Page 1 of 2 12 LastLast
Results 1 to 15 of 17
  1. #1
    CyanideC00kies's Avatar
    Join Date
    Oct 2011
    Gender
    male
    Location
    Canada
    Posts
    24
    Reputation
    12
    Thanks
    14

    NtCall - A stable workaround for hooked APIs

    This can easily be adapted by looking up the Indexes of other functions.
    If you see something that can be improved let me know.

    Code:
    #include <Windows.h>
    #include <stdio.h>
    
    LONG __declspec(naked) NtCall(DWORD FunctionIndex,DWORD ClassIndex,...)
    {
    	__asm
    	{
    		push ebp
    		mov ebp,esp
    		mov eax,FunctionIndex
    		mov ecx,ClassIndex
    		lea edx,[ebp+0x10]
    		call fs:[0xC0]
    		add esp,0x4
    		leave
    		retn
    	}
    }
    
    #define NtTerminateProcess(ProcessHandle,ExitStatus) NtCall(0x29,0x0,ProcessHandle,ExitStatus)
    #define NtUserSendInput(nInputs,pInput,cbSize) NtCall(0x1082,0x0,nInputs,pInput,cbSize)
    #define NtDeleteFile(ObjectAttributes) NtCall(0x0B2,0x0,ObjectAttributes)
    #define NtReadVirtualMemory(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesRead) NtCall(0x3C,0x0,ProcessHandle,BaseAddress,Buffer,NumberOfBytesToRead,NumberOfBytesRead)
    #define NtWriteVirtualMemory(ProcessHandle,BaseAddress,Buffer,NumberOfBytesToWrite,NumberOfBytesWritten) NtCall(0x37,0x0,ProcessHandle,BaseAddress,Buffer,NumberOfBytesToWrite,NumberOfBytesWritten)
    #define NtOpenProcess(ProcessHandle,DesiredAccess,ObjectAttributes,ClientId) NtCall(0x23,0x0,ProcessHandle,DesiredAccess,ObjectAttributes,ClientId)
    #define NtClose(Handle) NtCall(0x0C,0x0,Handle)
    #define NtWaitForSingleObject(ObjectHandle,Alertable,TimeOut) NtCall(0x1,0x0D,ObjectHandle,Alertable,TimeOut)
    #define NtDelayExecution(Alertable,DelayInterval) NtCall(0x31,0x6,Alertable,DelayInterval)
    #define NtProtectVirtualMemory(ProcessHandle,BaseAddress,NumberOfBytesToProtect,NewAccessProtection,OldAccessProtection) NtCall(0x4D,0x0,ProcessHandle,BaseAddress,NumberOfBytesToProtect,NewAccessProtection,OldAccessProtection)
    #define NtAllocateVirtualMemory(ProcessHandle,BaseAddress,ZeroBits,RegionSize,AllocationType,ProtectionType) NtCall(0x15,0x0,ProcessHandle,BaseAddress,ZeroBits,RegionSize,AllocationType,ProtectionType)
    #define NtFreeVirtualMemory(ProcessHandle,BaseAddress,RegionSize,FreeType) NtCall(0x1B,0x0,ProcessHandle,BaseAddress,RegionSize,FreeType)
    
    // Using NtTerminateProcess for an example
    int main()
    {
    	printf("Terminating self in one second\n");
    	Sleep(1000);
    	NtTerminateProcess(GetCurrentProcess(),-1);
    	printf("You should never see this message\n");
    	getchar();
    }
    Last edited by CyanideC00kies; 12-28-2012 at 03:22 AM.

  2. The Following User Says Thank You to CyanideC00kies For This Useful Post:

    SzaQal (12-28-2012)

  3. #2
    Jabberwock's Avatar
    Join Date
    Jun 2012
    Gender
    male
    Posts
    1,655
    Reputation
    191
    Thanks
    14,466
    My Mood
    Relaxed
    Seems nice. I might be using them.
    Even familiar landscapes will
    reveal a different kind of beauty
    if you change your viewpoint.
    Where these new encounters
    and new bonds will lead you...
    Such dazzling golden days.
    I, too, look forward to
    what I might behold.

    Everything depends on you friend. Be strong don't give up. Don't let the sadness hurt you. Be strong and prevail!

  4. #3
    ~FALLEN~'s Avatar
    Join Date
    May 2009
    Gender
    male
    Location
    devenv.exe
    Posts
    529
    Reputation
    23
    Thanks
    326
    My Mood
    Inspired
    If they have the function checked, this won't make a difference & it would be slower than calling the ring3 function because of the indirection... & tbh this looks copy and pasted, you're not subtracting 4 from the stack but you're adding 4, you have a leave command in there but there is no enter, you have a return near command but not the size of the parameters... this just is not a viable option to be honest.
    Last edited by ~FALLEN~; 12-28-2012 at 06:42 PM.

  5. #4
    CyanideC00kies's Avatar
    Join Date
    Oct 2011
    Gender
    male
    Location
    Canada
    Posts
    24
    Reputation
    12
    Thanks
    14
    Quote Originally Posted by ~FALLEN~ View Post
    If they have the function checked, this won't make a difference & it would be slower than calling the ring3 function because of the indirection... & tbh this looks copy and pasted, you're not subtracting 4 from the stack but you're adding 4, you have a leave command in there but there is no enter, you have a return near command but not the size of the parameters... this just is not a viable option to be honest.
    Do you even know assembly? Not trying to hate, but it seems like you have no idea what you're talking about.
    Last edited by CyanideC00kies; 12-28-2012 at 11:04 PM.

  6. #5
    ~FALLEN~'s Avatar
    Join Date
    May 2009
    Gender
    male
    Location
    devenv.exe
    Posts
    529
    Reputation
    23
    Thanks
    326
    My Mood
    Inspired
    Quote Originally Posted by CyanideC00kies View Post
    Do you even know assembly? Not trying to hate, but seems like you have no idea what you're talking about.
    Yes I do, I can write in x86 asm, read it, read binary, write binary, write code in binary, speak in binary, etc, can you? if there is a local variable you subtract from the stack, add at cleanup, if you're talking about the FS register call the nt functions should be standard calls ( __stdcall ) which means that the function itself should do the stack cleanup, not you. You have function parameters, the ret at the bottom should be ret ( 4 times number of parameters here ) as it is the size of params, seeing as a param is a pointer, that's why its 4 * number of params.. Like I said I've been coding for over 6 years, if you want to get into a pissing match then so be it, just know you will lose.

  7. #6
    akinator's Avatar
    Join Date
    Jul 2012
    Gender
    male
    Posts
    235
    Reputation
    14
    Thanks
    926
    this will work only on 64 bit.. since "fs:[C0]" is a pointer to a wow64 function that will convert 32bit system calls to 64 bits system calls.

  8. #7
    ~FALLEN~'s Avatar
    Join Date
    May 2009
    Gender
    male
    Location
    devenv.exe
    Posts
    529
    Reputation
    23
    Thanks
    326
    My Mood
    Inspired
    ^this /too short

  9. #8
    CyanideC00kies's Avatar
    Join Date
    Oct 2011
    Gender
    male
    Location
    Canada
    Posts
    24
    Reputation
    12
    Thanks
    14
    Quote Originally Posted by akinator View Post
    this will work only on 64 bit.. since "fs:[C0]" is a pointer to a wow64 function that will convert 32bit system calls to 64 bits system calls.
    Thanks for pointing that out.

    Quote Originally Posted by ~FALLEN~ View Post
    ^this /too short
    LOL FALLEN, stop acting like you actually knew that. Your explanation was completely wrong.
    Last edited by CyanideC00kies; 12-28-2012 at 11:07 PM.

  10. #9
    ~FALLEN~'s Avatar
    Join Date
    May 2009
    Gender
    male
    Location
    devenv.exe
    Posts
    529
    Reputation
    23
    Thanks
    326
    My Mood
    Inspired
    Quote Originally Posted by CyanideC00kies View Post
    Thanks for pointing that out.


    LOL FALLEN, stop acting like you actually knew that. Your explanation was completely wrong.
    No it wasn't, 0xC0 is reserved for wow32 if you were to look into the thread information block, process environment block, heap, etc, you would know that.
    Better way to do this:

    make a class filled with pointers to typedefed nt functions. ex
    get module from peb -> search module exports from nt header -> fill class with exports.
    It's stealthy and it's a faster, and much more reliable option than this. If you're talking about syscalls then there is much better alternatives than this...
    come at me?

  11. #10
    ☬Ξη†τσρîζ Ζσ♍βîε δτσηε☬
    Former Staff
    Premium Member
    Lehsyrus's Avatar
    Join Date
    Aug 2009
    Gender
    male
    Location
    Jersey
    Posts
    10,899
    Reputation
    1281
    Thanks
    3,064
    Stop bickering and work together. Instead of acting like douches, you should help each other.

  12. #11
    HOOSIER's Avatar
    Join Date
    Aug 2012
    Gender
    male
    Location
    CyberSpace
    Posts
    962
    Reputation
    33
    Thanks
    2,315
    My Mood
    Cheerful
    im kinda enjoying it it seems to be "there way of working it out" the way they know how the old fashioned pissing contest and dang i sure do enjoy the read!!!
    Last edited by HOOSIER; 12-29-2012 at 02:31 AM.

  13. #12
    ~FALLEN~'s Avatar
    Join Date
    May 2009
    Gender
    male
    Location
    devenv.exe
    Posts
    529
    Reputation
    23
    Thanks
    326
    My Mood
    Inspired
    Quote Originally Posted by HOOSIER View Post
    im kinda enjoying it it seems to be "there way of working it out" the way they know how the old fashioned pissing contest and dang i sure do enjoy the read!!!
    lol yeah, that's actually how most coders get to know each other believe it or not. Someone says something, someone else gives input, person a cant take criticism and yells at person b, person b goes off like yo i gotz a bigger e-penor than youz. Then eventually they contact outside of the place of the argument and get to know one another. That's how i met raiders LOL

  14. #13
    akinator's Avatar
    Join Date
    Jul 2012
    Gender
    male
    Posts
    235
    Reputation
    14
    Thanks
    926
    Quote Originally Posted by ~FALLEN~ View Post
    No it wasn't, 0xC0 is reserved for wow32 if you were to look into the thread information block, process environment block, heap, etc, you would know that.
    Better way to do this:

    make a class filled with pointers to typedefed nt functions. ex
    get module from peb -> search module exports from nt header -> fill class with exports.
    It's stealthy and it's a faster, and much more reliable option than this. If you're talking about syscalls then there is much better alternatives than this...
    come at me?
    this way would work only if the exports are getting patched.
    if they use a normal hook this would be pointless.

  15. #14
    ~FALLEN~'s Avatar
    Join Date
    May 2009
    Gender
    male
    Location
    devenv.exe
    Posts
    529
    Reputation
    23
    Thanks
    326
    My Mood
    Inspired
    Quote Originally Posted by akinator View Post


    this way would work only if the exports are getting patched.
    if they use a normal hook this would be pointless.
    No you're wrong, you're not understanding the point of the post. Let me explain, assuming this is a syscall wrapper ( which is what it looks like ) a much better alternative would be to fill out a list of syscall numbers and get the os version out of the PEB check the service pack, etc & then use the syscalls based off that. If it wasn't such, he could get module from peb, search exports then wrap them. But to be completely honest it would be more viable to use a driver and just unhook their hooks as anticheat drivers start alongside the anticheat which starts alongside the game. ( If this is the route you want to go that is, like I said there is really no true need for this )
    Last edited by ~FALLEN~; 12-30-2012 at 09:44 AM.

  16. #15
    oyasuna.dev's Avatar
    Join Date
    Jun 2011
    Gender
    male
    Location
    United States.
    Posts
    32
    Reputation
    10
    Thanks
    374
    Not trying to be mean, but if you guys don't understand what this is doing then you should take a break from MPGH for a bit, and learn some assembly before looking into this hook. Or ask CyanideC00kies, to kindly mark up the source.

Page 1 of 2 12 LastLast

Similar Threads

  1. Steps for Hooking
    By aanthonyz in forum DirectX/D3D Development
    Replies: 7
    Last Post: 03-31-2011, 09:16 PM
  2. [HELP] How to inject to hook api using VB
    By BLUE01299 in forum Visual Basic Programming
    Replies: 2
    Last Post: 11-07-2010, 01:29 AM
  3. crossfire wallhack source for hook
    By GangsterCode in forum CrossFire Hack Coding / Programming / Source Code
    Replies: 9
    Last Post: 10-04-2010, 07:47 AM
  4. is game ready for hook method
    By hhhjr1 in forum Combat Arms Hack Coding / Programming / Source Code
    Replies: 39
    Last Post: 08-30-2010, 02:50 PM
  5. Request: Working workaround for IP ban in Vent
    By D2max in forum General Game Hacking
    Replies: 1
    Last Post: 07-10-2009, 04:42 AM