Auto Dll injecting (Asm) matchserver and client

well ive seen a few people useing really crap methods this way is quite easy.

Client(Gunz.exe)
first goto line "574255" without quotes (ctrl + G)

you should see

Code:

---

00574255 > $ 6A 60          PUSH 60
00574257  . 68 48916000    PUSH theduel.00609148

---

nop them two lines then it should look like this

Code:

---

00574252  |. 59            POP ECX
00574253  |. 59            POP ECX
00574254  \. C3            RETN
00574255 >  90            NOP
00574256    90            NOP
00574257    90            NOP
00574258    90            NOP
00574259    90            NOP
0057425A    90            NOP
0057425B    90            NOP
0057425C  . E8 871D0000    CALL theduel.00575FE8
00574261  . BF 94000000    MOV EDI,94

---

Now make a jmp to code cave ill use the line "5E5F31"

so now you make the jmp 5E5F31 on line 574255

it now should look like this

Code:

---

00574252  |. 59            POP ECX
00574253  |. 59            POP ECX
00574254  \. C3            RETN
00574255 >  E9 D71C0700    JMP theduel.005E5F31
0057425A    90            NOP
0057425B    90            NOP
0057425C  . E8 871D0000    CALL theduel.00575FE8
00574261  . BF 94000000    MOV EDI,94

---

then goto line "5E5F31" without quotes (ctrl + G)

then you will see 5E5F22 just up from 5E5F31 so select that line right click -> Binary -> Edit
untick keep size and where it says ASCII Put your dll name
ill use "test.dll" the look where it says hex and add two 0's

picture:
http://i50.tinypic.com/333fh36.jpg

then press ok then press ctrl + A
then go to 5E5F31 again
and double click on the DB 00
and type "push 60" in the box that pops up
the press assemble then type in "PUSH 609148"
and press assemble then type in "PUSH 5E5F22"
and press assemble then type in "CALL DWORD PTR DS:[5E6168]"
and press assemble then type in "TEST EAX,EAX"
and press assemble then jmp back by typeing in "JMP 0057425C"
and press assemble.

press ctrl + a

you should now have something like this:

Code:

---

005E5F22  . 74 65 73 74 2E>ASCII "test.dll",0
005E5F2B    00            DB 00
005E5F2C    00            DB 00
005E5F2D    00            DB 00
005E5F2E    00            DB 00
005E5F2F    00            DB 00
005E5F30    00            DB 00
005E5F31  > 6A 60          PUSH 60
005E5F33  . 68 48916000    PUSH theduel.00609148
005E5F38  . 68 225F5E00    PUSH theduel.005E5F22                    ; /FileName = "test.dll"
005E5F3D  . FF15 68615E00  CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar>; \LoadLibraryA
005E5F43  . 85C0          TEST EAX,EAX
005E5F45  .^E9 12E3F8FF    JMP theduel.0057425C

---

and your done.

MatchServer
first go to line "417180" Nop that

should look like:

Code:

---

0041717E  |. 8BCE          MOV ECX,ESI
00417180    90            NOP
00417181    90            NOP
00417182    90            NOP
00417183    90            NOP
00417184    90            NOP
00417185  |. 84C0          TEST AL,AL

---

then make a JMP 5043E3 on line 00417180

then follow that 5043E3 (Ctrl + G)

remmeber that line and now go up to 005043CE and binary edit again then type in your dll name ill use test.dll look above on the client part of the dll if you need help then press ctrl + A
now go back to line 005043E3 and type double click on DB 00
and then type in "PUSHAD" press assemble then type "PUSH 5043CE"
press assemble then type in "CALL DWORD PTR DS:[5052CC]" press assemble then type in "POPAD" press assemble then type in "CALL 00418860" press assemble then type in "JMP 00417185" and press assemble

press ctrl + a

you should get something like this

Code:

---

005043CE  . 74 65 73 74 2E>ASCII "test.dll",0
005043D7    90            NOP
005043D8    90            NOP
005043D9    90            NOP
005043DA    90            NOP
005043DB    90            NOP
005043DC    90            NOP
005043DD    90            NOP
005043DE    90            NOP
005043DF    90            NOP
005043E0    90            NOP
005043E1    90            NOP
005043E2    90            NOP
005043E3  > 60            PUSHAD
005043E4  . 68 CE435000    PUSH MatchSer.005043CE                  ; /FileName = "test.dll"
005043E9  . FF15 CC525000  CALL DWORD PTR DS:[<&KERNEL32.LoadLibrar>; \LoadLibraryA
005043EF  . 61            POPAD
005043F0  . E8 6B44F1FF    CALL MatchSer.00418860
005043F5  .^E9 8B2DF1FF    JMP MatchSer.00417185

---

and your done

i take no credit to this apart from making the tut

First post, wewt.

good tut steven has been looking for one link this

Lol, you managed to work out for matchserver :D

yeah finnaly it was done differntly thanks for trying to help i just looked though my old fatalgunz matchserver lol

101 views no thanks or anything except the ppl i sent the link too

If I get this to work, then I'll be sure to thank you. This is something I've been looking a while for now :P. Thanks :)

ok thanks it works fine btw

-_-'. I'm confused, so what does this do?

This is the exact same thing everyone else has released just your method, in my honest opinion, is not as good as changing the OEP to run the dll before GunZ. Reguardless, nice release, it has been done before and also you preform a check on the return of "LoadLibraryA" but you're using a conventional jump (JMP) when you should use a jump if equal (JE) then some type of error handling method. Like, for instance a call to MessageBoxA.

~Iceman

thanks will try this.

Hey, are you Welsh Steven, the guy I talked to some time ago ?

If so; hey - long time no speak man.

yes but i was born in england and i hate 99% of welsh people

Quote:

---

Originally Posted by steven1234

yes but i was born in england and i hate 99% of welsh people

---

Nice to see you again.

Nice tut, trying to do it and its my first time asm-ing :P

Good tutorial. Easy to follow.

or you can use CFF Explorer ezzzzzzzz and fast

can anyoone tell me what is this? Tnx

Quote:

---

Originally Posted by kenvelo

can anyoone tell me what is this? Tnx

---

Clearly it is a tutorial on how to auto inject a dll into the matchserver and/or client.

Quote:

---

Originally Posted by THC

Clearly it is a tutorial on how to auto inject a dll into the matchserver and/or client.

---

Yes i can read that from title. But helps me with what?

Quote:

---

Originally Posted by kenvelo

Yes i can read that from title. But helps me with what?

---

Let's say you have a dll that changes your gravity in-game. You can have that dll auto injected so users don't have to manually inject it every time they open your client.

Quote:

---

Originally Posted by THC

Let's say you have a dll that changes your gravity in-game. You can have that dll auto injected so users don't have to manually inject it every time they open your client.

---

Thank you very much. I didn't know about this.

what does this actually do

thanks.

Quote:

---

Originally Posted by AllahAkbar

or you can use CFF Explorer ezzzzzzzz and fast

---

IAT hooking, tools such as LordPE do exactly the same.

Anyways, IAT hooking is preferred over what you've suggested, OP; it's easier and less volatile.

Nice tut

I'm a little bit confused, probably because i'm not that smart or unexperienced...
But, you hexedit the runnable or launcher and then it should auto load an dll inside the client files?

Quote:

---

Originally Posted by wesley1189

I'm a little bit confused, probably because i'm not that smart or unexperienced...
But, you hexedit the runnable or launcher and then it should auto load an dll inside the client files?

---

well, first off u kinda bumped the topic, and secondly, no. Hex editing, and ASM are completely different. This tutorial shows a different process. And as far as I know, it's not possible to auto inject through only hex editing.

Quote:

---

Originally Posted by ManyBlackPpl

well, first off u kinda bumped the topic, and secondly, no. Hex editing, and ASM are completely different. This tutorial shows a different process. And as far as I know, it's not possible to auto inject through only hex editing.

---

Ey, negro, why you still postin'?

Sorry for reviving the topic but I have a doubt, this tut works for files in July 2008? if you make a difference

i think no because the address is different.

Now make a jmp to code cave ill use the line "5E5F31"

so now you make the jmp 5E5F31 on line 574255

it now should look like this

i didnt know this i got confuse here..

Thanks man helped greate :D

i like to much :D