Read / Write Array Of Byte

[Hawlong]

Hello all ,

Please how can read , Array Of Byte (cheat engine).
using c ++ (internal)

https://i.top4top.io/p_2581t632y1.png

[malibor]

You would use ReadFile API
https://learn.microsoft.com/en-us/windows/win32/api/fileapi/nf-fileapi-readfile

Store the result to a byte array and then manipulate bytes however you need.

[jonnin]

read it from what?
cheat engine is a program -- are you reading a file it wrote, or a stream on the network, or a shared memory location, or ??

your less-than-useful image indicates a memory location.
under the great big assumption that you are allowed to access that memory location, a simple pointer is all you need:
unsigned char *cp{}; //this is a pointer to a block of bytes
cp = your_memory_address; //you will have to cast the integer if that is what you have, and be sure to use pointer sized types (probably 64 bit).
and you need to know how many bytes are in play.
from there:
for(int i{}; i < bytes_in_play; i++)
cout << (int)cp[i]; //do something with each byte.

[seeplus]

The image location is flagged as suspicious by McAfee Web Advisor...

[George P]

seeplus wrote:

The image location is flagged as suspicious by McAfee Web Advisor...

With FireFox I get quite a "wall of text explanation" of what's wrong...

Secure Connection Failed

An error occurred during a connection to i.top4top.io. SSL received a record that exceeded the maximum permissible length. Error code: SSL_ERROR_RX_RECORD_TOO_LONG

* The page you are trying to view cannot be shown because the authenticity of the received data could not be verified.

Even go up to the main URL and FireFox vomits up the error. There is something very wrong with that site.

[George P]

@Hawlong, why don't you find a less risky site to host that image. There are major security issues with it. Using it makes it appear you are deliberately trying to spread a virus or worse.

[malibor]

George P,
How would that be possible? I clicked on image, how could have my PC become infected by this?

[jonnin]

some sort of buffer overflow if your browser is vulnerable to one where this data is processed and if it actually contains a working payload.

[salem c]

@malibor
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=png

[George P]

jonnin wrote:

some sort of buffer overflow if your browser is vulnerable to one where this data is processed and if it actually contains a working payload.

Those are the keys, browser vulnerabilities and potential viral payloads secreted within the file(s) being accessed. Or the site could request information over what is requested as a secure connection that your browser deems as unneeded.

I am NOT saying Hawlong is doing something 'hinky' deliberately, but the 'home page' of the hosting site for the picture has a serious SSL error when dealing with a secure connection does raise for me a lot of red flags. Makes me a tad bit suspicious.

Better safe than sorry when it comes to something available on the interwebz. Especially when the entire site 'pings' a browser warning the connection is to be treated as secure, and it isn't.

[malibor]

Interesting, I guess the worst that could happen is some browser data being stolen, however the browser is running as unpriviledged process therefore system can't be compromised.

Deleting a win account and creating a new one would get rid of potential malware.

[Hawlong]

Malware it's just pictures guys? I do not know what sites are allowed to upload a picture here


Youtube ..

https://www.youtube.com/watch?v=YOOmX8IN6gE

all i need read this bytes by c++

[jonnin]

yea its just pictures. the what-iffing isnt aimed at you :)
Google has a file/image share, for one.

Still need a few more words, though. What, exactly, are you reading, is it a file or a memory location or something else?

[Hawlong]

Thanks jonnin for your replay ..

This data is sent to the server (packet) .

[jonnin]

then its just pointer access, using the length which the packet will know.
c++ does not directly deal with networking and sockets, it uses a library for such things, but they all work the same and somewhere you have a sendto or recievefrom with an 'array of bytes' via the pointer that you can simply iterate.

Since you had to ask, and the above is pretty basic stuff for someone that is already using packets, something is not being said about where you are in your c++ skillset or what you are trying to do -- you are starting to give off that vibe of "Hey, I downloaded the linux source code and want to edit it to run on a dehumidifier but don't know C and can't get it to work, what do I do". That is, the question isn't useful without details and background on what you know, what you have done, what you have downloaded, or something.

[Hawlong]

I am sure you can do that but need some details

any way this packet add to EBX(register).
I can move this packet to [char* sentBuffer]
Example:

__asm{
  mov sentBuffer, ebx
}

now .. i need copy data from sendBuffer to
std::vector<char> logText;

some codes maybe it helps (from google)

char const hex_chars[16] = {'0','1','2','3','4','5','6','7','8','9','A','B','C','D','E','F'};

inline void printSendBufferToLog() {
    char sendID[] = "[SEND] ";

    while (logText.size() > 4096) {
        logText.erase(logText.begin(), logText.begin() + 400);
    }
    if (logText.size() > 1) {
        logText.pop_back();
        logText.push_back('\r');
        logText.push_back('\n');
    }

    for (DWORD i = 0; i < sentLen + 7; ++i) {
        if (i < 7) {
            logText.push_back(sendID[i]);
        }
        else {
            logText.push_back(hex_chars[((sentBuffer)[i - 7] & 0xF0) >> 4]);
            logText.push_back(hex_chars[((sentBuffer)[i - 7] & 0x0F) >> 0]);
            logText.push_back(' ');
        }
    }
    logText.push_back('\0');
    SetWindowTextA(hLog, &logText[0]);
}

[jonnin]

That has a lot of irrelevancy for turning the buffer into hexadecimal text strings. You don't need most of that crap.

you need the size (do you have it, like you have the EBX fetch?), you have the pointer. assuming you can get the size of it, then its really just

std::vector<char> logText(the_size); //size the vector to what you need. 
int dx{};
for(char&c:logText)
{
  c = sentBuffer[dx++]; //for every char in the buffer, copy to the vector. 
}

and your vector will be the right size and populated.
you can use a block copy instead of the loop. I did it in a loop so you can see how to touch every byte in case you need to change one or find a sequence or whatnot. If you can pad both sides to be 64 bit aligned you can copy 8 bytes at a time, if this is a large buffer.

be careful this is using a 32 bit pointer so its very old code or for an embedded computer or something. If you can get the pointer without assembly hacks, and get a full sized 64 bit on, it will work on 64 bit compiles and modern setups.

[coder777]

Or this:

#include <iterator>     // std::back_insert_iterator

...

char sendID[] = "[SEND] ";

std::vector<char> logText(sendID, sendID + std::size(sendID)  - 1); // Note: std::size at least needs C++17

std::copy (sentBuffer, sentBuffer + sentLen, std::back_inserter(logText));

[Hawlong]

thanks so much jonnin , very good example
in memory worked i tested .
but in console i try to print vector elements

		for (char i : logText)
			std::cout << i << ' ';

 ╪ ┤  é ╪ ▌ ┬ 5 ☼ ☺ ■ â N ê ▓ & ╣ X · ; ╟♂  7 3 ╝ ╛ ِ h
 ▌ ┬ 5 ☼ ☺ ■
 â N ê ▓ & ╣ X · ; ╟♂7 3 ╝ ╛ ِ h ç ╡  : ╤ $

And something else how can convert vector<char> logText to const unsigned char
like this:
const unsigned char logText2[] = { 0x89,0x8E,0x5C,0x8E,0x89,0x8E,0xFE,0x75,0x74,0x74,0xE8,0xD8,0xD8 };


thanks for help coder777 <3

[seeplus]

It would be helpful if you posted your latest code and what doesn't work and what you're trying to achieve (without using web links).

#include <iterator>
#include <iostream>
#include <vector>
#include <algorithm>

int main() {
	const char sendID[] { "[SEND] " };
	const std::vector<char> logText(sendID, sendID + std::size(sendID) - 1);

	std::copy(logText.begin(), logText.end(), std::ostream_iterator<char>(std::cout, " "));
}

displays:

[ S E N D ] 

And something else how can convert vector<char> logText to const unsigned char
like this:
const unsigned char logText2[] = { 0x89,0x8E,0x5C,0x8E,0x89,0x8E,0xFE,0x75,0x74,0x74,0xE8,0xD8,0xD8 };

What are you trying to achieve?

Why not vector<unsigned char> if you need unsigned char?