Slugsnack
Grandmaster Cheater Supreme
![]() Reputation: 71
Joined: 24 Jan 2007
Posts: 1857
|
 Posted: Tue Apr 06, 2010 6:05 pm Post subject: |
 |
|
Let's take GetTickCount() which retrieves the time since system start. If you want it to appear as if time is going twice as fast then that means each time the application calls GetTickCount(), you need to make it appear as if twice the amount of time that has passed has passed. Take x to be the time since the game last called GetTickCount(). And y to be the time that the game first called it.
So on the very first time the game calls GetTickCount() we want to return y as normal. On every other instance to that, when the real time is y + x, what we want to return is y + 2x.
Therefore, what you wanna do is, as soon as your DLL is injected, call GetTickCount() and in that instance, store the initial time. Then in your hook in every other instance that that API is called, call a trampolined version of GetTickCount(), subtract the initial stored time from the return and multiply that by two. Then add that onto the stored initial, and return that.
You do a similar thing for timeGetTime() and QueryPerformanceCounter(). Here is the hook in assembly for GetTickCount() and timeGetTime(). I can't find the version with the QueryPerformanceCounter() hook too. Sloppy code since it's from like a year and half ago.. Omfg I used to be noob..
| Code: | .586
option casemap:none
includelib \masm32\lib\user32.lib
includelib \masm32\lib\kernel32.lib
includelib \masm32\lib\winmm.lib
include \masm32\include\masm32rt.inc
include \masm32\include\winmm.inc
DrawSpeedScale proto
HookFxn proto :DWORD, :DWORD
DLLMain proto
SpeedUp proto
SpeedDown proto
FetchPreamble proto :DWORD, :DWORD, :BOOL
RestorePreamble proto :DWORD, :DWORD, :BOOL
TickHook proto
GetTickCountX proto
timeHook proto
timeGetTimeX proto
.data
ClassName byte "Special Force", 0
WindowName byte "SpecialForce", 0
lpLibName byte "kernel32.dll", 0
lpFxnName byte "GetTickCount", 0
lpLibName2 byte "winmm.dll", 0
lpFxnName2 byte "timeGetTime", 0
SpeedScale dword 0
ProgramState byte 0 ; Program running = 0, finished = 1
.data?
hInstance dword ?
FxnAddr dword ? ; GetTickCount
FxnRetAddr dword ? ; GetTickCount
TickInitVal dword ? ; GetTickCount
TickPreamb byte 5 dup (?) ; GetTickCount
FxnAddr2 dword ? ; timeGetTime
FxnRetAddr2 dword ? ; timeGetTime
timeInitVal dword ? ; timeGetTime
timePreamb byte 7 dup (?) ; timeGetTime
.code
LibMain proc instance:DWORD,reason:DWORD,unused:DWORD
LOCAL ThreadID:DWORD
xor ebx, ebx
.if reason == DLL_PROCESS_ATTACH
mov eax, instance
mov hInstance, eax
invoke CreateThread, ebx, ebx, addr DLLMain, ebx, ebx, addr ThreadID
.elseif reason == DLL_PROCESS_DETACH
.endif
ret
LibMain endp
DLLMain proc
xor ebx, ebx
invoke CreateThread, ebx, ebx, addr SpeedUp, ebx, ebx, ebx
invoke CreateThread, ebx, ebx, addr SpeedDown, ebx, ebx, ebx
invoke CreateThread, ebx, ebx, addr DrawSpeedScale, ebx, ebx, ebx
invoke LoadLibrary, addr lpLibName
invoke GetProcAddress, eax, addr lpFxnName
mov FxnAddr, eax
add eax, 5
mov FxnRetAddr, eax
invoke GetTickCount
mov TickInitVal, eax
invoke FetchPreamble, FxnAddr, addr TickPreamb, FALSE
invoke RestorePreamble, addr GetTickCountX, addr TickPreamb, FALSE
invoke HookFxn, FxnAddr, addr TickHook
invoke LoadLibrary, addr lpLibName2
invoke GetProcAddress, eax, addr lpFxnName2
mov FxnAddr2, eax
add eax, 5
mov FxnRetAddr2, eax
invoke timeGetTime
mov timeInitVal, eax
invoke FetchPreamble, FxnAddr2, addr timePreamb, TRUE
invoke RestorePreamble, addr timeGetTimeX, addr timePreamb, TRUE
invoke HookFxn, FxnAddr2, addr timeHook
@@:
invoke Sleep, 100
invoke GetAsyncKeyState, VK_F10
test eax, eax
jz @b
mov ProgramState, 1
invoke RestorePreamble, FxnAddr, addr TickPreamb, FALSE
invoke RestorePreamble, FxnAddr2, addr timePreamb, TRUE
invoke Sleep, 200
invoke FreeLibraryAndExitThread, hInstance, 0
ret
DLLMain endp
DrawSpeedScale proc
LOCAL hWnd:DWORD
LOCAL hDC:DWORD
LOCAL lpSpeedStr:DWORD
@@:
invoke Sleep, 100
invoke FindWindow, 0, addr WindowName
test eax, eax
jz @b
mov hWnd, eax
invoke GetDC, eax
mov hDC, eax
invoke SetTextColor, hDC, 0ffffffh
invoke SetBkColor, hDC, 0h
@@:
cmp ProgramState, 1
je @f
invoke Sleep, 1
mov lpSpeedStr, ustr$(SpeedScale)
invoke TextOut, hDC, 0, 0, lpSpeedStr, len(lpSpeedStr)
jmp @b
invoke ReleaseDC, hWnd, hDC
@@:
ret
DrawSpeedScale endp
SpeedDown proc
@@:
cmp ProgramState, 1
je @f
invoke Sleep, 100
invoke GetAsyncKeyState, VK_F11
test eax, eax
jz @b
cmp SpeedScale, 0
je @b
dec SpeedScale
jmp @b
@@:
mov SpeedScale, 0
ret
SpeedDown endp
SpeedUp proc
@@:
cmp ProgramState, 1
je @f
invoke Sleep, 100
invoke GetAsyncKeyState, VK_F12
test eax, eax
jz @b
inc SpeedScale
jmp @b
@@:
mov SpeedScale, 0
ret
SpeedUp endp
FetchPreamble proc lpFxn:DWORD, lpBuf:DWORD, istimeGetTime:BOOL
mov ecx, lpFxn
mov eax, lpBuf
mov edx, dword ptr ds:[ecx]
mov dword ptr ds:[eax], edx
cmp istimeGetTime, TRUE
jne @f
mov dx, word ptr ds:[ecx+4]
mov word ptr ds:[eax+4], dx
mov dl, byte ptr ds:[ecx+6]
mov byte ptr ds:[eax+6], dl
@@:
mov dl, byte ptr ds:[ecx+4]
mov byte ptr ds:[eax+4], dl
EndFetch:
ret
FetchPreamble endp
RestorePreamble proc lpFxn:DWORD, lpBuf:DWORD, istimeGetTime:BOOL
LOCAL OldProt:DWORD
invoke VirtualProtect, lpFxn, 7, PAGE_EXECUTE_READWRITE, addr OldProt
mov ecx, lpFxn
mov eax, lpBuf
mov edx, dword ptr ds:[eax]
mov dword ptr ds:[ecx], edx
cmp istimeGetTime, TRUE
jne @f
mov dx, word ptr ds:[eax+4]
mov word ptr ds:[ecx+4], dx
mov dl, byte ptr ds:[eax+6]
mov byte ptr ds:[ecx+6], dl
@@:
mov dl, byte ptr ds:[eax+4]
mov byte ptr ds:[ecx+4], dl
invoke VirtualProtect, lpFxn, 7, OldProt, addr OldProt
ret
RestorePreamble endp
HookFxn proc JmpFromAddr:DWORD, JmpToAddr:DWORD
LOCAL JmpBytes:DWORD
LOCAL OldProt:DWORD
mov eax, JmpToAddr
sub eax, JmpFromAddr
sub eax, 5
mov JmpBytes, eax
push eax
invoke VirtualProtect, JmpFromAddr, 5, PAGE_EXECUTE_READWRITE, addr OldProt
mov ecx, JmpFromAddr
mov byte ptr ds:[ecx], 0E9h
pop eax
mov dword ptr ds:[ecx+1], eax
invoke VirtualProtect, JmpFromAddr, 5, OldProt, addr OldProt
ret
HookFxn endp
TickHook proc
OPTION EPILOGUE:NONE
OPTION PROLOGUE:NONE
invoke GetTickCountX
push eax
mov ecx, TickInitVal
sub eax, ecx
invoke IntMul, eax, SpeedScale
pop ecx
add eax, ecx
retn
TickHook endp
GetTickCountX proc
nop
nop
nop
nop
nop
jmp dword ptr ds:[FxnRetAddr]
GetTickCountX endp
timeHook proc
invoke timeGetTimeX
push eax
mov ecx, timeInitVal
sub eax, ecx
invoke IntMul, eax, SpeedScale
pop ecx
add eax, ecx
retn
timeHook endp
timeGetTimeX proc
nop
nop
nop
nop
nop
nop
nop
jmp dword ptr ds:[FxnRetAddr2]
timeGetTimeX endp
end LibMain |
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
