Write Multiple Bytes To Memory [delphi]

[Departure]

Hey people I just need a little help from someone with some delphi experiance, Im new to delphi coming over from Vb6 and I have no problem writting to memory in Vb6

But I want to do it in delphi, I have used something similar that I would have used in vb6. But I would like to know how I would write multiple bytes to a single address

implementation
   const
	 Address1=$0054B28B;  //These will be the address's im going to write to
	 Address2=$0054B297;
	 Address3=$0054B29C;
{$R *.dfm}procedure TForm1.Button1Click(Sender: TObject);
  var
  Path : string;
  StartInfo  : TStartupInfo;
  ProcInfo   : TProcessInformation;
  CreateOK   : Boolean;
  Write: Cardinal;
  NumberOfBytes : Cardinal;
  BytesToWrite :  Byte;   // Im not sure if I declared the correct variable, Proberly need to put it into an array??????
begin
  Path :='C:\\Program Files\\My Program\\MyProgram.exe';
	  { fill with known state }
  FillChar(StartInfo,SizeOf(TStartupInfo),#0);
  FillChar(ProcInfo,SizeOf(TProcessInformation),#0);
  StartInfo.cb := SizeOf(TStartupInfo);  CreateOK := CreateProcess(PChar(Path),nil, nil, nil,False,CREATE_SUSPENDED,nil, nil, StartInfo, ProcInfo);   //check to see if successful
   if CreateOK then
  begin
   NumberOfBytes := 2;   //No problem writing 1 byte "08" or "EB" but I want to write both bytes to adress Nr.1
   BytesToWrite := $08EB; 
  //If i was to change numberofbytes to = 1 and have BytesToWrite = $08 (single byte) it would work fine   WriteProcessMemory(ProcInfo.hProcess,ptr(Address1),BytesToWrite,NumberOfBytes,Write);
   ResumeThread(ProcInfo.hThread);
   CloseHandle(ProcInfo.hProcess);
  end;
end;
end.

Im thinnking I need to make byte array but then I just need to know how to implement the array, Writting 1 byte is no problems to the address but I need to write 2 or more bytes to a single address. Any help I would be very thankful

[IMPosTOR]

const 
 Patch_Memory_String1 : array[1..6] of byte = ($E9,$7B,$01,$00,$00,$90);....WriteProcessMemory(G_P,$0040000,@Patch_Memory_String1,length(Patch_Memory_String1),C);....

maybe this one can help u

Edited November 28, 2007 by IMPosTOR

[Departure]

yes look like the exact thing I wanted to do, ill try it out, I did find a solution but your way looks better )

This is my way I found that seems to work also

implementation const
	 Address1=$0054B28B;
	 Address2=$0054B297;
	 Address3=$0054B29C;
	 Value1 = $08EB;
	 Value2 = $BB00;
	 Value3 = $90;
{$R *.dfm}procedure TForm1.Button1Click(Sender: TObject);
  var
  Path : string;
  StartInfo  : TStartupInfo;
  ProcInfo   : TProcessInformation;
  CreateOK   : Boolean;
  Write: Cardinal;
  NumberOfBytes : Cardinal;
  WriteByte :  Byte;
  buf: PChar;
begin
  Path :='C:\\Program Files\\My Program\\MyProgram.exe';
	  //Fill with state
  FillChar(StartInfo,SizeOf(TStartupInfo),#0);
  FillChar(ProcInfo,SizeOf(TProcessInformation),#0);
  StartInfo.cb := SizeOf(TStartupInfo);  CreateOK := CreateProcess(PChar(Path),nil, nil, nil,False,CREATE_SUSPENDED,nil, nil, StartInfo, ProcInfo);  //Checking
   if CreateOK then
  begin
   NumberOfBytes := 2;
   GetMem(buf, 2);
   buf^ := Chr(Value1);
   WriteProcessMemory(ProcInfo.hProcess,ptr(Address1),buf,NumberOfBytes,Write);
   FreeMem(buf);   NumberOfBytes := 2;
   GetMem(buf, 2);
   buf^ := Chr(Value2);
   WriteProcessMemory(ProcInfo.hProcess,ptr(Address2),buf,NumberOfBytes,Write);
   FreeMem(buf);   NumberOfBytes := 1;
   GetMem(buf, 1);
   buf^ := Chr(Value3);
   WriteProcessMemory(ProcInfo.hProcess,ptr(Address3),buf,NumberOfBytes,Write);
   FreeMem(buf);   ResumeThread(ProcInfo.hThread);
   CloseHandle(ProcInfo.hProcess);
  end;
end;end.

But after seeing your way it looks better implemented So im going to go and try it now

Edited November 28, 2007 by Departure

[IMPosTOR]

my src is small and u can replace my src

Edited November 28, 2007 by IMPosTOR

[Departure]

Thanks IMPoster, I used your method and it works perfectly with a lot less code, I did'nt know i could use MyArray : array[1..8] of byte ($1b,$2b,$3b,$4b,$5b,$6b,$7b,$8b);

These are the small thing that make it alot easyer than with vb6, btw those arn'nt real bytes they are just example of how you told me...

Thanks again )

[Nevyn]

Thanks IMPoster, I used your method and it works perfectly with a lot less code, I did'nt know i could use MyArray : array[1..8] of byte ($1b,$2b,$3b,$4b,$5b,$6b,$7b,$8b);

These are the small thing that make it alot easyer than with vb6, btw those arn'nt real bytes they are just example of how you told me...

Thanks again )

I know you already got your answer out, but i thought i'd be giving you another way.

ar: array[0..500] of char;

begin

str := 'I can replace Strings in Memory';

FillChar(ar, SizeOf(ar), 0);

Move(str[1], ar, Length(str));

Then just WriteProcessMemory using @ar

[C++]

I have a question a little similar to this. In ollydbg there's a command I see called Fill with nops where it fills an address with 90s . I was trying to implement that also in delphi. I know I can do a loop but not so sure how to do it

Any help? or a better approach?

[evlncrn8]

make a buffer of the size required (or a fraction and do the write in a loop), fill it with 0x90, write x bytes from that to the process using WriteProcessMemory, hardly rocket science

Edited February 22, 2018 by evlncrn8

[GautamGreat]

procedure WriteNOP(Address : DWORD; Size : Integer; hProcess : THandle);
var
  i : Integer;
  nop : byte;
  bytesread : DWORD;
begin
  nop = $90;
  for i := 0 to Size - 1 do
  begin
    WriteProcessMemory(hProcess, Pointer(Address), @nop, 1, bytesread);
    inc(Address);
  end;
end;

 

Here is small example. Maybe it helps

Edited February 22, 2018 by GautamGreat

[evlncrn8]

that is one horrible example.. writing one byte at the time... wow... that code should be taken out the back of the shed and shot

[GautamGreat]

Its a terrible way but it works

[idrcelab]

On 2/22/2018 at 5:36 PM, evlncrn8 said:

that is one horrible example.. writing one byte at the time... wow... that code should be taken out the back of the shed and shot

Can you show us, how you can do it in a better way?

Edited February 26, 2018 by idrcelab

[evlncrn8]

i already said, allocate a buffer of the size, fill it with nops, write it in one go...

[GautamGreat]

procedure WriteNOP(Address : DWORD; Size : Integer; hProcess : THandle);
var
  NopBytes : array of Bytes;
  bytesread : DWORD;
begin
  SetLength(NopBytes, Size);
  FillMemory(@NopBytes[0], Size, $90);
  WriteProcessMemory(hProcess, Pointer(Address), @NopBytes, Size, bytesread); 
end;

 

something like this ?

[evlncrn8]

something like that yep, i think you can already see how much better is than one byte at a time.. no ?