[C#] Detouring

[jjaa]

I got bored the other day so I decided to mess around with some C#, and the BlackMagic library. I have done minimal work with C#, so if something could be done a better way feel free to point it out.

Anyway I decided to try detour the object tracking function. It worked, so I am posting it here because someone may find it useful

Syntax Highlighting (NoMorePasting.com)

        static void Detour( uint codeCave, uint Address, byte[] hook_func, ref BlackMagic WoW )
        {

            Console.WriteLine("Detouring 0x{0:X}", Address);
            Console.WriteLine("With Function at 0x{0:X}", codeCave);


            WoW.WriteBytes(codeCave, hook_func); 
            //Our function is in memory
            WoW.Asm.Clear();
            WoW.Asm.AddLine("push {0}", codeCave);
            WoW.Asm.AddLine("retn"); //pops codeCave from the stack into EIP

            WoW.WriteBytes(Address, WoW.Asm.Assemble()); //Detour the Function

        }

        static void Main(string[] args)
        {

            /////////////
            //WoW 3.0.9//
            /////////////

            BlackMagic WoW = new BlackMagic(SProcess.GetProcessFromProcessName("WoW"));


            uint CodeCave = WoW.AllocateMemory();


            WoW.Asm.Clear(); //Make sure no ASM lines exist
            //An STD call that returns true
            WoW.Asm.AddLine("mov al,1");
            WoW.Asm.AddLine("retn 4");

            //0x00633470 -> ObjectTracking

            Detour(CodeCave,0x00633470, WoW.Asm.Assemble(), ref WoW); 
            //tracking all objects

            Console.ReadLine();

        }

The only real limitation is that if you want to do something complex you will need good ASM skills


Now I canz track stuff :P


EDIT: I just remembered, i think there is a similar thing on GD so if you want more information look there....but i don't know if it is the same thing...i haven't looked...

[Cypher]

There are two functions you need to hook to do tracking like that. You've got one, but you're missing the other.

From memory one is for GameObjects, the other is for everything else. Or something similar to that.

[lanman92]

WOW! That's pretty awesome man. I'd almost +rep just for that bit of code there, never really thought about doing that...

[jjaa]

There are two functions you need to hook to do tracking like that. You've got one, but you're missing the other.

From memory one is for GameObjects, the other is for everything else. Or something similar to that.

Yeh i know, but they can detour that one themselves

0x006333E0 -> UnitTracking

[ostapus]

I am wondering is that detouring functions in this way (modifying .CODE section) should be catched by warden, isn't ? you dont worry about it or you tracking warden for information it sends to server ?

[Apoc]

Yeh i know, but they can detour that one themselves

0x006333E0 -> UnitTracking

You're close to 'real' .NET detouring.

Look into how delegates mimic function pointers in memory. (That was a big hint)