| View previous topic :: View next topic |
| Author |
Message |
GMZorita
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 21 Mar 2007
Posts: 1361
|
 Posted: Wed Sep 17, 2008 2:30 pm Post subject: |
 |
|
| kitterz wrote: | | 1qaz wrote: | | i think something wrong with my virtualprotect cuz it fail all the time changing the memory protection to execute_readwrite |
Im pretty sure you need to hook hop it.
| Code: | //VProtect Bypass
static const FARPROC Vprotect = (FARPROC)((DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "VirtualProtectEx")+5);
_declspec(naked) BOOL WINAPI FixMem(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect)
{
_asm
{
mov edi,edi
push ebp
mov ebp,esp
jmp Vprotect
}
} |
|
wow delete your post while you can!
Oh nvm you can't anymore.
The reason why we use the trampoline its to bypass GG...
He doesnt have to worry about GameGuard.
Besides I'm almost sure that MineSweeper is already as W/R/E.
_________________
Gone |
|
| Back to top |
|
 |
kitterz
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 24 Dec 2007
Posts: 1268
|
| Posted: Wed Sep 17, 2008 3:33 pm Post subject: |
|
|
| GMZorita wrote: | | kitterz wrote: | | 1qaz wrote: | | i think something wrong with my virtualprotect cuz it fail all the time changing the memory protection to execute_readwrite |
Im pretty sure you need to hook hop it.
| Code: | //VProtect Bypass
static const FARPROC Vprotect = (FARPROC)((DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "VirtualProtectEx")+5);
_declspec(naked) BOOL WINAPI FixMem(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect)
{
_asm
{
mov edi,edi
push ebp
mov ebp,esp
jmp Vprotect
}
} |
|
wow delete your post while you can!
Oh nvm you can't anymore.
The reason why we use the trampoline its to bypass GG...
He doesnt have to worry about GameGuard.
Besides I'm almost sure that MineSweeper is already as W/R/E. |
Oh.... 
LOL I did not reall all the post...I got it wrong this time 
_________________
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Wed Sep 17, 2008 4:15 pm Post subject: |
|
|
You only need to virtual protect if you're accessing memory from another program. Since you're using a dll and will be inside the address space of the program you're trying to edit, you don't need to use it.
You shouldn't use naked because you're just using the function as a regular function, not as something injected.
try *(BYTE[6]*)(address) = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; instead of the ASM to see whether it's what you're doing that's messing it up or if it's how you're doing it.
_________________
|
|
| Back to top |
|
|
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Sep 17, 2008 4:42 pm Post subject: |
|
|
| Jani wrote: | | oib111 wrote: | | Just wondering. What exactly is the prologue and epilogue when you talk about naked functions? |
There's none. That's why it's called naked. |
I thought naked meant you have to create your own? And even so, I would still like to know what it is =P
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
nog_lorp
Grandmaster Cheater
 Reputation: 0
Joined: 26 Feb 2006
Posts: 743
|
| Posted: Wed Sep 17, 2008 4:58 pm Post subject: |
|
|
Naked stops the prologue/epilogue from being generated. You still need to make one to stop it from crashing, unless you want it to lead in to another function.
_________________
Mutilated lips give a kiss on the wrist of the worm-like tips of tentacles expanding in my mind
I'm fine accepting only fresh brine you can get another drop of this yeah you wish |
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Sep 17, 2008 5:27 pm Post subject: |
|
|
Ok, well I still don't get what the prologue and epilogue is?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
 Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
|
| Back to top |
|
|
sponge
I'm a spammer
 Reputation: 1
Joined: 07 Nov 2006
Posts: 6009
|
| Posted: Wed Sep 17, 2008 6:35 pm Post subject: |
|
|
| HalfPrime wrote: | You only need to virtual protect if you're accessing memory from another program. Since you're using a dll and will be inside the address space of the program you're trying to edit, you don't need to use it.
You shouldn't use naked because you're just using the function as a regular function, not as something injected.
try *(BYTE[6]*)(address) = {0x90, 0x90, 0x90, 0x90, 0x90, 0x90}; instead of the ASM to see whether it's what you're doing that's messing it up or if it's how you're doing it. |
... No. You must use VirtualProtect, depending on the access of the code, even with a dll.
_________________
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Wed Sep 17, 2008 6:48 pm Post subject: |
|
|
Really? I've never had any trouble with that. Odd.
_________________
|
|
| Back to top |
|
|
rapion124
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Mar 2007
Posts: 1095
|
| Posted: Wed Sep 17, 2008 8:09 pm Post subject: |
|
|
| Sponge is correct. If you do a "mov" and the page's access doesn't allow write, then the program crashes. |
|
| Back to top |
|
|
pkedpker
Master Cheater
![]() Reputation: 1
Joined: 11 Oct 2006
Posts: 412
|
| Posted: Wed Sep 17, 2008 8:16 pm Post subject: |
|
|
yah always do VirtualProtects @ ,PAGE_EXECUTE_READWRITE
_________________
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Thu Sep 18, 2008 5:12 am Post subject: |
|
|
tell me what causes the failure with my virtualprotect
| Code: |
VirtualProtect((LPVOID)Address,6,PAGE_EXECUTE_READWRITE,0)
|
Address - means the flags address - 0x0100346E
6 - means the bytes so i saw it's 6 bytes
etc ...
it keeps failing me and i dont know why
_________________
Stylo |
|
| Back to top |
|
|
DoomsDay
Grandmaster Cheater
 Reputation: 0
Joined: 06 Jan 2007
Posts: 768
Location: %HomePath%
|
| Posted: Thu Sep 18, 2008 5:20 am Post subject: |
|
|
| Quote: | lpflOldProtect [out]
A pointer to a variable that receives the previous access protection value of the first page in the specified region of pages. If this parameter is NULL or does not point to a valid variable, the function fails. |
~Cheers |
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Thu Sep 18, 2008 5:53 am Post subject: |
|
|
so i assume that the previous access protection of the memory was PAGE_READONLY ??
edit: oops didn't see the [out] now i got it (tried to put PAGE_READONLY and couldn't understand why it didnt work)
_________________
Stylo
Last edited by Stylo on Thu Sep 18, 2008 5:57 am; edited 1 time in total |
|
| Back to top |
|
|
jackyyll
Expert Cheater
![]() Reputation: 0
Joined: 28 Jan 2008
Posts: 143
Location: here
|
| Posted: Thu Sep 18, 2008 7:18 am Post subject: |
|
|
| Yeah, VirtualProtect requires that you have the dwOldProtect or else it fails. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
