[VB/NET] Antihack Module :D

Newbie Spellweaver
Joined
Jun 27, 2010
Messages
53
Reaction score
67
I was bored, and i wanted to make antihack in vb.net, i was sucessfull until this error:
Code:
Error	1	Value of type '1-dimensional array of Byte' cannot be converted to 'System.IntPtr'.	d:\Visual Studio 2008\Projects\Launcher Client\Launcher Client\Antihack.vb	34

antihack module;
Code:
Imports System.Runtime.InteropServices
Module Antihack
    Dim MAX_DUMPS As Integer = 2
    Dim MAX_DUMP_SIZE As Integer = 32
    Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, <MarshalAs(UnmanagedType.AsAny)> ByVal lpBaseAddress As Object, <MarshalAs(UnmanagedType.AsAny)> ByRef lpBuffer As Object, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" ([B]ByVal pDst As IntPtr[/B], ByVal pSrc As String, ByVal ByteLen As Long)

    ' Dim Offsets(MAX_DUMPS) As Integer = {"0x4C8259"}

    Public Sub SystemProcessScan()
        Dim psList() As Process
        Try
            psList = Process.GetProcesses()

            For Each p As Process In psList
                If (Scan(p.Id) > 0) Then
                    MsgBox("Found hack software in your system.\n\nHint: Close all illegal programs and run application again.", "Software guard")
                    CloseProc("MU")
                End If

            Next p

        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
    End Sub

    Public Function Scan(ByVal hProcess As Int32)
        Dim Buf(MAX_DUMP_SIZE) As Byte
        Dim BytesRead As Int32 = 0
        Dim B = Convert.ToByte(Buf)
        For Int As Integer = 0 To MAX_DUMPS
            ReadProcessMemory(hProcess, "Offset", Buf, System.Runtime.InteropServices.Marshal.SizeOf(Buf), BytesRead)
            If CopyMemory([B]Buf[/B], "32byte DUMP", MAX_DUMP_SIZE) = 0 Then
                Return 1
            End If
        Next
        Return 0
    End Function

    Function CloseProc(ByVal sProcName As String) As String
        Dim Proc() As Process = Process.GetProcessesByName(sProcName)
        Try
            Proc(0).Kill()
            Return "Process killed"
        Catch
            Return "Can't find process"
        End Try
    End Function
End Module
 
That's awesome mate.

Thanks for the share. I might attempt to make one of these myself, tbh.
 
That's awesome mate.

Thanks for the share. I might attempt to make one of these
myself, tbh.
here update for ya :D but still that shity error :D

guide:
Code:
    Dim MAX_DUMPS As Integer = 2 - this is hack count added

 Public Sub LoadDump()
        Offsets(0) = "0x4C8259" - olly offset
        Dumps(0) = "0xA1, 0x38, 0xBD...." - olly 32 bit dump
...
Code:
Imports System.Runtime.InteropServices
Module Antihack
    Dim MAX_DUMPS As Integer = 2
    Dim MAX_DUMP_SIZE As Integer = 32
    Declare Function ReadProcessMemory Lib "kernel32" Alias "ReadProcessMemory" (ByVal hProcess As Integer, <MarshalAs(UnmanagedType.AsAny)> ByVal lpBaseAddress As Object, <MarshalAs(UnmanagedType.AsAny)> ByRef lpBuffer As Object, ByVal nSize As Integer, ByRef lpNumberOfBytesWritten As Integer) As Integer
    Declare Sub CopyMemory Lib "kernel32" Alias "RtlMoveMemory" (ByVal pDst As IntPtr, ByVal pSrc As String, ByVal ByteLen As Long)

    Dim Offsets(MAX_DUMPS) As String
    Dim Dumps(MAX_DUMPS) As String
    Public Sub LoadDump()
        Offsets(0) = "0x4C8259"
        Dumps(0) = "0xA1, 0x38, 0xBD, 0x4C, 0x00, 0x8B, 0x00, 0x8B, 0x4D, 0xFC, 0xBA, 0xC0, 0x82, 0x4C, 0x00, 0xE8, 0x1F, 0xF1, 0xFF, 0xFF, 0x33, 0xDB, 0xE8, 0xF8, 0xBE, 0xF3, 0xFF, 0x33, 0xC0, 0x5A, 0x59, 0x59"
        Offsets(1) = "0x4C8259"
        Dumps(1) = "0xA1, 0x38, 0xBD, 0x4C, 0x00, 0x8B, 0x00, 0x8B, 0x4D, 0xFC, 0xBA, 0xC0, 0x82, 0x4C, 0x00, 0xE8, 0x1F, 0xF1, 0xFF, 0xFF, 0x33, 0xDB, 0xE8, 0xF8, 0xBE, 0xF3, 0xFF, 0x33, 0xC0, 0x5A, 0x59, 0x59"
        Offsets(2) = "0x4C8259"
        Dumps(2) = "0xA1, 0x38, 0xBD, 0x4C, 0x00, 0x8B, 0x00, 0x8B, 0x4D, 0xFC, 0xBA, 0xC0, 0x82, 0x4C, 0x00, 0xE8, 0x1F, 0xF1, 0xFF, 0xFF, 0x33, 0xDB, 0xE8, 0xF8, 0xBE, 0xF3, 0xFF, 0x33, 0xC0, 0x5A, 0x59, 0x59"

    End Sub

    Public Sub SystemProcessScan()
        LoadDump()
        Dim psList() As Process
        Try
            psList = Process.GetProcesses()

            For Each p As Process In psList
                If (Scan(p.Id) > 0) Then
                    MsgBox("Found hack software in your system.\n\nHint: Close all illegal programs and run application again.", "Software guard")
                    CloseProc("MU")
                    Application.Exit()
                End If

            Next p

        Catch ex As Exception
            MsgBox(ex.Message)
        End Try
    End Sub

    Public Function Scan(ByVal hProcess As Int32)
        Dim Buf(MAX_DUMP_SIZE) As Byte
        Dim BytesRead As Int32 = 0
        Dim B = Convert.ToByte(Buf)
        For Int As Integer = 0 To MAX_DUMPS
            ReadProcessMemory(hProcess, Offsets(Int), Buf, System.Runtime.InteropServices.Marshal.SizeOf(Buf), BytesRead)
            If CopyMemory(Buf, Dumps(Int), MAX_DUMP_SIZE) = 0 Then
                Return 1
            End If
        Next
        Return 0
    End Function

    Function CloseProc(ByVal sProcName As String) As String
        Dim Proc() As Process = Process.GetProcessesByName(sProcName)
        Try
            Proc(0).Kill()
            Return "Process killed"
        Catch
            Return "Can't find process"
        End Try
    End Function
End Module
 
Don't see the point to this. It wouldn't detect anything realistically.
 
I been working on my antihack also, but for some reason, it doesnt recognize the programs that I added... (They are 32byte dumps also...)
 
Back