Imanoobbot
2012-07-07 08:48:21
int __stdcall Java_jaclib_ping_IcmpService_run(JNIEnv *env, jobject this)
{
jclass icmp_service_class; // edi@1
jobject this_ref; // eax@1
jmethodID (__stdcall *get_method_id)(JNIEnv *, jclass, const char *, const char *); // edx@1
HHOOK hook; // eax@1
jmethodID (__stdcall *_get_method_id)(JNIEnv *, jclass, const char *, const char *); // edx@1
jmethodID *notify2_method_id; // eax@1
int result; // eax@3
MSG msg; // [sp+30h] [bp-1Ch]@1
icmp_service_class = (*(*env + 31))(env, this);// env->GetObjectClass
this_ref = (*(*env + 21))(env, this); // env->NewGlobalRef
get_method_id = *(*env + 33); // env->GetMethodID
service_this = this_ref;
notify1_method_id = get_method_id(env, icmp_service_class, "notify", "(III)V");
hook_thread_id = GetCurrentThreadId();
hook = SetWindowsHookExA(WH_MOUSE_LL, mouse_hook_func, cur_module, 0);
_get_method_id = *(*env + 33);
mouse_hook = hook;
notify2_method_id = _get_method_id(env, icmp_service_class, "notify", "(I)V");
call_void_method(env, service_this, notify2_method_id, 0);
while ( GetMessageA(&msg, 0, 0, 0) )
{
TranslateMessage(&msg);
DispatchMessageA(&msg);
}
UnhookWindowsHookEx(mouse_hook);
(*(*env + 22))(env, service_this); // env->ReleaseGlobalRef
result = 0;
notify1_method_id = 0;
mouse_hook = 0;
return result;
}and
.text:10005DC0 ; =============== S U B R O U T I N E =======================================
.text:10005DC0
.text:10005DC0
.text:10005DC0 ; LRESULT __stdcall mouse_hook_func(int code, int message_id, MSLLHOOKSTRUCT *hook_struct)
.text:10005DC0 mouse_hook_func proc near ; DATA XREF: Java_jaclib_ping_IcmpService_run(x,x)+55o
.text:10005DC0
.text:10005DC0 env = dword ptr -4
.text:10005DC0 code = dword ptr 4
.text:10005DC0 message_id = dword ptr 8
.text:10005DC0 hook_struct = dword ptr 0Ch
.text:10005DC0
.text:10005DC0 push ecx ; preserve ecx
.text:10005DC1 mov eax, jvm_ptr
.text:10005DC6 mov ecx, [eax] ; store the JavaVM *vm in ecx
.text:10005DC8 push esi
.text:10005DC9 push edi ; preserve esi,edi
.text:10005DCA push 0 ; push null for attach args
.text:10005DCC lea edx, [esp+10h+env] ; store &env in edx
.text:10005DD0 push edx ; push &env
.text:10005DD1 mov [esp+14h+env], 0 ; initialize JNIEnv *env
.text:10005DD9 push eax ; preserve eax
.text:10005DDA mov eax, [ecx+10h]
.text:10005DDD call eax ; call vm->AttachCurrentThread(vm, &env, 0)
.text:10005DDF mov esi, [esp+0Ch+hook_struct] ; store the MSLLHOOKSTRUCT *hook_struct in esi
.text:10005DE3 mov ecx, [esi+0Ch] ; store hook_struct->mouseData in ecx
.text:10005DE6 mov edx, [esi+4] ; store hook_struct->pt.y in edx
.text:10005DE9 mov eax, [esi] ; store hook_struct->pt.x in eax
.text:10005DEB mov edi, [esp+0Ch+message_id] ; store message_id
.text:10005DEF push ecx ; push mouseData
.text:10005DF0 mov ecx, notify1_method_id ; store the handle to notify(III)V in ecx
.text:10005DF6 and edx, 0FFFFh
.text:10005DFC shl eax, 10h
.text:10005DFF or edx, eax ; pack coords (y & 0xffff) << 16 | x into edx
.text:10005E01 mov eax, [esp+10h+env] ; push env
.text:10005E05 push edi ; push message_id
.text:10005E06 push edx ; char
.text:10005E07 mov edx, service_this
.text:10005E0D push ecx ; push the notify(III)V method id
.text:10005E0E push edx ; push the IcmpService instance
.text:10005E0F call call_void_method ; call IcmpService.notify(mouseData, (y & 0xffff) << 16 | x, message_id)
.text:10005E14 mov eax, [esp+20h+code] ; store code in eax
.text:10005E18 mov ecx, mouse_hook ; store mouse_hook in ecx
.text:10005E1E add esp, 14h ; reset the stack height
.text:10005E21 push esi ; push hook_struct
.text:10005E22 push edi ; push message_id
.text:10005E23 push eax ; push code
.text:10005E24 push ecx ; push mouse_hook
.text:10005E25 call ds:CallNextHookEx ; continue the hook chain
.text:10005E2B pop edi
.text:10005E2C pop esi
.text:10005E2D pop ecx ; restore edi,esi,ecx
.text:10005E2E retn 0Ch
.text:10005E2E mouse_hook_func endp
.text:10005E2E
.text:10005E2E ; ---------------------------------------------------------------------------Basically they are detecting mouse movement outside their game applet. Illegal much?
Once flagged - all your stuff is available to them.
This will basically flag anyone spoofing awt mouse events.