Code Cave dll problem

04/11/2013 03:21 elmarcia#1
Hi all i made a crack me with c++ which loads a message from a dll , my aim is to reverse the messagebox with another dll which patch the exe code, everything is ok but a i have a problem the patched msg is shown twice -.-" all of this is just for learning the basic of code injection.

Why with a dll when i could patch it easily in ollydbg? because ollydbg is detected by a lot of programs but a simple dll can patch code inside the program without being noticed...

Here is my code:

Some Images For Full Understanding:

[Only registered and activated users can see links. Click Here To Register...]

[Only registered and activated users can see links. Click Here To Register...]

[Only registered and activated users can see links. Click Here To Register...]


If someone want to reverse by yourself could try here is the src

VT: WTF 8/46 :mad: [Only registered and activated users can see links. Click Here To Register...]

I'm very noob in this stuff so sorry if i made a stupid comment :D
04/11/2013 15:57 Omdi#2
Code:
__declspec(naked) void ReverseMesage(void)
{

__asm
{

call Function

Function:
push MB_OK //the patched messagebox
push offset title
push offset body
push 0 
call dword ptr MessageBoxA
ret 
}


}
You are calling "Function", which executes this code

Code:
Function:
push MB_OK //the patched messagebox
push offset title
push offset body
push 0 
call dword ptr MessageBoxA
ret
So after the ret, the code is returning to the return address which is here :

Code:
call Function
[COLOR=Red][B]<--------------------- RETURN ADDRESS[/B][/COLOR]
Function:
push MB_OK //the patched messagebox
push offset title
push offset body
push 0 
call dword ptr MessageBoxA
ret 
}
And then it will execute the same code again - MessageBox is shown twice.

This code should work fine :)

Code:
__declspec(naked) void ReverseMesage(void)
{

__asm
{
push MB_OK //the patched messagebox
push offset title
push offset body
push 0 
call dword ptr MessageBoxA
ret 
}


}