this thread is for developers of bots for Webzen. Plz only post in here if u are a developer.
Ill describe here the way to bypass GG blocked API Calls.
Ok ... lets take a look the PostMessageW API Call.
This is the normal assembly of the first bytes of it:
Code:
7E368CCB USER32.PostMessageW 8BFF mov edi, edi 7E368CCD 55 push ebp 7E368CCE 8BEC mov ebp, esp 7E368CD0 8B45 0C mov eax, dword ptr [ebp+C]
Code:
7E368CCB USER32.PostMessageW - FF65 08 jmp GG Function 7E368CCE 8BEC mov ebp, esp 7E368CD0 8B45 0C mov eax, dword ptr [ebp+C]
Ok how do we bypass it ?
First we need the Address of the PostMessageW API call so lets load the needed dll and get the address of the function.
Use LoadLibrary() and GetProcAddress(), now we need to inc 5 Bytes the original address (to overjump the gg hook).
1 Problem is still left ... we need to rebuild the stack so the original function can proceed its work.
Ill show an example.
Code:
hInst = LoadLibrary("user32.dll");
DLLFunc = (DWORD)GetProcAddress(hInst, "PostMessageW") + 5;
__declspec(naked) BOOL WINAPI __stdcall xPostMessageW(HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam)
{
__asm
{
mov edi, edi
push ebp
mov ebp, esp
jmp [DLLFunc]
}
}
Greez ACE
that would be very nice 
.
