[C#]Tournament Bot

[shout]

I am writing kind of a "tournament bot" I guess you could call it for SC/BW/ maybe WC3. So far I have:

• Log on to battle.net using hashes (non WC3)
• Provides simple moderation

I am working on:

• All the bots communicating over a non-battle.net connection
• In-game bot commands (using a hot key or something)
• Hack detection
• Record keeping based only on tournament games

I can probably figure out how to do record keeping and non-bnet connection, but I am guessing I will need to somehow modify the {insert game here}.exe process to achive the in-game bot commands or hack detection.

I guess the real reason of this post is to ask how to modify a running process (inject a DLL maybe...?)

[Banana fanna fo fanna]

Hrm. I don't know how VirtualProtect works, but I wonder if there's a way your process could maintain a lock on Starcraft's process space.

[shout]

I will admit I really have no idea how to go about this.

What exactly is VirtualProtect?

[Banana fanna fo fanna]

I'll leave that to someone better qualified to answer the question, but it changes memory permissions.

[Magickian]

I am writing kind of a "tournament bot" I guess you could call it for SC/BW/ maybe WC3. So far I have:

• Log on to battle.net using hashes (non WC3)
• Provides simple moderation

I am working on:

• All the bots communicating over a non-battle.net connection
• In-game bot commands (using a hot key or something)
• Hack detection
• Record keeping based only on tournament games

I can probably figure out how to do record keeping and non-bnet connection, but I am guessing I will need to somehow modify the {insert game here}.exe process to achive the in-game bot commands or hack detection.

I guess the real reason of this post is to ask how to modify a running process (inject a DLL maybe...?)

ReadProcessMemory/WriteProcessMemory can be used for simple read/writes externally from the process without having to inject. 
VirtualProtect is used to handle read/write within the process internally (and then using say memcpy, or pointers to modify data).

[shout]

Ever more questions:

• If I would modify the process externally, how would I find where all the data is stored in memory?
• How does DLL injection work?
• Is DLL injection possible with C#?

[Magickian]

Ever more questions:

• If I would modify the process externally, how would I find where all the data is stored in memory?
• How does DLL injection work?
• Is DLL injection possible with C#?

Bah, had a nice reply going, but then cablemodem went down for two hours.  Anyways, the quickest way to find the data you're looking for is usually with debuggers, or some kind of generic game trainers which will search for changes in values. 
DLL Injection is most easily done through creating a remote thread inside of the process, allocating memory, then calling LoadLibrary in the remote thread to load your DLL.  Once your DLL is in memory, you usually call virtualprotect to enable read/write on some of the memory inside of the app you are injecting.  Generally you are going to replace function calls inside of the app with your own, and for data spying purposes, you will usually just wrap a function (IE: Original app calls Winsock's Send function, you inject, overwrite original app's call with your call, then from your call you call Send with all of the original input parameters, then dump the buffer into a file, and then return from the call).  Replacing function calls requires quite a bit of assembly knowledge, I suggest going over to the Assembly thread and reading there, think there's a whole thread dedicated to how standard calls work with C++ and assembly.  As for C#, I think it uses a different calling convention than stdcall and am not sure of its details.  For simplicity purposes, you can create your C++ wrapper and then call the C# function from within your wrapper.

Modification:
P.S. Creating a remote thread only works under NT/2K/XP, it will not work under 9x/ME, the alternative to making it work under 9x/ME is quite ugly.

[Skywing]

SetWindowsHookEx works nice for Win9x and NT, assuming the program has a window.

(ot) Nice Cowboy Bebop.

[shout]

I guess if your using Win9x/ME you wont be able to use it. Too bad for people using operating systems 6 years old.

[Magickian]

SetWindowsHookEx works nice for Win9x and NT, assuming the program has a window.

(ot) Nice Cowboy Bebop.

Yeah, it was a pre-existing image, but I like Spike anyways.