Clarkie Detours.
Clarkie Detours.
Well you guys have a lot of detour problems so i made a detour for you guys. I know dont post this and that.
I was using topblast's revival Base and i notice the Tjmp structure, which is exactly what you need to make a Jump function. So I edited it and used it to make a detour.
Credit
Clarkie making it
Topblast (only for the little structure)
[highlight=c++]#pragma pack(push)
#pragma pack(1)
typedef struct {
unsigned char bNop;
unsigned char bPush;
unsigned long dwAddress;
unsigned char bRet;
} TestJmp;
typedef struct {
unsigned char bOPS[7];
unsigned char bNop;
unsigned char bJmp;
unsigned long dwAddress;
} Tjmp;
#pragma pack(pop)
bool Detour::Hook(PBYTE pTargetAddr, PBYTE pNewAddr, VOID** pCallOrigAddress)
{
TestJmp recJump;
Tjmp RetJump;
DWORD dwProtect;
*pCallOrigAddress = VirtualAlloc(0, sizeof(Tjmp), (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
if( pCallOrigAddress != NULL)
{
WriteNOP(&RetJump, sizeof(Tjmp));
for( int i = 0; i < (sizeof(TestJmp)+1); i++)
RetJump.bOPS[i] = pTargetAddr[i];
RetJump.bNop = 0x90;
RetJump.bJmp = 0xE9;
RetJump.dwAddress = (DWORD(pTargetAddr) + (sizeof(TestJmp)+1))-DWORD(*pCallOrigAddress)-(((sizeof(TestJmp)*2)));
memcpy(*pCallOrigAddress, &RetJump, sizeof(Tjmp));
if( WriteNOP(pTargetAddr, (sizeof(TestJmp))) == true &&
VirtualProtect(pTargetAddr, sizeof(TestJmp), PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE)
{
WriteNOP(&recJump, sizeof(TestJmp));
recJump.bNop = 0x90;
recJump.bPush = 0x68;
recJump.dwAddress = DWORD(pNewAddr);
recJump.bRet = 0xC3;
memcpy(pTargetAddr, &recJump, sizeof(TestJmp));
VirtualProtect(pTargetAddr, sizeof(TestJmp), dwProtect, &dwProtect);
return true;
}
}
return false;
}
[/highlight]
I was using topblast's revival Base and i notice the Tjmp structure, which is exactly what you need to make a Jump function. So I edited it and used it to make a detour.
Credit
Clarkie making it
Topblast (only for the little structure)
[highlight=c++]#pragma pack(push)
#pragma pack(1)
typedef struct {
unsigned char bNop;
unsigned char bPush;
unsigned long dwAddress;
unsigned char bRet;
} TestJmp;
typedef struct {
unsigned char bOPS[7];
unsigned char bNop;
unsigned char bJmp;
unsigned long dwAddress;
} Tjmp;
#pragma pack(pop)
bool Detour::Hook(PBYTE pTargetAddr, PBYTE pNewAddr, VOID** pCallOrigAddress)
{
TestJmp recJump;
Tjmp RetJump;
DWORD dwProtect;
*pCallOrigAddress = VirtualAlloc(0, sizeof(Tjmp), (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
if( pCallOrigAddress != NULL)
{
WriteNOP(&RetJump, sizeof(Tjmp));
for( int i = 0; i < (sizeof(TestJmp)+1); i++)
RetJump.bOPS[i] = pTargetAddr[i];
RetJump.bNop = 0x90;
RetJump.bJmp = 0xE9;
RetJump.dwAddress = (DWORD(pTargetAddr) + (sizeof(TestJmp)+1))-DWORD(*pCallOrigAddress)-(((sizeof(TestJmp)*2)));
memcpy(*pCallOrigAddress, &RetJump, sizeof(Tjmp));
if( WriteNOP(pTargetAddr, (sizeof(TestJmp))) == true &&
VirtualProtect(pTargetAddr, sizeof(TestJmp), PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE)
{
WriteNOP(&recJump, sizeof(TestJmp));
recJump.bNop = 0x90;
recJump.bPush = 0x68;
recJump.dwAddress = DWORD(pNewAddr);
recJump.bRet = 0xC3;
memcpy(pTargetAddr, &recJump, sizeof(TestJmp));
VirtualProtect(pTargetAddr, sizeof(TestJmp), dwProtect, &dwProtect);
return true;
}
}
return false;
}
[/highlight]
Nice . Good job 
Just copy it into Revival Base and it will work
Thanks Clarkie. And these actually are yours (nudges whit) 
Originally Posted by CAFlames
Thanks Clarkie. And these actually are yours (nudges whit)
Because i made mine, and you didnt make yours i guess,
Originally Posted by Clarkie
Because i made mine, and you didnt make yours i guess,
Originally Posted by whit
I never claimed those detours as mine
Im just bustin your balls. You did help out a lot of people by making them public on MPGH.
Originally Posted by CAFlames
You never gave credz either :P
Im just bustin your balls. You did help out a lot of people by making them public on MPGH.
Select Me ;D ---> and getting them detected by doing that
Cool, nice work.
Originally Posted by CodeDemon
Cool, nice work.
Originally Posted by whit
Welcome back from the dead
I have 41 notifications lolNice work clarkie..... OMG noooooo No my base.... ohh well I was credited
Originally Posted by CodeDemon
OMG, YOUR A LIVE!!!!!!!!!!!!!!!!!!!!! *faint*
Originally Posted by CodeDemon
I have 41 notifications lol
Thats what you get for ditching us. 
Originally Posted by CodeDemon
Cool, nice work.
Originally Posted by CodeDemon
I have 41 notifications lol Thats what you get for ditching us. Originally Posted by Clarkie
Well you guys have a lot of detour problems so i made a detour for you guys. I know dont post this and that.
I was using topblast's revival Base and i notice the Tjmp structure, which is exactly what you need to make a Jump function. So I edited it and used it to make a detour.
Credit
Clarkie making it
Topblast (only for the little structure)
[highlight=c++]#pragma pack(push)
#pragma pack(1)
typedef struct {
unsigned char bNop;
unsigned char bPush;
unsigned long dwAddress;
unsigned char bRet;
} TestJmp;
typedef struct {
unsigned char bOPS[7];
unsigned char bNop;
unsigned char bJmp;
unsigned long dwAddress;
} Tjmp;
#pragma pack(pop)
bool Detour::Hook(PBYTE pTargetAddr, PBYTE pNewAddr, VOID** pCallOrigAddress)
{
TestJmp recJump;
Tjmp RetJump;
DWORD dwProtect;
*pCallOrigAddress = VirtualAlloc(0, sizeof(Tjmp), (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
if( pCallOrigAddress != NULL)
{
WriteNOP(&RetJump, sizeof(Tjmp));
for( int i = 0; i < (sizeof(TestJmp)+1); i++)
RetJump.bOPS[i] = pTargetAddr[i];
RetJump.bNop = 0x90;
RetJump.bJmp = 0xE9;
RetJump.dwAddress = (DWORD(pTargetAddr) + (sizeof(TestJmp)+1))-DWORD(*pCallOrigAddress)-(((sizeof(TestJmp)*2)));
memcpy(*pCallOrigAddress, &RetJump, sizeof(Tjmp));
if( WriteNOP(pTargetAddr, (sizeof(TestJmp))) == true &&
VirtualProtect(pTargetAddr, sizeof(TestJmp), PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE)
{
WriteNOP(&recJump, sizeof(TestJmp));
recJump.bNop = 0x90;
recJump.bPush = 0x68;
recJump.dwAddress = DWORD(pNewAddr);
recJump.bRet = 0xC3;
memcpy(pTargetAddr, &recJump, sizeof(TestJmp));
VirtualProtect(pTargetAddr, sizeof(TestJmp), dwProtect, &dwProtect);
return true;
}
}
return false;
}
[/highlight]
I was using topblast's revival Base and i notice the Tjmp structure, which is exactly what you need to make a Jump function. So I edited it and used it to make a detour.
Credit
Clarkie making it
Topblast (only for the little structure)
[highlight=c++]#pragma pack(push)
#pragma pack(1)
typedef struct {
unsigned char bNop;
unsigned char bPush;
unsigned long dwAddress;
unsigned char bRet;
} TestJmp;
typedef struct {
unsigned char bOPS[7];
unsigned char bNop;
unsigned char bJmp;
unsigned long dwAddress;
} Tjmp;
#pragma pack(pop)
bool Detour::Hook(PBYTE pTargetAddr, PBYTE pNewAddr, VOID** pCallOrigAddress)
{
TestJmp recJump;
Tjmp RetJump;
DWORD dwProtect;
*pCallOrigAddress = VirtualAlloc(0, sizeof(Tjmp), (MEM_COMMIT | MEM_RESERVE), PAGE_EXECUTE_READWRITE);
if( pCallOrigAddress != NULL)
{
WriteNOP(&RetJump, sizeof(Tjmp));
for( int i = 0; i < (sizeof(TestJmp)+1); i++)
RetJump.bOPS[i] = pTargetAddr[i];
RetJump.bNop = 0x90;
RetJump.bJmp = 0xE9;
RetJump.dwAddress = (DWORD(pTargetAddr) + (sizeof(TestJmp)+1))-DWORD(*pCallOrigAddress)-(((sizeof(TestJmp)*2)));
memcpy(*pCallOrigAddress, &RetJump, sizeof(Tjmp));
if( WriteNOP(pTargetAddr, (sizeof(TestJmp))) == true &&
VirtualProtect(pTargetAddr, sizeof(TestJmp), PAGE_EXECUTE_READWRITE, &dwProtect) == TRUE)
{
WriteNOP(&recJump, sizeof(TestJmp));
recJump.bNop = 0x90;
recJump.bPush = 0x68;
recJump.dwAddress = DWORD(pNewAddr);
recJump.bRet = 0xC3;
memcpy(pTargetAddr, &recJump, sizeof(TestJmp));
VirtualProtect(pTargetAddr, sizeof(TestJmp), dwProtect, &dwProtect);
return true;
}
}
return false;
}
[/highlight]
Originally Posted by _Fk127_
Great job! Its awesome to see someone who actually knows what they're doing join up :P
This thread is closed for replies.