PDA

View Full Version : [From UC] PB Hack Tutorial


gil
20th February 2006, 21:17
I released the final version public already, yes. However, I feel it is worth reposting this into the public forum. In this thread you'll be able to see how I came up with functions in the final version. Debate, and work togethor to see if you can recreate another version.

The final version can be found here:
http://www.unknowncheats.com/forum/downloads.php?do=file&id=55

==================================

Okay, new version of PB-Hack. Again, because I don't have a game to test on the outcome I don't know. However, I've made my own programs which do the same exact thing as PB - detect files. This works for it, so it should for pb as well.

Okay, here is the cool thing. Because there are no public D3D hooks available and I have a feeling most of you aren't exerpeinced with C++ enough to make your own. Well, using the method I'm releasing here should make them undetected by adding it to the source of the hack.

Theory: Punkbuster relies on Kernel32 API way to much, so I'm taking advantage of it as much as possible. The API, "Module32Next" is the victim in this version. Those of you who don't know anything about it, let me explain.

The function:
BOOL
WINAPI
Module32Next(
HANDLE hSnapshot,
LPMODULEENTRY32 lpme
);

#define Module32Next Module32NextW

What it does: In english, it basicly does what it sounds like, searches the next module in the processlist.

Parameters: The handle is obvious, its the process which you want the information from. Basicly, the parameter is set up like this:

HANDLE hModuleSnap = CreateToolhelp32Snapshot(
DWORD dwFlags,
DWORD th32ProcessID
);

The second parameter, "LPMODULEENTRY32" is more fun. What ever the return value for this function is can be used throughout a program to get the process information such as PID. However, it is more tricky. This is a full example of how to use it:

MODULEENTRY32 ptr32;
Module32Next(hModuleSnap, &ptr32);

Notice the "&" it is not there for fun!

What to use M32N for: Run through a list of running modules loaded in a process and retrieve the module information. PB uses this function to detect if a hack is loaded in the game, and such as a D3D hack. Remember the "invalid d3d8.dll" kick in the olden days? Well, that is from this function.

Intercepting the API:I use the same method I've used for every API interception I do. Get the module of which exported the API to Kernel32.dll, compare it to pbcl.dll. If it matches, patch the function with your own. (This is done in DllMain)

BOOL WINAPI DllMain(HINSTANCE hInst, DWORD dwReason, LPVOID reserved)
{
if (dwReason == DLL_PROCESS_ATTACH)
{
Log.WriteLogHeader();
Log.Log("Hooking Function...");
hDLL = hInst;

DisableThreadLibraryCalls(hInst);
GetModuleFileName(GetModuleHandle(NULL), cDLL, sizeof(cDLL));
PathStripPath(cDLL);

if (strcmp(cDLL, "pbcl.dll") == 0)
InterceptPBAPI(hInst, "kernel32.dll", "Module32Next", (DWORD)AnticheatAPIReplace);

Log.Log("Successfull");
}
else if (dwReason == DLL_PROCESS_DETACH)
{
TlsFree((DWORD)hInst);
Log.Log("TrixnIce Unloaded");
}

return TRUE;
}


The Patch:Here is the part which replaces the code (yay!). First you have to know what you want to replace the function with. Should you return it FALSE? (Yes, Module32Next is a bool if you have forgotten ALREADY!) But if you do that, then any simple program can detect the function never succeded and use the function, "GetLastError()" and smack you with a, "No admin access" or, "Operation failed" alert. So here is my idea, why not let the function move along through the list of modules untill your module is up. Once that happens, smack it on the face with end of module list notification.

BOOL WINAPI AnticheatAPIReplace(LPSYSTEM_POWER_STATUS lpSystemPowerStatus)
{

DWORD dwPID = GetCurrentProcessId();

HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
MODULEENTRY32 ptr32;

hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
if(hModuleSnap == INVALID_HANDLE_VALUE)
{
return FALSE;
}

ptr32.dwSize = sizeof(MODULEENTRY32);

if (strcmp(ptr32.szModule, "TrixnIce.dll") == 0)
return ERROR_NO_MORE_FILES;

CloseHandle(hModuleSnap);
return TRUE;
}

There you have it, the API is replaced and no harm has been done. The function will continue to run as normal through the files, and each time it comes to your module it will be alerted there are no more modules.

Thanks HockeyBuster & UC, great job.

No1uKnow
20th February 2006, 22:43
if (strcmp(ptr32.szModule, "TrixnIce.dll") == 0)

yeah old school

He linked me to this in their irc, looks nice ;)

gj hb && crew

C-X
21st February 2006, 01:10
Wow, nice job!

Ping_pong
21st February 2006, 16:18
Wow, that's cool!
;) Hopes trundle will see this and will update his D3d8.dll hook!

k0t1c
16th March 2006, 19:00
i'm not sure this would work, and even if it worked, it would require altering the IAT of pbcl.dll, which doesn't really sound safe...
hiding the module in the PEB should achieve a level of security being *at least* as high as this one, if not higher, and it sounds more stealth too, though it's a bit more complicated...

LB/Fred_Durst
26th March 2006, 01:49
mhh,sry i don`t know really with which programm i can use the codes.

No1uKnow
26th March 2006, 01:53
i'm not sure this would work

tell that to Trix N Ice which stayed undetected for ages after pb starting smaking d3d's around for americas army.

But you could be right, maybe this wont work now but it did in the past =-) quite well I might add..

diff game -> diff pb version

keep that in mind b4 you post this next time 'k0t1k'


mhh,sry i don`t know really with which programm i can use the codes.

any c++ compiler, personally I use microsoft visual studio .net 2003

tdlrali
26th March 2006, 04:21
Cool, thanks :D

personally I use microsoft visual studio .net 2003
he bought it, of course. ;)

Dark_Raker
4th March 2008, 07:31
this link is broken. the site doesn't exist. do you have copy you could upload?

Holz
4th March 2008, 14:59
No idea how much if this information is still valid, haven't really checked it out either.

The new address for the UC downloads is:

http://www.ucdownloads.com/downloads/downloads.php


Maybe you can still find it there.

Dark_Raker
6th March 2008, 01:13
thanks holz

edit: :( its not there in downloads and forum doesn't seem to exist.

CioNide
6th March 2008, 06:02
Looks nice, but I wish it was is C# :).

goatpoop2
1st April 2008, 01:37
thanks holz

edit: :( its not there in downloads and forum doesn't seem to exist.

Yes and No. It exists, but Hockeybuster doesn't have a thread about this, at least from what I can see. http://www.uc-forum.com/forum/search.php?searchid=11720

Was probably on the old forum.

Dark_Raker
1st April 2008, 02:25
goatpoop2 yes it porbably was in the old forums but those are closed now.