| yazigegeda Expert Cheater
 
 ![]() Reputation: 0 
 Joined: 22 Jan 2019
 Posts: 183
 
 
 | 
			
				|  Posted: Tue Jun 18, 2024 1:50 am    Post subject: |   |  
				| 
 |  
				|  	  | yazigegeda wrote: |  	  |  	  | Dark Byte wrote: |  	  | try getURL instead of postURL | 
 
 
 But I want to request the website needs to use post mode, so really can? I don't know the getURL way to fill in the postURL parameters
 | 
 
 
 Okay, so now I've got a hook and his tests are working :lol:
 
 
 function:
 
 
  	  | Code: |  	  | 
 local PAGE_NOACCESS , PAGE_WRITECOPY , PAGE_READONLY , PAGE_READWRITE , PAGE_EXECUTE , PAGE_EXECUTE_WRITECOPY , PAGE_EXECUTE_READ , PAGE_EXECUTE_READWRITE  = 0x01 , 0x08 , 0x2 , 0x4 , 0x10, 0x80 , 0x20 , 0x40
 
 
 
 function NtProtectVirtualMemory(p1,p2,p3,p4,p5)   --  ,{0,p1},{0,p2}
 return executeCodeLocalEx('ntdll.NtProtectVirtualMemory',{0,p1},{0,p2},{0,p3} ,{0,p4},{0,p5})
 end
 
 
 
 
 function setHookRequestHeaders( p1 , p2 )
 
 
 MS_codes = createMemoryStream()
 MS_codes.Size = 255
 
 
 
 local MS = createMemoryStream()
 MS.Size = 0x40
 local pBaseAddress , pSize , poldpro = MS.Memory , MS.Memory+8 , MS.Memory+0x18
 WriteQwordLocal( pBaseAddress , MS_codes.Memory )
 WriteQwordLocal( pSize , 255 )
 NtProtectVirtualMemory( -1 , pBaseAddress , pSize ,  0x40 , poldpro )
 
 MS.destroy()
 
 
 local  HttpSendRequestA_addr = getAddress( 'wininet.HttpSendRequestA' , true )
 
 copyMemory( HttpSendRequestA_addr , 0xF , MS_codes.Memory , 3 )
 
 
 
 
 local ops , temp , temp2 = { 0x48 , 0xBA } , qwordToByteTable( p1 ) , dwordToByteTable( p2 )
 for i = 1 , #temp do
 table.insert( ops , temp[i] )
 end
 table.insert( ops , 0x41 )
 table.insert( ops , 0xB8 )
 for i = 1 , #temp2 do
 table.insert( ops , temp2[i] )
 end
 
 
 table.insert( ops , 0xFF )
 table.insert( ops , 0x25)
 table.insert( ops , 0x00 )
 table.insert( ops , 0x00 )
 table.insert( ops , 0x00 )
 table.insert( ops , 0x00 )
 
 taroffset = qwordToByteTable( HttpSendRequestA_addr + 0xF )
 
 for i = 1 , #taroffset do
 table.insert( ops , taroffset[i] )
 end
 
 WriteBytesLocal( MS_codes.Memory + 0xF , ops )
 
 
 -- print( string.format("HttpSendRequestA_addr  %X", HttpSendRequestA_addr ))
 
 
 --print( string.format("MS_codes.Memory  %X", MS_codes.Memory ))
 
 ops = {}
 
 table.insert( ops , 0xFF )
 table.insert( ops , 0x25 )
 table.insert( ops , 0x00 )
 table.insert( ops , 0x00 )
 table.insert( ops , 0x00 )
 table.insert( ops , 0x00 )
 
 taroffset = qwordToByteTable( MS_codes.Memory )
 
 for i = 1 , #taroffset do
 table.insert( ops , taroffset[i] )
 end
 
 WriteBytesLocal( HttpSendRequestA_addr, ops )
 
 
 end
 
 function delHookRequestHeaders()
 local ori = readBytesLocal(  MS_codes.Memory , 0xF , true)
 WriteBytesLocal( 'wininet.HttpSendRequestA' , ori )
 MS_codes.destroy()
 end
 
 
 
 
 | 
 
 
 
 
 demo:
 
 
  	  | Code: |  	  | 
 
 
 local MS = createMemoryStream()
 MS.Size = 0x1000
 local pheaders = MS.Memory
 local Headers = 'Content-Type: application/x-www-form-urlencoded\r\n'..
 'Referer: https://.....\r\n'
 
 WriteStringLocal( pheaders , Headers )
 
 
 setHookRequestHeaders( pheaders , #Headers )
 
 dom = int.postURL( url , json... )
 
 delHookRequestHeaders()
 
 MS.destroy()
 
 
 | 
 |  |