[Y_Less]

Introduction

This is a purely proof-of-concept include, but frankly a few people have released scripts in the last week that I had been thinking about, so I knocked this up quickly.

Basically, this embeds x86 assembly directly in to a .AMX file and invokes that code as a native function. It is a plugin embedded in a .amx file, no .dll file required. Currently there is only one function in there as it relies on redirecting a defined, but unused, existing native function ("SetDeathDropAmount"). The existence of natives is checked by the server before the AMX code is run, so the native must already exist. This puts a significant restriction on the number of native functions you can use, unless you redirect the pointer before every call and thus only really use one. Currently, all the code does is take an absolute pointer and write 4 bytes to it.

Note that once you have a working "WriteMem" function with a "VirtualProtect" call, anything else becomes simpler to do as you can safely write anywhere.

This requires the latest SVN version of YSI. It is also only tested on Windows (as it has assembly, this makes a difference), it also sometimes doesn't work, but it should do.

Example:

pawn Code:

#include <YSI\y_writemem>

stock SetModeRestartTime(Float:n)
{
    WriteMem(0x004AC45C, _:n);
}

main()
{
    // Write 4 bytes to the REAL base address of the AMX.
    WriteMem(AMX_REAL_ADDRESS, 42);
    // Read it using the relative address.
    printf("%d", AMX_Read(AMX_BASE_ADDRESS));
    // YSF function.
    SetModeRestartTime(20.0);
}

The code that generated the assembly, as well as the mnemonics, are in the comments. Download here:

http://pastebin.com/MqFxzPhe

Edit: I should say that the concept of hijacking a present, but unused, instruction to call assembly embedded in the memory segment is based on a post by a person called "CyQ" for Vice City SCM modding MANY years ago (around 10). This is an application of that idea to PAWN utilising recent advancements in #emit expoits.

I should also say that I do not believe that this is a security issue as you can already read and write memory far more conveniently from plugins, and VPSs should be sandboxed from each other anyway.

Edit: New version using a better version of "VirtualProtect" and "SYSREQ.D" not "SYSREQ.C" to avoid having to hijack an existing native. Both updates thanks to Zeex_ (it's now more his code than mine).

Download

This library is a part of YSI, which can be found here. Keep your eye on that topic and your server log for updates.

YSI Download Topic