Opções de Detours Combat Arms

[Cheetara]

Opções de Detours Combat Arms

Com o tamanho do detour "const int len" = 10 é para funcionar em todos os Windows XP, Windows 7 e Windows 8.

void *DetourJMP(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\xE9';
	*(DWORD*)(&src[1]) = (DWORD)(dst - src) - 5;
	for (int i = 5; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourJMP((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourNOPJMP(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\x90';
	src[1] = '\xE9';
	*(DWORD*)(&src[2]) = (DWORD)(dst - src) - 6;
	for (int i = 6; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourNOPJMP((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourPUSHRET(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\x68';
	*(DWORD*)(&src[1]) = (DWORD)(dst);
	src[5] = '\xC3';
	for (int i = 6; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourPUSHRET((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourNOPNOPJMP(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\x90';
	src[1] = '\x90';
	src[2] = '\xE9';
	*(DWORD*)(&src[3]) = (DWORD)(dst - src) - 7;
	for (int i = 7; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourNOPNOPJMP((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourPUSHPOPJMP(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\x50';
	src[1] = '\x58';
	src[2] = '\xE9';
	*(DWORD*)(&src[3]) = (DWORD)(dst - src) - 7;
	for (int i = 7; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourPUSHPOPJMP((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourSTCJB(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\xF9';
	src[1] = '\x0F';
	src[2] = '\x82';
	*(DWORD*)(&src[3]) = (DWORD)(dst - src) - 7;
	for (int i = 7; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourSTCJB((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourCLCJNB(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\xF8';
	src[1] = '\x0F';
	src[2] = '\x83';
	*(DWORD*)(&src[3]) = (DWORD)(dst - src) - 7;
	for (int i = 7; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourCLCJNB((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourMOVJMP(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\xB8';
	*(DWORD*)(&src[1]) = (DWORD)(dst);
	src[5] = '\xFF';
	src[6] = '\xE0';
	for (int i = 7; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourMOVJMP((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

void *DetourXORTESTJE(BYTE *src, const BYTE *dst, const int len)
{
	BYTE *jmp = (BYTE*)malloc(len + 5);
	DWORD dwBack;
	VirtualProtect(src, len, PAGE_READWRITE, &dwBack);
	memcpy(jmp, src, len);
	jmp += len;
	jmp[0] = '\xE9';
	*(DWORD*)(jmp + 1) = (DWORD)(src + len - jmp) - 5;
	src[0] = '\x33';
	src[1] = '\xC0';
	src[2] = '\x85';
	src[3] = '\xC0';
	src[4] = '\x0F';
	src[5] = '\x84';
	*(DWORD*)(&src[6]) = (DWORD)(dst - src) - 10;
	for (int i = 10; i < len; i++) src[i] = 0x90;
	VirtualProtect(src, len, dwBack, &dwBack);
	return (jmp - len);
}

oPresent = (tPresent)DetourXORTESTJE((PBYTE) dwVTablePresent, (PBYTE) &Present, 10);

Créditos:
Azorbix / Gordon / Patrick / WE11ington[/QUOTE]

[Coder.Hu3]

Talvez amanha já esteja detect Essas Detours

so mais a minha detours(CDetours) com umas 40 linhas .

[Cheetara]

Talvez amanha já esteja detect Essas Detours

so mais a minha detours(CDetours) com umas 40 linhas .

Pode até ser, porem com essas detours ae se souber da para criar umas umas 4 ou 5 opções a mais!
só repostei !

[New - Hacker]

Interessante, mas é só uma versão simplificada da cDetours(que eu não sei quem criou). Pode ver que tudo isso tem em bases com a do MMBOB (tem muito outros tipos de detours lá). A Detours PUSHRET tem na WhitBase v2 por exemplo.
Mas como vc disse, da pra fazer pequenas alterações nos OPCodes e deixar indetectável.

Poderia explicar por que com len = 10, a detours funciona em todos os SO @Cheetara ?

[Cheetara]

Poderia explicar por que com len = 10, a detours funciona em todos os SO @Cheetara ?

Não, não poderia!

[_ReturnsBR_]

ñ vi nada de diferente nessas detours "Cheetara" Good Job

[pDevice]

ñ vi nada de diferente nessas detours "Cheetara" Good Job

Considere-se com problemas

[Fellas1704]

AHHAHAHAHHAHAHHAHAHAHAHAH

[Txego]

AHHAHAHAHHAHAHHAHAHAHAHAH

Bem down ...

[rodrigo19091992]

legal fera e as ppekas kkkkkkkkkkkkk belo tópico xD

[arun823]

MS Detour 3.0
Problem solved

[luizimloko]

MS Detour 3.0
Problem solved

the remaining 5 cents is for you buy a candy in market.

[iTz.Cheater]

the remaining 5 cents is for you buy a candy in market.

LOL né que é mesmo mais tem um free..

[rodrigo19091992]

the remaining 5 cents is for you buy a candy in market.

Que Treta kkkkkkkkkkkkk

[arun823]

the remaining 5 cents is for you buy a candy in market.

Stop being poor.

Problem Solved