Results 1 to 6 of 6
  1. #1
    Kenshin13's Avatar
    Join Date
    May 2011
    Gender
    male
    Location
    Cloud 9
    Posts
    3,473
    Reputation
    564
    Thanks
    5,882
    My Mood
    Psychedelic

    Hooking mid-function to change value?

    Hey, I had a DLL I used to inject that I don't have the source for. I wanted to change part of it do I located the desired part and tried to hook it.

    Code:
    #include <windows.h>
    #include <iostream>
    
    DWORD dwJmpBack = ((DWORD)GetModuleHandleA("Test.dll")+0x424E2), cmdOld_ = 0;
    
    typedef struct
    {
    	int ServerTime; //0x0000 
    	int CurrentButton; //0x0004 
    	int ViewAngles[3]; //0x0008
    	char _0x0014[24];
    }usercmd_t;//Size=0x002C
    
    typedef struct
    {
    	usercmd_t usercmds[128];
    	int currentCmdNum; // 0x16E8
    
    	usercmd_t *GetUserCmd(int cmdNum)
    	{
    		int id = cmdNum & 0x7F;
    		return &usercmds[id];
    	}
    }input_t;
    
    __declspec(naked) void MyHook()
    {
    	__asm
    	{
    		PUSHAD;
    		PUSHFD;
    	}
            input_t * Input_T = ( input_t* )0x010638A4;
    	usercmd_t* cmdOld = Input_T->GetUserCmd( Input_T->currentCmdNum - 1 );
    	usercmd_t* cmd = Input_T->GetUserCmd( Input_T->currentCmdNum );
    	cmdOld->ServerTime = cmd->ServerTime + 1;
    	cmdOld_ = Input_T->currentCmdNum - 1;
    	__asm
    	{
    		POPAD;
    		POPFD;
    		mov ecx, cmdOld_;
    		push ecx;
    		jmp [dwJmpBack];
    	}
    }
    
    void MakeJMP(BYTE *pAddress, DWORD dwJumpTo, DWORD dwLen)
    {
    	DWORD dwOldProtect, dwBkup, dwRelAddr;
    	VirtualProtect(pAddress, dwLen, PAGE_EXECUTE_READWRITE, &dwOldProtect);
    	dwRelAddr = (DWORD) (dwJumpTo - (DWORD) pAddress) - 5;
    	*pAddress = 0xE9;
    	*((DWORD *)(pAddress + 0x1)) = dwRelAddr;
    	for(DWORD x = 0x5; x < dwLen; x++) *(pAddress + x) = 0x90;
    	VirtualProtect(pAddress, dwLen, dwOldProtect, &dwBkup);
    	return;
    }
    
    BOOL APIENTRY DllMain(HANDLE hDllHandle, DWORD dwReason, LPVOID lpreserved)
    {
    	if(dwReason==DLL_PROCESS_ATTACH)
    	{
    		MakeJMP((BYTE*)((DWORD)GetModuleHandleA("Test__.dll") + 0x424DB), (DWORD)MyHook, 0x6);
    	}
    	return TRUE;
    }
    What I overwrote was just:
    Code:
    MOV ECX,[EAX+1600h] //Value of the current cmd
    PUSH ECX
    But it crashes with a violation read of 0x200..... I haven't been able to debug why sucessfully yet Any help? Seems it's not returning correctly after...

  2. #2
    rawr im a tiger's Avatar
    Join Date
    Feb 2012
    Gender
    male
    Location
    On the edge of Sanity
    Posts
    238
    Reputation
    40
    Thanks
    1,017
    My Mood
    Angelic
    @Kenshin13, I'm unsure about this since ymmv by compiler, but try this:

    Code:
    mov ecx, [cmdOld_]
    or

    Code:
    lea ecx, cmdOld_
    I'm guessing you're hooking Barata's Tekno Multihack to edit the previous CMD and therefore make it not shake other's screens?
    Last edited by rawr im a tiger; 01-31-2013 at 02:45 AM.

  3. #3
    Kenshin13's Avatar
    Join Date
    May 2011
    Gender
    male
    Location
    Cloud 9
    Posts
    3,473
    Reputation
    564
    Thanks
    5,882
    My Mood
    Psychedelic
    Quote Originally Posted by rawr im a tiger View Post
    @Kenshin13, I'm unsure about this since ymmv by compiler, but try this:

    Code:
    mov ecx, [cmdOld_]
    or

    Code:
    lea ecx, cmdOld_
    I'm guessing you're hooking Barata's Tekno Multihack to edit the previous CMD and therefore make it not shake other's screens?
    Exactly so and I'm also trying to throw in silent aim there., I tried the "mov ecx, [cmdOld_]" before I posted this already but I'll try lea (Still seems like a fancy ass MOV to me but usually I just see it with pointers)

  4. #4
    Kenshin13's Avatar
    Join Date
    May 2011
    Gender
    male
    Location
    Cloud 9
    Posts
    3,473
    Reputation
    564
    Thanks
    5,882
    My Mood
    Psychedelic
    Ok, I tried both, still crashes....Anyone?

  5. #5
    rawr im a tiger's Avatar
    Join Date
    Feb 2012
    Gender
    male
    Location
    On the edge of Sanity
    Posts
    238
    Reputation
    40
    Thanks
    1,017
    My Mood
    Angelic
    @Kenshin13, You pushad then pushfd, then popad and popfd. That's not how the stack works. pushad, pushfd, popfd, popad.

  6. #6
    Kenshin13's Avatar
    Join Date
    May 2011
    Gender
    male
    Location
    Cloud 9
    Posts
    3,473
    Reputation
    564
    Thanks
    5,882
    My Mood
    Psychedelic
    Quote Originally Posted by rawr im a tiger View Post
    @Kenshin13, You pushad then pushfd, then popad and popfd. That's not how the stack works. pushad, pushfd, popfd, popad.
    Yea, @-InSaNe- corrected me on that. I know that's the general order, somehow I forgot. Anyways, I think I'm hooking the wrong address, I'll look into it more and report back.

Similar Threads

  1. [C/C++ Tutorial] Mid Function Hook
    By MarkHC in forum Programming Tutorials
    Replies: 5
    Last Post: 08-09-2015, 04:06 PM
  2. [Help Request] Change value for headshot/kills for weapon
    By valkaliban2 in forum Call of Duty Modern Warfare 3 Help
    Replies: 3
    Last Post: 04-09-2012, 10:29 PM
  3. [Source Code] DIP / Present / SetTransform Mid Functions
    By DirecTX_ in forum WarRock Hack Source Code
    Replies: 2
    Last Post: 11-23-2011, 03:07 PM
  4. [Help] Mid function hook
    By giniyat202 in forum CrossFire Hack Coding / Programming / Source Code
    Replies: 17
    Last Post: 08-07-2011, 05:33 AM
  5. How do Hack Addie's And Change Value?
    By monkkiller in forum Visual Basic Programming
    Replies: 3
    Last Post: 12-19-2009, 02:43 PM