{"id":1449,"date":"2017-07-17T07:48:35","date_gmt":"2017-07-17T07:48:35","guid":{"rendered":"http:\/\/www.gironsec.com\/blog\/?p=1449"},"modified":"2017-07-17T07:48:35","modified_gmt":"2017-07-17T07:48:35","slug":"intel-pin-cheatz-hax-and-detection-part-2","status":"publish","type":"post","link":"https:\/\/www.gironsec.com\/blog\/2017\/07\/intel-pin-cheatz-hax-and-detection-part-2\/","title":{"rendered":"Intel PIN, Cheatz, Hax, And Detection Part 2"},"content":{"rendered":"

Hi!<\/p>\n

Today I’m going to go over more on intel’s PIN, more on cheats, and less on detection since I already covered that. I feel like I’ve spent way too much time on this and it’s a huge turn off against my productivity. And of course, I commit to a talk and it HAS to be done. Blech. At least I can now work on the talk more. <\/p>\n

As I’ve gone over before, PIN allows us to dynamically instrument programs without source code. The documentation is nice, but leaves some things to be desired. For example – how in the hell do you stop on a specific memory address rather than some API name? <\/p>\n

Cheats and PIN. <\/p>\n

Traditionally a cheat will make use of (WriteProcessMemory) or something similiar to ‘peek’ and ‘poke’ memory addresses and with values of our choice. Once we’ve established the right memory addresses and values of course, we write our 3rd party ‘helper’ app (trainer) that attaches to a game and does our peek \/ poke. Here is what a typical cheat looks like in C# for windows. C# because not everything has to be C\/C++, and managed code is awesome for those kick ass easy guis:<\/p>\n

<\/p>\n

\n
using<\/span> System<\/span>;<\/span>\r\nusing<\/span> System.Collections.Generic<\/span>;<\/span>\r\nusing<\/span> System.Linq<\/span>;<\/span>\r\nusing<\/span> System.Text<\/span>;<\/span>\r\nusing<\/span> System.Threading.Tasks<\/span>;<\/span>\r\nusing<\/span> System.Diagnostics<\/span>;<\/span>\r\nusing<\/span> System.Runtime.InteropServices<\/span>;<\/span>\r\n\r\nnamespace<\/span> Trainer<\/span>\r\n{<\/span>\r\n    class<\/span> Program<\/span>\r\n    {<\/span>\r\n        [DllImport("kernel32.dll")]<\/span>\r\n        internal<\/span> static<\/span> extern<\/span> IntPtr<\/span> OpenProcess<\/span>(<\/span>int<\/span> dwDesiredAccess<\/span>,<\/span> bool<\/span> bInheritHandle<\/span>,<\/span> int<\/span> dwProcessId<\/span>);<\/span>\r\n\r\n        [DllImport("kernel32.dll", SetLastError = true)]<\/span>\r\n        static<\/span> extern<\/span> bool<\/span> WriteProcessMemory<\/span>(<\/span>IntPtr<\/span> hProcess<\/span>,<\/span> IntPtr<\/span> lpBaseAddress<\/span>,<\/span> byte<\/span>[]<\/span> lpBuffer<\/span>,<\/span> int<\/span> nSize<\/span>,<\/span> out<\/span> IntPtr<\/span> lpNumberOfBytesWritten<\/span>);<\/span>\r\n\r\n        [DllImport("kernel32.dll")]<\/span>\r\n        static<\/span> extern<\/span> bool<\/span> ReadProcessMemory<\/span>(<\/span>IntPtr<\/span> hProcess<\/span>,<\/span> IntPtr<\/span> lpBaseAddress<\/span>,<\/span> byte<\/span>[]<\/span> lpBuffer<\/span>,<\/span> UInt32<\/span> nSize<\/span>,<\/span> ref<\/span> UInt32<\/span> lpNumberOfBytesRead<\/span>);<\/span>\r\n        <\/span>\r\n        [DllImport("kernel32.dll")]<\/span>\r\n        static<\/span> extern<\/span> bool<\/span> CloseHandle<\/span>(<\/span>IntPtr<\/span> hHandle<\/span>);<\/span>\r\n\r\n        [DllImport("User32.dll")]<\/span>\r\n        private<\/span> static<\/span> extern<\/span> short<\/span> GetAsyncKeyState<\/span>(<\/span>System<\/span>.<\/span>Int32<\/span> vKey<\/span>);<\/span>\r\n\r\n        [DllImport("kernel32.dll")]<\/span>\r\n        static<\/span> extern<\/span> bool<\/span> VirtualProtectEx<\/span>(<\/span>IntPtr<\/span> hProcess<\/span>,<\/span> IntPtr<\/span> lpAddress<\/span>,<\/span> UIntPtr<\/span> dwSize<\/span>,<\/span> uint<\/span> flNewProtect<\/span>,<\/span> out<\/span> uint<\/span> lpflOldProtect<\/span>);<\/span>\r\n\r\n        static<\/span> int<\/span> ProcID<\/span>;<\/span>\r\n        static<\/span> IntPtr<\/span> Handle<\/span>;<\/span>\r\n\r\n        public<\/span> static<\/span> class<\/span> OutIgnore<\/span><<\/span>T<\/span>><\/span>\r\n        {<\/span>\r\n            [ThreadStatic]<\/span>\r\n            public<\/span> static<\/span> T<\/span> Ignored<\/span>;<\/span>\r\n        }<\/span>\t\r\n        public<\/span> static<\/span> void<\/span> WriteMemory<\/span>(<\/span>int<\/span> Address<\/span>,<\/span> byte<\/span>[]<\/span> data<\/span>)<\/span>\r\n        {<\/span>\r\n            WriteProcessMemory<\/span>(<\/span>Handle<\/span>,<\/span> (<\/span>IntPtr<\/span>)<\/span>Address<\/span>,<\/span> data<\/span>,<\/span> data<\/span>.<\/span>Length<\/span>,<\/span> out<\/span> OutIgnore<\/span><<\/span>IntPtr<\/span>>.<\/span>Ignored<\/span>);<\/span>\r\n        }<\/span>\r\n\t\t\r\n        public<\/span> static<\/span> byte<\/span>[]<\/span> Read<\/span>(<\/span>IntPtr<\/span> Address<\/span>,<\/span> int<\/span> length<\/span>)<\/span>\r\n        {<\/span>\r\n            byte<\/span>[]<\/span> ret<\/span> =<\/span> new<\/span> byte<\/span>[<\/span>length<\/span>];<\/span>\r\n            ReadProcessMemory<\/span>(<\/span>Handle<\/span>,<\/span> Address<\/span>,<\/span> ret<\/span>,<\/span> (<\/span>UInt32<\/span>)<\/span>ret<\/span>.<\/span>Length<\/span>,<\/span> ref<\/span> OutIgnore<\/span><<\/span>uint<\/span>>.<\/span>Ignored<\/span>);<\/span>\r\n            return<\/span> ret<\/span>;<\/span>\r\n        }<\/span>\r\n\t\t\r\n        public<\/span> static<\/span> int<\/span> ReadInt32<\/span>(<\/span>IntPtr<\/span> Address<\/span>,<\/span> int<\/span> len<\/span>)<\/span>\r\n        {<\/span>\r\n            return<\/span> BitConverter<\/span>.<\/span>ToInt32<\/span>(<\/span>Read<\/span>(<\/span>Address<\/span>,<\/span> len<\/span>),<\/span> 0<\/span>);<\/span>\r\n        }<\/span>\r\n\t\t\r\n        public<\/span> static<\/span> byte<\/span> ByteReadOffset<\/span>(<\/span>IntPtr<\/span> addr<\/span>,<\/span> int<\/span> offset<\/span>,<\/span> int<\/span> len<\/span>)<\/span>\r\n        {<\/span>\r\n            int<\/span> address<\/span> =<\/span> ReadInt32<\/span>(<\/span>addr<\/span>,<\/span> len<\/span>);<\/span>\r\n            return<\/span> Read<\/span>((<\/span>IntPtr<\/span>)<\/span>address<\/span> +<\/span> offset<\/span>,<\/span> 1<\/span>)[<\/span>0<\/span>];<\/span>\r\n        }<\/span>\r\n\t\t\r\n        public<\/span> static<\/span> float<\/span> FloatReadOffset<\/span>(<\/span>IntPtr<\/span> addr<\/span>,<\/span> int<\/span> offset<\/span>,<\/span> int<\/span> len<\/span>)<\/span>\r\n        {<\/span>\r\n            int<\/span> address<\/span> =<\/span> ReadInt32<\/span>(<\/span>addr<\/span>,<\/span> len<\/span>);<\/span>\r\n            byte<\/span>[]<\/span> naddr<\/span> =<\/span> Read<\/span>((<\/span>IntPtr<\/span>)<\/span>address<\/span> +<\/span> offset<\/span>,<\/span> sizeof<\/span>(<\/span>float<\/span>));<\/span>\r\n            return<\/span> BitConverter<\/span>.<\/span>ToSingle<\/span>(<\/span>naddr<\/span>,<\/span> 0<\/span>);<\/span>\r\n        }<\/span>\r\n\t\t\r\n        public<\/span> static<\/span> int<\/span> IntReadOffset<\/span>(<\/span>IntPtr<\/span> addr<\/span>,<\/span> int<\/span> offset<\/span>,<\/span> int<\/span> len<\/span>)<\/span>\r\n        {<\/span>\r\n            int<\/span> address<\/span> =<\/span> ReadInt32<\/span>(<\/span>addr<\/span>,<\/span> len<\/span>);<\/span>\r\n            byte<\/span>[]<\/span> naddr<\/span> =<\/span> Read<\/span>((<\/span>IntPtr<\/span>)<\/span>address<\/span> +<\/span> offset<\/span>,<\/span> sizeof<\/span>(<\/span>int<\/span>));<\/span>\r\n            return<\/span> BitConverter<\/span>.<\/span>ToInt32<\/span>(<\/span>naddr<\/span>,<\/span> 0<\/span>);<\/span>\r\n        }<\/span>\r\n\t\t\r\n        public<\/span> static<\/span> void<\/span> WriteOffset<\/span>(<\/span>IntPtr<\/span> addr<\/span>,<\/span> int<\/span> offset<\/span>,<\/span> byte<\/span>[]<\/span> res<\/span>,<\/span> int<\/span> len<\/span>)<\/span>\r\n        {<\/span>\r\n            int<\/span> address<\/span> =<\/span> ReadInt32<\/span>(<\/span>addr<\/span>,<\/span> len<\/span>);<\/span>\r\n            WriteMemory<\/span>(<\/span>address<\/span> +<\/span> offset<\/span>,<\/span> res<\/span>);<\/span>\r\n        }<\/span>\r\n\t\t\r\n        static<\/span> void<\/span> Main<\/span>(<\/span>string<\/span>[]<\/span> args<\/span>)<\/span>\r\n        {<\/span>\r\n            Console<\/span>.<\/span>WriteLine<\/span>(<\/span>"Started. W8 process...."<\/span>);<\/span>\r\n            while<\/span> (<\/span>ProcID<\/span> ==<\/span> 0<\/span>)<\/span>\r\n            {<\/span>\r\n                foreach<\/span> (<\/span>Process<\/span> id<\/span> in<\/span> Process<\/span>.<\/span>GetProcessesByName<\/span>(<\/span>"AoK HD"<\/span>))<\/span>\r\n                {<\/span>\r\n                    ProcID<\/span> =<\/span> id<\/span>.<\/span>Id<\/span>;<\/span>\r\n                }<\/span>\r\n            }<\/span>\r\n\r\n            Handle<\/span> =<\/span> OpenProcess<\/span>(<\/span>0<\/span>x001F0FFF<\/span>,<\/span> false<\/span>,<\/span> ProcID<\/span>);<\/span>\r\n\r\n            \r\n            bool<\/span> makeitrain<\/span> =<\/span> false<\/span>;<\/span>\r\n\t\t\t\r\n            Console<\/span>.<\/span>WriteLine<\/span>(<\/span>"Injected"<\/span>);<\/span>\r\n\t\t\t\r\n            while<\/span> (<\/span>true<\/span>)<\/span>\r\n            {<\/span>\r\n                string<\/span> cmd<\/span> =<\/span> Console<\/span>.<\/span>ReadLine<\/span>();<\/span>\r\n\r\n                if<\/span> (<\/span>cmd<\/span> ==<\/span> "exit"<\/span>)<\/span>\r\n                    return<\/span>;<\/span>\r\n\r\n                if<\/span> (<\/span>cmd<\/span> ==<\/span> "makeitrain"<\/span>)<\/span>\r\n                {<\/span>\r\n                    makeitrain<\/span> =<\/span> (!<\/span>makeitrain<\/span>);<\/span>\r\n                    WriteMemory<\/span>(<\/span>0<\/span>xA444A4<\/span>,<\/span> (!<\/span>makeitrain<\/span>)<\/span> ?<\/span> new<\/span> byte<\/span>[]<\/span> {<\/span> 0<\/span>x0<\/span> }<\/span> :<\/span> new<\/span> byte<\/span>[]<\/span> {<\/span> 0<\/span>x1<\/span> });<\/span>\r\n                }<\/span>\r\n                if<\/span> (<\/span>cmd<\/span> ==<\/span> "get"<\/span>)<\/span>\r\n                {<\/span>\r\n                    Console<\/span>.<\/span>WriteLine<\/span>(<\/span>"State: "<\/span> +<\/span> CPed<\/span>.<\/span>GetByteOffset<\/span>(<\/span>0<\/span>x46F<\/span>));<\/span>\r\n                    Console<\/span>.<\/span>WriteLine<\/span>(<\/span>"Animation State: "<\/span> +<\/span> CPed<\/span>.<\/span>GetByteOffset<\/span>(<\/span>0<\/span>x4DF<\/span>));<\/span>\r\n                    Console<\/span>.<\/span>WriteLine<\/span>(<\/span>"Gold: "<\/span> +<\/span> ReadInt32<\/span>((<\/span>IntPtr<\/span>)<\/span>0<\/span>xB7CE50<\/span>,<\/span> 4<\/span>));<\/span>\r\n                    \r\n                }<\/span>\r\n            }<\/span>\r\n        }<\/span>\r\n    }<\/span>\r\n}<\/span>\r\n<\/pre>\n<\/div>\n
Your classic trainer in action – Find a memory address, poke it with a new value. Easy right? Can you guess the game? Hint: GetProcessesByName(“AoK HD”)<\/i>. That’s right, age of empires. <\/p>\n
It’s pretty simple in action – writes itself directly to the address space of the process after opening a handle to it. This will work for a lot of games too. The problem is, many games no check for this sort of thing. We have to be more creative. But how?<\/p>\n
Well, we could try DLL Injection. For those unfamiliar with DLL Injection, we basically write a dll, place code in the ‘DLL_PROCESS_ATTACH’ region, then when our dll is injected, our code is run in the address space of the game \/ process. This is a bonus because it makes the program think it belongs or something. <\/p>\n
<\/p>\n
\n
#include <windows.h><\/span>\r\n#include <tlhelp32.h><\/span>\r\n#include <Psapi.h><\/span>\r\n#include <stdio.h> <\/span>\r\n\r\nstatic<\/span> const<\/span> DWORD<\/span> ammo<\/span> =<\/span> 0x0EB9B878<\/span>;<\/span>\r\nHANDLE<\/span> dllhandle<\/span> =<\/span> 0<\/span>;<\/span>\r\n\r\nDWORD<\/span> ThreadProc<\/span>(<\/span>LPVOID<\/span> lpdwThreadParam<\/span>);<\/span>\r\n\r\nMODULEINFO<\/span> GetModuleInfo<\/span>(<\/span> char<\/span> *<\/span>szModule<\/span> )<\/span>\r\n{<\/span>\r\n\tMODULEINFO<\/span> modinfo<\/span> =<\/span> {<\/span>0<\/span>};<\/span>\r\n\tHMODULE<\/span> hModule<\/span> =<\/span> GetModuleHandle<\/span>(<\/span>szModule<\/span>);<\/span>\r\n\tif<\/span>(<\/span>hModule<\/span> ==<\/span> 0<\/span>)<\/span> \r\n\t\treturn<\/span> modinfo<\/span>;<\/span>\r\n\tGetModuleInformation<\/span>(<\/span>GetCurrentProcess<\/span>(),<\/span> hModule<\/span>,<\/span> &<\/span>modinfo<\/span>,<\/span> sizeof<\/span>(<\/span>MODULEINFO<\/span>));<\/span>\r\n\treturn<\/span> modinfo<\/span>;<\/span>\r\n}<\/span>\r\n\r\nvoid<\/span> WriteToMemory<\/span>(<\/span>DWORD<\/span>*<\/span> addressToWrite<\/span>,<\/span> char<\/span>*<\/span> valueToWrite<\/span>,<\/span> int<\/span> byteNum<\/span>)<\/span>\r\n{<\/span>\r\n\tunsigned<\/span> long<\/span> OldProtection<\/span>;<\/span>\r\n\tVirtualProtect<\/span>((<\/span>LPVOID<\/span>)(<\/span>addressToWrite<\/span>),<\/span> byteNum<\/span>,<\/span> PAGE_EXECUTE_READWRITE<\/span>,<\/span> &<\/span>OldProtection<\/span>);<\/span>\r\n\tmemcpy<\/span>(<\/span> (<\/span>LPVOID<\/span>)<\/span>addressToWrite<\/span>,<\/span> valueToWrite<\/span>,<\/span> byteNum<\/span>);<\/span>\r\n\tVirtualProtect<\/span>((<\/span>LPVOID<\/span>)(<\/span>addressToWrite<\/span>),<\/span> byteNum<\/span>,<\/span> OldProtection<\/span>,<\/span> NULL<\/span>);<\/span>\r\n}<\/span>\r\n\r\n\r\nvoid<\/span> ChangeMemory<\/span>(<\/span>DWORD<\/span> baseadress<\/span>,<\/span> int<\/span> value<\/span>,<\/span> DWORD<\/span> offset1<\/span>,<\/span> DWORD<\/span> offset2<\/span>,<\/span> BOOL<\/span> msg<\/span>)<\/span>\r\n{<\/span>\r\n\t\/\/DWORD d, ds;<\/span>\r\n\tDWORD<\/span>*<\/span> adress<\/span> =<\/span> (<\/span>DWORD<\/span>*<\/span>)((<\/span>*<\/span>(<\/span>DWORD<\/span>*<\/span>)(<\/span>baseadress<\/span> +<\/span> offset1<\/span>))<\/span> +<\/span> offset2<\/span>);<\/span>\t\r\n \r\n\tif<\/span> (<\/span>msg<\/span>)<\/span>\r\n\t{<\/span>\r\n\t\tchar<\/span> szTest<\/span>[<\/span>10<\/span>]<\/span> ;<\/span>\r\n\t\tsprintf<\/span>(<\/span>szTest<\/span>,<\/span> "The final adress is : %X"<\/span>,<\/span> adress<\/span>);<\/span>\r\n\t\tMessageBox<\/span>(<\/span>NULL<\/span>,<\/span>szTest<\/span> ,<\/span> NULL<\/span>,<\/span> MB_OK<\/span>);<\/span>\r\n\t}<\/span>\r\n \r\n\t*<\/span>(<\/span>int<\/span>*<\/span>)<\/span>adress<\/span> =<\/span> value<\/span>;<\/span>\r\n}<\/span>\r\n\r\nBOOL<\/span> WINAPI<\/span> DllMain<\/span>\r\n(<\/span>\r\n    HANDLE<\/span>   hinstDLL<\/span>,<\/span>\r\n    DWORD<\/span>       fdwReason<\/span>,<\/span>\r\n    LPVOID<\/span>      lpvReserved<\/span>\r\n)<\/span>\r\n{<\/span>\r\n    if<\/span>(<\/span>fdwReason<\/span>==<\/span>DLL_PROCESS_ATTACH<\/span>)<\/span>\r\n    {<\/span>\r\n \t\tDWORD<\/span> threadId<\/span>;<\/span>\r\n\t\tdllhandle<\/span> =<\/span> hinstDLL<\/span>;<\/span>\r\n        CreateThread<\/span>(<\/span>NULL<\/span>,<\/span> 0<\/span>,<\/span> (<\/span>LPTHREAD_START_ROUTINE<\/span>)<\/span>&<\/span>ThreadProc<\/span>,<\/span> NULL<\/span>,<\/span> 0<\/span>,<\/span> &<\/span>threadId<\/span>);<\/span>\r\n\t}<\/span>\r\n   \r\n    return<\/span> 1<\/span>;<\/span>\r\n}<\/span>\r\nDWORD<\/span> ThreadProc<\/span>(<\/span>LPVOID<\/span> lpdwThreadParam<\/span>)<\/span>\r\n{<\/span>\r\n\tMODULEINFO<\/span> mInfo<\/span> =<\/span> GetModuleInfo<\/span>(<\/span>"fearxp.exe"<\/span>);<\/span>\r\n\tDWORD<\/span> base<\/span> =<\/span> (<\/span>DWORD<\/span>)<\/span>mInfo<\/span>.<\/span>lpBaseOfDll<\/span>;<\/span>\r\n\tChangeMemory<\/span>(<\/span>base<\/span>,<\/span>1234<\/span>,<\/span>ammo<\/span>,<\/span>ammo<\/span>,<\/span>FALSE<\/span>);<\/span>\r\n   \r\n    return<\/span> 0<\/span>;<\/span>\r\n}<\/span>\r\n<\/pre>\n<\/div>\n
The idea is pretty simple – poke a memory address after creating a new thread. The thread runs in the context of the running program. I know what you’re thinking – “Joe, isn’t this good enough for my cheats? surely the game won’t detect this? right?” and you’d be half right. Some game devs are clever assholes. We need to be more clever than them to inject code into their products and not have them caught. We can always use hooking and detours to do our injection. <\/p>\n
Recall, I’ve talked about detours before<\/a>. Yeah those, we can use those for game hacking. Given we have our function pointer address \/ memory address or function name, we can ‘detour’ to our code to peek \/ poke whatever address \/ value combo we want. Though I used detouring for more…evil purposes, however the concepts carry over.<\/p>\n
<\/p>\n
\n
#include "stdafx.h"<\/span>\r\n#include <windows.h><\/span>\r\n#include <detours.h><\/span>\r\n#pragma comment(lib, "detours.lib")<\/span>\r\n\r\ntypedef<\/span> void<\/span> (<\/span>WINAPI<\/span> *<\/span>pFunc<\/span>)(<\/span>void<\/span>);<\/span>\r\nvoid<\/span> WINAPI<\/span> MyFunc<\/span>(<\/span>void<\/span>);<\/span>\r\npFunc<\/span> FuncToDetour<\/span> =<\/span> (<\/span>pFunc<\/span>)(<\/span>0x4BD11B<\/span>);<\/span> \/\/ Set it at address to detour in<\/span>\r\n\r\nvoid<\/span> WINAPI<\/span> MyFunc<\/span>(<\/span>void<\/span>)<\/span>\r\n{<\/span>\r\n\tMessageBox<\/span>(<\/span>NULL<\/span>,<\/span> L"NONO"<\/span>,<\/span> L"TEST"<\/span>,<\/span> MB_OK<\/span>);<\/span>\r\n\tunsigned<\/span> char<\/span> buf<\/span>[]<\/span> =<\/span>\r\n\t\t"\\xfc\\xe8\\x82\\x00\\x00\\x00\\x60\\x89\\xe5\\x31\\xc0\\x64\\x8b\\x50\\x30"<\/span>\r\n\t\t"\\x8b\\x52\\x0c\\x8b\\x52\\x14\\x8b\\x72\\x28\\x0f\\xb7\\x4a\\x26\\x31\\xff"<\/span>\r\n\t\t"\\xac\\x3c\\x61\\x7c\\x02\\x2c\\x20\\xc1\\xcf\\x0d\\x01\\xc7\\xe2\\xf2\\x52"<\/span>\r\n\t\t"\\x57\\x8b\\x52\\x10\\x8b\\x4a\\x3c\\x8b\\x4c\\x11\\x78\\xe3\\x48\\x01\\xd1"<\/span>\r\n\t\t"\\x51\\x8b\\x59\\x20\\x01\\xd3\\x8b\\x49\\x18\\xe3\\x3a\\x49\\x8b\\x34\\x8b"<\/span>\r\n\t\t"\\x01\\xd6\\x31\\xff\\xac\\xc1\\xcf\\x0d\\x01\\xc7\\x38\\xe0\\x75\\xf6\\x03"<\/span>\r\n\t\t"\\x7d\\xf8\\x3b\\x7d\\x24\\x75\\xe4\\x58\\x8b\\x58\\x24\\x01\\xd3\\x66\\x8b"<\/span>\r\n\t\t"\\x0c\\x4b\\x8b\\x58\\x1c\\x01\\xd3\\x8b\\x04\\x8b\\x01\\xd0\\x89\\x44\\x24"<\/span>\r\n\t\t"\\x24\\x5b\\x5b\\x61\\x59\\x5a\\x51\\xff\\xe0\\x5f\\x5f\\x5a\\x8b\\x12\\xeb"<\/span>\r\n\t\t"\\x8d\\x5d\\x68\\x33\\x32\\x00\\x00\\x68\\x77\\x73\\x32\\x5f\\x54\\x68\\x4c"<\/span>\r\n\t\t"\\x77\\x26\\x07\\xff\\xd5\\xb8\\x90\\x01\\x00\\x00\\x29\\xc4\\x54\\x50\\x68"<\/span>\r\n\t\t"\\x29\\x80\\x6b\\x00\\xff\\xd5\\x6a\\x08\\x59\\x50\\xe2\\xfd\\x40\\x50\\x40"<\/span>\r\n\t\t"\\x50\\x68\\xea\\x0f\\xdf\\xe0\\xff\\xd5\\x97\\x68\\x02\\x00\\x1f\\x90\\x89"<\/span>\r\n\t\t"\\xe6\\x6a\\x10\\x56\\x57\\x68\\xc2\\xdb\\x37\\x67\\xff\\xd5\\x57\\x68\\xb7"<\/span>\r\n\t\t"\\xe9\\x38\\xff\\xff\\xd5\\x57\\x68\\x74\\xec\\x3b\\xe1\\xff\\xd5\\x57\\x97"<\/span>\r\n\t\t"\\x68\\x75\\x6e\\x4d\\x61\\xff\\xd5\\x68\\x63\\x6d\\x64\\x00\\x89\\xe3\\x57"<\/span>\r\n\t\t"\\x57\\x57\\x31\\xf6\\x6a\\x12\\x59\\x56\\xe2\\xfd\\x66\\xc7\\x44\\x24\\x3c"<\/span>\r\n\t\t"\\x01\\x01\\x8d\\x44\\x24\\x10\\xc6\\x00\\x44\\x54\\x50\\x56\\x56\\x56\\x46"<\/span>\r\n\t\t"\\x56\\x4e\\x56\\x56\\x53\\x56\\x68\\x79\\xcc\\x3f\\x86\\xff\\xd5\\x89\\xe0"<\/span>\r\n\t\t"\\x4e\\x56\\x46\\xff\\x30\\x68\\x08\\x87\\x1d\\x60\\xff\\xd5\\xbb\\xaa\\xc5"<\/span>\r\n\t\t"\\xe2\\x5d\\x68\\xa6\\x95\\xbd\\x9d\\xff\\xd5\\x3c\\x06\\x7c\\x0a\\x80\\xfb"<\/span>\r\n\t\t"\\xe0\\x75\\x05\\xbb\\x47\\x13\\x72\\x6f\\x6a\\x00\\x53\\xff\\xd5"<\/span>;<\/span>\r\n\t\r\n}<\/span>\r\nextern<\/span> "C"<\/span> __declspec<\/span>(<\/span>dllexport<\/span>)<\/span> void<\/span> DoNothingAlready<\/span>(<\/span>void<\/span>)<\/span>\r\n{<\/span>\r\n\tDWORD<\/span> ayylmao<\/span> =<\/span> 20345<\/span>;<\/span>\r\n\t_asm<\/span>\r\n\t{<\/span>\r\n\t\txor<\/span> eax<\/span>,<\/span> eax<\/span>\r\n\t\t\txor<\/span> ecx<\/span>,<\/span> ecx<\/span>\r\n\t\t\tmov<\/span> eax<\/span>,<\/span> ayylmao<\/span>\r\n\t\t\tmov<\/span> ecx<\/span>,<\/span> 0<\/span>\r\n\t\ttestd:<\/span>\r\n\t\tfnop<\/span>\r\n\t\t\tinc<\/span> ecx<\/span>\r\n\t\t\tcmp<\/span> eax<\/span>,<\/span> ecx<\/span>\r\n\t\t\tjnz<\/span> testd<\/span>\r\n\t\t\tpop<\/span> ebx<\/span>\r\n\t\t\tnop<\/span>\r\n\t}<\/span>\r\n\treturn<\/span>;<\/span>\r\n}<\/span>\r\n\r\nBOOL<\/span> WINAPI<\/span> DllMain<\/span>(<\/span>HINSTANCE<\/span> hinst<\/span>,<\/span> DWORD<\/span> dwReason<\/span>,<\/span> LPVOID<\/span> reserved<\/span>)<\/span>\r\n{<\/span>\r\n\tif<\/span> (<\/span>DetourIsHelperProcess<\/span>())<\/span> {<\/span>\r\n\t\treturn<\/span> TRUE<\/span>;<\/span>\r\n\t}<\/span>\r\n\r\n\tif<\/span> (<\/span>dwReason<\/span> ==<\/span> DLL_PROCESS_ATTACH<\/span>)<\/span> {<\/span>\r\n\t\tDetourRestoreAfterWith<\/span>();<\/span>\r\n\t\tDetourTransactionBegin<\/span>();<\/span>\r\n\t\tDetourUpdateThread<\/span>(<\/span>GetCurrentThread<\/span>());<\/span>\r\n\t\tDetourAttach<\/span>(<\/span>&<\/span>(<\/span>PVOID<\/span>&<\/span>)<\/span>FuncToDetour<\/span>,<\/span> MyFunc<\/span>);<\/span>\r\n\t\tDetourTransactionCommit<\/span>();<\/span>\r\n\t}<\/span>\r\n\telse<\/span> if<\/span> (<\/span>dwReason<\/span> ==<\/span> DLL_PROCESS_DETACH<\/span>)<\/span> {<\/span>\r\n\t\tDetourTransactionBegin<\/span>();<\/span>\r\n\t\tDetourUpdateThread<\/span>(<\/span>GetCurrentThread<\/span>());<\/span>\r\n\t\tDetourDetach<\/span>(<\/span>&<\/span>(<\/span>PVOID<\/span>&<\/span>)<\/span>FuncToDetour<\/span>,<\/span> MyFunc<\/span>);<\/span>\r\n\t\tDetourTransactionCommit<\/span>();<\/span>\r\n\t}<\/span>\r\n\treturn<\/span> TRUE<\/span>;<\/span>\r\n}<\/span>\r\n<\/pre>\n<\/div>\n
This is certainly something that would be hard to detect right? So what else is there to inject code in? Enter binary instrumentation and PIN. A mad man could possibly conceive a way to inject code and hack games using a framework that’s been used for all kinds of things from unpacking malware, to finding bugs and memory leaks. It seems game hacking with PIN is just inevitable. <\/p>\n
But joe you might say, “how the hell do you stop on a particular memory address in PIN? I don’t see a way to specify a pointer like with detours, only function names!” and you’d be right. But keep in mind, with PIN we have full control of the context \/ registers. It’s a simple matter of halting on a particular instruction pointer address. Easy peasy. Observe:<\/p>\n
<\/p>\n
\n
\/*<\/span>\r\nalexander hanel - thanks alex, much love. <\/span>\r\nlog IP of all instructions that do not reside in a module. <\/span>\r\n*\/<\/span>\r\n#include <stdio.h> <\/span>\r\n#include <iostream> <\/span>\r\n#include "pin.H" <\/span>\r\nnamespace<\/span> WINDOWS<\/span>\r\n{<\/span>\r\n#include <Windows.h><\/span>\r\n}<\/span>\r\n#include <string><\/span>\r\n#include <algorithm><\/span>\r\n\r\n\r\n\/\/ bool started = FALSE;<\/span>\r\nADDRINT<\/span> addr<\/span>;<\/span>\r\nvector<\/span><<\/span>string<\/span>><\/span> modules<\/span>;<\/span>\r\nchar<\/span> othercompare<\/span>[<\/span>32<\/span>]<\/span>  =<\/span> "0x000000014000112A"<\/span>;<\/span>\r\n\/\/__int64 curIP = 0;<\/span>\r\n\r\nFILE<\/span> *<\/span> trace<\/span>;<\/span>\r\n\r\n\/\/ This function is called before every instruction is executed<\/span>\r\n\/\/ and prints the IP<\/span>\r\nVOID<\/span> printip<\/span>(<\/span>VOID<\/span> *<\/span>ip<\/span>)<\/span> \r\n{<\/span>\r\n\tchar<\/span> joincompare<\/span>[<\/span>32<\/span>]<\/span> =<\/span> ""<\/span>;<\/span>\r\n\tsprintf<\/span>(<\/span>joincompare<\/span>,<\/span> "0x%p"<\/span>,<\/span>ip<\/span>);<\/span>\r\n\t\r\n\tif<\/span>(<\/span>strcmp<\/span>(<\/span>joincompare<\/span>,<\/span>othercompare<\/span>))<\/span>\r\n\t{<\/span>\r\n\t\/\/ we do our hax here<\/span>\r\n\tprintf<\/span>(<\/span>"******************************************\\n"<\/span>);<\/span>\r\n\tprintf<\/span>(<\/span>"******************************************\\n"<\/span>);<\/span>\r\n\tprintf<\/span>(<\/span>"****************Found it!!!***************\\n"<\/span>);<\/span>\r\n\tprintf<\/span>(<\/span>"******************************************\\n"<\/span>);<\/span>\r\n\tprintf<\/span>(<\/span>"******************************************\\n"<\/span>);<\/span>\r\n\t}<\/span>\r\n\tfprintf<\/span>(<\/span>trace<\/span>,<\/span> "Instruction Pointer: 0x%p\\n"<\/span>,<\/span> ip<\/span> );<\/span> \r\n\t\r\n}<\/span>\r\n\r\n\/\/ Pin calls this function every time a new instruction is encountered<\/span>\r\nVOID<\/span> Instruction<\/span>(<\/span>INS<\/span> ins<\/span>,<\/span> VOID<\/span> *<\/span>v<\/span>)<\/span>\r\n{<\/span>\r\n\tIMG<\/span> img<\/span> =<\/span> IMG_FindByAddress<\/span>(<\/span>INS_Address<\/span>(<\/span>ins<\/span>));<\/span>\r\n\tstring<\/span> path<\/span> =<\/span> (<\/span>IMG_Valid<\/span>(<\/span>img<\/span>)<\/span> ?<\/span> IMG_Name<\/span>(<\/span>img<\/span>)<\/span> :<\/span> "InvalidImg"<\/span>);<\/span>\r\n\tauto<\/span> it<\/span> =<\/span> std<\/span>::<\/span>find<\/span>(<\/span>modules<\/span>.<\/span>begin<\/span>(),<\/span> modules<\/span>.<\/span>end<\/span>(),<\/span> path<\/span>);<\/span>\r\n\tif<\/span> (<\/span>it<\/span> !=<\/span> modules<\/span>.<\/span>end<\/span>())<\/span>\r\n\t\treturn<\/span>;<\/span>\r\n\telse<\/span>\r\n\t{<\/span>\r\n\t\tfprintf<\/span>(<\/span>trace<\/span>,<\/span> "Instruction: %s\\n"<\/span>,<\/span> INS_Disassemble<\/span>(<\/span>ins<\/span>));<\/span> \/\/ also print the decoded instructions<\/span>\r\n\t\tINS_InsertCall<\/span>(<\/span>ins<\/span>,<\/span> IPOINT_BEFORE<\/span>,<\/span> (<\/span>AFUNPTR<\/span>)<\/span>printip<\/span>,<\/span> IARG_INST_PTR<\/span>,<\/span> IARG_END<\/span>);<\/span>\r\n\t}<\/span>\r\n}<\/span>\r\n\r\nVOID<\/span> Image<\/span>(<\/span>IMG<\/span> Img<\/span>,<\/span> VOID<\/span> *<\/span>v<\/span>)<\/span>\r\n{<\/span> \r\n\tif<\/span> (<\/span>IMG_IsMainExecutable<\/span>(<\/span>Img<\/span>))<\/span>\r\n\t\tprintf<\/span>(<\/span>"Main module loading...\\n"<\/span>);<\/span>\r\n\telse<\/span>\r\n\t\tmodules<\/span>.<\/span>push_back<\/span>(<\/span>IMG_Name<\/span>(<\/span>Img<\/span>).<\/span>c_str<\/span>());<\/span>\r\n}<\/span>\r\n\r\nVOID<\/span> Fini<\/span>(<\/span>INT32<\/span> code<\/span>,<\/span> VOID<\/span> *<\/span>v<\/span>)<\/span> \r\n{<\/span> \r\n\tprintf<\/span>(<\/span>"The following modules were loaded: \\r\\n"<\/span>);<\/span>\r\n\tint<\/span> ii<\/span>;<\/span>\r\n\tfor<\/span> (<\/span>ii<\/span> =<\/span> 0<\/span>;<\/span> ii<\/span> <<\/span> modules<\/span>.<\/span>size<\/span>();<\/span> ii<\/span>++<\/span>)<\/span>\r\n\t{<\/span>\r\n\t\tcout<\/span> <<<\/span> modules<\/span>[<\/span>ii<\/span>]<\/span> <<<\/span> endl<\/span>;<\/span>\r\n\t}<\/span>\r\n}<\/span> \r\n\r\nINT32<\/span> Usage<\/span>()<\/span> \r\n{<\/span> \r\n\treturn<\/span> -<\/span>1<\/span>;<\/span> \r\n}<\/span>\r\n\r\nint<\/span> main<\/span>(<\/span>int<\/span> argc<\/span>,<\/span> char<\/span> *<\/span> argv<\/span>[])<\/span> \r\n{<\/span> \r\n\ttrace<\/span> =<\/span> fopen<\/span>(<\/span>"itrace.out"<\/span>,<\/span> "w"<\/span>);<\/span>\r\n\tif<\/span> (<\/span>PIN_Init<\/span>(<\/span>argc<\/span>,<\/span> argv<\/span>))<\/span> \r\n\t\treturn<\/span> Usage<\/span>();<\/span>\r\n\tIMG_AddInstrumentFunction<\/span>(<\/span>Image<\/span>,<\/span> 0<\/span>);<\/span>\r\n\tINS_AddInstrumentFunction<\/span>(<\/span>Instruction<\/span>,<\/span> 0<\/span>);<\/span> \r\n\tPIN_AddFiniFunction<\/span>(<\/span>Fini<\/span>,<\/span> 0<\/span>);<\/span> \r\n\tPIN_StartProgram<\/span>();<\/span> \r\n\treturn<\/span> 0<\/span>;<\/span> \r\n}<\/span>\r\n<\/pre>\n<\/div>\n
Where do we obtain the instruction pointer address? That’s up to you(me), and the disassembler. Let’s go over an example.<\/p>\n
Here we have a simple C program I wrote (in 64 bit no less) that uses the MessageBox API. <\/p>\n
<\/p>\n
\n
#include <windows.h><\/span>\r\nint<\/span> main<\/span>(<\/span>void<\/span>)<\/span>\r\n{<\/span>\r\n\tchar<\/span> *<\/span>msg1<\/span> =<\/span> "this will work"<\/span>;<\/span>\r\n\tchar<\/span> *<\/span>msg2<\/span> =<\/span> "this too"<\/span>;<\/span>\r\n\tMessageBox<\/span>(<\/span>NULL<\/span>,<\/span>msg1<\/span>,<\/span>msg2<\/span>,<\/span>MB_YESNOCANCEL<\/span>);<\/span>\r\n\treturn<\/span> 0<\/span>;<\/span>\r\n}<\/span>\r\n<\/pre>\n<\/div>\n
Here we run the fucker:
\n\"\"<\/a><\/p>\n
And here’s what it looks like in IDA:
\n\"\"<\/a><\/p>\n
We would want to instrument at the address 0x0000000140001000<\/i>. To modify the call to MessageBox, we need to alter the contents of the registers. The register ‘r9d’ contains the value 3 or MB_YESNOCANCEL<\/a>. With what? How about something simple like changing the MessageBox ‘uType’ to ‘MB_OK’ or 0. This means we would need to modify the ‘r9d’ register at the address 0x0000000140001004<\/i> or just before the call to MessageBox. This means we have to halt on this address and modify the CONTEXT structure. For those who don’t know, the CONTEXT structure is a windows term for the state of registers. PIN has my back when it comes to modifying this structure. <\/p>\n
This code we use to modify the context structure. using some creative C++ hax, I’m able to stop on a certain address and call modify at the right time:<\/p>\n
<\/p>\n
\n
#include <iostream><\/span>\r\n#include <fstream><\/span>\r\n#include "pin.H"<\/span>\r\n\r\nvector<\/span><<\/span>string<\/span>><\/span> modules<\/span>;<\/span>\r\n\/\/REG testedRegister = REG_INVALID();<\/span>\r\n\r\nBOOL<\/span> hitit<\/span> =<\/span> false<\/span>;<\/span>\r\nREG<\/span> testedRegister<\/span> =<\/span> REG_R9D<\/span>;<\/span>\r\n\r\nchar<\/span> stop_on_me<\/span>[<\/span>32<\/span>]<\/span>  =<\/span> "0000000140001004"<\/span>;<\/span>\r\nchar<\/span> joincompare<\/span>[<\/span>32<\/span>]<\/span> =<\/span> ""<\/span>;<\/span>\r\n\r\nVOID<\/span> show_instruction_pointer<\/span>(<\/span>ADDRINT<\/span> rip<\/span>,<\/span> ADDRINT<\/span> r9<\/span>)<\/span> \r\n{<\/span>\r\n\tsprintf<\/span>(<\/span>joincompare<\/span>,<\/span> "%p"<\/span>,<\/span>Addrint2VoidStar<\/span>(<\/span>rip<\/span>));<\/span>\r\n\tif<\/span>(<\/span>memcmp<\/span>(<\/span>joincompare<\/span>,<\/span>stop_on_me<\/span>,<\/span>sizeof<\/span>(<\/span>joincompare<\/span>)))<\/span>\r\n\t{<\/span>\r\n\tprintf<\/span>(<\/span>"Instruction pointer is %p\\r\\n"<\/span>,<\/span>Addrint2VoidStar<\/span>(<\/span>rip<\/span>));<\/span>\r\n\t\/\/printf("Value of R9 is %p\\r\\n",Addrint2VoidStar(r9));<\/span>\r\n\thitit<\/span> =<\/span> true<\/span>;<\/span>\r\n\r\n\t}<\/span>\r\n\r\n}<\/span>\r\n\r\nvoid<\/span> afterfunc_call<\/span>(<\/span>CONTEXT<\/span> *<\/span> ctxt<\/span>)<\/span>\r\n{<\/span>\r\n\tif<\/span>(<\/span>hitit<\/span>)<\/span>\r\n\t{<\/span>\r\n\tprintf<\/span>(<\/span>"Setting the value of R9 to 0"<\/span>);<\/span>\r\n\tPIN_SetContextRegval<\/span>(<\/span>ctxt<\/span>,<\/span> testedRegister<\/span>,<\/span> 0x0000000000000000<\/span>);<\/span>\r\n\t}<\/span>\r\n}<\/span>\r\n    \r\n\/\/ Pin calls this function every time a new instruction is encountered<\/span>\r\nVOID<\/span> Instruction<\/span>(<\/span>INS<\/span> ins<\/span>,<\/span> VOID<\/span> *<\/span>v<\/span>)<\/span>\r\n{<\/span>\r\n\tIMG<\/span> img<\/span> =<\/span> IMG_FindByAddress<\/span>(<\/span>INS_Address<\/span>(<\/span>ins<\/span>));<\/span>\r\n\tstring<\/span> path<\/span> =<\/span> (<\/span>IMG_Valid<\/span>(<\/span>img<\/span>)<\/span> ?<\/span> IMG_Name<\/span>(<\/span>img<\/span>)<\/span> :<\/span> "InvalidImg"<\/span>);<\/span>\r\n\tauto<\/span> it<\/span> =<\/span> std<\/span>::<\/span>find<\/span>(<\/span>modules<\/span>.<\/span>begin<\/span>(),<\/span> modules<\/span>.<\/span>end<\/span>(),<\/span> path<\/span>);<\/span>\r\n\tif<\/span> (<\/span>it<\/span> !=<\/span> modules<\/span>.<\/span>end<\/span>())<\/span>\r\n\t\treturn<\/span>;<\/span>\r\n\telse<\/span>\r\n\t{<\/span>\r\n\t\r\n\t REGSET<\/span> regsin<\/span>;<\/span>\r\n     REGSET<\/span> regsout<\/span>;<\/span>\r\n     REGSET_Clear<\/span>(<\/span>regsin<\/span>);<\/span>\r\n     REGSET_Clear<\/span>(<\/span>regsout<\/span>);<\/span>\r\n     REGSET_Insert<\/span>(<\/span>regsout<\/span>,<\/span> testedRegister<\/span>);<\/span>\r\n\t \r\n\t \/\/ insert call to check for instruction pointer<\/span>\r\n    INS_InsertCall<\/span>(<\/span>ins<\/span>,<\/span> IPOINT_BEFORE<\/span>,<\/span> (<\/span>AFUNPTR<\/span>)<\/span>show_instruction_pointer<\/span>,<\/span> IARG_REG_VALUE<\/span>,<\/span> REG_INST_PTR<\/span>,<\/span> IARG_END<\/span>);<\/span>\r\n\t \/\/ insert call to modify register value<\/span>\r\n\tINS_InsertCall<\/span>(<\/span>ins<\/span>,<\/span> IPOINT_BEFORE<\/span>,<\/span> AFUNPTR<\/span>(<\/span>afterfunc_call<\/span>),<\/span>IARG_PARTIAL_CONTEXT<\/span>,<\/span> &<\/span>regsin<\/span>,<\/span> &<\/span>regsout<\/span>,<\/span> IARG_END<\/span>);<\/span>\r\n\t\r\n\t}<\/span>\r\n}<\/span>\r\n\r\nVOID<\/span> Image<\/span>(<\/span>IMG<\/span> Img<\/span>,<\/span> VOID<\/span> *<\/span>v<\/span>)<\/span>\r\n{<\/span> \r\n\tif<\/span> (<\/span>IMG_IsMainExecutable<\/span>(<\/span>Img<\/span>))<\/span>\r\n\t\tprintf<\/span>(<\/span>"Main module loading...\\n"<\/span>);<\/span>\r\n\telse<\/span>\r\n\t\tmodules<\/span>.<\/span>push_back<\/span>(<\/span>IMG_Name<\/span>(<\/span>Img<\/span>).<\/span>c_str<\/span>());<\/span>\r\n}<\/span>\r\n\r\nVOID<\/span> Fini<\/span>(<\/span>INT32<\/span> code<\/span>,<\/span> VOID<\/span> *<\/span>v<\/span>)<\/span>\r\n{<\/span>\r\n    \r\n  \r\n}<\/span>\r\n\r\n\/* ===================================================================== *\/<\/span>\r\n\/* Print Help Message                                                    *\/<\/span>\r\n\/* ===================================================================== *\/<\/span>\r\n\r\nINT32<\/span> Usage<\/span>()<\/span>\r\n{<\/span>\r\n    cerr<\/span> <<<\/span> "Just more code hax by joe"<\/span> <<<\/span> endl<\/span>;<\/span>\r\n    \r\n    return<\/span> -<\/span>1<\/span>;<\/span>\r\n}<\/span>\r\n\r\n\/* ===================================================================== *\/<\/span>\r\n\/* Main                                                                  *\/<\/span>\r\n\/* ===================================================================== *\/<\/span>\r\n\/*   argc, argv are the entire command line: pin -t <toolname> -- ...    *\/<\/span>\r\n\/* ===================================================================== *\/<\/span>\r\n\r\nint<\/span> main<\/span>(<\/span>int<\/span> argc<\/span>,<\/span> char<\/span> *<\/span> argv<\/span>[])<\/span>\r\n{<\/span>\r\n    \/\/ Initialize pin<\/span>\r\n    if<\/span> (<\/span>PIN_Init<\/span>(<\/span>argc<\/span>,<\/span> argv<\/span>))<\/span> return<\/span> Usage<\/span>();<\/span>\r\n\tIMG_AddInstrumentFunction<\/span>(<\/span>Image<\/span>,<\/span> 0<\/span>);<\/span> \/\/ remove other modules, except main module, let that run<\/span>\r\n    INS_AddInstrumentFunction<\/span>(<\/span>Instruction<\/span>,<\/span> 0<\/span>);<\/span>\r\n    PIN_AddFiniFunction<\/span>(<\/span>Fini<\/span>,<\/span> 0<\/span>);<\/span>\r\n    PIN_StartProgram<\/span>();<\/span>\r\n    \r\n    return<\/span> 0<\/span>;<\/span>\r\n}<\/span>\r\n<\/pre>\n<\/div>\n
Does it work? Hell yeah!
\n\"\"<\/a><\/p>\n
So how the hell would you cheat like this? Well I’ve already demonstrated register manipulation, memory manipulation, so the rest should be trivial. <\/p>\n
I’m sorry it took so long to go through this framework and make it into something useful. I’m not done with PIN just yet, I plan to release something awesome using it soon. Stay tuned!
\n\"\"<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
Hi! Today I’m going to go over more on intel’s PIN, more on cheats, and less on detection since I already covered that. I feel like I’ve spent way too much time on this and it’s a huge turn off against my productivity. And of course, I commit to a talk and it HAS to […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[4,6,7],"tags":[113],"_links":{"self":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1449"}],"collection":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/comments?post=1449"}],"version-history":[{"count":5,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1449\/revisions"}],"predecessor-version":[{"id":1460,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/posts\/1449\/revisions\/1460"}],"wp:attachment":[{"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/media?parent=1449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/categories?post=1449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.gironsec.com\/blog\/wp-json\/wp\/v2\/tags?post=1449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}