Cheat Engine

dnsi0 · Posted: Sun Aug 10, 2008 12:11 pm Post subject:

So is it possible to rewrite the functions such as rpm with asm?

So copy the asm from rpm and construct your own function with it. Will that hop the hook or will the hook still own it?

Slugsnack · Posted: Sun Aug 10, 2008 12:22 pm Post subject:

You can bypass a usermode hook that way but since your function will still eventually have to call the kernelmode version, that will still get hooked if it is a function hooked in kernelmode and other bits and pieces such as KiAttachProcess, etc. But if it just bypasses the usermode hook, a trampoline would just be much easier. Also bear in mind that your program would not be very "compatible" in that the code for APIs differ across different systems.

Although if you really want to go and totally recode an API including every kernel function it uses, then sure that would probably work in terms of bypassing GG's hooks.

dnsi0 · Posted: Sun Aug 10, 2008 1:02 pm Post subject:

lurc · Posted: Sun Aug 10, 2008 2:34 pm Post subject:

Well, ReadProcessMemory will still have to call NtReadVirtualMemory from the ntdll.dll, which will then do a sysenter and call NtReadVirtualMemory from ntoskrnl.exe. The SSDT of NtReadVirtualMemory is hooked via SSDT pointer modification.

Easy way around this, make a driver, store the original address before GameGuard installs its driver, call it from there.

But then there's another problem. KeAttachProcess via ntoskrnl.exe has a 5 byte hook at the beginning of the function. Not only that, functions it calls are also hooked (via 5 byte hook).

Fix for KeAttachProcess: Trampoline over the first 5 bytes.
Fix for inline calls: Hook the bytes before the hooked call, emulate the bytes instruction, then trampoline the first 5 bytes of the called address. (don't forget to emulate those bytes to). Then return after the inline call.

^ Thinking out loud, dunno if it really works, just seems logical.

Also another solution is to just load an entire new ntoskrnl.exe