rendered paste bodyBreakpoint->AddBreakpoint( 0x0070A706, (DWORD)hook_WardenAlloc );
DWORD dwSize = 0, dwBase = 0, dwOrig = 0x0070A718;
void __declspec( naked ) hook_WardenAlloc()
{
_asm
{
pushad
mov esi, [ esi + 4 ]
mov dwSize, esi
popad
mov dwBase, eax
}
dwBase = (DWORD)VirtualAlloc( 0, dwBase, 0x1000, 4 );
/*push 4
push 1000
push eax
push 0
call VirtualAlloc
mov dwBase, eax*/
_asm
{
mov eax, dwBase
mov dword ptr ds:[esi], eax
jmp dwOrig
}
/*
0070A706 > 6A 04 PUSH 4 ; /Protect = PAGE_READWRITE
0070A708 . 68 00100000 PUSH 1000 ; |AllocationType = MEM_COMMIT
0070A70D . 50 PUSH EAX ; |Size
0070A70E . 6A 00 PUSH 0 ; |Address = NULL
0070A710 . FF15 58218300 CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>] ; \VirtualAlloc
0070A716 . 8906 MOV DWORD PTR DS:[ESI],EAX
*/
}