rendered paste bodyrecive hook (this hook works)
-----------
Orginal bytes
-----------
006F2F20 . 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
006F2F26 . 6A FF PUSH -1
006F2F28 . 68 EFC18300 PUSH KnightOn.0083C1EF
006F2F2D . 50 PUSH EAX
006F2F2E . 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
006F2F35 . 81EC 8C010000 SUB ESP,18C
006F2F3B . 53 PUSH EBX
006F2F3C . 55 PUSH EBP
006F2F3D . 56 PUSH ESI
006F2F3E . 8BB424 A8010000 MOV ESI,DWORD PTR SS:[ESP+1A8]
006F2F45 . 57 PUSH EDI ; ntdll.7C910738
006F2F46 . 8BBC24 B0010000 MOV EDI,DWORD PTR SS:[ESP+1B0]
006F2F4D . 57 PUSH EDI ; /Arg2 = 7C910738
006F2F4E . 8BE9 MOV EBP,ECX ; |
006F2F50 . 8B1F MOV EBX,DWORD PTR DS:[EDI] ; |
006F2F52 . 56 PUSH ESI ; |Arg1 = FFFFFFFF
006F2F53 . E8 D8D00C00 CALL KnightOn.007C0030 ; \KnightOn.007C0030
006F2F58 . 84C0 TEST AL,AL
006F2F5A . 0F85 63030000 JNZ KnightOn.006F32C3
006F2F60 . 8D43 01 LEA EAX,DWORD PTR DS:[EBX+1]
006F2F63 . 8907 MOV DWORD PTR DS:[EDI],EAX
006F2F65 . 8B4E 04 MOV ECX,DWORD PTR DS:[ESI+4]
006F2F68 . 3BC1 CMP EAX,ECX
006F2F6A . 7E 07 JLE SHORT KnightOn.006F2F73
006F2F6C . C64424 14 00 MOV BYTE PTR SS:[ESP+14],0
006F2F71 . EB 0B JMP SHORT KnightOn.006F2F7E
->006F2F73 > 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8]
->006F2F76 . 8A5401 FF MOV DL,BYTE PTR DS:[ECX+EAX-1]
->006F2F7A . 885424 14 MOV BYTE PTR SS:[ESP+14],DL
006F2F7E > 8B4C24 14 MOV ECX,DWORD PTR SS:[ESP+14]
006F2F82 . 81E1 FF000000 AND ECX,0FF
006F2F88 . 83C1 FA ADD ECX,-6 ; Switch (cases 6..90)
006F2F8B . 81F9 8A000000 CMP ECX,8A
006F2F91 . 0F87 111C0000 JA KnightOn.006F4BA8
-----------
codecave
-----------
00150000 50 PUSH EAX
00150001 890D F4011500 MOV DWORD PTR DS:[1501F4],ECX
->00150007 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8]
0015000A 890D FE011500 MOV DWORD PTR DS:[1501FE],ECX
00150010 68 80000000 PUSH 80
00150015 6A 03 PUSH 3
00150017 6A 00 PUSH 0
00150019 6A 01 PUSH 1
0015001B 68 00000040 PUSH 40000000
00150020 68 00041500 PUSH 150400 ; ASCII "\\\\.\\mailslot\\recivehook"
00150025 FF15 2A031500 CALL DWORD PTR DS:[15032A] ; kernel32.CreateFileA
0015002B 83F8 FF CMP EAX,-1
0015002E 74 1D JE SHORT 0015004D
00150030 50 PUSH EAX
00150031 6A 00 PUSH 0
00150033 54 PUSH ESP
00150034 FF35 F4011500 PUSH DWORD PTR DS:[1501F4]
0015003A FF35 FE011500 PUSH DWORD PTR DS:[1501FE]
00150040 50 PUSH EAX
00150041 FF15 34031500 CALL DWORD PTR DS:[150334] ; kernel32.WriteFile
00150047 FF15 3E031500 CALL DWORD PTR DS:[15033E] ; kernel32.CloseHandle
->0015004D 8B4E 08 MOV ECX,DWORD PTR DS:[ESI+8]
->00150050 8A5408 FF MOV DL,BYTE PTR DS:[EAX+ECX-1]
00150054 68 7A2F6F00 PUSH 6F2F7A
00150059 C3 RETN
Send Hook (this hook fails)
-----------
Orginal bytes
-----------
0046FD30 /$ 64:A1 00000000 MOV EAX,DWORD PTR FS:[0]
0046FD36 |. 6A FF PUSH -1
0046FD38 |. 68 BB8A8100 PUSH KnightOn.00818ABB
0046FD3D |. 50 PUSH EAX
0046FD3E |. B8 10030400 MOV EAX,40310
0046FD43 |. 64:8925 00000000 MOV DWORD PTR FS:[0],ESP
0046FD4A |. E8 A1303900 CALL KnightOn.00802DF0
0046FD4F |. 56 PUSH ESI
0046FD50 |. 8BF1 MOV ESI,ECX
0046FD52 |. 897424 04 MOV DWORD PTR SS:[ESP+4],ESI
0046FD56 |. 8B86 94000400 MOV EAX,DWORD PTR DS:[ESI+40094]
0046FD5C |. 85C0 TEST EAX,EAX
0046FD5E |. 0F84 5D010000 JE KnightOn.0046FEC1
0046FD64 |. 837E 04 FF CMP DWORD PTR DS:[ESI+4],-1
0046FD68 |. 0F84 53010000 JE KnightOn.0046FEC1
0046FD6E |. 8B86 20000400 MOV EAX,DWORD PTR DS:[ESI+40020]
0046FD74 |. 85C0 TEST EAX,EAX
0046FD76 |. 0F84 45010000 JE KnightOn.0046FEC1
0046FD7C |. 53 PUSH EBX
0046FD7D |. 55 PUSH EBP
0046FD7E |. 57 PUSH EDI ; ntdll.7C910738
0046FD7F |. B9 FFFF0000 MOV ECX,0FFFF
0046FD84 |. 33C0 XOR EAX,EAX
0046FD86 |. 8DBC24 21030000 LEA EDI,DWORD PTR SS:[ESP+321]
0046FD8D |. C68424 20030000 00 MOV BYTE PTR SS:[ESP+320],0
0046FD95 |. F3:AB REP STOS DWORD PTR ES:[EDI]
0046FD97 |. 66:AB STOS WORD PTR ES:[EDI]
0046FD99 |. AA STOS BYTE PTR ES:[EDI]
0046FD9A |. 8B86 38000400 MOV EAX,DWORD PTR DS:[ESI+40038]
0046FDA0 |. 85C0 TEST EAX,EAX
0046FDA2 |. 74 36 JE SHORT KnightOn.0046FDDA
0046FDA4 |. 68 BC9B8900 PUSH KnightOn.00899BBC ; /Arg1 = 00899BBC ASCII "S9*lO1mD"
0046FDA9 |. 8D4C24 24 LEA ECX,DWORD PTR SS:[ESP+24] ; |
0046FDAD |. E8 1EED2B00 CALL KnightOn.0072EAD0 ; \KnightOn.0072EAD0
0046FDB2 |. 8B86 3C000400 MOV EAX,DWORD PTR DS:[ESI+4003C]
0046FDB8 |. 8B8C24 34030400 MOV ECX,DWORD PTR SS:[ESP+40334]
0046FDBF |. 8B9424 30030400 MOV EDX,DWORD PTR SS:[ESP+40330]
0046FDC6 |. 50 PUSH EAX ; /Arg3 = 00000000
0046FDC7 |. 51 PUSH ECX ; |Arg2 = 0013FFB0
0046FDC8 |. 52 PUSH EDX ; |Arg1 = 7C90EB94
0046FDC9 |. 8D4C24 2C LEA ECX,DWORD PTR SS:[ESP+2C] ; |
0046FDCD |. E8 0EEE2B00 CALL KnightOn.0072EBE0 ; \KnightOn.0072EBE0
0046FDD2 |. 8BB6 3C000400 MOV ESI,DWORD PTR DS:[ESI+4003C]
0046FDD8 |. EB 0E JMP SHORT KnightOn.0046FDE8
->0046FDDA |> 8B8424 34030400 MOV EAX,DWORD PTR SS:[ESP+40334]
->0046FDE1 |. 8BB424 30030400 MOV ESI,DWORD PTR SS:[ESP+40330]
0046FDE8 |> 6A 01 PUSH 1
0046FDEA |. 56 PUSH ESI
0046FDEB |. 50 PUSH EAX
0046FDEC |. 8D4C24 20 LEA ECX,DWORD PTR SS:[ESP+20]
0046FDF0 |. E8 4BECFFFF CALL KnightOn.0046EA40
-----------
codecave
-----------
00160000 50 PUSH EAX
00160001 890D F4011600 MOV DWORD PTR DS:[1601F4],ECX
->00160007 8B8424 34030400 MOV EAX,DWORD PTR SS:[ESP+40334]
0016000E 890D FE011600 MOV DWORD PTR DS:[1601FE],ECX
00160014 68 80000000 PUSH 80
00160019 6A 03 PUSH 3
0016001B 6A 00 PUSH 0
0016001D 6A 01 PUSH 1
0016001F 68 00000040 PUSH 40000000
00160024 68 00041600 PUSH 160400 ; ASCII "\\\\.\\mailslot\\sendhook"
00160029 FF15 2A031600 CALL DWORD PTR DS:[16032A] ; kernel32.CreateFileA
0016002F 83F8 FF CMP EAX,-1
00160032 74 1D JE SHORT 00160051
00160034 50 PUSH EAX
00160035 6A 00 PUSH 0
00160037 54 PUSH ESP
00160038 FF35 F4011600 PUSH DWORD PTR DS:[1601F4]
0016003E FF35 FE011600 PUSH DWORD PTR DS:[1601FE]
00160044 50 PUSH EAX
00160045 FF15 34031600 CALL DWORD PTR DS:[160334] ; kernel32.WriteFile
0016004B FF15 3E031600 CALL DWORD PTR DS:[16033E] ; kernel32.CloseHandle
->00160051 8B8C24 34030400 MOV ECX,DWORD PTR SS:[ESP+40334]
00160058 68 DAFD4600 PUSH 46FDDA
0016005D C3 RETN
but a friend says he hook like this(he hook skills):
00260111 B8 FF000000 MOV EAX,0FF
00260116 8BB424 30030400 MOV ESI,DWORD PTR SS:[ESP+40330]
0026011D 8A0E MOV CL,BYTE PTR DS:[ESI]
0026011F 80F9 21 CMP CL,21
00260122 74 10 JE SHORT 00260134
00260124 8A0E MOV CL,BYTE PTR DS:[ESI]
00260126 80F9 31 CMP CL,31
00260129 74 02 JE SHORT 0026012D
0026012B EB 10 JMP SHORT 0026013D
0026012D 8B4E 02 MOV ECX,DWORD PTR DS:[ESI+2]
00260130 8908 MOV DWORD PTR DS:[EAX],ECX
00260132 EB 09 JMP SHORT 0026013D
00260134 B9 0F000000 MOV ECX,0F
00260139 8BF8 MOV EDI,EAX
0026013B F3:A4 REP MOVS BYTE PTR ES:[EDI],BYTE PTR DS:[ESI]
0026013D 8B8424 34030400 MOV EAX,DWORD PTR SS:[ESP+40334]
00260144 68 DAFD4600 PUSH 46FDDA
00260149 C3 RETN
but how do I get data from send hook to mailslot(I need more then just skills so are address still right?)?