Clarkie Detours.

[Clarkie]

Well you guys have a lot of detour problems so i made a detour for you guys. I know dont post this and that.

I was using topblast's revival Base and i notice the Tjmp structure, which is exactly what you need to make a Jump function. So I edited it and used it to make a detour.


Credit
Clarkie making it
Topblast (only for the little structure)

[highlight=c++]#pragma pack(push)
#pragma pack(1)

typedef struct {
unsigned char bNop;
unsigned char bPush;
unsigned long dwAddress;
unsigned char bRet;
} TestJmp;


typedef struct {
unsigned char bOPS[7];
unsigned char bNop;
unsigned char bJmp;
unsigned long dwAddress;
} Tjmp;
#pragma pack(pop)

bool Detour::Hook(PBYTE pTargetAddr, PBYTE pNewAddr, VOID** pCallOrigAddress)
{
TestJmp recJump;
Tjmp RetJump;
DWORD dwProtect;
*pCallOrigAddress = VirtualAlloc(0, sizeof(Tjmp), (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
if( pCallOrigAddress != NULL)
{
WriteNOP(&RetJump, sizeof(Tjmp));

for( int i = 0; i < (sizeof(TestJmp)+1); i++)
RetJump.bOPS[i] = pTargetAddr[i];
RetJump.bNop = 0x90;
RetJump.bJmp = 0xE9;
RetJump.dwAddress = (DWORD(pTargetAddr) + (sizeof(TestJmp)+1))-DWORD(*pCallOrigAddress)-(((sizeof(TestJmp)*2)));
memcpy(*pCallOrigAddress, &RetJump, sizeof(Tjmp));

if( WriteNOP(pTargetAddr, (sizeof(TestJmp))) == true &&
VirtualProtect(pTargetAddr, sizeof(TestJmp), PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE)
{
WriteNOP(&recJump, sizeof(TestJmp));
recJump.bNop = 0x90;
recJump.bPush = 0x68;
recJump.dwAddress = DWORD(pNewAddr);
recJump.bRet = 0xC3;
memcpy(pTargetAddr, &recJump, sizeof(TestJmp));
VirtualProtect(pTargetAddr, sizeof(TestJmp), dwProtect, &dwProtect);
return true;
}
}
return false;
}
[/highlight]

[whit]

Nice . Good job

[Clarkie]

Just copy it into Revival Base and it will work

[CAFlames]

Thanks Clarkie. And these actually are yours (nudges whit)

[whit]

Thanks Clarkie. And these actually are yours (nudges whit)

Why am i being nudged

[Clarkie]

Because i made mine, and you didnt make yours i guess,

[whit]

Because i made mine, and you didnt make yours i guess,

I never claimed those detours as mine

[CodeDemon]

Cool, nice work.

[whit]

Cool, nice work.

Welcome back from the dead

[CodeDemon]

Welcome back from the dead

I have 41 notifications lol

[topblast]

Nice work clarkie..... OMG noooooo No my base.... ohh well I was credited

Cool, nice work.

OMG, YOUR A LIVE!!!!!!!!!!!!!!!!!!!!! *faint*

I have 41 notifications lol

Thats what you get for ditching us.

[CAFlames]

I never claimed those detours as mine

You never gave credz either :P

Im just bustin your balls. You did help out a lot of people by making them public on MPGH.

[Clarkie]

You never gave credz either :P

Im just bustin your balls. You did help out a lot of people by making them public on MPGH.

lol,

Select Me ;D ---> and getting them detected by doing that

[_Fk127_]

Well you guys have a lot of detour problems so i made a detour for you guys. I know dont post this and that.

I was using topblast's revival Base and i notice the Tjmp structure, which is exactly what you need to make a Jump function. So I edited it and used it to make a detour.


Credit
Clarkie making it
Topblast (only for the little structure)

[highlight=c++]#pragma pack(push)
#pragma pack(1)

typedef struct {
unsigned char bNop;
unsigned char bPush;
unsigned long dwAddress;
unsigned char bRet;
} TestJmp;


typedef struct {
unsigned char bOPS[7];
unsigned char bNop;
unsigned char bJmp;
unsigned long dwAddress;
} Tjmp;
#pragma pack(pop)

bool Detour::Hook(PBYTE pTargetAddr, PBYTE pNewAddr, VOID** pCallOrigAddress)
{
TestJmp recJump;
Tjmp RetJump;
DWORD dwProtect;
*pCallOrigAddress = VirtualAlloc(0, sizeof(Tjmp), (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
if( pCallOrigAddress != NULL)
{
WriteNOP(&RetJump, sizeof(Tjmp));

for( int i = 0; i < (sizeof(TestJmp)+1); i++)
RetJump.bOPS[i] = pTargetAddr[i];
RetJump.bNop = 0x90;
RetJump.bJmp = 0xE9;
RetJump.dwAddress = (DWORD(pTargetAddr) + (sizeof(TestJmp)+1))-DWORD(*pCallOrigAddress)-(((sizeof(TestJmp)*2)));
memcpy(*pCallOrigAddress, &RetJump, sizeof(Tjmp));

if( WriteNOP(pTargetAddr, (sizeof(TestJmp))) == true &&
VirtualProtect(pTargetAddr, sizeof(TestJmp), PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE)
{
WriteNOP(&recJump, sizeof(TestJmp));
recJump.bNop = 0x90;
recJump.bPush = 0x68;
recJump.dwAddress = DWORD(pNewAddr);
recJump.bRet = 0xC3;
memcpy(pTargetAddr, &recJump, sizeof(TestJmp));
VirtualProtect(pTargetAddr, sizeof(TestJmp), dwProtect, &dwProtect);
return true;
}
}
return false;
}
[/highlight]

Great job! Its awesome to see someone who actually knows what they're doing join up :P

[Clarkie]

Great job! Its awesome to see someone who actually knows what they're doing join up :P

Lol i try :P