Compare commits
27 Commits
| Author | SHA1 | Date | |
|---|---|---|---|
| b3f64ba6f6 | |||
| dd15dc60e3 | |||
| ac68448cbd | |||
| 80c817cb6b | |||
| 4e614e1d82 | |||
| 8b9f8e68aa | |||
| 99c0c20a3d | |||
| 64a25b1607 | |||
| 43e8adaf12 | |||
| 0004c26d7a | |||
| 848ae06792 | |||
| c979c980c1 | |||
| 3d943b641b | |||
| 215af6e3db | |||
| 7aef85851c | |||
| f7c24f5ab7 | |||
| 2ebd40b621 | |||
| 7f43a042e8 | |||
| 8164694c8f | |||
| 61e657b2e4 | |||
| 7a8087e8a1 | |||
| 351fe85e2f | |||
| 938b663bd9 | |||
| df1f611199 | |||
| 94efee7496 | |||
| 06be53ad8e | |||
| ce427556a3 |
2
.gitignore
vendored
2
.gitignore
vendored
@ -3,7 +3,7 @@
|
||||
.directory
|
||||
|
||||
# File withheld to make abuse more difficult
|
||||
game_payload/src/tp6.c
|
||||
game_payload/src/core.c
|
||||
|
||||
build
|
||||
out
|
||||
|
||||
15
README.md
15
README.md
@ -1,11 +1,11 @@
|
||||
### Games and regions
|
||||
- **3rd**: glb v6.7.0
|
||||
- **SR**: os/cn v1.1.0 (unsafe, refer to [configuration](#configuration))
|
||||
- **SR**: os/cn v1.2.0 (potentially unsafe, but no bans were reported since v1.1.0)
|
||||
|
||||
It may be possilbe to completely remove the region and version-specific data in the future. Refer to the source code in `game_payload/src` for details.
|
||||
|
||||
### Information
|
||||
The anticheat the games use is fundamentally incompatible with Wine in multiple ways. This tool launches the game without it (`injector/launcher_payload`) and imitates it's behaviour (`game_payload`).
|
||||
The anticheat the games use is fundamentally incompatible with Wine in multiple ways. This tool launches the game without it (`injector`) and imitates it's behaviour (`game_payload`).
|
||||
|
||||
**SR-specific**: this tool disables the use of DirectX shared resources in a rather hacky way. It is required, as there is no (and most likely never will be) shared resources support in DirectX translation layers (WineD3D/DXVK). Refer to [configuration](#configuration) if you wish to run the game without the fix.
|
||||
|
||||
@ -18,7 +18,7 @@ The anticheat the games use is fundamentally incompatible with Wine in multiple
|
||||
|
||||
**Wine 8.0+ is recommended**, as lower versions leak "The Wine project" as the device identifier. Not critical, but taking a precaution never hurt anyone. **DXVK is strongly recommended.**
|
||||
|
||||
**3rd-specific**: In some cases, and if you're not using Proton GE, **a fix for Media Foundation may be required to play videos. The Game may crash without it.** You can download it from [here](https://github.com/z0z0z/mf-install). You might need to [limit the number of cores available to the game](https://github.com/z0z0z/mf-install/issues/44) if your CPU has more than 8.
|
||||
**3rd-specific**: In some cases, and if you're not using Proton GE, **a fix for Media Foundation may be required to play videos. The Game may crash without it.** You can download it from [here](https://github.com/z0z0z/mf-install). You might need to [limit the number of cores available to the game](https://github.com/z0z0z/mf-install/issues/44) if your CPU has more than 8. **IMPORTANT: do not run the mfplat fix under Proton GE. Doing so may irreparably damage your game installation!**
|
||||
|
||||
Manual usage instructions:
|
||||
- Download the game you want to run
|
||||
@ -32,20 +32,19 @@ This tool is capable of starting the games from a different process. This may be
|
||||
To pass commandline arguments to the game, append them after the launcher path: `wine jadeite.exe 'Z:\wine\path\to\game.exe' 'Z:\wine\path\to\launcher.exe' -arg1 -arg2 -arg3`. To use the default launcher process, use `--`: `wine jadeite.exe 'Z:\wine\path\to\game.exe' -- -arg1 -arg2 -arg3`.
|
||||
|
||||
### Configuration
|
||||
These environment variables can be used to configure the behaviour of the tool.
|
||||
These environment variables can be used to configure the behaviour of the tool. Any value except empty string counts as set. `1` will be used in all examples.
|
||||
|
||||
- `WAIT_BEFORE_RESUME=1` - show a messagebox and wait for user input before resuming the game process. Useful on my side for debugging
|
||||
|
||||
**SR-exclusive**:
|
||||
- `I_WANT_A_BAN=1` - allows to launch SR. Please only use testing accounts, as there is an extremely high risk of getting banned
|
||||
- `SRFIX_DISABLE=1` - disable shared resources fix
|
||||
- `SRFIX_DISABLE=1` - disable shared resources fix. Not recommended. Doing so will most likely cause the game to not run at all
|
||||
|
||||
### Internals
|
||||
This tool consists of three parts: the main injector (`injector`), the launcher payload (`injector/launcher_payload`) and the game payload (`game_payload`).
|
||||
This tool consists of three parts: the main injector (`injector/src/exe.c`), the launcher payload (`injector/src/dll.c`) and the game payload (`game_payload`).
|
||||
|
||||
I am very bad at explaining, so just take a look at the source code. Maybe I'll write a detailed explanation in the future.
|
||||
|
||||
A part of the source code is witheld (`game_payload/src/tp6.c`). This is a forced measure to make abuse more difficult.
|
||||
A part of the source code is witheld (`game_payload/src/core.c`). This is a forced measure to make abuse more difficult. However, a precompiled blob is provided in the repo. `build.sh` will use it automatically.
|
||||
|
||||
### Guildelines
|
||||
1. **Please don't share this project in public.** This might attract unnecessary attention from either the Game Company or the Anticheat Company
|
||||
|
||||
6
build.sh
6
build.sh
@ -1,12 +1,6 @@
|
||||
#!/usr/bin/env bash
|
||||
set -e
|
||||
|
||||
if ! [ "x$1" = "xdo" ]; then
|
||||
echo "A part of the source code is witheld (game_payload/src/tp6.c) to make abuse more difficult. Please download a binary release"
|
||||
exit
|
||||
fi
|
||||
shift
|
||||
|
||||
strip="x86_64-w64-mingw32-strip"
|
||||
|
||||
rm -f jadeite.zip
|
||||
|
||||
BIN
game_payload/blob/core.o
Normal file
BIN
game_payload/blob/core.o
Normal file
Binary file not shown.
4
game_payload/copy_core.sh
Normal file
4
game_payload/copy_core.sh
Normal file
@ -0,0 +1,4 @@
|
||||
#!/usr/bin/env sh
|
||||
|
||||
cp "$1" "$2"
|
||||
cp "$1" "$3"
|
||||
7
game_payload/include/core.h
Normal file
7
game_payload/include/core.h
Normal file
@ -0,0 +1,7 @@
|
||||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
|
||||
#include <game.h>
|
||||
|
||||
void core_setup_patcher(struct game_data *game, HMODULE baseModule);
|
||||
@ -1,7 +0,0 @@
|
||||
#pragma once
|
||||
|
||||
#include <windows.h>
|
||||
|
||||
#include <game.h>
|
||||
|
||||
void tp6_setup_patcher(struct game_data *game, HMODULE baseModule);
|
||||
@ -1,3 +1,7 @@
|
||||
fs = import('fs')
|
||||
|
||||
include_dir = include_directories('include')
|
||||
|
||||
# Input files
|
||||
sources = [
|
||||
'src/main.c',
|
||||
@ -8,10 +12,7 @@ sources = [
|
||||
'src/hi3.c',
|
||||
'src/hsr.c',
|
||||
'src/utils.c',
|
||||
'src/msg.c',
|
||||
|
||||
# File withheld to make abuse more difficult
|
||||
'src/tp6.c'
|
||||
'src/msg.c'
|
||||
]
|
||||
resources = [
|
||||
'res/hi3/glb/allocations.dat',
|
||||
@ -24,17 +25,56 @@ resources = [
|
||||
]
|
||||
|
||||
# Generate resource files for ./res
|
||||
res_files = custom_target(
|
||||
'resources.[ho]',
|
||||
output: [ 'resources.o', 'resources.h' ],
|
||||
res_header = custom_target(
|
||||
'resources.h',
|
||||
output: 'resources.h',
|
||||
input: resources,
|
||||
command: [ gen_res, meson.current_source_dir(), '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
|
||||
command: [ gen_res, '--header', meson.current_source_dir(), '@OUTPUT0@', '@INPUT@' ]
|
||||
)
|
||||
res_object = custom_target(
|
||||
'resources.o',
|
||||
output: 'resources.o',
|
||||
input: resources,
|
||||
command: [ gen_res, '--object', meson.current_source_dir(), '@OUTPUT0@', '@INPUT@' ]
|
||||
)
|
||||
|
||||
if fs.exists('src/core.c')
|
||||
# Compile the real file first (dirty hack)
|
||||
core_fake_exe = executable(
|
||||
'core.o',
|
||||
'src/core.c',
|
||||
res_header,
|
||||
link_args: [ '-r' ], # Output an object file
|
||||
include_directories: include_dir
|
||||
)
|
||||
|
||||
# another dirty hack
|
||||
copy_core = find_program('copy_core.sh')
|
||||
|
||||
core_target = [custom_target(
|
||||
'copy_core',
|
||||
output: 'core.o',
|
||||
input: core_fake_exe.extract_all_objects(recursive: false),
|
||||
command: [
|
||||
copy_core,
|
||||
'@INPUT0@',
|
||||
'@OUTPUT0@', meson.current_source_dir() / 'blob/core.o'
|
||||
]
|
||||
)]
|
||||
core_blob = []
|
||||
else
|
||||
message('Using precompiled core blob. Refer to the readme for more details')
|
||||
core_target = []
|
||||
core_blob = [ 'blob/core.o' ]
|
||||
endif
|
||||
|
||||
shared_library(
|
||||
'game_payload',
|
||||
sources,
|
||||
res_files,
|
||||
include_directories: 'include',
|
||||
res_header,
|
||||
res_object,
|
||||
core_target,
|
||||
objects: core_blob,
|
||||
include_directories: include_dir,
|
||||
name_prefix: ''
|
||||
)
|
||||
|
||||
Binary file not shown.
Binary file not shown.
Binary file not shown.
Binary file not shown.
14
game_payload/src/core.md
Normal file
14
game_payload/src/core.md
Normal file
@ -0,0 +1,14 @@
|
||||
### 1.0.0
|
||||
- First version
|
||||
|
||||
### 1.1.0
|
||||
- HSR support
|
||||
|
||||
### 1.1.9
|
||||
- Fixed a bug which could cause the game to crash in odd scenarios
|
||||
|
||||
### 1.1.10
|
||||
- Fixed a subtle bug introduced in 1.1.9
|
||||
|
||||
### 1.1.11
|
||||
- Fixed an additional issue introduced in 1.1.9
|
||||
@ -17,14 +17,14 @@ struct crc_id_pair {
|
||||
const struct crc_id_pair HSR_REGIONS[] = {
|
||||
// It may be possible to get rid of region-specific data altogether in the future
|
||||
|
||||
{ 0x2df53005, GAME_HSR_OS }, // os v1.1.0
|
||||
{ 0x3e644d26, GAME_HSR_CN } // cn v1.1.0
|
||||
{ 0x9eb3084e, GAME_HSR_OS }, // os v1.2.0
|
||||
{ 0x14be07e9, GAME_HSR_CN } // cn v1.2.0
|
||||
};
|
||||
|
||||
#define JUMP_SIZE (6 + sizeof(void*))
|
||||
|
||||
// Temporarily hardcoded offset
|
||||
// v1.1.0, same for os and cn
|
||||
// v1.2.0, same for os and cn
|
||||
#define WTSUD_PATCH_OFFSET 0x16430
|
||||
|
||||
char wtsud_original_bytes[JUMP_SIZE];
|
||||
@ -71,12 +71,6 @@ static void _unityplayer_callback(HMODULE unityModule) {
|
||||
}
|
||||
|
||||
void hsr_fill_data(struct game_data *buf) {
|
||||
if (!utils_env_enabled("I_WANT_A_BAN")) {
|
||||
msg_err_a("Using this tool with HSR is unsafe. Refer to the readme for more details");
|
||||
} else {
|
||||
msg_warn_a("Using this tool with HSR will most likely result in a ban. Please only use testing accounts");
|
||||
}
|
||||
|
||||
uint32_t crc = utils_file_crc32c("UnityPlayer.dll");
|
||||
|
||||
enum game_id id = GAME_INVALID;
|
||||
|
||||
@ -3,7 +3,7 @@
|
||||
#include <ntdll.h>
|
||||
#include <ace.h>
|
||||
#include <game.h>
|
||||
#include <tp6.h>
|
||||
#include <core.h>
|
||||
#include <utils.h>
|
||||
|
||||
#include <main.h>
|
||||
@ -46,7 +46,7 @@ BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID reserved) {
|
||||
ace_load_driver_module();
|
||||
|
||||
// ...magic
|
||||
tp6_setup_patcher(&game, baseModule);
|
||||
core_setup_patcher(&game, baseModule);
|
||||
|
||||
// Load the UnityPlayer module and invoke the callback
|
||||
HMODULE unityModule = LoadLibraryA("UnityPlayer.dll");
|
||||
|
||||
@ -1,5 +0,0 @@
|
||||
### 1.0.0
|
||||
- First version
|
||||
|
||||
### 1.1.0
|
||||
- HSR support
|
||||
@ -31,5 +31,5 @@ uint32_t utils_file_crc32c(const char *filePath) {
|
||||
|
||||
char utils_env_enabled(const char *env) {
|
||||
char *envText = getenv(env);
|
||||
return envText && strcmp(envText, "") != 0;
|
||||
return envText && *envText;
|
||||
}
|
||||
|
||||
@ -2,19 +2,38 @@
|
||||
|
||||
linker="x86_64-w64-mingw32-ld"
|
||||
|
||||
# Select output types
|
||||
for i in {0..1}
|
||||
do
|
||||
case "$1" in
|
||||
--header)
|
||||
gen_header=1
|
||||
shift
|
||||
;;
|
||||
--object)
|
||||
gen_object=1
|
||||
shift
|
||||
;;
|
||||
esac
|
||||
done
|
||||
|
||||
# Read project directory
|
||||
proj_dir=`realpath "$1"`
|
||||
shift
|
||||
|
||||
# Read output file destinations
|
||||
resources_o=`realpath "$1"`
|
||||
shift
|
||||
resources_h=`realpath "$1"`
|
||||
shift
|
||||
# Read output file destinations and make sure they don't exist
|
||||
if [ "x${gen_object}" = "x1" ]; then
|
||||
resources_o=`realpath "$1"`
|
||||
shift
|
||||
|
||||
# Make sure that the header does not exist
|
||||
rm -f "${resources_h}"
|
||||
rm -f "${resources_o}"
|
||||
rm -f "${resources_h}"
|
||||
fi
|
||||
if [ "x${gen_header}" = "x1" ]; then
|
||||
resources_h=`realpath "$1"`
|
||||
shift
|
||||
|
||||
rm -f "${resources_o}"
|
||||
fi
|
||||
|
||||
# Recomupte relative paths to parameters
|
||||
idx=0
|
||||
@ -26,16 +45,19 @@ do
|
||||
idx="$(("${idx}" + 1))"
|
||||
done
|
||||
|
||||
# Create the object file
|
||||
pushd "${proj_dir}" >> /dev/null
|
||||
$linker -r -b binary -o "${resources_o}" "${resource_files[@]}"
|
||||
popd >> /dev/null
|
||||
if [ "x${gen_object}" = "x1" ]; then
|
||||
# Create the object file
|
||||
pushd "${proj_dir}" >> /dev/null
|
||||
$linker -r -b binary -o "${resources_o}" "${resource_files[@]}"
|
||||
popd >> /dev/null
|
||||
fi
|
||||
|
||||
# Include stddef.h in the resources header (for size_t)
|
||||
echo "#include <stddef.h>" >> "${resources_h}"
|
||||
if [ "x${gen_header}" = "x1" ]; then
|
||||
# Include stddef.h in the resources header (for size_t)
|
||||
echo "#include <stddef.h>" >> "${resources_h}"
|
||||
|
||||
for resource in "${resource_files[@]}"
|
||||
do
|
||||
for resource in "${resource_files[@]}"
|
||||
do
|
||||
# Use relative path to the resource as the variable name
|
||||
var_name="_binary_${resource}"
|
||||
|
||||
@ -46,4 +68,5 @@ do
|
||||
echo "extern void *${var_name}_start;" >> "${resources_h}"
|
||||
echo "extern void *${var_name}_size;" >> "${resources_h}"
|
||||
echo "" >> "${resources_h}"
|
||||
done
|
||||
done
|
||||
fi
|
||||
|
||||
@ -17,14 +17,14 @@ exe_res_files = custom_target(
|
||||
'launcher_p.[oh]',
|
||||
output: [ 'launcher_p.o', 'launcher_p.h' ],
|
||||
input: [ launcher_payload_bin ],
|
||||
command: [ gen_res, './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
|
||||
command: [ gen_res, '--header', '--object', './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
|
||||
)
|
||||
|
||||
dll_res_files = custom_target(
|
||||
'game_p.[oh]',
|
||||
output: [ 'game_p.o', 'game_p.h' ],
|
||||
input: [ game_payload_bin ],
|
||||
command: [ gen_res, './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
|
||||
command: [ gen_res, '--header', '--object', './injector', '@OUTPUT0@', '@OUTPUT1@', '@INPUT@' ]
|
||||
)
|
||||
|
||||
# Main injector exe
|
||||
|
||||
@ -30,7 +30,7 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
// Compute the working directory path
|
||||
wchar_t workdir[MAX_PATH];
|
||||
wcscpy(workdir, targetExe);
|
||||
*(wcsrchr(workdir, '\\')) = '\0';
|
||||
*(wcsrchr(workdir, L'\\')) = L'\0';
|
||||
|
||||
// SAFETY: verify that the injector is not inside the game directory
|
||||
HMODULE kernel32 = GetModuleHandleA("kernel32.dll");
|
||||
@ -42,7 +42,7 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
|
||||
char *i = unixInjectDll, *w = unixWorkdir;
|
||||
char startsWith = 0;
|
||||
while (*i != '\0' && *w != '\0') {
|
||||
while (*i && *w) {
|
||||
startsWith = *i == *w;
|
||||
if (!startsWith) break;
|
||||
|
||||
@ -95,7 +95,7 @@ BOOL WINAPI DllMain(HINSTANCE inst, DWORD reason, LPVOID reserved) {
|
||||
|
||||
// Optional: wait for user input before resuming (useful for debugging)
|
||||
char *waitEnabled = getenv("WAIT_BEFORE_RESUME");
|
||||
if (waitEnabled && strcmp(waitEnabled, "") != 0) {
|
||||
if (waitEnabled && *waitEnabled) {
|
||||
wchar_t message[64];
|
||||
wsprintfW(message, L"PID: %ld. Press OK to continue", pi.dwProcessId);
|
||||
MessageBoxW(NULL, message, J_MB_TITLE, MB_OK | MB_ICONINFORMATION);
|
||||
|
||||
@ -1,5 +1,50 @@
|
||||
BITS 64
|
||||
|
||||
; Macro definitions
|
||||
|
||||
; read dst, pSrc, size
|
||||
%macro read 3
|
||||
|
||||
mov %1, [%2]
|
||||
add %2, %3
|
||||
|
||||
%endmacro
|
||||
|
||||
; copy pDst, pSrc, temp, tempSize
|
||||
%macro copy 4
|
||||
|
||||
mov %3, [%2]
|
||||
mov [%1], %3
|
||||
add %1, %4
|
||||
add %2, %4
|
||||
|
||||
%endmacro
|
||||
|
||||
; unprotect addr, size, fn
|
||||
%macro unprotect 3
|
||||
|
||||
mov rcx, %1
|
||||
mov rdx, %2
|
||||
mov r8, 40h ; PAGE_EXECUTE_READWRITE
|
||||
lea r9, [rel oldProtect]
|
||||
|
||||
call %3
|
||||
|
||||
%endmacro
|
||||
|
||||
; reprotect addr, size, fn
|
||||
%macro reprotect 3
|
||||
|
||||
mov rcx, %1
|
||||
mov rdx, %2
|
||||
lea r9, [rel oldProtect]
|
||||
mov r8d, [r9]
|
||||
|
||||
call %3
|
||||
|
||||
%endmacro
|
||||
|
||||
|
||||
main: ; Replacement entry point
|
||||
push rsi
|
||||
push rdi
|
||||
@ -16,6 +61,14 @@ main: ; Replacement entry point
|
||||
mov rdi, rax ; *GetProcAddress
|
||||
|
||||
|
||||
mov rcx, rsi ; kernel32.dll
|
||||
lea rdx, [rel s_VirtualProtect]
|
||||
call rdi ; rax = *VirtualProtect
|
||||
|
||||
mov rcx, rax
|
||||
call RecoverExecutable
|
||||
|
||||
|
||||
mov rcx, rsi ; kernel32.dll
|
||||
lea rdx, [rel s_LoadLibraryW]
|
||||
call rdi ; rax = *LoadLibraryW
|
||||
@ -63,10 +116,65 @@ main: ; Replacement entry point
|
||||
ret
|
||||
|
||||
|
||||
RecoverExecutable: ; expects *VirtualProtect in rcx
|
||||
push rbx
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
sub rsp, 8
|
||||
|
||||
mov r13, rcx
|
||||
|
||||
; Find the recovery data structure
|
||||
lea rbx, [rel dllPath]
|
||||
|
||||
.search:
|
||||
read ax, rbx, 2
|
||||
test ax, ax
|
||||
jnz .search
|
||||
|
||||
; Recover entry point bytes (6 + 8 = 14 total)
|
||||
read r12, rbx, 8 ; Address
|
||||
mov r14, r12
|
||||
|
||||
unprotect r14, 14, r13
|
||||
copy r12, rbx, rax, 8
|
||||
copy r12, rbx, eax, 4
|
||||
copy r12, rbx, ax, 2
|
||||
reprotect r14, 14, r13
|
||||
|
||||
; Recover import descriptor bytes (20 total)
|
||||
read r12, rbx, 8
|
||||
mov r14, r12
|
||||
|
||||
unprotect r14, 20, r13
|
||||
copy r12, rbx, rax, 8
|
||||
copy r12, rbx, rax, 8
|
||||
copy r12, rbx, eax, 4
|
||||
reprotect r14, 20, r13
|
||||
|
||||
; Recover import data directory entry size bytes (4 total)
|
||||
read r12, rbx, 8
|
||||
mov r14, r12
|
||||
|
||||
unprotect r14, 4, r13
|
||||
copy r12, rbx, eax, 4
|
||||
reprotect r14, 4, r13
|
||||
|
||||
add rsp, 8
|
||||
pop r14
|
||||
pop r13
|
||||
pop r12
|
||||
pop rbx
|
||||
ret
|
||||
|
||||
|
||||
%include "gpa.asm"
|
||||
|
||||
oldProtect: dd 0
|
||||
|
||||
; Strings
|
||||
s_VirtualProtect: db "VirtualProtect", 0
|
||||
s_LoadLibraryW: db "LoadLibraryW", 0
|
||||
s_GetModuleHandleA: db "GetModuleHandleA", 0
|
||||
s_GetCommandLineW: db "GetCommandLineW", 0
|
||||
|
||||
@ -1,5 +1,22 @@
|
||||
#include <inject.h>
|
||||
|
||||
#define JUMP_SIZE (6 + sizeof(void*))
|
||||
|
||||
// Original values to recover after the injection
|
||||
// Recovery is performed by the assembly payload
|
||||
#pragma pack(push, 1)
|
||||
struct recovery_data {
|
||||
void *entryPointAddress;
|
||||
char entryPointData[JUMP_SIZE];
|
||||
|
||||
void *importDescriptorAddress;
|
||||
IMAGE_IMPORT_DESCRIPTOR importDescriptorData;
|
||||
|
||||
void *sizeFieldAddress;
|
||||
DWORD sizeFieldData;
|
||||
};
|
||||
#pragma pack(pop)
|
||||
|
||||
static inline void write_protected_process_memory(HANDLE process, void *address, const void *buf, size_t size) {
|
||||
DWORD oldProtect;
|
||||
VirtualProtectEx(process, address, size, PAGE_EXECUTE_READWRITE, &oldProtect);
|
||||
@ -13,13 +30,6 @@ static inline void write_protected_process_memory(HANDLE process, void *address,
|
||||
void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar_t *dllPath) {
|
||||
size_t _; // Contrary to the docs, {Write,Read}ProcessMemory likes to crash if the last arg is NULL
|
||||
|
||||
// Inject the loader into the module
|
||||
size_t dllPathLen = (wcslen(dllPath) + 1) * sizeof(wchar_t);
|
||||
|
||||
char *remoteAlloc = VirtualAllocEx(process, NULL, payloadSize + dllPathLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
WriteProcessMemory(process, remoteAlloc, payload, payloadSize, &_);
|
||||
WriteProcessMemory(process, remoteAlloc + payloadSize, dllPath, dllPathLen, &_);
|
||||
|
||||
// Find the EXE header in the process
|
||||
char exeHeader[1024];
|
||||
IMAGE_DOS_HEADER *dosHeader = NULL;
|
||||
@ -45,7 +55,7 @@ void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar
|
||||
}
|
||||
|
||||
// Skip DLLs
|
||||
if ((ntHeaders->FileHeader.Characteristics | IMAGE_FILE_DLL) == IMAGE_FILE_DLL) {
|
||||
if ((ntHeaders->FileHeader.Characteristics & IMAGE_FILE_DLL) == IMAGE_FILE_DLL) {
|
||||
goto cont;
|
||||
}
|
||||
|
||||
@ -64,25 +74,60 @@ void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar
|
||||
|
||||
char *exe = (char*)memoryInfo.BaseAddress;
|
||||
|
||||
|
||||
// Inject the loader into the process
|
||||
const unsigned char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
|
||||
|
||||
size_t dllPathSize = (wcslen(dllPath) + 1) * sizeof(wchar_t);
|
||||
|
||||
size_t allocSize = payloadSize + dllPathSize + sizeof(struct recovery_data);
|
||||
char *remoteAlloc = VirtualAllocEx(process, NULL, allocSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
|
||||
|
||||
// Write the assembly payload and dll path
|
||||
WriteProcessMemory(process, remoteAlloc, payload, payloadSize, &_);
|
||||
WriteProcessMemory(process, remoteAlloc + payloadSize, dllPath, dllPathSize, &_);
|
||||
|
||||
|
||||
// Modify the executable to run the assembly payload
|
||||
// Recovery data structure
|
||||
struct recovery_data rd;
|
||||
|
||||
// Replace the entry point with a jump to the loader
|
||||
char *entryPoint = exe + ntHeaders->OptionalHeader.AddressOfEntryPoint;
|
||||
|
||||
const unsigned char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
|
||||
// Save the original entry point address and bytes
|
||||
rd.entryPointAddress = entryPoint;
|
||||
ReadProcessMemory(process, rd.entryPointAddress, rd.entryPointData, sizeof(rd.entryPointData), &_);
|
||||
|
||||
// Replace the entry point with a jump to the assembly payload
|
||||
write_protected_process_memory(process, entryPoint, JUMP_INST, sizeof(JUMP_INST));
|
||||
write_protected_process_memory(process, entryPoint + sizeof(JUMP_INST), &remoteAlloc, sizeof(remoteAlloc));
|
||||
|
||||
|
||||
// Break the import table to prevent any dlls from being loaded
|
||||
// Step 1: break the first import descriptor
|
||||
char *importDescriptors = exe + ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
|
||||
|
||||
// Save the original descriptor address and bytes
|
||||
rd.importDescriptorAddress = importDescriptors;
|
||||
ReadProcessMemory(process, rd.importDescriptorAddress, &rd.importDescriptorData, sizeof(rd.importDescriptorData), &_);
|
||||
|
||||
// Overwrite with zeroes
|
||||
IMAGE_IMPORT_DESCRIPTOR firstDescriptor;
|
||||
ZeroMemory(&firstDescriptor, sizeof(firstDescriptor));
|
||||
|
||||
write_protected_process_memory(process, importDescriptors, &firstDescriptor, sizeof(firstDescriptor));
|
||||
|
||||
// Step 2: break the image data directory entry
|
||||
size_t ddOffset = ((char*)&(ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)) - exeHeader;
|
||||
DWORD newSize = 0;
|
||||
char* ddAddr = ((char*)&(ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)) - exeHeader + exe;
|
||||
|
||||
write_protected_process_memory(process, exe + ddOffset, &newSize, sizeof(newSize));
|
||||
// Save the original value
|
||||
rd.sizeFieldAddress = ddAddr;
|
||||
ReadProcessMemory(process, rd.sizeFieldAddress, &rd.sizeFieldData, sizeof(rd.sizeFieldData), &_);
|
||||
|
||||
// Set to 0
|
||||
DWORD newSize = 0;
|
||||
write_protected_process_memory(process, ddAddr, &newSize, sizeof(newSize));
|
||||
|
||||
// Write recovery data to the allocation
|
||||
WriteProcessMemory(process, remoteAlloc + payloadSize + dllPathSize, &rd, sizeof(rd), &_);
|
||||
}
|
||||
|
||||
@ -1,4 +1,4 @@
|
||||
project('jadeite', 'c', version: '1.1.7')
|
||||
project('jadeite', 'c', version: '1.1.13')
|
||||
|
||||
nasm = find_program('nasm')
|
||||
gen_res = find_program('gen_resources.sh')
|
||||
|
||||
@ -1,6 +1,6 @@
|
||||
{
|
||||
"jadeite": {
|
||||
"version": "1.1.7"
|
||||
"version": "1.1.13"
|
||||
},
|
||||
"games": {
|
||||
"hi3rd": {
|
||||
@ -11,12 +11,12 @@
|
||||
},
|
||||
"hsr": {
|
||||
"global": {
|
||||
"status": "unsafe",
|
||||
"version": "1.1.0"
|
||||
"status": "verified",
|
||||
"version": "1.2.0"
|
||||
},
|
||||
"china": {
|
||||
"status": "unsafe",
|
||||
"version": "1.1.0"
|
||||
"status": "verified",
|
||||
"version": "1.2.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user