forked from ldebug/BetaShield
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathMemoryScan.cpp
More file actions
64 lines (55 loc) · 2.16 KB
/
Copy pathMemoryScan.cpp
File metadata and controls
64 lines (55 loc) · 2.16 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
#include "ProjectMain.h"
#include "Main.h"
#include "Scan.h"
#include "DynamicWinapi.h"
#include "Functions.h"
#include "CLog.h"
#include "VersionHelpers.h"
LPVOID pMemoryWatchdog;
void CScan::InitializeMemoryWatchdog()
{
#ifdef _DEBUG
LPLog->AddLog(0, "Memory Watchdog creating..");
#endif
__try {
pMemoryWatchdog = BetaFunctionTable->VirtualAlloc(0, 0x10000, MEM_COMMIT | MEM_RESERVE, PAGE_READWRITE);
}
__except (1) {
#ifdef _DEBUG
LPLog->ErrorLog(0, "Memory Watchdog creation returned as exception");
#endif
}
#ifdef _DEBUG
if (pMemoryWatchdog)
LPLog->AddLog(0, "Memory Watchdog created on: %p", pMemoryWatchdog);
else
LPLog->AddLog(0, "Memory Watchdog create failed!");
#endif
}
void CScan::CheckMemoryWatchdog()
{
if (!pMemoryWatchdog)
return;
PSAPI_WORKING_SET_EX_INFORMATION pworkingSetExInformation = { 0 };
pworkingSetExInformation.VirtualAddress = pMemoryWatchdog;
if (NT_SUCCESS(BetaFunctionTable->NtQueryVirtualMemory(NtCurrentProcess, NULL, MemoryWorkingSetExInformation, &pworkingSetExInformation, sizeof(pworkingSetExInformation), NULL)))
{
if (pworkingSetExInformation.VirtualAttributes.Valid) {
CHAR __warn[] = { 'G', 'a', 'm', 'e', ' ', 'm', 'e', 'm', 'o', 'r', 'y', ' ', 'i', 's', ' ', 'n', 'o', 't', ' ', 'c', 'o', 'r', 'r', 'e', 'c', 't', '.', ' ', 'P', 'l', 'e', 'a', 's', 'e', ' ', 'd', 'o', ' ', 'n', 'o', 't', ' ', 'u', 's', 'e', ' ', 'c', 'h', 'e', 'a', 't', '.', 0x0 }; // Game memory is not correct. Please do not use cheat.
LPFunctions->CloseProcess(__warn, false, "");
}
}
else
{
if (IsWindowsVistaOrGreater() == true)
{
if (BetaFunctionTable->QueryWorkingSetEx(NtCurrentProcess, &pworkingSetExInformation, sizeof(pworkingSetExInformation)))
{
if (pworkingSetExInformation.VirtualAttributes.Valid) {
CHAR __warn[] = { 'G', 'a', 'm', 'e', ' ', 'm', 'e', 'm', 'o', 'r', 'y', ' ', 'i', 's', ' ', 'n', 'o', 't', ' ', 'c', 'o', 'r', 'r', 'e', 'c', 't', '.', ' ', 'P', 'l', 'e', 'a', 's', 'e', ' ', 'd', 'o', ' ', 'n', 'o', 't', ' ', 'u', 's', 'e', ' ', 'c', 'h', 'e', 'a', 't', '.', '.', 0x0 }; // Game memory is not correct. Please do not use cheat..
LPFunctions->CloseProcess(__warn, false, "");
}
}
}
}
}