Speedhack

[Burningmace]

Most speed hacks for WoW seem to be related to packet injection, either through a patched winsock provider or by calling WoW's packet functions directly via code injection. This seems a somewhat awkward method of doing things.

What I think might be a (better?) way to do it is by hooking calls to GetTickCount and returning a fake result. Cheat Engine utilises this trick for its speed hack. Here's some pseudo code to describe the math:

long initTicks = 0;
float multiplier = 1.0f;
public void StartSpeedHack()
{
    initTicks = GetTickCount();
    InstallHook();
}
public long GetFakeTickCount()
{
    float tc = (long)Math.Round((float)(GetTickCount() - initTicks) * multiplier);
}

What I can't work out is the best way to approach the hook itself in managed code. I've read in many places that global system hooks are impossible in managed code. Is it possible to inject code for a fake GetTickCount and then patch all calls to it at runtime so that they go to the fake method instead of the real imported one?

If it is possible to just alter the calls in the process memory, since a call to an extern (0x15FF) is different to a standard call (0xE are there any ramifications of replacing such values?

[MaiN]

I believe that Warden watches those for detours, which is the reason why it is not used.

[kynox]

I believe that Warden watches those for detours, which is the reason why it is not used.

Not the detour, but the modified return value.

[Burningmace]

Ah, thanks for the info. I wasn't aware that Warden checked for such changes.

For future reference though, are there any ramifications of replacing an extern call with a standard call? Could I replace a call to an import in the format of 15 FF <Address> with a call to a proc using 90 E8 <Address> without screwing things up? Or would it have to be E8 <address> 90? I'd guess that the position of the NOP doesn't matter, but there may be something that I overlooked.

[Burningmace]

Ignore this. Damn browser made me double post

[DEMON_PK]

so Warden will know if i use CE speedhack?)

[!@^^@!]

You should't be here DEMON_PK... and how hard can it be to add 2 and 2? /shoo

[DEMON_PK]

What's up scooooby doo
I used CE speedhack many times without been banned.

[!@^^@!]

It's called delayed banning...

[DEMON_PK]

I hope it is not..
anyway i want create my own sh with method that dont monitored yet, or i will use CE again.