GetPixel uses kernelmode?!

wassssup34579 · #11 08-19-2008, 04:34 PM

i heard masm is good. not sure about tasm though.

kaswar · #12 08-19-2008, 05:31 PM

GetPixel clone?

is it like getpixel called 4 times each on a different part of the screen?

also, theres a GPPMX.DLL which bypasses GetPixel in ring3 i think.

it uses the 5 byte jmp

Beast · #13 08-19-2008, 05:34 PM

All right, is do you any of you know asm?

wassssup34579 · #14 08-19-2008, 05:37 PM

Quote:

Originally Posted by kaswar

GetPixel clone?

is it like getpixel called 4 times each on a different part of the screen?

also, theres a GPPMX.DLL which bypasses GetPixel in ring3 i think.

it uses the 5 byte jmp

no, it's not. this also bypasses ring3, but without a 5 byte trampoline.

Quote:

Originally Posted by Beast

All right, is do you any of you know asm?

i know some asm. not alot though. and could we try to keep on topic? im still curious if getpixel uses ring0.

Slugsnack · #15 09-11-2008, 10:14 AM

Have just read this thread. First off.. I want to strongly advise you against using this method. I know it is possible but it is really not smart. The code for APIs differ for different machines and different systems so there is a good chance your code will not function correctly on other systems especially if have modified bits and pieces.

Now then, for your main question. Yes, GetPixel does enter kernelspace if used correctly. Go to OllyDbg and press Ctrl-G (on an application which maps gdi32.dll) and enter GetPixel. See that it eventually makes a CALL ?

Click the call and press enter to follow it. You will probably see something like this :

Code:

773ECCC6    B8 C6100000     MOV EAX,10C6
773ECCCB    BA 0003FE7F     MOV EDX,7FFE0300
773ECCD0    FF12            CALL DWORD PTR DS:[EDX]
773ECCD2    C2 0C00         RETN 0C

0x7FFE0300 is your system-call API structure member and 0x10C6 is your ServiceID for this function. I'm not gonna say much more now because I do know a bit more about kernelmode but it's not something I'm comfortable talking about right now.. (don't feel like saying something wrong and looking like a ****tard lol).

If you REALLY must use your method instead of a trampoline.. what I suggest you do is to fetch the bytes of GetPixel dynamically and store it in a buffer and then write them back to an empty procedure when you want to use them. You will need to do it before GameGuard starts though. That way you can ensure the GetPixel you have is the correct copy for the system your application is running on.

wassssup34579 · #16 09-11-2008, 05:18 PM

but if it uses kernelmode, why doesnt gameguard hook it in ring0?

**Sean** · #17 09-11-2008, 06:13 PM

Quote:

Originally Posted by Slugsnack

[COLOR=\"blue\"]Have just read this thread. First off.. I want to strongly advise you against using this method. I know it is possible but it is really not smart. The code for APIs differ for different machines and different systems so there is a good chance your code will not function correctly on other systems especially if have modified bits and pieces.

Now then, for your main question. Yes, GetPixel does enter kernelspace if used correctly. Go to OllyDbg and press Ctrl-G (on an application which maps gdi32.dll) and enter GetPixel. See that it eventually makes a CALL ?

Click the call and press enter to follow it. You will probably see something like this :[/color]

Code:

773ECCC6    B8 C6100000     MOV EAX,10C6
773ECCCB    BA 0003FE7F     MOV EDX,7FFE0300
773ECCD0    FF12            CALL DWORD PTR DS:[EDX]
773ECCD2    C2 0C00         RETN 0C

[COLOR=\"Blue\"]0x7FFE0300 is your system-call API structure member and 0x10C6 is your ServiceID for this function. I'm not gonna say much more now because I do know a bit more about kernelmode but it's not something I'm comfortable talking about right now.. (don't feel like saying something wrong and looking like a ****tard lol).

If you REALLY must use your method instead of a trampoline.. what I suggest you do is to fetch the bytes of GetPixel dynamically and store it in a buffer and then write them back to an empty procedure when you want to use them. You will need to do it before GameGuard starts though. That way you can ensure the GetPixel you have is the correct copy for the system your application is running on.[/color]

this is where dynamically fetching the first 5 bytes presents a problem. on Rakion for example, all methods of injecting a dll before gg fully loads are patched. I guess the only reason trampolining works on Gunbound is because both gme's are loaded at the same time (right when you click start game).