Speedhacking...

[lanman92]

Ugh. I frown upon doing this, but i've copied and pasted many different speedhacks and all they do is crash the window. I even commented out the code that actually does anything, and it still is crashing. Is there some type of protection that is not letting me detour GetTickCount()??? Here's the code im using...

 
#pragma comment(lib, "detours.lib")
DETOUR_TRAMPOLINE(DWORD WINAPI GetTickCount_Trampoline(void), GetTickCount);
DWORD gtc_last_real, gtc_last_fake;
DWORD increasefactor = 200;
DWORD speedenabled = 1;
DWORD WINAPI GetTickCount_Detour(void);
 
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
DisableThreadLibraryCalls(hModule);
DetourFunctionWithTrampoline((PBYTE)GetTickCount_Trampoline, (PBYTE)GetTickCount_Detour);
case DLL_PROCESS_DETACH:
break;
}
return TRUE;
}
DWORD WINAPI GetTickCount_Detour()
{
DWORD ret = GetTickCount_Trampoline();
// DWORD nReal = ret;
// DWORD dReal = nReal - gtc_last_real;
// DWORD dFake = (increasefactor/100) * dReal;
//
// if (speedenabled == 1)
// {
// ret = gtc_last_fake + dFake;
// gtc_last_fake += dFake;
// }
// else
// {
// ret = gtc_last_fake + dReal;
// gtc_last_fake += dReal;
// }
//
//gtc_last_real += dReal;
return ret;
}

[Xarg0]

Edit: Sorry didn't look too much at your code, I thought you were using DetourFunction not DetourFunctionWithTrampoline.
I currently have no Idea what's causing your crash ^^

[lanman92]

If i changed it to standard Detourfunction() would it make much of a difference? I hope Cypher will come on and tell me what im doing wrong, he always knows what to do. lol.

[Shynd]

Change your DLL source so that the first line of GetTickCount_Detour is "__asm __emit 0xCC." Recompile and inject while WoW is running with OLLYDBG attached. See what goes wrong. Fix it.


Edit: For the record, the code you're using is mine and it's years old, although I just tried it and it works just fine, besides disconnecting after a while. Don't know what the problem is.

[Xarg0]

Maybe it's a compiler issue ^^
What compiler and settings are you using lanman?

And about the disconnect, you can prevent this problem by returning ret = gtc_last_fake + dReal
every now and then even if your speed hack is enabled.

[lanman92]

Ok, thanks for the help guys. I think I'll be able to get it to work now. Could you tell me why I need to add that ASM line? I like to know what the code does, so I don't look like a leecher.

EDIT: I just re-read your post and you mean that will help me see what's going wrong, not fix it? If so, thanks even more.
EDIT2: I just tried what you said, but I'm getting a compiler error, it says it's an invalid opcode. I'll MSDN it to see if there's an updated opcode or something...

[Shynd]

What compiler are you using? All it is for is setting a breakpoint so that OLLYDBG will break and allow you to step through the code line-by-line until you see what's going wrong (it'd probably have to be something obvious). Probably is a compiler error, though.

[lanman92]

Ah, I had the space missing :P My mistake.

[lanman92]

Here's what the code in Olly looked like, it seems right... (I just edited it so it shows the entry point, where it's crashing.)

710C15C0 > 55               PUSH EBP
710C15C1   8BEC             MOV EBP,ESP
710C15C3   81EC C4000000    SUB ESP,0C4
710C15C9   53               PUSH EBX
710C15CA   56               PUSH ESI
710C15CB   57               PUSH EDI
710C15CC   8DBD 3CFFFFFF    LEA EDI,DWORD PTR SS:[EBP-C4]
710C15D2   B9 31000000      MOV ECX,31
710C15D7   B8 CCCCCCCC      MOV EAX,CCCCCCCC
710C15DC   F3:AB            REP STOS DWORD PTR ES:[EDI]
710C15DE   8B45 0C          MOV EAX,DWORD PTR SS:[EBP+C]
710C15E1   8985 3CFFFFFF    MOV DWORD PTR SS:[EBP-C4],EAX
710C15E7   83BD 3CFFFFFF 01 CMP DWORD PTR SS:[EBP-C4],1
710C15EE   74 02            JE SHORT Gettickc.710C15F2
710C15F0   EB 22            JMP SHORT Gettickc.710C1614
710C15F2   8BF4             MOV ESI,ESP
710C15F4   8B45 08          MOV EAX,DWORD PTR SS:[EBP+8]
710C15F7   50               PUSH EAX
710C15F8   FF15 B0B10C71    CALL DWORD PTR DS:[<&KERNEL32.DisableThr>; kernel32.DisableThreadLibraryCalls
710C15FE   3BF4             CMP ESI,ESP
710C1600   E8 D1FBFFFF      CALL Gettickc.710C11D6
710C1605   68 46100C71      PUSH Gettickc.710C1046
710C160A   68 E0110C71      PUSH Gettickc.710C11E0
710C160F   E8 44FCFFFF      CALL Gettickc.710C1258
710C1614   B8 01000000      MOV EAX,1
710C1619   5F               POP EDI
710C161A   5E               POP ESI
710C161B   5B               POP EBX
710C161C   81C4 C4000000    ADD ESP,0C4
710C1622   3BEC             CMP EBP,ESP
710C1624   E8 ADFBFFFF      CALL Gettickc.710C11D6
710C1629   8BE5             MOV ESP,EBP
710C162B   5D               POP EBP
710C162C   C2 0C00          RETN 0C

EDIT: It seems that there is an access violation at 710C15DE, I'll try to figure it out... It's crashing before the code is executed. Odd.
EDIT2: I don't think that CMP DWORD PTR SS:[EBP-C4],1 is pointing to the right addy. I have no idea how to fix this, but it's crashing right there.

[lanman92]

...anyone know what's wrong with the code?

[DrD]

Maybe its because you actually have no clue what your doing, and your just trying to copy and paste? And even then when that doesn't work for you, you go ahead and ask others to fix it for you.

[lanman92]

Dude, I was trying out someone elses code because mine wasn't working. I was checking if it was my code being wrong or if it just wasn't working. I settled on just hooking QPC(), so **** off.

[Nonominator]

Fed the troll drd and cypher!

He said "so aestrik aestrik aestrik aestrik off."

I reply in a famous quote from McSquizzy:
"Ged off my trees ya buck-toothed sporran!"