Official site anti-cheat Ultra Core Protector

Home Download F.A.Q. Addons Monitor Forum Support Advertise English version site UCP Anti-Cheat  Russian version site UCP Anti-Cheat
Ultra Core Protector - is the client-server anti-cheat freeware, for server protection from unscrupulous players.

Abilities Supported games  
Half-Life
Condition Zero
Counter-Strike 1.6
Day of Defeat
Adrenaline Gamer
Team Fortress Classic
Counter-Strike Source
MU Online
Ragnarok Online
Half-Life 2 Deathmatch
Adrenaline Gamer 2
Team Fortress 2
UMPMLib – Read memory from any process in usermode

It has a few detection vector but if you understand exactly how this works, you can easily make it undetectable.

Do not use as is, this can be detected if you don’t take the necessary steps.

This can read ANY PROCESS memory directly from the ram. Without opening a handle.

#include
#include "PMemHelper.h"

void main()
{
PMemHelper *mem = new PMemHelper();
uint8_t buffer[255];
auto cr3 = mem->GetDirBase(GetCurrentProcessId()); // Put the PID of the process you want to read
auto base = mem->GetProcessBase(GetCurrentProcessId()); // Put the PID of the process you want to read

//Do all your reading here
mem->ReadVirtual(cr3, base, buffer, sizeof(buffer));
return ;

}

#include "PhysicalMemory.h"

typedef enum _SECTION_INHERIT { ViewShare = 1, ViewUnmap = 2 } SECTION_INHERIT, *PSECTION_INHERIT;

extern "C" NTSTATUS NTAPI ZwOpenSection(PHANDLE, ACCESS_MASK, POBJECT_ATTRIBUTES);
extern "C" NTSTATUS NTAPI ZwMapViewOfSection(_In_ HANDLE SectionHandle, _In_ HANDLE ProcessHandle,
_Inout_ PVOID BaseAddress, _In_ ULONG_PTR ZeroBits, _In_ SIZE_T CommitSize,
_Inout_opt_ PLARGE_INTEGER SectionOffset, _Inout_ PSIZE_T ViewSize,
_In_ SECTION_INHERIT InheritDisposition, _In_ ULONG AllocationType,
_In_ ULONG Win32Protect);
extern "C" NTSTATUS NTAPI ZwUnmapViewOfSection(_In_ HANDLE ProcessHandle, _In_opt_ PVOID BaseAddress);

BOOLEAN MapPhysicalMemory(HANDLE hMemory, PDWORD64 pDwAddress, PSIZE_T pSize, PDWORD64 pDwVirtualAddress)
{
NTSTATUS ntStatus;

LARGE_INTEGER viewBase;
*pDwVirtualAddress = 0;
viewBase.QuadPart = *pDwAddress;
ntStatus = ZwMapViewOfSection(hMemory, GetCurrentProcess(), (void**)pDwVirtualAddress, 0L, *pSize, &viewBase, pSize, ViewShare, 0, PAGE_READWRITE);
if (!NT_SUCCESS(ntStatus))
return false;
*pDwAddress = viewBase.QuadPart;
return true;
}

BOOLEAN UnmapPhysicalMemory(PDWORD64 Address)
{
if (!ZwUnmapViewOfSection(GetCurrentProcess(), (void*)Address))
return true;
else
return false;
}

HANDLE OpenPhysicalMemory()
{
UNICODE_STRING physmemString;
OBJECT_ATTRIBUTES attributes;
WCHAR physmemName[] = L"\\device\\physicalmemory";
NTSTATUS status;
HANDLE physmem;

RtlInitUnicodeString(&physmemString, physmemName);

InitializeObjectAttributes(&attributes, &physmemString, OBJ_CASE_INSENSITIVE, NULL, NULL);

status = ZwOpenSection(&physmem, SECTION_ALL_ACCESS, &attributes);

if (!NT_SUCCESS(status))
{
return NULL;
}

return physmem;
}

int isAscii(int c)
{
return((c >= 'A' && c <= 'z') || (c >= '0' && c <= '9') || c == 0x20 || c == '@' || c == '_' || c == '?'); } int isPrintable(uint32_t uint32) { if ((isAscii((uint32 >> 24) & 0xFF)) && (isAscii((uint32 >> 16) & 0xFF)) && (isAscii((uint32 >> 8) & 0xFF)) &&
(isAscii((uint32) & 0xFF)))
return true;
else
return false;
}

Full sources here: github.com/waryas/UMPMLib

It has a few bugs probably, was tested only in Windows 10 X64.
Not tested on 7,8,8.1 yet (it might need tweaks)

Won’t support 32 bit OS.


 



germantown dental extraction . Gemafreie Musik zum Download . how to design clothes . Galapagos Tours