OpenProcess from 32 bits to 64 bits and 32 bits, and improve an openhandle detector

Job ID: 37495216

Budget: $250 – $750 USD

- I need to be able to perform an OpenProcess to 64bit and 32bit processes to read the memory with this code

BOOLEAN
__2___1__s(
HANDLE ProcessHandle,
BYTE Data[][200],
INT DataSize,
INT LEN[]
)

{
if ((0 == ProcessHandle) || (0 == Data) || (0 == DataSize))
{
return 0;
}

DWORD dwReadableMask = (PAGE_READONLY | PAGE_READWRITE | PAGE_WRITECOPY
| PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE
| PAGE_EXECUTE_WRITECOPY);
DWORD dwProtectedMask = (PAGE_GUARD | PAGE_NOACCESS);

UINT_PTR ulCurrAddr = 0;
BYTE* lpBuff = 0;
SIZE_T ulBytesRead = 0;

SYSTEM_INFO SysInfo;
MEMORY_BASIC_INFORMATION Mbi;

ZeroMemory(&SysInfo, sizeof(SysInfo));
ZeroMemory(&Mbi, sizeof(Mbi));

GetSystemInfo(&SysInfo);

ulCurrAddr = (UINT_PTR)(SysInfo.lpMinimumApplicationAddress);

while ((sizeof(Mbi) == VirtualQueryEx(ProcessHandle, (LPVOID)(ulCurrAddr), &Mbi, sizeof(Mbi)) &&
(ulCurrAddr <= (UINT_PTR)(SysInfo.lpMaximumApplicationAddress)))) {

if ((dwReadableMask & Mbi.Protect) && (FALSE == (dwProtectedMask & Mbi.Protect))) {
lpBuff = (BYTE*)(malloc(Mbi.RegionSize));

if (TRUE == ReadProcessMemory(ProcessHandle, (LPVOID)(ulCurrAddr), lpBuff, Mbi.RegionSize,
&ulBytesRead)) {

if (ulBytesRead == Mbi.RegionSize)
{
for (UINT i = 0; i < Mbi.RegionSize; ++i)
{
lpBuff[i] = lpBuff[i] ^ 0x12;
}
for (UINT i = 0; i < Mbi.RegionSize; ++i) {
for (UINT j = 0; j < DataSize; ++j) {
if (0 == memcmp((LPCVOID)(lpBuff + i), Data[j], LEN[j])) {


return TRUE;
}
}
}
}
}

free(lpBuff);
}

if (Mbi.RegionSize == 0)
break;
ulCurrAddr = (UINT_PTR)(Mbi.BaseAddress) + Mbi.RegionSize;
}
CloseHandle(ProcessHandle);
return FALSE;
}




- Detect Handle from cheat engine and other process

bool HANDLE_PROTECTION_SCAN() // OK
{
std::clock_t ahora = std::clock();
double segundosTranscurridos = (ahora - ultimoEjecutados) / (double)CLOCKS_PER_SEC;

if (segundosTranscurridos >= 60.0) { // Si han pasado al menos 60 segundos (1 minuto)

static CProcessQuery ProcessQuery;

std::map<DWORD,std::vector<DWORD>> HandleProtectionTable;

if(ProcessQuery.Fetch(SystemExtendedHandleInformation,sizeof(SYSTEM_HANDLE_INFO_EX)) != 0)
{
SYSTEM_HANDLE_INFO_EX* lpSystemHandleInfo = ProcessQuery.GetExtendedHandleInfo();

if(lpSystemHandleInfo != 0)
{
SYSTEM_HANDLE_ENTRY_INFO_EX* lpSystemHandleEntryInfo = lpSystemHandleInfo->Handles;

if(lpSystemHandleEntryInfo != 0)
{
for(DWORD n=0;n < lpSystemHandleInfo->NumberOfHandles;n++,lpSystemHandleEntryInfo++)
{
if (lpSystemHandleEntryInfo->UniqueProcessId != GetCurrentProcessId() && lpSystemHandleEntryInfo->ObjectTypeIndex == HandleProtectionNumber && lpSystemHandleEntryInfo->Object == ((LPVOID)HandleProtectionObject) && (lpSystemHandleEntryInfo->GrantedAccess & PROCESS_VM_WRITE | PROCESS_QUERY_LIMITED_INFORMATION) != 0)

{
std::map<DWORD,std::vector<DWORD>>::iterator it = HandleProtectionTable.find(lpSystemHandleEntryInfo->UniqueProcessId);

if(it == HandleProtectionTable.end())
{
HandleProtectionTable.insert(std::pair<DWORD,std::vector<DWORD>>(lpSystemHandleEntryInfo->UniqueProcessId,std::vector<DWORD>(1,lpSystemHandleEntryInfo->HandleValue)));
continue;
}
else
{

if (it->second.size() >= 5)
{
}
}
}
}
Related categories: C Programming C++ Programming