| View previous topic :: View next topic |
| Author |
Message |
b6ooy
Grandmaster Cheater
![]() Reputation: 0
Joined: 21 Sep 2006
Posts: 653
|
 Posted: Sun Feb 01, 2009 8:37 am Post subject: [Q] GetProcAddress |
 |
|
I have a problem getting the address of a module that name objXXXX.tmp
the XXXX is 2bytes hex and it changes everytime that i join the game also it is allocated in different address ..
I have no idea how i can make GetModuleHandle skip the 2Bytes or only find the module that starts with obj
| Code: |
GetProcAddress(GetModuleHandle("obj%x.tmp"),"Gm.exe"); |
I had an idea on making a counter to increase the %x till it find the correct module but dont know if it will work or not .
Just asking for another way .
|
|
| Back to top |
|
 |
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sun Feb 01, 2009 8:49 am Post subject: |
|
|
| Use the same method as you would with processes except snap only modules from a process. Go through the list of modules until you find whatever you are looking fro then extract the string and trim it. Then use GetProcAddress(GetModuleHandle(found),'Whatever');
|
|
| Back to top |
|
|
b6ooy
Grandmaster Cheater
![]() Reputation: 0
Joined: 21 Sep 2006
Posts: 653
|
| Posted: Sun Feb 01, 2009 9:23 am Post subject: |
|
|
| dnsi0 wrote: | | Use the same method as you would with processes except snap only modules from a process. Go through the list of modules until you find whatever you are looking fro then extract the string and trim it. Then use GetProcAddress(GetModuleHandle(found),'Whatever'); |
I did what you wrote but for some reason it didn't work .
Is CreateToolhelp32Snapshot , Module32First and Module32Next hooked by GG ?
I know that GetProcAddress & GetModuleHandle is not hooked but it return false .
Check my code whats wrong ?
| Code: |
CHAR TModule[4] = "obj";
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, NULL);
MODULEENTRY32 me32;
me32.dwSize = sizeof(MODULEENTRY32);
Module32First(hSnapshot, &me32);
while(Module32Next(hSnapshot, &me32))
{
if(strcmp(me32.szModule,TModule) == 0)
{
GetProcAddress(me32.hModule,"Gm.exe");
}
}
CloseHandle(hSnapshot);
|
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Sun Feb 01, 2009 9:33 am Post subject: |
|
|
| b6ooy wrote: | | dnsi0 wrote: | | Use the same method as you would with processes except snap only modules from a process. Go through the list of modules until you find whatever you are looking fro then extract the string and trim it. Then use GetProcAddress(GetModuleHandle(found),'Whatever'); |
I did what you wrote but for some reason it didn't work .
Is CreateToolhelp32Snapshot , Module32First and Module32Next hooked by GG ?
I know that GetProcAddress & GetModuleHandle is not hooked but it return false .
Check my code whats wrong ?
| Code: |
CHAR TModule[4] = "obj";
HANDLE hSnapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, NULL);
MODULEENTRY32 me32;
me32.dwSize = sizeof(MODULEENTRY32);
Module32First(hSnapshot, &me32);
while(Module32Next(hSnapshot, &me32))
{
if(strcmp(me32.szModule,TModule) == 0)
{
GetProcAddress(me32.hModule,"Gm.exe");
}
}
CloseHandle(hSnapshot);
|
|
you have to trim it..... The string is modname followed by alot of NULL characters to fill the 255 bytes in the string.
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Sun Feb 01, 2009 10:01 am Post subject: modified version of my GetPebDll ... |
|
|
this should suffice 
caveat being its for XP sp1 sp2 im not sure of sp3 or vista suport..
and that this function has to execute in the context of the process to read the peb.
| Code: |
HMODULE FindDllHandleByNameEx(wchar_t* NameConstant)
{
HMODULE DllBase = 0;
PWSTR UNIS;
int tsl = 0;
wchar_t* nTemp = NameConstant;
tsl = wcslen(NameConstants);
if(tsl > 255)
{
return FALSE;
}
else
{
__asm
{
pushad
xor eax, eax
mov eax, fs:[0x30] //Peb
mov ecx, [eax+0x0C] //Peb.Ldr - PEB_LDR_DATA
mov eax,ecx+0x0C]
Scan:
push eax
lea ecx, [eax+0x2c]
mov eax, [ecx]UNICODE_STRING.Buffer
push eax
push nTemp
pop edi
pop esi
mov ecx,tsl
repe cmpsw
jnz nextmod
pop eax
mov ecx, [eax+0x18]
mov DllBase, ecx
popad
}
return DllBase;
__asm
{
nextmod:
pop ecx
cmp dword ptr [ecx],0
je Failed
mov eax, [ecx]
jmp Scan
Failed:
popad
}
return DllBase;// Return 0
}
}
|
Last edited by BanMe on Sun Feb 01, 2009 10:04 am; edited 1 time in total |
|
| Back to top |
|
|
Zerith
Master Cheater
 Reputation: 1
Joined: 07 Oct 2007
Posts: 468
|
| Posted: Sun Feb 01, 2009 10:03 am Post subject: |
|
|
strcmp returns 0 if both strings are exactly the same.
Just make your own function to compare the 3 first characters or something...
|
|
| Back to top |
|
|
b6ooy
Grandmaster Cheater
![]() Reputation: 0
Joined: 21 Sep 2006
Posts: 653
|
| Posted: Sun Feb 01, 2009 10:54 am Post subject: |
|
|
| Zerith wrote: | strcmp returns 0 if both strings are exactly the same.
Just make your own function to compare the 3 first characters or something... |
yea , used strncmp to compare the first 3 only .
Thanks all , i got it to work the only mistake was using GetProcAddress it doesnt give the mdulebase address so i changed it to me32.modBaseAddr and worked
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Mon Feb 02, 2009 5:00 pm Post subject: |
|
|
I swear to god no one listens to me...
I code something(on a web page) better then GetModuleHandle and its ignored...annoying..my solution though not completely refined would half the execution time necessary then relying on CreateToolhelp32Snapshot/Module32First/Module32Next but what do i know...
regards BanMe
|
|
| Back to top |
|
|
rapion124
Grandmaster Cheater Supreme
![]() Reputation: 0
Joined: 25 Mar 2007
Posts: 1095
|
| Posted: Mon Feb 02, 2009 6:23 pm Post subject: |
|
|
| BanMe wrote: | I swear to god no one listens to me...
I code something(on a web page) better then GetModuleHandle and its ignored...annoying..my solution though not completely refined would half the execution time necessary then relying on CreateToolhelp32Snapshot/Module32First/Module32Next but what do i know...
regards BanMe |
Except your method is very volatile. Why not use Win32 APIs? That's why M$ created them.
|
|
| Back to top |
|
|
ShurikeN
Advanced Cheater
![]() Reputation: 0
Joined: 09 Jan 2008
Posts: 84
|
| Posted: Tue Feb 03, 2009 4:44 am Post subject: |
|
|
[quote="b6ooy"] | Zerith wrote: | strcmp returns 0 if both strings are exactly
yea , used strncmp to compare the first 3 only .
|
how about strstr()??
_________________
| Code: | XXXXXX XXXXXX
XXXXX XXXXX
XXXXXXXX
D I R E C T
XXXXXXXX
XXXXX XXXXX
XXXXXX XXXXXX
GameDev
|
|
|
| Back to top |
|
|
BanMe
Master Cheater
![]() Reputation: 0
Joined: 29 Nov 2005
Posts: 375
Location: Farmington NH, USA
|
| Posted: Tue Feb 03, 2009 12:14 pm Post subject: |
|
|
and when one is presented with a Environment that does not have win32 api(cause there not loaded yet(literaly) such as the environment in a Native Application such as the one mark russinovich(prolly got his name wrong xD) presented then you come up with stuff such as this and if you consider how Volitile a virus is on the whole and most used to use a method very similiar to this then the question of volitility becomes moot in the face of abject reality.
regards BanMe
|
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
