Click here to Skip to main content
15,895,772 members
Home / Discussions / C / C++ / MFC
   

C / C++ / MFC

 
QuestionRandom number? Pin
LudaLuda25-Feb-04 9:56
LudaLuda25-Feb-04 9:56 
AnswerRe: Random number? Pin
Christian Graus25-Feb-04 10:12
protectorChristian Graus25-Feb-04 10:12 
AnswerRe: Random number? Pin
John M. Drescher25-Feb-04 11:13
John M. Drescher25-Feb-04 11:13 
GeneralCalcFixedLayout and CalcDynamicLayout Pin
ozamgal25-Feb-04 9:06
ozamgal25-Feb-04 9:06 
GeneralMicrosoft SDK/DDK for AMD64 Pin
Alexander M.,25-Feb-04 9:04
Alexander M.,25-Feb-04 9:04 
GeneralRe: Microsoft SDK/DDK for AMD64 [EDITED] Pin
John M. Drescher25-Feb-04 11:19
John M. Drescher25-Feb-04 11:19 
GeneralRe: Microsoft SDK/DDK for AMD64 Pin
John M. Drescher25-Feb-04 11:25
John M. Drescher25-Feb-04 11:25 
GeneralCheat Pin
Anonymous25-Feb-04 6:00
Anonymous25-Feb-04 6:00 
OK, I'm tryin to make a cheat-program wich should be able to bypass an anti-cheatprogram. I have the source code but I dont know wich lines I can edit to make it able to bypass it and still work correctly...
This is the file which should be edited:

#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <stdio.h>
#include "apihijack.h"

// This function must be __cdecl!!!
void __cdecl DelayLoadProfileDLL_UpdateCount( PVOID dummy );

PIMAGE_IMPORT_DESCRIPTOR g_pFirstImportDesc;

//===========================================================================
// Given an HMODULE, returns a pointer to the PE header

PIMAGE_NT_HEADERS PEHeaderFromHModule(HMODULE hModule)
{
PIMAGE_NT_HEADERS pNTHeader = 0;
if (hModule == NULL)
return pNTHeader;
__try
{
if (PIMAGE_DOS_HEADER(hModule)->e_magic != IMAGE_DOS_SIGNATURE)
__leave;

pNTHeader = PIMAGE_NT_HEADERS(PBYTE(hModule)
+ PIMAGE_DOS_HEADER(hModule)->e_lfanew);

if (pNTHeader->Signature != IMAGE_NT_SIGNATURE)
pNTHeader = 0;
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
}

return pNTHeader;
}

//===========================================================================
// Builds stubs for and redirects the IAT for one DLL (pImportDesc)

bool RedirectIAT(SDLLHook* DLLHook, PIMAGE_IMPORT_DESCRIPTOR pImportDesc, PVOID pBaseLoadAddr)
{
PIMAGE_THUNK_DATA pIAT; // Ptr to import address table
PIMAGE_THUNK_DATA pINT; // Ptr to import names table
PIMAGE_THUNK_DATA pIteratingIAT;

// Figure out which OS platform we're on
OSVERSIONINFO osvi;
osvi.dwOSVersionInfoSize = sizeof(osvi);
GetVersionEx(&osvi);

// If no import names table, we can't redirect this, so bail
if (pImportDesc->OriginalFirstThunk == 0)
return false;

pIAT = MakePtr(PIMAGE_THUNK_DATA, pBaseLoadAddr, pImportDesc->FirstThunk);
pINT = MakePtr(PIMAGE_THUNK_DATA, pBaseLoadAddr, pImportDesc->OriginalFirstThunk);

// Count how many entries there are in this IAT. Array is 0 terminated
pIteratingIAT = pIAT;
unsigned cFuncs = 0;
while (pIteratingIAT->u1.Function)
{
cFuncs++;
pIteratingIAT++;
}

if (cFuncs == 0) // If no imported functions, we're done!
return false;

// These next few lines ensure that we'll be able to modify the IAT,
// which is often in a read-only section in the EXE.
DWORD flOldProtect, flNewProtect, flDontCare;
MEMORY_BASIC_INFORMATION mbi;

// Get the current protection attributes
VirtualQuery(pIAT, &mbi, sizeof(mbi));

// remove ReadOnly and ExecuteRead attributes, add on ReadWrite flag
flNewProtect = mbi.Protect;
flNewProtect &= ~(PAGE_READONLY | PAGE_EXECUTE_READ);
flNewProtect |= (PAGE_READWRITE);

if (!VirtualProtect(pIAT, (sizeof(PVOID) * cFuncs), flNewProtect, &flOldProtect))
{
return false;
}

// If the Default hook is enabled, build an array of redirection stubs in the processes memory.
DLPD_IAT_STUB * pStubs = 0;

// Scan through the IAT, completing the stubs and redirecting the IAT
// entries to point to the stubs
pIteratingIAT = pIAT;

while (pIteratingIAT->u1.Function)
{
void* HookFn = 0; // Set to either the SFunctionHook or pStubs.

if (!IMAGE_SNAP_BY_ORDINAL(pINT->u1.Ordinal)) // import by name
{
PIMAGE_IMPORT_BY_NAME pImportName = MakePtr(PIMAGE_IMPORT_BY_NAME, pBaseLoadAddr, pINT->u1.AddressOfData);

// Iterate through the hook functions, searching for this import.
SFunctionHook* FHook = DLLHook->Functions;
while (FHook->Name)
{
if (lstrcmpi(FHook->Name, (char*)pImportName->Name) == 0)
{

// Save the old function in the SFunctionHook structure and get the new one.
FHook->OrigFn = (void*)pIteratingIAT->u1.Function;
HookFn = FHook->HookFn;
break;
}

FHook++;
}
}

// Replace the IAT function pointer if we have a hook.
if (HookFn)
{
// Cheez-o hack to see if what we're importing is code or data.
// If it's code, we shouldn't be able to write to it
if (IsBadWritePtr((PVOID)pIteratingIAT->u1.Function, 1))
{
pIteratingIAT->u1.Function = (DWORD)HookFn;
}
else if (osvi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS)
{
// Special hack for Win9X, which builds stubs for imported
// functions in system DLLs (Loaded above 2GB). These stubs are
// writeable, so we have to explicitly check for this case
if (pIteratingIAT->u1.Function > (DWORD)0x80000000)
pIteratingIAT->u1.Function = (DWORD)HookFn;
}
}

if (DLLHook->UseDefault)
pStubs++; // Advance to next stub

pIteratingIAT++; // Advance to next IAT entry
pINT++; // Advance to next INT entry
}


// Put the page attributes back the way they were.
VirtualProtect(pIAT, (sizeof(PVOID) * cFuncs), flOldProtect, &flDontCare);

return true;
}

//===========================================================================
// Builds stubs for and redirects the IAT for one DLL (pImportDesc)

bool UnRedirectIAT(SDLLHook* DLLHook, PIMAGE_IMPORT_DESCRIPTOR pImportDesc, PVOID pBaseLoadAddr)
{
PIMAGE_THUNK_DATA pIAT; // Ptr to import address table
PIMAGE_THUNK_DATA pINT; // Ptr to import names table
PIMAGE_THUNK_DATA pIteratingIAT;

// Figure out which OS platform we're on
OSVERSIONINFO osvi;
osvi.dwOSVersionInfoSize = sizeof(osvi);
GetVersionEx(&osvi);

// If no import names table, we can't redirect this, so bail
if (pImportDesc->OriginalFirstThunk == 0)
return false;

pIAT = MakePtr(PIMAGE_THUNK_DATA, pBaseLoadAddr, pImportDesc->FirstThunk);
pINT = MakePtr(PIMAGE_THUNK_DATA, pBaseLoadAddr, pImportDesc->OriginalFirstThunk);

// Count how many entries there are in this IAT. Array is 0 terminated
pIteratingIAT = pIAT;
unsigned cFuncs = 0;
while (pIteratingIAT->u1.Function)
{
cFuncs++;
pIteratingIAT++;
}

if (cFuncs == 0) // If no imported functions, we're done!
return false;

// These next few lines ensure that we'll be able to modify the IAT,
// which is often in a read-only section in the EXE.
DWORD flOldProtect, flNewProtect, flDontCare;
MEMORY_BASIC_INFORMATION mbi;

// Get the current protection attributes
VirtualQuery(pIAT, &mbi, sizeof(mbi));

// remove ReadOnly and ExecuteRead attributes, add on ReadWrite flag
flNewProtect = mbi.Protect;
flNewProtect &= ~(PAGE_READONLY | PAGE_EXECUTE_READ);
flNewProtect |= (PAGE_READWRITE);

if (!VirtualProtect(pIAT, (sizeof(PVOID) * cFuncs), flNewProtect, &flOldProtect))
{
return false;
}

// If the Default hook is enabled, build an array of redirection stubs in the processes memory.
DLPD_IAT_STUB * pStubs = 0;

// Scan through the IAT, completing the stubs and redirecting the IAT
// entries to point to the stubs
pIteratingIAT = pIAT;

while (pIteratingIAT->u1.Function)
{
void* HookFn = 0; // Set to either the SFunctionHook or pStubs.

if (!IMAGE_SNAP_BY_ORDINAL(pINT->u1.Ordinal)) // import by name
{
PIMAGE_IMPORT_BY_NAME pImportName = MakePtr(PIMAGE_IMPORT_BY_NAME, pBaseLoadAddr, pINT->u1.AddressOfData);

// Iterate through the hook functions, searching for this import.
SFunctionHook* FHook = DLLHook->Functions;
while (FHook->Name)
{
if (lstrcmpi(FHook->Name, (char*)pImportName->Name) == 0)
{
HookFn = FHook->OrigFn;
break;
}

FHook++;
}
}
// Replace the IAT function pointer if we have a hook.
if (HookFn)
{
// Cheez-o hack to see if what we're importing is code or data.
// If it's code, we shouldn't be able to write to it
if (IsBadWritePtr((PVOID)pIteratingIAT->u1.Function, 1))
{
pIteratingIAT->u1.Function = (DWORD)HookFn;
}
else if (osvi.dwPlatformId == VER_PLATFORM_WIN32_WINDOWS)
{
// Special hack for Win9X, which builds stubs for imported
// functions in system DLLs (Loaded above 2GB). These stubs are
// writeable, so we have to explicitly check for this case
if (pIteratingIAT->u1.Function > (DWORD)0x80000000)
pIteratingIAT->u1.Function = (DWORD)HookFn;
}
}
pIteratingIAT++; // Advance to next IAT entry
pINT++; // Advance to next INT entry
}

if (DLLHook->UseDefault)
pStubs->pszNameOrOrdinal = 0; // Final stub is a sentinel

// Put the page attributes back the way they were.
VirtualProtect(pIAT, (sizeof(PVOID) * cFuncs), flOldProtect, &flDontCare);

return true;
}

//===========================================================================
// Top level routine to find the EXE's imports, and redirect them
bool HookAPICalls(SDLLHook* Hook, HMODULE hModule)
{
if (!Hook)
return false;

PIMAGE_NT_HEADERS pExeNTHdr = PEHeaderFromHModule(hModule);

if (!pExeNTHdr)
return false;

DWORD importRVA = pExeNTHdr->OptionalHeader.DataDirectory
[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
if (!importRVA)
return false;

// Convert imports RVA to a usable pointer
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = MakePtr(PIMAGE_IMPORT_DESCRIPTOR, hModule, importRVA);

// Save off imports address in a global for later use
g_pFirstImportDesc = pImportDesc;

// Iterate through each import descriptor, and redirect if appropriate
while (pImportDesc->FirstThunk)
{
PSTR pszImportModuleName = MakePtr(PSTR, hModule, pImportDesc->Name);
if (lstrcmpi(pszImportModuleName, Hook->Name) == 0)
RedirectIAT(Hook, pImportDesc, (PVOID)hModule);
pImportDesc++; // Advance to next import descriptor
}
return true;
}

//===========================================================================
// Top level routine to find the EXE's imports, and redirect them
bool UnHookAPICalls(SDLLHook* Hook, HMODULE hModule)
{
if (!Hook)
return false;

PIMAGE_NT_HEADERS pExeNTHdr = PEHeaderFromHModule(hModule);

if (!pExeNTHdr)
return false;

DWORD importRVA = pExeNTHdr->OptionalHeader.DataDirectory
[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
if (!importRVA)
return false;

// Convert imports RVA to a usable pointer
PIMAGE_IMPORT_DESCRIPTOR pImportDesc = MakePtr(PIMAGE_IMPORT_DESCRIPTOR, hModule, importRVA);

// Save off imports address in a global for later use
g_pFirstImportDesc = pImportDesc;

// Iterate through each import descriptor, and redirect if appropriate
while (pImportDesc->FirstThunk)
{
PSTR pszImportModuleName = MakePtr(PSTR, hModule, pImportDesc->Name);
if (lstrcmpi(pszImportModuleName, Hook->Name) == 0)
UnRedirectIAT(Hook, pImportDesc, (PVOID)hModule);
pImportDesc++; // Advance to next import descriptor
}
return true;
}

Thx in advance guys...
GeneralRe: Cheat Pin
Shog925-Feb-04 6:18
sitebuilderShog925-Feb-04 6:18 
GeneralRe: Cheat Pin
Prakash Nadar25-Feb-04 6:32
Prakash Nadar25-Feb-04 6:32 
GeneralRe: Cheat Pin
LunaticFringe25-Feb-04 7:14
LunaticFringe25-Feb-04 7:14 
GeneralRe: Cheat Pin
Maximilien25-Feb-04 6:18
Maximilien25-Feb-04 6:18 
GeneralRe: Cheat Pin
l a u r e n25-Feb-04 6:48
l a u r e n25-Feb-04 6:48 
GeneralRe: Cheat Pin
Alexander M.,25-Feb-04 9:02
Alexander M.,25-Feb-04 9:02 
GeneralRe: Cheat Pin
Shog925-Feb-04 9:19
sitebuilderShog925-Feb-04 9:19 
GeneralRe: Cheat Pin
Ian Darling25-Feb-04 9:53
Ian Darling25-Feb-04 9:53 
GeneralRe: Cheat Pin
Christian Graus25-Feb-04 10:13
protectorChristian Graus25-Feb-04 10:13 
GeneralRe: Cheat Pin
Steve S25-Feb-04 22:51
Steve S25-Feb-04 22:51 
GeneralRe: Cheat Pin
lukhas21-Apr-04 11:07
lukhas21-Apr-04 11:07 
GeneralDXSDK FullScreenDialog &amp; TreeControl Pin
akira3225-Feb-04 5:35
akira3225-Feb-04 5:35 
GeneralRe: DXSDK FullScreenDialog &amp; TreeControl Pin
Prakash Nadar25-Feb-04 5:55
Prakash Nadar25-Feb-04 5:55 
GeneralRe: DXSDK FullScreenDialog &amp; TreeControl Pin
akira3227-Feb-04 5:57
akira3227-Feb-04 5:57 
Generaldoc/view initialization problem Pin
Stephane Routelous25-Feb-04 5:29
Stephane Routelous25-Feb-04 5:29 
Generalline Pin
Goh Hui Beng25-Feb-04 5:11
Goh Hui Beng25-Feb-04 5:11 
GeneralRe: line Pin
David Crow25-Feb-04 5:31
David Crow25-Feb-04 5:31 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.