| View previous topic :: View next topic |
| Author |
Message |
Zand
Master Cheater
![]() Reputation: 0
Joined: 21 Jul 2006
Posts: 424
|
 Posted: Sun Sep 07, 2008 7:59 am Post subject: |
 |
|
while(!(hWnd = FindWindow("MapleStoryClass", NULL)))
Sleep(100);
|
|
| Back to top |
|
 |
SunBeam
I post too much
 Reputation: 65
Joined: 25 Feb 2005
Posts: 4023
Location: Romania
|
| Posted: Sun Sep 07, 2008 8:20 am Post subject: |
|
|
You do realize that discussing these in open public forums, methods get patched within days/weeks, right?.. Just ignore common sense, but watch out for ban/warn hammer when you whine it's patched 
|
|
| Back to top |
|
|
sponge
I'm a spammer
 Reputation: 1
Joined: 07 Nov 2006
Posts: 6009
|
| Posted: Sun Sep 07, 2008 1:11 pm Post subject: |
|
|
| SunBeam wrote: | | You do realize that discussing these in open public forums, methods get patched within days/weeks, right?.. Just ignore common sense, but watch out for ban/warn hammer when you whine it's patched |
Trampoline hasn't been patched for ages.
_________________
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Mon Sep 08, 2008 2:13 am Post subject: |
|
|
| dnsi0 wrote: | | Hieroglyphics wrote: | Either look here
Or I THINK this might work correct me if I am wrong anybody:
| Code: | #include "windows.h"
#include <iostream>
using namespace std;
DWORD PostMessA = (DWORD)GetProcAddress(LoadLibrary("USER32.DLL"), "PostMessageA"));
_declspec(naked) BOOL PostMessageX(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) {
_asm {
mov edi, edi
push ebp
mov ebp, esp
jmp[PostMessA]
}
}
int main() {
while (true) {
HWND hWnd;
hWnd = FindWindow(NULL,"MapleStory");
PostMessage(hWnd,WM_CHAR,0x41,1);
Sleep(1);
}
} |
Then if you wanna edit memory
| Code: | static const FARPROC VPX = (FARPROC)((DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "VirtualProtectEx")+5);
DWORD oldp = 0;
PDWORD oldprot = &oldp;
#define JMP(frm, to) (int)(((int)to - (int)frm) - 5);
DWORD dwBytesWritten;
_declspec(naked) BOOL WINAPI FixMemEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) {
_asm {
mov edi,edi
push ebp
mov ebp,esp
jmp VPX
}
} |
Somethin like that
Sphere90 posted
| Code: | ULONG reentry_address = GetProcAddress( LoadLibrary("user32.dll"), "PostMessageA" ) + 5;
__declspec(naked) void myPostMessageA(void)
{
__asm
{
mov edi,edi
push ebp
mov ebp,esp
jmp [reentry_address]
}
} |
|
Yea that works. All you really have to do is find out the PMA address which is a constant at: 0x77D1CB85
Create a hop to jump over the 5 byte jmp hook that gg does. But you still need it EXCEPT mov edi,edi which is pointless...
and then jump to pma+5 past the hook. |
No PMA address is not a constant at 0x77D1CB85. If it was constant, there would be no need ot find it each time. That is the point of a dynamic link library. Funtions have variable addresses which are resolved at runtime. The address of a function can and do differ per system.
|
|
| Back to top |
|
|
Dami
Master Cheater
 Reputation: 0
Joined: 23 Oct 2006
Posts: 336
|
| Posted: Wed Sep 24, 2008 6:06 am Post subject: |
|
|
| How would you use this 5 byte jump method on C# ?
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Wed Sep 24, 2008 7:57 am Post subject: |
|
|
| Hieroglyphics wrote: | Then if you wanna edit memory
| Code: | static const FARPROC VPX = (FARPROC)((DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "VirtualProtectEx")+5);
DWORD oldp = 0;
PDWORD oldprot = &oldp;
#define JMP(frm, to) (int)(((int)to - (int)frm) - 5);
DWORD dwBytesWritten;
_declspec(naked) BOOL WINAPI FixMemEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) {
_asm {
mov edi,edi
push ebp
mov ebp,esp
jmp VPX
}
} |
Somethin like that |
Just saw this post again. Are you sure this method works for bypassing VirtualProtectEx hooks ? Bearing in mind that ZwProtectVirtualMemory and NtProtectVirtualMemory are both hooked.. ?
|
|
| Back to top |
|
|
Dami
Master Cheater
Reputation: 0
Joined: 23 Oct 2006
Posts: 336
|
| Posted: Wed Sep 24, 2008 8:06 am Post subject: |
|
|
| Slugsnack wrote: | | Hieroglyphics wrote: | Then if you wanna edit memory
| Code: | static const FARPROC VPX = (FARPROC)((DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "VirtualProtectEx")+5);
DWORD oldp = 0;
PDWORD oldprot = &oldp;
#define JMP(frm, to) (int)(((int)to - (int)frm) - 5);
DWORD dwBytesWritten;
_declspec(naked) BOOL WINAPI FixMemEx(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect) {
_asm {
mov edi,edi
push ebp
mov ebp,esp
jmp VPX
}
} |
Somethin like that |
Just saw this post again. Are you sure this method works for bypassing VirtualProtectEx hooks ? Bearing in mind that ZwProtectVirtualMemory and NtProtectVirtualMemory are both hooked.. ? |
I think i had that code in my trainer on rev 1154 and 117? and it worked just fine...
How can i skip 5 bytes on PostMessage with C#, could i maybe use the PMX.dll for it?
Edit: I got my problem sorted out with delphi, but im still wanting to know how to do it on C#
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Wed Sep 24, 2008 9:06 am Post subject: |
|
|
| Do it dynamically. If you hardcode the prologue it is only 'guaranteed' to work on Windows XP SP2 and up and that is not even guaranteed. I suggest fetching the first 5 bytes first before the game/GameGuard even loads then copy it dynamically into a trampoline function later when you need it.
|
|
| Back to top |
|
|
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Wed Sep 24, 2008 4:32 pm Post subject: |
|
|
| Quote: | Do it dynamically. If you hardcode the prologue it is only 'guaranteed' to work on Windows XP SP2 and up and that is not even guaranteed. I suggest fetching the first 5 bytes first before the game/GameGuard even loads then copy it dynamically into a trampoline function later when you need it.
|
You'd have to do more than just copy the first 5 bytes if you want to do it dynamically. There's no gaurantee the first 5 bytes will be a complete set of instructions which is why they added the hotpatching prologue in the first place.
_________________
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Thu Sep 25, 2008 8:47 am Post subject: |
|
|
| No guarantee, correct. If you want to do it properly, find what the instructions are and see if the size of them add up to 5. However just 5 will work the majority of the time for most (if not all) of the functions that GG hooks.
|
|
| Back to top |
|
|
RAKO
Master Cheater
 Reputation: 0
Joined: 26 Jun 2006
Posts: 454
|
| Posted: Thu Sep 25, 2008 7:30 pm Post subject: |
|
|
| Dami3n wrote: | | How would you use this 5 byte jump method on C# ? |
i don't think you can do asm in c# so you would have to make a the function in c++ or delphi and put that into a dll. then you use introp.
_________________
| Dark Byte wrote: | | Who knows, perhaps i'm a maple gm!!!! |
|
|
| Back to top |
|
|
Dami
Master Cheater
Reputation: 0
Joined: 23 Oct 2006
Posts: 336
|
| Posted: Fri Sep 26, 2008 12:11 pm Post subject: |
|
|
| RAKO wrote: | | Dami3n wrote: | | How would you use this 5 byte jump method on C# ? |
i don't think you can do asm in c# so you would have to make a the function in c++ or delphi and put that into a dll. then you use introp. |
Yeah, that is the one part i was thinking too...
Thanks for the replys, i guess il get somewhere with this 
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
