Cheat Engine

jackyyll · Posted: Thu Jul 10, 2008 11:26 am Post subject: [Question] Hook hopping

I know hook hopping is jumping over the hook that GG puts on some API's but i was wondering, is this a generic thing that all game protection software does? Like, is it going to be the same thing for xTrap, like jump ove the five bytes and stuff? Or, is it going to be a completely different routine with possibly more than just a jmp to their own code?

EDIT:
Also, can you hook hop the IsDebuggerPresent function and change the code so it always returns false thus allowing you to run debuggers?

lurc · Posted: Thu Jul 10, 2008 11:35 am Post subject:

If xTrap puts a hook at the beggining of user-mode functions like GG then yes you can use it.

For IsDebuggerPresent:
If you want to always return false then you have to hook IsDebuggerPresent, and always return false.

jackyyll · Posted: Thu Jul 10, 2008 11:42 am Post subject:

How can i tell if they're putting it at the beginning of the function, the UCE i'm using for some reason wont enumerate DLL's and Symbols :/ Don't know if it's xtrap stopping it or if it's the UCE.

Isn't hook hopping the IsDebuggerPresent going to accomplish the same thing as a hook since you're going to be rewriting the code can't you just add a ret false or something? Or when you hook hop it, redirect to a completely different function like a trampoline?

lurc · Posted: Thu Jul 10, 2008 12:00 pm Post subject:

Your missing the big picture about hook-hopping.

Your rewriting the original bytes ourselves then jumping right back to to the function past those bytes we just wrote ourself. It run's normally after that. Plus this only helps you.
If another process called IsDebuggerPresent it would run normally.

hooking something yourself is different. Your doing what GameGuard is doing. writing the first 5 bytes to a jump to your function. Where you rebuild wut you had overwritten then just return false.

Dark Gigabyte · Posted: Thu Jul 10, 2008 12:06 pm Post subject:

Try putting something like this using FixMemEx

or you can use virtual protect I think

put this under your includes:

lurc · Posted: Thu Jul 10, 2008 12:10 pm Post subject:

jackyyll · Posted: Thu Jul 10, 2008 12:48 pm Post subject:

I see. So, how can i find the API's in the games memory if the enumerate DLL's isn't working in CE? Is there another way that i can find them?

atom0s · Posted: Thu Jul 10, 2008 12:58 pm Post subject:

jackyyll · Posted: Thu Jul 10, 2008 1:26 pm Post subject:

Using PEiD, i open the Task Viewer in it, and the game's process doesn't show up. If i open the executable, there are only two imports kernel32.dll and comctl32.dll. Is this because the game is packed with themida?