Wesnoth 해킹하기 (7) External Memory Hack 짜기

저번 시간에 Wesnoth의 디버깅을 실시함으로써 골드라는 재화가 *(*(0x17EECB8 + 0x60) + 0xA90)+0x4에 저장되어 있음을 알았다. 이번 시간에는 C++로 골드를 변경하는 핵을 만들 것이다.

 

핵을 만들기 위해 Windows API를 사용할 것인데 필요한 함수는 아래와 같다:

HWND FindWindow(
    LPCWSTR lpClassName,
    LPCWSTR lpWindowName
);

HANDLE OpenProcess(
    DWORD dwDesiredAccess,
    BOOL  bInheritHandle,
    DWORD dwProcessId
);

 

BOOL ReadProcessMemory(
    HANDLE  hProcess,
    LPCVOID lpBaseAddress,
    LPVOID  lpBuffer,
    SIZE_T  nSize,
    SIZE_T  *lpNumberOfBytesRead
);

 

BOOL WriteProcessMemory(
    HANDLE  hProcess,
    LPVOID  lpBaseAddress,
    LPCVOID lpBuffer,
    SIZE_T  nSize,
    SIZE_T  *lpNumberOfBytesWritten
);

---

최종 코드

#include <Windows.h>

int main(int argc, char** argv) {
	// prefix L casts char* to const wchar_t*.
	HWND wesnoth_window = FindWindow(NULL, L"The Battle for Wesnoth - 1.14.9");

	DWORD process_id = 0;
	GetWindowThreadProcessId(wesnoth_window, &process_id);

	HANDLE wesnoth_process = OpenProcess(PROCESS_ALL_ACCESS, true, process_id);

	DWORD gold_address = 0;
	DWORD gold_value = 0;
	DWORD bytes_read = 0;
	ReadProcessMemory(wesnoth_process, (LPCVOID) (0x017EECB8 + 0x60), &gold_address, 4, &bytes_read);
	gold_address += 0xA90;
	ReadProcessMemory(wesnoth_process, (LPCVOID)gold_address, &gold_address, 4, &bytes_read);
	gold_address += 0x4;
	ReadProcessMemory(wesnoth_process, (LPCVOID)gold_address, &gold_value, 4, &bytes_read);

	DWORD new_gold_value = 999;
	DWORD bytes_written = 0;
	WriteProcessMemory(wesnoth_process, (LPVOID)gold_address, &new_gold_value, 4, &bytes_written);

	return 0;
}