#include #include #include #include #include // Task is to pattern find this function and replace it with a subtraction. int add( int a, int b ) { return a + b; } // Writes an array of bytes to memory bool writeBytes( HANDLE handle, const void* address, const char* bytes, size_t length ) { return WriteProcessMemory( handle, (LPVOID)address, bytes, length, nullptr ); } // Reads an array of bytes from memory bool readBytes( HANDLE handle, const void* address, char* bytes, size_t length ) { return ReadProcessMemory( handle, (LPVOID)address, bytes, length, nullptr ); } // This all assumes pattern and mask are the same length bool patternScan( HANDLE handle, const void* startAddress, const void* endAddress, const unsigned char* pattern, const unsigned char* mask, size_t size, uint64_t& value ) { std::unique_ptr buffer( new unsigned char[size] ); // Can't add a value to a void* so I gotta cast it to a char*. for( size_t i = 0; reinterpret_cast( startAddress ) + i < endAddress; ++i ) { const void* current = reinterpret_cast( startAddress ) + i; if( !readBytes( handle, current, reinterpret_cast( buffer.get() ), size ) ) return false; const unsigned char* patternPtr = pattern; const unsigned char* maskPtr = mask; size_t j = 0; for( ; j < size; ++j, ++patternPtr, ++maskPtr ) { // Anything that is not an 'x' is optional if( *maskPtr != 'x' ) continue; if( *patternPtr != buffer[j] ) { break; } } if( j == size ) { // Found value = reinterpret_cast( current ); return true; } } return false; } // Changes the '+' sign in std::cout to '-' bool changeSign( HANDLE handle ) { // Find the pattern: // mov edx, 0000002B // mov rcx, rax const char pattern[] = "\xBA\x2B\x00\x00\x00\x48\x89\xC1"; const char mask[] = "xxxxxxxx"; static_assert( std::size( pattern ) == std::size( mask ) ); // A mask has the same size of the pattern which gives a meaning to the pattern. // - x means that the value at that location must exist. // - ? means that it is optional. // Big enough data type to store void* uint64_t ptr = 0; if( !patternScan( handle, reinterpret_cast( 0x401000 ), reinterpret_cast( 0x404200 ), reinterpret_cast( pattern ), reinterpret_cast( mask ), std::size( pattern ) - 1, ptr ) ) return false; if( ptr ) { // Replace with the pattern: // mov edx, 0000002D // mov rcx, rax const char bytes[] = "\x2D"; // Write it to the found location at an offset of 1. if( writeBytes( handle, reinterpret_cast(ptr + 1), bytes, std::size( bytes ) - 1 ) ) return true; } return false; } // Replaces the add function with a subtraction function. bool changeFunction( HANDLE handle ) { // Find the pattern: // mov edx,[rbp+10] // mov eax,[rbp+18] // add eax, edx const char pattern[] = "\x8B\x55\x10\x8B\x45\x18\x01\xD0\x5D"; const char mask[] = "xxxxxxxxx"; static_assert( std::size( pattern ) == std::size( mask ) ); // A mask has the same size of the pattern which gives a meaning to the pattern. // - x means that the value at that location must exist. // - ? means that it is optional. // Big enough data type to store void* uint64_t ptr = 0; if( !patternScan( handle, reinterpret_cast( 0x401000 ), reinterpret_cast( 0x404200 ), reinterpret_cast( pattern ), reinterpret_cast( mask ), std::size( pattern ) - 1, ptr ) ) return false; if( ptr ) { // Replace with the pattern: // mov eax,[rbp+10] // mov edx,[rbp+18] // sub eax, edx const char bytes[] = "\x8B\x45\x10\x8B\x55\x18\x29"; // In case you're wondering why I don't just swap the registers like: sub edx, eax. // It's because sub stores the result in the left register but eax will be the return value. // Swapping them around would leave eax unmodified and therefore the wrong value would be returned. // Adding instructions can't usually be done without allocating space, placing a jump opcode and jumping back after execution. // Write it to the found location at an offset of 0. if( writeBytes( handle, reinterpret_cast( ptr ), bytes, std::size( bytes ) - 1 ) ) return true; } return false; } bool modifyCode() { struct HANDLEDeleter { void operator()( HANDLE* handle ) { CloseHandle( *handle ); delete handle; } }; using HandlePtr = std::unique_ptr; // GetCurrentProcess() is pretty much the same as (void*)-1, a pointer meaning the current process. But this is more future proof. HandlePtr handle( new HANDLE( GetCurrentProcess() ) ); if( !changeFunction( *handle ) ) return false; if( !changeSign( *handle ) ) return false; return true; } namespace Random { static std::mt19937 generator( time( nullptr ) ); static int getRandom( int min, int max ) { return std::uniform_int_distribution( min, max )( generator ); } }; int main() { constexpr int Iterations = 20; for( int i = 0; i < Iterations; ++i ) { if( i == Iterations / 2 ) { if( !modifyCode() ) { std::cerr << "Could not modify code\n"; return -1; } else { std::cout << "\n=============\nModified code\n=============\n\n"; } } int a = Random::getRandom( 1, 100 ); int b = Random::getRandom( 1, 100 ); // " " << '+' << " " instead of " + " because the latter would be placed in read only memory, the former is just a number that is placed directly into the code, so it's easier to modify. std::cout << a << " " << '+' << " " << b << " = " << add( a, b ) << '\n'; } return 0; }

Self modifying code