Hooking dll's

[Quget]

Hi there i thought i do make a small guide hooking dlls into flyff.
First:http://forum.ragezone.com/f497/create-auto-injector-566876/
Yes people in the gunz development section like hooking up dll's and injecting their are some good tutorials there

Okay what do you need?
Visual studio c++(2008 or 2010)for compiling
First start a dll project.
file -> new project -> c++ -> win32 -> next -> select dll i prefer empty but its your choose -> finish
Wouw your first dll project probly
okay lets start adding source files and headers files.
Rigth mouse button on Source files -> add-> new item -> cpp file and name it how you like it
now Rigth mouse button on header files -> add-> new item -> .h file and name it they same as your source file
yay now we can start writing
open (named).cpp in source files
We are going to add a MessageBox and listen if a key is being pressed so lets include windows.
Use commands by adding // it will command out things it will turn green.
I'm not really good at explaining lol but yea i added commands
this is my .cpp file

#include <windows.>//We will use functions in Windows.h

void CodeInjection()//A fuction that we inject latter :)
{
	for(;;Sleep(20))//Ofcourse as i said it should listen if we are pressing a button so it should loop and check if we are
	{
		if(GetAsyncKeyState('1'))//it checks if your pressing 1 if so then ...
		{
			MessageBox(NULL, L"Yay you just pressed 2 look :D omg", L"Fun isn't it ?", MB_OK);//it shows this msg box :D
			Sleep(250);//Sleep because it could crash 
		}
		if(GetAsyncKeyState('2'))//it checks if your pressing 2 if so then ..
		{
			ErrorLog("Hello you just hooked into a error log :D");//This is a function in flyff i added in flyff.h it writes an error in your error log file
			Sleep(250);//Sleep because it could crash 
		}
	}
}

__declspec(dllexport) BOOL __stdcall DllMain(HINSTANCE hInst,DWORD reason,LPVOID lpv)// dll export
{
	DisableThreadLibraryCalls(hInst);
        if (reason == DLL_PROCESS_ATTACH)//If dll is hooked in the process
        {
            MessageBox(NULL, L"Injected", L"HI", MB_OK);//show msg box
            CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&CodeInjection, NULL, 0, NULL);  //injects our function in the procces 
	}
        return true;//returns true
}

My .h file

typedef void(__cdecl *WriteError)(char const *,...);//Void becuase it can hold any value :P [CODE]*WriteError)(char const *,...)// This is a flyff function with writes something in the error log

WriteError ErrorLog = (WriteError)0x0000000000652B10;//(WriteError)0x0000000000652B10//It tells where the flyff function starts (address) With you need to find yourself since i used my own neuz for this so you got to find it out in IDA pro or olly dbg
[/CODE]

This is what i could explain xD i learned this while making gunz hacks with is kinda fun and usefull

Got any questions feel free to ask.
See? Not that hard as someone let us think it is

 

[wishly]

thanks Misterkid...

 

[Mootie]

Most game antihacks prevent this. Not very useful for hacking these days.

 

[Quget]

Mootie Gameguard doesn't block this.
Just code the functions right with a little asm and BAM you have your hack.
For flyff it would be easy to get the functions now
Only think you need to do is getting the right addresses and find a way to fool gameguard or other anti cheats.

 

[KrYpT0n]

Mootie Gameguard doesn't block this.
Just code the functions right with a little asm and BAM you have your hack.
For flyff it would be easy to get the functions now
Only think you need to do is getting the right addresses and find a way to fool gameguard or other anti cheats.

The 'new' gameguard utilizes this thing called a NPHeartBeat. Even if you manage to patch it's calls, you're not gonna get into the server w/out actually emulating it out.

Another thing is that LoadLibraryA could easily be detected, by even setting a DLL_ATTACH message handler. Gameguard does block it. Another thing is that the kernel function for getting processes(I don't remember what it was called) is hooked, preventing you to get neuz's process handle easily. Even though it's not hard, it can sometimes be a *****.

So if you sir can unpack Themida on gg and Neuz, please give me so I can has funs. Too bad GG does a checksum these days.