22
33function write (){
44 $ all_access = 0x000F0000 | 0x00100000 | 0xFFFF ;
5- $ base = 0x6FFAE0 ; // çíà÷åíèå âçÿòü èç êîíñîëè (victim.exe)
5+ $ base = 0x6FFAE0 ; // значение взять из консоли (victim.exe)
66 $ newValue = 100 ;
77
88
9- $ hwnd = DFFI ::callFunction ("user32 " , "int " , "FindWindowA " , [null , "Victim " ], ["int " , "string " ]); //ïîëó÷àåì õåíäë îêíà
9+ $ hwnd = DFFI ::callFunction ("user32 " , "int " , "FindWindowA " , [null , "Victim " ], ["int " , "string " ]); //получаем хендл окна
1010 if ($ hwnd == 0 ){
1111 alert ("Victim not found " );
1212 }else {
1313 $ pid_ref = new DFFIReferenceValue ("int " );
14- DFFI ::callFunction ("user32 " , "int " , "GetWindowThreadProcessId " , [$ hwnd , $ pid_ref ], ["int " , "reference " ]);//ïîëó÷àåì pid ïðîöåññà
14+ DFFI ::callFunction ("user32 " , "int " , "GetWindowThreadProcessId " , [$ hwnd , $ pid_ref ], ["int " , "reference " ]);//получаем pid процесса
1515 $ pid = $ pid_ref ->getValue ();
1616
1717 $ hOpen = DFFI ::callFunction ("kernel32 " , "int " , "OpenProcess " , [$ all_access , false , $ pid ], ["int " , "bool " , "int " ]);
1818 if (!$ hOpen ){
1919 alert ("Process error " );
2020 }else {
2121 $ newValue_ref = new DFFIReferenceValue ("int " , $ newValue );
22- DFFI ::callFunction ("kernel32 " , "bool " , "WriteProcessMemory " , //çàïèñûâàåì çíà÷åíèå
22+ DFFI ::callFunction ("kernel32 " , "bool " , "WriteProcessMemory " , //записываем значение
2323 [$ hOpen , $ base , $ newValue_ref , sizeof ($ newValue ), null ],
2424 ["int " , "int " , "reference " , "int " , "int " ]
2525 );
2626 }
2727 }
28- }
28+ }
0 commit comments