To detour Script_GetGUIDFromToken but did not succeed

[34D]

typedef bool(__fastcall* token2guid)(const char*, unsigned int, ObjectGuid*, bool);
token2guid TokenGUIDFunc = (token2guid)(void*)offsets::GetGUIDFromToken;//(rebase)

bool __fastcall testFunc(const char* token, unsigned int Unknown1, ObjectGuid* guid, bool Unknown2)
{
	return TokenGUIDFunc(token, Unknown1, guid, Unknown2);
}

void Hook()
{
	DetourTransactionBegin();
	DetourUpdateThread(GetCurrentThread());
	DetourAttach(&(PVOID&)TokenGUIDFunc, testFunc);
	DetourTransactionCommit();
}

I tried detours4.01 but there is No effect

then I want to rewrite some, but can’t write memory Error.

bool Hook(void* toHook, void* hk_func, int len) {
	if (len < 13)
		return false;

	DWORD curProtection;
	VirtualProtect(toHook, len, PAGE_EXECUTE_READWRITE, &curProtection);

	memset(toHook, 0x90, len);
	unsigned char patch[] = {
		0x50, 0x48, 0xb8, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
		0xFF, 0xE0
	};
	*(DWORD64*)&patch[3] = (DWORD64)hk_func;
	memcpy((void*)toHook, patch, sizeof(patch));
	DWORD temp;
	VirtualProtect(toHook, len, curProtection, &temp);
	return true;
}

[Jadd]

https://www.ownedcore.com/forums/wor...ml#post4223754 (BFA retail -- WriteProcessMemory from injected dll fails)

[34D]

https://www.ownedcore.com/forums/wor...ml#post4223754 (BFA retail -- WriteProcessMemory from injected dll fails)

Thanks for the reply, the simple road will not work anymore

[GlittPrizes]

Thanks for the reply, the simple road will not work anymore

I know it's not ideal, but the time spent trying to maintain a working CRC spoof might be better spent just making a handler to register your own versions of functions that would normally be used by GUIDFromToken if you wanted to use this function in a different manner such as the object pointer. There is some info here regarding patching the debugger features which would get you started on writing a client hook, but it's also known that this is a red flag, so even if you can accomplish it you might jeopardize your bot because a rogue client will be a bigger target than an unknown process/dll.

Maybe there is some OC wizard that has been able to dump Warden from memory and use reflection to fool it's signature scanner, but there are so many moving parts in that equation that it's beyond most people's ability. For me, I will just have to be content with re-registering a shit ton of functions