Cheat Engine

hcong · Newbie cheater Reputation: 0 Joined: 12 Mar 2006 Posts: 21

Dark Byte, you know how to unhook api function?

i have tried to back up the 1st 6 bytes of the function, but when i try to write back the 6 bytes, i get access violation, because the VirtualProtect also hooked, i don't know what else can i do Sad

Dark Byte · Posted: Tue Sep 26, 2006 3:24 am Post subject:

make a copy of the original bytes (using the disasembler/assembler combination) and then when you want to call the function you call the rewritten code.

or you can write a devicedriver that simulates virtualprotect for you allowing you to make memory writable

hcong · Newbie cheater Reputation: 0 Joined: 12 Mar 2006 Posts: 21

Dark Byte · Posted: Tue Sep 26, 2006 8:34 am Post subject:

missing stdcall;

hcong · Newbie cheater Reputation: 0 Joined: 12 Mar 2006 Posts: 21

thanks Dark Byte, it work well now, i seldom program in delphi, so i not really know what the stdcall use for Confused

Dark Byte · Posted: Tue Sep 26, 2006 10:15 am Post subject:

to use the standard calling method used by windows.

also, if you plan on using this method on nprotect thats not going to work. That specific api is also hooked in kernelmode

hcong · Newbie cheater Reputation: 0 Joined: 12 Mar 2006 Posts: 21

you mean if i want to bypass nProtect, i need to unhook in both usermode and kernelmode?

Sad

i didn't learn how to write devicedriver yet

any suggestion on where to start? i cannot find any ebook or tutorial on internet Sad

Dark Byte · Posted: Tue Sep 26, 2006 11:29 am Post subject:

i'm not sure. I know it is hooked, but some people say they can use it with that method, so theyr hook must be crappy.

anyhow, you could rewrite a unused sdt entry with the address of sendinput, and then change the eax value to that unused entry

I know you don't understand this, but when you do, this is the best solution. (and you can always try to disable their driver)

hcong · Newbie cheater Reputation: 0 Joined: 12 Mar 2006 Posts: 21