ep!chack
How do I cheat?
![]() Reputation: 1
Joined: 11 Sep 2015
Posts: 4
|
 Posted: Thu May 04, 2017 10:12 am Post subject: Function pointer, parameters to non-volatile registers |
 |
|
So there is this online game that includes a chat box. I have already written a C# program that writes (WriteProcessMemory) a chat message (timestamp, channel+filter and the message itself) to the chatlog 'tail', and then it increments the 'tail' value with the number of bytes written.
The problem is that the message I(my program) write does not actually get displayed until the next 'proper' chatmessage appears. So yeah, I can't expect WriteProcessMemory to actually refresh/update the chat box,  so I did an Ultimap scan and narrowed it down to these 4 results.
proc.exe+76C1A0 //most likely this, if I want to properly add a message
proc.exe+E4E1A0
proc.exe+E50B50
proc.exe+E50CE0
I am not experienced in assembly so I might be going off the rail here, but I can make somewhat sense of the start of the function at +76C1A0. It looks like this:
4 parameters, as far as I understand.
This is what a trace looks like, when a chat message is added normally(in-game)
R13 is obviously a pointer to the "input buffer". The others? well, I'll worry about them later. I suspect I can do a pointer scan/path for them later and then just pass them on, when I've figured out how to call this function properly.
CreateRemoteThread doesn't seem to accept >1 parameter without a hassle so I made a C++ DLL to inject and it calls the function like this:
| Code: | DWORD WINAPI MyThread(LPVOID)
{
CallFunction(0xDEADBEE1, 0xDEADBEE2, 0xDEADBEE3, 0xDEADBEE4);
FreeLibraryAndExitThread(g_hModule, 0);
return 0;
}
void __vectorcall CallFunction(intptr_t param1, intptr_t param2, intptr_t param3, intptr_t param4)
{
typedef void(__vectorcall *pFunctionAddress)(intptr_t, intptr_t, intptr_t, intptr_t);
pFunctionAddress pMySecretFunction = (pFunctionAddress)(0x13FC7C1A0);//TODO: actually proc.exe+0x76C1A0
pMySecretFunction(param1, param2, param3, param4);
} |
I've tried changing some parameter types to HWND and long but the trace looks the same.
This is what the trace looks like, when I inject this DLL and start it in it's new thread:
This obviously causes a crash...
Is there any way to call this function with the parameters ending up in the intended registers?
I've been reading about calling conventions and it doesn't seem like I can.
Does that mean that this I'm calling the wrong ASM function and should be looking for something different?
I am just looking for a solution to have my written chatmessage displayed to the user, in the in-game chat box, as soon as it's written to memory - or passed to a function pointer.
Thanks in advance for any suggestion, tips or general help.
:EDIT: I figured I can actually call the function this way, with the correct pointers But somewhere a little further down the trace it crashes. hmm
|
|
FAQ
Search
Memberlist
Usergroups
Register
Profile
Log in to check your private messages
Log in
