 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
Ferocious
Advanced Cheater
 Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
 Posted: Wed Jun 11, 2008 9:16 am Post subject: |
 |
|
what od you mean im not doing anything?
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
 |
HalfPrime
Grandmaster Cheater
![]() Reputation: 0
Joined: 12 Mar 2008
Posts: 532
Location: Right there...On your monitor
|
| Posted: Wed Jun 11, 2008 11:42 am Post subject: |
|
|
He's talking about the variables that Flyte mentioned.
_________________
|
|
| Back to top |
|
|
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Jun 11, 2008 5:09 pm Post subject: |
|
|
All my variables were used. I had to clean up ferocious code. He has this.
| Code: |
BOOL TrampolineAPI(HMODULE hModule, LPCWSTR DllName, LPCSTR ProcName, DWORD dwReplaced)
{
DWORD dwOldProtect;
DWORD dwAddressToHook = (DWORD)GetProcAddress(GetModuleHandle(DllName), ProcName);
DebugPrint(L"dwAddressToHook : %X", dwAddressToHook);
BYTE *pbTargetCode = (BYTE *)dwAddressToHook;
BYTE *pbReplaced = (BYTE *)dwReplaced;
VirtualProtect((LPVOID)dwAddressToHook, 5, PAGE_EXECUTE_READWRITE, &dwOldProtect);
*pbTargetCode++ = 0xE9;
*((signed int*)(pbTargetCode)) = pbReplaced - (pbTargetCode + 4);
VirtualProtect((LPVOID)dwAddressToHook, 5, PAGE_EXECUTE, &dwOldProtect);
dwReturn = dwAddressToHook + 5;
FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
return TRUE;
}
|
Not used or needed or works:
OldProtect
DebugPrint()
dwReturn // not even decalred
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Wed Jun 11, 2008 5:29 pm Post subject: |
|
|
OldProtect:
| Code: | BOOL WINAPI VirtualProtect(
__in LPVOID lpAddress,
__in SIZE_T dwSize,
__in DWORD flNewProtect,
__out PDWORD lpflOldProtect
); |
lpflOldProtect [out]
A pointer to a variable that receives the previous access protection value of the first page in the specified region of pages. If this parameter is NULL or does not point to a valid variable, the function fails.
DebugPrint:
as for the the DebugPrint it was just for debugging purposes.
dwReturn:
and dwReturn, lol you figure it out yourself why I have that there.
since you condemned its useless.
_________________
I wanna hack, but I don't know how...
Last edited by Ferocious on Wed Jun 11, 2008 5:41 pm; edited 1 time in total |
|
| Back to top |
|
|
Flyte
Peanuts!!!!
 Reputation: 6
Joined: 19 Apr 2006
Posts: 1887
Location: Canada
|
| Posted: Wed Jun 11, 2008 5:36 pm Post subject: |
|
|
| Code: | BYTE *ATH = (BYTE*)AddressToHook;
BYTE *ATU = (BYTE*)Replace; |
It's incredibly redundant. |
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Jun 11, 2008 5:46 pm Post subject: |
|
|
So you suggest this?
| Code: |
BOOL APIHOOK(LPCSTR DllName, LPCSTR API, DWORD Replace) {
DWORD AddressToHook = (DWORD)GetProcAddress(LoadLibrary(DllName), API);
DWORD oldprotect;
VirtualProtect((LPVOID)AddressToHook, 5, PAGE_EXECUTE_READWRITE, &oldprotect);
(BYTE)AddressToHook++ = 0xE9;
(signed int)((BYTE)(AddressToHook)) = (BYTE)Replace-((BYTE)(AddressToHook+4));
VirtualProtect((LPVOID)AddressToHook, 5, PAGE_EXECUTE, &oldprotect);
FlushInstructionCache(GetCurrentProcess(), NULL, NULL);
return TRUE;
}
|
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Wed Jun 11, 2008 6:09 pm Post subject: |
|
|
Eh... For the second VirtualProtect are you reverting the memory? if you are, why are u setting it as PAGE_EXECUTE, instead use the oldprotect
Also "signed" is not needed with the int because the compiler by default uses signed integer type's unless defined as unsigned.
use BYTE*/PBYTE/LPBYTE btw for the modifying.
Edit
Well, I did my own little function, rearranging the code and function a bit,
I didn't test it but it should work...
| Code: | BOOL HookApi( LPCTSTR lpModule, LPCSTR lpAPI, PVOID pFunction )
{
DWORD dwOldProt, dwJunk;
DWORD dwApiAddy = (DWORD)GetProcAddress( LoadLibrary( lpModule ), lpAPI );
if ( dwApiAddy )
{
if ( VirtualProtect( &dwApiAddy, 5, PAGE_EXECUTE_READWRITE, &dwOldProt ) )
{
*(PBYTE)dwApiAddy = 0xE9;
*(PDWORD)(dwApiAddy + 1) = (DWORD)pFunction - dwApiAddy - 5;
if ( VirtualProtect( &dwApiAddy, 5, dwOldProt, &dwJunk ) )
{
if ( FlushInstructionCache( GetCurrentProcess(), NULL, NULL ) )
return TRUE;
}
}
}
return FALSE;
} |
_________________
|
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Jun 11, 2008 6:43 pm Post subject: |
|
|
Always wondered why he didn't use oldprotect like that. And why he didn't error check. I guess I would have done something like...
| Code: |
BOOL APIHOOK(LPCSTR DllName, LPCSTR API, DWORD Replace) {
DWORD oldprotect, postop;
DWORD AddressToHook = (DWORD)GetProcAddress(LoadLibrary(DllName), API);
if(VirtualProtect((LPVOID)AddressToHook, 5, PAGE_EXECUTE_READWRITE, &oldprotect)) {
*(PBYTE)AddressToHook++ = 0xE9;
*((int*)(AddressToHook)) = Replace-(AddressToHook+4); //whats difference between using +4 and -5
if(VirtualProtect((LPVOID)AddressToHook, 5, oldprotect, &postop)) {
if(FlushInstructionCache(GetCurrentProcess(), NULL, NULL)) {
return TRUE;
}
}
}
return FALSE;
}
|
Ok, and as I put, whats the dif between using +4 and -5? And also, is using "*((int*)(AddressToHook))" and "*(PDWORD)AddressToHook" basically the same?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Ferocious
Advanced Cheater
Reputation: 0
Joined: 06 Feb 2008
Posts: 54
|
| Posted: Thu Jun 12, 2008 1:28 am Post subject: |
|
|
| oib111 wrote: | | Always wondered why he didn't use oldprotect like that. |
so that if any process trying to write the memory will return, access violation.
as PAGE_EXECUTE : An attempt to read or write to the committed region results in an access violation.
and PAGE_EXECUTE_READWRITE : Enables execute, read, and write access to the committed region of pages, which allow all three acess.
| oib111 wrote: | | And why he didn't error check. |
Because the code you are using basically is just a pseudo.
_________________
I wanna hack, but I don't know how... |
|
| Back to top |
|
|
oib111
I post too much
Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Thu Jun 12, 2008 7:52 am Post subject: |
|
|
Ok, btw, whats the difference between using +4 and -5? Like...
| Code: |
*((int*)(ATH)) = ATU-(ATH+4);
//or
*((int*)(ATH)) = ATU-(ATH-5);
|
And I understand your calculating the offset for jump, but why do you use the +4 and -5?
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
