| View previous topic :: View next topic |
| Author |
Message |
hcavolsdsadgadsg
I'm a spammer
![]() Reputation: 26
Joined: 11 Jun 2007
Posts: 5801
|
 Posted: Tue Sep 16, 2008 12:31 pm Post subject: |
 |
|
| 1qaz wrote: | oh i think i forgot to mention that i tried already byte ptr and dword ptr with 0x90 00 00 00 still not working
btw i attached the window to the process as u told me to (still don't know what it's good for) and it doesn't work too |
You have to be within it's memory space to directly goof with stuff.
Inject it as a DLL, or start a remote thread.
|
|
| Back to top |
|
 |
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Tue Sep 16, 2008 1:25 pm Post subject: |
|
|
so i assume that this code should work fine if i'll inject the dll
| Code: |
#include <windows.h>
#include <tchar.h>
DWORD Address = 0x0100346E;
__declspec(naked) void Hack()
{
__asm
{
mov byte ptr ds:[Address],0x90
RETN
}
}
void Hacking()
{
Hack();
}
BOOL WINAPI DllMain (HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(0,0,(LPTHREAD_START_ROUTINE)&Hacking,0,0,0);
}
}
|
the game crushes every time i inject the dll
_________________
Stylo |
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Tue Sep 16, 2008 1:29 pm Post subject: |
|
|
You've removed Memory Write Protection if there is any?
VirtualProtect the address to PAGE_EXECUTE_READWRITE before you modify anything.
_________________
|
|
| Back to top |
|
|
Noz3001
I'm a spammer
 Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Tue Sep 16, 2008 1:37 pm Post subject: |
|
|
| Also, the opcode at the address you are writing to might be more than one byte. Make sure you nop all of them.
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Tue Sep 16, 2008 1:48 pm Post subject: |
|
|
how do i check if there's any memory write protection? the process is winmine
but even though i used virtualprotect anyway
| Code: |
VirtualProtect((LPVOID)Address,6,PAGE_EXECUTE_READWRITE,0);
|
game still keep crushing
i dont know what's the deal with the 4th parameter btw so i guess that's the reason ?! maybe
@noz i tried both byte and dword ways and they didn't work
_________________
Stylo |
|
| Back to top |
|
|
GMZorita
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 21 Mar 2007
Posts: 1361
|
| Posted: Tue Sep 16, 2008 1:54 pm Post subject: |
|
|
| 1qaz wrote: | how do i check if there's any memory write protection? the process is winmine
but even though i used virtualprotect anyway
| Code: |
VirtualProtect((LPVOID)Address,6,PAGE_EXECUTE_READWRITE,0);
|
game still keep crushing
i dont know what's the deal with the 4th parameter btw so i guess that's the reason ?! maybe
@noz i tried both byte and dword ways and they didn't work |
Thats not what he mean.
like if you want to nop:
1 byte might be fine, but if you are noping a
you might need 3 bytes.
_________________
Gone |
|
| Back to top |
|
|
sponge
I'm a spammer
 Reputation: 1
Joined: 07 Nov 2006
Posts: 6009
|
| Posted: Tue Sep 16, 2008 5:07 pm Post subject: |
|
|
| nog_lorp wrote: | | sponge wrote: | | Clean up the Epilogue noggy. |
Hi, I'm dumb.
| Code: | mov esp, ebp
pop ebp
ret |
For some reason I never see leave used. |
I see leave plenty.
_________________
|
|
| Back to top |
|
|
DoomsDay
Grandmaster Cheater
 Reputation: 0
Joined: 06 Jan 2007
Posts: 768
Location: %HomePath%
|
| Posted: Tue Sep 16, 2008 11:00 pm Post subject: |
|
|
Leave is equivalent to | Code: | mov esp,ebp
pop ebp |
|
|
| Back to top |
|
|
oib111
I post too much
 Reputation: 0
Joined: 02 Apr 2007
Posts: 2947
Location: you wanna know why?
|
| Posted: Wed Sep 17, 2008 8:27 am Post subject: |
|
|
Just wondering. What exactly is the prologue and epilogue when you talk about naked functions? Because it seems rather important and I'm clueless 
_________________
| 8D wrote: |
cigs dont make people high, which weed does, which causes them to do bad stuff. like killing |
|
|
| Back to top |
|
|
Jani
Grandmaster Cheater
![]() Reputation: 2
Joined: 29 Dec 2006
Posts: 804
|
| Posted: Wed Sep 17, 2008 9:30 am Post subject: |
|
|
| oib111 wrote: | | Just wondering. What exactly is the prologue and epilogue when you talk about naked functions? |
There's none. That's why it's called naked.
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Wed Sep 17, 2008 11:21 am Post subject: |
|
|
okay look at this code and tell me what causes the game crush
| Code: |
#include <windows.h>
#include <tchar.h>
int* Address = (int*)0x0100346E;
__declspec(naked) void Hack()
{
__asm
{
mov byte ptr ds:[Address],0x90
mov byte ptr ds:[Address + 1],0x90
mov byte ptr ds:[Address + 2],0x90
mov byte ptr ds:[Address + 3],0x90
mov byte ptr ds:[Address + 4],0x90
mov byte ptr ds:[Address + 5],0x90
RETN
}
}
void Hacking()
{
VirtualProtect((LPVOID)Address,6,PAGE_EXECUTE_READWRITE,0);
Hack();
}
BOOL WINAPI DllMain (HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
CreateThread(0,0,(LPTHREAD_START_ROUTINE)&Hacking,0,0,0);
}
}
|
as u can see i nopped all the 6 bytes at the address.. :\
can any1 make his own code to stuck Minesweeper's flags and upload here so i could figure out what is wrong with what i'm doing?
_________________
Stylo |
|
| Back to top |
|
|
Noz3001
I'm a spammer
Reputation: 26
Joined: 29 May 2006
Posts: 6220
Location: /dev/null
|
| Posted: Wed Sep 17, 2008 11:34 am Post subject: |
|
|
| slovach wrote: | | You're creating a thread for yourself, not within the other process |
He's changed it to a DLL now.
|
|
| Back to top |
|
|
DoomsDay
Grandmaster Cheater
Reputation: 0
Joined: 06 Jan 2007
Posts: 768
Location: %HomePath%
|
| Posted: Wed Sep 17, 2008 11:51 am Post subject: |
|
|
DllMain should return TRUE unless it fails to load.
In your case, I'd suggest the following: | Code: | BOOL WINAPI DllMain (HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
return CreateThread(0,0,(LPTHREAD_START_ROUTINE)&Hacking,0,0,0);
return TRUE;
} |
Also note:- Your new thread should be declared as stdcall, or should call ExitThread by itself.
- Hack() doesn't have to be naked, it's usually used for hooks etc'
Another usefull api you could use is FreeLibraryAndExitThread(): | Code: | __declspec(naked) void Hack()
{
...
}
void Hacking(HMODULE hModule)
{
if (VirtualProtect((LPVOID)Address,6,PAGE_EXECUTE_READWRITE,0))
Hack();
FreeLibraryAndExitThread(hModule,0)
}
BOOL WINAPI DllMain (HMODULE hModule, DWORD dwReason, LPVOID lpvReserved)
{
...
} |
|
|
| Back to top |
|
|
Stylo
Grandmaster Cheater Supreme
![]() Reputation: 3
Joined: 16 May 2007
Posts: 1073
Location: Israel
|
| Posted: Wed Sep 17, 2008 12:52 pm Post subject: |
|
|
i think something wrong with my virtualprotect cuz it fail all the time changing the memory protection to execute_readwrite
_________________
Stylo |
|
| Back to top |
|
|
kitterz
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 24 Dec 2007
Posts: 1268
|
| Posted: Wed Sep 17, 2008 2:03 pm Post subject: |
|
|
| 1qaz wrote: | | i think something wrong with my virtualprotect cuz it fail all the time changing the memory protection to execute_readwrite |
Im pretty sure you need to hook hop it.
| Code: | //VProtect Bypass
static const FARPROC Vprotect = (FARPROC)((DWORD)GetProcAddress(GetModuleHandleA("kernel32.dll"), "VirtualProtectEx")+5);
_declspec(naked) BOOL WINAPI FixMem(HANDLE hProcess, LPVOID lpAddress, SIZE_T dwSize, DWORD flNewProtect, PDWORD lpflOldProtect)
{
_asm
{
mov edi,edi
push ebp
mov ebp,esp
jmp Vprotect
}
} |
_________________
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
