 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
 Posted: Tue Jun 03, 2008 11:55 am Post subject: |
 |
|
If GG hooks the function in ring0, there's no way you can use it in usermode without a driver. (right?) Even if you rewrite the whole api or w/e, at some point you still have to call the kernel mode function, it's unevitable. Of course it will work for api's like PostMessage, but that's because they're not hooked in kernel mode.
So I don't really get what you're trying to say HalfPrime... |
|
| Back to top |
|
 |
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Wed Jun 04, 2008 8:57 am Post subject: |
|
|
| nwongfeiying wrote: | | Wow...I know quite a few peeps on here from DarkRising. Holy shit you guys are pro! |
What does that have to do with this topic?
Anyway. Halfprime, I thought about it, maybe it's possible to use the api's, but let gameguard think you're not using them for hacking. E.g. when you use VirtualQueryEx for another process than the game, it will work. So if somehow you could make gg believe that the handle of the process you give to the function, is not the handle of the game, it'll work.
EDIT: About the KeAttachProcess. Wasn't that already bypassed by the 'fixmemaccess' procedure, which copied the whole function? Or doesn't that work anymore. |
|
| Back to top |
|
|
Ksbunker
Advanced Cheater
![]() Reputation: 0
Joined: 18 Oct 2006
Posts: 88
|
| Posted: Fri Jun 06, 2008 7:48 am Post subject: re: |
|
|
Half-Prime noted he had a method to bypass detours without any code. I'd be very impressed to see how you managed that feat.. without code.
As for methods to bypass detours aside from function trampolines, there is the obvious IAT (only works with functions called via IAT [duh], not GetProcAddress) method... and also... the EAT method whereby you hook the Exported Address Function from within the target dll e.g. Kernel32.dll
Moreover, I realise the function is hooked from kernelmode, but in the event a normal usermode detour was implemented, you can bypass it by using the lower level function (e.g. ZwWriteVirtualMemory) or by using the syscall method. |
|
| Back to top |
|
|
tombana
Master Cheater
![]() Reputation: 2
Joined: 14 Jun 2007
Posts: 456
Location: The Netherlands
|
| Posted: Fri Jun 06, 2008 9:13 am Post subject: Re: re: |
|
|
| Ksbunker wrote: | | Moreover, I realise the function is hooked from kernelmode, but in the event a normal usermode detour was implemented, you can bypass it by using the lower level function (e.g. ZwWriteVirtualMemory) or by using the syscall method. |
Too bad that such lower level functions or syscalls are not documented... and they can change on different systems I suppose. |
|
| Back to top |
|
|
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Fri Jun 06, 2008 5:12 pm Post subject: |
|
|
Some are documented...
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Fri Jun 06, 2008 5:58 pm Post subject: Re: re: |
|
|
| Ksbunker wrote: | | Half-Prime noted he had a method to bypass detours without any code. I'd be very impressed to see how you managed that feat.. without code. |
It's quite easy actually, all you need is a hex editor. 
Oh shit, big clue right there to bypassing all user mode functions. |
|
| Back to top |
|
|
Ksbunker
Advanced Cheater
![]() Reputation: 0
Joined: 18 Oct 2006
Posts: 88
|
| Posted: Fri Jun 06, 2008 10:21 pm Post subject: Re: re: |
|
|
| tombana wrote: | | Too bad [...] syscalls are not documented... and they can change on different systems I suppose |
It is true that the function ID passed in EAX in the syscall can change depending on the Service pack, OS, etc... but there is (at least I think) an easy solution to that. Looking at the code for ZwWriteVirtualMemory, you have;
| Code: | 7C90EA32 > B8 15010000 MOV EAX,115
7C90EA37 BA 0003FE7F MOV EDX,7FFE0300
7C90EA3C FF12 CALL DWORD PTR DS:[EDX]
7C90EA3E C2 1400 RETN 14 |
To dynamically obtain the ID, all you have to do is read a "WORD PTR [ZwWriteVirtualMemory+1]"... and this works for all the ntdll functions that enter syscall.
| Code: | deltaString MACRO szString
call @F
db szString, 0
@@:
ENDM
.data
wpmID dd 0
.code
deltaString "ntdll.dll"
call LoadLibrary
deltaString "ZwWriteVirtualMemory"
push eax
call GetProcAddress
mov ax, WORD PTR [eax+1]
rol eax, 16
xor ax, ax
rol eax, 16
mov wpmID, eax
push param5
push param4
push param3
push param2
push param1
call @WPM_sysenter
push 0
call ExitProcess
@WPM_sysenter:
push ebp
mov ebp, esp
push [ebp+18h]
push [ebp+14h]
push [ebp+10h]
push [ebp+0ch]
push [ebp+8h]
call @stub
leave
retn 014h
@stub:
mov eax, wpmID
mov edx, esp
int 02Eh
ret |
I feel like a whore always suggesting this, but I wrote some WPM anti-hook a while ago, viewable here: http://forum.gamedeception.net/showthread.php?t=12973 |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
