To tentando Hook uma dll em um GameServer 97d+99i


Ja localizei os offSets


07311658 <=> LoadlidraryA
07311620 <=> GetProcAddress
004CC1B6 <=> OffSet Limpo
004CC1C8 <=> OffSetFunçao




1ª Abrir o Game Server Com Olly e localizei os offSets achei esses.

004CC13B <=> EntryPoint
07311658 <=> LoadlidraryA
07311620 <=> GetProcAddress


2ª Localizar uma área em branco caracterizada como OffSet vazios (OffSet Limpo)


3ª Selecionei a linha do OffSet vazio cliquei com o botao direito e selecionei Foltow in Dump

em ASCII escrevi o nome da dll e a Funçao respeitando os digitos

004CC1B6 <=> OffSet Limpo Nome Da dll
004CC1C8 <=> OffSet Limpo Nome Da Funçao Da dll

================================================== =======================================
====================================ASCII========= =======================================
================================================== =======================================
CPU Dump
Address Hex dump ASCII
004CC1B6 00 00 00 00|00 00 00 00|00 00 00 00|00 00 00 00| HardPower.dll (<=Nome Da dll 13 digitos)
HardPower

CPU Dump
Address Hex dump ASCII
004CC1C8 00 00 00 00|00 00 00 00|00 00 00 00|00 00 00 00| GameServer (<=Nome Da Funçao Da dll 10 digitos)





4ª Dei um espaço de 50 OffSets



5ª Selecionei alguns OffSet Vazios ai cliquei com o botao direito digitar em (edit)=> (Fill With NOPs) esses codigos que eu vi em um tutorial.


PUSH 004CC1B6 = OffSet Limpo
CALL DWORD PTR DS:[07311658] =LoadlidraryA
OR EAX,EAX
JE 004CC13B = EntryPoint
PUSH 004CC1C8 = OffSetFunçao
PUSH EAX
CALL DWORD PTR DS:[07311620] = GetProcAddress
CALL EAX
JMP 004CC13B






CPU Disasm
Address Hex dump Command Comments
004CC1B5 00 DB 00
004CC1B6 47 INC EDI
004CC1B7 61 POPAD
004CC1B8 6D INS DWORD PTR ES:[EDI],DX ; I/O command
004CC1B9 65:53 PUSH EBX ; Superfluous segment override prefix
004CC1BB 65:72 76 JB SHORT 004CC234 ; Superfluous segment override prefix
004CC1BE 65:72 2E JB SHORT 004CC1EF ; Superfluous segment override prefix
004CC1C1 64:6C INS BYTE PTR ES:[EDI],DX ; Superfluous segment override prefix
004CC1C3 6C INS BYTE PTR ES:[EDI],DX ; I/O command
004CC1C4 00 DB 00
004CC1C5 00 DB 00
004CC1C6 00 DB 00
004CC1C7 00 DB 00
004CC1C8 52 PUSH EDX
004CC1C9 65:61 POPAD ; Superfluous segment override prefix
004CC1CB 64:79 00 JNS SHORT 004CC1CE ; Superfluous segment override prefix
004CC1CE 00 DB 00
004CC1CF 00 DB 00
004CC1D0 00 DB 00
004CC1D1 00 DB 00
004CC1D2 00 DB 00
004CC1D3 00 DB 00
004CC1D4 00 DB 00
004CC1D5 00 DB 00
004CC1D6 00 DB 00
004CC1D7 00 DB 00
004CC1D8 00 DB 00
004CC1D9 00 DB 00
004CC1DA 00 DB 00
004CC1DB 00 DB 00
004CC1DC 00 DB 00
004CC1DD 00 DB 00
004CC1DE 00 DB 00
004CC1DF 00 DB 00
004CC1E0 00 DB 00
004CC1E1 00 DB 00
004CC1E2 00 DB 00
004CC1E3 00 DB 00
004CC1E4 00 DB 00
004CC1E5 00 DB 00
004CC1E6 00 DB 00
004CC1E7 00 DB 00
004CC1E8 00 DB 00
004CC1E9 00 DB 00
004CC1EA 00 DB 00
004CC1EB 00 DB 00
004CC1EC 00 DB 00
004CC1ED 00 DB 00
004CC1EE 00 DB 00
004CC1EF 00 DB 00
004CC1F0 00 DB 00
004CC1F1 00 DB 00
004CC1F2 00 DB 00
004CC1F3 00 DB 00
004CC1F4 00 DB 00
004CC1F5 00 DB 00
004CC1F6 68 B6C14C00 PUSH 004CC1B6 ; ASCII "HardPower.dll"
004CC1FB FF15 58163107 CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar
004CC201 09C0 OR EAX,EAX
004CC203 ^ 0F84 32FFFFFF JE <ModuleEntryPoint>
004CC209 50 PUSH EAX
004CC20A 68 C8C14C00 PUSH 004CC1C8 ; ASCII "GameServer"
004CC20F 50 PUSH EAX
004CC210 FF15 20163107 CALL DWORD PTR DS:[<&KERNEL32.GetProcAdd
004CC216 FFD0 CALL EAX
004CC218 ^ E9 1EFFFFFF JMP <ModuleEntryPoint>
004CC21D 90 NOP
004CC21E 90 NOP
004CC21F 90 NOP
004CC220 90 NOP
004CC221 90 NOP
004CC222 90 NOP
004CC223 90 NOP
004CC224 90 NOP
004CC225 90 NOP
004CC226 90 NOP
004CC227 90 NOP
004CC228 90 NOP
004CC229 90 NOP
004CC22A 00 DB 00


6ª selecionei todos esses OffSets que colei aqui em cima ai cliquei em Edit Copy to executable
na nova pela que abriu apertei em Save File GameServer.



================================================== ================================================== ==============
LordPE Redefinir o EntryPoint Calculadora cientifica valor em Hex ai Subtraímos 004CC1B6 - 00400000 = CC1B6 = 000CC1B6 => Novo EntryPoint


004CC13B - 00400000 = CC13B = 000CC13B => EntryPoint

004CC1B6 - 00400000 = CC1B6 = 000CC1B6 => Novo EntryPoint


Não ta funcionando o hook no gameserver nao sei se ta serto.