Patching memory

Question

I've successfully reversed and patched an application on windows, but patching the executable on disk triggers a CRC check and prevents it from loading. I've used x64dbg and have the addresses I need (they are static and don't change on reruns). However, if the unmodified executable is already loaded and running, and then the patches are applied, everything will work fine. My question is how can I write a simple loader to patch those memory addresses after execution? I've been searching for this all over the Internet and can't get my head around it. The boiler plate codes I've found are giving me headaches as fixing the c++ code errors is so confusing.

Here is my code:

#include <windows.h>
#include <stdio.h>
#include <tchar.h>
#include <iostream>

using namespace std;



int main()
{
    int newValue = 0x24;
    uint8_t readTest;
    byte num_char[16];

    HWND hwnd = FindWindowA(NULL, "Playback password authentication");
    if (hwnd == NULL)
    {
        cout << "Cannot find window" << endl;
        Sleep(3000);
        exit(-1);
    }
    else
    {
        DWORD procID;
        GetWindowThreadProcessId(hwnd, &procID);
        HANDLE handle = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);
        if (procID == NULL)
        {
            cout << "Cannot obtain process." << endl;
            Sleep(3000);
            exit(-1);
        }
        else 
        {
            ReadProcessMemory(handle, (PBYTE*)0x0052BD7E, &num_char, sizeof(num_char), 0);
//          WriteProcessMemory(handle, (LPVOID)0x0052BD7E, &newValue, sizeof(newValue), 0);
            cout << num_char << endl;
            Sleep(10000);
        }
    }
}

First I need the code to actually read and print the hex bytes at those addresses so I can make sure the addresses and their values are actually correct. If this returns the correct values, then I think I using WriteProcessMemory won't be that hard. But the problem is the values returned for my addresses are not those I expect and see in x64dbg.

Answer 1

A Process Has N Number of Modules
And these Modules can Load At Different Base Address
so using Addresses Like 0x0052BD7E may yield Wrong Results

Enumerate The Modules
Find The Correct Base Address
Add The Relative Virtual Address
Read From Those Address

here is a small python code that reads the first 10 bytes of Calculator Metro app's ApplicationFrameHost.exe in windows 10 try adapting the concept

from ctypes import *
import win32con
import win32process
import win32api

calwnd = windll.user32.FindWindowW(None,"Calculator")
if(calwnd != None):
    calpid = c_uint32(0)  
    windll.user32.GetWindowThreadProcessId(calwnd,byref(calpid))
    if(calpid.value != 0):
        process_handle = win32api.OpenProcess(win32con.PROCESS_ALL_ACCESS,False,calpid.value)
        if(process_handle != None):
            module_handles = win32process.EnumProcessModules(process_handle)
            print("Total No of Module = %d" % len(module_handles))
            print("base Address Of First Module = %x" % module_handles[0])
            print("Mod1=%s" % win32process.GetModuleFileNameEx(process_handle, module_handles[0]))
            buf = create_string_buffer(16)
            tmp = c_void_p(module_handles[0])
            bread = c_int()
            windll.kernel32.ReadProcessMemory(process_handle.handle,tmp,byref(buf),16,byref(bread))
            for i in range(0,16,1):
                print(buf[i],end=" ") 

executing

D:\pyt>python writeproc.py
Total No of Module = 65
base Address Of First Module = 7ff728780000
Mod1 = C:\WINDOWS\system32\ApplicationFrameHost.exe
b'M' b'Z' b'\x90' b'\x00' b'\x03' b'\x00' b'\x00' b'\x00' b'\x04' b'\x00' b'\x00' b'\x00' b'\xff' b'\xff' b'\x00' b'\x00