Page 1 of 1

API hooking: inject dll in all processes

Posted: Mon Jul 13, 2009 10:03 pm
by Machiavelli
Hi.

I want use that dll:

Code: Select all

Global Dim Backup.b(5)

Procedure HookedMouse_Event(a,b,c,d) 
 MessageBox_(0,"mouse_eveit hooked","Title",0)
 ;ProcedureReturn 0
EndProcedure 

Procedure HookedSetCursorPos(a,b) 
 MessageBox_(0,"SetCursorPos hooked","Title",0)
; ProcedureReturn 0
EndProcedure 

Procedure HookedKeybd_Event(a,b,c,d) 
 MessageBox_(0,"keybd_event hooked","Title",0)
 ;ProcedureReturn 0
EndProcedure 

Procedure Hook(library$,function$,HookedProcAddr) 
  dwAddr=GetProcAddress_(GetModuleHandle_(library$),function$) 
  ReadProcessMemory_(GetCurrentProcess_(),dwAddr,@Backup(0),6,@readbytes) 
  Dim a.b(6) : a(0)=$E9 : a(5)=$C3 : dwCalc=HookedProcAddr-dwAddr-5 
  CopyMemory(@dwCalc,@a(1),4) 
  WriteProcessMemory_(GetCurrentProcess_(),dwAddr,@a(0),6,@written) 
EndProcedure 

Hook("C:\WINDOWS\system32\user32.dll","mouse_event",@HookedMouse_Event())
Hook("C:\WINDOWS\system32\user32.dll","SetCursorPos",@HookedSetCursorPos())
Hook("C:\WINDOWS\system32\user32.dll","keybd_event",@HookedKeybd_Event())
for hooking and block 3 functions: keyb_event, mouse_event, setCursorPos.

If i place path to that dll in HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows\AppInit_DLLs and then i can't load my windows OS :oops:
where is my mistake?

sorry for my bad english :oops:

Posted: Tue Jul 14, 2009 12:15 am
by Kaeru Gaman
where is my mistake?
you ask in an honest programmers' forum how to program malware.
... this is a mistake.

Posted: Tue Jul 14, 2009 12:59 am
by netmaestro
Actually, based on the functions he's hooking, he appears to be trying to defend against something. Possibly trying to bot-proof a game by the look of it.

Posted: Tue Jul 14, 2009 6:51 am
by Machiavelli
you ask in an honest programmers' forum how to program malware.
This is not a malware. I need write bot\clicker protection for a game.
Actually, based on the functions he's hooking, he appears to be trying to defend against something. Possibly trying to bot-proof a game by the look of it.
Right :)

upd: problem solved by adding AttachProcess procedure:)

Posted: Tue Jul 14, 2009 11:19 am
by Kaeru Gaman
Machiavelli wrote:This is not a malware. I need write bot\clicker protection for a game.
I'm sorry... was a bit confused by the "inject ALL processess"

Posted: Tue Jul 14, 2009 12:15 pm
by cas
netmaestro wrote:Possibly trying to bot-proof a game by the look of it.
That is impossible to achieve by many commercial developers with big teams, how is he trying to do it? If he succeeds, he will be very rich man. 8)

Posted: Tue Jul 14, 2009 12:24 pm
by Machiavelli
i dont create ideal protection :) i'm just want block some popular bots.

Posted: Tue Jul 14, 2009 12:27 pm
by cas
OK then, sorry for hijacking your thread :oops:
You will have a lot of work by updating game every often because bots will eventually bypass your protection.