Anti Macro

[justnoob123]

kus12

 

[xtephane]

Where in the source is added this code?

 

[justnoob123]

i will not answer idiotic questions, this is for people who can code.

 

[a1tl4]

So nice.. have you tried hook NtGdiGetDCObject or NtGdiGetPixel also?
I dont have idea what i can do on hook from these two api

 

[justnoob123]

it wont help you to block other processs from reading screen

 

[Mr_Troy]

So nice.. have you tried hook NtGdiGetDCObject or NtGdiGetPixel also?
I dont have idea what i can do on hook from these two api

You'll need to go in Ring0 to prevent other processes from using GDI functions.

 

[a1tl4]

You'll need to go in Ring0 to prevent other processes from using GDI functions.

Thanks. I already tried do it in C++.
But I think that is possible only in C.

 

[justnoob123]

Thanks. I already tried do it in C++.
But I think that is possible only in C.

i wouldn't recommend going that way, because if you will just hook them trough the shadow ssdt it would be as much as easy to restore the orginal function address,
and if you would directly hook the functions it gona be a ***** to write hooks for all the different kernels versions.

 

[migueldj]

Nice job

 

[Solaire]

You'll need to go in Ring0 to prevent other processes from using GDI functions.

Not essentially, ring3 would make a good solution.

On-topic:
What if you'd obtain the DirectInput handle from memory?

 

[justnoob123]

i dont understand, can you explain?

 

[Solaire]

i dont understand, can you explain?

If you grab the DirectInput handle (it's a global somewhere, I haven't touched GunZ in ages), you can legitimately call DirectInput functions from a DLL, including input functions. That way, there's no way to tell whether or not they were injected. Neither SendMessage or WindowsHookEx actually have impact on keyboard input in GunZ as DirectInput obtains the input straight from the driver rather than through Windows. Though, DirectInput is only used for the keys defined in your config.xml.

That being said, mouse events aren't obtained from DirectInput unfortunately, they're obtained from the windows message loop. For mouse, switching to DirectInput would patch all shotbots as I've posted numerous times before. Then, you'd need to go ring0 to bypass.

I appreciate the release though.

 

[justnoob123]

every method is bypassable one way or another.

 

[Mr_Troy]

If you grab the DirectInput handle (it's a global somewhere, I haven't touched GunZ in ages), you can legitimately call DirectInput functions from a DLL, including input functions. That way, there's no way to tell whether or not they were injected. Neither SendMessage or WindowsHookEx actually have impact on keyboard input in GunZ as DirectInput obtains the input straight from the driver rather than through Windows. Though, DirectInput is only used for the keys defined in your config.xml.

That being said, mouse events aren't obtained from DirectInput unfortunately, they're obtained from the windows message loop. For mouse, switching to DirectInput would patch all shotbots as I've posted numerous times before. Then, you'd need to go ring0 to bypass.

I appreciate the release though.

Actually, Mouse events are obtained from DirectInput in Gunz1.5. Check the source. Only the interface related mouse events are obtained from Windows.

ZInput.cpp

    ////////////////////////////////////////////////////////
    // Å°º¸µå ÀÔ·Â
    static ZDIBUFFER keyBuffer[256];
    int nCount = m_pDirectInput->GetKeyboardBufferedData(keyBuffer,sizeof(keyBuffer)/sizeof(keyBuffer[0]));
    for(int i=0; i<nCount; i++){
        int nScanCode = keyBuffer[i].nKey;
        bool bPressed = keyBuffer[i].bPressed;
        if(bPressed)
            ExclusiveEvent(nScanCode);
        ZACTIONKEYMAP::iterator itr = m_ActionKeyMap.find(nScanCode);
        if(itr!=m_ActionKeyMap.end())
            OnActionKey(itr->second,bPressed);
    }


    ////////////////////////////////////////////////////////
    // ¸¶¿ì½º ÀÔ·Â
    static ZDIBUFFER mouseBuffer[256];
    int iDeltaX, iDeltaY;
    nCount = m_pDirectInput->GetMouseBufferedData(&iDeltaX,&iDeltaY,mouseBuffer,256);
    for(int i=0; i<nCount; i++){
        int nKey = mouseBuffer[i].nKey + MOUSE_BASE;
        bool bPressed = mouseBuffer[i].bPressed;
        if(bPressed)
            ExclusiveEvent(nKey);
        ZACTIONKEYMAP::iterator itr = m_ActionKeyMap.find(nKey);
        if(itr!=m_ActionKeyMap.end())
            OnActionKey(itr->second,bPressed);
    }
    // invert ¸¶¿ì½º Àû¿ë
    if (Z_MOUSE_INVERT)
        iDeltaY = -iDeltaY;


    float fRotateStep = 0.005f * Z_MOUSE_SENSITIVITY;
    m_fRotationDeltaX += (iDeltaX * fRotateStep);
    m_fRotationDeltaY += (iDeltaY * fRotateStep);

EDIT: I looked in the old GunZ source and saw that it hasn't changed since then.

Not essentially, ring3 would make a good solution.

On-topic:
What if you'd obtain the DirectInput handle from memory?

By injecting into every process, yes, but is that a reliable solution? Anti-viruses and other protection programs and protected programs (other games with anticheats or whatever) might **** some bricks.

 

[Solaire]

Actually, Mouse events are obtained from DirectInput in Gunz1.5. Check the source. Only the interface related mouse events are obtained from Windows.

ZInput.cpp

    ////////////////////////////////////////////////////////
    // Å°º¸µå ÀÔ·Â
    static ZDIBUFFER keyBuffer[256];
    int nCount = m_pDirectInput->GetKeyboardBufferedData(keyBuffer,sizeof(keyBuffer)/sizeof(keyBuffer[0]));
    for(int i=0; i<nCount; i++){
        int nScanCode = keyBuffer[i].nKey;
        bool bPressed = keyBuffer[i].bPressed;
        if(bPressed)
            ExclusiveEvent(nScanCode);
        ZACTIONKEYMAP::iterator itr = m_ActionKeyMap.find(nScanCode);
        if(itr!=m_ActionKeyMap.end())
            OnActionKey(itr->second,bPressed);
    }


    ////////////////////////////////////////////////////////
    // ¸¶¿ì½º ÀÔ·Â
    static ZDIBUFFER mouseBuffer[256];
    int iDeltaX, iDeltaY;
    nCount = m_pDirectInput->GetMouseBufferedData(&iDeltaX,&iDeltaY,mouseBuffer,256);
    for(int i=0; i<nCount; i++){
        int nKey = mouseBuffer[i].nKey + MOUSE_BASE;
        bool bPressed = mouseBuffer[i].bPressed;
        if(bPressed)
            ExclusiveEvent(nKey);
        ZACTIONKEYMAP::iterator itr = m_ActionKeyMap.find(nKey);
        if(itr!=m_ActionKeyMap.end())
            OnActionKey(itr->second,bPressed);
    }
    // invert ¸¶¿ì½º Àû¿ë
    if (Z_MOUSE_INVERT)
        iDeltaY = -iDeltaY;


    float fRotateStep = 0.005f * Z_MOUSE_SENSITIVITY;
    m_fRotationDeltaX += (iDeltaX * fRotateStep);
    m_fRotationDeltaY += (iDeltaY * fRotateStep);

EDIT: I looked in the old GunZ source and saw that it hasn't changed since then.

Check the GetMessage loop in main.cpp. GunZ either gets input from both or it did change since 2007.

By injecting into every process, yes, but is that a reliable solution? Anti-viruses and other protection programs and protected programs (other games with anticheats or whatever) might **** some bricks.

Anti-viruses won't care as plenty of modules are loaded up-on starting a process.

 

[Mr_Troy]

Check the GetMessage loop in main.cpp. GunZ either gets input from both or it did change since 2007.



Anti-viruses won't care as plenty of modules are loaded up-on starting a process.

RFrameWork.cpp and not main.cpp, and as I said, game input is obtained completely from DirectInput and only the mouse messages related to the interface are obtained from Windows.

 

[Solaire]

RFrameWork.cpp and not main.cpp, and as I said, game input is obtained completely from DirectInput and only the mouse messages related to the interface are obtained from Windows.

Main.cpp line 816. WndProc handles the windows messages.

 

[Mr_Troy]

Main.cpp line 816. WndProc handles the windows messages.

And precisely in that function you see that only Mint2 relies on Windows messages.

    if(Mint::GetInstance()->ProcessEvent(hWnd, message, wParam, lParam)==true)
    {
        if (ZGetGameInterface() && ZGetGameInterface()->IsReservedResetApp())    // for language changing
        {
            ZGetGameInterface()->ReserveResetApp(false);
            ResetAppResource();
        }


        return 0;
    }

To view the content, you need to sign in or register

Ingame input relies on the ZGameInput class, which relies on the ZInput class, which relies on DirectInput. Strangely enough, Windows messages are coming through DirectInput, because SendInput works just fine for both keyboard and mouse events.

EDIT: (old 2007 source)

To view the content, you need to sign in or register

 

[Solaire]

And precisely in that function you see that only Mint2 relies on Windows messages.

That's beside the point, you told me it wasn't in main.cpp while it obviously is.

To view the content, you need to sign in or register

Ingame input relies on the ZGameInput class, which relies on the ZInput class, which relies on DirectInput. Strangely enough, Windows messages are coming through DirectInput, because SendInput works just fine for both keyboard and mouse events.

EDIT: (old 2007 source)

To view the content, you need to sign in or register

Again, it does not. If you send a config defined key (e.g. W, A, S, D) while in-game through SendInput (or keybd_event) it will not be processed by GunZ. I'm well aware that GunZ obtains input from both and uses DirectInput for the game. However, somehow, they either mess up processing the Windows messages for the mouse and do actually use them for the game, or they use a very strange implementation of DirectInput and mess up the config defined keys.

Give

To view the content, you need to sign in or register

a read and realize this:

Because DirectInput works directly with the device drivers, it either suppresses or ignores Windows mouse and keyboard messages. It also ignores mouse and keyboard settings made by the user in Control Panel. It does, however, use the calibrations set for a joystick or other game controller.

 

[justnoob123]

That's beside the point, you told me it wasn't in main.cpp while it obviously is.



Again, it does not. If you send a config defined key (e.g. W, A, S, D) while in-game through SendInput (or keybd_event) it will not be processed by GunZ. I'm well aware that GunZ obtains input from both and uses DirectInput for the game. However, somehow, they either mess up processing the Windows messages for the mouse and do actually use them for the game, or they use a very strange implementation of DirectInput and mess up the config defined keys.

Give

To view the content, you need to sign in or register

a read and realize this:

SendInput does work