Simple Maphack - OpenSource - Delphi

Ygasmy · #1 08-02-2008, 05:52 AM

hello,
some weeks ago I decided to make a maphack myself and since I didn't have any source of other Maphacks I started from nothing and after 4 hours of trying i finally got my maphack working. (well, nothing = being a programmer for 8 years now)

It's not the best one and it's also highly detectable so DO NOT use it on ladder games - or even better - refrain from using it at all. I made it just to see how maphacks work and if I can compete with other so called "advanced hackers".

It's coded in delphi because I was too lazy to install/download any IDEs/compilers for C++ and the Delphi IDE was already installed on my pc.
If you can't code pascal/delphi but C++ it should be kinda easy to translate this into C++ because the main commands are windows APIs, how they work can be researched in the MSDN:

MSDN: Microsoft Developer Network

Bare source of my program, having just a single button on the form:

Code:

{
 This program was written on 14th July 2008.
 Original Author: tndz
 I did NOT rip ANY code off other maphacks or hacks
 nor did I use any tutorial which has something to
 do with game-hacking/cracking or whatsoever. This
 program-source was made by me, though the DebugPrivilege
 part and some infos on how to use WriteProcessMemory were
 taken from the MSDN (microsoft developer network) and
 Joachim Rohde and Marcus Roming's book "Assembler".
}


unit maphack;

interface

uses
  Windows, SysUtils, Controls, Forms, StdCtrls, ExtCtrls, Classes,
  Graphics;

type
  TmainF = class(TForm)
    btn_on: TButton;
    procedure btn_onClick(Sender: TObject);
    function SetDebugPrivilege: Boolean;
  private
    { Private-Deklarationen }
  public
    { Public-Deklarationen }
  end;

var
  mainF: TmainF;



implementation

{$R *.dfm}

procedure TmainF.btn_onClick(Sender: TObject);
var
  Wc3: Hwnd;                                                           //declaring variables
  ProcessId: Integer;
  Bytes: Cardinal;
  Stat: array of Byte;
begin
setlength(stat,2);                                                     //declare our array (could also have used 3 different variables or reassign values)
SetDebugPrivilege;                                                     //grant our process Debug-rights (important!)
wc3 := FindWindow (nil,'Warcraft III');                                //find wc3 handle
GetWindowThreadProcessId(Wc3, @ProcessId);                             //find PID by Phandle
wc3 := OpenProcess(PROCESS_ALL_ACCESS, False, ProcessId);              //open wc3 process with all rights
Bytes := 1;                                                            //not needed for this tbh
                                                                        {
                                                                        We need to store what we want to write
                                                                        in a variable(array) first. Byte variable
                                                                        in Delphi is 0..255, decimal-system. Since
                                                                        we want to write into memory, we need hex-values.
                                                                        I just calculated them from hex to decimal via
                                                                        windows calculator instead of recalculating them
                                                                        via program-code.
                                                                        }

stat[0] := 185;                                                        //185 = B9h
stat[1] := 15;                                                         //15 = Fh
stat[2] := 00;                                                         //00 = 0h
                                                                        {
                                                                         B9 0F 00 is part of
                                                                         MOV ECX,000F
                                                                         which means:
                                                                         COPY 000F into ECX
                                                                         so what we do is:
                                                                         we overwrite a part of
                                                                         the drawing engine which
                                                                         checks if a unit is visible
                                                                         to a player or not.
                                                                        }
WriteProcessMemory(wc3, ptr($6F3A0474), @Stat[0], 1, Bytes);          //write first bytepair
WriteProcessMemory(wc3, ptr($6F3A0475), @Stat[1], 1, Bytes);          //2nd
WriteProcessMemory(wc3, ptr($6F3A0476), @Stat[2], 1, Bytes);          //3rd
end;


function TmainF.SetDebugPrivilege: Boolean;
var
  hToken: THandle;
  TP: TTokenPrivileges;
  lpLuid: TLargeInteger;
  dwReturnLength: DWORD;
begin
  Result := False;
  if OpenProcessToken(GetCurrentProcess, TOKEN_ADJUST_PRIVILEGES or TOKEN_QUERY, hToken) then
  begin
    if LookupPrivilegeValue(nil, 'SeDebugPrivilege', lpLuid) then
    begin
      TP.PrivilegeCount := 1;
      TP.Privileges[0].Attributes := SE_PRIVILEGE_ENABLED;
      TP.Privileges[0].Luid := lpLuid;
      Result := AdjustTokenPrivileges(hToken, False, TP, sizeof(TP), nil, dwReturnLength);
    end;
    CloseHandle(hToken);
  end;
end;

end.

Here is the PE (aka .exe) compiled with this source. (I added a picture though :p)
RapidShare: Easy Filehosting
http://www.megaupload.com/?d=5OTH8YED
(MD5: 81899ffa99e7246b7e6192bdbe16a8f3)

Since I don't trust anyone posting results of malware scanners, download it and go check it on virusscan.jotti.org, its only 172kb in size (packed).

cya,
tndz aka Ygasmy.