| View previous topic :: View next topic |
| Author |
Message |
talkerzero
Grandmaster Cheater
![]() Reputation: 1
Joined: 24 Jul 2008
Posts: 560
Location: California
|
 Posted: Sat Feb 07, 2009 9:55 pm Post subject: [C++ help] SendInput for MapleStory w/ GameGuard? |
 |
|
As you know, GameGuard blocks SendInput. Now apparently, if you use a DLL injected into GameMon.des, it will work as the process is on the whitelist.
Now my question is, can this be bypassed the same way as PostMessageA, in the case that I don't want to use a DLL?
Like this, for example..
| Code: | DWORD siJump = (DWORD)GetProcAddress(LoadLibrary("user32.dll"), "SendInput") + 5;
__declspec(naked) UINT WINAPI SendInputB(UINT nInputs, LPINPUT pInputs, int cbSize)
{
__asm
{
push ebp
mov ebp, esp
jmp dword ptr ds:[_PMA]
}
} |
I tested it myself, but it just crashed when I tried to send the RIGHT key. Help?
|
|
| Back to top |
|
 |
Xoujiro
Advanced Cheater
![]() Reputation: 0
Joined: 20 Mar 2006
Posts: 86
|
| Posted: Sat Feb 07, 2009 10:13 pm Post subject: Re: [C++ help] SendInput for MapleStory w/ GameGuard? |
|
|
| talker0 wrote: | As you know, GameGuard blocks SendInput. Now apparently, if you use a DLL injected into GameMon.des, it will work as the process is on the whitelist.
Now my question is, can this be bypassed the same way as PostMessageA, in the case that I don't want to use a DLL?
Like this, for example..
| Code: | DWORD siJump = (DWORD)GetProcAddress(LoadLibrary("user32.dll"), "SendInput") + 5;
__declspec(naked) UINT WINAPI SendInputB(UINT nInputs, LPINPUT pInputs, int cbSize)
{
__asm
{
push ebp
mov ebp, esp
jmp dword ptr ds:[_PMA]
}
} |
I tested it myself, but it just crashed when I tried to send the RIGHT key. Help? |
From what ive heard SendInput is hooked in kernelmode too, so trampoline wont work. You have to use PostMessageA but i cant get it to work for me ><.
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sat Feb 07, 2009 11:02 pm Post subject: |
|
|
I suggest you disassemble User32.dll and find SendInput 
It'll explain why you crashed, and a whole lot more.
If you called it from GameMon.des it wouldn't matter if it was hooked regardless if its user or kernel if it is indeed on the white list.
Try it out.
_________________
|
|
| Back to top |
|
|
sphere90
Grandmaster Cheater
 Reputation: 0
Joined: 24 Jun 2006
Posts: 912
|
| Posted: Sun Feb 08, 2009 1:12 am Post subject: |
|
|
Not all functions start with the standard "push ebp mov ebp, esp" prologue
_________________
Give a hungry man a fish and he'll be full for a day. Teach a hungry man how to fish and he'll be full for the rest of his life. |
|
| Back to top |
|
|
DeletedUser14087
I post too much
![]() Reputation: 2
Joined: 21 Jun 2006
Posts: 3069
|
| Posted: Sun Feb 08, 2009 1:20 am Post subject: |
|
|
| sphere90 wrote: | | Not all functions start with the standard "push ebp mov ebp, esp" prologue |
Hahaha, not just that, they replace PostMessageA with some other shit they want to "bypass" and think it'll work. (and think user32.dll export all MSDN)
just use KiKi's KiInput thingy if you really want to use it.
|
|
| Back to top |
|
|
talkerzero
Grandmaster Cheater
![]() Reputation: 1
Joined: 24 Jul 2008
Posts: 560
Location: California
|
| Posted: Sun Feb 08, 2009 1:45 am Post subject: |
|
|
Well, it works for SetCursorPos and GetPixel, so I thought, why not SendInput?
And, user32.dll does export SendInput, so I don't know what you're talking about.
What's KiKi's KiInput thingy? Let me search..
|
|
| Back to top |
|
|
smartz993
I post too much
 Reputation: 2
Joined: 20 Jun 2006
Posts: 2013
Location: USA
|
| Posted: Sun Feb 08, 2009 1:48 am Post subject: |
|
|
| talker0 wrote: | Well, it works for SetCursorPos and GetPixel, so I thought, why not SendInput?
And, user32.dll does export SendInput, so I don't know what you're talking about.
What's KiKi's KiInput thingy? Let me search.. |
Lol i don't think he knows what he's talking about either :]
Anyway, KiKi's KiInput BSOD's once GG loads.
|
|
| Back to top |
|
|
sphere90
Grandmaster Cheater
Reputation: 0
Joined: 24 Jun 2006
Posts: 912
|
| Posted: Sun Feb 08, 2009 3:43 am Post subject: |
|
|
| talker0 wrote: | Well, it works for SetCursorPos and GetPixel, so I thought, why not SendInput?
And, user32.dll does export SendInput, so I don't know what you're talking about.
What's KiKi's KiInput thingy? Let me search.. |
Dude, I just gave you the answer in my post above. But since you are so reluctant to do some disassembling, here's the disassembly of SendInput in user32.dll.
| Code: | 7E42F140 - b8 f6 11 00 00 - mov eax,000011f6
7E42F145 - ba 00 03 fe 7f - mov edx,7ffe0300
7E42F14A - ff 12 - call dword ptr [edx]
7E42F14C - c2 0c 00 - ret 000c
|
Think about it before you post more stupid replies.
_________________
Give a hungry man a fish and he'll be full for a day. Teach a hungry man how to fish and he'll be full for the rest of his life. |
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sun Feb 08, 2009 8:58 am Post subject: |
|
|
I think that gameguard doesn't hook SendInput in usermode.
It hooks the ServiceDescriptorTableShadow and along time ago started hooking inline hooks.
Is the Usermode and Kernelmode Declaration of the Types the same? cause I know that OpenProcess and NtOpenProcess are very different. Cause I am sending my usermode struct into kernelmode and then calling NtUserSendInput there but its not really working. (This is without gameguard so no hooks yet)
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun Feb 08, 2009 9:03 am Post subject: |
|
|
Yes It does, run rkUnhooker when it's running and you'll see that it is indeed hooked.
And either you fucked up and didn't restore it properly or GameGuard noticed you changed something and kicked your ass out.
It really shouldn't matter though because GameGuard uses it's own copy of the SSDT/SSDTS instead, and they are using inline hooks not pointer replacement.
@talker0:
I gave you the suggestion of disassembling it and you had to get sphere90 to actually paste SendInput to show you that you're completely stupid in thinking that every function starts with the hot-patch; push ebp mov ebp, esp prologue..
Seriously try to fucking understand why your doing what your doing before you just throw some other random functions in there hoping it'll act the same way.
_________________
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sun Feb 08, 2009 9:42 am Post subject: |
|
|
7E42F140 - b8 f6 11 00 00 - mov eax,000011f6
7E42F145 - ba 00 03 fe 7f - mov edx,7ffe0300
7E42F14A - ff 12 - call dword ptr [edx]
7E42F14C - c2 0c 00 - ret 000c
This is push the system call number into eax, then calling that address. the ret
But wouldent it be eaiser just to do mov eax,000011f6 then sysenter then ret c?
Or am I completely wrong?
| Quote: | Yes It does, run rkUnhooker when it's running and you'll see that it is indeed hooked.
And either you fucked up and didn't restore it properly or GameGuard noticed you changed something and kicked your ass out.
It really shouldn't matter though because GameGuard uses it's own copy of the SSDT/SSDTS instead, and they are using inline hooks not pointer replacement. |
eh... I know. But Im running without Gameguard. And doesn't matter if they hook Win32k.sys cause I made a copy and pointed the NtUserSendInput to that copy so Im not even accessing the SSDTS while doing that.[/quote]
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
