Skip to content

Instantly share code, notes, and snippets.

@3dsboy08
Last active August 18, 2017 11:32
Show Gist options
  • Save 3dsboy08/d9ae62a4ef677df870647ba8297dcfd1 to your computer and use it in GitHub Desktop.
Save 3dsboy08/d9ae62a4ef677df870647ba8297dcfd1 to your computer and use it in GitHub Desktop.
//generic codecave lib by 3dsboy08 - extremely lazy code, sorry.
//port to your meme of choice
#define GENERIC_CODECAVE(name, stype) DWORD name(stype* arg)
#define CodeCaveHeader DWORD Address;
HANDLE Proc; //edit to your process
DWORD GetFunctionSize(DWORD Func)
{
DWORD Size = 0;
DWORD Amount = 0;
do
{
if (*(BYTE*)(Func + Size) == 0xF4)
{
Amount++;
if (Amount == 4)
{
Size = Size - 3;
break;
}
}
Size++;
} while (1);
return Size;
}
DWORD semi_codecave_create(DWORD function_to_inject)
{
DWORD size = GetFunctionSize((DWORD)function_to_inject);
void* fAddr = VirtualAllocEx(ROBLOXProc, NULL, size, MEM_RESERVE | MEM_COMMIT, PAGE_EXECUTE_READWRITE);
WriteProcessMemory(Proc, fAddr, (void*)function_to_inject, size, NULL);
return (DWORD)fAddr;
}
template<typename T>
DWORD semi_codecave_run(DWORD codecave_addr, T argument)
{
void* paramsAddr = VirtualAllocEx(Proc, NULL, sizeof(T), MEM_RESERVE | MEM_COMMIT, PAGE_READWRITE);
WriteProcessMemory(Proc, paramsAddr, &argument, sizeof(T), NULL);
HANDLE t = CreateRemoteThread(ROBLOXProc, NULL, 0, (LPTHREAD_START_ROUTINE)codecave_addr, paramsAddr, 0, NULL);
if (t)
{
WaitForSingleObject(t, INFINITE);
DWORD ret = 0;
GetExitCodeThread(t, &ret);
VirtualFree(paramsAddr, 0, MEM_RELEASE);
CloseHandle(t);
return ret;
}
return 0;
}
//example
struct s_test
{
CodeCaveHeader;
};
GENERIC_CODECAVE(codecave_test, s_test)
{
your_func_def dostuff = (your_func_def)arg->Address;
return dostuff(0xDEADBEEF);
FUNCTION_MARK();
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment