All pastes #769400 Raw Edit

Mine

public text v1 · immutable
·published 2007-11-11 12:32 UTC
rendered paste body
Breakpoint->AddBreakpoint( 0x0070A706, (DWORD)hook_WardenAlloc );


DWORD dwSize = 0, dwBase = 0, dwOrig = 0x0070A718;
void __declspec( naked ) hook_WardenAlloc()
{
	_asm
	{
		pushad
		mov esi, [ esi + 4 ]
		mov dwSize, esi
		popad
		mov dwBase, eax
	}
	dwBase = (DWORD)VirtualAlloc( 0, dwBase, 0x1000, 4 );
		/*push 4
		push 1000
		push eax
		push 0
		call VirtualAlloc
		mov dwBase, eax*/
	_asm
	{
		mov eax, dwBase
		mov dword ptr ds:[esi], eax
		jmp dwOrig
	}
	/*
0070A706   > 6A 04          PUSH 4                                                      ; /Protect = PAGE_READWRITE
0070A708   . 68 00100000    PUSH 1000                                                   ; |AllocationType = MEM_COMMIT
0070A70D   . 50             PUSH EAX                                                    ; |Size
0070A70E   . 6A 00          PUSH 0                                                      ; |Address = NULL
0070A710   . FF15 58218300  CALL DWORD PTR DS:[<&KERNEL32.VirtualAlloc>]                ; \VirtualAlloc
0070A716   . 8906           MOV DWORD PTR DS:[ESI],EAX
	*/
}