Das ist der Code, der vor 3 Jahren am Ende rauskam:
Code:
void SendChat(char* Text)
{
__asm
{
MOV EAX, DWORD PTR DS:[0xAF381F8]
MOV EAX, DWORD PTR DS:[EAX + 0x2C]
MOV EAX, DWORD PTR DS:[EAX + 0x8]
MOV EDX, DWORD PTR DS:[EAX]
MOV EDX, DWORD PTR DS:[EDX + 0x8]
PUSH Text
MOV ECX, EAX
CALL EDX
}
}
Bzw. als kompletter Hook wie du es beschrieben hast:
Code:
//bUTL9R ChatHook, credits to florian0 from stagetwo
//=====================================================
// Includes
//=====================================================
#include "Manager.h"
void CallChat(char* Text);
//==================================================================
// Important Variables
//==================================================================
DWORD dwEAX = 0; //EAX register wich is not static and needs to be retrived by GetEAX, otherwhise SendMessage will crash the game!
DWORD dwChatAddress; //Where to "hook" the chat function with our GetEAX function
DWORD dwCallOrigSendMessage = 0; //Address to call the original SendMessage from the game itself
DWORD dwJumpBack;
void CreateConsole()
{
AllocConsole();
freopen( "CONOUT$", "wb", stdout );
}
void CheckHotkeys()
{
while (true)
{
Sleep(10);
if (GetAsyncKeyState(VK_NUMPAD1) &1)
{
CallChat("easy");
}
if (GetAsyncKeyState(VK_NUMPAD2) &1)
{
printf("Sending GG\n");
CallChat("/all GG!");
if (dwEAX == 0 || dwCallOrigSendMessage == 0)
{
return;
}
CallChat("/all GG!");
CallChat("/all GG!");
CallChat("/all GG!");
CallChat("/all GG!");
CallChat("/all GG!");
CallChat("/all GG!");
CallChat("/all GG!");
CallChat("/all GG!");
}
if (GetAsyncKeyState(VK_NUMPAD3) &1)
{
printf("call sendChat with troll\n");
CallChat("/all I molest rubber chicken!");
}
if (GetAsyncKeyState(VK_NUMPAD4) &1)
{
CallChat("/all B1tch where you going?!");
}
if (GetAsyncKeyState(VK_NUMPAD5) &1)
{
CallChat("/all Not even close baby!");
}
if (GetAsyncKeyState(VK_NUMPAD6) &1)
{
CallChat("/all My favorite poker card? The ACE!");
}
if (GetAsyncKeyState(VK_NUMPAD7) &1)
{
CallChat("/all Nope, not on my watch!");
}
}
}
//==================================================================
// CallChat
//Our CallChat function, wich calls the original CallChat function with our text parameter
//==================================================================
void CallChat(char* Text)
{
//http://www.stagetwo.eu/index.php?page=Thread&threadID=156383&pageNo=3
// call to SendMessage: 0045F270
if (dwEAX == 0 || dwCallOrigSendMessage == 0)
{
MessageBox(NULL, "You dumbfuck want me to crash?!", "Error", MB_OK);
return;
}
//you need to use the chat once manually (write hello or something), since we need 2 addresses
__asm
{
mov eax, dwEAX
mov edx, dwCallOrigSendMessage
push Text
mov ecx, eax
call edx
}
}
//==================================================================
// GetEAX
//==================================================================
__declspec(naked) void GetEAX()
{
__asm
{
mov dwEAX, eax
mov dwCallOrigSendMessage, edx
push ecx
mov ecx, eax
call edx
}
//We got eax, ad edx [address for original sendmessage function], so we restore the original code to stay as undetected as possible
//orig code: 51 8B C8 FF D2
FrameWork->WriteMemory((void *)dwChatAddress, (void *)"\x51\x8B\xC8\xFF\xD2", 5);
//jump back to original code
__asm
{
jmp [dwJumpBack]
}
}
//==================================================================
// InitializeChatHook
//==================================================================
void InitializeChatHook()
{
CreateConsole();
//Chat address is inside League of Legends.exe. Modulebase is always 0x00400000
//LolClient ModuleSize: 0B158000
printf("Searching chat address!\n");
dwChatAddress = FrameWork->FindPattern(0x00400000, 0x0B158000, (PBYTE)"\x51\x8B\xC8\xFF\xD2\xB0\x01", "xxxxxxx");
if (dwChatAddress != 0)
{
printf("Found chat address: %x\n", dwChatAddress);
}
else
{
printf("Did not find chat address!\n");
return;
}
FrameWork->MakeJMP((PBYTE)dwChatAddress, (DWORD)GetEAX, 5);
dwJumpBack = dwChatAddress + 5; //Important, original game code continues there
printf("Detoured function, ready to go.\n");
CheckHotkeys();
return;
}
(Von hier:
[Only registered and activated users can see links. Click Here To Register...] (und Seite 4))
Ich kann mir nicht vorstellen, dass der Hook noch funktioniert. Dafür ist zu viel Zeit vergangen.
Der LoL-Client arbeitet viel mit Übersetzungen. Ggf. findet man /all nicht mehr. Aber die hier findet man noch:
- game_chat_known_commands
- game_chat_command_help
- game_console_chatcommand