| View previous topic :: View next topic |
| Author |
Message |
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
 Posted: Tue Jan 27, 2009 8:18 pm Post subject: NtWriteVirtualMemory Base... |
 |
|
| My SDT is being hooked by Klif.sys so I don't kjnow the real address of That so anyone know?
|
|
| Back to top |
|
 |
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Tue Jan 27, 2009 8:47 pm Post subject: |
|
|
livekd
| Code: | | d nt!NtWriteVirtualMemory |
Regards BanMe
Last edited by BanMe on Wed Jan 28, 2009 1:56 pm; edited 1 time in total |
|
| Back to top |
|
|
FerrisBuellerYourMyHero
Master Cheater
 Reputation: 0
Joined: 14 Feb 2007
Posts: 401
Location: Inside your <kernel>
|
| Posted: Wed Jan 28, 2009 3:16 am Post subject: |
|
|
Klif.sys? I looked it up and it seems to be part of kaspersky anti-virus... That's your AV?
BanMe, NtWriteVirtualMemory is an undocumented function, so I don't think you can get to it (in kernel mode) by name...
dnsi0, why not just use kaspersky's hook as your NtWriteVirtualMemory address?
I think probably the hook only makes sure that a program is not trying to write memory to their antivirus software exe's... So wouldn't it still work if your writing somewhere else?
Also I'm curious, how does gameguard react to the SDT being hooked by AV's? does it restore it? Does it think your AV is a hack? I want you to test it, have it so you can press a button or something and your driver will debug print the SDT entry for this function, before loading gg it will point to your av's hook, try it after loading gg, see if your AV's hook has been removed...
How can it tell the difference between a hack and an AV? I'm surprised AV's don't clash with GG? I dont have av so i can't test it.
Well I think the way GG knows the real addresses, is by reading from ntoskrnl. Not sure exactly how they do it... GG restores SDT/SSDT hooks if you put them so they have a way.
Maybe you could make an AOB which only that function will be found if you search it, then start a search from your kernel base for the length of the kernel to find the real address...
Or follow your AV's hook, they must have a trampoline which goes to the original function!
Use windbg->kernel debug->local kernel->disassembly
you can even use it to peak at gg's hooks for a few minutes before they close the game. gg uses trampolines too! 
_________________
You know, life moves pretty fast. If you don't stop and look around once in a while, You could miss it!
 |
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Wed Jan 28, 2009 1:50 pm Post subject: |
|
|
just because its undocumented doesnt mean anything..
though i was wrong in the first posting.. this code will work in livekd 
| Code: |
u nt!NameOfFunction..
|
0: kd> u nt!NtWriteVirtualMemory
nt!NtWriteVirtualMemory:
80587da4 6a1c push 0x1c
80587da6 68c85f4f80 push 0x804f5fc8
80587dab e8d3b0f5ff call nt!_SEH_prolog (804e2e83)
80587db0 64a124010000 mov eax,fs:[00000124]
80587db6 8bf8 mov edi,eax
80587db8 8a8740010000 mov al,[edi+0x140]
80587dbe 8845e0 mov [ebp-0x20],al
80587dc1 8b7514 mov esi,[ebp+0x14]
0: kd>
it could determine hack and AV by module address Range Name verification ... (simplest solution is usually the right solution).. ;P
|
|
| Back to top |
|
|
FerrisBuellerYourMyHero
Master Cheater
Reputation: 0
Joined: 14 Feb 2007
Posts: 401
Location: Inside your <kernel>
|
| Posted: Wed Jan 28, 2009 3:00 pm Post subject: |
|
|
Ok maybe your right, so I need livekd then? it allows you to view undocumented functions too I suppose...
In just windbg it wont work though:
it only works if I try a documented function like:
I noticed you used a command though so I tried:
Its probably because I don't have a symbol file! maybe livekd installs that, I'll give it a try...
EDIT: ah here we go! I just pasted livekd.exe into my directory where windbg is installed, then from command prompt executed it, it ran as a command line app I tried the command and it worked! 
then I tried running windbg from it! "livekd.exe -w" its a nicer way to run windbg, it automatically starts debugging your local kernel for you!
and undocumented stuff shows up, unlike with just windbg alone!!
_________________
You know, life moves pretty fast. If you don't stop and look around once in a while, You could miss it!
|
|
| Back to top |
|
|
kittonkicker
I post too much
 Reputation: 1
Joined: 19 Apr 2006
Posts: 2171
|
| Posted: Wed Jan 28, 2009 3:38 pm Post subject: |
|
|
Careful about enabling debug mode in Vista... I was getting BSOD when hitting the scroll lock key when I had it on >.<.
_________________
All gone  |
|
| Back to top |
|
|
rapion124
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Mar 2007
Posts: 1095
|
| Posted: Wed Jan 28, 2009 5:00 pm Post subject: |
|
|
| kittonkicker wrote: | | Careful about enabling debug mode in Vista... I was getting BSOD when hitting the scroll lock key when I had it on >.<. |
Lol. That means your keyboard vendor can't write proper drivers.
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Wed Jan 28, 2009 5:30 pm Post subject: |
|
|
Glad i could help
Regards BanMe
|
|
| Back to top |
|
|
FerrisBuellerYourMyHero
Master Cheater
Reputation: 0
Joined: 14 Feb 2007
Posts: 401
Location: Inside your <kernel>
|
| Posted: Wed Jan 28, 2009 5:41 pm Post subject: |
|
|
| kittonkicker wrote: | | Careful about enabling debug mode in Vista... I was getting BSOD when hitting the scroll lock key when I had it on >.<. |
Well that was probably just to everyone, but I'm not running vista  if you look closely at the 3rd picture it says Windows XP Kernel!
I just made XP look like vista because I was getting sick of the XP Luna look!! Vista transparency is pretty nifty
I'll keep that in mind though if I do ever get vista...
rapion124, when is the last time you bought a keyboard that came with drivers to install? Usually windows already has default drivers on the system already that work. So are you saying you have vista and you can enable debug mode + press scroll lock without getting a blue screen?
_________________
You know, life moves pretty fast. If you don't stop and look around once in a while, You could miss it!
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Wed Jan 28, 2009 6:03 pm Post subject: |
|
|
lol I run bar bones XP on a almost new computer.. no frills no themes and optimized performance.. usually no sound in most games.. :0o: and i play soldier front..
I maintain a strict policy of if i dont need it kill it.. and if it looks pretty its consuming to much memory.. xD
if you have more then 17~20 process running on you computer at startup then in my opinion your computer is running effeciently :}
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Wed Jan 28, 2009 6:14 pm Post subject: |
|
|
| thanks for the help!
|
|
| Back to top |
|
|
rapion124
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Mar 2007
Posts: 1095
|
| Posted: Thu Jan 29, 2009 7:03 am Post subject: |
|
|
| FerrisBuellerYourMyHero wrote: | | kittonkicker wrote: | | Careful about enabling debug mode in Vista... I was getting BSOD when hitting the scroll lock key when I had it on >.<. |
Well that was probably just to everyone, but I'm not running vista if you look closely at the 3rd picture it says Windows XP Kernel!
I just made XP look like vista because I was getting sick of the XP Luna look!! Vista transparency is pretty nifty
I'll keep that in mind though if I do ever get vista...
rapion124, when is the last time you bought a keyboard that came with drivers to install? Usually windows already has default drivers on the system already that work. So are you saying you have vista and you can enable debug mode + press scroll lock without getting a blue screen? |
The only keyboards that have drivers are the ones with "special" keys like keys for email, and stuff. If you have a generic keyboard with 100 keys, the default driver will work. If you have a "special" keyboard, they come with drivers. I know Logitech has drivers for their keyboards and mice. To answer your question, I don't BSOD when I press scroll lock because I use a crappy generic keyboard.
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Thu Jan 29, 2009 7:19 pm Post subject: |
|
|
wait... 2nd question. The offset from the base of ntoskrnl.exe is the same right?
Cause Im just gonna create a offset and use that in the new kernel.
And yay... I got DeviceIOControl to work with my driver...
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Thu Jan 29, 2009 7:44 pm Post subject: |
|
|
yes the offset is the same.
and congrats on your achievements
|
|
| Back to top |
|
|
crayzbeef
Expert Cheater
![]() Reputation: 0
Joined: 21 Jan 2007
Posts: 101
|
| Posted: Thu Feb 05, 2009 11:04 pm Post subject: |
|
|
| BanMe wrote: | lol I run bar bones XP on a almost new computer.. no frills no themes and optimized performance.. usually no sound in most games.. :0o: and i play soldier front..
I maintain a strict policy of if i dont need it kill it.. and if it looks pretty its consuming to much memory.. xD
if you have more then 17~20 process running on you computer at startup then in my opinion your computer is running effeciently :} |
God damn get off your fat ass and get a job if your computer cant even support a basic aero theme or sound.
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
