EasyHook - For all you C# fans

[Neverhaven]

Hi,

I'm new on this forum, and found it accidentally while looking for some offset guides, and i must say, this forum has some great information, still trying to find some guides, but for now, I'm using the published ones others have found.

Now, to the point of this thread, I've done a lot of hacking in Warcraft III, and I'm behind a project that adds some great new features. Now the project is written purely in c++, but I'm mostly a C# fan, so I've been looking for methods to use it instead of c++. Recently i stumbled upon EasyHook which is project that allows you to do function hooking in C#, in some very easy steps. I've done some preliminary testing, and using it with current(3.2.2.10505) WoW doesn't trigger Warden, even if injected when the process starts, before Warden does it initial check, I haven't made a c++ injection into WoW myself, so i don't know if that's safe as well, and if it is, EasyHook is still a great and easy way to do function hooking in C#. I hope someone might find it useful. Also, this helps towards my 5 posts.

- Neverhaven

[Viano]

Show me how to hook EndScene() with this and I will kiss you

[Cypher]

Show me how to hook EndScene() with this and I will kiss you

How about you stop being so lazy and have a go at doing it yourself?

You'll never learn anything if you don't challenge yourself.

[Viano]

How about you stop being so lazy and have a go at doing it yourself?

You'll never learn anything if you don't challenge yourself.

Currently reading: Lena's Reversing Tutorial.

[Neverhaven]

I have to agree with Cypher, the best way to learn is by doing it yourself. There's some pretty neat tutorials on the site. And working from them is easy enough as well. If you have any questions related to using EasyHook, I'll be more than glad to try and help you out.

[Cypher]

Currently reading: Lena's Reversing Tutorial.

Ummm. So?

Who ****ing cares what you're reading, it has NO bearing on what I said. Stop asking stupid questions and HAVE A GO. Then, if you're still failing, come back, say what you tried, and people might be able to give you a targeted push in the right direction.

Getting someone else to do it for you though will get you nowhere.

[zenteoxero]

I have a question related to EndScene...
What is the point? Why do we need to hook it?

[Cypher]

I have a question related to EndScene...
What is the point? Why do we need to hook it?

You should also stop asking stupid questions. The answer lies in this section, do some searching and you'll find what you're looking for.

[zenteoxero]

You should also stop asking stupid questions. The answer lies in this section, do some searching and you'll find what you're looking for.

Quite hard with a minute between each search... xD

[Scorpiona]

I suggest you look into project babbot, it has the plus side of not working so you can't copypasta, but will show you a simple way of injecting with EasyHook; and you can figure out the EndScene hook from there.

[Viano]

Ummm. So?

Who ****ing cares what you're reading, it has NO bearing on what I said. Stop asking stupid questions and HAVE A GO. Then, if you're still failing, come back, say what you tried, and people might be able to give you a targeted push in the right direction.

Getting someone else to do it for you though will get you nowhere.

You stated that I am lazy, I am reading and gaining knowledge in my own so I am NOT lazy.

I was trying to hook CreateDevice and from there EndScene with the help of EasyHook but failed hard as the following thread shows http://www.mmowned.com/forums/wow-me...atedevice.html. And ramey's suggestion did not help a bit :/

[Nesox]

just copy paste it from babbot -.-

[flukes1]

You stated that I am lazy, I am reading and gaining knowledge in my own so I am NOT lazy.

This may be the case but you're still asking questions which are answered on this forum. A reversing tutorial is not really going to help you with hooking D3D calls.

I was trying to hook CreateDevice and from there EndScene with the help of EasyHook but failed hard as the following thread shows http://www.mmowned.com/forums/wow-me...atedevice.html. And ramey's suggestion did not help a bit :/

So you've understood that the key to hooking EndScene is finding it in the first place. That's a good first step.

In my opinion, hooking CreateDevice is a waste of time. It's unnecessary as there is a much cleaner way to get the device pointer. WoW has a function called CGxDeviceD3d::ICreateD3dDevice - reverse it and you'll find out where it stores the device pointer in memory.

Once you have that information, you can easily grab WoW's IDirect3DDevice9 pointer at any time with a few memory reads. From there, finding EndScene is relatively easy. It's stored at index 42 in the device's VMT.

Hope that helps.

zenteoxero: WoW's main thread calls EndScene before a frame is rendered. Hooking it provides 2 benefits: you can run code on WoW's main thread, and you can render stuff just before each frame is pushed to the graphics driver.

[GliderPro]

I looked at this to see how they were doing things. They have a driver (service actually) for manipulating process memory. On top of that is a C++ DLL that exposes a class for talking to the driver. That class is then mapped into C# with pinvoke. There is also a C++ DLL that gets injected into the target process, fires up the the .NET runtime, and then calls into a C# class which finally loads your code into the process. In the end there are 4-5 DLLs which make up the EasyHook code. I haven't read the code enough to be sure what the driver buys them. I didn't see anything that absolutely needed to be done from the kernel space.

All in all the code seems well thought out and designed.

[Cypher]

I looked at this to see how they were doing things. They have a driver (service actually) for manipulating process memory. On top of that is a C++ DLL that exposes a class for talking to the driver. That class is then mapped into C# with pinvoke. There is also a C++ DLL that gets injected into the target process, fires up the the .NET runtime, and then calls into a C# class which finally loads your code into the process. In the end there are 4-5 DLLs which make up the EasyHook code. I haven't read the code enough to be sure what the driver buys them. I didn't see anything that absolutely needed to be done from the kernel space.

All in all the code seems well thought out and designed.

I haven't looked into the implementation either but the main page claims they can hook across terminal sessions. I'd say that's one of the things they use the driver for.