Being a big fan of ADetours, created by Azorbix, I've ported it to ring0 a while ago & now i've enhanced it a bit to make a release.
What it does now:
ADetourKernelFunc:
- auto-detect opcode size
- lock pages in memory before accessing them (needed for detours over pageable memory like win32k.sys)
ARetourKernelFunc:
- you can now decide wheter to free or redirect the trampoline.
Usage:
in your .h file:
Código PHP:
#include "adetours.h"
// define Example1 functions and init the Org_Example1 address to 0x101010
// > 1st arg: function name
// > 2nd arg: return type
// > 3rd arg: arguments with "( )"
// > 4th arg: original function address
// > 5th arg: calling convention (this is optional) ADETOUR_DEFINE_AND_INIT(Example1, BOOLEAN, (IN LONG arg1), 0x101010, NTAPI);
// define Example2 functions and don't init Org_Example2
// > we could also add a ", NTAPI" here,
// > but as it is optional, we don't do it this time ADETOUR_DEFINE(Example2, VOID, (IN LONG arg1) ); in your .cpp/.c file:
Código PHP:
void AddDetours() {
AttachToGui();
// set detour & auto-detect opcode size
ADETOUR_HOOK(Example1);
// init Org_Example2
Org_Example2 = (Example2_Func)0x202020;
// set detour & use 8 as opcode length (minimal value is 5)
ADETOUR_HOOK_LEN(Example2, 8);
DetachFromGui();
} void RemoveDetours() {
AttachToGui();
// remove detour & don't free trampoline and redirect it to Org_Example1
ADETOUR_UNHOOK(Example1, false);
// remove detour with given opcode length & free trampoline
ADETOUR_UNHOOK_LEN(Example2, 8, true);
DetachFromGui();
} BOOLEAN NTAPI My_Example1(IN LONG arg1)
{
return Trmp_Example1(arg1);
} VOID NTAPI My_Example2(IN LONG arg1)
{
return Trmp_Example2(arg1);
} helper funcs, if you are going for win32k.sys stuff: (you should know what this is.
if not check Sheppard's Ring 0 Tool for Diablo 2: Ring 0 Hack for Diablo 2 (Sourcecode) - Game Deception - Forums)
Código PHP:
void AttachToGui()
{
_asm
{
CLI
MOV EAX, CR0
AND EAX, NOT 10000H
MOV CR0, EAX
}
KeAttachProcess((PEPROCESS)GUIEprocess);
}
void DetachFromGui()
{
KeDetachProcess();
_asm
{
MOV EAX, CR0
OR EAX, 10000H
MOV CR0, EAX
STI
}
} Credits
Matthew L (Azorbix)
Dom1n1k
LanceVorgin
P47R!CK
rain
Ms-Rem
Changelog
1.0 - first release
1.1 - rewrote page locking functions
0 comentarios:
Publicar un comentario