Creating your first C++ dll hack

[JoshRose]

This is a follow on to my tutorial of game hacking with Vb.net. All of the code here is mine and not copy/pasted. Credit will be given where due to people who helped me with things that i will now help you with.

Okay so here goes:

First, load up Visual Studio or whatever it is you use and create a new "Win32 Application", set Application type to "DLL" and tick "Empty project".

Now we are ready.

Create a new SOURCE file called "main.cpp" and inside that, type this at the very top:

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#include <float.h>
using namespace std;

This will incude all your typical headers.

Now, since this is a DLL, we are going to want to have functions that we can turn on or off so we need to create some new threads.

First and foremost, you must type this just below your includes:

BOOL WINAPI DllMain (HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved)
{
    if (dwAttached == DLL_PROCESS_ATTACH) {
        CreateThread(NULL,0,&LoopFunction,NULL,0,NULL);
    }
    return 1;
}

In simple terms, it says, upon the attachment of this DLL to a process, create a new thread called "LoopFunction"

simple right......

Now, the reason we have created this thread is becuase we need to continually loop around so we can detect when a certain key has been pressed. We will come onto this later.

So, you need this code above the code you just typed:

 DWORD WINAPI LoopFunction( LPVOID lpParam  )
{
//some CPU relief
    Sleep(200);
}


}
return 0;
}

Now, for my example, i will be locking the X-hairs in the game BF2142

Here we go....

Underneath the line

 DWORD WINAPI LoopFunction( LPVOID lpParam  ) {

copy this:

    BYTE StandingON[] = {0x8B, 0x02, 0x90};
    BYTE CrouchingON[] = {0x8B, 0x11, 0x90};
    BYTE ProneON[] = {0x8B, 0x08, 0x90};
    BYTE StandingOFF[] = {0x8B, 0x42, 0x4C};
    BYTE CrouchingOFF[] = {0x8B, 0x51, 0x50};
    BYTE ProneOFF[] = {0x8B, 0x48, 0x54};

This is defining a phrase as an array of bytes thus making our writeprocessmemory tasks much easier.

Once you have done that, put this underneath:

 bool CrosshairOn = false;

Here we are using a boolean to determine or set the status of our hack. The reason we put it here is so that when we first attach our dll it sets the boolean to false, meaning out hack is not active. We will later set it to true so that our hack turns on.....

After that line, leave a few lines and paste:

HANDLE bf2142 = GetCurrentProcess();

Due to the fatc we are using a DLL we are already inside the process and therefore can get the pid and other things very easily using this line of code.

Once again leave a few more lines and paste this:

if (GetAsyncKeyState(VK_F1)&0x80000)
{
    if (CrosshairOn ==  true) {
        WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingOFF, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingOFF, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneOFF, 3, 0);
        CrosshairOn = false;

    }
    else if( CrosshairOn ==  false ) {
        WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingON, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingON, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneON, 3, 0);
        CrosshairOn ==  true
    }

}

Here we are using our boolean.
Basically what it is doing is:

If the bool CrosshairOn = false then it knows that the hack is inactive and thus performs the writememoryprocesses using the correct array of bytes that will lock my X-Hair at all times. If it finds that the bool CrosshairOn = true, then it does the opposite and writes the original bytes back to the correct offsets, thus making my x-hair return to normal.

You can add other hacks by doing this:

if (GetAsyncKeyState(VK_F2)&0x80000)
{
   

}

your finished code will look something along the lines of:

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#include <float.h>
using namespace std;

DWORD WINAPI LoopFunction( LPVOID lpParam )
{

    BYTE StandingON[] = {0x8B, 0x02, 0x90};
    BYTE CrouchingON[] = {0x8B, 0x11, 0x90};
    BYTE ProneON[] = {0x8B, 0x08, 0x90};
    BYTE StandingOFF[] = {0x8B, 0x42, 0x4C};
    BYTE CrouchingOFF[] = {0x8B, 0x51, 0x50};
    BYTE ProneOFF[] = {0x8B, 0x48, 0x54};

    bool Crosshair = false;

    HANDLE bf2142 = GetCurrentProcess();

    while(1) {
        if (GetAsyncKeyState(VK_F1)&0x80000) {
            if (Crosshair == true) {
                WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingOFF, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingOFF, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneOFF, 3, 0);
                Crosshair = false;

            }
            else if( Crosshair == false) {
                WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingON, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingON, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneON, 3, 0);
                Crosshair = true;
            }

        }
    }
//some CPU relief
    Sleep(200);
    return 0;
}

BOOL WINAPI DllMain (HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved)
{
    if (dwAttached == DLL_PROCESS_ATTACH) {
        CreateThread(NULL,0,&LoopFunction,NULL,0,NULL);
    }
    return 1;
}

That covers the very basics of creating your first hack in C++, just post any questions



Credits:
Zoomgod
raiders
ReUnioN

All of the above helped and are still helping me learn.

[Alkatraz]

Nice tutorial man, love it when guys actually make a tutorial instead of just posting code and saying have fun. Makes it easier on the guys trying to learn..

+rep for this.

[Roverturbo]

You might want to also tell people how the execute their first C+P hack because double clicking a Dynamic-Link Library will not make it magically write itself into a processes memory space and execute.

Thanks for posting something to help the newbies.

Originally Posted by jjrose54

just post any questions

WriteProcessMemory(...) when your code is running inside the processes memory your editing? memcpy... pointers...

[d1gitalSLR]

There is one thing off about this tutorial. Its that you give them the minimap yet you lock the X-Hairs. That may confuse a beginner and then they will come back with "It doesent work I get a error C2065: 'StandingOFF' : undeclared identifier error.

But still its a great tutorial for some beginners that have some background in what they are doing.

A++ Tutorial and +rep!

[nerrAd]

Very nice tutorial that gets right down to the bare stuff for beginners like me! I wish more tutorials were like this! Unforunately I don't play or have BF2142 so cannot test if I done it correctly!

I am currently reading several C++ books by Ivor Horton (currently half way through Beginning ANSI C++ and have Beginning Visual C++ 2008 set aside for after!) and Secrets of Reserve Engineering by Eldad Eilam. All recommended somewhere on this forum, I think. Only need to find some good D3D9 books now!
I've been surfing these forums for several months and having a read of source code, etc that I don't even have understand!

More tutorials like this but for CSS or BF2 would be very much appreciated and helpful!

[jimix]

okey,but how i can save and use this????

[JoshRose]

Originally Posted by jimix

okey,but how i can save and use this????

What do you mean save and use?

Go download MS VC++, read the tutorial, do everything as read the tutorial. Add or edit any code you want then save all and build

[jancsies]

1. question: Put the main.cpp to the Source files or to the root folder?
2. question: when I made the dll file where to put it or what to do with that?

[JoshRose]

Originally Posted by jancsies

1. question: Put the main.cpp to the Source files or to the root folder?
2. question: when I made the dll file where to put it or what to do with that?

Create a new empty dll in MS VC++.

In the Solution explorer you will see a directory tree, right click "Source Files" and press:

Add -> New Item -> C++ File (cpp)

name it "main.cpp" and put the code in there.

Once you have successfully compiled your dll, you need a program just as Winject so that you can 'Inject' your newly created dll into the procees of the game you wish to hack

Regards
Josh

[3p1c]

Originally Posted by Roverturbo

You might want to also tell people how the execute their first C+P hack because double clicking a Dynamic-Link Library will not make it magically write itself into a processes memory space and execute.

Thanks for posting something to help the newbies.



WriteProcessMemory(...) when your code is running inside the processes memory your editing? memcpy... pointers...

Using WPM is essentially the same as virtual protect and memcpy. Depending on what your doing the overhead is not that big of deal. Maybe I am wrong. What is your resoning for memcpy rather than WPM? I mean we are coding for a windows environment so IDK.

[learn_more]

Originally Posted by jaroldoshoot54

Using WPM is essentially the same as virtual protect and memcpy. Depending on what your doing the overhead is not that big of deal. Maybe I am wrong. What is your resoning for memcpy rather than WPM? I mean we are coding for a windows environment so IDK.

writeprocessmemory is calling ring 0 functions,

memcyp isnt (unless you virtualprotect ofc)

[Breeze]

Good tut

[AndrewThomas]

Originally Posted by jaroldoshoot54

Using WPM is essentially the same as virtual protect and memcpy. Depending on what your doing the overhead is not that big of deal. Maybe I am wrong. What is your resoning for memcpy rather than WPM? I mean we are coding for a windows environment so IDK.

A ) Anti-hack systems will hook WriteProcessMemory
B ) It's more proper, quicker, and doesn't make any calls the the kernel
C ) Looks neater, doesn't require a handle to the address space, also only has 3 params opposed to 5.

There are several other reasons, but I'm not writing a book on it :S


Not to get off-topic, great tut, only thing I disagree with is your use of WriteProcessMemory. Also, instead of including the whole std namepace in the cpp file, you really should only use it in functions that make constant use of it, like a logging function.

[x3res]

i got error like this:

1>------ Build started: Project: proper, Configuration: Debug Win32 ------
1>Compiling...
1>main.cpp
1>c:\documents and settings\arek\moje dokumenty\visual studio 2005\projects\proper\proper\main.cpp(1) : fatal error C1083: Cannot open include file: 'windows.h': No such file or directory
1>Build log was saved at "file://c:\Documents and Settings\arek\Moje dokumenty\Visual Studio 2005\Projects\proper\proper\Debug\BuildLog.htm"
1>proper - 1 error(s), 0 warning(s)
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========


and my script looks like this:

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#include <float.h>
using namespace std;
DWORD WINAPI LoopFunction( LPVOID lpParam ) {


//some CPU relief
Sleep(200);

}
}
return 0;
}
BOOL WINAPI DllMain (HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved) {
if (dwAttached == DLL_PROCESS_ATTACH) {
CreateThread(NULL,0,&LoopFunction,NULL,0,NULL);

}
return 1;
}
DWORD WINAPI LoopFunction( LPVOID lpParam ) {

BYTE MiniMapInfantryON[] = {0x17};
BYTE MiniMapVehicleON[] = {0x90, 0x90};
BYTE MiniMapInfantryOFF[] = {0x18};
BYTE MiniMapVehicleOFF[] = {0x75, 0x09};
bool CrosshairOn = false;



HANDLE bf2142 = GetCurrentProcess();
if (GetAsyncKeyState(VK_F1)&0x80000)
{
if (CrosshairOn)
{
WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingOFF, 3, 0);
WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingOFF, 3, 0);
WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneOFF, 3, 0);


}
else
{
WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingON, 3, 0);
WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingON, 3, 0);
WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneON, 3, 0);
}

CrosshairOn = !CrosshairOn;

}



anyone know what is wrong?

[JoshRose]

Originally Posted by x3res

anyone know what is wrong?

You don't know what you are doing

1) You have the loop function in their twice, and they are both wrong anyway
2) When you get it to compile you don't have a dllmain so it won't work
3) Although i made a mistake in the tutorial and named something wrong, you have obvs just C&P all of it (badly may i add) and not realised the rather obvious mistake

But, everyone must start somewhere, try this:

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#include <float.h>
using namespace std;

DWORD WINAPI LoopFunction( LPVOID lpParam )
{

    BYTE StandingON[] = {0x8B, 0x02, 0x90};
    BYTE CrouchingON[] = {0x8B, 0x11, 0x90};
    BYTE ProneON[] = {0x8B, 0x08, 0x90};
    BYTE StandingOFF[] = {0x8B, 0x42, 0x4C};
    BYTE CrouchingOFF[] = {0x8B, 0x51, 0x50};
    BYTE ProneOFF[] = {0x8B, 0x48, 0x54};

    bool Crosshair = false;

    HANDLE bf2142 = GetCurrentProcess();

    while(1) {
        if (GetAsyncKeyState(VK_F1)&0x80000) {
            if (Crosshair == true) {
                WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingOFF, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingOFF, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneOFF, 3, 0);
                Crosshair = false;

            }
            else if( Crosshair == false) {
                WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingON, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingON, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneON, 3, 0);
                Crosshair = true;
            }

        }
    }
//some CPU relief
    Sleep(200);
    return 0;
}

There is no DLLMain in that code i just gave you, but the tutorial shows you what to do.

[Winslow]

Originally Posted by x3res

i got error like this:

1>------ Build started: Project: proper, Configuration: Debug Win32 ------
1>Compiling...
1>main.cpp
1>c:\documents and settings\arek\moje dokumenty\visual studio 2005\projects\proper\proper\main.cpp(1) : fatal error C1083: Cannot open include file: 'windows.h': No such file or directory
1>Build log was saved at "file://c:\Documents and Settings\arek\Moje dokumenty\Visual Studio 2005\Projects\proper\proper\Debug\BuildLog.htm"
1>proper - 1 error(s), 0 warning(s)
========== Build: 0 succeeded, 1 failed, 0 up-to-date, 0 skipped ==========

Do you have Microsoft SDK installed? http://www.microsoft.com/downloads/d...displaylang=en

Are your directories set up correctly? Tools >> Options >> Projects and Solutions >> VC++ Directories ...


That should get rid of the specific error you're getting.
Also read what Jose said to fix the other errors you're going to get

[JoshRose]

Originally Posted by Winslow

Also read what Jose said to fix the other errors you're going to get

Hmm, i quite like that name, José, very cool

[explorerkelo]

Originally Posted by JoshRose

This is a follow on to my tutorial of game hacking with Vb.net. All of the code here is mine and not copy/pasted. Credit will be given where due to people who helped me with things that i will now help you with.

Okay so here goes:

First, load up Visual Studio or whatever it is you use and create a new "Win32 Application", set Application type to "DLL" and tick "Empty project".

Now we are ready.

Create a new SOURCE file called "main.cpp" and inside that, type this at the very top:

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#include <float.h>
using namespace std;

This will incude all your typical headers.

Now, since this is a DLL, we are going to want to have functions that we can turn on or off so we need to create some new threads.

First and foremost, you must type this just below your includes:

BOOL WINAPI DllMain (HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved)
{
    if (dwAttached == DLL_PROCESS_ATTACH) {
        CreateThread(NULL,0,&LoopFunction,NULL,0,NULL);
    }
    return 1;
}

In simple terms, it says, upon the attachment of this DLL to a process, create a new thread called "LoopFunction"

simple right......

Now, the reason we have created this thread is becuase we need to continually loop around so we can detect when a certain key has been pressed. We will come onto this later.

So, you need this code above the code you just typed:

 DWORD WINAPI LoopFunction( LPVOID lpParam  )
{
//some CPU relief
    Sleep(200);
}


}
return 0;
}

Now, for my example, i will be locking the X-hairs in the game BF2142

Here we go....

Underneath the line

 DWORD WINAPI LoopFunction( LPVOID lpParam  ) {

copy this:

    BYTE StandingON[] = {0x8B, 0x02, 0x90};
    BYTE CrouchingON[] = {0x8B, 0x11, 0x90};
    BYTE ProneON[] = {0x8B, 0x08, 0x90};
    BYTE StandingOFF[] = {0x8B, 0x42, 0x4C};
    BYTE CrouchingOFF[] = {0x8B, 0x51, 0x50};
    BYTE ProneOFF[] = {0x8B, 0x48, 0x54};

This is defining a phrase as an array of bytes thus making our writeprocessmemory tasks much easier.

Once you have done that, put this underneath:

 bool CrosshairOn = false;

Here we are using a boolean to determine or set the status of our hack. The reason we put it here is so that when we first attach our dll it sets the boolean to false, meaning out hack is not active. We will later set it to true so that our hack turns on.....

After that line, leave a few lines and paste:

HANDLE bf2142 = GetCurrentProcess();

Due to the fatc we are using a DLL we are already inside the process and therefore can get the pid and other things very easily using this line of code.

Once again leave a few more lines and paste this:

if (GetAsyncKeyState(VK_F1)&0x80000)
{
    if (CrosshairOn ==  true) {
        WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingOFF, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingOFF, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneOFF, 3, 0);
        CrosshairOn = false;

    }
    else if( CrosshairOn ==  false ) {
        WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingON, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingON, 3, 0);
        WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneON, 3, 0);
        CrosshairOn ==  true
    }

}

Here we are using our boolean.
Basically what it is doing is:

If the bool CrosshairOn = false then it knows that the hack is inactive and thus performs the writememoryprocesses using the correct array of bytes that will lock my X-Hair at all times. If it finds that the bool CrosshairOn = true, then it does the opposite and writes the original bytes back to the correct offsets, thus making my x-hair return to normal.

You can add other hacks by doing this:

if (GetAsyncKeyState(VK_F2)&0x80000)
{
   

}

your finished code will look something along the lines of:

#include <windows.h>
#include <stdio.h>
#include <iostream>
#include <conio.h>
#include <string>
#include <fstream>
#include <float.h>
using namespace std;

DWORD WINAPI LoopFunction( LPVOID lpParam )
{

    BYTE StandingON[] = {0x8B, 0x02, 0x90};
    BYTE CrouchingON[] = {0x8B, 0x11, 0x90};
    BYTE ProneON[] = {0x8B, 0x08, 0x90};
    BYTE StandingOFF[] = {0x8B, 0x42, 0x4C};
    BYTE CrouchingOFF[] = {0x8B, 0x51, 0x50};
    BYTE ProneOFF[] = {0x8B, 0x48, 0x54};

    bool Crosshair = false;

    HANDLE bf2142 = GetCurrentProcess();

    while(1) {
        if (GetAsyncKeyState(VK_F1)&0x80000) {
            if (Crosshair == true) {
                WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingOFF, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingOFF, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneOFF, 3, 0);
                Crosshair = false;

            }
            else if( Crosshair == false) {
                WriteProcessMemory(bf2142, (void*)(0x05E2C88), &StandingON, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C93), &CrouchingON, 3, 0);
                WriteProcessMemory(bf2142, (void*)(0x05E2C9E), &ProneON, 3, 0);
                Crosshair = true;
            }

        }
    }
//some CPU relief
    Sleep(200);
    return 0;
}

BOOL WINAPI DllMain (HINSTANCE hModule, DWORD dwAttached, LPVOID lpvReserved)
{
    if (dwAttached == DLL_PROCESS_ATTACH) {
        CreateThread(NULL,0,&LoopFunction,NULL,0,NULL);
    }
    return 1;
}

That covers the very basics of creating your first hack in C++, just post any questions



Credits:
Zoomgod
raiders
ReUnioN

All of the above helped and are still helping me learn.

nice, How do I Create a new SOURCE file called "main.cpp" ?

[CRYSIS2000]

Originally Posted by explorerkelo

nice, How do I Create a new SOURCE file called "main.cpp" ?

Solved on xfire.

[FreakBoy]

Question,

Does the "main.cpp" go into the "Header Files" (Folder) or just sit out all alone by it self?

Also will and injector basically work to inject this .dll?

Any help would be appreciated.




UPDATE:

I think I found my answer, lol I just had to re-read all these posts 3 more times.

Thanks