quentin
/
maniackplanet
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

Message wrapper called but crash ManiaPlanet

This commit is contained in:
Quentin 2017-10-19 18:27:37 +02:00
parent 2b747cf568
commit 2ad9977ff9
1 changed files with 34 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

46
Observer/dllmain.cpp
View File

@ -2,9 +2,9 @@
#include "stdafx.h"
#include <iostream>
#include <fstream>
/*
void __stdcall LogMessageWrapperHook() {
std::cout << "Message wrapped called" << std::endl;
std::cout << "[OK] Message wrapped called :D :D :D" << std::endl;
}
__declspec(naked) void TrampolineLogMessageWrapperHook()
@ -27,7 +27,7 @@ __declspec(naked) void TrampolineLogMessageWrapperHook()
// Not really sure...
RET
}
}*/
}
void initDll() {
AllocConsole();
@ -37,24 +37,46 @@ void initDll() {
freopen_s(&console, "CONOUT$", "w", stdout);
freopen_s(&console, "CONOUT$", "w", stderr);
std::cout << "Observer.dll was successfully injected, time to patch now..." << std::endl;
return;
/*
unsigned int* addressToPatch = (unsigned int*)0x403b70;
std::cout << "[OK] Observer.dll was successfully injected, time to patch now..." << std::endl;
unsigned char* addressToPatch = (unsigned char *)0x403b70;
DWORD oldProtection = 0;
if (*addressToPatch != 0x56 || *(addressToPatch + 1) != 0xff) {
std::cout << "[ERR] Did not found 0x56 0xff which are the searched opcodes..." << std::endl;
return;
}
else {
std::cout << "[OK] Found the searched opcodes 0x56 0xff" << std::endl;
}
// Enable writing in memory
if (!VirtualProtect(addressToPatch, 5, PAGE_EXECUTE_READWRITE, &oldProtection)) {
std::cout << "Failed to change VirtualProtect status while attempting to patch your binary" << std::endl;
std::cout << "[ERR] Failed to change VirtualProtect BEFORE writing memory" << std::endl;
return;
}
else {
std::cout << "[OK] Successfully changed VirtualProtect BEFORE writing memory" << std::endl;
}
// Change the instruction by JMP Trampoline
*addressToPatch = 0xE9; // JMP INT32
*(addressToPatch + 1) = (unsigned int)TrampolineLogMessageWrapperHook - ((unsigned int)addressToPatch + 5);
*/
*addressToPatch = 0xE9; // JMP INT32 --- char = 1 octet
*(unsigned int*) (addressToPatch + 1) = (unsigned int) TrampolineLogMessageWrapperHook - ((unsigned int) addressToPatch + 5);
std::cout << "[OK] Memory written." << std::endl;
std::cout << "[INF] Patched function: 0x" << std::hex << (int)addressToPatch << std::endl;
std::cout << "[INF] Trampoline function: 0x" << std::hex << ((int)TrampolineLogMessageWrapperHook) << std::endl;
std::cout << "[INF] Relative jump: 0x" << std::hex << *(unsigned int*)(addressToPatch + 1) << std::endl;
// Reprotect memory
if (!VirtualProtect(addressToPatch, 5, oldProtection, &oldProtection)) {
std::cout << "[ERR] Failed to change VirtualProtect AFTER writing memory" << std::endl;
return;
}
else {
std::cout << "[OK] Successfully changed VirtualProtect AFTER writing memory" << std::endl;
}
}
BOOL APIENTRY DllMain( HMODULE hModule,