 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
ElverGone
Master Cheater
 Reputation: 0
Joined: 16 Mar 2007
Posts: 366
Location: Bellocan / The dragon nest left behind
|
 Posted: Mon Feb 18, 2008 10:27 pm Post subject: [HELP] How to use debug flags in a dll? [nipplestory][C++] |
 |
|
can someone post a tut/script where it enables a debug register flag in C++ please, or in pascal would be also useful
thanks in advance
_________________
rep me if you like Red Hot Chili Peppers
 |
|
| Back to top |
|
 |
samuri25404
Grandmaster Cheater
 Reputation: 7
Joined: 04 May 2007
Posts: 955
Location: Why do you care?
|
| Posted: Tue Feb 19, 2008 9:15 am Post subject: Re: [HELP] How to use debug flags in a dll? [nipplestory][C+ |
|
|
| ElverGone wrote: | can someone post a tut/script where it enables a debug register flag in C++ please, or in pascal would be also useful
thanks in advance |
C++:
| Code: |
_asm
{
szf ;Set the Zero Flag
czf ;Clear the Zero Flag, there's others like this, just Google
}
|
Pascal:
_________________
|
|
| Back to top |
|
|
ElverGone
Master Cheater
Reputation: 0
Joined: 16 Mar 2007
Posts: 366
Location: Bellocan / The dragon nest left behind
|
| Posted: Tue Feb 19, 2008 9:19 am Post subject: |
|
|
thanks, but what about the 2nd zero flag?
(ZF [x][x])
edit: i found how to set the other flags, but yet i couldnt find how to set the EIP debugregs
according to x0r you use SetThreadContext to set EIP, can someone confirm this?
_________________
rep me if you like Red Hot Chili Peppers
|
|
| Back to top |
|
|
Jani
Grandmaster Cheater
![]() Reputation: 2
Joined: 29 Dec 2006
Posts: 804
|
| Posted: Tue Feb 19, 2008 1:03 pm Post subject: |
|
|
| ElverGone wrote: | | according to x0r you use SetThreadContext to set EIP, can someone confirm this? |
BOOL WINAPI SetThreadContext( __in HANDLE hThread, __in const CONTEXT* lpContext );
CONTEXT test;
test.Eip = 0;
Bad hints, but you got it ..right? >_>
|
|
| Back to top |
|
|
Symbol
I'm a spammer
![]() Reputation: 0
Joined: 18 Apr 2007
Posts: 5094
Location: Israel.
|
| Posted: Tue Feb 19, 2008 1:19 pm Post subject: |
|
|
| ElverGone wrote: | thanks, but what about the 2nd zero flag?
(ZF [x][x])
edit: i found how to set the other flags, but yet i couldnt find how to set the EIP debugregs
according to x0r you use SetThreadContext to set EIP, can someone confirm this? |
The "second" Zero Flag is actually Zero Flag set and "first Zero Flag" is unset. (when you tick nothing its simply doesn't change anything...)
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
 Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Tue Feb 19, 2008 2:47 pm Post subject: |
|
|
isnt zf 6? - http://en.wikipedia.org/wiki/FLAGS_register_%28computing%29
2 zf's is 0x9090 (2 nops)
im pretty sure.
CONTEXT text;
text.Eip = w/e value here
SetThreadContext( &text );
(i think u might need to ZeroMemory the struct... not quite sure.)
_________________
|
|
| Back to top |
|
|
FerrisBuellerYourMyHero
Master Cheater
 Reputation: 0
Joined: 14 Feb 2007
Posts: 401
Location: Inside your <kernel>
|
| Posted: Tue Feb 19, 2008 5:46 pm Post subject: |
|
|
I've made a DLL injector like this, using the "codecave" method... the basic idea is this...
you make a codecave which has the old EIP, and the address of loadlibrarya, and the address of the string of the dll to load... then call loadlibrarya with the dll string...
| Code: |
__declspec(naked) loadDll(void)
{
_asm{
// Placeholder for the return address
push 0xBAADF00D
// Save the flags and registers
pushfd
pushad
// Placeholder for the string address and LoadLibrary
push 0xBAADBABE
mov eax, 0xDEADBABE
// Call LoadLibrary with the string parameter
call eax
// Restore the registers and flags
popad
popfd
// Return control to the hijacked thread
ret
}
}
|
then copy it to the target process using writeprocessmemory
next you get a threadID of a running thread in the process, get the context of the thread, save the old EIP, then hijack the thread by changing the EIP to point to the codecave which calls loadlibrarya, and resume the thread... it jumps to your cave, loads the dll, then returns control back to the thread...
| Code: |
CONTEXT ctx;
threadID = GetThreadID("ProcessName.exe");
hThread = OpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME), false, threadID);
SuspendThread(hThread);
ctx.ContextFlags = CONTEXT_CONTROL;
GetThreadContext(hThread, &ctx);
oldIP = ctx.Eip;
ctx.Eip = (DWORD)stub;
ctx.ContextFlags = CONTEXT_CONTROL;
VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot);
memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4);
memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4);
memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4);
WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL);
SetThreadContext(hThread, &ctx);
ResumeThread(hThread);
unsigned long GetThreadID(char *procName)
{
PROCESSENTRY32 pe;
HANDLE thSnapshot, hProcess;
BOOL retval, ProcFound = false;
unsigned long pTID, threadID;
thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(thSnapshot == INVALID_HANDLE_VALUE)
{
MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL);
return false;
}
pe.dwSize = sizeof(PROCESSENTRY32);
retval = Process32First(thSnapshot, &pe);
while(retval)
{
if(StrStrI(pe.szExeFile, procName) )
{
ProcFound = true;
break;
}
retval = Process32Next(thSnapshot,&pe);
pe.dwSize = sizeof(PROCESSENTRY32);
}
CloseHandle(thSnapshot);
_asm {
mov eax, fs:[0x18]
add eax, 36
mov [pTID], eax
}
hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID);
ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL);
CloseHandle(hProcess);
return threadID;
}
|
The problem is I can't seem to figure out how to set the EIP at a certain ADDRESS! this just does it at any random address a thread is currently running at... also how do you get the threadID of the of the thread that has the address you want to change EIP at?
Ive wanted to make DLL's change registers too, but can't seem to figure it out...
_________________
You know, life moves pretty fast. If you don't stop and look around once in a while, You could miss it!
 |
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Tue Feb 19, 2008 6:57 pm Post subject: |
|
|
you have to make a user breakpoint on an addy... im gonna look at the CE source on that and see how it makes its breakpoint.
_________________
|
|
| Back to top |
|
|
samuri25404
Grandmaster Cheater
Reputation: 7
Joined: 04 May 2007
Posts: 955
Location: Why do you care?
|
| Posted: Tue Feb 19, 2008 7:24 pm Post subject: |
|
|
For changing registers, can't you just do
| Code: |
_asm
{
mov [eax],1337
}
|
?
_________________
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Tue Feb 19, 2008 7:28 pm Post subject: |
|
|
| samuri25404 wrote: | For changing registers, can't you just do
| Code: |
_asm
{
mov [eax],1337
}
|
? |
yes you can change register flags via inline asm (not your code above thats for sure) but your doing it via Memory editing instead of hardware breakpoints and Memory Editing is Detected so you need MSCRC and which needs GGCRC
_________________
|
|
| Back to top |
|
|
FerrisBuellerYourMyHero
Master Cheater
Reputation: 0
Joined: 14 Feb 2007
Posts: 401
Location: Inside your <kernel>
|
| Posted: Wed Feb 20, 2008 12:16 am Post subject: |
|
|
| lurc wrote: | | samuri25404 wrote: | For changing registers, can't you just do
| Code: |
_asm
{
mov [eax],1337
}
|
? |
yes you can change register flags via inline asm (not your code above thats for sure) but your doing it via Memory editing instead of hardware breakpoints and Memory Editing is Detected so you need MSCRC and which needs GGCRC |
what lurc said is spot on! think about it, to change eax like that you'd have to hook an address to change the eax there[and that changes the crc]...
just changing 1 byte will screw up the crc...
and besides that you can't go
it just doesn't work like that...
_________________
You know, life moves pretty fast. If you don't stop and look around once in a while, You could miss it!
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Thu Feb 21, 2008 9:31 pm Post subject: |
|
|
Then How do you set it for an address???
|
|
| Back to top |
|
|
lurc
Grandmaster Cheater Supreme
Reputation: 2
Joined: 13 Nov 2006
Posts: 1900
|
| Posted: Sun Feb 24, 2008 1:18 pm Post subject: |
|
|
| dnsi0 wrote: |
Then How do you set it for an address??? |
You have to set a breakpoint on the address.. check how CE does it.
_________________
|
|
| Back to top |
|
|
rapion124
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Mar 2007
Posts: 1095
|
| Posted: Sun Feb 24, 2008 1:37 pm Post subject: |
|
|
Set a breakpoint at whatever address you want to have a register change. You have to use hardware BPs.
Call SuspendThread(hThread) // hThread is a handle to the thread
Define a context structure.
Use GetThreadContext to fill the context structure so you don't screw up the other app.
Context.Blah // Blah is the register you wanna change
SetThreadContext(hThread, @Whatever)
|
|
| Back to top |
|
|
Sean1337
Master Cheater
 Reputation: 0
Joined: 04 May 2007
Posts: 478
|
| Posted: Sun Feb 24, 2008 11:17 pm Post subject: |
|
|
| FerrisBuellerYourMyHero wrote: |
I've made a DLL injector like this, using the "codecave" method... the basic idea is this...
you make a codecave which has the old EIP, and the address of loadlibrarya, and the address of the string of the dll to load... then call loadlibrarya with the dll string...
| Code: |
__declspec(naked) loadDll(void)
{
_asm{
// Placeholder for the return address
push 0xBAADF00D
// Save the flags and registers
pushfd
pushad
// Placeholder for the string address and LoadLibrary
push 0xBAADBABE
mov eax, 0xDEADBABE
// Call LoadLibrary with the string parameter
call eax
// Restore the registers and flags
popad
popfd
// Return control to the hijacked thread
ret
}
}
|
then copy it to the target process using writeprocessmemory
next you get a threadID of a running thread in the process, get the context of the thread, save the old EIP, then hijack the thread by changing the EIP to point to the codecave which calls loadlibrarya, and resume the thread... it jumps to your cave, loads the dll, then returns control back to the thread...
| Code: |
CONTEXT ctx;
threadID = GetThreadID("ProcessName.exe");
hThread = OpenThread((THREAD_GET_CONTEXT | THREAD_SET_CONTEXT | THREAD_SUSPEND_RESUME), false, threadID);
SuspendThread(hThread);
ctx.ContextFlags = CONTEXT_CONTROL;
GetThreadContext(hThread, &ctx);
oldIP = ctx.Eip;
ctx.Eip = (DWORD)stub;
ctx.ContextFlags = CONTEXT_CONTROL;
VirtualProtect(loadDll, stubLen, PAGE_EXECUTE_READWRITE, &oldprot);
memcpy((void *)((unsigned long)loadDll + 1), &oldIP, 4);
memcpy((void *)((unsigned long)loadDll + 8), &dllString, 4);
memcpy((void *)((unsigned long)loadDll + 13), &loadLibAddy, 4);
WriteProcessMemory(hProcess, stub, loadDll, stubLen, NULL);
SetThreadContext(hThread, &ctx);
ResumeThread(hThread);
unsigned long GetThreadID(char *procName)
{
PROCESSENTRY32 pe;
HANDLE thSnapshot, hProcess;
BOOL retval, ProcFound = false;
unsigned long pTID, threadID;
thSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
if(thSnapshot == INVALID_HANDLE_VALUE)
{
MessageBox(NULL, "Error: unable to create toolhelp snapshot", "Loader", NULL);
return false;
}
pe.dwSize = sizeof(PROCESSENTRY32);
retval = Process32First(thSnapshot, &pe);
while(retval)
{
if(StrStrI(pe.szExeFile, procName) )
{
ProcFound = true;
break;
}
retval = Process32Next(thSnapshot,&pe);
pe.dwSize = sizeof(PROCESSENTRY32);
}
CloseHandle(thSnapshot);
_asm {
mov eax, fs:[0x18]
add eax, 36
mov [pTID], eax
}
hProcess = OpenProcess(PROCESS_VM_READ, false, pe.th32ProcessID);
ReadProcessMemory(hProcess, (const void *)pTID, &threadID, 4, NULL);
CloseHandle(hProcess);
return threadID;
}
|
The problem is I can't seem to figure out how to set the EIP at a certain ADDRESS! this just does it at any random address a thread is currently running at... also how do you get the threadID of the of the thread that has the address you want to change EIP at?
Ive wanted to make DLL's change registers too, but can't seem to figure it out... |
congratulations - you know how to copy paste code from edgeofnowhere.cc and act pro by not providing proper credits!
w00t, another noob is born!
credits go to Darawk from edgeofnowhere.cc, previously known as BlizzHackers:
http://www.edgeofnowhere.cc/viewtopic.php?p=2483118
_________________
|
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
