitConverter.GetBytes(MultiClientCodeCave + 41);
byte[] CALLForward = BitConverter.GetBytes(CallForwardAddress - MultiClientCodeCave - 34);
byte[] MACAddress = BitConverter.GetBytes(MACCodeCave);
byte[] GTCAddress = BitConverter.GetBytes(GTC - MultiClientCodeCave - 18);
byte[] MultiClientArray = BitConverter.GetBytes(MultiClientCodeCave - MultiClientAddress - 5);
byte[] MultiClientCodeArray = { 0xE8, MultiClientArray[0], MultiClientArray[1], MultiClientArray[2], MultiClientArray[3] };
byte[] MultiClientCode = { 0x8F, 0x05, CallBack[0], CallBack[1], CallBack[2], CallBack[3], //POP DWORD PTR DS:[xxxxxxxx]
0xA3, MACAddress[0], MACAddress[1], MACAddress[2], MACAddress[3], //MOV DWORD PTR DS:[xxxxxxxx],EAX
0x60, //PUSHAD
0x9C, //PUSHFD
0xE8, GTCAddress[0], GTCAddress[1], GTCAddress[2], GTCAddress[3], // Call KERNEL32.gettickcount
0x8B, 0x0D, MACAddress[0], MACAddress[1], MACAddress[2], MACAddress[3], //MOV ECX,DWORD PTR DS:[xxxxxxxx]
0x89, 0x41, 0x02, // MOV DWORD PTR DS:[ECX+2],EAX
0x9D, //POPFD
0x61, //POPAD
0xE8, CALLForward[0], CALLForward[1], CALLForward[2], CALLForward[3], //CALL xxxxxxxx
0xFF, 0x35, CallBack[0], CallBack[1], CallBack[2], CallBack[3], // PUSH DWORD PTR DS:[xxxxxxxx]
0xC3 //RETN
};
WriteProcessMemory(SroProcessHandle, MultiClientCodeCave, MultiClientCode, MultiClientCode.Length, ByteArray);
WriteProcessMemory(SroProcessHandle, MultiClientAddress, MultiClientCodeArray, MultiClientCodeArray.Length, ByteArray);
}
private void StartingTextMSG(IntPtr SroProcessHandle, string StartingText, byte[] HexColor)
{
string ChangeVersionString = "Dev";
uint StartingMSGStringCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, StartingText.Length, 0x1000, 0x4);
uint ChangeVersionStringCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, StartingText.Length, 0x1000, 0x4);
byte[] StartingMSGByteArray = Encoding.Unicode.GetBytes(StartingText);
byte[] ChangeVersionByteArray = Encoding.Unicode.GetBytes(ChangeVersionString);
byte[] CallStartingMSG = BitConverter.GetBytes(StartingMSGStringCodeCave);
byte[] CallChangeVersion = BitConverter.GetBytes(ChangeVersionStringCodeCave);
byte[] StartingMSGCodeArray = { 0xB8, CallStartingMSG[0], CallStartingMSG[1], CallStartingMSG[2], CallStartingMSG[3] };
byte[] ChangeVersionCodeArray = { 0x68, CallChangeVersion[0], CallChangeVersion[1], CallChangeVersion[2], CallChangeVersion[3] };
WriteProcessMemory(SroProcessHandle, ChangeVersionStringCodeCave, ChangeVersionByteArray, ChangeVersionByteArray.Length, ByteArray);
WriteProcessMemory(SroProcessHandle, ChangeVersion, ChangeVersionCodeArray, ChangeVersionCodeArray.Length, ByteArray);
WriteProcessMemory(SroProcessHandle, ChangeVersion - 59, HexColor, HexColor.Length, ByteArray);
WriteProcessMemory(SroProcessHandle, StartingMSGStringCodeCave, StartingMSGByteArray, StartingMSGByteArray.Length, ByteArray);
WriteProcessMemory(SroProcessHandle, StartingMSG, StartingMSGCodeArray, StartingMSGCodeArray.Length, ByteArray);
WriteProcessMemory(SroProcessHandle, StartingMSG + 9, HexColor, HexColor.Length, ByteArray);
System.Environment.Exit(0);
}
private uint FindPattern(byte[] Pattern, byte[] FileByteArray, uint Result)
{
uint MyPosition = 0;
uint ResultCounter = 0;
for (uint PositionFileByteArray = 0; PositionFileByteArray < FileByteArray.Length - Pattern.Length; PositionFileByteArray++)
{
bool found = true;
for (uint PositionPattern = 0; PositionPattern < Pattern.Length; PositionPattern++)
{
if (FileByteArray[PositionFileByteArray + PositionPattern] != Pattern[PositionPattern])
{
found = false;
break;
}
}
if (found)
{
ResultCounter += 1;
if (Result == ResultCounter)
{
MyPosition = PositionFileByteArray;
break;
}
}
}
return MyPosition;
}
private uint FindStringPattern(byte[] StringByteArray, byte[] FileArray, uint BaseAddress, byte StringWorker, uint Result)
{
uint MyPosition = 0;
byte[] StringWorkerAddress = { StringWorker, 0x00, 0x00, 0x00, 0x00 };
byte[] StringAddress = new byte[4];
StringAddress = BitConverter.GetBytes(BaseAddress + FindPattern(StringByteArray, FileArray, 1));
StringWorkerAddress[1] = StringAddress[0];
StringWorkerAddress[2] = StringAddress[1];
StringWorkerAddress[3] = StringAddress[2];
StringWorkerAddress[4] = StringAddress[3];
MyPosition = BaseAddress + FindPattern(StringWorkerAddress, FileArray, Result);
return MyPosition;
}