Cheat Engine Forum Index Cheat Engine
The Official Site of Cheat Engine
 
 FAQFAQ   SearchSearch   MemberlistMemberlist   UsergroupsUsergroups   RegisterRegister 
 ProfileProfile   Log in to check your private messagesLog in to check your private messages   Log inLog in 


hookhop not working....

 
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming
View previous topic :: View next topic  
Author Message
AwayTheWInd
Master Cheater
Reputation: 0

Joined: 11 Sep 2007
Posts: 450
PostPosted: Fri Apr 18, 2008 9:26 pm    Post subject: hookhop not working.... Reply with quote
this is what i did:
DWORD dwTextOut = (DWORD)GetProcAddress( LoadLibrary("gdi32.dll"), "TextOutA" ) + 5;
__declspec(naked) BOOL WINAPI myTextOutA(HDC hdc,int nXStart,int nYStart,LPCTSTR lpString,int cbString)
{
_asm
{
mov edi,edi
push ebp
mov ebp,esp
jmp dword ptr ds:[dwTextOut]
}
}

DWORD WINAPI MonitorHotKeys()
{
while( !bExit )
{
{
char buffer [256];
sprintf(buffer,"Angle = %f",A);
hGunBound = FindWindow("Softnyx","GunBound");
aGunBound = GetDC(hGunBound);
size = strlen(buffer);
//check under
myTextOutA(aGunBound,50,42,buffer,size);
sprintf(buffer,"Wind = %f",WF);


thats part of the code. it wont draw over "GunBound" anyone have an idea? is itbecuz of the directx??
Back to top
View user's profile Send private message
iPromise
Grandmaster Cheater
Reputation: -1

Joined: 27 Jun 2009
Posts: 529
Location: Canada
PostPosted: Thu Dec 24, 2009 1:46 pm    Post subject: Reply with quote
GetDC is under a ring3 hook by GameGuard, a trampoline is just fine.
Back to top
View user's profile Send private message MSN Messenger
Slugsnack
Grandmaster Cheater Supreme
Reputation: 71

Joined: 24 Jan 2007
Posts: 1857
PostPosted: Thu Dec 24, 2009 3:25 pm    Post subject: Reply with quote
wow. it's a coincidence i rediscovered some old sources yesterday on a memory stick. one just happens to be back long long ago when i was practising drawing gdi32 onto flyff. anyway changing the process, window and window class name will get this drawing onto GB too :

Code:
include \masm32\include\masm32rt.inc

TextOutX proto :DWORD, :DWORD, :DWORD, :DWORD, :DWORD
MakeProcessSnapshot proto
IATHook proto
IATTrampoline proto :DWORD

.data

TargetProcess   db      "Neuz.exe",0
WindowName      db      "FLYFF",0
ClassName       db      "D3D Window",0
LibraryName     db      "gdi32.dll",0
FxnName         db      "TextOutA",0
TextString      db      "Slugsnack",0
TextString2     db      "Irwin rams cock !!!",0
IATTargetFxn    dd      GetDC
Colour1         dword   0000FF00h
Colour2         dword   00FF0000h

.data?

SnapShotHandle  dword   ?
ExeName         dword   ?
TargetHandle    dword   ?
hWnd            dword   ?
PID             dword   ?
PIDFromWindow   dword   ?
TextOutAddr     dword   ?
FLYFFDC         dword   ?
FxnAddr         dword   ?
TrampolineAddr  dword   ?
IATEntryAddr    dword   ?
XorKey          dword   ?
XorColour       dword   ?

.code
    Start:

xor ebx, ebx
    invoke AllocConsole
        SetConsoleCaption "Slugsnack Prototyping Drawing"
       
    invoke LoadLibrary, addr LibraryName
    invoke GetProcAddress, eax, addr FxnName
add eax, 5
mov TextOutAddr, eax

        print "Waiting for target process."
    invoke MakeProcessSnapshot

    invoke IATHook

    FindWindowLoop:

    invoke Sleep, 1
    invoke FindWindow, addr ClassName, addr WindowName
test eax, eax
jz FindWindowLoop

mov hWnd, eax
        print "Handle to FLYFF's window has found to be : 0x"
        print uhex$(hWnd), 13, 10, 13, 10

    invoke GetDC, hWnd
mov FLYFFDC, eax

        print "Device context handle of FLYFF is : 0x"
        print uhex$(FLYFFDC), 13, 10

mov eax, offset TextString
xor eax, offset TextString2
mov XorKey, eax

    invoke SetBkColor, FLYFFDC, Colour1
    invoke SetTextColor, FLYFFDC, Colour2
mov ecx, Colour1
xor ecx, Colour2
mov XorColour, ecx

mov edi, len(addr TextString)
mov esi, offset TextString

    TextFxn:

    invoke GetKeyState, 79h
test eax, eax
jnz FinishDrawing
    invoke GetAsyncKeyState, 78h
test eax, eax
jnz ChangeTextString
    invoke TextOutX, FLYFFDC, ebx, ebx, esi, edi
    invoke Sleep, 1
jmp TextFxn

    ChangeTextString:

mov ecx, Colour1
mov eax, Colour2
xor eax, XorColour
mov Colour2, eax
xor ecx, XorColour
mov Colour1, ecx
    invoke SetBkColor, FLYFFDC, Colour1
    invoke SetTextColor, FLYFFDC, Colour2
mov ecx, esi
xor ecx, XorKey
mov edi, len(ecx)
mov esi, ecx
jmp TextFxn

    FinishDrawing:

    invoke ReleaseDC, hWnd, FLYFFDC
    invoke CloseHandle, TargetHandle
    invoke FreeConsole
    invoke ExitProcess, ebx

IATHook proc
LOCAL OldProt:DWORD
LOCAL IATTrampolineProt:DWORD

mov eax, [IATTargetFxn]
add eax, 2
mov eax, [eax]
mov IATEntryAddr, eax
mov eax, [eax]
mov FxnAddr, eax
    invoke VirtualProtect, IATEntryAddr, 4, PAGE_EXECUTE_READWRITE, addr OldProt
mov eax, offset IATTrampoline
mov ecx, IATEntryAddr
mov [ecx], eax
    invoke VirtualProtect, IATEntryAddr, 4, OldProt, addr OldProt
    invoke VirtualProtect, IATTrampoline, 5, PAGE_EXECUTE_READWRITE, addr IATTrampolineProt
mov eax, FxnAddr
mov eax, [eax]
mov ecx, offset IATTrampoline
mov [ecx], eax
mov eax, FxnAddr
add eax, 4
mov al, byte ptr ds:[eax]
mov ecx, [IATTrampoline]
mov byte ptr ds:[ecx+4], al
    invoke VirtualProtect, IATTrampoline, 5, IATTrampolineProt, addr IATTrampolineProt

ret
IATHook endp


MakeProcessSnapshot proc
LOCAL ProcessStructure:PROCESSENTRY32

    NextSnapshot:

    invoke Sleep, 1
    invoke CreateToolhelp32Snapshot, TH32CS_SNAPPROCESS, ebx
mov SnapShotHandle, eax
mov eax, sizeof ProcessStructure
mov ProcessStructure.dwSize, eax
    invoke Process32First, SnapShotHandle, addr ProcessStructure

    @@:

    invoke Sleep, 1
print "."
    invoke Process32Next, SnapShotHandle, addr ProcessStructure
    invoke GetLastError
cmp eax, ERROR_NO_MORE_FILES
je End_Of_Structure
lea esi, ProcessStructure.szExeFile
mov edi, len(addr TargetProcess)
mov eax, len(esi)
    invoke BinSearch, ebx, esi, eax, addr TargetProcess, edi
cmp eax, -1
je @b
jmp ProcessFound

    End_Of_Structure:

    invoke SetLastError, ERROR_SUCCESS
jmp NextSnapshot

    ProcessFound:

mov eax, ProcessStructure.th32ProcessID
mov PID, eax
            cls
            print " ", 13, 10, 13, 10
            print "    ======================================================================", 13, 10
            print "                 Coded in MASM32 by Slugsnack of XMEGaming.net", 13, 10
            print "    ======================================================================", 13, 10, 13, 10, 13, 10, 9, 9
            print "================ HOTKEYS ================", 13, 10, 13, 10, 9, 9
            print "F9       =   Toggle text", 13, 10, 9, 9
            print "F10      =   Close app", 13, 10, 13, 10, 13, 10
            print "Process ID of target process : 0x"
            print uhex$(PID), 13, 10
    invoke OpenProcess, PROCESS_ALL_ACCESS, TRUE, PID
mov TargetHandle, eax
            print "Handle of target process : 0x"
            print uhex$(TargetHandle), 13, 10, 13, 10

ret
MakeProcessSnapshot endp

TextOutX proc V:DWORD, W:DWORD, X:DWORD, Y:DWORD, Z:DWORD
option prologue:none
option epilogue:none

push ebp
mov ebp, esp
test ebx, ebx
jnz MakeOllyEvenHappier
jmp TextOutAddr

    MakeOllyEvenHappier:

ret
TextOutX endp

IATTrampoline proc X:DWORD
option epilogue:none
option prologue:none

push ebp
xchg eax, eax
xchg eax, eax
mov ebp, esp
push eax
mov eax, FxnAddr
add eax, 5
mov TrampolineAddr, eax
pop eax
test ebx, ebx
jnz MakeOllyHappy
jmp TrampolineAddr

    MakeOllyHappy:
   
ret
IATTrampoline endp

    end Start


also, lol @ ugly code

here is a cuter IAT hook i made about half a year ago :

Code:
include \masm32\include\masm32rt.inc
include \masm32\include\psapi.inc
includelib \masm32\lib\psapi.lib

main proto
HookFxn proto

.data

szTempFile          byte            "IAT Hook.txt", 0
szModulename        byte            "user32.dll", 0
szProcname          byte            "MessageBoxA", 0

bPlaceHooks         bool            TRUE

szParam1            byte            "Param 1 : 0x"
szParam2            byte            "Param 2 : 0x"
szParam3            byte            "Param 3 : 0x"
szParam4            byte            "Param 4 : 0x"

.data?

hInstance           dword           ?
hProcess            dword           ?
hFile               dword           ?
hSnapshot           dword           ?
lpProc              dword           ?
me                  MODULEENTRY32   <>
szFilename          byte 255 dup    (?)

.code

LibMain proc instance:DWORD,reason:DWORD,unused:DWORD

    .IF reason == DLL_PROCESS_ATTACH
        mrm hInstance, instance       ; copy local to global
            invoke CreateThread, 0, 0, addr main, 0, 0, 0
        mov eax, TRUE                 ; return TRUE so DLL will start

    .ELSEIF reason == DLL_PROCESS_DETACH

    .ELSEIF reason == DLL_THREAD_ATTACH

    .ELSEIF reason == DLL_THREAD_DETACH

    .ENDIF

ret
LibMain endp

main proc
LOCAL flOldProtect:DWORD

xor ebx, ebx

    invoke GetCurrentProcessId
    invoke OpenProcess, PROCESS_ALL_ACCESS, FALSE, eax
mov hProcess, eax

    invoke GetModuleFileNameEx, hProcess, hInstance, addr szFilename, 255
mov ecx, offset szFilename

    @@:

dec eax
cmp byte ptr ds:[eax+ecx], '\'
jne @b

mov byte ptr ds:[eax+ecx+1], 0


mov eax, add$(addr szFilename, addr szTempFile)
    invoke CreateFile, addr szFilename, GENERIC_READ OR GENERIC_WRITE, ebx, ebx, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, ebx
mov hFile, eax
    invoke SetEndOfFile, eax

    invoke GetModuleHandle, addr szModulename
    invoke GetProcAddress, eax, addr szProcname
mov edi, eax
mov lpProc, eax

    restoreIAT:

    invoke CreateToolhelp32Snapshot, TH32CS_SNAPMODULE, ebx
mov hSnapshot, eax

mov me.dwSize, sizeof me
    invoke Module32First, eax, addr me

    @@:

mov eax, me.modBaseAddr         ; address of PE header
add eax, 3Ch                    ; offset to value of offset to PE signature
mov eax, dword ptr ds:[eax]
add eax, me.modBaseAddr         ; eax = pointer to PE signature
add eax, 0D8h                   ; eax = pointer to pointer to IAT

mov esi, dword ptr ds:[eax]     ; esi = pointer to offset of IAT
add esi, me.modBaseAddr         ; esi = pointer to IAT
mov ecx, dword ptr ds:[eax+4]   ; ecx = IAT size

    .WHILE ecx != 0

        .IF dword ptr ds:[esi+4*ecx] == edi

            lea esi, [esi+4*ecx]
                invoke VirtualProtect, esi, 4, PAGE_EXECUTE_READWRITE, addr flOldProtect

                .IF bPlaceHooks == 1
                    mov dword ptr ds:[esi], offset HookFxn
                .ELSE
                    mov eax, lpProc
                    mov dword ptr ds:[esi], eax
                .ENDIF

                invoke VirtualProtect, esi, 4, flOldProtect, addr flOldProtect
            mov ecx, 1

        .ENDIF
       
        dec ecx

    .ENDW

    invoke Module32Next, hSnapshot, addr me
test eax, eax
jnz @b

    invoke CloseHandle, hSnapshot

    .IF bPlaceHooks == TRUE

        xor eax, eax
       
            .WHILE eax == 0
       
                    invoke Sleep, 100
                    invoke GetAsyncKeyState, VK_F10
       
            .ENDW
       
        mov bPlaceHooks, FALSE
        mov edi, offset HookFxn
        jmp restoreIAT

    .ENDIF

    invoke CloseHandle, hFile
    invoke CloseHandle, hProcess
    invoke FreeLibraryAndExitThread, hInstance, ebx

ret
main endp

HookFxn proc
OPTION PROLOGUE:NONE
OPTION EPILOGUE:NONE

push ebp
mov ebp, esp
pushad

mov edi, lengthof szParam1
mov ebx, dword ptr ss:[ebp+8]
mov eax, fwrite(hFile, addr szParam1, edi)
            fprint hFile, uhex$(ebx)

mov ebx, dword ptr ss:[ebp+0Ch]
mov eax, fwrite(hFile, addr szParam2, edi)
            fprint hFile, uhex$(ebx)

mov ebx, dword ptr ss:[ebp+010h]
mov eax, fwrite(hFile, addr szParam3, edi)
            fprint hFile, uhex$(ebx)

mov ebx, dword ptr ss:[ebp+014h]
mov eax, fwrite(hFile, addr szParam4, edi)
            fprint hFile, uhex$(ebx)

popad
pop ebp
jmp lpProc

ret
HookFxn endp

end LibMain


i think i put an IAT hook there as POC since a regular trampoline would've done
Back to top
View user's profile Send private message
Display posts from previous:   
Post new topic   Reply to topic    Cheat Engine Forum Index -> General programming All times are GMT - 6 Hours
Page 1 of 1

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum


Powered by phpBB © 2001, 2005 phpBB Group

CE Wiki   IRC (#CEF)   Twitter
Third party websites