BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
 Posted: Tue Sep 02, 2008 4:08 pm Post subject: sorry for misprint of name GetThreadContext SetThreadContext |
 |
|
//sorry for misprint of names for GetThreadContext SetThreadContext
//my Bad.. hopefully this makes up for it xD
include tlhelp32.h to use this function :d
this code is a rework of tabris's Win9x Dll Injector on GameDeceptions forums..
this version is recoded for CallSite redirection so big Thanks to him for the base code.
| Code: |
//ascii Functions are just wrappers around Unicode Functions
//so to cut execution time use Unicode API...
void SetEip(WCHAR* ProcessName,DWORD CallSite,DWORD Param1,DWORD Param2)
{
PROCESSENTRY32W Pe32;
THREADENTRY32 Te32;
CONTEXT Context;
HANDLE pSnap,tSnap,hThread,hProcess;
pSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS,NULL);
if(pSnap == INVALID_HANDLE_VALUE)
{
return;
}
Pe32.dwSize = sizeof(PROCESSENTRY32);
if(!Process32FirstW(SnapShot,&Pe32))
{
CloseHandle(pSnap);
return;
}
//it is never the first process...
do
{
if(wcscmp(ProcessName,Pe32.szExeFile) == 0)
{
hProcess = OpenProcess(PROCESS_ALL_ACCESS,0,Pe32.th32ProcessID);
break;
}
}while(Process32NextW(pSnap,&Pe32));
if(hProcess == INVALID_HANDLE_VALUE)
{
CloseHandle(pSnap);
return;
}
tSnap = CreateToolhelp32Snapshot(TH32_SNAPTHREAD,Pe32.th32ProcessID);
if(tSnap == INVALID_HANDLE_VALUE)
{
CloseHandle(pSnap);
return;
}
if(!Thread32First(tSnap,&Te32);
{
CloseHandle(pSnap);
CloseHandle(tSnap);
return;
}
if(Te32.th32OwnerProcessID == Pe32.th32ProcessID)
{
hThread = OpenThread(THREAD_ALL_ACCESS,0,Te32.th32ThreadID);
if(hThread == INVALID_HANDLE_VALUE)
{
CloseHandle(pSnap);
CloseHandle(tSnap);
return;
}
SuspendThread(hThread);
memset(&Context,0,sizeof(CONTEXT));
Context.ContextFlags = CONTEXT_FULL;
if(GetThreadContext(hThread,&Context) == 0)
{
CloseHandle(pSnap);
CloseHandle(tSnap);
CloseHandle(hThread);
return;
}
//0 Parameter Call...
if(Param1 == -1 && Param2 == -1)
{
DWORD ParamSize = 0;
}
//1 Parameter Call...
if(Param1 != -1 && Param2 == -1)
{
DWORD ParamSize = sizeof(Param1);
}
if(Param1 != -1 && Param2 != -1)
{
DWORD ParamSize = (sizeof(Param1) + sizeof(Param2));
}
DWORD OldEsp = Context.Esp;
DWORD OldEip = Context.Eip;
Context.Esp -= ParamSize;
DWORD CodeStack = 0x40 + Context.Esp;
char *Code = new char[ParamSize];
if(Code == NULL)
{
return;
}
memset(&Code,0x90,ParamSize);//fill with nops ;]
char *cp = Code;
*cp++ = 0x60; //pushad
if(Param2 != - 1)
{
*cp++ = 0x68; //push
*(DWORD*)cp = Param2;
cp +=4;
}
if(Param1 != -1)
{
*cp++ = 0x68; //push
*(DWORD*)cp = Param1;
cp +=4;
}
*cp++ = 0xe8; // call...
*(DWORD*)cp = CallSite - (CodeStack + ((int)cp - (int)Code) + 4);
cp+ = 4;
// Restore the stack and jump back
*cp++ = 0x61; // popad
*cp++ = 0xbc; // mov esp...
*(DWORD*)p = OldEsp; // ...oldesp
cp += 4;
*cp++ = 0xe9; // jmp
*(DWORD*)cp = OldEip - (CodeStack + ((int)cp - (int)Code) + 4); // ...original EIP
cp += 4;
// set EIP to the start of our code on the stack
Context.Eip = CodeStack;
SetThreadContext(hThread,&Context);
WriteProcessMemory(hProcess, (LPVOID)CodeStack, Code, ParamSize, NULL);
FlushInstructionCache(hProcess,(LPCVOID)CodeStack,sizeof(ParamSize));
ResumeThread(hThread);
delete [] Code;
CloseHandle(pSnap);
CloseHandle(tSnap);
CloseHandle(hProcess);
CloseHandle(hThread);
return;
}
else
{
CloseHandle(pSnap);
CloseHandle(tSnap);
return;
}
}
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
