Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


IAT Hooks

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
viktor00
Newbie cheater
Reputation: 0

Joined: 19 Oct 2007
Posts: 14
PostPosted: Sat Mar 08, 2008 11:25 am    Post subject: IAT Hooks Reply with quote
Hi, could someone tell me how to hook IAT entries of a game for example? I want to hook the IAT entries for WSA Send and Receive of the online game Flyff in C++. If somebody could help me please do so.
Back to top
View user's profile Send private message
atom0s
Moderator
Reputation: 205

Joined: 25 Jan 2006
Posts: 8587
Location: 127.0.0.1
PostPosted: Sat Mar 08, 2008 1:37 pm    Post subject: Reply with quote
Uh... ok I posted a source code and it posted a link instead to something I haven't seen...


Anyway this is from Patricks sources on GameDeception.net:

Code:
FARPROC HookImportFunction( HMODULE hModule, const char * szModuleName, const char * szFunctionName, DWORD dwHookFunction )
{
   PIMAGE_NT_HEADERS         pNtHeader         = NULL;
   PIMAGE_IMPORT_DESCRIPTOR   pImportDescriptor   = NULL;
   PIMAGE_THUNK_DATA         pThunk            = NULL;
   FARPROC                  fpFunction         = NULL;
   HMODULE                  hOwnerModule      = GetModuleHandle( szModuleName );
   DWORD                  dwProtect[2]      = { 0 };
   BOOL                  bHooked            = FALSE;

   if( (fpFunction = GetProcAddress( hOwnerModule, szFunctionName )) == NULL ) { return( NULL ); }
   if( ((PIMAGE_DOS_HEADER)hModule)->e_magic != IMAGE_DOS_SIGNATURE ) { return( NULL ); }

   pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)hModule + (DWORD)((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
   if( pNtHeader->Signature != IMAGE_NT_SIGNATURE ) { return( NULL ); }

   pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)hModule + (DWORD)pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
   while( pImportDescriptor->Name != NULL )
   {
      if( stricmp( (char*)((DWORD)hModule + (DWORD)pImportDescriptor->Name), szModuleName ) == 0 )
      {
         if( pImportDescriptor->Name == NULL ) { return( NULL ); }
         pThunk = (PIMAGE_THUNK_DATA)((DWORD)hModule + (DWORD)pImportDescriptor->FirstThunk);
         while( pThunk->u1.Function != NULL )
         {
            if( pThunk->u1.Function == (DWORD)fpFunction )
            {
               if( VirtualProtect( (LPVOID)&pThunk->u1.Function, sizeof( DWORD ), PAGE_EXECUTE_READWRITE, &dwProtect[0] ) == FALSE )
               {
                  return( NULL );
               }

               if( IsBadWritePtr( (LPVOID)&pThunk->u1.Function, sizeof( DWORD ) ) == 0 )
               {
                  bHooked = TRUE;
                  pThunk->u1.Function = (DWORD)dwHookFunction;
               }
               
               if( VirtualProtect( (LPVOID)&pThunk->u1.Function, sizeof( DWORD ), dwProtect[0] , &dwProtect[1] ) == FALSE )
               {
                  return( NULL );
               }
            }
            if( bHooked == TRUE ) { break; }
            pThunk++;
         }

      }
      if( bHooked == TRUE ) { break; }
      pImportDescriptor++;
   }

   if( bHooked == TRUE ) { return( fpFunction ); }
   return( NULL );
}

BOOL UnhookImportFunction( HMODULE hModule, const char * szModuleName, const char * szFunctionName, DWORD dwHookFunction )
{
   PIMAGE_NT_HEADERS         pNtHeader         = NULL;
   PIMAGE_IMPORT_DESCRIPTOR   pImportDescriptor   = NULL;
   PIMAGE_THUNK_DATA         pThunk            = NULL;
   FARPROC                  fpFunction         = NULL;
   HMODULE                  hOwnerModule      = GetModuleHandle( szModuleName );
   DWORD                  dwProtect[2]      = { 0 };
   BOOL                  bUnhooked         = FALSE;

   if( (fpFunction = GetProcAddress( hOwnerModule, szFunctionName )) == NULL ) { return( FALSE ); }
   if( ((PIMAGE_DOS_HEADER)hModule)->e_magic != IMAGE_DOS_SIGNATURE ) { return( FALSE ); }

   pNtHeader = (PIMAGE_NT_HEADERS)((DWORD)hModule + (DWORD)((PIMAGE_DOS_HEADER)hModule)->e_lfanew);
   if( pNtHeader->Signature != IMAGE_NT_SIGNATURE ) { return( FALSE ); }

   pImportDescriptor = (PIMAGE_IMPORT_DESCRIPTOR)((DWORD)hModule + (DWORD)pNtHeader->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress);
   while( pImportDescriptor->Name != NULL )
   {
      if( stricmp( (char*)((DWORD)hModule + (DWORD)pImportDescriptor->Name), szModuleName ) == 0 )
      {
         if( pImportDescriptor->Name == NULL ) { return( FALSE ); }
         pThunk = (PIMAGE_THUNK_DATA)((DWORD)hModule + (DWORD)pImportDescriptor->FirstThunk);
         while( pThunk->u1.Function != NULL )
         {
            if( pThunk->u1.Function == (DWORD)dwHookFunction )
            {
               if( VirtualProtect( (LPVOID)&pThunk->u1.Function, sizeof( DWORD ), PAGE_EXECUTE_READWRITE, &dwProtect[0] ) == FALSE )
               {
                  return( FALSE );
               }

               if( IsBadWritePtr( (LPVOID)&pThunk->u1.Function, sizeof( DWORD ) ) == 0 )
               {
                  bUnhooked = TRUE;
                  pThunk->u1.Function = (DWORD)fpFunction;
               }
               
               if( VirtualProtect( (LPVOID)&pThunk->u1.Function, sizeof( DWORD ), dwProtect[0] , &dwProtect[1] ) == FALSE )
               {
                  return( FALSE );
               }
            }
            if( bUnhooked == TRUE ) { break; }
            pThunk++;
         }

      }
      if( bUnhooked == TRUE ) { break; }
      pImportDescriptor++;
   }

   if( bUnhooked == TRUE ) { return( TRUE ); }
   return( FALSE );
}

_________________
- Retired.
Back to top
View user's profile Send private message Visit poster's website
viktor00
Newbie cheater
Reputation: 0

Joined: 19 Oct 2007
Posts: 14
PostPosted: Sat Mar 08, 2008 2:22 pm    Post subject: Reply with quote
thanks a lot
and also for the link I'll go and try to find out there how to exactly find the adresses and other details.
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites