| View previous topic :: View next topic |
| Author |
Message |
&Vage
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Jul 2008
Posts: 1053
|
 Posted: Thu Sep 18, 2008 8:27 pm Post subject: |
 |
|
| rapion124 wrote: | | _void wrote: |
Would you like me to use KiSystemFastcall instead of RPM? 
|
Lol. Won't work either. Most anti-cheats load a driver that hooks the int 2E handler. |
There are other methods...
|
|
| Back to top |
|
 |
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Fri Sep 19, 2008 1:52 pm Post subject: |
|
|
| Is it possible to Unhook it or will the driver simply detect it?
|
|
| Back to top |
|
|
&Vage
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Jul 2008
Posts: 1053
|
| Posted: Fri Sep 19, 2008 2:28 pm Post subject: |
|
|
| dnsi0 wrote: | | Is it possible to Unhook it or will the driver simply detect it? |
No, you can't unhook it. GameGuard will rewrite the hook.
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Fri Sep 19, 2008 2:37 pm Post subject: |
|
|
I thought gg crashed if one of it's hooks got over-written. If all it does is re-write it, couldn't you just unhook it every time you use rpm/wpm?
_________________
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Fri Sep 19, 2008 3:07 pm Post subject: |
|
|
you may not be able to unhook it, though you could just Add a entry For Hooked Entry into the SSDT manuelly, just add a secondary Kernel Service Function that simply call the function directly instead of through the ServiceDesriptorTable..
Also add Entries to the SSPT..for your functions
could also place a hook for the sysenter call
| Code: |
7C90D5DA >/$ B8 1D000000 MOV EAX,1D
7C90D5DF |. BA 0003FE7F MOV EDX,7FFE0300
7C90D5E4 |. FF12 CALL DWORD PTR DS:[EDX]
7C90D5E6 \. C2 0400 RETN 4
7C90D5E9 90 NOP
|
ZwCompleteConnectPort as a example
could be hooked by changing the DWORD 7 bytes in :d
so a example hooking routine to do just that
| Code: |
__declspec(naked) void DetourSysEnter
{
__asm
{
mov eax,OurKernelServiceId
mov edx, 0x7FFE0300
call DWORD PTR ds:[edx]
retn 4
}
}
pfn = GetProcAddress(ntdll,"NtOrZw");
pfn+7 = *(DWORD*)DetourSysEnter;
|
or alternativly with a 2 byte hook in code and a 5 byte modification of nops ...up or down you choice 
| Code: |
*pfn+16 = 0xe9;
// *pfn-5 = 0xe9
*pfn+17 = *(DWORD*)DetourSysEnter;
// *pfn-4 = *(DWORD*)DetourSysEnter
*pfn+11 = 0x03eb;
// *pfn+11 = 0xfeeb
|
also you could do a direct modification of the Word located at bytes 2 and 3 to directly change the Id,and not have to rely on loaded a handler Function...
| Code: |
*pfn+2=*(WORD*)OurServiceIdNumber;
|
Last edited by BanMe on Sat Sep 20, 2008 9:19 am; edited 5 times in total |
|
| Back to top |
|
|
nog_lorp
Grandmaster Cheater
 Reputation: 0
Joined: 26 Feb 2006
Posts: 743
|
| Posted: Fri Sep 19, 2008 3:26 pm Post subject: |
|
|
| _void_ wrote: | | nog_lorp wrote: | | Return in case of fail shouldn't be Value, it should be 0 or -1 or some indication of failure. |
It is...
This will find the address without injecting a DLL. |
What? No.
| Code: | if(value == sig){
Addr = i;
return Addr;
}
}
return Addr; |
should be | Code: | if(value == sig){
Addr = i;
return Addr;
}
}
return -1; // or 0 or something |
_________________
Mutilated lips give a kiss on the wrist of the worm-like tips of tentacles expanding in my mind
I'm fine accepting only fresh brine you can get another drop of this yeah you wish |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
