HuHu, ich "versuche" mal die Kal-Sektion zu verbessern jeder nder irgendwelche Code's für Kal hat kann sie hier mal posten, ihr könnt sie ja ruhig coden hat sogar noob schutz weil eh nicht jeder damit umgehn kann =) hehe
Dieser eine Code der Hochgeladen wurde:
Hier zum Injeten in c++ (keine 100% garantie)
Hier noch was zum .dll injeten:
Dieser eine Code der Hochgeladen wurde:
Code:
//////////////////////////////////////////////////////////////////////
// ClientCore.cpp
// -------------------------------------------------------------------
// Default Client Dll entrypoint.
//////////////////////////////////////////////////////////////////////
#include <stdio.h>
#include "CommonStructs.h"
#define EXPORT __declspec( dllexport ) __cdecl
#define PRIVATE __cdecl
#define BIND_TO_SERVER(x) server->##x##=(fn##x##)GetProcAddress(hModule,#x ##);
extern "C" {
BOOL EXPORT OnGameCommandLine(char* argv[], int argc);
WORD EXPORT OnPacketBeforeSent(LPBYTE pbPacket, WORD wLen);
WORD EXPORT OnPacketBeforeRecv(LPBYTE pbPacket, WORD wLen);
BYTE EXPORT OnGameKeyUp(BYTE iKeyCode);
VOID EXPORT OnUnitSelect(GAMEUNIT GameUnit);
BOOL EXPORT OnMapClick(PGAMEUNITCOORDS cClick);
}
BOOL PRIVATE OnClientStop();
BOOL PRIVATE OnClientStart();
#pragma comment(lib, "shlwapi.lib")
#include <shlwapi.h>
//////////////////////////////////////////////////////////////////////
// Global server struct holding pointers to exported functions
//////////////////////////////////////////////////////////////////////
FUNCTIONENTRYPOINTS *server;
HMODULE g_hModule; // New Global
char g_szModuleDir[MAX_PATH]; // New Global
//////////////////////////////////////////////////////////////////////
// Dll entry/exit
//////////////////////////////////////////////////////////////////////
BOOL APIENTRY DllMain(HMODULE hinstModule, DWORD ul_reason_for_call, LPVOID lpReserved)
{
char szTemp[MAX_PATH];
BOOL hResult = TRUE;
switch (ul_reason_for_call)
{
case DLL_PROCESS_ATTACH:
// initiate client
g_hModule = (HMODULE)hinstModule;
GetModuleFileName( g_hModule, szTemp, sizeof(szTemp) );
PathRemoveFileSpec(szTemp);
sprintf( g_szModuleDir, szTemp );
// Create server/me struct
server = new FUNCTIONENTRYPOINTS;
// Bind exported functions from server
HMODULE hModule;
hModule = (HMODULE)GetModuleHandle("KalHackIt");
if(!hModule)
{
MessageBox(0,"Unable to find KalHackIt.dll in process",0,0);
return FALSE;
}
// Macros make this look a lot nicer :)
BIND_TO_SERVER(GameCommandLine);
BIND_TO_SERVER(GameCommandLinef);
BIND_TO_SERVER(GamePrintString);
BIND_TO_SERVER(GamePrintInfo);
BIND_TO_SERVER(GamePrintError);
BIND_TO_SERVER(GamePrintStringf);
BIND_TO_SERVER(GamePrintInfof);
BIND_TO_SERVER(GamePrintErrorf);
BIND_TO_SERVER(ClientSendPacketToServer);
BIND_TO_SERVER(ClientSendPacketToClient);
BIND_TO_SERVER(UserSendPacketToServer);
BIND_TO_SERVER(UserSendPacketToClient);
BIND_TO_SERVER(EnumUnits);
BIND_TO_SERVER(FindUnitByID);
BIND_TO_SERVER(FindUnitByName);
BIND_TO_SERVER(GetUnitName);
BIND_TO_SERVER(GetUnitID);
BIND_TO_SERVER(GetUnitCoord);
BIND_TO_SERVER(GetUnitType);
BIND_TO_SERVER(GetNextMonster);
BIND_TO_SERVER(GetPlayerUnit);
BIND_TO_SERVER(GetPlayerInfoStruct);
BIND_TO_SERVER(GetUnitLife);
BIND_TO_SERVER(GetUnitMaxLife);
BIND_TO_SERVER(GetPlayerLife);
BIND_TO_SERVER(GetPlayerMaxLife);
BIND_TO_SERVER(GetHeight);
BIND_TO_SERVER(teleport);
BIND_TO_SERVER(serverteleport);
BIND_TO_SERVER(GetSocket);
hResult = OnClientStart();
break;
case DLL_PROCESS_DETACH:
// kill client
hResult = OnClientStop();
delete[] server;
break;
}
return hResult;
}
//////////////////////////////////////////////////////////////////////
// Stubfunctions for 'property get' functions.
//////////////////////////////////////////////////////////////////////
// OnClientCommandLine
// -------------------------------------------------------------------
// The modules own extension of the command line interface. Any custom
// commands you add are parsed here.
//
// Return value should be TRUE, but it is not used at this
// time.
//
// Arguments when we get here:
// argv[0] Name of module
// argv[1] Name of command (If supplied)
// argv[2 ... n] The rest
//
// Syntax in the game: .<module> <arguments>
//////////////////////////////////////////////////////////////////////
BOOL EXPORT OnGameCommandLine(char* argv[], int argc)
{
// Check if user supplied anything at all, if not assume help...
if (argc==1)
argv[argc++]="help";
MODULECOMMANDSTRUCT* mcs=ModuleCommands;
while (mcs->szName) {
if (!stricmp(mcs->szName, argv[1]))
break;
mcs++;
}
char *p,*t,*msg,*fMsg;
fMsg=new char[256];
//
// Is this a built-in function ?
if (mcs->szName) {
//
// If functions returns false, show usage help
if (!mcs->pFunc(argv, argc)) {
t=new char[strlen(mcs->szUsage)+1];
server->GamePrintInfo("Usage:");
sprintf((char*)t, "%s", mcs->szUsage);
if (strlen((char*)t))
{
msg=p=t;
while (*p != 0) {
if (*p == '\n')
{
*(p++) = 0;
sprintf(fMsg, ".%s %s", argv[0], msg);
server->GamePrintInfo((char*)fMsg);
if (*p != 0)
msg = p;
} else
p++;
}
sprintf(fMsg, ".%s %s", argv[0], msg);
server->GamePrintInfo((char*)fMsg);
}
delete t;
}
} else {
// Unknown command, show catch-all help phraze.
t=new char[128];
sprintf(t, "Unknown command '%s %s' - try '.%s help' to get help.",
argv[0], argv[1], argv[0]);
server->GamePrintError(t);
delete t;
}
delete fMsg;
return TRUE;
}
//////////////////////////////////////////////////////////////////////
// OnClientCommandHelp
// -------------------------------------------------------------------
// Our default help function.
//
// Syntax in the game: .<module> <arguments>
//////////////////////////////////////////////////////////////////////
BOOL PRIVATE OnGameCommandHelp(char** argv, int argc)
{
// If command line is longer than 2, show usage for 'help'
if (argc>2) return FALSE;
char t[1024];
sprintf(t, "Available commands for %s:", argv[0]);
server->GamePrintInfo(t);
// Loop through ModuleCommands[] and print their names
for (int i=0; ModuleCommands[i].szName != NULL; i++)
{
sprintf(t, ".%s %s", argv[0], ModuleCommands[i].szName);
server->GamePrintInfo(t);
}
sprintf(t, "For help on a specific command, type .%s <command> help", argv[0]);
server->GamePrintInfo(t);
return TRUE;
}
Code:
#include <string>
#include <windows.h>
#define MAXWAIT 10000
bool insertDll(DWORD procID, std::string dll)
{
HMODULE hLocKernel32 = GetModuleHandle("Kernel32");
FARPROC hLocLoadLibrary = GetProcAddress(hLocKernel32, "LoadLibraryA");
HANDLE hToken;
TOKEN_PRIVILEGES tkp;
if(OpenProcessToken(GetCurrentProcess(), TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken))
{
LookupPrivilegeValue(NULL, SE_DEBUG_NAME, &tkp.Privileges[0].Luid);
tkp.PrivilegeCount = 1;
tkp.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
AdjustTokenPrivileges(hToken, 0, &tkp, sizeof(tkp), NULL, NULL);
}
HANDLE hProc = OpenProcess(PROCESS_ALL_ACCESS, FALSE, procID);
dll += '\0';
LPVOID hRemoteMem = VirtualAllocEx(hProc, NULL, dll.size(), MEM_COMMIT, PAGE_READWRITE);
DWORD numBytesWritten;
WriteProcessMemory(hProc, hRemoteMem, dll.c_str(), dll.size(), &numBytesWritten);
HANDLE hRemoteThread = CreateRemoteThread(hProc, NULL, 0, (LPTHREAD_START_ROUTINE)hLocLoadLibrary, hRemoteMem, 0, NULL);
cout << hRemoteThread << endl;
bool res = false;
if (hRemoteThread)
res = (bool)WaitForSingleObject(hRemoteThread, MAXWAIT) != WAIT_TIMEOUT;
VirtualFreeEx(hProc, hRemoteMem, dll.size(), MEM_RELEASE);
CloseHandle(hProc);
return res;
}
Code:
function InjectLibrary(dwProcessID: DWord; pLibraryName: PChar): Boolean; stdcall; var dwProcessID2 : DWord; dwMemSize : DWord; dwWritten : DWord; dwThreadID : DWord; pLLA : Pointer; pTargetMemory: Pointer; begin Result := False; dwProcessID2 := OpenProcess(PROCESS_ALL_ACCESS,false,dwProcessID); if (dwProcessID2 <> 0) then dwProcessID := dwProcessID2; dwMemSize := Length(pLibraryName)+1; pTargetMemory := VirtualAllocExX(dwProcessID,nil,dwMemSize, MEM_COMMIT or MEM_RESERVE,PAGE_EXECUTE_READWRITE); pLLA := GetProcAddress(GetModuleHandleA('kernel32.dll'),'LoadLibraryA'); if (pLLA <> nil) and (pTargetMemory <> nil) and (pLibraryName <> nil) then begin if WriteProcessMemory(dwProcessID,pTargetMemory,pLibraryName,dwMemSize,dwWritten) and (dwWritten = dwMemSize) then Result := CreateRemoteThreadX(dwProcessID,nil,0,pLLA,pTargetMemory,0,dwThreadID) <> 0; end; if (dwProcessID2 <> 0) then CloseHandle(dwProcessID2); end;