注：原贴中的dll是game.dll,俺们这里的dll是config.dll
网络游戏
NONAMEPT
以下是原贴
Hooking a DLL in game.exe
I'm going to teach you how to hook your dll into the game, and preventing the game to execute if the dll doesnt exists, or if it isnt the real dll.
We need use these two functions:
LoadLibrary - To load, ofc.
GetProcAddress - To get the dll function handle.
ExitProcess - dont need to explain, right?
First, go to some place where you have enough code and, in hex, add the name of your dll and the main function.
Example:
Code:
005C75CB . 67 61 6D 65 5C>ASCII "game.dll"
005C75DB . 6C 00 ASCII "l",0
005C75DD 00 DB 00
005C75DE 00 DB 00
005C75DF 00 DB 00
005C75E0 00 DB 00
005C75E1 . 44 6C 6C 45 6E>ASCII "DllEntryPoint",0
Now, we have to load.
Code:
PUSH 005C75CB
CALL kernel32.LoadLibrary (type Control+N, search for this function and you'll find the address).
After it, the dll handle will be stored in EAX, that we will use to check.
Code:
TEST EAX,EAX or CMP EAX,0
JE OFFSET
In the ficticial address, OFFSET, we will put the code to make the game close.
Code:
PUSH 1
CALL kernel32.ExitProcess
OK, now, after the JE, we have to check if it is really our DLL.
Code:
PUSH game.005C75E1 - the dll Function
PUSH EAX - The DLL handle we get in LoadLibrary
CALL KERNEL32.GetProcAddress
Now, if everything is fine, EAX must NOT contain a NULL value.
Then, we use the same technique that we used in LoadLibrary.
Code:
TEST EAX,EAX or CMP EAX,0
JE OFFSET
If everything is fine, none of the JE will be taken.
Now, we just have to return our code to its entrypoint.
If you are using PE Explorer, you could change the EP and dont have the need of making a jump in the EP.
But, if you have, you just need to restore the first 2 push you take to make a jump to this new code, and then JUMP back to the first call after the EP.
