Page 1 of 3 123 LastLast
Results 1 to 15 of 31
  1. #1
    topblast's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Far from around you Programmer: C++ | VB | C# | JAVA
    Posts
    3,607
    Reputation
    149
    Thanks
    4,922
    My Mood
    Cool

    Copy Function Beta [For PTC]

    Well I just put this together is about 3 mins so it might got a few logical errors in it.


    I DID NOT TEST THIS CODE.

    But the way i wanted it to work is to Copy the whole function into a place in memory. Then return the addy to the space in memory, Stop like the bottom half of Some detours. So I Copy the whole function and you can use that function anytime you want to.

    I have one that i am 100% that will work but i dont want to post it, it is built for profection :O

    So in other words
    1. CopyFunction(ENGINE_LTC_FOR_PTC);
    2. Copy PTC Function into memory
    3. Return the Address of that function and store into your Typedef function lets say
      PTC = CopyFunction(ENGINE_LTC_FOR_PTC);
    4. PTC("ShowFPS 1");
    5. and it SHOULD work


    Credits to topblast
    ONLY TOPBLAST

    Code:
    void* CopyFunction(DWORD addy)
    {
    	if (addy == NULL) return NULL;
    	int len = 0;
    	PBYTE func;
    	DWORD dwProtect;
    	LPVOID ret;
    	func = PBYTE(addy);
    	while(func[len] != 0xC3 || func[len] != 0xC2
    		  || func[len] != 0xCA || func[len] != 0xCB)
    	{
    		len++;
    	}
    	ret =  VirtualAlloc(0, len, (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
    	if (ret != NULL && 
    		VirtualProtect(LPVOID(addy), len, PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE) return NULL;
    	{
    		memcpy(ret,LPVOID(addy),len);
    		VirtualProtect(LPVOID(addy), len, dwProtect, &dwProtect);
    		return ret;
    	}
    	ret = NULL;
    	func = NULL;
    	return NULL;
    }
    Last edited by topblast; 06-10-2011 at 07:39 PM.
    I just like programming, that is all.

    Current Stuff:

    • GPU Programmer (Cuda)
    • Client/Server (Cloud Server)
    • Mobile App Development

  2. The Following 5 Users Say Thank You to topblast For This Useful Post:

    'Batata! (06-15-2011),CAFlames (06-11-2011),ortax (06-12-2011),S0aD (06-24-2011),speedforyou (06-10-2011)

  3. #2
    LionelMessi10's Avatar
    Join Date
    Oct 2010
    Gender
    male
    Location
    MPGH.NET
    Posts
    6,125
    Reputation
    114
    Thanks
    4,545
    My Mood
    Aggressive
    Nice Job..


  4. The Following 2 Users Say Thank You to LionelMessi10 For This Useful Post:

    ortax (06-12-2011),topblast (06-10-2011)

  5. #3
    topblast's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Far from around you Programmer: C++ | VB | C# | JAVA
    Posts
    3,607
    Reputation
    149
    Thanks
    4,922
    My Mood
    Cool
    I just saw that i have some unneeded code in they but it wont hurt i guess.
    I just like programming, that is all.

    Current Stuff:

    • GPU Programmer (Cuda)
    • Client/Server (Cloud Server)
    • Mobile App Development

  6. The Following User Says Thank You to topblast For This Useful Post:

    ortax (06-12-2011)

  7. #4
    speedforyou's Avatar
    Join Date
    Aug 2010
    Gender
    male
    Posts
    741
    Reputation
    -59
    Thanks
    108
    My Mood
    Happy
    nice thanks

    steel o-o's sig =
    = Done , = Not Done

    Leecher 0 =
    Newbie 25 =
    Member 50 =
    Advanced Member 100 =
    H4X0R Member 150 =
    Dual-Keyboard Member 250 =
    Expert Member 500 =
    's Trainer 750 =
    MPGH Expert 1000 =
    Synthetic Hacker 1250 =
    Blackhat Hacker 1500 =
    Whitehat Hacker 2000 =
    's Guardian 2500 =
    Upcoming MPGHiean 3000 =
    MPGH Addict 3500 =
    MPGHiean 4000 =
    MPGH Knight 4500 =
    MPGH Lord 5000 =
    MPGH Champion 5500 =
    MPGH King 6000 =
    MPGH Legend 6500 =
    MPGH God 7000 =
    MPGH God II 7500 =
    MPGH God III 8000 =
    MPGH God IV 8500 =
    MPGH God V 9000 =
    Arun's Slave 9500 =
    Dave's Slave 10000 =

  8. The Following User Says Thank You to speedforyou For This Useful Post:

    ortax (06-12-2011)

  9. #5
    fragbox's Avatar
    Join Date
    Aug 2009
    Gender
    male
    Location
    oregon
    Posts
    310
    Reputation
    9
    Thanks
    25
    My Mood
    Aggressive
    good job...... i guess dont know what its for? but
    Actions speak louder than words.

    CounterStrike:GlobalOffensive

    Learning C++ currently, then i'll start producing some simple hacks/tools for counterstrike


  10. The Following User Says Thank You to fragbox For This Useful Post:

    ortax (06-12-2011)

  11. #6
    SNal2F's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    175
    Reputation
    30
    Thanks
    99
    cool its the same thing i was talking about in the other ptc post redirecting to a rewritten function :P

  12. The Following 2 Users Say Thank You to SNal2F For This Useful Post:

    freedompeace (06-11-2011),ortax (06-12-2011)

  13. #7
    topblast's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Far from around you Programmer: C++ | VB | C# | JAVA
    Posts
    3,607
    Reputation
    149
    Thanks
    4,922
    My Mood
    Cool
    Quote Originally Posted by SNal2F View Post
    cool its the same thing i was talking about in the other ptc post redirecting to a rewritten function :P
    sure you was.
    I just like programming, that is all.

    Current Stuff:

    • GPU Programmer (Cuda)
    • Client/Server (Cloud Server)
    • Mobile App Development

  14. The Following User Says Thank You to topblast For This Useful Post:

    ortax (06-12-2011)

  15. #8
    SNal2F's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    175
    Reputation
    30
    Thanks
    99
    Quote Originally Posted by topblast View Post


    sure you was.

    ...........how isnt it when i redirect a pointer to my own function and rewrite it? Think about it logically

    not the first time i have talked about it either , trust me this method is older then me & your birth age they did this shit in the 80's
    Last edited by SNal2F; 06-11-2011 at 12:51 AM.

  16. The Following 3 Users Say Thank You to SNal2F For This Useful Post:

    freedompeace (06-11-2011),ortax (06-12-2011),whit (06-11-2011)

  17. #9
    AVGN's Avatar
    Join Date
    Sep 2009
    Gender
    male
    Location
    Making America Great Again.
    Posts
    15,451
    Reputation
    1549
    Thanks
    6,234
    Quote Originally Posted by SNal2F View Post
    ...........how isnt it when i redirect a pointer to my own function and rewrite it? Think about it logically

    not the first time i have talked about it either , trust me this method is older then me & your birth age they did this shit in the 80's



    ^Thanks to RJ^




  18. The Following User Says Thank You to AVGN For This Useful Post:

    ortax (06-12-2011)

  19. #10
    topblast's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Far from around you Programmer: C++ | VB | C# | JAVA
    Posts
    3,607
    Reputation
    149
    Thanks
    4,922
    My Mood
    Cool
    Quote Originally Posted by SNal2F View Post
    ...........how isnt it when i redirect a pointer to my own function and rewrite it? Think about it logically

    not the first time i have talked about it either , trust me this method is older then me & your birth age they did this shit in the 80's
    lol, but this function is not complete. you see some asm functions have RETN at both sides of a Jump, I dont have the PTC in ASM so i wont be sure if this will work but it is worth a try..

    Can someone give me the PTC function in ASM and i dont need to copy the Function, I will just convert it to usable code
    I just like programming, that is all.

    Current Stuff:

    • GPU Programmer (Cuda)
    • Client/Server (Cloud Server)
    • Mobile App Development

  20. The Following User Says Thank You to topblast For This Useful Post:

    ortax (06-12-2011)

  21. #11
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    833
    My Mood
    Twisted
    Quote Originally Posted by topblast View Post


    lol, but this function is not complete. you see some asm functions have RETN at both sides of a Jump, I dont have the PTC in ASM so i wont be sure if this will work but it is worth a try..

    Can someone give me the PTC function in ASM and i dont need to copy the Function, I will just convert it to usable code
    Not sure since this is from the top of my head:

    Code:
    mov eax, ltc (ltc+208/whatever you call to call too shove comands)
    push pCommand (has to be char*/PCHAR)
    call eax
    add esp, 4h

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




  22. The Following User Says Thank You to .::SCHiM::. For This Useful Post:

    ortax (06-12-2011)

  23. #12
    SNal2F's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    175
    Reputation
    30
    Thanks
    99
    all ptc does is call a sub function


    Code:
           __asm PUSH szCommand
                    __asm PUSH 0x8003F0
                    __asm CALL SubConsole
                    __asm ADD ESP,8
    Last edited by SNal2F; 06-11-2011 at 01:26 PM.

  24. The Following User Says Thank You to SNal2F For This Useful Post:

    ortax (06-12-2011)

  25. #13
    topblast's Avatar
    Join Date
    Mar 2010
    Gender
    male
    Location
    Far from around you Programmer: C++ | VB | C# | JAVA
    Posts
    3,607
    Reputation
    149
    Thanks
    4,922
    My Mood
    Cool
    Quote Originally Posted by .::SCHiM::. View Post
    Not sure since this is from the top of my head:

    Code:
    mov eax, ltc (ltc+208/whatever you call to call too shove comands)
    push pCommand (has to be char*/PCHAR)
    call eax
    add esp, 4h
    Quote Originally Posted by SNal2F View Post
    all ptc does is call a sub function


    Code:
           __asm PUSH szCommand
                    __asm PUSH 0x8003F0
                    __asm CALL SubConsole
                    __asm ADD ESP,8

    You both have it wrong, i already know how to create a PTC SUB which calls the PTC function.

    But what i want is the ASM code inside the PTC function.

    PTC wrapper
    I just like programming, that is all.

    Current Stuff:

    • GPU Programmer (Cuda)
    • Client/Server (Cloud Server)
    • Mobile App Development

  26. The Following User Says Thank You to topblast For This Useful Post:

    ortax (06-12-2011)

  27. #14
    SNal2F's Avatar
    Join Date
    Jul 2009
    Gender
    male
    Posts
    175
    Reputation
    30
    Thanks
    99
    Quote Originally Posted by topblast View Post





    You both have it wrong, i already know how to create a PTC SUB which calls the PTC function.

    But what i want is the ASM code inside the PTC function.

    PTC wrapper
    you have it wrong...

    that is the code inside the ptc @ 0x208 prior to checks

    table -> call ptc ->call sub console


    learn to reverse b4 calling someone out.
    Last edited by SNal2F; 06-11-2011 at 02:17 PM.

  28. The Following User Says Thank You to SNal2F For This Useful Post:

    whit (06-11-2011)

  29. #15
    .::SCHiM::.'s Avatar
    Join Date
    Sep 2010
    Gender
    male
    Posts
    733
    Reputation
    180
    Thanks
    833
    My Mood
    Twisted
    Quote Originally Posted by topblast View Post





    You both have it wrong, i already know how to create a PTC SUB which calls the PTC function.

    But what i want is the ASM code inside the PTC function.

    PTC wrapper
    Then that'd be the console function not the push to console function.
    Get your terms straight.

    Anyway, I don't know what you try to achieve by copying the function to a different location (it's not like it will work...). But here it is (the first bit of it, if you want more you'll have to dump it yourself):

    Code:
    77DF1D78   A1 3C001037      MOV EAX,DWORD PTR DS:[3710003C]
    77DF1D7D   8B88 2C001037    MOV ECX,DWORD PTR DS:[EAX+3710002C]
    77DF1D83   8B1424           MOV EDX,DWORD PTR SS:[ESP]
    77DF1D86   05 00001037      ADD EAX,37100000
    77DF1D8B   81C1 00001037    ADD ECX,37100000
    77DF1D91   3BD1             CMP EDX,ECX
    77DF1D93   72 0E            JB SHORT ntdll.77DF1DA3
    77DF1D95   8B40 50          MOV EAX,DWORD PTR DS:[EAX+50]
    77DF1D98   03C1             ADD EAX,ECX
    77DF1D9A   3BD0             CMP EDX,EAX
    77DF1D9C   73 05            JNB SHORT ntdll.77DF1DA3
    77DF1D9E   E9 A5630100      JMP ntdll.77E08148
    77DF1DA3   C3               RETN
    77DF1DA4   CC               INT3
    77DF1DA5   CC               INT3
    77DF1DA6   CC               INT3
    77DF1DA7   CC               INT3
    77DF1DA8   A1 08028000      MOV EAX,DWORD PTR DS:[800208]
    77DF1DAD   83B8 500A0000 00 CMP DWORD PTR DS:[EAX+A50],0
    77DF1DB4   74 0B            JE SHORT ntdll.77DF1DC1
    77DF1DB6   8B88 500A0000    MOV ECX,DWORD PTR DS:[EAX+A50]
    77DF1DBC   E9 B7B40A00      JMP ntdll.77E9D278
    77DF1DC1   33C0             XOR EAX,EAX
    77DF1DC3   C3               RETN
    Note, copying this doesn't make any sense, for starters you'll have to re-write all offsets

    Just so you know

    I'm SCHiM

    Morals derive from the instinct to survive. Moral behavior is survival behavior above the individual level.

    Polymorphic engine
    Interprocess callback class
    SIN
    Infinite-precision arithmetic
    Hooking dynamic linkage
    (sloppy)Kernel mode Disassembler!!!

    Semi debugger




Page 1 of 3 123 LastLast