Initial commit

injector/src/injector.c

@@ -0,0 +1,87 @@
+#include <stdio.h>
+
+#include <injshared.h>
+
+#include <ipayload.h>
+
+const char EXE_ENV[] = "JADEITE_TARGET_EXE_PATH";
+const char INJECT_DLL_ENV[] = "JADEITE_INJECT_DLL_PATH";
+
+const char LAUNCHER_INJECT_DLL[] = "launcher_payload.dll";
+const char GAME_INJECT_DLL[] = "game_payload.dll";
+
+int main(int argc, char **argv) {
+    // Read arguments
+    char *gamePath = NULL;
+    char *launcherPath = NULL;
+
+    switch (argc) {
+        case 1:
+            printf("Usage: wine jadeite.exe [game path] <launcher path>\n");
+            return 0;
+        case 2:
+            printf("No launcher process specified! Using explorer.exe\n");
+            gamePath = argv[1];
+            launcherPath = "C:\\Windows\\explorer.exe";
+            break;
+        case 3:
+            gamePath = argv[1];
+            launcherPath = argv[2];
+            break;
+        default:
+            fprintf(stderr, "Too many arguments! (%d)\n", argc);
+            return 1;
+    }
+
+    // Compute absolute paths
+    char gameExePath[MAX_PATH];
+    GetFullPathNameA(gamePath, sizeof(gameExePath), gameExePath, NULL);
+
+    char gamePayloadPath[MAX_PATH];
+    GetFullPathNameA(GAME_INJECT_DLL, sizeof(gamePayloadPath), gamePayloadPath, NULL);
+
+    char launcherPayloadPath[MAX_PATH];
+    GetFullPathNameA(LAUNCHER_INJECT_DLL, sizeof(launcherPayloadPath), launcherPayloadPath, NULL);
+
+    printf("Starting \"%s\" via \"%s\"\n", gameExePath, launcherPath);
+
+    // Set envvars
+    SetEnvironmentVariableA(EXE_ENV, gameExePath);
+    SetEnvironmentVariableA(INJECT_DLL_ENV, gamePayloadPath);
+
+    // Start the launcher
+    STARTUPINFO si;
+    ZeroMemory(&si, sizeof(si));
+
+    PROCESS_INFORMATION pi;
+    si.cb = sizeof(si);
+    ZeroMemory(&pi, sizeof(pi));
+
+    if (!CreateProcessA(
+        launcherPath,
+        NULL,
+        NULL,
+        NULL,
+        FALSE,
+        CREATE_SUSPENDED,
+        NULL,
+        NULL,
+        &si,
+        &pi
+    )) {
+        fprintf(stderr, "Could not start process! (%ld)\n", GetLastError());
+        exit(1);
+    }
+
+    printf("Started launcher process (%ld)\n", pi.dwProcessId);
+
+    // Inject
+    void *payloadStart = &_binary_ipayload_o_p_payload_bin_start;
+    size_t payloadSize = (size_t)&_binary_ipayload_o_p_payload_bin_size; // yes this is valid
+    inject(pi.hProcess, payloadStart, payloadSize, launcherPayloadPath);
+
+    // Resume the process
+    ResumeThread(pi.hThread);
+
+    return 0;
+}

injector/src/payload.asm

@@ -0,0 +1,98 @@
+BITS 64
+
+main: ; Replacement entry point
+    push rbp
+    mov rbp, rsp
+    sub rsp, 10h + 90h
+
+
+    call GetKernel32ModuleHandle
+    mov [rbp - 8h], rax   ; kernel32.dll
+
+    mov rcx, rax
+    call GetAddressOf_GetProcAddress
+    mov [rbp - 10h], rax  ; *GetProcAddress
+
+
+    mov rcx, [rbp - 8h]   ; kernel32.dll
+    lea rdx, [rel s_LoadLibraryA]
+    mov rax, [rbp - 10h]  ; *GetProcAddress
+    call rax              ; rax = *LoadLibraryA
+
+    lea rcx, [rel dllPath]
+    call rax              ; LoadLibraryA(dllPath)
+
+
+    add rsp, 10h + 90h
+    pop rbp
+    ret
+
+
+; https://dennisbabkin.com/blog/?t=how-to-implement-getprocaddress-in-shellcode
+GetKernel32ModuleHandle:
+    mov rax, gs:[60h]
+    mov rax, [rax + 18h]
+    mov rax, [rax + 20h]
+    mov rax, [rax]
+    mov rax, [rax]
+    mov rax, [rax + 20h]
+    ret
+
+
+GetAddressOf_GetProcAddress:
+    mov eax, [rcx + 3ch]
+    add rax, rcx
+    lea rax, [rax + 88h]
+
+    mov edx, [rax]
+    lea rax, [rcx + rdx]
+
+    mov edx, [rax + 18h]
+    mov r8d, [rax + 20h]
+    lea r8, [rcx + r8]
+
+    mov r10, 41636f7250746547h ; "GetProcA"
+    mov r11, 0073736572646441h ; "Address\0"
+
+GAO_GPA@1:
+    mov r9d, [r8]
+    lea r9, [rcx + r9]
+
+    ; Function name comparision
+    cmp r10, [r9]
+    jnz GAO_GPA@2
+    cmp r11, [r9 + 7]
+    jnz GAO_GPA@2
+
+    ; Found GetProcAddress
+    neg rdx
+    mov r10d, [rax + 18h]
+    lea rdx, [r10 + rdx]
+
+    mov r10d, [rax + 24h]
+    lea r10, [rcx + r10]
+    movzx rdx, word [r10 + rdx * 2]
+
+    mov r10d, [rax + 1ch]
+    lea r10, [rcx + r10]
+
+    mov r10d, [r10 + rdx * 4]
+
+    lea rax, [rcx + r10] ; Function address
+    jmp GAO_GPA@end
+
+GAO_GPA@2:
+    add r8, 4
+    dec rdx
+    jnz GAO_GPA@1
+
+GAO_GPA@end:
+    ret
+
+
+; Strings
+s_LoadLibraryA:  db "LoadLibraryA", 0
+
+dllPath:
+    ; This will be filled out by the injector
+    ; Path to the dll to inject into the launcher