[tutor]membuat dll injection

#define _crt_secure_no_warnings
#include <windows.h>
#include <tlhelp32.h>

// definisikan variable dengan 'window title', 'window classname' dan modul
char *pprocesswindowtitle = "point blank";
char *pprocesswindowclass = "i3viewer";
char *pprocessmodulename = "pointblank.i3exec";

// etc...
uint_ptr uipuserrankvalue = 35; // major? <img src="http://forum-indonesia.com/wp-includes/images/smilies/icon_biggrin.gif" alt="" class="wp-smiley">
uint_ptr uipuserpointsvalue = 999999; // omg!

uint_ptr uiptrfinalrank, uiptrfinalpoints;

bool isinitmmhmemory = true;

dword dwprocessid;
uint_ptr uipmmhbaseaddress;
handle hprocess;

dword getmodulebase(lpstr lpmodulename, dword dwprocessid)
{
moduleentry32 lpmoduleentry = {0};
handle hsnapshot = createtoolhelp32snapshot(th32cs_snapmodule, dwprocessid);

if(!hsnapshot)
return null;
lpmoduleentry.dwsize = sizeof(lpmoduleentry);
bool bmodule = module32first( hsnapshot, &lpmoduleentry );
while(bmodule)
{
if(!strcmp( lpmoduleentry.szmodule, lpmodulename ) )
{
closehandle(hsnapshot);
return (dword)lpmoduleentry.modbaseaddr;
}
bmodule = module32next( hsnapshot, &lpmoduleentry );
}
closehandle( hsnapshot );
return null;
}

// deref() = credit l. spiro (mhs)
uint_ptr deref( uint_ptr _uiptrpointer ) {
uint_ptr uiptrret;
if (!::readprocessmemory(hprocess, reinterpret_cast<lpvoid>(_uiptrpointer), &uiptrret, sizeof(uiptrret), null)) { return 0ul; }
return uiptrret;
}

// inisialisasi proses
void initapplicationprocess()
{
bool isfindwindow = true;
hwnd hwnd = null;

while(isfindwindow)
{
if((hwnd = findwindowa(pprocesswindowclass, pprocesswindowtitle)) != null) // jika window ditemukan
{
isfindwindow = false;
}
sleep(500);
}

getwindowthreadprocessid(hwnd, &dwprocessid);
hprocess = openprocess(process_all_access|process_vm_operation|process_vm_read|process_vm_write|process_query_information, false, dwprocessid);
}

void majormissionhack()
{
if(isinitmmhmemory)
{
uipmmhbaseaddress = getmodulebase(pprocessmodulename, dwprocessid);

// misal: pointer yang didapat = pointblank.i3exec+00471234 dengan offset 0xa12, tuliskan seperti di bawah!
uiptrfinalrank = deref(uipmmhbaseaddress + 0x4xxxxx) + 0xxxx; // user rank pointer - masked, sorry!
uiptrfinalpoints = deref(uipmmhbaseaddress + 0x4xxxxx) + 0xxxx; // user points pointer - masked, sorry!

isinitmmhmemory = false;
}

// writeprocessmemory pada pointer 'rank', berikan nilai uipuserrankvalue (35)
::writeprocessmemory(hprocess, reinterpret_cast<lpvoid>(uiptrfinalrank), &uipuserrankvalue, sizeof(uipuserrankvalue), null);

// writeprocessmemory pada pointer 'points', berikan nilai uipuserpointsvalue (999999) lol!
::writeprocessmemory(hprocess, reinterpret_cast<lpvoid>(uiptrfinalpoints), &uipuserpointsvalue, sizeof(uipuserpointsvalue), null);
}

void lovelyloopy()
{
// ok, berikan salam dulu! <img src="http://forum-indonesia.com/wp-includes/images/smilies/icon_biggrin.gif" alt="" class="wp-smiley">
messagebox(0, "dll berhasil di-inject. lanjutkan!", "hello world", mb_ok + mb_iconasterisk);

initapplicationprocess();

while(1) // loop selamanya <img src="http://forum-indonesia.com/wp-includes/images/smilies/icon_biggrin.gif" alt="" class="wp-smiley">
{
if(getasynckeystate(vk_f12)&1) // jika f12 ditekan
{
majormissionhack(); // panggil fungsi 'majormissionhack()'
sleep(500);
}

sleep(1);
}
}

bool winapi dllmain(hmodule hdll, dword dwreason, lpvoid lpreserved)
{
disablethreadlibrarycalls(hdll);

if(dwreason == dll_process_attach)
{
createthread(null, null, (lpthread_start_routine)lovelyloopy, null, null, null);
}
else if(dwreason == dll_process_detach)
{
closehandle(hprocess);
}

return true;
}