v1.1.12

README.md

@@ -1,11 +1,11 @@
 ### Games and regions
 - **3rd**: glb v6.7.0
-- **SR**: os/cn v1.1.0 (unsafe, refer to [configuration](#configuration)) 
+- **SR**: os/cn v1.2.0 (unsafe, refer to [configuration](#configuration)) 
 
 It may be possilbe to completely remove the region and version-specific data in the future. Refer to the source code in `game_payload/src` for details.
 
 ### Information
-The anticheat the games use is fundamentally incompatible with Wine in multiple ways. This tool launches the game without it (`injector/launcher_payload`) and imitates it's behaviour (`game_payload`).
+The anticheat the games use is fundamentally incompatible with Wine in multiple ways. This tool launches the game without it (`injector`) and imitates it's behaviour (`game_payload`).
 
 **SR-specific**: this tool disables the use of DirectX shared resources in a rather hacky way. It is required, as there is no (and most likely never will be) shared resources support in DirectX translation layers (WineD3D/DXVK). Refer to [configuration](#configuration) if you wish to run the game without the fix.
 
@@ -18,7 +18,7 @@ The anticheat the games use is fundamentally incompatible with Wine in multiple
 
 **Wine 8.0+ is recommended**, as lower versions leak "The Wine project" as the device identifier. Not critical, but taking a precaution never hurt anyone. **DXVK is strongly recommended.**
 
-**3rd-specific**: In some cases, and if you're not using Proton GE, **a fix for Media Foundation may be required to play videos. The Game may crash without it.** You can download it from [here](https://github.com/z0z0z/mf-install). You might need to [limit the number of cores available to the game](https://github.com/z0z0z/mf-install/issues/44) if your CPU has more than 8.
+**3rd-specific**: In some cases, and if you're not using Proton GE, **a fix for Media Foundation may be required to play videos. The Game may crash without it.**  You can download it from [here](https://github.com/z0z0z/mf-install). You might need to [limit the number of cores available to the game](https://github.com/z0z0z/mf-install/issues/44) if your CPU has more than 8. **IMPORTANT: do not run the mfplat fix under Proton GE. Doing so may irreparably damage your game installation!**
 
 Manual usage instructions:
 - Download the game you want to run
@@ -32,20 +32,20 @@ This tool is capable of starting the games from a different process. This may be
 To pass commandline arguments to the game, append them after the launcher path: `wine jadeite.exe 'Z:\wine\path\to\game.exe' 'Z:\wine\path\to\launcher.exe' -arg1 -arg2 -arg3`. To use the default launcher process, use `--`: `wine jadeite.exe 'Z:\wine\path\to\game.exe' -- -arg1 -arg2 -arg3`.
 
 ### Configuration
-These environment variables can be used to configure the behaviour of the tool.
+These environment variables can be used to configure the behaviour of the tool. Any value except empty string counts as set. `1` will be used in all examples.
 
 - `WAIT_BEFORE_RESUME=1` - show a messagebox and wait for user input before resuming the game process. Useful on my side for debugging
 
 **SR-exclusive**:
 - `I_WANT_A_BAN=1` - allows to launch SR. Please only use testing accounts, as there is an extremely high risk of getting banned
-- `SRFIX_DISABLE=1` - disable shared resources fix
+- `SRFIX_DISABLE=1` - disable shared resources fix. Not recommended. Doing so will most likely cause the game to not run at all
 
 ### Internals
-This tool consists of three parts: the main injector (`injector`), the launcher payload (`injector/launcher_payload`) and the game payload (`game_payload`).
+This tool consists of three parts: the main injector (`injector/src/exe.c`), the launcher payload (`injector/src/dll.c`) and the game payload (`game_payload`).
 
 I am very bad at explaining, so just take a look at the source code. Maybe I'll write a detailed explanation in the future.
 
-A part of the source code is witheld (`game_payload/src/tp6.c`). This is a forced measure to make abuse more difficult. 
+A part of the source code is witheld (`game_payload/src/tp6.c`). This is a forced measure to make abuse more difficult. However, a precompiled blob is provided in the repo. `build.sh` will use it automatically.
 
 ### Guildelines
 1. **Please don't share this project in public.** This might attract unnecessary attention from either the Game Company or the Anticheat Company
@@ -60,7 +60,8 @@ Please do not report any issues with the Game to the official channels. Use the
 
 ### Credits
 - mkrsym1 — project leader, reverse engineering
-- Yor#1920 — major help with analyzing network activity
+- [EternalStudentDesuKa](https://github.com/EternalStudentDesuKa) — major help with analyzing network activity
+- [An Anime Team](https://github.com/an-anime-team) — Honkers Launcher and The Honkers Railway Launcher
 - Some others credited in the source code
 
 License: MIT

build.sh

@@ -1,12 +1,6 @@
 #!/usr/bin/env bash
 set -e
 
-if ! [ "x$1" = "xdo" ]; then
-    echo "A part of the source code is witheld (game_payload/src/tp6.c) to make abuse more difficult. Please download a binary release"
-    exit
-fi
-shift
-
 strip="x86_64-w64-mingw32-strip"
 
 rm -f jadeite.zip

game_payload/copy_tp6c.sh

@@ -0,0 +1,4 @@
+#!/usr/bin/env sh
+
+cp "$1" "$2"
+cp "$1" "$3"

game_payload/meson.build

@@ -1,3 +1,7 @@
+fs = import('fs')
+
+include_dir = include_directories('include')
+
 # Input files
 sources = [
     'src/main.c',
@@ -8,10 +12,7 @@ sources = [
     'src/hi3.c',
     'src/hsr.c',
     'src/utils.c',
-    'src/msg.c',
+    'src/msg.c'
-
-    # File withheld to make abuse more difficult
-    'src/tp6.c'
 ]
 resources = [
     'res/hi3/glb/allocations.dat',
@@ -24,17 +25,56 @@ resources = [
 ]
 
 # Generate resource files for ./res
-res_files = custom_target(
+res_header = custom_target(
-    'resources.[ho]',
+    'resources.h',
-    output: [ 'resources.o', 'resources.h' ],
+    output: 'resources.h',
     input: resources,
-    command: [ gen_res, meson.current_source_dir(), '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
+    command: [ gen_res, '--header', meson.current_source_dir(), '@OUTPUT0@', '@INPUT@' ]
 )
+res_object = custom_target(
+    'resources.o',
+    output: 'resources.o',
+    input: resources,
+    command: [ gen_res, '--object', meson.current_source_dir(), '@OUTPUT0@', '@INPUT@' ]
+)
+
+if fs.exists('src/tp6.c')
+    # Compile the real file first (dirty hack)
+    tp6c_fake_exe = executable(
+        'tp6c.o',
+        'src/tp6.c',
+        res_header,
+        link_args: [ '-r' ], # Output an object file
+        include_directories: include_dir
+    )
+    
+    # another dirty hack
+    copy_tp6c = find_program('copy_tp6c.sh')
+
+    tp6c_target = [custom_target(
+        'copy_tp6c',
+        output: 'tp6c.o',
+        input: tp6c_fake_exe.extract_all_objects(recursive: false),
+        command: [ 
+            copy_tp6c, 
+            '@INPUT0@',
+            '@OUTPUT0@', meson.current_source_dir() / 'blob/tp6c.o' 
+        ]
+    )]
+    tp6c_blob = []
+else
+    message('Using precompiled tp6c blob. Refer to the readme for more details')
+    tp6c_target = []
+    tp6c_blob = [ 'blob/tp6c.o' ]
+endif
 
 shared_library(
     'game_payload',
     sources,
-    res_files,
+    res_header,
-    include_directories: 'include',
+    res_object,
+    tp6c_target,
+    objects: tp6c_blob,
+    include_directories: include_dir,
     name_prefix: ''
 )

game_payload/src/hsr.c

@@ -17,14 +17,14 @@ struct crc_id_pair {
 const struct crc_id_pair HSR_REGIONS[] = {
     // It may be possible to get rid of region-specific data altogether in the future
 
-    { 0x2df53005, GAME_HSR_OS }, // os v1.1.0
+    { 0x9eb3084e, GAME_HSR_OS }, // os v1.2.0
-    { 0x3e644d26, GAME_HSR_CN }  // cn v1.1.0
+    { 0x14be07e9, GAME_HSR_CN }  // cn v1.2.0
 };
 
 #define JUMP_SIZE (6 + sizeof(void*))
 
 // Temporarily hardcoded offset
-// v1.1.0, same for os and cn
+// v1.2.0, same for os and cn
 #define WTSUD_PATCH_OFFSET 0x16430
 
 char wtsud_original_bytes[JUMP_SIZE];
@@ -72,7 +72,7 @@ static void _unityplayer_callback(HMODULE unityModule) {
 
 void hsr_fill_data(struct game_data *buf) {
     if (!utils_env_enabled("I_WANT_A_BAN")) {
-        msg_err_a("Using this tool with HSR is unsafe. Refer to the readme for more details");
+        msg_err_a("Using this tool with HSR is unsafe. Refer to the readme for more details: https://codeberg.org/mkrsym1/jadeite");
     } else {
         msg_warn_a("Using this tool with HSR will most likely result in a ban. Please only use testing accounts");
     }

game_payload/src/tp6.md

@@ -3,3 +3,12 @@
 
 ### 1.1.0
 - HSR support
+
+### 1.1.9
+- Fixed a bug which could cause the game to crash in odd scenarios
+
+### 1.1.10
+- Fixed a subtle bug introduced in 1.1.9
+
+### 1.1.11
+- Fixed an additional issue introduced in 1.1.9

game_payload/src/utils.c

@@ -31,5 +31,5 @@ uint32_t utils_file_crc32c(const char *filePath) {
 
 char utils_env_enabled(const char *env) {
     char *envText = getenv(env);
-    return envText && strcmp(envText, "") != 0;
+    return envText && *envText;
 }

gen_resources.sh

@@ -2,19 +2,38 @@
 
 linker="x86_64-w64-mingw32-ld"
 
+# Select output types
+for i in {0..1}
+do
+    case "$1" in
+        --header)
+            gen_header=1
+            shift
+            ;;
+        --object)
+            gen_object=1
+            shift
+            ;;
+    esac 
+done
+
 # Read project directory
 proj_dir=`realpath "$1"`
 shift
 
-# Read output file destinations
+# Read output file destinations and make sure they don't exist
-resources_o=`realpath "$1"`
+if [ "x${gen_object}" = "x1" ]; then
-shift
+    resources_o=`realpath "$1"`
-resources_h=`realpath "$1"`
+    shift
-shift
 
-# Make sure that the header does not exist
+    rm -f "${resources_h}"
-rm -f "${resources_h}"
+fi
-rm -f "${resources_o}"
+if [ "x${gen_header}" = "x1" ]; then
+    resources_h=`realpath "$1"`
+    shift
+
+    rm -f "${resources_o}"
+fi
 
 # Recomupte relative paths to parameters
 idx=0
@@ -26,24 +45,28 @@ do
     idx="$(("${idx}" + 1))"
 done
 
-# Create the object file
+if [ "x${gen_object}" = "x1" ]; then
-pushd "${proj_dir}" >> /dev/null
+    # Create the object file
-$linker -r -b binary -o "${resources_o}" "${resource_files[@]}"
+    pushd "${proj_dir}" >> /dev/null
-popd >> /dev/null
+    $linker -r -b binary -o "${resources_o}" "${resource_files[@]}"
+    popd >> /dev/null
+fi
 
-# Include stddef.h in the resources header (for size_t)
+if [ "x${gen_header}" = "x1" ]; then
-echo "#include <stddef.h>" >> "${resources_h}"
+    # Include stddef.h in the resources header (for size_t)
+    echo "#include <stddef.h>" >> "${resources_h}"
 
-for resource in "${resource_files[@]}"
+    for resource in "${resource_files[@]}"
-do
+    do
-    # Use relative path to the resource as the variable name
+        # Use relative path to the resource as the variable name
-    var_name="_binary_${resource}"
+        var_name="_binary_${resource}"
 
-    # Replace all non-alphanumeric characters with underscores
+        # Replace all non-alphanumeric characters with underscores
-    var_name=`printf "${var_name}" | sed "s/[^a-zA-Z0-9]/_/g"`
+        var_name=`printf "${var_name}" | sed "s/[^a-zA-Z0-9]/_/g"`
 
-    # Define externs in the header
+        # Define externs in the header
-    echo "extern void *${var_name}_start;" >> "${resources_h}"
+        echo "extern void *${var_name}_start;" >> "${resources_h}"
-    echo "extern void *${var_name}_size;" >> "${resources_h}"
+        echo "extern void *${var_name}_size;" >> "${resources_h}"
-    echo "" >> "${resources_h}"
+        echo "" >> "${resources_h}"
-done
+    done
+fi

injector/include/envs.h

@@ -1,6 +1,6 @@
 #pragma once
 
-#define EPFX "__JADEITE_"
+#define EPFX L"__JADEITE_"
 
 #define ENV_EXE_PATH EPFX"TARGET_EXE_PATH"
 #define ENV_DLL_PATH EPFX"INJECT_DLL_PATH"

injector/include/inject.h

@@ -2,4 +2,4 @@
 
 #include <windows.h>
 
-void inject(HANDLE process, const void *payload, size_t payloadSize, const char *dllPath);
+void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar_t *dllPath);

injector/meson.build

@@ -17,14 +17,14 @@ exe_res_files = custom_target(
     'launcher_p.[oh]',
     output: [ 'launcher_p.o', 'launcher_p.h' ],
     input: [ launcher_payload_bin ],
-    command: [ gen_res, './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
+    command: [ gen_res, '--header', '--object', './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
 )
 
 dll_res_files = custom_target(
     'game_p.[oh]',
     output: [ 'game_p.o', 'game_p.h' ],
     input: [ game_payload_bin ],
-    command: [ gen_res, './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
+    command: [ gen_res, '--header', '--object', './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
 )
 
 # Main injector exe
@@ -34,7 +34,8 @@ executable(
     'src/inject.c',
     exe_res_files,
     include_directories: include_dir,
-    name_prefix: ''
+    name_prefix: '',
+    link_args: '-municode'
 )
 
 # Dll that will be injected into the launcher
@@ -44,5 +45,6 @@ shared_library(
     'src/inject.c',
     dll_res_files,
     include_directories: include_dir,
-    name_prefix: ''
+    name_prefix: '',
+    link_args: '-municode'
 )

injector/src/dll.c

@@ -7,7 +7,7 @@
 
 typedef char *(*wgufn_t)(wchar_t* path); // wine_get_unix_file_name
 
-const char *J_MB_TITLE = "Jadeite Launcher Payload";
+const wchar_t *J_MB_TITLE = L"Jadeite Launcher Payload";
 
 BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
     // Only listen for attach
@@ -16,37 +16,37 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
     }
 
     // Get target EXE path
-    char *targetExe = getenv(ENV_EXE_PATH);
+    wchar_t targetExe[MAX_PATH];
+    GetEnvironmentVariableW(ENV_EXE_PATH, targetExe, MAX_PATH);
     
     // Get the path of the DLL to inject
-    char *injectDll = getenv(ENV_DLL_PATH);
+    wchar_t injectDll[MAX_PATH];
+    GetEnvironmentVariableW(ENV_DLL_PATH, injectDll, MAX_PATH);
 
     // Get game commandline
-    char *cmdline = getenv(ENV_PROC_CMD);
+    wchar_t cmdline[8192];
+    GetEnvironmentVariableW(ENV_PROC_CMD, cmdline, sizeof(cmdline) / sizeof(wchar_t));
 
     // Compute the working directory path
-    char workdir[MAX_PATH];
+    wchar_t workdir[MAX_PATH];
-    strcpy(workdir, targetExe);
+    wcscpy(workdir, targetExe);
-    *(strrchr(workdir, '\\')) = '\0';
+    *(wcsrchr(workdir, L'\\')) = L'\0';
 
     // SAFETY: verify that the injector is not inside the game directory
     HMODULE kernel32 = GetModuleHandleA("kernel32.dll");
     wgufn_t wine_get_unix_file_name = (wgufn_t)GetProcAddress(kernel32, "wine_get_unix_file_name");
 
     if (wine_get_unix_file_name) {
-        wchar_t wInjectDll[MAX_PATH], wWorkdir[MAX_PATH];
+        char *unixInjectDll = wine_get_unix_file_name(injectDll);
-        MultiByteToWideChar(CP_UTF8, 0, injectDll, strlen(injectDll) + 1, wInjectDll, MAX_PATH);
+        char *unixWorkdir = wine_get_unix_file_name(workdir);
-        MultiByteToWideChar(CP_UTF8, 0, workdir, strlen(workdir) + 1, wWorkdir, MAX_PATH);
-
-        char *unixInjectDll = wine_get_unix_file_name(wInjectDll);
-        char *unixWorkdir = wine_get_unix_file_name(wWorkdir);
 
+        char *i = unixInjectDll, *w = unixWorkdir;
         char startsWith = 0;
-        while (*unixInjectDll != '\0' && *unixWorkdir != '\0') {
+        while (*i && *w) {
-            startsWith = *unixInjectDll == *unixWorkdir;
+            startsWith = *i == *w;
             if (!startsWith) break;
 
-            unixInjectDll++, unixWorkdir++;
+            i++, w++;
         }
 
         HANDLE heap = GetProcessHeap();
@@ -54,22 +54,22 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
         HeapFree(heap, 0, unixWorkdir);
 
         if (startsWith) {
-            MessageBoxA(NULL, "Putting the patcher (or any other foreign PE binaries) inside the game directory is dangerous! Please move it elsewhere.", J_MB_TITLE, MB_OK | MB_ICONERROR);
+            MessageBoxW(NULL, L"Putting the patcher (or any other foreign PE binaries) inside the game directory is dangerous! Please move it elsewhere.", J_MB_TITLE, MB_OK | MB_ICONERROR);
             exit(1);
         }
     } else {
-        MessageBoxA(NULL, "Could not find wine_get_unix_file_name! Wine version too old?", J_MB_TITLE, MB_OK | MB_ICONWARNING);
+        MessageBoxW(NULL, L"Could not find wine_get_unix_file_name! Wine version too old?", J_MB_TITLE, MB_OK | MB_ICONWARNING);
     }
 
     // Start the game
-    STARTUPINFO si;
+    STARTUPINFOW si;
     ZeroMemory(&si, sizeof(si));
 
     PROCESS_INFORMATION pi;
     si.cb = sizeof(si);
     ZeroMemory(&pi, sizeof(pi));
 
-    if (!CreateProcessA(
+    if (!CreateProcessW(
         NULL,
         cmdline,
         NULL,
@@ -81,9 +81,9 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
         &si,
         &pi
     )) {
-        char message[64];
+        wchar_t message[1024];
-        sprintf(message, "Failed to start game process: %ld", GetLastError());
+        wsprintfW(message, L"Failed to start game process: %ld", GetLastError());
-        MessageBoxA(NULL, message, J_MB_TITLE, MB_OK | MB_ICONERROR);
+        MessageBoxW(NULL, message, J_MB_TITLE, MB_OK | MB_ICONERROR);
 
         exit(1);
     }
@@ -95,10 +95,10 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
 
     // Optional: wait for user input before resuming (useful for debugging) 
     char *waitEnabled = getenv("WAIT_BEFORE_RESUME");
-    if (waitEnabled && strcmp(waitEnabled, "") != 0) {
+    if (waitEnabled && *waitEnabled) {
-        char message[64];
+        wchar_t message[64];
-        sprintf(message, "PID: %ld. Press OK to continue", pi.dwProcessId);
+        wsprintfW(message, L"PID: %ld. Press OK to continue", pi.dwProcessId);
-        MessageBoxA(NULL, message, J_MB_TITLE, MB_OK | MB_ICONINFORMATION);
+        MessageBoxW(NULL, message, J_MB_TITLE, MB_OK | MB_ICONINFORMATION);
     }
 
     // Resume the process

injector/src/exe.c

@@ -5,28 +5,28 @@
 
 #include <launcher_p.h>
 
-const char LAUNCHER_INJECT_DLL[] = "launcher_payload.dll";
+const wchar_t *LAUNCHER_INJECT_DLL = L"launcher_payload.dll";
-const char GAME_INJECT_DLL[] = "game_payload.dll";
+const wchar_t *GAME_INJECT_DLL = L"game_payload.dll";
 
 #define SHIFT(argc, argv) argc--, argv++
 
-int main(int argc, char **argv) {
+int wmain(int argc, wchar_t **argv) {
     // Read arguments
-    char *gamePath = NULL;
+    wchar_t *gamePath = NULL;
-    char *launcherPath = NULL;
+    wchar_t *launcherPath = NULL;
 
     // Skip executable
     SHIFT(argc, argv);
     
     switch (argc) {
         case 0:
-            printf("Usage: wine jadeite.exe [game path] <launcher path>\n");
+            wprintf(L"Usage: wine jadeite.exe [game path] <launcher path>\n");
             return 0;
         case 1:
             gamePath = argv[0];
             SHIFT(argc, argv);
 
-            launcherPath = "--";
+            launcherPath = L"--";
 
             break;
         default:
@@ -40,57 +40,57 @@ int main(int argc, char **argv) {
     }
 
     // Default launcher path
-    if (strcmp(launcherPath, "--") == 0) {
+    if (wcscmp(launcherPath, L"--") == 0) {
-        printf("No launcher process specified! Using explorer.exe\n");
+        wprintf(L"No launcher process specified! Using explorer.exe\n");
-        launcherPath = "C:\\Windows\\explorer.exe";
+        launcherPath = L"C:\\Windows\\explorer.exe";
     } 
 
     // cd into the injector directory
-    char injectorPath[MAX_PATH];
+    wchar_t injectorPath[MAX_PATH];
-    GetModuleFileNameA(GetModuleHandleA(NULL), injectorPath, sizeof(injectorPath));
+    GetModuleFileNameW(GetModuleHandleW(NULL), injectorPath, MAX_PATH);
 
-    *(strrchr(injectorPath, '\\')) = '\0';
+    *(wcsrchr(injectorPath, L'\\')) = L'\0';
     
-    SetCurrentDirectoryA(injectorPath);
+    SetCurrentDirectoryW(injectorPath);
 
     // Compute absolute paths
-    char gameExePath[MAX_PATH];
+    wchar_t gameExePath[MAX_PATH];
-    GetFullPathNameA(gamePath, sizeof(gameExePath), gameExePath, NULL);
+    GetFullPathNameW(gamePath, MAX_PATH, gameExePath, NULL);
 
-    char gamePayloadPath[MAX_PATH];
+    wchar_t gamePayloadPath[MAX_PATH];
-    GetFullPathNameA(GAME_INJECT_DLL, sizeof(gamePayloadPath), gamePayloadPath, NULL);
+    GetFullPathNameW(GAME_INJECT_DLL, MAX_PATH, gamePayloadPath, NULL);
 
-    char launcherPayloadPath[MAX_PATH];
+    wchar_t launcherPayloadPath[MAX_PATH];
-    GetFullPathNameA(LAUNCHER_INJECT_DLL, sizeof(launcherPayloadPath), launcherPayloadPath, NULL);
+    GetFullPathNameW(LAUNCHER_INJECT_DLL, MAX_PATH, launcherPayloadPath, NULL);
 
     // Construct commandline for the game process
-    char cmdline[8192];
+    wchar_t cmdline[8192];
-    sprintf(cmdline, "\"%s\"", gameExePath);
+    wsprintfW(cmdline, L"\"%ls\"", gameExePath);
 
     while (argc) {
-        char arg[8192];
+        wchar_t arg[8192];
-        sprintf(arg, " \"%s\"", argv[0]);
+        wsprintfW(arg, L" \"%ls\"", argv[0]);
-        strcat(cmdline, arg);
+        wcscat(cmdline, arg);
 
         SHIFT(argc, argv);
     }
 
     // Set envvars
-    SetEnvironmentVariableA(ENV_EXE_PATH, gameExePath);
+    SetEnvironmentVariableW(ENV_EXE_PATH, gameExePath);
-    SetEnvironmentVariableA(ENV_DLL_PATH, gamePayloadPath);
+    SetEnvironmentVariableW(ENV_DLL_PATH, gamePayloadPath);
-    SetEnvironmentVariableA(ENV_PROC_CMD, cmdline);
+    SetEnvironmentVariableW(ENV_PROC_CMD, cmdline);
 
     // Start the launcher
-    printf("Starting '%s' via '%s'\n", gameExePath, launcherPath);
+    wprintf(L"Starting '%ls' via '%ls'\n", gameExePath, launcherPath);
 
-    STARTUPINFO si;
+    STARTUPINFOW si;
     ZeroMemory(&si, sizeof(si));
 
     PROCESS_INFORMATION pi;
     si.cb = sizeof(si);
     ZeroMemory(&pi, sizeof(pi));
 
-    if (!CreateProcessA(
+    if (!CreateProcessW(
         launcherPath,
         NULL,
         NULL,
@@ -102,11 +102,11 @@ int main(int argc, char **argv) {
         &si,
         &pi
     )) {
-        fprintf(stderr, "Could not start process! (%ld)\n", GetLastError());
+        fwprintf(stderr, L"Could not start process! (%ld)\n", GetLastError());
         exit(1);
     }
 
-    printf("Started launcher process (%ld)\n", pi.dwProcessId);
+    wprintf(L"Started launcher process (%ld)\n", pi.dwProcessId);
 
     // Inject
     void *payloadStart = &_binary_launcher_p_o_p_launcher_p_bin_start;

injector/src/game_p.asm

@@ -1,5 +1,50 @@
 BITS 64
 
+; Macro definitions
+
+; read dst, pSrc, size
+%macro read 3
+
+    mov %1, [%2]
+    add %2, %3
+
+%endmacro
+
+; copy pDst, pSrc, temp, tempSize
+%macro copy 4
+
+    mov %3, [%2]
+    mov [%1], %3
+    add %1, %4
+    add %2, %4
+
+%endmacro
+
+; unprotect addr, size, fn
+%macro unprotect 3
+
+    mov rcx, %1
+    mov rdx, %2
+    mov r8, 40h  ; PAGE_EXECUTE_READWRITE
+    lea r9, [rel oldProtect]
+
+    call %3
+
+%endmacro
+
+; reprotect addr, size, fn
+%macro reprotect 3
+
+    mov rcx, %1
+    mov rdx, %2
+    lea r9, [rel oldProtect]
+    mov r8d, [r9]
+
+    call %3
+
+%endmacro
+
+
 main: ; Replacement entry point
     push rsi
     push rdi
@@ -17,11 +62,19 @@ main: ; Replacement entry point
 
 
     mov rcx, rsi          ; kernel32.dll
-    lea rdx, [rel s_LoadLibraryA]
+    lea rdx, [rel s_VirtualProtect]
-    call rdi              ; rax = *LoadLibraryA
+    call rdi              ; rax = *VirtualProtect
+    
+    mov rcx, rax
+    call RecoverExecutable
+
+
+    mov rcx, rsi          ; kernel32.dll
+    lea rdx, [rel s_LoadLibraryW]
+    call rdi              ; rax = *LoadLibraryW
 
     lea rcx, [rel dllPath]
-    call rax              ; LoadLibraryA(dllPath)    
+    call rax              ; LoadLibraryW(dllPath)    
 
 
     mov rcx, rsi          ; kernel32.dll
@@ -63,11 +116,66 @@ main: ; Replacement entry point
     ret
 
 
+RecoverExecutable:  ; expects *VirtualProtect in rcx
+    push rbx
+    push r12
+    push r13
+    push r14
+    sub rsp, 8
+
+    mov r13, rcx
+
+    ; Find the recovery data structure
+    lea rbx, [rel dllPath]
+
+.search:
+    read ax, rbx, 2
+    test ax, ax
+    jnz .search
+
+    ; Recover entry point bytes (6 + 8 = 14 total)
+    read r12, rbx, 8  ; Address
+    mov r14, r12
+
+    unprotect r14, 14, r13
+    copy r12, rbx, rax, 8
+    copy r12, rbx, eax, 4
+    copy r12, rbx, ax,  2
+    reprotect r14, 14, r13
+
+    ; Recover import descriptor bytes (20 total)
+    read r12, rbx, 8
+    mov r14, r12
+
+    unprotect r14, 20, r13
+    copy r12, rbx, rax, 8
+    copy r12, rbx, rax, 8
+    copy r12, rbx, eax, 4
+    reprotect r14, 20, r13
+
+    ; Recover import data directory entry size bytes (4 total)
+    read r12, rbx, 8
+    mov r14, r12
+
+    unprotect r14, 4, r13
+    copy r12, rbx, eax, 4
+    reprotect r14, 4, r13
+
+    add rsp, 8
+    pop r14
+    pop r13
+    pop r12
+    pop rbx
+    ret
+
+
 %include "gpa.asm"
 
+oldProtect: dd 0
 
 ; Strings
-s_LoadLibraryA:      db "LoadLibraryA", 0
+s_VirtualProtect:    db "VirtualProtect", 0
+s_LoadLibraryW:      db "LoadLibraryW", 0
 s_GetModuleHandleA:  db "GetModuleHandleA", 0
 s_GetCommandLineW:   db "GetCommandLineW", 0
 s_UnityPlayer.dll:   db "UnityPlayer.dll", 0

injector/src/inject.c

@@ -1,5 +1,22 @@
 #include <inject.h>
 
+#define JUMP_SIZE (6 + sizeof(void*))
+
+// Original values to recover after the injection
+// Recovery is performed by the assembly payload
+#pragma pack(push, 1)
+struct recovery_data {
+    void *entryPointAddress;
+    char entryPointData[JUMP_SIZE];
+
+    void *importDescriptorAddress;
+    IMAGE_IMPORT_DESCRIPTOR importDescriptorData;
+
+    void *sizeFieldAddress;
+    DWORD sizeFieldData;
+};
+#pragma pack(pop)
+
 static inline void write_protected_process_memory(HANDLE process, void *address, const void *buf, size_t size) {
     DWORD oldProtect;
     VirtualProtectEx(process, address, size, PAGE_EXECUTE_READWRITE, &oldProtect);
@@ -10,16 +27,9 @@ static inline void write_protected_process_memory(HANDLE process, void *address,
     VirtualProtectEx(process, address, size, oldProtect, &oldProtect);
 }
 
-void inject(HANDLE process, const void *payload, size_t payloadSize, const char *dllPath) {
+void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar_t *dllPath) {
     size_t _; // Contrary to the docs, {Write,Read}ProcessMemory likes to crash if the last arg is NULL
 
-    // Inject the loader into the module
-    size_t dllPathLen = strlen(dllPath) + 1;
-
-    char *remoteAlloc = VirtualAllocEx(process, NULL, payloadSize + dllPathLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
-    WriteProcessMemory(process, remoteAlloc, payload, payloadSize, &_);
-    WriteProcessMemory(process, remoteAlloc + payloadSize, dllPath, dllPathLen, &_);
-
     // Find the EXE header in the process
     char exeHeader[1024];
     IMAGE_DOS_HEADER *dosHeader = NULL;
@@ -45,7 +55,7 @@ void inject(HANDLE process, const void *payload, size_t payloadSize, const char
         }
 
         // Skip DLLs
-        if ((ntHeaders->FileHeader.Characteristics | IMAGE_FILE_DLL) == IMAGE_FILE_DLL) {
+        if ((ntHeaders->FileHeader.Characteristics & IMAGE_FILE_DLL) == IMAGE_FILE_DLL) {
             goto cont;
         }
 
@@ -64,25 +74,60 @@ void inject(HANDLE process, const void *payload, size_t payloadSize, const char
 
     char *exe = (char*)memoryInfo.BaseAddress;
 
+
+    // Inject the loader into the process
+    const unsigned char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
+   
+    size_t dllPathSize = (wcslen(dllPath) + 1) * sizeof(wchar_t);
+
+    size_t allocSize = payloadSize + dllPathSize + sizeof(struct recovery_data);
+    char *remoteAlloc = VirtualAllocEx(process, NULL, allocSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+
+    // Write the assembly payload and dll path
+    WriteProcessMemory(process, remoteAlloc, payload, payloadSize, &_);
+    WriteProcessMemory(process, remoteAlloc + payloadSize, dllPath, dllPathSize, &_);
+
+
+    // Modify the executable to run the assembly payload
+    // Recovery data structure
+    struct recovery_data rd;
+
     // Replace the entry point with a jump to the loader
     char *entryPoint = exe + ntHeaders->OptionalHeader.AddressOfEntryPoint;
 
-    const unsigned char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
+    // Save the original entry point address and bytes
+    rd.entryPointAddress = entryPoint;
+    ReadProcessMemory(process, rd.entryPointAddress, rd.entryPointData, sizeof(rd.entryPointData), &_);
 
+    // Replace the entry point with a jump to the assembly payload
     write_protected_process_memory(process, entryPoint, JUMP_INST, sizeof(JUMP_INST));
     write_protected_process_memory(process, entryPoint + sizeof(JUMP_INST), &remoteAlloc, sizeof(remoteAlloc));
 
+
     // Break the import table to prevent any dlls from being loaded
     // Step 1: break the first import descriptor
     char *importDescriptors = exe + ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
+
+    // Save the original descriptor address and bytes
+    rd.importDescriptorAddress = importDescriptors;
+    ReadProcessMemory(process, rd.importDescriptorAddress, &rd.importDescriptorData, sizeof(rd.importDescriptorData), &_);
+
+    // Overwrite with zeroes    
     IMAGE_IMPORT_DESCRIPTOR firstDescriptor;
     ZeroMemory(&firstDescriptor, sizeof(firstDescriptor));
-
     write_protected_process_memory(process, importDescriptors, &firstDescriptor, sizeof(firstDescriptor));
 
     // Step 2: break the image data directory entry
-    size_t ddOffset = ((char*)&(ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)) - exeHeader;
+    char* ddAddr = ((char*)&(ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)) - exeHeader + exe;
-    DWORD newSize = 0;
+    
+    // Save the original value
+    rd.sizeFieldAddress = ddAddr;
+    ReadProcessMemory(process, rd.sizeFieldAddress, &rd.sizeFieldData, sizeof(rd.sizeFieldData), &_);
 
-    write_protected_process_memory(process, exe + ddOffset, &newSize, sizeof(newSize));
+    // Set to 0
+    DWORD newSize = 0;
+    write_protected_process_memory(process, ddAddr, &newSize, sizeof(newSize));
+
+    // Write recovery data to the allocation
+    WriteProcessMemory(process, remoteAlloc + payloadSize + dllPathSize, &rd, sizeof(rd), &_);
 }

injector/src/launcher_p.asm

@@ -12,8 +12,8 @@ main: ; Replacement entry point
 
 
     mov rcx, rsi          ; kernel32.dll
-    lea rdx, [rel s_LoadLibraryA]
+    lea rdx, [rel s_LoadLibraryW]
-    call rax              ; rax = *LoadLibraryA
+    call rax              ; rax = *LoadLibraryW
 
     lea rcx, [rel dllPath]
     call rax              ; LoadLibraryA(dllPath)
@@ -27,7 +27,7 @@ main: ; Replacement entry point
 
 
 ; Strings
-s_LoadLibraryA:  db "LoadLibraryA", 0
+s_LoadLibraryW:  db "LoadLibraryW", 0
 
 dllPath:
     ; This will be filled out by the injector

meson.build

@@ -1,4 +1,4 @@
-project('jadeite', 'c', version: '1.1.6')
+project('jadeite', 'c', version: '1.1.12')
 
 nasm = find_program('nasm')
 gen_res = find_program('gen_resources.sh')

metadata.json

@@ -1,6 +1,6 @@
 {
     "jadeite": {
-        "version": "1.1.6"
+        "version": "1.1.12"
     },
     "games": {
         "hi3rd": {
@@ -11,12 +11,12 @@
         },
         "hsr": {
             "global": {
-                "status": "unsafe",
+                "status": "unverified",
-                "version": "1.1.0"
+                "version": "1.2.0"
             },
             "china": {
-                "status": "unsafe",
+                "status": "unverified",
-                "version": "1.1.0"
+                "version": "1.2.0"
             }
         }
     }