Light

danielkrupinski / x86retspoof Goto Github PK

Invoke functions with a spoofed return address. For 32-bit Windows binaries. Supports __fastcall, __thiscall, __stdcall and __cdecl calling conventions. Written in C++17.

License: MIT License

C++ 96.13% CMake 3.87%

reverse-engineering assembly-language assembly-x86 game-hacking anticheat-bypass cpp17 single-header x86

x86retspoof's Introduction

x86RetSpoof

Invoke functions with a spoofed return address. For 32-bit Windows binaries.

How to use

Include x86RetSpoof.h in your project.
Find FF 23 byte sequence (gadget, machine code equivalent of jmp dword ptr [ebx]) in the executable code section of the module you want the spoofed return address to appear in. The address of it will be the gadgetAddress and the invoked function will see it as the return address.
Call the function with x86RetSpoof::invoke...() matching the calling convention of the target function.

Example

Calling MessageBoxW function:

x86RetSpoof::invokeStdcall<int>(std::uintptr_t(&MessageBoxW), std::uintptr_t(gadgetAddress), nullptr, L"text", L"title", MB_OK);

x86retspoof's People

Contributors

Stargazers

Watchers

x86retspoof's Issues

I need x64RetSpoof

I need x64RetSpoof. Can you provide an x64 architecture RetSpoof

x64retspoof

would be possible to fuse both codes into one?
1file for x86 and x64
https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html

Osiris, CS:GO - memdumps of game at exit

Since the x86RetSpoof update, when exiting CS:GO, on Windows, 2 memdumps are created.
C:\Users\Me\AppData\Local\CrashDumps

common_sense.h cant be found

https://www.youtube.com/watch?v=v2xg2pSPfBs

I don't get how to spoof __fastcall call.

Hello,

So, I'm using this library for a few days, and i got an small problem.

I want to spoof __fastcall?
for example. I want to spoof call to SetClanTag (game / csgo)
I got an correct address to an function and i use it like that;
x86RetSpoof::invokeFastcall<void>(0, 0, address, csgo::jmpEbxGadgetInClient, "clantag", "clantag");
it leads to the following error:

when using __cdecl, this error doesn't happen, the function gets called, but strings doesn't get passed correctly which is causing some weird unicodes.

Can you please point what am i doing wrong and/or tell me how to fix it?

Thanks!

Recommend Projects

React

A declarative, efficient, and flexible JavaScript library for building user interfaces.
Vue.js

🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript

TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
TensorFlow

An Open Source Machine Learning Framework for Everyone
Django

The Web framework for perfectionists with deadlines.
Laravel

A PHP framework for web artisans
D3

Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

javascript

JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
web

Some thing interesting about web. New door for the world.
server

A server is a program made to process requests and deliver data to clients.
Machine learning

Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Visualization

Some thing interesting about visualization, use data art
Game

Some thing interesting about game, make everyone happy.

Recommend Org

Facebook

We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft

Open source projects and samples from Microsoft.
Google

Google ❤️ Open Source for everyone.
Alibaba

Alibaba Open Source for everyone
D3

Data-Driven Documents codes.
Tencent

China tencent open source team.