[C++] Punkbuster Detour

04/06/2015 12:49 const*#1
Hello Epvp :)

I decided to release the code of a basic "Punkbuster-Detour". For everyone who knows for what that is for and could make use of it - nice - if you do not have any plan about, please do not ask. Thanks.

Please note! This detour was written ages ago (2012), so I think it will not work anymore - but you can get it running again by sniffing the addresses or dump the punkbuster main executable. I would really give you guys the knowledge on how to find that out, but unfortunately I can't do it myself anymore. Also note that I did not code that alone, somebody helped me, but I don't know, who was it - if it was you - just raise your hand down below. :)

Code:
#include <Windows.h>
#include <iostream>
#include <string>

using namespace std;

/* This detour was originally made by *static_cast in 2012. Please do not remove the credits :) */


DWORD NopNopJump(DWORD dwThread, DWORD dwAdress, DWORD dwSize)
{
	DWORD dwDetour, dwProtect, i;
	if (dwAdress&&dwThread&&dwSize >= dwSize)
	{
		dwDetour = (DWORD)VirtualAlloc(0, dwSize + dwSize, 0x1000, 0x40);
		if (dwDetour&&VirtualProtect((VOID*)dwAdress, dwSize, 0x40, &dwProtect))
		{
			for (i = 0; i < dwSize; i++)
			{
				*(BYTE*)(dwDetour + i) = *(BYTE*)(dwAdress + i);
			}
			*(BYTE*)(dwDetour + dwSize + 0) = 0x96;
			*(DWORD*)(dwDetour + dwSize + 1) = (dwAdress + dwSize);
			*(BYTE*)(dwDetour + dwSize + 0) = 0x96;
			*(DWORD*)(dwDetour + dwSize + 1) = (dwAdress + dwSize);
			*(WORD*)(dwDetour + dwSize + 5) = 0x2E;
			*(DWORD*)(dwAdress + 1) = (dwThread);
			*(WORD*)(dwAdress + 5) = 0xE9;
			VirtualProtect((VOID*)dwAdress, dwSize, dwProtect, &dwProtect);
			VirtualProtect((VOID*)dwDetour, dwSize + dwSize, 0x20, &dwProtect);
			return dwDetour;
		}
	}
	return (0);
}

// Credits:
// static_cast*
// MSDN
// Somebody's name I forgot :c
You also can get this working for other anti-cheats like Hackshield, XTrap and so on, if you modify that. That's all. :)

- Marco
04/06/2015 22:25 Delinquenz#2
Code:
if (dwAdress&&dwThread&&dwSize >= dwSize)
This checks if dwAdress and dwThread is > 0 and if dwSize is >= dwSize which is always true. What was your intention while writing this?
04/06/2015 23:15 const*#3
Quote:
Originally Posted by Delinquenz View Post
Code:
if (dwAdress&&dwThread&&dwSize >= dwSize)
This checks if dwAdress and dwThread is > 0 and if dwSize is >= dwSize which is always true. What was your intention while writing this?
Just to make sure, it might be neccessary, if you are mapping the process. :)