[Source] How to patch Bytes using PatternScan (AOB) + Explanation / Snippet topic

Hey guys!
@DarkLinuxz 's idea of trying to teach people how to do their stuff instead of just releasing his work, also made me reconsider releasing multiple stuff. So here we go with more info sharing!

None of the Source is mine, im only sharing it and explaining how to use it. Use at your own risk! If you can't understand this info, either post a comment or go learn the basics.

Step 1: We are first going to find the Adress where we want to set the NOP. (There are Plenty of tutorials in for MemoryScanning: Click )
I'll be doing this in ollydbg using a nice Plugin Called SigMaker (Click)



Step 2: We will record our BYTE PATTERN and BYTE MASK (Make sure you know where in the pattern is the byte you want to. Make sure there is only one combination of this pattern.



Step 3: CopyPaste codenz and put your signature and mask and all the information. Its all explained with comments:

PHP Code:

---


#include <Windows.h>

#include <iostream>  

#include "Functions.h"

using namespace std;


//Define all Here, its easier.

char BytesToPatch[] = "\x90\x90"; //What we are replacing with, for example \x90\ = NOP.

char ProcessName[] = "TheCodenZ.exe"; //Processname

char BytePattern[] = "\xFF\x0E\x8D\x74\x24\x24\xE8\x00\x00\x00\x00\x5F\x5E\xB0\x01\x5B\x8B\xE5\x5D\xC2\x04\x00"; //Our Pattern

char ByteMask[] = "xxxxxxx????xxxxxxxxxxx"; //Our Mask

int Position = 0; //0 means first.

int NoOfBytes = 2;


//Our Main Function

void InitiatePatch()

{    

    DWORD Bytes = FindPattern(ProcessName, BytePattern, ByteMask);

    Bytes+= Position;

    WriteToMemory(Bytes, BytesToPatch, NoOfBytes);

        

} 





---

And you will need the header file:

PHP Code:

---


#include <iostream>

#include <Windows.h>

#include <tlhelp32.h>

#include <Psapi.h>




//Get all module related info, this will include the base DLL. 

//and the size of the module

MODULEINFO GetModuleInfo( char *szModule )

{

    MODULEINFO modinfo = {0};

    HMODULE hModule = GetModuleHandle(szModule);

    if(hModule == 0) 

        return modinfo;

    GetModuleInformation(GetCurrentProcess(), hModule, &modinfo, sizeof(MODULEINFO));

    return modinfo;

}



void WriteToMemory(uintptr_t addressToWrite, char* valueToWrite, int byteNum)

{

    //used to change our file access type, stores the old

    //access type and restores it after memory is written

    unsigned long OldProtection;

    //give that address read and write permissions and store the old permissions at oldProtection

    VirtualProtect((LPVOID)(addressToWrite), byteNum, PAGE_EXECUTE_READWRITE, &OldProtection);


    //write the memory into the program and overwrite previous value

    memcpy( (LPVOID)addressToWrite, valueToWrite, byteNum);


    //reset the permissions of the address back to oldProtection after writting memory

    VirtualProtect((LPVOID)(addressToWrite), byteNum, OldProtection, NULL);

}



DWORD FindPattern(char *module, char *pattern, char *mask)

{

    //Get all module related information

    MODULEINFO mInfo = GetModuleInfo(module);


    //Assign our base and module size

    //Having the values right is ESSENTIAL, this makes sure

    //that we don't scan unwanted memory and leading our game to crash

    DWORD base = (DWORD)mInfo.lpBaseOfDll;

    DWORD size =  (DWORD)mInfo.SizeOfImage;


    //Get length for our mask, this will allow us to loop through our array

    DWORD patternLength = (DWORD)strlen(mask);


    for(DWORD i = 0; i < size - patternLength; i++)

    {

        bool found = true;

        for(DWORD j = 0; j < patternLength; j++)

        {

            //if we have a ? in our mask then we have true by default, 

            //or if the bytes match then we keep searching until finding it or not

            found &= mask[j] == '?' || pattern[j] == *(char*)(base + i + j);

        }


        //found = true, our entire pattern was found

        //return the memory addy so we can write to it

        if(found) 

        {

            return base + i;

        }

    }


    return NULL;

} 





---