Detour In Visual Basic !!
Hey guys, just been converting over the Detours from acids base to vb.net from C++
im still converting the whole base over, so bare with me.. here is the Detour.vb
[php]
Public Class GlobalMembersDetour
': The following #define macro was replaced in-line:
'ORIGINAL LINE: #define DetourRandTypeLow DETOUR_TYPE_OBS_ADD
#Const DetourRandTypeLow = True
': The following #define macro was replaced in-line:
'ORIGINAL LINE: #define DetourRandTypeHigh DETOUR_TYPE_OBS_ADDNOT
#Const DetourRandTypeHigh = True
Public Shared Function DetourCreate(ByVal lpFuncOrig As IntPtr, ByVal lpFuncDetour As IntPtr, ByVal patchType As Integer, Optional ByVal detourLen As Integer = DefineConstants.DETOUR_LEN_AUTO) As IntPtr
Dim lpMallocPtr As IntPtr = Nothing
Dim dwProt As UInteger = 0
Dim pbMallocPtr() As Byte = 0
Dim pbFuncOrig As Byte = CByte(lpFuncOrig)
Dim pbFuncDetour As Byte = CByte(lpFuncDetour)
Dim pbPatchBuf() As Byte = 0
Dim minDetLen As Integer = 0
Dim detLen As Integer = 0
' Get detour length
minDetLen = GlobalMembersDetour.GetDetourLen(patchType)
If minDetLen = 0 Then
Return Nothing
End If
If detourLen <> DefineConstants.DETOUR_LEN_AUTO Then
detLen = detourLen
Else
detLen = GlobalMembersDetour.GetDetourLenAuto(pbFuncOrig, minDetLen)
If detLen < minDetLen Then
Return Nothing
End If
End If
' Alloc mem for the overwritten bytes
lpMallocPtr = CType(malloc(detLen+DefineConstants.JMP32_SZ+Defin eConstants.SIG_SZ), IntPtr)
': The memory management function 'malloc' has no equivalent in VB:
If lpMallocPtr Is Nothing Then
Return Nothing
End If
pbMallocPtr = CByte(lpMallocPtr)
' Enable writing to original
VirtualProtect(lpFuncOrig, detLen, PAGE_READWRITE, dwProt)
' Write overwritten bytes to the malloc
': The memory management function 'memcpy' has no equivalent in VB:
memcpy(lpMallocPtr, lpFuncOrig, detLen)
pbMallocPtr += detLen
pbMallocPtr(0) = &HE9
*CUInt(pbMallocPtr+1) = CUInt((pbFuncOrig+detLen)-pbMallocPtr)-DefineConstants.JMP32_SZ
pbMallocPtr += DefineConstants.JMP32_SZ
pbMallocPtr(0) = DefineConstants.SIG_OP_0
pbMallocPtr(1) = DefineConstants.SIG_OP_1
pbMallocPtr(2) = DefineConstants.SIG_OP_2
' Create a buffer to prepare the detour bytes
pbPatchBuf = New Byte(detLen - 1) {}
': The memory management function 'memset' has no equivalent in VB:
memset(pbPatchBuf, &H90, detLen)
Select Case patchType
Case detour_types_s.DETOUR_TYPE_JMP
pbPatchBuf(0) = &HE9
*(UInteger*) And pbPatchBuf(1) = CUInt(pbFuncDetour - pbFuncOrig)- 5
Case detour_types_s.DETOUR_TYPE_PUSH_RET
pbPatchBuf(0) = &H68
*(UInteger*) And pbPatchBuf(1) = CUInt(pbFuncDetour)
pbPatchBuf(5) = &HC3
Case detour_types_s.DETOUR_TYPE_NOP_JMP
pbPatchBuf(0) = &H90
pbPatchBuf(1) = &HE9
*(UInteger*) And pbPatchBuf(2) = CUInt(pbFuncDetour - pbFuncOrig)- 6
Case detour_types_s.DETOUR_TYPE_NOP_NOP_JMP
pbPatchBuf(0) = &H90
pbPatchBuf(1) = &H90
pbPatchBuf(2) = &HE9
*(UInteger*) And pbPatchBuf(3) = CUInt(pbFuncDetour - pbFuncOrig)- 7
Case detour_types_s.DETOUR_TYPE_STC_JC
pbPatchBuf(0) = &HF9
pbPatchBuf(1) = &HF
pbPatchBuf(2) = &H82
*(UInteger*) And pbPatchBuf(3) = CUInt(pbFuncDetour - pbFuncOrig)- 7
Case detour_types_s.DETOUR_TYPE_CLC_JNC
pbPatchBuf(0) = &HF8
pbPatchBuf(1) = &HF
pbPatchBuf(2) = &H83
*(UInteger*) And pbPatchBuf(3) = CUInt(pbFuncDetour - pbFuncOrig)- 7
Case Else
Return Nothing
End Select
' Write the detour
For i As Integer = 0 To detLen - 1
pbFuncOrig(i) = pbPatchBuf(i)
Next i
pbPatchBuf = Nothing
' Reset original mem flags
VirtualProtect(lpFuncOrig, detLen, dwProt, GlobalMembersDetour.dwOldProt)
Return lpMallocPtr
End Function
' Thin wrapper for APIs
Public Shared Function DetourCreate(ByVal lpModuleName As String, ByVal lpProcName As String, ByVal lpFuncDetour As IntPtr, ByVal patchType As Integer, Optional ByVal detourLen As Integer = DefineConstants.DETOUR_LEN_AUTO) As IntPtr
Dim lpFuncOrig As IntPtr = Nothing
lpFuncOrig = GetProcAddress(GetModuleHandleA(lpModuleName), lpProcName)
If lpFuncOrig Is Nothing Then
Return Nothing
End If
Return GlobalMembersDetour.DetourCreate(lpFuncOrig, lpFuncDetour, patchType, detourLen)
End Function
Public Shared Function DetourRemove(ByVal lpDetourCreatePtr As IntPtr) As Integer
Dim pbMallocPtr() As Byte = 0
Dim dwFuncOrig As UInteger = 0
Dim dwProt As UInteger = 0
Dim i As Integer = 0
pbMallocPtr = CByte(lpDetourCreatePtr)
If pbMallocPtr Is Nothing Then
Return 0
End If
' Find the orig jmp32 opcode sig
For i = 0 To DefineConstants.DETOUR_MAX_SRCH_OPLEN
If pbMallocPtr(i) = DefineConstants.SIG_OP_0 AndAlso pbMallocPtr(i + 1) = DefineConstants.SIG_OP_1 AndAlso pbMallocPtr(i + 2) = DefineConstants.SIG_OP_2 Then
Exit For
End If
If i = DefineConstants.DETOUR_MAX_SRCH_OPLEN Then
Return 0
End If
Next i
' Calculate the original address
pbMallocPtr += (i - DefineConstants.JMP32_SZ + 1) ' Inc to jmp
dwFuncOrig = *CUInt(pbMallocPtr) ' Get 32bit jmp
pbMallocPtr += DefineConstants.BIT32_SZ ' Inc to end of jmp
dwFuncOrig += CUInt(pbMallocPtr) ' Add this addr to 32bit jmp
dwFuncOrig -= (i - DefineConstants.JMP32_SZ) ' Dec by detour len to get to start of orig
' Write the overwritten bytes back to the original
VirtualProtect(CType(dwFuncOrig, IntPtr), (i - DefineConstants.JMP32_SZ), PAGE_READWRITE, dwProt)
': The memory management function 'memcpy' has no equivalent in VB:
memcpy(CType(dwFuncOrig, IntPtr), lpDetourCreatePtr, (i - DefineConstants.JMP32_SZ))
VirtualProtect(CType(dwFuncOrig, IntPtr), (i - DefineConstants.JMP32_SZ), dwProt, GlobalMembersDetour.dwOldProt)
' Memory cleanup
': The memory management function 'free' has no equivalent in VB:
free(lpDetourCreatePtr)
Return 1
End Function
#Const DETOUR_MAX_SRCH_OPLEN = True
#Const JMP32_SZ = True
#Const BIT32_SZ = True
' jmp32 sig
#Const SIG_SZ = True
#Const SIG_OP_0 = True
#Const SIG_OP_1 = True
#Const SIG_OP_2 = True
Friend Shared dwOldProt As UInteger
Public Shared Function GetDetourLen(ByVal patchType As Integer) As Integer
Select Case patchType
Case detour_types_s.DETOUR_TYPE_JMP
Return 5
Case detour_types_s.DETOUR_TYPE_PUSH_RET, detour_types_s.DETOUR_TYPE_NOP_JMP
Return 6
Case detour_types_s.DETOUR_TYPE_NOP_NOP_JMP, detour_types_s.DETOUR_TYPE_STC_JC, detour_types_s.DETOUR_TYPE_CLC_JNC
Return 7
Case Else
Return 0
End Select
End Function
Public Shared Function GetDetourLenAuto(ByRef pbFuncOrig As Byte, ByVal minDetLen As Integer) As Integer
Dim len As Integer = 0
': Pointer arithmetic is detected on this variable, so pointers on this variable are left unchanged.
Dim pbCurOp As Byte * = pbFuncOrig
Do While len < minDetLen
Dim i As Integer = oplen(pbCurOp)
If i = 0 OrElse i = -1 Then
Return 0
End If
If len > DefineConstants.DETOUR_MAX_SRCH_OPLEN Then
Return 0
End If
len += i
pbCurOp += i
Loop
Return len
End Function
End Class
'
' Name: DetourXS
' Description: DetourXS is a library for function detouring
' Version: 1.0
' Author: Sinner
' Website: www.gamedefeat.com & www.cheatersutopia.com
' Credits: z0mbie (ADE32), LanceVorgin's CDetour (some ideas)
'
'#pragma comment(lib, "detourxs")
#Const DETOUR_LEN_AUTO = True
Public Enum detour_types_s
DETOUR_TYPE_NOT_SET = -1
DETOUR_TYPE_OBS_RAND
DETOUR_TYPE_JMP
DETOUR_TYPE_PUSH_RET
DETOUR_TYPE_NOP_JMP
DETOUR_TYPE_NOP_NOP_JMP
DETOUR_TYPE_STC_JC
DETOUR_TYPE_CLC_JNC
DETOUR_TYPE_OBS_ADD
DETOUR_TYPE_OBS_XOR
DETOUR_TYPE_OBS_STACKADD
DETOUR_TYPE_OBS_ROR
DETOUR_TYPE_OBS_ADDNOT
End Enum
Partial Friend NotInheritable Class DefineConstants
Public Const DETOUR_LEN_AUTO As Integer = 0
Public Const C_ERROR As Long = &HFFFFFFFFL
Public Const C_ADDR1 As Integer = &H1
Public Const C_ADDR2 As Integer = &H2
Public Const C_ADDR4 As Integer = &H4
Public Const C_LOCK As Integer = &H8
Public Const C_67 As Integer = &H10
Public Const C_66 As Integer = &H20
Public Const C_REP As Integer = &H40
Public Const C_SEG As Integer = &H80
Public Const C_DATA1 As Integer = &H100
Public Const C_DATA2 As Integer = &H200
Public Const C_DATA4 As Integer = &H400
Public Const C_SIB As Integer = &H800
Public Const C_ADDR67 As Integer = &H1000
Public Const C_DATA66 As Integer = &H2000
Public Const C_MODRM As Integer = &H4000
Public Const C_BAD As Integer = &H8000
Public Const C_OPCODE2 As Integer = &H10000
Public Const C_REL As Integer = &H20000
Public Const C_STOP As Integer = &H40000
Public Const DETOUR_MAX_SRCH_OPLEN As Integer = 64
Public Const JMP32_SZ As Integer = 5
Public Const BIT32_SZ As Integer = 4
Public Const SIG_SZ As Integer = 3
Public Const SIG_OP_0 As Integer = &HCC
Public Const SIG_OP_1 As Integer = &H90
Public Const SIG_OP_2 As Integer = &HC3
End Class
[/php]
what ya think ?
im still converting the whole base over, so bare with me.. here is the Detour.vb
[php]
Public Class GlobalMembersDetour
': The following #define macro was replaced in-line:
'ORIGINAL LINE: #define DetourRandTypeLow DETOUR_TYPE_OBS_ADD
#Const DetourRandTypeLow = True
': The following #define macro was replaced in-line:
'ORIGINAL LINE: #define DetourRandTypeHigh DETOUR_TYPE_OBS_ADDNOT
#Const DetourRandTypeHigh = True
Public Shared Function DetourCreate(ByVal lpFuncOrig As IntPtr, ByVal lpFuncDetour As IntPtr, ByVal patchType As Integer, Optional ByVal detourLen As Integer = DefineConstants.DETOUR_LEN_AUTO) As IntPtr
Dim lpMallocPtr As IntPtr = Nothing
Dim dwProt As UInteger = 0
Dim pbMallocPtr() As Byte = 0
Dim pbFuncOrig As Byte = CByte(lpFuncOrig)
Dim pbFuncDetour As Byte = CByte(lpFuncDetour)
Dim pbPatchBuf() As Byte = 0
Dim minDetLen As Integer = 0
Dim detLen As Integer = 0
' Get detour length
minDetLen = GlobalMembersDetour.GetDetourLen(patchType)
If minDetLen = 0 Then
Return Nothing
End If
If detourLen <> DefineConstants.DETOUR_LEN_AUTO Then
detLen = detourLen
Else
detLen = GlobalMembersDetour.GetDetourLenAuto(pbFuncOrig, minDetLen)
If detLen < minDetLen Then
Return Nothing
End If
End If
' Alloc mem for the overwritten bytes
lpMallocPtr = CType(malloc(detLen+DefineConstants.JMP32_SZ+Defin eConstants.SIG_SZ), IntPtr)
': The memory management function 'malloc' has no equivalent in VB:
If lpMallocPtr Is Nothing Then
Return Nothing
End If
pbMallocPtr = CByte(lpMallocPtr)
' Enable writing to original
VirtualProtect(lpFuncOrig, detLen, PAGE_READWRITE, dwProt)
' Write overwritten bytes to the malloc
': The memory management function 'memcpy' has no equivalent in VB:
memcpy(lpMallocPtr, lpFuncOrig, detLen)
pbMallocPtr += detLen
pbMallocPtr(0) = &HE9
*CUInt(pbMallocPtr+1) = CUInt((pbFuncOrig+detLen)-pbMallocPtr)-DefineConstants.JMP32_SZ
pbMallocPtr += DefineConstants.JMP32_SZ
pbMallocPtr(0) = DefineConstants.SIG_OP_0
pbMallocPtr(1) = DefineConstants.SIG_OP_1
pbMallocPtr(2) = DefineConstants.SIG_OP_2
' Create a buffer to prepare the detour bytes
pbPatchBuf = New Byte(detLen - 1) {}
': The memory management function 'memset' has no equivalent in VB:
memset(pbPatchBuf, &H90, detLen)
Select Case patchType
Case detour_types_s.DETOUR_TYPE_JMP
pbPatchBuf(0) = &HE9
*(UInteger*) And pbPatchBuf(1) = CUInt(pbFuncDetour - pbFuncOrig)- 5
Case detour_types_s.DETOUR_TYPE_PUSH_RET
pbPatchBuf(0) = &H68
*(UInteger*) And pbPatchBuf(1) = CUInt(pbFuncDetour)
pbPatchBuf(5) = &HC3
Case detour_types_s.DETOUR_TYPE_NOP_JMP
pbPatchBuf(0) = &H90
pbPatchBuf(1) = &HE9
*(UInteger*) And pbPatchBuf(2) = CUInt(pbFuncDetour - pbFuncOrig)- 6
Case detour_types_s.DETOUR_TYPE_NOP_NOP_JMP
pbPatchBuf(0) = &H90
pbPatchBuf(1) = &H90
pbPatchBuf(2) = &HE9
*(UInteger*) And pbPatchBuf(3) = CUInt(pbFuncDetour - pbFuncOrig)- 7
Case detour_types_s.DETOUR_TYPE_STC_JC
pbPatchBuf(0) = &HF9
pbPatchBuf(1) = &HF
pbPatchBuf(2) = &H82
*(UInteger*) And pbPatchBuf(3) = CUInt(pbFuncDetour - pbFuncOrig)- 7
Case detour_types_s.DETOUR_TYPE_CLC_JNC
pbPatchBuf(0) = &HF8
pbPatchBuf(1) = &HF
pbPatchBuf(2) = &H83
*(UInteger*) And pbPatchBuf(3) = CUInt(pbFuncDetour - pbFuncOrig)- 7
Case Else
Return Nothing
End Select
' Write the detour
For i As Integer = 0 To detLen - 1
pbFuncOrig(i) = pbPatchBuf(i)
Next i
pbPatchBuf = Nothing
' Reset original mem flags
VirtualProtect(lpFuncOrig, detLen, dwProt, GlobalMembersDetour.dwOldProt)
Return lpMallocPtr
End Function
' Thin wrapper for APIs
Public Shared Function DetourCreate(ByVal lpModuleName As String, ByVal lpProcName As String, ByVal lpFuncDetour As IntPtr, ByVal patchType As Integer, Optional ByVal detourLen As Integer = DefineConstants.DETOUR_LEN_AUTO) As IntPtr
Dim lpFuncOrig As IntPtr = Nothing
lpFuncOrig = GetProcAddress(GetModuleHandleA(lpModuleName), lpProcName)
If lpFuncOrig Is Nothing Then
Return Nothing
End If
Return GlobalMembersDetour.DetourCreate(lpFuncOrig, lpFuncDetour, patchType, detourLen)
End Function
Public Shared Function DetourRemove(ByVal lpDetourCreatePtr As IntPtr) As Integer
Dim pbMallocPtr() As Byte = 0
Dim dwFuncOrig As UInteger = 0
Dim dwProt As UInteger = 0
Dim i As Integer = 0
pbMallocPtr = CByte(lpDetourCreatePtr)
If pbMallocPtr Is Nothing Then
Return 0
End If
' Find the orig jmp32 opcode sig
For i = 0 To DefineConstants.DETOUR_MAX_SRCH_OPLEN
If pbMallocPtr(i) = DefineConstants.SIG_OP_0 AndAlso pbMallocPtr(i + 1) = DefineConstants.SIG_OP_1 AndAlso pbMallocPtr(i + 2) = DefineConstants.SIG_OP_2 Then
Exit For
End If
If i = DefineConstants.DETOUR_MAX_SRCH_OPLEN Then
Return 0
End If
Next i
' Calculate the original address
pbMallocPtr += (i - DefineConstants.JMP32_SZ + 1) ' Inc to jmp
dwFuncOrig = *CUInt(pbMallocPtr) ' Get 32bit jmp
pbMallocPtr += DefineConstants.BIT32_SZ ' Inc to end of jmp
dwFuncOrig += CUInt(pbMallocPtr) ' Add this addr to 32bit jmp
dwFuncOrig -= (i - DefineConstants.JMP32_SZ) ' Dec by detour len to get to start of orig
' Write the overwritten bytes back to the original
VirtualProtect(CType(dwFuncOrig, IntPtr), (i - DefineConstants.JMP32_SZ), PAGE_READWRITE, dwProt)
': The memory management function 'memcpy' has no equivalent in VB:
memcpy(CType(dwFuncOrig, IntPtr), lpDetourCreatePtr, (i - DefineConstants.JMP32_SZ))
VirtualProtect(CType(dwFuncOrig, IntPtr), (i - DefineConstants.JMP32_SZ), dwProt, GlobalMembersDetour.dwOldProt)
' Memory cleanup
': The memory management function 'free' has no equivalent in VB:
free(lpDetourCreatePtr)
Return 1
End Function
#Const DETOUR_MAX_SRCH_OPLEN = True
#Const JMP32_SZ = True
#Const BIT32_SZ = True
' jmp32 sig
#Const SIG_SZ = True
#Const SIG_OP_0 = True
#Const SIG_OP_1 = True
#Const SIG_OP_2 = True
Friend Shared dwOldProt As UInteger
Public Shared Function GetDetourLen(ByVal patchType As Integer) As Integer
Select Case patchType
Case detour_types_s.DETOUR_TYPE_JMP
Return 5
Case detour_types_s.DETOUR_TYPE_PUSH_RET, detour_types_s.DETOUR_TYPE_NOP_JMP
Return 6
Case detour_types_s.DETOUR_TYPE_NOP_NOP_JMP, detour_types_s.DETOUR_TYPE_STC_JC, detour_types_s.DETOUR_TYPE_CLC_JNC
Return 7
Case Else
Return 0
End Select
End Function
Public Shared Function GetDetourLenAuto(ByRef pbFuncOrig As Byte, ByVal minDetLen As Integer) As Integer
Dim len As Integer = 0
': Pointer arithmetic is detected on this variable, so pointers on this variable are left unchanged.
Dim pbCurOp As Byte * = pbFuncOrig
Do While len < minDetLen
Dim i As Integer = oplen(pbCurOp)
If i = 0 OrElse i = -1 Then
Return 0
End If
If len > DefineConstants.DETOUR_MAX_SRCH_OPLEN Then
Return 0
End If
len += i
pbCurOp += i
Loop
Return len
End Function
End Class
'
' Name: DetourXS
' Description: DetourXS is a library for function detouring
' Version: 1.0
' Author: Sinner
' Website: www.gamedefeat.com & www.cheatersutopia.com
' Credits: z0mbie (ADE32), LanceVorgin's CDetour (some ideas)
'
'#pragma comment(lib, "detourxs")
#Const DETOUR_LEN_AUTO = True
Public Enum detour_types_s
DETOUR_TYPE_NOT_SET = -1
DETOUR_TYPE_OBS_RAND
DETOUR_TYPE_JMP
DETOUR_TYPE_PUSH_RET
DETOUR_TYPE_NOP_JMP
DETOUR_TYPE_NOP_NOP_JMP
DETOUR_TYPE_STC_JC
DETOUR_TYPE_CLC_JNC
DETOUR_TYPE_OBS_ADD
DETOUR_TYPE_OBS_XOR
DETOUR_TYPE_OBS_STACKADD
DETOUR_TYPE_OBS_ROR
DETOUR_TYPE_OBS_ADDNOT
End Enum
Partial Friend NotInheritable Class DefineConstants
Public Const DETOUR_LEN_AUTO As Integer = 0
Public Const C_ERROR As Long = &HFFFFFFFFL
Public Const C_ADDR1 As Integer = &H1
Public Const C_ADDR2 As Integer = &H2
Public Const C_ADDR4 As Integer = &H4
Public Const C_LOCK As Integer = &H8
Public Const C_67 As Integer = &H10
Public Const C_66 As Integer = &H20
Public Const C_REP As Integer = &H40
Public Const C_SEG As Integer = &H80
Public Const C_DATA1 As Integer = &H100
Public Const C_DATA2 As Integer = &H200
Public Const C_DATA4 As Integer = &H400
Public Const C_SIB As Integer = &H800
Public Const C_ADDR67 As Integer = &H1000
Public Const C_DATA66 As Integer = &H2000
Public Const C_MODRM As Integer = &H4000
Public Const C_BAD As Integer = &H8000
Public Const C_OPCODE2 As Integer = &H10000
Public Const C_REL As Integer = &H20000
Public Const C_STOP As Integer = &H40000
Public Const DETOUR_MAX_SRCH_OPLEN As Integer = 64
Public Const JMP32_SZ As Integer = 5
Public Const BIT32_SZ As Integer = 4
Public Const SIG_SZ As Integer = 3
Public Const SIG_OP_0 As Integer = &HCC
Public Const SIG_OP_1 As Integer = &H90
Public Const SIG_OP_2 As Integer = &HC3
End Class
[/php]
what ya think ?
Originally Posted by HL-SDK
