Hook Present Engine

Code:

Present:

004C40C0   6A FF                    PUSH -1
004C40C2   68 78DC6200              PUSH 62DC78
004C40C7   64:A1 00000000           MOV EAX,DWORD PTR FS:[0]
004C40CD   50                       PUSH EAX
004C40CE   51                       PUSH ECX
004C40CF   A1 40446A00              MOV EAX,DWORD PTR DS:[6A4440]
004C40D4   33C4                     XOR EAX,ESP
004C40D6   50                       PUSH EAX
004C40D7   8D4424 08                LEA EAX,DWORD PTR SS:[ESP+8]
004C40DB   64:A3 00000000           MOV DWORD PTR FS:[0],EAX
004C40E1   68 F82F6C00              PUSH 6C2FF8
004C40E6   8D4C24 08                LEA ECX,DWORD PTR SS:[ESP+8]
004C40EA   E8 E12BF5FF              CALL 416CD0
004C40EF   C74424 10 00000000       MOV DWORD PTR SS:[ESP+10],0
004C40F7   A1 702E6C00              MOV EAX,DWORD PTR DS:[6C2E70]
004C40FC   85C0                     TEST EAX,EAX
004C40FE   0F84 CB000000            JE 4C41CF
004C4104   F64424 18 04             TEST BYTE PTR SS:[ESP+18],4
004C4109   74 0A                    JE SHORT 4C4115
004C410B   E8 C0EAFFFF              CALL 4C2BD0
004C4110   E9 A6000000              JMP 4C41BB
004C4115   803D 1B536B00 00         CMP BYTE PTR DS:[6B531B],0
004C411C   8B00                     MOV EAX,DWORD PTR DS:[EAX]
004C411E   8B08                     MOV ECX,DWORD PTR DS:[EAX]
004C4120   6A 00                    PUSH 0
004C4122   0F84 87000000            JE 4C41AF
004C4128   803D 40556B00 00         CMP BYTE PTR DS:[6B5540],0
004C412F   74 7E                    JE SHORT 4C41AF
004C4131   8B15 D04D6B00            MOV EDX,DWORD PTR DS:[6B4DD0]
004C4137   52                       PUSH EDX
004C4138   68 C04D6B00              PUSH 6B4DC0
004C413D   68 C04D6B00              PUSH 6B4DC0
004C4142   50                       PUSH EAX
004C4143   8B41 44                  MOV EAX,DWORD PTR DS:[ECX+44]
004C4146   FFD0                     CALL EAX
004C4148   8B0D 702E6C00            MOV ECX,DWORD PTR DS:[6C2E70]
004C414E   8B01                     MOV EAX,DWORD PTR DS:[ECX]
004C4150   8B0D D04D6B00            MOV ECX,DWORD PTR DS:[6B4DD0]
004C4156   8B10                     MOV EDX,DWORD PTR DS:[EAX]
004C4158   8B52 44                  MOV EDX,DWORD PTR DS:[EDX+44]
004C415B   6A 00                    PUSH 0
004C415D   51                       PUSH ECX
004C415E   68 E84D6B00              PUSH 6B4DE8
004C4163   68 E84D6B00              PUSH 6B4DE8
004C4168   50                       PUSH EAX
004C4169   FFD2                     CALL EDX
004C416B   8B15 D04D6B00            MOV EDX,DWORD PTR DS:[6B4DD0]
004C4171   A1 702E6C00              MOV EAX,DWORD PTR DS:[6C2E70]
004C4176   8B00                     MOV EAX,DWORD PTR DS:[EAX]
004C4178   8B08                     MOV ECX,DWORD PTR DS:[EAX]
004C417A   6A 00                    PUSH 0
004C417C   52                       PUSH EDX
004C417D   68 FC4D6B00              PUSH 6B4DFC
004C4182   68 FC4D6B00              PUSH 6B4DFC
004C4187   50                       PUSH EAX
004C4188   8B41 44                  MOV EAX,DWORD PTR DS:[ECX+44]
004C418B   FFD0                     CALL EAX
004C418D   8B0D 702E6C00            MOV ECX,DWORD PTR DS:[6C2E70]
004C4193   8B01                     MOV EAX,DWORD PTR DS:[ECX]
004C4195   8B0D D04D6B00            MOV ECX,DWORD PTR DS:[6B4DD0]
004C419B   8B10                     MOV EDX,DWORD PTR DS:[EAX]
004C419D   8B52 44                  MOV EDX,DWORD PTR DS:[EDX+44]
004C41A0   6A 00                    PUSH 0
004C41A2   51                       PUSH ECX
004C41A3   68 D84D6B00              PUSH 6B4DD8
004C41A8   68 D84D6B00              PUSH 6B4DD8
004C41AD   EB 09                    JMP SHORT 4C41B8
004C41AF   8B51 44                  MOV EDX,DWORD PTR DS:[ECX+44]
004C41B2   6A 00                    PUSH 0
004C41B4   6A 00                    PUSH 0
004C41B6   6A 00                    PUSH 0
004C41B8   50                       PUSH EAX
004C41B9   FFD2                     CALL EDX
004C41BB   B8 702E6C00              MOV EAX,6C2E70
004C41C0   E8 9B20F9FF              CALL 456260
004C41C5   C705 54556B00 00000000   MOV DWORD PTR DS:[6B5554],0
004C41CF   8D4C24 04                LEA ECX,DWORD PTR SS:[ESP+4]
004C41D3   E8 182BF5FF              CALL 416CF0
004C41D8   8B4C24 08                MOV ECX,DWORD PTR SS:[ESP+8]
004C41DC   64:890D 00000000         MOV DWORD PTR FS:[0],ECX
004C41E3   59                       POP ECX
004C41E4   83C4 10                  ADD ESP,10
004C41E7   C3                       RETN

CREDITS:
WE11ington (present hook)
Shad0w_ (midfunction)
Avene (detour, Azorbix's detour detected)

0x004C4156 Device engine
0x44 Present Offset??

I have done a midfunction on present some hours ago but it need to load the login else it crash :S

And if i inject it on login it decect me...
6C2E70 = Device Engine

whats your offset

^^ Same Question.

Originally Posted by giniyat101

I dont understand u what's the mistake

Originally Posted by giniyat101

jesus christ how horrifying

@giniyat101: Reverse Engineering dlls FTW!
@KerozHany: He's pointing out each hacks made using the released DIP hook in source code section.

Don't worry they can't recognize how present hook works , they just c+p . @giniyat101
also thanks @Avene for c+p wellington post

Originally Posted by ramo

Don't worry they can't recognize how present hook works , they just c+p . @giniyat101
also thanks @Avene for c+p wellington post

Yeah Ur Right, Open Ur Msn Now

lol Leechers '-' @ramo @UltraPGNoob

Why mentionning me? @XarutoUsoCrack
I don't need to be mentionned as i suscribed to this thread.

this is silly... you guys just C+P the sources from other web sites @giniyat101 this hook can be used for drawing menus ?

Originally Posted by kmanev073

this is silly... you guys just C+P the sources from other web sites @giniyat101 this hook can be used for drawing menus ?

yes ofc

Hook Present Engine

Similar Threads

Tags for this Thread