Thread: [64-bit]Quake Live Hack

A quick Quake Live base I put together to get into 64-bit reversing and detouring. Will be updating as time goes on.

Features:
-Works on FF 3.x and 4 64-bit
-Player filtered wallhack
-vmMain and Syscall is setup to be redirected
-Dynamic 64-bit detour function that currently handles (for me at least) relative addressing issues such as branches, jumps, and RIP related operands. Its very messy and was thrown together as a PoC. Must have distorm3 compiled and installed to use

Any feedback is appreciated

Credits:
azorbix @ GD for initial 64-bit detour base
nixCoders, th0bro, m0wl, distorm

************* EDIT **************
Updated the detouring function in the attached zip in the first post to actually handle Branches and Relative Addressing for specific instructions instead of failing :Embarrass (Was going about it the wrong way).

Currently handles:
**Relative MOV instructions with a 32-bit or 64-bit register as the destination
**Common MOVSXD and MOVSS instructions
**All branch instructions, however it will not handle detours over a jump location. Specifically a detour at location 0x5195FE will fail in the example below as you will disrupt other branches to loc_519606.

Code:

.text:00000000005195FC                 cdqe
.text:00000000005195FE                 add     r12, rax
.text:0000000000519601                 jmp     loc_519486
.text:0000000000519606 ; ---------------------------------------------------------------------------
.text:0000000000519606
.text:0000000000519606 loc_519606:                             ; CODE XREF: sub_518E80+2F8j
.text:0000000000519606                 mov     rdx, r14
.text:0000000000519609                 mov     esi, offset aR_loadmd3SHasN ; "R_LoadMD3: %s has no frames\n"

**Trampoline size is automatically resized when needed. Also the trampoline does not have to be within a 32-bit jump of the target function as previously implemented

good work :] Let me test it now ^^

One again, all I can say, nice job. Those detours are slightly non consistent, but I can forgive you as it is a PoC
Doesn't RIP point to the end of its current instruction, so it will always point to the next address (offset), no matter howmuch operands you'll add to your opcode?
I'd better get started

After unpacking, how to use it?

Detour function updated

good work

Originally Posted by amba

good work

But, can you refresh code ?