Interface Hooking
bom..., como o xtrap esta detectando agora esses hooks que eu usava desde o ano passado, resolvi posta-los para que sirva de estudos para vocês ...
Code:
void *DetourCreate (BYTE *src, const BYTE *dst, const int len)
{
BYTE *jmp = (BYTE*)malloc(len+5);
DWORD dwback;
VirtualProtect(src, len, PAGE_READWRITE, &dwback);
memcpy(jmp, src, len); jmp += len;
jmp[0] = 0xE9;
*(DWORD*)(jmp+1) = (DWORD)(src+len - jmp) - 5;
src[0] = 0xE9;
*(DWORD*)(src+1) = (DWORD)(dst - src) - 5;
VirtualProtect(src, len, dwback, &dwback);
return (jmp-len);
}
Code:
//00457540 /$ 6A FF PUSH -1
//00457542 |. 68 48296300 PUSH crossfir.00632948
//00457547 |. 64:A1 00000000 MOV EAX,DWORD PTR FS:[0] => EndScene Interface
//0045754D |. 50 PUSH EAX
//0045754E |. 51 PUSH ECX
//0045754F |. 53 PUSH EBX
//00457550 |. A1 A0D56A00 MOV EAX,DWORD PTR DS:[6AD5A0]
//00457555 |. 33C4 XOR EAX,ESP
//00457557 |. 50 PUSH EAX
//00457558 |. 8D4424 0C LEA EAX,DWORD PTR SS:[ESP+C]
//0045755C |. 64:A3 00000000 MOV DWORD PTR FS:[0],EAX
//00457562 |. 68 00C36C00 PUSH crossfir.006CC300 ; /Arg1 = 006CC300
//00457567 |. 8D4C24 0C LEA ECX,DWORD PTR SS:[ESP+C] ; |
//0045756B |. E8 700EFCFF CALL crossfir.004183E0 ; \crossfir.004183E0
//00457570 |. 33C9 XOR ECX,ECX
//00457572 |. 894C24 14 MOV DWORD PTR SS:[ESP+14],ECX
//00457576 |. 380D FCC26C00 CMP BYTE PTR DS:[6CC2FC],CL
//0045757C |. 74 3D JE SHORT crossfir.004575BB
//0045757E |. A1 78C16C00 MOV EAX,DWORD PTR DS:[6CC178]
//00457583 |. 3BC1 CMP EAX,ECX
//00457585 |. 74 34 JE SHORT crossfir.004575BB
//00457587 |. 880D FCC26C00 MOV BYTE PTR DS:[6CC2FC],CL
//0045758D |. 8B00 MOV EAX,DWORD PTR DS:[EAX]
//0045758F |. 8B08 MOV ECX,DWORD PTR DS:[EAX] => EndScene Engine
//00457591 |. 8B91 A8000000 MOV EDX,DWORD PTR DS:[ECX+A8]
//00457597 |. 50 PUSH EAX
//00457598 |. FFD2 CALL EDX
//0045759A |. 85C0 TEST EAX,EAX
//0045759C |. 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
//004575A0 |. 0F94C3 SETE BL
//004575A3 |. E8 580EFCFF CALL crossfir.00418400
//004575A8 |. 8AC3 MOV AL,BL
//004575AA |. 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
//004575AE |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
//004575B5 |. 59 POP ECX
//004575B6 |. 5B POP EBX
//004575B7 |. 83C4 10 ADD ESP,10
//004575BA |. C3 RETN
//004575BB |> 8D4C24 08 LEA ECX,DWORD PTR SS:[ESP+8]
//004575BF |. E8 3C0EFCFF CALL crossfir.00418400
//004575C4 |. 32C0 XOR AL,AL
//004575C6 |. 8B4C24 0C MOV ECX,DWORD PTR SS:[ESP+C]
//004575CA |. 64:890D 000000>MOV DWORD PTR FS:[0],ECX
//004575D1 |. 59 POP ECX
//004575D2 |. 5B POP EBX
//004575D3 |. 83C4 10 ADD ESP,10
//004575D6 \. C3 RETN
DWORD EndSceneInterface = 0x00457547;
DWORD retEndSceneInterface = (EndSceneInterface + 0x7);
__declspec(naked)HRESULT WINAPI EndSceneInterfaceMidfunction(VOID)
{
static LPDIRECT3DDEVICE9 pDevice;
__asm
{
MOV EAX, DWORD PTR FS:[0]
PUSH EAX
PUSHAD
}
pDevice = **(LPDIRECT3DDEVICE9 **)0x6CC178;
// DrawBox(x, y, w, h, px, pDevice);
__asm
{
POPAD
JMP DWORD PTR DS:[retEndSceneInterface]
}
}
DWORD WINAPI dwStartHook(PVOID)
{
while(1)
{
if(memcmp((PVOID)EndSceneInterface, (PVOID)(PBYTE)"\x64\xA1", 2) == 0)
{
DetourCreate((PBYTE)EndSceneInterface, (PBYTE)EndSceneInterfaceMidfunction, 7);
}
}
return FALSE;
}
Code:
//00579590 /. 55 PUSH EBP
//00579591 |. 8BEC MOV EBP,ESP
//00579593 |. 51 PUSH ECX
//00579594 |. 833D 74856C00 >CMP DWORD PTR DS:[6C8574],0
//0057959B |. 75 37 JNZ SHORT crossfir.005795D4
//0057959D |. 6A 49 PUSH 49 ; /Arg1 = 00000049
//0057959F |. E8 8C0D0600 CALL crossfir.005DA330 ; \crossfir.005DA330
//005795A4 |. 83C4 04 ADD ESP,4
//005795A7 |. 833D F4E56B00 >CMP DWORD PTR DS:[6BE5F4],1
//005795AE |. 7C 1D JL SHORT crossfir.005795CD
//005795B0 |. 68 9C9D6600 PUSH crossfir.00669D9C ; /Arg4 = 00669D9C
//005795B5 |. 68 78AD6600 PUSH crossfir.0066AD78 ; |Arg3 = 0066AD78 ASCII "LT_NOTINITIALIZED"
//005795BA |. 68 58576700 PUSH crossfir.00675758 ; |Arg2 = 00675758 ASCII "Start3D"
//005795BF |. A1 30456B00 MOV EAX,DWORD PTR DS:[6B4530] ; |
//005795C4 |. 50 PUSH EAX ; |Arg1 => 00669D54 ASCII "LT ERROR: %s returned %s (%s)"
//005795C5 |. E8 56110600 CALL crossfir.005DA720 ; \crossfir.005DA720
//005795CA |. 83C4 10 ADD ESP,10
//005795CD |> B8 49000000 MOV EAX,49
//005795D2 |. EB 29 JMP SHORT crossfir.005795FD
//005795D4 |> C745 FC 7C856C>MOV DWORD PTR SS:[EBP-4],crossfir.006C85>
//005795DB |. 8B4D FC MOV ECX,DWORD PTR SS:[EBP-4]
//005795DE |. 8B11 MOV EDX,DWORD PTR DS:[ECX]
//005795E0 |. 83C2 01 ADD EDX,1
//005795E3 |. 8B45 FC MOV EAX,DWORD PTR SS:[EBP-4]
//005795E6 |. 8910 MOV DWORD PTR DS:[EAX],EDX
//005795E8 |. 833D 7C856C00 >CMP DWORD PTR DS:[6C857C],1
//005795EF |. 74 04 JE SHORT crossfir.005795F5
//005795F1 |. 33C0 XOR EAX,EAX
//005795F3 |. EB 08 JMP SHORT crossfir.005795FD
//005795F5 |> FF15 CC856C00 CALL DWORD PTR DS:[6C85CC] ; crossfir.00457460
//005795FB |. 33C0 XOR EAX,EAX
//005795FD |> 8BE5 MOV ESP,EBP
//005795FF |. 5D POP EBP
//00579600 \. C3 RETN
DWORD Start3DEngine = 0x005795DB;
DWORD retStart3DEngine = (Start3DEngine + 0x14);
__declspec(naked)HRESULT WINAPI Start3DMidfunction(VOID)
{
__asm
{
MOV ECX,DWORD PTR SS:[EBP-4]
MOV EDX,DWORD PTR DS:[ECX]
ADD EDX,1
MOV EAX,DWORD PTR SS:[EBP-4]
MOV DWORD PTR DS:[EAX],EDX
CMP DWORD PTR DS:[0x6C857C],1
PUSHAD
}
// funções ...
//if(memcmp((PVOID)Start3DEngine, (PVOID)(PBYTE)"\x8B\x4D", 2) == 0)
//{
// DetourCreate((PBYTE)Start3DEngine, (PBYTE)Start3DMidfunction, 14);
//}
__asm
{
POPAD
JMP DWORD PTR DS:[retStart3DEngine]
}
}
Originally Posted by stefanlove
