SaiPal

SaiPal.cpp

#include <windows.h>
#include <iostream>
#include <iomanip>
#include <stdlib.h>
#include <conio.h>
#include <TlHelp32.h> //GetModuleBase
#pragma pack()
struct Color
{
	Color()
	{
		B = G = R = 128;
	}
	signed short B, G, R;
};

DWORD GetModuleBase(DWORD dwProcessId)
{
	HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
	if (hSnapShot == INVALID_HANDLE_VALUE) {
		return 0;
	}

	MODULEENTRY32 lpModuleEntry;
	lpModuleEntry.dwSize = sizeof(MODULEENTRY32);

	bool bRet = Module32First(hSnapShot, &lpModuleEntry);
	CloseHandle(hSnapShot);

	return (bRet) ? (DWORD)lpModuleEntry.modBaseAddr : 0;
}

DWORD GetModuleBase(LPSTR lpModuleName, DWORD dwProcessId)
{
	MODULEENTRY32 lpModuleEntry = { 0 };
	HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwProcessId);
	if (hSnapShot == INVALID_HANDLE_VALUE) {
		return 0;
	}

	if (!hSnapShot)
		return 0;
	lpModuleEntry.dwSize = sizeof(MODULEENTRY32);
	BOOL bModule = Module32First(hSnapShot, &lpModuleEntry);
	while (bModule)
	{
		//If module name matches: return it
		if (!strcmp(lpModuleEntry.szModule, lpModuleName))
		{
			CloseHandle(hSnapShot);
			return (DWORD)lpModuleEntry.modBaseAddr;
		}
		bModule = Module32Next(hSnapShot, &lpModuleEntry);
	}
	CloseHandle(hSnapShot);
	return 0;
}

int main()
{
	HINSTANCE hDLL = LoadLibrary("psapi.dll");
	std::cout << hDLL << std::endl;

	HANDLE hStdout = GetStdHandle(STD_OUTPUT_HANDLE);
	std::cout << "SaiPal demo - Build date(" << __DATE__ << ")" << std::endl;
	std::cout << "\t-DEElekgolo (DEElekgolo.tumblr.com)\n" << std::endl;
	DWORD Address = 0;
	DWORD ProcessID;
	HWND SaiProcess;
	std::cout << std::hex << std::uppercase;
	SaiProcess = FindWindow("sfl_window_class", NULL);
	if (!SaiProcess)
	{
		SetConsoleTextAttribute(hStdout, FOREGROUND_RED | FOREGROUND_INTENSITY);
		std::cout << "Sai process not found (Error code: " << GetLastError() << ")" << std::endl;
		system("PAUSE");
		return 1;
	}
	SetConsoleTextAttribute(hStdout, FOREGROUND_GREEN | FOREGROUND_INTENSITY);
	std::cout << "Sai.exe process found" << std::endl;
	SetConsoleTextAttribute(hStdout, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
	GetWindowThreadProcessId(SaiProcess, &ProcessID);
	HANDLE pHandle = OpenProcess(PROCESS_VM_READ |
		PROCESS_VM_WRITE |
		PROCESS_VM_OPERATION |
		PROCESS_QUERY_INFORMATION,
		0, ProcessID);
	if (!pHandle)
	{
		SetConsoleTextAttribute(hStdout, FOREGROUND_RED | FOREGROUND_INTENSITY);
		std::cout << "Could not open Sai Process (Error code: " << GetLastError() << ")" << std::endl;
		system("PAUSE");
		return 1;
	}
	SetConsoleTextAttribute(hStdout, FOREGROUND_GREEN | FOREGROUND_INTENSITY);
	std::cout << "Process opened for reading/writing. PID: " << ProcessID << std::endl;
	SetConsoleTextAttribute(hStdout, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
	Address = GetModuleBase(ProcessID);
	Address += 0x000E9C2C;
	ReadProcessMemory(pHandle, (void*)(Address), &Address, 4, NULL);
	std::cout << "Resolving base pointer " << std::hex << Address << std::endl;
	Address += 0x24;
	ReadProcessMemory(pHandle, (void*)(Address), &Address, 4, NULL);
	std::cout << "Resolving session pointer: " << std::hex << Address << std::endl;
	Address += 0x874;
	std::cout << "Final pointer: " << std::hex << Address << std::endl;
	SetConsoleTextAttribute(hStdout, FOREGROUND_RED | FOREGROUND_INTENSITY);
	std::cout << "Press ESC to exit" << std::endl;
	Color New;
	int Count = 0;
	SetConsoleTextAttribute(hStdout, FOREGROUND_GREEN | FOREGROUND_INTENSITY);
	while (WriteProcessMemory(pHandle, (void*)Address, (void*)&New, sizeof(Color), NULL))
	{
		if (_kbhit() && _getch() == 27)
		{
			break;
		}
		New.B = 128 + (rand() << 8);
		New.G = 128 + (rand() << 8);
		New.R = 128 + (rand() << 8);
		std::cout << 
			"\tColor: " << ((New.R & 0xFF00) >> 8) << " , " << ((New.G & 0xFF00) >> 8) << " , " << ((New.B & 0xFF00) >> 8) << '\r';
	}
	SetConsoleTextAttribute(hStdout, FOREGROUND_RED | FOREGROUND_GREEN | FOREGROUND_BLUE);
	std::cout << std::endl;
	CloseHandle(pHandle);
	return 0;
}