Question

Well, I have recently created a programs in C# that alters a program’s memory, it will work, but every time I close the program and re-open it, I have to go and find the memory value again, is there a way I can prevent the program’s memory from changing after I close it?

public partial class Form1 : Form
{

    public Form1()
    {
        InitializeComponent();
    }

    [DllImport("kernel32.dll")]
    static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, [MarshalAs(UnmanagedType.Bool)] bool bInheritHandle, int dwProcessId);

    [DllImport("kernel32.dll", SetLastError = true)]
    static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, uint nSize, out int lpNumberOfBytesWritten);

    [DllImport("kernel32.dll")]
    public static extern Int32 CloseHandle(IntPtr hProcess);

    [Flags]
    public enum ProcessAccessFlags : uint
    {
        All = 0x001F0FFF,
        Terminate = 0x00000001,
        CreateThread = 0x00000002,
        VMOperation = 0x00000008,
        VMRead = 0x00000010,
        VMWrite = 0x00000020,
        DupHandle = 0x00000040,
        SetInformation = 0x00000200,
        QueryInformation = 0x00000400,
        Synchronize = 0x00100000
    }

    public static void WriteMem(Process p, int address, long v)
    {
        var hProc = OpenProcess(ProcessAccessFlags.All, false, (int)p.Id);
        var val = new byte[] { (byte)v };

        int wtf = 0;
        WriteProcessMemory(hProc, new IntPtr(address), val, (UInt32)val.LongLength, out wtf);

        CloseHandle(hProc);
    }

    private void notify(string not)
    {
        if (textBox1.Text != "")
        {
            textBox1.Text += Environment.NewLine;
        }

        textBox1.Text += not;
    }

    private void button1_Click(object sender, EventArgs e)
    {
        var p = Process.GetProcessesByName("SAFlashPlayer").FirstOrDefault();
        WriteMem(p, 0x07A6A0C1, 1000);
        notify("A lot of Ability Points added.");
    }
    private void button2_Click(object sender, EventArgs e)
    {
        var p = Process.GetProcessesByName("SAFlashPlayer").FirstOrDefault();
        //WriteMem(p, 0x008373CC, 0);
        notify("Power set to 0.");
    }

    private void Checker_Tick(object sender, EventArgs e)
    {
        Process[] pname = Process.GetProcessesByName("SAFlashPlayer");

        if (pname.Length == 0)
        {
            button1.Enabled = false;
            button2.Enabled = false;
            status.ForeColor = System.Drawing.Color.Red;
            status.Text = "Flash Player not running!";
        }
        else
        {
            button1.Enabled = true;
            button2.Enabled = true;
            status.ForeColor = System.Drawing.Color.Green;
            status.Text = "Flash Player running!";
        }
    }
}

Answer 1

Yes, cheating is hard – paying gold farmers is easier. It is most likely you need to scan the other process for values/patterns you want to update after every program restart since memory layout have good chance to change, especialy on Win7.

In old good times people would just update executable itself… After reading some article in printed magazine…

Nowdays with all JIT, ASLR, compressed/encoded executatbles and scripts or even remote loaded modules/SWF it is much harder. So blame internet on need to spend more efforts when cheat.