NooBpluSS Cheater
Reputation: 0
Joined: 24 Jun 2007 Posts: 37
|
Posted: Thu Jun 04, 2009 8:30 pm Post subject: [Help] Using a jmp to do it or other method |
|
|
It's the code :
| Code: |
if ((LoadedAddress <> nil) and (ExportedAddress <> nil)) then
begin
if ((ExportedAddress^ <> 0) and (LoadedAddress^ <> 0) and (ExportedAddress^ <> LoadedAddress^)) then
begin
Result := True;
WriteLn('Unhooking ', FunctionName, '...');
WriteLn('');
CodeLen := SizeOfProc(LoadedAddress);
try
VirtualProtect(ExportedAddress, CodeLen, PAGE_EXECUTE_READWRITE, @OldProtection);
CopyMemory(ExportedAddress, LoadedAddress, CodeLen);
VirtualProtect(ExportedAddress, CodeLen, OldProtection, @OldProtection);
except
end;
end;
end;
|
well...
I can find the api hooked in user mode but I use VirtualProtect to restore it and ViertualProtect is hooked too ... -.-'
How can I do a jmp to do it ?
or other method ?
and first I need unhook in user mode or in kernel mode ?
thanks.
_________________
Newbie cheater ;] |
|