hitachihex
How do I cheat?
![]() Reputation: 0
Joined: 25 Sep 2008
Posts: 4
|
 Posted: Fri Oct 17, 2008 7:14 pm Post subject: Getting around an EIP check (injection) |
 |
|
I didn't really wanna come and ask from help from anyone, because I kinda wanted to figure a way around it myself, if there actually is one.
But I decided I can come ask here, just keep in mind, i'm not looking for a straight answer if it's possible, i'd rather find out the exact method myself.
Anyways.. I have a game that's using an EIP check, or something along the lines of it, what it does is this:
| Code: |
__asm {
pushad;
mov eax, ebp;
add eax, 4;
mov eax, dword ptr ds:[eax]
mov local_var, eax // ebp-8, dword assumed
popad;
}
|
The thing is, I tried basically copying the function byte for byte, in a naked function, (__declspec(naked) // etc) but that failed, so i'm sorta stuck atm.
It goes on comparing a base range, which I can also paste the rest of the assembly if anyone wants to see that as well. I'm just wondering if theres a way to stop it from knowing that the function that had the check added to it doesn't know an injected DLL (out of it's base range) has called it.
Thanks for anyone replies[/code]
|
|
Psy
Grandmaster Cheater Supreme
![]() Reputation: 1
Joined: 27 Mar 2008
Posts: 1366
|
| Posted: Sat Oct 18, 2008 2:18 am Post subject: |
|
|
As this is the Instruction Pointer we are talking about, there is no 'direct' way to alter this. Its obviously pointing to the code that the processory is current executing. However, I don't see why you can't direct you're code into the current module from the injected .dll, and then go from there... Need to more 
~Psy
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
