| View previous topic :: View next topic |
| Author |
Message |
Dark Byte
Site Admin
 Reputation: 475
Joined: 09 May 2003
Posts: 26003
Location: The netherlands
|
 Posted: Mon May 10, 2010 3:11 am Post subject: |
 |
|
I think he means it scans for:
| Code: |
MOV EDI, EDI
PUSH EBP
MOV EBP, ESP
JMP xxxxxxxx
|
where xxxxxxxx is way out of range of the function itself
I'm not sure myself, but that's what I would scan for if I made a cheat protector
of course, you can easily rewrite this into something else and make it undetected
e.g:
| Code: |
mov [esp],ebp
mov ebp,esp
sub ebp,4
mov esp,ebp
jmp xxxxxxxx
|
and that's just one of infinite number of rewrites
_________________
Tools give you results. Knowledge gives you control.
Like my help? Join me on Patreon so i can keep helping
Last edited by Dark Byte on Mon May 10, 2010 7:19 am; edited 3 times in total |
|
| Back to top |
|
 |
zile
Advanced Cheater
![]() Reputation: 0
Joined: 11 Jul 2009
Posts: 75
|
| Posted: Mon May 10, 2010 5:16 am Post subject: |
|
|
| hope you dont mind me asking but, what function do u use to save the results found to a temporary file?
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Mon May 10, 2010 7:31 am Post subject: |
|
|
| writefile ?
|
|
| Back to top |
|
|
iPromise
Grandmaster Cheater
![]() Reputation: -1
Joined: 27 Jun 2009
Posts: 529
Location: Canada
|
| Posted: Mon May 10, 2010 2:31 pm Post subject: |
|
|
| fstream.h
|
|
| Back to top |
|
|
AtheistCrusader
Grandmaster Cheater
![]() Reputation: 6
Joined: 23 Sep 2006
Posts: 681
|
| Posted: Mon May 10, 2010 2:38 pm Post subject: |
|
|
| iPromise wrote: | | fstream.h |
He ain't using C faggot
|
|
| Back to top |
|
|
sponge
I'm a spammer
 Reputation: 1
Joined: 07 Nov 2006
Posts: 6009
|
| Posted: Mon May 10, 2010 6:26 pm Post subject: |
|
|
| Slugsnack wrote: | | i see. so it scans for the stack frame and if it detects it it closes the game. that's odd because a stack frame is used in probably 95% of functions |
It's not odd at all. Unless a module is compiled with the /hotpatch option, most if not all function prologues will not have the typical hotpatching instruction mov edi, edi. That being said, script kiddies who commonly code these types of programs seem to think that the mov instruction actually holds importance in setting up the stack frame. It only makes sense to scan for this type of signature. If the memory found is not in a system module, it is safe to say (though not guaranteed and sloppy) that it is most likely a hacking procedure.
_________________
|
|
| Back to top |
|
|
Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
| Posted: Tue May 11, 2010 6:15 am Post subject: |
|
|
Unless that option is used by default then it appears to still be popping up. This is an injector I made and compiled with VC++ 2010.
Scanning only in the main executable's module itself, 8 matches for that byte sequence, none of which I had specified explicitly.
http://img504.imageshack.us/img504/9981/11863558.png
Removing the 8bff, ie. mov edi, edi, showed 23 results instead. Either way according to your theory, any 8 of these would trigger the anti-hack.
And how is the game to determine whether the module is a system module or some external module ? There are services which people use which inject a DLL into every single process. No doubt there would be something there to trigger the detection.
The /hotpatch means the compiler ensures that the first instruction of each function is two bytes but that is not to say when that option is not enabled, there are no functions with those 2 bytes already as their first instruction.
|
|
| Back to top |
|
|
zile
Advanced Cheater
![]() Reputation: 0
Joined: 11 Jul 2009
Posts: 75
|
| Posted: Sat May 15, 2010 5:47 am Post subject: |
|
|
Anyone mind giving me some hints on how to make progressbar? i made it's range to 0 - 100 and now im stuck
i tried putting the dialog's default to get value of a variable 'Progress' and change accordingly and then
| Code: | | Progress = (I-dwStart)/(dwEnd-dwStart) * 100; |
at the scanner to get the % of scan but it doesnt work, it only gives 0 and 100, i tried changing it to float and theres another problem
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
