MPGHThe Dark Arts
RegisterLog in

NOP Addies

Posts 1–15 of 19 · Page 1 of 2
NOP Addies
Hey guys.

Can someone tell me how to NOP addies in C++?

Ive heard people use MemCpy() but i cant find a link on it.
Ive also heard people use WriteProcessMemory()

I found something on WPM() but i didnt know how to handle the process properly D:

So someone help me out please?

Ohh and its also going in a DLL not an EXE..

Thanks,
ac1d_buRn
#1 ·
I believe nopping is just filling with 90's

I haven't done this in a long time. But I assume you are asking this in regards to that no recoil addie in ca source section. I'll try and help with that.
Code:
void NoRecoil(bool on)
{
	if(on)
	{
		byte NoRecoilOn[#] = { 0x90, 0x90, 0x90 }; // # = number of bytes?
		byte NoRecoilOn2[#] = { 0x90, 0x90, 0x90 };
		byte NoRecoilOn3[#] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
		byte NoRecoilOn4[#] = { 0x90, 0x90, 0x90 };
		memcpy_s((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
		memcpy_s((PVOID)0x002E7F71, (void*)NoRecoilOn2, sizeof(NoRecoilOn2));
		memcpy_s((PVOID)0x002E7F76, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));
		memcpy_s((PVOID)0x002E7F82, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));

	}
	else
	{
                byte NoRecoilOn[#] = { 0xD8, 0x66, 0x54 }; //# = number of bytes
                byte NoRecoilOn2[#] = { 0xD9, 0x46, 0x54 };
                byte NoRecoilOn3[#] = { 0xD9, 0x5E, 0x54, 0xD9, 0x46, 0x48 };
                byte NoRecoilOn4[#] = { 0xD9, 0x5E, 0x48 };
		memcpy_s((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
		memcpy_s((PVOID)0x002E7F71, (void*)NoRecoilOn2, sizeof(NoRecoilOn2));
                memcpy_s((PVOID)0x002E7F76, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));
                memcpy_s((PVOID)0x002E7F82, (void*)NoRecoilOn4, sizeof(NoRecoilOn4));
	}
}
I can't verify that this works 'cause I'm working from memory and have to go to bed.

Better of waiting for why06
#2 · edited ·
That's actually pretty good. And you would have been exactly right except your using memcpy_s()//secure which takes an extra parameter of the size of the destination buffer to prevent buffer overflow, but we don't care about security since were the ones hacking xD... in fact we want to write into memory!

So you can just use the regular memcpy() and keep your parameters the same. Also you can remove those little #'s symbols as when you don't specify the size of an array it will automatically be set to the size of the number of elements you passed.

Lastly you might need to change the write access of your memory by using VirtualProtect like so:
Code:
 DWORD dwProtect;
BOOL WINAPI VirtualProtect(A_pointer_to_the_address_you_want_to_change, numbytes, PAGE_READWRITE, &dwProtect);
//do all your memcpy() here
BOOL WINAPI VirtualProtect(A_pointer_to_the_address_you_want_to_change, numbytes, dwProtect, &dwProtect); //set back to old protection
Here's an example with just one:
Code:
byte NoRecoilOn[] = { 0x90, 0x90, 0x90 };
 DWORD dwProtect;
BOOL WINAPI VirtualProtect((LPVOID)0x002E7F62, 3, PAGE_READWRITE, &dwProtect);
memcpy((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
BOOL WINAPI VirtualProtect((LPVOID)0x002E7F62, 3, dwProtect, &dwProtect);
And I always check myself on MSDN, and you should too:
http://msdn.microsoft.com/en-us/libr...8VS.85%29.aspx
http://msdn.microsoft.com/en-us/libr...8VS.71%29.aspx
#3 · edited ·
Oops noticed I put the last off address wrong, edited it.

Quote Originally Posted by why06 View Post
That's actually pretty good. And you would have been exactly right except your using memcpy_s()//secure which takes an extra parameter of the size of the destination buffer to prevent buffer overflow, but we don't care about security since were the ones hacking xD... in fact we want to write into memory!
Oh not bad, actually I do recall all those months ago screwing up that same thing with the _s. It was unusual because I started in c++ 6.0 in which it worked but when converting code it was basically the only thing that didn't in 08

Thanks for clearing that up, best of luck ac1d.
#4 ·
Thank you very much guys.

Thanked both of you.

Time for me to give it a go now..

EDIT:

OMG it just doesnt wanna work for me ffs.

Here is the code i am using. Are there any faults?

Code:
		if(GetAsyncKeyState(VK_NUMPAD0)<0)
			{
				if(recoil)
				{
					byte NoRecoilOff[] = { 0xD8, 0x66, 0x54 };
					byte NoRecoilOff2[] = { 0xD9, 0x46, 0x54 };
					byte NoRecoilOff3[] = { 0xD9, 0x5E, 0x54, 0xD9, 0x46, 0x48 };
					byte NoRecoilOff4[] = { 0xD9, 0x5E, 0x48 };

					memcpy((PVOID)0x002E7F62, (void*)NoRecoilOff, sizeof(NoRecoilOff));
					memcpy((PVOID)0x002E7F71, (void*)NoRecoilOff2, sizeof(NoRecoilOff2));
					memcpy((PVOID)0x002E7F76, (void*)NoRecoilOff3, sizeof(NoRecoilOff3));
					memcpy((PVOID)0x002E7F82, (void*)NoRecoilOff4, sizeof(NoRecoilOff4));
					recoil = false;
				}
				else
				{
				    byte NoRecoilOn[] = { 0x90, 0x90, 0x90 }; //# = number of bytes
					byte NoRecoilOn2[] = { 0x90, 0x90, 0x90 };
					byte NoRecoilOn3[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
					byte NoRecoilOn4[] = { 0x90, 0x90, 0x90 };

					memcpy((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
					memcpy((PVOID)0x002E7F71, (void*)NoRecoilOn2, sizeof(NoRecoilOn2));
					memcpy((PVOID)0x002E7F76, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));
					memcpy((PVOID)0x002E7F82, (void*)NoRecoilOn4, sizeof(NoRecoilOn4));
					recoil = true;
				}
		}
That didnt work. So i tried this.

Code:
if(GetAsyncKeyState(VK_DELETE)&1)
			{
				if(recoil)
				{
					byte NoRecoilOff[] = { 0xD8, 0x66, 0x54 };
					byte NoRecoilOff2[] = { 0xD9, 0x46, 0x54 };
					byte NoRecoilOff3[] = { 0xD9, 0x5E, 0x54, 0xD9, 0x46, 0x48 };
					byte NoRecoilOff4[] = { 0xD9, 0x5E, 0x48 };

					DWORD dwProtect;
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F62, 3, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F62, (void*)NoRecoilOff, sizeof(NoRecoilOff));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F62, 3, dwProtect, &dwProtect);

					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F71, 3, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F71, (void*)NoRecoilOff2, sizeof(NoRecoilOff2));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F71, 3, dwProtect, &dwProtect);

					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F76, 6, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F76, (void*)NoRecoilOff3, sizeof(NoRecoilOff3));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F76, 6, dwProtect, &dwProtect);

					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F82, 3, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F82, (void*)NoRecoilOff4, sizeof(NoRecoilOff4));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F82, 3, dwProtect, &dwProtect);
					recoil = false;
				}
				else
				{
				    byte NoRecoilOn[] = { 0x90, 0x90, 0x90 }; //# = number of bytes
					byte NoRecoilOn2[] = { 0x90, 0x90, 0x90 };
					byte NoRecoilOn3[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
					byte NoRecoilOn4[] = { 0x90, 0x90, 0x90 };

					DWORD dwProtect;
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F62, 3, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F62, 3, dwProtect, &dwProtect);

					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F71, 3, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F71, (void*)NoRecoilOn2, sizeof(NoRecoilOn2));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F71, 3, dwProtect, &dwProtect);

					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F76, 6, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F76, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F76, 6, dwProtect, &dwProtect);

					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F82, 3, PAGE_READWRITE, &dwProtect);
					memcpy((PVOID)0x002E7F82, (void*)NoRecoilOn4, sizeof(NoRecoilOn4));
					BOOL WINAPI VirtualProtect((LPVOID)0x002E7F82, 3, dwProtect, &dwProtect);
					recoil = true;
				}
		}
And that code gave me a shit load of errors.

Please help D:


#5 · edited ·
Code:
bool NoRec;

void memcpy_s(PVOID address, void* val, int bytes)
{
    DWORD d, ds;
    VirtualProtect(address, bytes, PAGE_EXECUTE_READWRITE, &d);
    memcpy(address, val, bytes);
    VirtualProtect(address,bytes,d,&ds);
}

void NoRecoil(bool on)
{
	if(on)
	{
		byte NoRecoilOn[] = { 0x90, 0x90, 0x90 }; 
		byte NoRecoilOn2[] = { 0x90, 0x90, 0x90 };
		byte NoRecoilOn3[] = { 0x90, 0x90, 0x90, 0x90, 0x90, 0x90 };
		byte NoRecoilOn4[] = { 0x90, 0x90, 0x90 };
		memcpy_s((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
		memcpy_s((PVOID)0x002E7F71, (void*)NoRecoilOn2, sizeof(NoRecoilOn2));
		memcpy_s((PVOID)0x002E7F76, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));
		memcpy_s((PVOID)0x002E7F82, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));

	}
	else
	{
                byte NoRecoilOn[] = { 0xD8, 0x66, 0x54 }; 
                byte NoRecoilOn2[] = { 0xD9, 0x46, 0x54 };
                byte NoRecoilOn3[] = { 0xD9, 0x5E, 0x54, 0xD9, 0x46, 0x48 };
                byte NoRecoilOn4[] = { 0xD9, 0x5E, 0x48 };
		memcpy_s((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
		memcpy_s((PVOID)0x002E7F71, (void*)NoRecoilOn2, sizeof(NoRecoilOn2));
                memcpy_s((PVOID)0x002E7F76, (void*)NoRecoilOn3, sizeof(NoRecoilOn3));
                memcpy_s((PVOID)0x002E7F82, (void*)NoRecoilOn4, sizeof(NoRecoilOn4));
	}
}

HRESULT APIENTRY hkIDirect3DDevice9::Present(CONST RECT *pSourceRect, CONST RECT *pDestRect, HWND hDestWindowOverride, CONST RGNDATA *pDirtyRegion) 
{
	if(GetAsyncKeyState(VK_NUMPAD0)&1){ //hotkey numpad 0
		NoRec = !NoRec;
		    if(NoRec){
			     NoRecoil(true);//on
			     }else{
		             NoRecoil(false);//off
		             }	
	           }
	return m_pD3Ddev->Present(pSourceRect, pDestRect, hDestWindowOverride, pDirtyRegion);
}
I think I set it up correctly, and didn't leave anything out but I'm not sure, you'll have to test.

Oh and I know I used memcpy_s again, but it seemed to work, so I left it

I'm sure their is a mistake or two somewhere, but you should be able to spot it out.

If you need more help I'm sure why can help my knowledge doesn't extend much past here
#6 · edited ·
Post errors please.
#7 ·
May I suggest:
Code:
void MemCopy(void* Dest, const void* Src, int Len)
{
	DWORD OldProtect;
	DWORD OldProtect2;
	VirtualProtect(Dest, Len, PAGE_EXECUTE_READWRITE, &OldProtect);
	memcpy(Dest, Src, Len);
	VirtualProtect(Dest, Len, OldProtect, &OldProtect2);
	FlushInstructionCache(GetCurrentProcess(), Dest, Len);
}
so that you dont need to type the same thing over and over again.
#8 ·
Well I tried to make my own and when I inject it, it says "Combat Arms has stopped working..."
#9 ·
Post code for hack otherwise no one can help you unless some1 here can read minds. =/
#10 ·
Quote Originally Posted by why06 View Post
Post code for hack otherwise no one can help you unless some1 here can read minds. =/
I found the mistake I forgot a sleep statement.

It doesn't turn on but I think I know the problem.
#11 ·
Quote Originally Posted by Crash View Post
I found the mistake I forgot a sleep statement.

It doesn't turn on but I think I know the problem.
Ok well also make sure your waiting for the modules to load before you try to do anything. Hopefully u can fix it, because all I can give is general advice. It might be something far worse, like your indexing outside an array or something.
#12 ·
may i ask why

Code:
memcpy_s((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
thats on offset and not a valid address

correction:
Code:
DWORD dwShell = NULL;
//wait for cshell to be loaded
while(! (dwShell = (DWORD)GetModuleHandle("cshell.dll")) )
    Sleep(100);

//cshell.dll has been loaded - now go patching
memcpy_s((PVOID)(dwShell+0x002E7F62), &NoRecoilOn, sizeof(NoRecoilOn));
#13 ·
Hmmmm.... oh yes your right! I just assumed he knew the address, but these are the addresses from the no recoil post and must be offset from cshell. Good catch.
#14 ·
Quote Originally Posted by Gordon` View Post
may i ask why

Code:
memcpy_s((PVOID)0x002E7F62, (void*)NoRecoilOn, sizeof(NoRecoilOn));
thats on offset and not a valid address

correction:
Code:
DWORD dwShell = NULL;
//wait for cshell to be loaded
while(! (dwShell = (DWORD)GetModuleHandle("cshell.dll")) )
    Sleep(100);

//cshell.dll has been loaded - now go patching
memcpy_s((PVOID)(dwShell+0x002E7F62), &NoRecoilOn, sizeof(NoRecoilOn));
Ahh. Thanks gordon
#15 ·
Posts 1–15 of 19 · Page 1 of 2
This thread is closed for replies.

Tags for this Thread

None

Talk with us