[C# DLL] aHook, use ASM through EndScene hook menu

User Tag List

Page 1 of 6 12345 ... LastLast
Results 1 to 15 of 82
  1. #1
    JuJuBoSc's Avatar Banned for scamming CoreCoins Purchaser
    Reputation
    1019
    Join Date
    May 2007
    Posts
    922
    Thanks G/R
    1/3
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)

    [C# DLL] aHook, use ASM through EndScene hook

    Hello,


    Here is a little dll based on BlackMagic for hooking the EndScene using static address.

    It allow to run asm code through the EndScene, have fun with it.

    I'll post the source once the last "problem" is fixed, under Win 7 / Vista WoW need to be run as admin, i assume cause of some win API used, i need to do something for grant WoW privilege.

    Of course it's easier using injected dll with MS Detours, but anyway i'll post it i'm sure it can be usefull for someone.

    Here is sample code to use Lua_DoString :

    Code:
    using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Text;
    using aHook;
    
    namespace TestaHook
    {
        class Program
        {
            static void Main(string[] args)
            {
    
                Hook EndScene = new Hook(aProcess.GetProcessIdByName("Wow"));
    
                UInt32 pDevicePtr = EndScene.BlackMagic.ReadUInt(0x00C76668);
                pDevicePtr = EndScene.BlackMagic.ReadUInt(pDevicePtr + 0x397C);
    
                UInt32 EndSceneAddr = EndScene.BlackMagic.ReadUInt(pDevicePtr);
                EndSceneAddr = EndScene.BlackMagic.ReadUInt(EndSceneAddr + 0xA8);
    
                Console.WriteLine(EndScene.Hook_Install(EndSceneAddr).ToString());
    
    
                    // Command to send using LUA
                    String Command = "print(\"EndScene hooked!\");";
    
                    // Allocate memory for command
                    uint DoString_space = EndScene.BlackMagic.AllocateMemory(Encoding.UTF8.GetBytes(Command).Length + 1);
    
                    // Write command in the allocated memory
                    EndScene.BlackMagic.WriteBytes(DoString_space, Encoding.UTF8.GetBytes(Command));
    
                    // Write the asm stuff for Lua_DoString
                    EndScene.Hook_AsmAddLine("mov eax, " + DoString_space);
                    EndScene.Hook_AsmAddLine("push 0");
                    EndScene.Hook_AsmAddLine("push eax");
                    EndScene.Hook_AsmAddLine("push eax");
                    EndScene.Hook_AsmAddLine("mov eax, 0x007F1F40"); // Lua_DoString
                    EndScene.Hook_AsmAddLine("call eax");
                    EndScene.Hook_AsmAddLine("add esp, 0xC");
                    EndScene.Hook_AsmAddLine("retn");
    
                    // Inject the shit
                    EndScene.Hook_AsmInject();
    
                    // Free memory allocated for command
                    EndScene.BlackMagic.FreeMemory(DoString_space);
    
                    // Uninstall the hook
                    EndScene.Hook_Remove();
    
                Console.ReadLine();
    
            }
        }
    }

    It's based on ASM detour by Shynd, so credit to Shynd
    Attached Files Attached Files
    Last edited by JuJuBoSc; 01-04-2010 at 05:08 PM.

    [C# DLL] aHook, use ASM through EndScene hook
  2. #2
    Rival-Fr's Avatar Banned
    Reputation
    15
    Join Date
    Apr 2009
    Posts
    119
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thank you good job as always. I'll try that.

  3. #3
    bolototo's Avatar Banned
    Reputation
    0
    Join Date
    May 2009
    Posts
    30
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Code:
    0x007F1F40"); // Lua_DoString
    is not 0x007F1A50 ?

  4. #4
    JuJuBoSc's Avatar Banned for scamming CoreCoins Purchaser
    Reputation
    1019
    Join Date
    May 2007
    Posts
    922
    Thanks G/R
    1/3
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Hmm no from lua_RunScript I got :

    Code:
    .text:00483BCC                 push    0
    .text:00483BCE                 push    eax
    .text:00483BCF                 push    eax
    .text:00483BD0                 call    sub_7F1F40

  5. #5
    Ellesar1's Avatar Member
    Reputation
    20
    Join Date
    Feb 2009
    Posts
    78
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    You should explain how you get your offset since your code will not be usable anymore when the next patch arrives.

    Regarding EndScene hooking, there's a question on stackoverflow, listing several method which are mentioned on this and other sites, so maybe you could take it as some conclusion about what methods are there to achieve an EndScene hook.

  6. #6
    Grape's Avatar Member
    Reputation
    1
    Join Date
    May 2007
    Posts
    13
    Thanks G/R
    0/0
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Thanks for the tutorial! I'm wondering how you would go about returns such as.

    if i used GetPlayerMapPosition("player") is there a way i can get the return from this hook.

  7. #7
    JuJuBoSc's Avatar Banned for scamming CoreCoins Purchaser
    Reputation
    1019
    Join Date
    May 2007
    Posts
    922
    Thanks G/R
    1/3
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Use GetLocalizedText, you can use it using Asm as for DoString in the hook.

  8. #8
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1356
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/4
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by JuJuBoSc View Post
    Use GetLocalizedText, you can use it using Asm as for DoString in the hook.
    GetLocalText pollutes the global lua scope and causes taint (and may well also interfere with any addons the user has installed).

    A much better way is to wrap Lua calls in a custom callback and use Lua's 'tostring' function to get all the args.

    The best way however is simply to reimplement FrameScript__Execute manually so that you never call Lua's 'settop' function to clear the arguments until you've already pulled them out.

  9. #9
    Nesox's Avatar ★ Elder ★
    Reputation
    1280
    Join Date
    Mar 2007
    Posts
    1,238
    Thanks G/R
    0/3
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    btw.. can you hook a function with his?

  10. #10
    JuJuBoSc's Avatar Banned for scamming CoreCoins Purchaser
    Reputation
    1019
    Join Date
    May 2007
    Posts
    922
    Thanks G/R
    1/3
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by Cypher View Post
    GetLocalText pollutes the global lua scope and causes taint (and may well also interfere with any addons the user has installed).

    A much better way is to wrap Lua calls in a custom callback and use Lua's 'tostring' function to get all the args.

    The best way however is simply to reimplement FrameScript__Execute manually so that you never call Lua's 'settop' function to clear the arguments until you've already pulled them out.
    I think it's really hard to implement it using only Asm with BlackMagic.

    Btw will test it using MS Detours and LUA lib directly thanks for the hint.

  11. #11
    Nesox's Avatar ★ Elder ★
    Reputation
    1280
    Join Date
    Mar 2007
    Posts
    1,238
    Thanks G/R
    0/3
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    can you hook a function with this eg. check what the arguments passed to it are each time it's being called?

  12. #12
    JuJuBoSc's Avatar Banned for scamming CoreCoins Purchaser
    Reputation
    1019
    Join Date
    May 2007
    Posts
    922
    Thanks G/R
    1/3
    Trade Feedback
    1 (100%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    No it only execute Asm code in main thread when function is called using global event.

  13. #13
    Cypher's Avatar Kynox's Sister's Pimp
    Reputation
    1356
    Join Date
    Apr 2006
    Posts
    5,368
    Thanks G/R
    0/4
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Originally Posted by JuJuBoSc View Post
    I think it's really hard to implement it using only Asm with BlackMagic.

    Btw will test it using MS Detours and LUA lib directly thanks for the hint.
    Huh?

    First off, you don't need detours, you need to write a REPLACEMENT of FrameScript__Execute. Not hook it.

    Second, the Lua lib is useless to you. Blizzard use a modified Lua struct, you need to reverse engineer FrameScript__Execute, and find their implementations of the Lua API in the game, then use those.

    At any rate, a wrapper shouldn't be too hard to do, yes it's a pain in the ass to do in ASM, but it's not as difficult as you're implying (assuming you have a decent grasp of it).

  14. #14
    -Ryuk-'s Avatar Elite User CoreCoins Purchaser Authenticator enabled
    Reputation
    529
    Join Date
    Nov 2009
    Posts
    1,028
    Thanks G/R
    38/51
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Im gonna sound like a total noob, But how easy would this be for warden to detect?
    |Leacher:11/2009|Donor:02/2010|Established Member:09/2010|Contributor:09/2010|Elite:08/2013|

  15. #15
    lanman92's Avatar Active Member
    Reputation
    50
    Join Date
    Mar 2007
    Posts
    1,033
    Thanks G/R
    0/1
    Trade Feedback
    0 (0%)
    Mentioned
    0 Post(s)
    Tagged
    0 Thread(s)
    Didn't someone say that they're scanning for random RWX memory in their process now? Maybe I'm imagining things... You can fix it with a hook on NtQueryVirtualMemory anyways, so it's irrelevant.

Page 1 of 6 12345 ... LastLast

Similar Threads

  1. [Sample Code] EndScene Hook with ASM and blackmagic
    By RivaLfr in forum WoW Memory Editing
    Replies: 89
    Last Post: 05-13-2021, 03:26 PM
  2. CEGUI - EndScene Hook - DLL Function Call
    By Orix in forum WoW Memory Editing
    Replies: 5
    Last Post: 02-12-2011, 03:51 PM
  3. [Test Theory] EndScene hook without Native Code (Kinda)
    By Apoc in forum WoW Memory Editing
    Replies: 7
    Last Post: 09-04-2009, 12:46 PM
  4. EndScene Hook not changing anything
    By lanman92 in forum WoW Memory Editing
    Replies: 32
    Last Post: 06-01-2009, 11:46 PM
  5. Some Useful ASM info
    By Hausmaster in forum WoW Memory Editing
    Replies: 1
    Last Post: 03-23-2008, 06:32 PM
All times are GMT -5. The time now is 06:46 PM. Powered by vBulletin® Version 4.2.3
Copyright © 2024 vBulletin Solutions, Inc. All rights reserved. User Alert System provided by Advanced User Tagging (Pro) - vBulletin Mods & Addons Copyright © 2024 DragonByte Technologies Ltd.
Digital Point modules: Sphinx-based search