Hi,
this thread is for developers of bots for Webzen. Plz only post in here if u are a developer.
Ill describe here the way to bypass GG blocked API Calls.
Ok ... lets take a look the PostMessageW API Call.
This is the normal assembly of the first bytes of it:
after the GG hoook it .. it will look like this
As u can see it overwrites the first 5 bytes to jump in the GG function that will disable to send keys to the al window.
Ok how do we bypass it ?
First we need the Address of the PostMessageW API call so lets load the needed dll and get the address of the function.
Use LoadLibrary() and GetProcAddress(), now we need to inc 5 Bytes the original address (to overjump the gg hook).
1 Problem is still left ... we need to rebuild the stack so the original function can proceed its work.
Ill show an example.
All u have to do now is to call ur function(xPostMessageW) instead the original.
Greez ACE
this thread is for developers of bots for Webzen. Plz only post in here if u are a developer.
Ill describe here the way to bypass GG blocked API Calls.
Ok ... lets take a look the PostMessageW API Call.
This is the normal assembly of the first bytes of it:
Code:
7E368CCB USER32.PostMessageW 8BFF mov edi, edi 7E368CCD 55 push ebp 7E368CCE 8BEC mov ebp, esp 7E368CD0 8B45 0C mov eax, dword ptr [ebp+C]
Code:
7E368CCB USER32.PostMessageW - FF65 08 jmp GG Function 7E368CCE 8BEC mov ebp, esp 7E368CD0 8B45 0C mov eax, dword ptr [ebp+C]
Ok how do we bypass it ?
First we need the Address of the PostMessageW API call so lets load the needed dll and get the address of the function.
Use LoadLibrary() and GetProcAddress(), now we need to inc 5 Bytes the original address (to overjump the gg hook).
1 Problem is still left ... we need to rebuild the stack so the original function can proceed its work.
Ill show an example.
Code:
hInst = LoadLibrary("user32.dll");
DLLFunc = (DWORD)GetProcAddress(hInst, "PostMessageW") + 5;
__declspec(naked) BOOL WINAPI __stdcall xPostMessageW(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
__asm
{
mov edi, edi
push ebp
mov ebp, esp
jmp [DLLFunc]
}
}
Greez ACE
