1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:
32:
33:
34:
35:
36:
37:
38:
39:
40:
41:
42:
43:
44:
45:
46:
47:
48:
49:
50:
51:
52:
53:
54:
55:
56:
57:
58:
59:
60:
61:
62:
63:
64:
65:
66:
67:
68:
69:
70:
71:
72:
73:
74:
75:
76:
77:
78:
79:
80:
81:
82:
83:
84:
85:
86:
87:
88:
89:
90:
91:
92:
93:
94:
95:
96:
97:
98:
99:
100:
101:
102:
103:
104:
105:
106:
107:
108:
109:
110:
111:
112:
113:
114:
115:
116:
117:
118:
119:
120:
121:
122:
123:
124:
125:
126:
127:
128:
129:
130:
131:
132:
133:
134:
135:
136:
137:
138:
139:
140:
141:
142:
143:
144:
145:
146:
147:
148:
149:
150:
151:
152:
153:

unit ModCode;

interface

uses
 Windows, SysUtils;

const
 EXE_START = $00400000;
 SRC_START = $00401000;
 SRC_END   = $7fffffff;
 BUFMAX    = 65536;

type
 PDataArray = ^TDataArray;
 TDataArray = array[0..BUFMAX-1] of byte;

 TModMyself = class
 private
  fProcess: DWORD;
  function ReadBufferFromMemory(address: DWORD; var Data: TDataArray): DWORD;
 public
  constructor Create(Process: DWORD); overload;
  constructor Create; overload;

  function Find(data: pointer; length: DWORD): DWORD; overload;
  function Find(data: string): DWORD; overload;
  function WriteBuffer(address: DWORD; const buffer; length: DWORD): boolean;
  function WriteByte(address: DWORD; data: byte): boolean;

  function ReadByte(address: DWORD): byte;
  function ReadWord(address: DWORD): word;
  function ReadDWord(address: DWORD): DWORD;
  function ReadBuffer(address: DWORD; const buffer; length: DWORD): DWORD;
 end;

implementation

{ TModMyself }

function TModMyself.Find(data: pointer; length: DWORD): DWORD;
var
 CurrentAddress: DWORD;
 BytesRead: DWORD;
 memdata: TDataArray;
 i, j: DWORD;
begin
 result := 0;

 // Maximal so lang wie der Buffer
 if length > BUFMAX then
  exit;

 // Am Anfang des Codes anfangen
 CurrentAddress := SRC_START;
 repeat
  // Einen Block einlesen (mit Länge BUFMAX)
  BytesRead:=ReadBufferFromMemory(CurrentAddress, memdata);
  // Nichts gelesen => raus
  if BytesRead = 0 then
   exit;
  // Verhindern, dass "data" nicht gefunden wird, wenn es
  // sich am Ende des Buffers befindet
  if BytesRead > (BUFMAX - length) then
   dec(BytesRead, length);
  // Daten durchsuchen
  for i := 0 To BytesRead-1 do
   if CompareMem(@MemData[i], data, length) then
   begin
    // gefunden :)
    result := CurrentAddress + i;
    exit;
   end;
  inc(CurrentAddress, BytesRead);
 until CurrentAddress>=SRC_END;
end;

constructor TModMyself.Create(Process: DWORD);
begin
 inherited Create;
 // fremder Prozess
 fProcess := Process;
end;

constructor TModMyself.Create;
begin
 inherited;
 // Der eigene Prozess
 fProcess := GetCurrentProcess;
end;

function TModMyself.Find(data: string): DWORD;
begin
 result := Find(@data[1], length(data));
end;

// Daten aus dem Speicher lesen & schreiben
function TModMyself.ReadBuffer(address: DWORD; const buffer;
  length: DWORD): DWORD;
begin
 ReadProcessMemory(fProcess, pointer(address), @buffer, length, result);
end;

function TModMyself.ReadBufferFromMemory(address: DWORD; var Data: TDataArray): DWORD;
begin
 ReadProcessMemory(fProcess, pointer(address), @Data[0], BUFMAX, result);
end;

function TModMyself.ReadByte(address: DWORD): byte;
var
 count: dword;
begin
 ReadProcessMemory(fProcess, pointer(address), @result, 1, count);
end;

function TModMyself.ReadDWord(address: DWORD): DWORD;
var
 count: dword;
begin
 ReadProcessMemory(fProcess, pointer(address), @result, 4, count);
end;

function TModMyself.ReadWord(address: DWORD): word;
var
 count: dword;
begin
 ReadProcessMemory(fProcess, pointer(address), @result, 2, count);
end;

function TModMyself.WriteBuffer(address: DWORD; const buffer;
  length: DWORD): boolean;
var
 count: cardinal;
 oldprotect:dword;
begin
 VirtualProtect(pointer(address), length, PAGE_EXECUTE_READWRITE, @oldprotect);
 WriteProcessMemory(fProcess, pointer(address), @buffer, length, count);
 VirtualProtect(pointer(address), length, oldprotect, @oldprotect);
 result := count = length;
end;

function TModMyself.WriteByte(address: DWORD; data: byte): boolean;
var
 count: cardinal;
 oldprotect:dword;
begin
 VirtualProtect(pointer(address), 1, PAGE_EXECUTE_READWRITE, @oldprotect);
 WriteProcessMemory(fProcess, pointer(address), @data, sizeof(data), count);
 VirtualProtect(pointer(address), sizeof(data), oldprotect, @oldprotect);
 result := count = 1;
end;

end.					

1:
2:
3:
4:
5:

asm
 jmp @@foo
 DB $12, $74, $A7, $2C, $7D, $C7, $3E
 @@foo:
end;					

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:

function test2(a: byte): integer;
begin
 if a = 0 then
 begin
  asm
   // Die Markierung von oben 
   jmp @@foo
   DB $12, $74, $A7, $2C, $7D, $C7, $3E
   @@foo:
  end;
  result := 1;
 end
 else result := 2;
end;					

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:

var
 pos: integer;

...

 with TModMyself.Create do
 try
  // Wieder die Markierung
  pos := find(#$12#$74#$A7#$2C#$7D#$C7#$3E);
  // Hier befindet sich der Benötigte Offset 4 Bytes vor der Markierung
  // JZ = Jump If Zero
  // JNZ = Jump if not Zero
  if ReadByte(pos-4) = $74 then // JZ
   WriteByte(pos-4, $75) // JNZ
  else
   WriteByte(pos-4, $74); // JZ
 finally
  free;
 end;					

1:
2:
3:
4:
5:
6:
7:
8:
9:
10:

 with TModMyself.Create do
 try
  pos := dword(@test2)+$11;
  if ReadByte(pos-4) = $74 then // JZ
   WriteByte(pos-4, $75) // JNZ
  else
   WriteByte(pos-4, $74); // JZ
 finally
  free;
 end;