/* by Luigi Auriemma */ static unsigned char undk2_dump[] = "\x8b\x54\x24\x08\x83\xec\x0c\x33\xc0\x53\x55\x56\x8b\x74\x24\x1c" "\x85\xd2\x57\x0f\x84\xc6\x01\x00\x00\x8a\x02\x8d\x4a\x01\x33\xd2" "\x8a\x11\xc1\xe0\x08\x03\xc2\x41\xf6\xc4\x01\x74\x03\x83\xc1\x03" "\x33\xc0\x33\xd2\x8a\x01\x8a\x51\x01\x41\xc1\xe0\x08\x03\xc2\x41" "\x33\xd2\x8a\x11\xc1\xe0\x08\x03\xc2\x41\x8a\x19\x41\xf6\xc3\x80" "\x88\x5c\x24\x10\x75\x58\x8a\x11\x41\x88\x54\x24\x20\x8b\x54\x24" "\x10\x81\xe2\xff\x00\x00\x00\x8b\xfa\x83\xe7\x03\x8b\xdf\x4f\x85" "\xdb\x74\x0a\x47\x8a\x19\x88\x1e\x46\x41\x4f\x75\xf7\x8b\xda\x8b" "\xfe\x83\xe3\x60\xc1\xe3\x03\x2b\xfb\x8b\x5c\x24\x20\x81\xe3\xff" "\x00\x00\x00\xc1\xea\x02\x2b\xfb\x83\xe2\x07\x4f\x83\xc2\x02\x8a" "\x1f\x88\x1e\x46\x47\x8b\xda\x4a\x85\xdb\x75\xf3\xeb\x9c\xf6\xc3" "\x40\x75\x61\x8a\x11\x41\x88\x54\x24\x20\x8b\x7c\x24\x20\x8a\x11" "\x81\xe7\xff\x00\x00\x00\x88\x54\x24\x24\x8b\xd7\x41\xc1\xea\x06" "\x8b\xea\x4a\x85\xed\x74\x0c\x8d\x6a\x01\x8a\x11\x88\x16\x46\x41" "\x4d\x75\xf7\x83\xe7\x3f\x8b\xd6\xc1\xe7\x08\x2b\xd7\x8b\x7c\x24" "\x24\x81\xe7\xff\x00\x00\x00\x83\xe3\x3f\x2b\xd7\x4a\x83\xc3\x03" "\x8b\xfb\x8a\x1a\x88\x1e\x46\x42\x8b\xdf\x4f\x85\xdb\x75\xf3\xe9" "\x36\xff\xff\xff\xf6\xc3\x20\x0f\x85\x81\x00\x00\x00\x8a\x19\x8a" "\x51\x01\x8b\x7c\x24\x10\x41\x41\x88\x54\x24\x24\x81\xe7\xff\x00" "\x00\x00\x8a\x11\x41\x88\x54\x24\x18\x8b\xd7\x83\xe2\x03\x8b\xea" "\x4a\x85\xed\x74\x0c\x8d\x6a\x01\x8a\x11\x88\x16\x46\x41\x4d\x75" "\xf7\x33\xd2\x8a\xf3\x89\x54\x24\x14\x8b\xd6\x8b\x5c\x24\x14\x2b" "\xd3\x8b\xdf\x83\xe3\x10\x83\xe7\x0c\xc1\xe3\x0c\x2b\xd3\x8b\x5c" "\x24\x24\x81\xe3\xff\x00\x00\x00\x2b\xd3\x8b\x5c\x24\x18\x4a\xc1" "\xe7\x06\x81\xe3\xff\x00\x00\x00\x8d\x7c\x1f\x04\x8a\x1a\x88\x1e" "\x46\x42\x8b\xdf\x4f\x85\xdb\x75\xf3\xe9\xac\xfe\xff\xff\x8a\xd3" "\x83\xe2\x1f\x8d\x14\x95\x04\x00\x00\x00\x83\xfa\x70\x77\x1a\x8b" "\xfa\x4a\x85\xff\x0f\x84\x90\xfe\xff\xff\x42\x8a\x19\x88\x1e\x46" "\x41\x4a\x75\xf7\xe9\x81\xfe\xff\xff\x83\xe3\x03\x8b\xd3\x4b\x85" "\xd2\x74\x0c\x8d\x53\x01\x8a\x19\x88\x1e\x46\x41\x4a\x75\xf7\x5f" "\x5e\x5d\x5b\x83\xc4\x0c\xc2\x0c\x00"; int (* __stdcall undk2)(unsigned char *out, unsigned char *in, int unused) = NULL; // anti DEP limitation! if you apply VirtualAlloc on a static char // it will cover also the rest of the page included other variables! void *undk2_alloc(u8 *dump, int dumpsz) { int pagesz; void *ret; pagesz = (dumpsz + 4095) & (~4095); // useful for pages? mah #ifdef WIN32 ret = VirtualAlloc( NULL, pagesz, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE); // write for memcpy #else ret = malloc(pagesz); mprotect( ret, pagesz, PROT_EXEC | PROT_WRITE); // write for memcpy #endif memcpy(ret, dump, dumpsz); return(ret); } void undk2_init(void) { if(undk2) return; undk2 = undk2_alloc(undk2_dump, sizeof(undk2_dump)); }