| View previous topic :: View next topic |
| Author |
Message |
kitterz Grandmaster Cheater Supreme
Reputation: 0
Joined: 24 Dec 2007 Posts: 1268
|
Posted: Thu Jul 10, 2008 9:03 pm Post subject: [Question] Error Bypassing GetPixel |
|
|
I think one can bypass gg to use GetPixel by adding the 5 bytes like the postmesage bypass...right? Or am I mistaken?
Edit: Now I am getting the error
| Code: | | Run-Time Check Failure #0 - The value of ESP was not properly saved across a function call. This is usually a result of calling a function declared with one calling convention with a function pointer declared with a different calling convention. |
Anyone can help?
Last edited by kitterz on Fri Jul 11, 2008 9:09 am; edited 1 time in total |
|
| Back to top |
|
 |
lurc Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006 Posts: 1900
|
Posted: Thu Jul 10, 2008 9:05 pm Post subject: |
|
|
Yes you are correct.
_________________
|
|
| Back to top |
|
 |
oib111 I post too much
Reputation: 0
Joined: 02 Apr 2007 Posts: 2947 Location: you wanna know why?
|
Posted: Thu Jul 10, 2008 9:07 pm Post subject: |
|
|
Yea...
| Code: |
DWORD GPA = (DWORD)GetProcAddress(LoadLibrary("USER32.DLL"), "GetPixel")+5;
_declspec(naked) COLORREF GetPixelX(HDC hdc, int nXPos, int nYPos) {
_asm {
mov edi, edi
push ebp
mov ebp, esp
jmp[GPA]
}
}
|
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
 |
kitterz Grandmaster Cheater Supreme
Reputation: 0
Joined: 24 Dec 2007 Posts: 1268
|
Posted: Thu Jul 10, 2008 9:18 pm Post subject: |
|
|
| oib111 wrote: | Yea...
| Code: |
DWORD GPA = (DWORD)GetProcAddress(LoadLibrary("USER32.DLL"), "GetPixel")+5;
_declspec(naked) COLORREF GetPixelX(HDC hdc, int nXPos, int nYPos) {
_asm {
mov edi, edi
push ebp
mov ebp, esp
jmp[GPA]
}
}
|
|
Thx but i already knew how XD
|
|
| Back to top |
|
 |
Symbol I'm a spammer
Reputation: 0
Joined: 18 Apr 2007 Posts: 5094 Location: Israel.
|
Posted: Thu Jul 10, 2008 10:21 pm Post subject: |
|
|
| oib111 wrote: | Yea...
| Code: |
DWORD GPA = (DWORD)GetProcAddress(LoadLibrary("USER32.DLL"), "GetPixel")+5;
_declspec(naked) COLORREF GetPixelX(HDC hdc, int nXPos, int nYPos) {
_asm {
mov edi, edi
push ebp
mov ebp, esp
jmp[GPA]
}
}
|
|
| Code: | | jmp dword ptr ds:[GPA] |
And you can simply do:
| Code: | | jmp dword ptr ds:[GetPixel+5] |
or of this doesn't work:
| Code: | mov eax,dword ptr ds:[GetPixel]
add eax,5
jmp eax |
|
|
| Back to top |
|
 |
Flyte Peanuts!!!!
Reputation: 6
Joined: 19 Apr 2006 Posts: 1887 Location: Canada
|
Posted: Thu Jul 10, 2008 10:30 pm Post subject: |
|
|
| Symbol wrote: | And you can simply do:
| Code: | | jmp dword ptr ds:[GetPixel+5] |
or of this doesn't work:
| Code: | mov eax,dword ptr ds:[GetPixel]
add eax,5
jmp eax |
|
You are making the assumption that the IAT isn't also hooked.
|
|
| Back to top |
|
 |
Stylo Grandmaster Cheater Supreme
Reputation: 3
Joined: 16 May 2007 Posts: 1073 Location: Israel
|
Posted: Thu Jul 10, 2008 11:25 pm Post subject: |
|
|
btw thats's "Gdi32.Dll" not "User32.Dll"
_________________
Stylo |
|
| Back to top |
|
 |
kitterz Grandmaster Cheater Supreme
Reputation: 0
Joined: 24 Dec 2007 Posts: 1268
|
Posted: Fri Jul 11, 2008 7:35 am Post subject: |
|
|
| 1qaz wrote: | | btw thats's "Gdi32.Dll" not "User32.Dll" |
Yep, I was wondering when someone was going to notice that XD
|
|
| Back to top |
|
 |
|