Compare commits
16 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| 6209157cf2 | |||
| f26bcbd0fc | |||
| 14c90f7137 | |||
| 8f96ec4eec | |||
| 5421487212 | |||
| 326ccd188e | |||
| 0b0216e41e | |||
| 4c0c35ba43 | |||
| e299d264de | |||
| cba9b20171 | |||
| 5640987ead | |||
| 54a127b848 | |||
| 3994188b08 | |||
| 7ffce8fe3a | |||
| 5143dc0d56 | |||
| 0afdf60cc6 |
29
README.md
29
README.md
@ -1,38 +1,43 @@
|
||||
# PROOF OF CONCEPT. DO NOT USE IF YOU DON'T KNOW WHAT YOU'RE DOING
|
||||
|
||||
### Games and regions
|
||||
3rd: glb v6.6.0
|
||||
|
||||
SR: os/cn v1.1.0 (unsafe, refer to [configuration](#configuration))
|
||||
- **3rd**: glb v6.6.0
|
||||
- **SR**: os/cn v1.1.0 (unsafe, refer to [configuration](#configuration))
|
||||
|
||||
It may be possilbe to completely remove the region and version-specific data in the future. Refer to the source code in `game_payload/src` for details.
|
||||
|
||||
### Information
|
||||
The anticheat the games use is fundamentally incompatible with Wine in multiple ways. This tool launches the game without it (`injector/launcher_payload`) and imitates it's behaviour (`game_payload`).
|
||||
|
||||
Does not work on Windows.
|
||||
**SR-specific**: this tool disables the use of DirectX shared resources in a rather hacky way. It is required, as there is no (and most likely never will be) shared resources support in DirectX translation layers (WineD3D/DXVK). Refer to [configuration](#configuration) if you wish to run the game without the fix.
|
||||
|
||||
**Using third-party software (such as this tool) with the games violates their Terms of Service**. Therefore, **you may receive a ban**. No bans were ever reported with 3rd, however the legacy patch for SR did cause many. **Use at your own risk and only if you understand all the possible consequences**.
|
||||
|
||||
**This is not a cheating tool**. Using it with Windows is not possible, and Windows support is not planned or intended in any way. However, as it does not perform any on-disk file modifications, you may reuse the same game install for Windows if you have a dual-boot setup.
|
||||
|
||||
### Usage
|
||||
**Refer to [Third-party launchers](#third-party-launchers) (will be written later)** for convenient usage. If you don't want to (or can't) use third-party launchers, continue reading the section below.
|
||||
**Refer to [third-party launchers](#third-party-launchers) (will be written later)** for convenient usage. If you don't want to (or can't) use third-party launchers, continue reading the section below.
|
||||
|
||||
**Wine 8.0+ is recommended**, as lower versions leak "The Wine project" as the device identifier. Not critical, but taking a precaution never hurt anyone. **DXVK is strongly recommended.**
|
||||
|
||||
3rd-specific: In some cases, and if you're not using Proton GE, **a fix for Media Foundation may be required to play videos. The Game may crash without it.** You can download it from [here](https://github.com/z0z0z/mf-install). You might need to [limit the number of cores available to the game](https://github.com/z0z0z/mf-install/issues/44) if your CPU has more than 8.
|
||||
**3rd-specific**: In some cases, and if you're not using Proton GE, **a fix for Media Foundation may be required to play videos. The Game may crash without it.** You can download it from [here](https://github.com/z0z0z/mf-install). You might need to [limit the number of cores available to the game](https://github.com/z0z0z/mf-install/issues/44) if your CPU has more than 8.
|
||||
|
||||
Manual usage instructions:
|
||||
- Download the game you want to run
|
||||
- Download a release from this repository
|
||||
- Extract the archive (**NOT INTO THE GAME DIRECTORY! THIS IS IMPORTANT!**)
|
||||
- Block analytics servers in your `hosts` file. You can find the list in SERVERS.txt
|
||||
- Run `wine jadeite.exe "Z:\\wine\\path\\to\\game.exe"`
|
||||
- Run `wine jadeite.exe 'Z:\wine\path\to\game.exe'`
|
||||
|
||||
This tool is capable of starting the games from a different process. This may be useful for spoofing the parent process (SR is known to report it). Use `wine jadeite.exe "Z:\\wine\\path\\to\\game.exe" "Z:\\wine\\path\\to\\launcher.exe"`. `explorer.exe` is used as the default.
|
||||
This tool is capable of starting the games from a different process. This may be useful for spoofing the parent process (SR is known to report it). Use `wine jadeite.exe 'Z:\wine\path\to\game.exe' 'Z:\wine\path\to\launcher.exe'`. `explorer.exe` is used as the default.
|
||||
|
||||
To pass commandline arguments to the game, append them after the launcher path: `wine jadeite.exe 'Z:\wine\path\to\game.exe' 'Z:\wine\path\to\launcher.exe' -arg1 -arg2 -arg3`. To use the default launcher process, use `--`: `wine jadeite.exe 'Z:\wine\path\to\game.exe' -- -arg1 -arg2 -arg3`.
|
||||
|
||||
### Configuration
|
||||
These environment variables can be used to configure the behaviour of the tool.
|
||||
|
||||
SR-exclusive:
|
||||
- `I_WANT_A_BAN=1` - allows to launch HSR. Please only use testing accounts, as there is an extremely high risk of getting banned
|
||||
- `WAIT_BEFORE_RESUME=1` - show a messagebox and wait for user input before resuming the game process. Useful on my side for debugging
|
||||
|
||||
**SR-exclusive**:
|
||||
- `I_WANT_A_BAN=1` - allows to launch SR. Please only use testing accounts, as there is an extremely high risk of getting banned
|
||||
- `SRFIX_DISABLE=1` - disable shared resources fix
|
||||
|
||||
### Internals
|
||||
|
||||
@ -2,3 +2,11 @@
|
||||
0.0.0.0 log-upload-os.hoyoverse.com
|
||||
0.0.0.0 sg-public-data-api.hoyoverse.com
|
||||
0.0.0.0 dump.gamesafe.qq.com
|
||||
|
||||
# Honkai Star Rail logging servers (oversea)
|
||||
0.0.0.0 log-upload-os.hoyoverse.com
|
||||
0.0.0.0 sg-public-data-api.hoyoverse.com
|
||||
|
||||
# Honkai Star Rail logging servers (China)
|
||||
0.0.0.0 log-upload.mihoyo.com
|
||||
0.0.0.0 public-data-api.mihoyo.com
|
||||
|
||||
4
game_payload/include/main.h
Normal file
4
game_payload/include/main.h
Normal file
@ -0,0 +1,4 @@
|
||||
#pragma once
|
||||
|
||||
void unload_ctr_inc();
|
||||
void unload_ctr_dec();
|
||||
@ -4,4 +4,4 @@
|
||||
|
||||
#include <game.h>
|
||||
|
||||
void tp6_setup_patcher(struct game_data *game, HMODULE thisModule, HMODULE baseModule);
|
||||
void tp6_setup_patcher(struct game_data *game, HMODULE baseModule);
|
||||
|
||||
@ -1,5 +1,9 @@
|
||||
#include <utils.h>
|
||||
#include <msg.h>
|
||||
#include <main.h>
|
||||
|
||||
#include <crc32.h>
|
||||
#include <pe.h>
|
||||
|
||||
#include <game.h>
|
||||
|
||||
@ -20,24 +24,53 @@ const struct crc_id_pair HSR_REGIONS[] = {
|
||||
{ 0x3e644d26, GAME_HSR_CN } // cn v1.1.0
|
||||
};
|
||||
|
||||
#define JUMP_SIZE (6 + sizeof(void*))
|
||||
|
||||
// Temporarily hardcoded offset
|
||||
// v1.1.0, same for os and cn
|
||||
#define WTSUD_PATCH_OFFSET 0x16430
|
||||
|
||||
char wtsud_original_bytes[JUMP_SIZE];
|
||||
char *wtsud_patch_addr;
|
||||
|
||||
static void _wtsud_stub() {
|
||||
// Recover original bytes
|
||||
DWORD oldProtect;
|
||||
VirtualProtect(wtsud_patch_addr, JUMP_SIZE, PAGE_EXECUTE_READWRITE, &oldProtect);
|
||||
|
||||
memcpy(wtsud_patch_addr, wtsud_original_bytes, JUMP_SIZE);
|
||||
|
||||
VirtualProtect(wtsud_patch_addr, JUMP_SIZE, oldProtect, &oldProtect);
|
||||
|
||||
unload_ctr_dec();
|
||||
}
|
||||
|
||||
static void _unityplayer_callback(HMODULE unityModule) {
|
||||
if (utils_env_enabled("SRFIX_DISABLE")) {
|
||||
msg_info_a("Shared resources fix disabled. The game may not work");
|
||||
return;
|
||||
}
|
||||
|
||||
// Disable shared resources
|
||||
|
||||
// Temporarily hardcoded offset
|
||||
// v1.1.0, same for os and cn
|
||||
unsigned char *srAddr = ((unsigned char*)unityModule) + 0x16430;
|
||||
// Remove dependency on shared resources by patching WriteTextureStatisticUserData
|
||||
unload_ctr_inc();
|
||||
|
||||
wtsud_patch_addr = ((char*)unityModule) + 0x16430;
|
||||
|
||||
DWORD oldProtect;
|
||||
VirtualProtect(srAddr, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
|
||||
VirtualProtect(wtsud_patch_addr, JUMP_SIZE, PAGE_EXECUTE_READWRITE, &oldProtect);
|
||||
|
||||
*srAddr = 0xC3; // ret
|
||||
// Save original bytes
|
||||
memcpy(wtsud_original_bytes, wtsud_patch_addr, JUMP_SIZE);
|
||||
|
||||
VirtualProtect(srAddr, 1, oldProtect, &oldProtect);
|
||||
// Write jump
|
||||
const char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 }; // jmp [$ + 6]
|
||||
memcpy(wtsud_patch_addr, JUMP_INST, sizeof(JUMP_INST));
|
||||
|
||||
// Write destination address
|
||||
void *destAddr = &_wtsud_stub;
|
||||
memcpy(wtsud_patch_addr + sizeof(JUMP_INST), &destAddr, sizeof(destAddr));
|
||||
|
||||
VirtualProtect(wtsud_patch_addr, JUMP_SIZE, oldProtect, &oldProtect);
|
||||
}
|
||||
|
||||
void hsr_fill_data(struct game_data *buf) {
|
||||
|
||||
@ -6,12 +6,31 @@
|
||||
#include <tp6.h>
|
||||
#include <utils.h>
|
||||
|
||||
#include <main.h>
|
||||
|
||||
HMODULE this_module;
|
||||
size_t unload_ctr = 0;
|
||||
|
||||
void unload_ctr_inc() {
|
||||
unload_ctr++;
|
||||
}
|
||||
|
||||
void unload_ctr_dec() {
|
||||
unload_ctr--;
|
||||
if (unload_ctr == 0) {
|
||||
void *pFreeLibrary = GetProcAddress(GetModuleHandleA("kernel32.dll"), "FreeLibrary");
|
||||
CreateThread(NULL, 0, pFreeLibrary, this_module, 0, NULL);
|
||||
}
|
||||
}
|
||||
|
||||
BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID reserved) {
|
||||
// Only listen to attach
|
||||
if (reason != DLL_PROCESS_ATTACH) {
|
||||
return TRUE;
|
||||
}
|
||||
|
||||
this_module = instance;
|
||||
|
||||
// Dynamically link functions from ntdll
|
||||
ntdll_link();
|
||||
|
||||
@ -27,7 +46,7 @@ BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID reserved) {
|
||||
ace_load_driver_module();
|
||||
|
||||
// ...magic
|
||||
tp6_setup_patcher(&game, instance, baseModule);
|
||||
tp6_setup_patcher(&game, baseModule);
|
||||
|
||||
// Load the UnityPlayer module and invoke the callback
|
||||
HMODULE unityModule = LoadLibraryA("UnityPlayer.dll");
|
||||
|
||||
@ -1,7 +1,10 @@
|
||||
#include <windows.h>
|
||||
|
||||
const char ENV_EXE_PATH[] = "JADEITE_TARGET_EXE_PATH";
|
||||
const char ENV_DLL_PATH[] = "JADEITE_INJECT_DLL_PATH";
|
||||
#define EPFX "__JADEITE_"
|
||||
|
||||
const char ENV_EXE_PATH[] = EPFX"TARGET_EXE_PATH";
|
||||
const char ENV_DLL_PATH[] = EPFX"INJECT_DLL_PATH";
|
||||
const char ENV_PROC_CMD[] = EPFX"PROCESS_COMMAND";
|
||||
|
||||
static inline void write_protected_process_memory(HANDLE process, void *address, const void *buf, size_t size) {
|
||||
DWORD oldProtect;
|
||||
|
||||
@ -4,11 +4,6 @@
|
||||
|
||||
#include <lpayload.h>
|
||||
|
||||
static inline void read_env(const char *env, char *dest, size_t size) {
|
||||
GetEnvironmentVariableA(env, dest, size);
|
||||
SetEnvironmentVariableA(env, "");
|
||||
}
|
||||
|
||||
BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
// Only listen for attach
|
||||
if (reason != DLL_PROCESS_ATTACH) {
|
||||
@ -16,12 +11,13 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
}
|
||||
|
||||
// Get target EXE path
|
||||
char targetExe[MAX_PATH];
|
||||
read_env(ENV_EXE_PATH, targetExe, sizeof(targetExe));
|
||||
char *targetExe = getenv(ENV_EXE_PATH);
|
||||
|
||||
// Get the path of the DLL to inject
|
||||
char injectDll[MAX_PATH];
|
||||
read_env(ENV_DLL_PATH, injectDll, sizeof(injectDll));
|
||||
char *injectDll = getenv(ENV_DLL_PATH);
|
||||
|
||||
// Get game commandline
|
||||
char *cmdline = getenv(ENV_PROC_CMD);
|
||||
|
||||
// Compute the working directory path
|
||||
char workdir[MAX_PATH];
|
||||
@ -37,8 +33,8 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
ZeroMemory(&pi, sizeof(pi));
|
||||
|
||||
if (!CreateProcessA(
|
||||
targetExe,
|
||||
NULL,
|
||||
cmdline,
|
||||
NULL,
|
||||
NULL,
|
||||
FALSE,
|
||||
@ -60,6 +56,14 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
size_t payloadSize = (size_t)&_binary_lpayload_o_p_payload_bin_size;
|
||||
inject(pi.hProcess, payloadStart, payloadSize, injectDll);
|
||||
|
||||
// Optional: wait for user input before resuming (useful for debugging)
|
||||
char *waitEnabled = getenv("WAIT_BEFORE_RESUME");
|
||||
if (waitEnabled && strcmp(waitEnabled, "") != 0) {
|
||||
char message[64];
|
||||
sprintf(message, "PID: %ld. Press OK to continue", pi.dwProcessId);
|
||||
MessageBoxA(NULL, message, "Jadeite Launcher Payload", MB_OK | MB_ICONINFORMATION);
|
||||
}
|
||||
|
||||
// Resume the process
|
||||
ResumeThread(pi.hThread);
|
||||
|
||||
|
||||
@ -7,35 +7,48 @@
|
||||
const char LAUNCHER_INJECT_DLL[] = "launcher_payload.dll";
|
||||
const char GAME_INJECT_DLL[] = "game_payload.dll";
|
||||
|
||||
#define SHIFT(argc, argv) argc--, argv++
|
||||
|
||||
int main(int argc, char **argv) {
|
||||
// Read arguments
|
||||
char *gamePath = NULL;
|
||||
char *launcherPath = NULL;
|
||||
|
||||
// Skip executable
|
||||
SHIFT(argc, argv);
|
||||
|
||||
switch (argc) {
|
||||
case 1:
|
||||
case 0:
|
||||
printf("Usage: wine jadeite.exe [game path] <launcher path>\n");
|
||||
return 0;
|
||||
case 2:
|
||||
printf("No launcher process specified! Using explorer.exe\n");
|
||||
gamePath = argv[1];
|
||||
launcherPath = "C:\\Windows\\explorer.exe";
|
||||
break;
|
||||
case 3:
|
||||
gamePath = argv[1];
|
||||
launcherPath = argv[2];
|
||||
case 1:
|
||||
gamePath = argv[0];
|
||||
SHIFT(argc, argv);
|
||||
|
||||
launcherPath = "--";
|
||||
|
||||
break;
|
||||
default:
|
||||
fprintf(stderr, "Too many arguments! (%d)\n", argc);
|
||||
return 1;
|
||||
gamePath = argv[0];
|
||||
SHIFT(argc, argv);
|
||||
|
||||
launcherPath = argv[0];
|
||||
SHIFT(argc, argv);
|
||||
|
||||
break;
|
||||
}
|
||||
|
||||
// Default launcher path
|
||||
if (strcmp(launcherPath, "--") == 0) {
|
||||
printf("No launcher process specified! Using explorer.exe\n");
|
||||
launcherPath = "C:\\Windows\\explorer.exe";
|
||||
}
|
||||
|
||||
// cd into the injector directory
|
||||
char injectorPath[MAX_PATH];
|
||||
GetModuleFileNameA(GetModuleHandleA(NULL), injectorPath, sizeof(injectorPath));
|
||||
|
||||
char *lastSep = strrchr(injectorPath, '\\');
|
||||
*lastSep = '\0';
|
||||
*(strrchr(injectorPath, '\\')) = '\0';
|
||||
|
||||
SetCurrentDirectoryA(injectorPath);
|
||||
|
||||
@ -49,13 +62,26 @@ int main(int argc, char **argv) {
|
||||
char launcherPayloadPath[MAX_PATH];
|
||||
GetFullPathNameA(LAUNCHER_INJECT_DLL, sizeof(launcherPayloadPath), launcherPayloadPath, NULL);
|
||||
|
||||
printf("Starting \"%s\" via \"%s\"\n", gameExePath, launcherPath);
|
||||
// Construct commandline for the game process
|
||||
char cmdline[8192];
|
||||
sprintf(cmdline, "\"%s\"", gameExePath);
|
||||
|
||||
while (argc) {
|
||||
char arg[8192];
|
||||
sprintf(arg, " \"%s\"", argv[0]);
|
||||
strcat(cmdline, arg);
|
||||
|
||||
SHIFT(argc, argv);
|
||||
}
|
||||
|
||||
// Set envvars
|
||||
SetEnvironmentVariableA(ENV_EXE_PATH, gameExePath);
|
||||
SetEnvironmentVariableA(ENV_DLL_PATH, gamePayloadPath);
|
||||
SetEnvironmentVariableA(ENV_PROC_CMD, cmdline);
|
||||
|
||||
// Start the launcher
|
||||
printf("Starting '%s' via '%s'\n", gameExePath, launcherPath);
|
||||
|
||||
STARTUPINFO si;
|
||||
ZeroMemory(&si, sizeof(si));
|
||||
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
project('jadeite', 'c', version: '1.1.0')
|
||||
project('jadeite', 'c', version: '1.1.4')
|
||||
|
||||
nasm = find_program('nasm')
|
||||
gen_res = find_program('gen_resources.sh')
|
||||
|
||||
23
metadata.json
Normal file
23
metadata.json
Normal file
@ -0,0 +1,23 @@
|
||||
{
|
||||
"jadeite": {
|
||||
"version": "1.1.4"
|
||||
},
|
||||
"games": {
|
||||
"hi3rd": {
|
||||
"global": {
|
||||
"status": "verified",
|
||||
"version": "6.6.0"
|
||||
}
|
||||
},
|
||||
"hsr": {
|
||||
"global": {
|
||||
"status": "unsafe",
|
||||
"version": "1.1.0"
|
||||
},
|
||||
"china": {
|
||||
"status": "unsafe",
|
||||
"version": "1.1.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user