 |
Cheat Engine
The Official Site of Cheat Engine
|
| View previous topic :: View next topic |
| Author |
Message |
iPromise
Grandmaster Cheater
![]() Reputation: -1
Joined: 27 Jun 2009
Posts: 529
Location: Canada
|
 Posted: Sun Nov 11, 2012 1:00 pm Post subject: BSOD for emulating a function |
 |
|
So basically i'm making a test to see if can emulate a function supported by the DDK if I have its address. The function is inside my driver and i'm emulating ZwOpenFile. Each time I invoke this emulated function I get a BSOD without any reason being specified.
Here is the code:
| Code: |
NTSTATUS NTAPI ZwOpenFileX ( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions )
{
__asm
{
jmp [ dwFuncAddr ];
}
}
|
same parameters, same everything, dwProtectMemory doesn't return 0.
dwFuncAddr:
| Code: |
RtlInitUnicodeString ( &pText, L"ZwOpenFile" );
dwFuncAddr = (DWORD) MmGetSystemRoutineAddress ( &pText );
|
|
|
| Back to top |
|
 |
Dark Byte
Site Admin
 Reputation: 471
Joined: 09 May 2003
Posts: 25837
Location: The netherlands
|
| Posted: Mon Nov 12, 2012 1:17 am Post subject: |
 |
|
You didn't declare it as a naked function
this will create the assembler code:
| Code: |
push ebp
mov ebp,esp
jmp [dwFuncAddrr]
ret 18
|
As you see, the stack will be broken
Another thing you can do without defining a naked type is the hook method, where you define dwFuncAddr as a function type with the same declaration as ZwOpenFile, and then pass the parameters you got on to the new function call
e.g:
| Code: |
typedef NTSTATUS NTAPI (*MYZWOPENPROCESS) ( PHANDLE FileHandle, ACCESS_MASK DesiredAccess, POBJECT_ATTRIBUTES ObjectAttributes,
PIO_STATUS_BLOCK IoStatusBlock, ULONG ShareAccess, ULONG OpenOptions ) ;
MYZWOPENPROCESS dwFuncAddr;
...
...
return dwFuncAddr(FileHandle, DesiredAccess, ObjectAttributes, IoStatusBlock, ShareAccess, OpenOptions);
|
_________________
Do not ask me about online cheats. I don't know any and wont help finding them.
Like my help? Join me on Patreon so i can keep helping |
|
| Back to top |
|
|
|
|
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You cannot attach files in this forum
You can download files in this forum
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
