| View previous topic :: View next topic |
| Author |
Message |
tanjiajun_34
Grandmaster Cheater
 Reputation: 0
Joined: 16 Feb 2006
Posts: 786
Location: Singapore
|
 Posted: Sat Apr 18, 2009 8:07 pm Post subject: [DELPHI-7]Debug Registers Hack |
 |
|
I know you have to use WriteProcessMemory() But how to script it?
Let's say i got an address "00400000" i wan to make it EAX=0,2,3 or even change it to ZF [X] [X]....How do i do it? I searched but no avail. I hope you guys can teach me...+REP
|
|
| Back to top |
|
 |
sphere90
Grandmaster Cheater
 Reputation: 0
Joined: 24 Jun 2006
Posts: 912
|
| Posted: Sat Apr 18, 2009 9:01 pm Post subject: Re: [DELPHI-7]Debug Registers Hack |
|
|
| tanjiajun_34 wrote: | I know you have to use WriteProcessMemory() But how to script it?
Let's say i got an address "00400000" i wan to make it EAX=0,2,3 or even change it to ZF [X] [X]....How do i do it? I searched but no avail. I hope you guys can teach me...+REP |
You don't need WPM to use debug registers. Look at CE's source code or here.
In short, set DR0 - DR3 of a thread using SetContextThread. You need to set the debug condition in DR7 as well. Then, hook the interrupt handler for int1 to include register modifying routines.
If you are talking about software breakpoints (int3), you need WPM because you need to write the int3 opcode at the address that you want to break. But to handle that interrupt, you need to attach a debugger to the process. Then you can modify the registers easily using SetContextThread.
EDIT: Thanks dnsi0 for pointing out my mistake.
_________________
Give a hungry man a fish and he'll be full for a day. Teach a hungry man how to fish and he'll be full for the rest of his life.
Last edited by sphere90 on Tue Apr 21, 2009 1:00 am; edited 1 time in total |
|
| Back to top |
|
|
tanjiajun_34
Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006
Posts: 786
Location: Singapore
|
| Posted: Sat Apr 18, 2009 9:30 pm Post subject: |
|
|
| wow that's difficult...got any alternative
|
|
| Back to top |
|
|
sphere90
Grandmaster Cheater
Reputation: 0
Joined: 24 Jun 2006
Posts: 912
|
| Posted: Sat Apr 18, 2009 10:31 pm Post subject: |
|
|
| tanjiajun_34 wrote: | | wow that's difficult...got any alternative |
How is it difficult when it's already available in CE's source code? Unless you don't know anything about windows internal.
_________________
Give a hungry man a fish and he'll be full for a day. Teach a hungry man how to fish and he'll be full for the rest of his life. |
|
| Back to top |
|
|
tanjiajun_34
Grandmaster Cheater
Reputation: 0
Joined: 16 Feb 2006
Posts: 786
Location: Singapore
|
| Posted: Mon Apr 20, 2009 4:20 am Post subject: |
|
|
| i know some but i just wanna know the coding..hahas..i think i read still +rep
|
|
| Back to top |
|
|
zd601
How do I cheat?
![]() Reputation: 0
Joined: 08 Nov 2008
Posts: 4
|
| Posted: Mon Apr 20, 2009 9:23 am Post subject: Re: [DELPHI-7]Debug Registers Hack |
|
|
| sphere90 wrote: | | tanjiajun_34 wrote: | I know you have to use WriteProcessMemory() But how to script it?
Let's say i got an address "00400000" i wan to make it EAX=0,2,3 or even change it to ZF [X] [X]....How do i do it? I searched but no avail. I hope you guys can teach me...+REP |
You don't need WPM to use debug registers. Look at CE's source code or
In short, set dr0 - dr3 of a thread using SetContextThread. You need to set the debug condition in dr7 as well. Then, hook the interrupt handler for int0 to include register modifying routines.
If you are talking about software breakpoints (int3), you need WPM because you need to write the int3 opcode at the address that you want to break. But to handle that interrupt, you need to attach a debugger to the process. Then you can modify the registers easily using SetContextThread. |
I make a program using MLE's driver and dll to implement hardware breakpoint at a specific address. But i found i must lauch MLE first then close it, and run my program and it will be effect. If i don't run MLE and run my program directly, it will not take effect. Why?
PS: my target is MapleStory with NProtect.
|
|
| Back to top |
|
|
dnsi0
I post too much
![]() Reputation: 0
Joined: 04 Jan 2007
Posts: 2674
|
| Posted: Mon Apr 20, 2009 8:04 pm Post subject: Re: [DELPHI-7]Debug Registers Hack |
|
|
| sphere90 wrote: | | tanjiajun_34 wrote: | I know you have to use WriteProcessMemory() But how to script it?
Let's say i got an address "00400000" i wan to make it EAX=0,2,3 or even change it to ZF [X] [X]....How do i do it? I searched but no avail. I hope you guys can teach me...+REP |
You don't need WPM to use debug registers. Look at CE's source code or here.
In short, set dr0 - dr3 of a thread using SetContextThread. You need to set the debug condition in dr7 as well. Then, hook the interrupt handler for int0 to include register modifying routines.
If you are talking about software breakpoints (int3), you need WPM because you need to write the int3 opcode at the address that you want to break. But to handle that interrupt, you need to attach a debugger to the process. Then you can modify the registers easily using SetContextThread. |
Uh... Isn't it int1... ???
|
|
| Back to top |
|
|
sphere90
Grandmaster Cheater
Reputation: 0
Joined: 24 Jun 2006
Posts: 912
|
| Posted: Mon Apr 20, 2009 9:14 pm Post subject: Re: [DELPHI-7]Debug Registers Hack |
|
|
| zd601 wrote: | I make a program using MLE's driver and dll to implement hardware breakpoint at a specific address. But i found i must lauch MLE first then close it, and run my program and it will be effect. If i don't run MLE and run my program directly, it will not take effect. Why?
PS: my target is MapleStory with NProtect. |
Running MLE loads the driver. That's why if you don't run it, the driver doesn't get loaded and your program doesn't work. One way to fix it is to load MLE's driver manually in your program before trying to set breakpoints.
| dnsi0 wrote: | | Uh... Isn't it int1... ??? |
Opps. My bad. Should be int1.
_________________
Give a hungry man a fish and he'll be full for a day. Teach a hungry man how to fish and he'll be full for the rest of his life. |
|
| Back to top |
|
|
zd601
How do I cheat?
![]() Reputation: 0
Joined: 08 Nov 2008
Posts: 4
|
| Posted: Tue Apr 21, 2009 1:16 am Post subject: Re: [DELPHI-7]Debug Registers Hack |
|
|
| sphere90 wrote: | | zd601 wrote: | I make a program using MLE's driver and dll to implement hardware breakpoint at a specific address. But i found i must lauch MLE first then close it, and run my program and it will be effect. If i don't run MLE and run my program directly, it will not take effect. Why?
PS: my target is MapleStory with NProtect. |
Running MLE loads the driver. That's why if you don't run it, the driver doesn't get loaded and your program doesn't work. One way to fix it is to load MLE's driver manually in your program before trying to set breakpoints.
. |
Thanks for your reply.
My program will load the dll when it boots and i have read the dbk32 source and found the dll will load the driver when LoadLibrary.
I have searched CEF and found a guy have the same issue with me but no one can figure out the reason.
BTW, sphere90 , could you pls post a sample of hook int1 handler to insert our own process of changing register? Can this be done in userspace?
|
|
| Back to top |
|
|
sphere90
Grandmaster Cheater
Reputation: 0
Joined: 24 Jun 2006
Posts: 912
|
| Posted: Tue Apr 21, 2009 1:46 am Post subject: Re: [DELPHI-7]Debug Registers Hack |
|
|
| zd601 wrote: | | BTW, sphere90 , could you pls post a sample of hook int1 handler to insert our own process of changing register? Can this be done in userspace? |
It's not possible do it in usermode. Here's a file from CE's source. It describes how int1 and int3 handlers are hooked and what the hooks do.
_________________
Give a hungry man a fish and he'll be full for a day. Teach a hungry man how to fish and he'll be full for the rest of his life. |
|
| Back to top |
|
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
