[Mysterious]

Oh great, I it had to come to this point -.-

I already have some very light experiances in disassembling, I hope that might help in any way

Anyways, thank you for your reply and for the luck

Regards
Mysterious

[Mysterious]

Hello,

isn't there an easier way than SigScanning or is there at least a way to get the signature by using the static libraries or the original source code of lua?


Regards
Mysterious


post scriptum: Are double posts allowed in these forums?

[Mysterious]

Hello,
finally I found the disassembly part containing the signature:

00b25430 <lua_open>:
  b25430:    55                       push   %ebp
  b25431:    89 e5                    mov    %esp,%ebp
  b25433:    83 ec 18                 sub    $0x18,%esp
  b25436:    c7 04 24 00 00 00 00     movl   $0x0,(%esp)
  b2543d:    e8 70 f9 ff ff           call   b24db2 <mallocstate>
  b25442:    89 45 fc                 mov    %eax,-0x4(%ebp)
  b25445:    83 7d fc 00              cmpl   $0x0,-0x4(%ebp)
  b25449:    74 67                    je     b254b2 <lua_open+0x82>
  b2544b:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b2544e:    c6 40 04 08              movb   $0x8,0x4(%eax)
  b25452:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b25455:    c6 40 05 00              movb   $0x0,0x5(%eax)
  b25459:    8b 55 fc                 mov    -0x4(%ebp),%edx
  b2545c:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b2545f:    c7 40 50 00 00 00 00     movl   $0x0,0x50(%eax)
  b25466:    c7 02 00 00 00 00        movl   $0x0,(%edx)
  b2546c:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b2546f:    89 04 24                 mov    %eax,(%esp)
  b25472:    e8 66 fd ff ff           call   b251dd <preinit_state>
  b25477:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b2547a:    c7 40 10 00 00 00 00     movl   $0x0,0x10(%eax)
  b25481:    c7 44 24 08 00 00 00     movl   $0x0,0x8(%esp)
  b25488:    00 
  b25489:    c7 44 24 04 94 4f b2     movl   $0xb24f94,0x4(%esp)
  b25490:    00 
  b25491:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b25494:    89 04 24                 mov    %eax,(%esp)
  b25497:    e8 fc ff ff ff           call   b25498 <lua_open+0x68>
  b2549c:    85 c0                    test   %eax,%eax
  b2549e:    74 12                    je     b254b2 <lua_open+0x82>
  b254a0:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b254a3:    89 04 24                 mov    %eax,(%esp)
  b254a6:    e8 d0 fd ff ff           call   b2527b <close_state>
  b254ab:    c7 45 fc 00 00 00 00     movl   $0x0,-0x4(%ebp)
  b254b2:    8b 45 fc                 mov    -0x4(%ebp),%eax
  b254b5:    c9                       leave  
  b254b6:    c3                       ret

But I am a bit confused because of the description how to extract the signature, there was something about question-marks.
Actually I don't really know how to use the Data Display Debugger

Do I just have to glue the hexa-decimal-numbers with "\x"s ?

Then it would be:

\x55\x89\xe5\x83\xec\x18\xc7\x04\x24\x00\x00\x00\x00\xe8\x70\xf9\xff\xff\x89\x45\xfc\x00
\x74\x67\x8b\x45\xfc\xc6\x40\x04\x08\x8b\x45\xfc\xc6\x40\x05\x00\x8b\x55\xfc\x8b\x45\xfc
\xc7\x40\x50\x00\x00\x00\x00\xc7\x02\x00\x00\x00\x00\x8b\x45\xfc\x89\x04\x24\xe8\x66\xfd
\xff\xff\x8b\x45\xfc\xc7\x40\x10\x00\x00\x00\x00\xc7\x44\x24\x08\x00\x00\x00\x00\xc7\x44
\x24\x04\x94\x4f\xb2\x00\x8b\x45\xfc\x89\x04\x24\xe8\xfc\xff\xff\xff\x85\xc0\x74\x12\x8b
\x45\xfc\x89\x04\x24\xe8\xd0\xfd\xff\xff\xc7\x45\xfc\x00\x00\x00\x00\x8b\x45\xfc\xc9\xc3

However I am not sure if it's useful to get the lua_open function...
My plugin will load later then the lua implementation in gmod9 server.
Perhaps I could put my plugin into the server bin directory so it would be loaded before the addons folder.
What do you think?

Regards
Mysterious

[Mysterious]

Hello again,

I finally understood how to create a signature so I can tell you that my previous post was total crap.
I also found a way to get the lua_State pointer. I thought of "hooking/detouring" the lua_dostring and lua_dofile function thus i could get the pointer before the lua-files are executed. At least I think the plugins are loaded before the lua-scripts.
And here my new problem begins:
How to hook the function to get the pointer? I already heared something about detouring but how to do this? Is there a tutorial?

Regards
Mysterious

[Mysterious]

Great...
This is like talking to a wall...

[BAILOPAN]

Grow up. Passive aggressive, snide comments aren't going to make people want to do your work for you. No one gets a paycheck or a 1st Prize Ribbon for answering complicated systems programming questions here.

Functions are just byte streams in memory and detouring is editing the low-level instructions.