 |
Cheat Engine The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
oib111 I post too much
Reputation: 0
Joined: 02 Apr 2007 Posts: 2947 Location: you wanna know why?
|
Posted: Fri Jul 25, 2008 4:49 pm Post subject: |
|
|
Nobody caught it, but you declared the array as BYTE[5] varname instead of BYTE varname[5].
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
 |
rapion124 Grandmaster Cheater Supreme
Reputation: 0
Joined: 25 Mar 2007 Posts: 1095
|
Posted: Fri Jul 25, 2008 4:57 pm Post subject: |
|
|
What you are trying to do is called inline hooking. You modify the execution flow of a program by placing a jmp instruction. Placing the hook is the easy part. Your actual hook function needs to have a few things: a way to return execution flow to the original code, proper understanding of registers and stack, and restoration of the overwritten instructions. If you don't have those things, your hook will fail and the program just crashes.
Here's my code to install an inline hook:
| Code: |
DWORD CalculateJmpOffset(DWORD dwSource, DWORD dwDestination)
{
DWORD dwRet;
dwRet = (dwDestination - dwSource - 5);
return dwRet;
}
BOOL InstallInlineHook(DWORD dwHookAddress, DWORD dwHookProc, SIZE_T nCrumbBytes)
{
BOOL bRet = FALSE;
DWORD dwOldProtect1, dwOldProtect2;
if (VirtualProtect(LPVOID(dwHookAddress), nCrumbBytes + 5, PAGE_EXECUTE_READWRITE, &dwOldProtect1)) //Unprotect memory
{
(*(BYTE *)(dwHookAddress)) = 0xE9; //0xE9 = jmp short relative
(*(DWORD *)(dwHookAddress + 1)) = CalculateJmpOffset(dwHookAddress, dwHookProc);
if (nCrumbBytes > 0)
{
memset((void *)(dwHookAddress + 5), 0x90, nCrumbBytes);
}
bRet = VirtualProtect(LPVOID(dwHookAddress), nCrumbBytes + 5, dwOldProtect1, &dwOldProtect2);
}
return bRet;
}
|
|
|
| Back to top |
|
 |
oib111 I post too much
Reputation: 0
Joined: 02 Apr 2007 Posts: 2947 Location: you wanna know why?
|
Posted: Fri Jul 25, 2008 5:12 pm Post subject: |
|
|
I know what inline hooking was. I was just wondering if I could apply the hotpatching method (replacing the first five bytes with a jump) for program defined functions. And your code could use some cleaning. It works, but it has lots of code that isn't needed, and bad ways of doing things.
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
 |
Dark Byte Site Admin
Reputation: 475
Joined: 09 May 2003 Posts: 25982 Location: The netherlands
|
Posted: Fri Jul 25, 2008 5:17 pm Post subject: |
|
|
my preferred method:
Add a disassembler/assembler to your hooker. (write it yourself, or use a dll. Sure, the package will grow several KB's, but who cares? not me!)
Disassemble the start of the routine till you have at least 5 bytes.
Then let the assembler write the following:
originalcode (reassembled, so all relative jumps will be written successfully)
jmp "after the bytesyoudisassembled"
And then you can safely assemble a "jmp toyourhook" at the spot you want to hook.
Sure, it's not really advanced, and it's taking the easy way out, but hey, it works...
Just find yourself a good assembler/disassembler dll (and if you're bored, the ce source compile the assembler ,disassembler and even auto assembler as a dll if you do some minor changes and make new project files)
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
 |
Ferocious Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008 Posts: 54
|
Posted: Fri Jul 25, 2008 10:08 pm Post subject: |
|
|
@HalfPrime : i've already edited my previous post, i've said that im sorry for the misleading infomation.
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
 |
|
|
You cannot post new topics in this forum You cannot reply to topics in this forum You cannot edit your posts in this forum You cannot delete your posts in this forum You cannot vote in polls in this forum You cannot attach files in this forum You can download files in this forum
|
|