C# hafıza programlama

       private void MultiClient(IntPtr SroProcessHandle)
        {
            uint MultiClientCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, 45, 0x1000, 0x4);
            uint MACCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, 4, 0x1000, 0x4);
            uint GTC = GetProcAddress(GetModuleHandle("kernel32.dll"), "GetTickCount");

            byte[] CallBack = BitConverter.GetBytes(MultiClientCodeCave + 41);
            byte[] CALLForward = BitConverter.GetBytes(CallForwardAddress - MultiClientCodeCave - 34);
            byte[] MACAddress = BitConverter.GetBytes(MACCodeCave);
            byte[] GTCAddress = BitConverter.GetBytes(GTC - MultiClientCodeCave - 18);

            byte[] MultiClientArray = BitConverter.GetBytes(MultiClientCodeCave - MultiClientAddress - 5);
            byte[] MultiClientCodeArray = { 0xE8, MultiClientArray[0], MultiClientArray[1], MultiClientArray[2], MultiClientArray[3] };

            byte[] MultiClientCode = {   0x8F, 0x05, CallBack[0], CallBack[1], CallBack[2], CallBack[3], //POP DWORD PTR DS:[xxxxxxxx]
                                         0xA3, MACAddress[0], MACAddress[1], MACAddress[2], MACAddress[3], //MOV DWORD PTR DS:[xxxxxxxx],EAX
                                         0x60, //PUSHAD
                                         0x9C, //PUSHFD
                                         0xE8, GTCAddress[0], GTCAddress[1], GTCAddress[2], GTCAddress[3], // Call KERNEL32.gettickcount
                                         0x8B, 0x0D, MACAddress[0], MACAddress[1], MACAddress[2], MACAddress[3], //MOV ECX,DWORD PTR DS:[xxxxxxxx]
                                         0x89, 0x41, 0x02, // MOV DWORD PTR DS:[ECX+2],EAX
                                         0x9D, //POPFD
                                         0x61, //POPAD
                                         0xE8, CALLForward[0], CALLForward[1], CALLForward[2], CALLForward[3], //CALL xxxxxxxx
                                         0xFF, 0x35, CallBack[0], CallBack[1], CallBack[2], CallBack[3], // PUSH DWORD PTR DS:[xxxxxxxx]
                                         0xC3 //RETN
                                       };

            WriteProcessMemory(SroProcessHandle, MultiClientCodeCave, MultiClientCode, MultiClientCode.Length, ByteArray);
            WriteProcessMemory(SroProcessHandle, MultiClientAddress, MultiClientCodeArray, MultiClientCodeArray.Length, ByteArray);
        }

        private void StartingTextMSG(IntPtr SroProcessHandle, string StartingText, byte[] HexColor)
        {
            string ChangeVersionString = "Dev";
            uint StartingMSGStringCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, StartingText.Length, 0x1000, 0x4);
            uint ChangeVersionStringCodeCave = VirtualAllocEx(SroProcessHandle, IntPtr.Zero, StartingText.Length, 0x1000, 0x4);
            byte[] StartingMSGByteArray = Encoding.Unicode.GetBytes(StartingText);
            byte[] ChangeVersionByteArray = Encoding.Unicode.GetBytes(ChangeVersionString);
            byte[] CallStartingMSG = BitConverter.GetBytes(StartingMSGStringCodeCave);
            byte[] CallChangeVersion = BitConverter.GetBytes(ChangeVersionStringCodeCave);
            byte[] StartingMSGCodeArray = { 0xB8, CallStartingMSG[0], CallStartingMSG[1], CallStartingMSG[2], CallStartingMSG[3] };
            byte[] ChangeVersionCodeArray = { 0x68, CallChangeVersion[0], CallChangeVersion[1], CallChangeVersion[2], CallChangeVersion[3] };
            WriteProcessMemory(SroProcessHandle, ChangeVersionStringCodeCave, ChangeVersionByteArray, ChangeVersionByteArray.Length, ByteArray);
            WriteProcessMemory(SroProcessHandle, ChangeVersion, ChangeVersionCodeArray, ChangeVersionCodeArray.Length, ByteArray);
            WriteProcessMemory(SroProcessHandle, ChangeVersion - 59, HexColor, HexColor.Length, ByteArray);
            WriteProcessMemory(SroProcessHandle, StartingMSGStringCodeCave, StartingMSGByteArray, StartingMSGByteArray.Length, ByteArray);
            WriteProcessMemory(SroProcessHandle, StartingMSG, StartingMSGCodeArray, StartingMSGCodeArray.Length, ByteArray);
            WriteProcessMemory(SroProcessHandle, StartingMSG + 9, HexColor, HexColor.Length, ByteArray);
            System.Environment.Exit(0); 
        }
        private uint FindPattern(byte[] Pattern, byte[] FileByteArray, uint Result)
        {
            uint MyPosition = 0;
            uint ResultCounter = 0;
            for (uint PositionFileByteArray = 0; PositionFileByteArray < FileByteArray.Length - Pattern.Length; PositionFileByteArray++)
            {
                bool found = true;
                for (uint PositionPattern = 0; PositionPattern < Pattern.Length; PositionPattern++)
                {
                    if (FileByteArray[PositionFileByteArray + PositionPattern] != Pattern[PositionPattern])
                    {
                        found = false;
                        break;
                    }
                }
                if (found)
                {
                    ResultCounter += 1;
                    if (Result == ResultCounter)
                    {
                        MyPosition = PositionFileByteArray;
                        break;
                    }
                }
            }
            return MyPosition;
        }
        private uint FindStringPattern(byte[] StringByteArray, byte[] FileArray, uint BaseAddress, byte StringWorker, uint Result)
        {
            uint MyPosition = 0;
            byte[] StringWorkerAddress = { StringWorker, 0x00, 0x00, 0x00, 0x00 };
            byte[] StringAddress = new byte[4];
            StringAddress = BitConverter.GetBytes(BaseAddress + FindPattern(StringByteArray, FileArray, 1));
            StringWorkerAddress[1] = StringAddress[0];
            StringWorkerAddress[2] = StringAddress[1];
            StringWorkerAddress[3] = StringAddress[2];
            StringWorkerAddress[4] = StringAddress[3];

            MyPosition = BaseAddress + FindPattern(StringWorkerAddress, FileArray, Result);
            return MyPosition;
        }

emrebeyoglu adlı üyeden alıntı: mesajı görüntüle

sen dll olarak yazdın galiba peki grafikleri falan nasil okuttun Q ve P nin altındaki adamı oraya nasil çizdirttin

bide exe olarak yaparsak knight exe den bunu açtırtmamız lazım clientin içine mi kopyalıycaz yazdığımız exeleri

not: mustafa(PENTAGRAM)'in mantığı (DirectX arayüzünü hooklama) yöntemi ile knight penceresine ve diğer tüm oyunlara müdahale edebiliyorum drawing kullanarak çizim yaptırtabiliyorum ama bana dinamik nesne lazım knightin loglarını görüntületebileceğim notice bar yapabileceğim nesneleri oraya entegre ettirmem gerekiyor araştırmalarım devam etmekte yardımlarınız ve yorumlarnız için teşekkürler..

00676219 > $^E9 7E53FDFF    JMP 0064B59C

0064B59C   > 55             PUSH EBP
0064B59D   . 8BEC           MOV EBP,ESP
0064B59F   . 6A FF          PUSH -1
0064B5A1   . 68 8CB56400    PUSH 0064B58C                   			; /FileName = "Client.dll"
0064B5A6   . FF15 00326A00  CALL DWORD PTR DS:[6A3200]					; \LoadLibraryA
0064B5AC   . 6A 01          PUSH 1                                   	; /IsShown = 1
0064B5AE   . 6A 00          PUSH 0                                   	; |DefDir = NULL
0064B5B0   . 68 CFB56400    PUSH 0064B5CF                   			; |Parameters = "EveryBodyFooL"
0064B5B5   . 68 E2B56400    PUSH 0064B5E2                   			; |FileName = "Client.exe"
0064B5BA   . 68 00646D00    PUSH 006D6400                   			; |Operation = "open"
0064B5BF   . 6A 00          PUSH 0                                   	; |hWnd = NULL
0064B5C1   . FF15 C4326A00  CALL DWORD PTR DS:[6A32C4]					; \ShellExecuteA
0064B5C7   . 6A 00          PUSH 0
0064B5C9   . E9 50AC0200    JMP 0067621E

0064B58C   . 43 6C 69 65 6E>ASCII "Client.dll",0
0064B5CF   . 45 76 65 72 79>ASCII "EveryBodyFooL",0
0064B5E2   . 43 6C 69 65 6E>ASCII "Client.exe",0