Cod4 Multihack v1.0

[Jorndel]

Where would I even find assembly code like this on the internet? It isn't very common to code in...

Well, you can easy google such stuff but

(ASM Code)
https://www.mpgh.net/forum/31-c-c-pro...y-hacking.html

All you need now is the Main Function and you're ready to go I suppose


Note: I'm not saying you did. Just telling that it's possible.

[Zeraxis]

Well, you can easy google such stuff but

(ASM Code)
https://www.mpgh.net/forum/31-c-c-pro...y-hacking.html

All you need now is the Main Function and you're ready to go I suppose


Note: I'm not saying you did. Just telling that it's possible.

Well, that's not all you need to do. First you have to call VirtualProtect and then mov the value in. In my code I made a function that did all this for me. Plus I only used pure assembly instead of all the macros MASM has like the proc declaration. Without it the function I made looks like this:

push ebp
mov ebp, esp

mov ebx, dword ptr [ebp+8]
mov edx, dword ptr [ebp+0Ch]
mov eax, dword ptr [ebp+10h]

push eax
push ebx
push edx
push offset oldProt
push 40h
push eax
push ebx
call VirtualProtect
pop edx
pop ebx
pop eax
		
xor ecx, ecx
patch:
    mov byte ptr [ebx+ecx], dl
    inc ecx
    cmp ecx, eax
    jne patch
		
push 0
push oldProt
push eax
push ebx
call VirtualProtect

mov esp, ebp
pop ebp
retn

Anyone that knows ASM can use that if they want as long as they give me credit
If anyone still doesn't believe me I could explain how the function works too.

[Demonz.]

Detected on PB servers.

WinXP 32bit.

[Jorndel]

Well, that's not all you need to do. First you have to call VirtualProtect and then mov the value in. In my code I made a function that did all this for me. Plus I only used pure assembly instead of all the macros MASM has like the proc declaration. Without it the function I made looks like this:

push ebp
mov ebp, esp

mov ebx, dword ptr [ebp+8]
mov edx, dword ptr [ebp+0Ch]
mov eax, dword ptr [ebp+10h]

push eax
push ebx
push edx
push offset oldProt
push 40h
push eax
push ebx
call VirtualProtect
pop edx
pop ebx
pop eax
		
xor ecx, ecx
patch:
    mov byte ptr [ebx+ecx], dl
    inc ecx
    cmp ecx, eax
    jne patch
		
push 0
push oldProt
push eax
push ebx
call VirtualProtect

mov esp, ebp
pop ebp
retn

Anyone that knows ASM can use that if they want as long as they give me credit
If anyone still doesn't believe me I could explain how the function works too.

Well, nice of you to share but, this is the internet. (People don't always like to give credit :S)
And yeah, I found something that seems easier for us "normal" coders
https://www.mpgh.net/forum/604-call-d...s-like-me.html


Thanks for the contribution tho

[Zeraxis]

Well, nice of you to share but, this is the internet. (People don't always like to give credit :S)
And yeah, I found something that seems easier for us "normal" coders
https://www.mpgh.net/forum/604-call-d...s-like-me.html


Thanks for the contribution tho

lol, yeah that definitely is a lot easier. I was just learning assembly and wanted to make something with it. It was kind of just a challenge for myself

---------- Post added at 02:35 PM ---------- Previous post was at 02:32 PM ----------

Detected on PB servers.

WinXP 32bit.

Thanks for letting me know

[R3Dx666†]

Where would I even find assembly code like this on the internet? It isn't very common to code in...

i am not saying the websites but if you google it, its all over and its basic writeproccessmemory try learning with e-books theres some on this website if you search as hard as that source you should find

[Zeraxis]

i am not saying the websites but if you google it, its all over and its basic writeproccessmemory try learning with e-books theres some on this website if you search as hard as that source you should find

Okay, I guess I'll explain how all of it works then even though I'm pretty sure your just trolling. My function takes 3 arguments which are:

mov ebx, dword ptr [ebp+8]
mov edx, dword ptr [ebp+0Ch]
mov eax, dword ptr [ebp+10h]

[ebp+8] is the first, which is the memory address
[ebp+0Ch] is the second, which is the opcode you want to write
[ebp+10h] is the third, which is the number of bytes what you want to write

next you push eax, ebx, and edx onto the stack to preserve them because they get changed during the call to the VirtualProtect. After the call you pop them back off the stack.

Next is the loop that patches the address you chose. I wrote mine with a loop so that if for example I wanted to nop out 6 bytes I could do it in one call. The loop first uses an xor ecx, ecx to set ecx to 0, which will act as our counter for the loop. Then it uses a mov to write the opcode into the address.

mov byte ptr [ebx+ecx], dl

ebx is the address that we passed in and ecx is the counter that uses inc to increase by one every time it goes through the loop. edx is the byte we wanted to write, but because this is a 1 byte patch we need to use the 8 bit part of edx which is dl.

Next we compare ecx and eax with cmp ecx, eax. eax is the number of bytes we passed in. So, it checks if we have written enough bytes to exit our loop. If not, it jumps back up to the label called patch. If it is it restores the old protection with another call to VirtualProtect and then exits the function.

There, are you happy now?

[xZomeEcx3]

Where is the injector??!!

[Zeraxis]

Where is the injector??!!

Jorndel posted a link to one.

[MaRvAWAKE]

It does work thanks

[Tacioto]

is this undetected then?

[Zeraxis]

is this undetected then?

Yep

[Vehrdyn]

Nice work

[n4chos]

im sorry! didnt want to

---------- Post added at 10:41 AM ---------- Previous post was at 10:14 AM ----------

i get kicked on pb servers..corrupted memory/codhook

[megadeath000]

i got a problem when i inject this dll using that injector, it hangs-up in the beginning of the game.