1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107
|
#include <Windows.h>
#include <iostream>
#include <string>
#include <TCHAR.H>
using namespace std;
DWORD jmpBackAddy;
bool Hook(void * toHook, void * ourFunct, int len)
{
if (len < 5)
{
return false;
}
else
{
}
DWORD curProtection;
VirtualProtect(toHook, len, PAGE_EXECUTE_READWRITE, &curProtection);
memset(toHook, 0x90, len);
DWORD relativeAddress = ((DWORD)ourFunct - (DWORD)toHook) - 5;
*(BYTE*)toHook = 0xE9;
*(DWORD*)((DWORD)toHook + 1) = relativeAddress;
DWORD temp;
VirtualProtect(toHook, len, curProtection, &temp);
return true;
}
void __declspec(naked) ourFunct()
{
__asm
{
cmp [[0x0128CAD4]+0x2E0],32
jnc speedjmp
cmp [[0x0128CAD4]+0x2E0],22
jc s_speed
cmp [[0x0128CAD4]+0x2E0],25
Je speedwake
jmp code
speedjmp:
mov [[0x0128CAD4]+0x2E0],33
jmp code
speedwake:
mov [[0x0128CAD4]+0x2E0],24
jmp code
s_speed:
mov [[0x0128CAD4]+0x2E0],5
jmp code
code:
mov ebx,[esi+0x2E0]
jmp jmpBackAddy
}
}
DWORD WINAPI MainThread(LPVOID param)
{
int hookLength = 6; // 5 for jump + 1 remaining
DWORD hookAddress = 0x988B91;
jmpBackAddy = hookAddress + hookLength;
Hook((void*)hookAddress, ourFunct, hookLength);
//Create Console
AllocConsole();
FILE* f;
freopen_s(&f, "CONOUT$", "w", stdout);
//end console
while (true)
{
if (GetAsyncKeyState(VK_ESCAPE)) break;
Sleep(1000);
}
fclose(f);
FreeConsole();
FreeLibraryAndExitThread((HMODULE)param, 0);
return 0;
}
BOOL WINAPI DllMain(HINSTANCE hModule, DWORD dwReason, LPVOID lpReserved) {
switch (dwReason) {
case DLL_PROCESS_ATTACH:
CreateThread(0, 0, MainThread, hModule, 0, 0);
break;
}
return TRUE;
}
| |