Cheat Engine

hevnfkxu · How do I cheat? Reputation: 0 Joined: 08 Aug 2007 Posts: 4

SYSTEMSERVICEIDX(0x1XXX)

Doesn't seem to work...

I tried to google about win32k service table.. but

I got so confused...

Please help!

Noz3001 · Posted: Sun Aug 12, 2007 4:03 am Post subject:

http://www.metasploit.com/users/opcode/syscalls.html

You can get the system call numbers for your OS there.

You can just use

UnLmtD · Posted: Sun Aug 12, 2007 8:05 am Post subject:

win32k, thats KeServiceDescriptorTableShadow. You get the Call numbers from disassembling "user32.dll" It's not exported btw.

hevnfkxu · How do I cheat? Reputation: 0 Joined: 08 Aug 2007 Posts: 4

UnLmtD

Could you tell me how to get the KeServiceDescriptorTableShadow properly?

I know the Service Number but I don't know how to hook it.

PSERVICE_DESCRIPTORTABLE KeServiceDescriptorTableShadow

pCurrentThread = KeGetCurrentThread();
KeServiceDescriptorTableShadow = pCurrentThread->ServiceTable

I did this.. but.. I get BSOD When I try to even read off that address

DbgPrint("NewNtUserXXX: %X\n",KeServiceDescriptorTableShadow->win32k.ServiceTable[0x1B3]);// BSOD!!!