MCPcopy Create free account
hub / github.com/SickleSec/GhostWolf / PatchBaseAddress

Function PatchBaseAddress

Ghostwolf/Memory.cpp:56–89  ·  view source on GitHub ↗

Source from the content-addressed store, hash-verified

54}
55
56BYTE* PatchBaseAddress(const BYTE* pattern, size_t patternSize, uintptr_t baseAddress, AppLication targetApp, AppMode mode) {
57
58 BYTE* newPattern = (BYTE*)malloc(sizeof(BYTE) * patternSize);
59 for (size_t i = 0; i < patternSize; i++)
60 newPattern[i] = pattern[i];
61 BYTE baseAddrPattern[sizeof(uintptr_t)];
62 ConvertToByteArray(baseAddress, baseAddrPattern, sizeof(uintptr_t));
63 if (targetApp == Chrome or targetApp == Edge) {
64 if (mode == Pass) {
65 PatchPattern(newPattern, baseAddrPattern, 16);
66 PatchPattern(newPattern, baseAddrPattern, 40);
67 PatchPattern(newPattern, baseAddrPattern, 48);
68 PatchPattern(newPattern, baseAddrPattern, 56);
69 PatchPattern(newPattern, baseAddrPattern, 64);
70 }
71 else
72 {
73 PatchPattern(newPattern, baseAddrPattern, 16);
74 PatchPattern(newPattern, baseAddrPattern, 24);
75 PatchPattern(newPattern, baseAddrPattern, 56);
76 PatchPattern(newPattern, baseAddrPattern, 80);
77 PatchPattern(newPattern, baseAddrPattern, 136);
78 PatchPattern(newPattern, baseAddrPattern, 168);
79 PatchPattern(newPattern, baseAddrPattern, 176);
80 PatchPattern(newPattern, baseAddrPattern, 184);
81 }
82 }
83 if (targetApp == FireFox) {
84 PatchPattern(newPattern, baseAddrPattern, 8);
85 PatchPattern(newPattern, baseAddrPattern, 88);
86 }
87
88 return newPattern;
89}
90
91BOOL FindPattern(HANDLE hProcess, const BYTE* pattern, size_t patternSize, uintptr_t* cookieMonsterInstances, size_t& szCookieMonster, AppLication targetApp, AppMode mode) {
92

Callers 1

FindPatternFunction · 0.85

Calls 2

ConvertToByteArrayFunction · 0.85
PatchPatternFunction · 0.85

Tested by

no test coverage detected