v1.1.13

.gitignore

@@ -3,7 +3,7 @@
 .directory
 
 # File withheld to make abuse more difficult
-game_payload/src/tp6.c
+game_payload/src/core.c
 
 build
 out

README.md

@@ -1,6 +1,6 @@
 ### Games and regions
 - **3rd**: glb v6.7.0
-- **SR**: os/cn v1.1.0 (unsafe, refer to [configuration](#configuration)) 
+- **SR**: os/cn v1.2.0 (potentially unsafe, but no bans were reported since v1.1.0) 
 
 It may be possilbe to completely remove the region and version-specific data in the future. Refer to the source code in `game_payload/src` for details.
 
@@ -37,7 +37,6 @@ These environment variables can be used to configure the behaviour of the tool.
 - `WAIT_BEFORE_RESUME=1` - show a messagebox and wait for user input before resuming the game process. Useful on my side for debugging
 
 **SR-exclusive**:
-- `I_WANT_A_BAN=1` - allows to launch SR. Please only use testing accounts, as there is an extremely high risk of getting banned
 - `SRFIX_DISABLE=1` - disable shared resources fix. Not recommended. Doing so will most likely cause the game to not run at all
 
 ### Internals
@@ -45,7 +44,7 @@ This tool consists of three parts: the main injector (`injector/src/exe.c`), the
 
 I am very bad at explaining, so just take a look at the source code. Maybe I'll write a detailed explanation in the future.
 
-A part of the source code is witheld (`game_payload/src/tp6.c`). This is a forced measure to make abuse more difficult. However, a precompiled blob is provided in the repo. `build.sh` will use it automatically.
+A part of the source code is witheld (`game_payload/src/core.c`). This is a forced measure to make abuse more difficult. However, a precompiled blob is provided in the repo. `build.sh` will use it automatically.
 
 ### Guildelines
 1. **Please don't share this project in public.** This might attract unnecessary attention from either the Game Company or the Anticheat Company

game_payload/include/core.h

@@ -0,0 +1,7 @@
+#pragma once
+
+#include <windows.h>
+
+#include <game.h>
+
+void core_setup_patcher(struct game_data *game, HMODULE baseModule);

game_payload/include/tp6.h

@@ -1,7 +0,0 @@
-#pragma once
-
-#include <windows.h>
-
-#include <game.h>
-
-void tp6_setup_patcher(struct game_data *game, HMODULE baseModule);

game_payload/meson.build

@@ -38,32 +38,34 @@ res_object = custom_target(
     command: [ gen_res, '--object', meson.current_source_dir(), '@OUTPUT0@', '@INPUT@' ]
 )
 
-if fs.exists('src/tp6.c')
+if fs.exists('src/core.c')
     # Compile the real file first (dirty hack)
-    tp6c_fake_exe = executable(
-        'tp6c.o',
-        'src/tp6.c',
+    core_fake_exe = executable(
+        'core.o',
+        'src/core.c',
         res_header,
         link_args: [ '-r' ], # Output an object file
         include_directories: include_dir
     )
     
     # another dirty hack
-    copy_tp6c = find_program('copy_tp6c.sh')
+    copy_core = find_program('copy_core.sh')
 
-    tp6c = custom_target(
-        'copy_tp6c',
-        output: 'tp6c.o',
-        input: tp6c_fake_exe.extract_all_objects(recursive: false),
+    core_target = [custom_target(
+        'copy_core',
+        output: 'core.o',
+        input: core_fake_exe.extract_all_objects(recursive: false),
         command: [ 
-            copy_tp6c, 
+            copy_core, 
             '@INPUT0@',
-            '@OUTPUT0@', meson.current_source_dir() / 'blob/tp6c.o' 
+            '@OUTPUT0@', meson.current_source_dir() / 'blob/core.o' 
         ]
-    )
+    )]
+    core_blob = []
 else
-    message('Using precompiled tp6c blob. Refer to the readme for more details')
-    tp6c = 'blob/tp6c.o'
+    message('Using precompiled core blob. Refer to the readme for more details')
+    core_target = []
+    core_blob = [ 'blob/core.o' ]
 endif
 
 shared_library(
@@ -71,7 +73,8 @@ shared_library(
     sources,
     res_header,
     res_object,
-    objects: tp6c,
+    core_target,
+    objects: core_blob,
     include_directories: include_dir,
     name_prefix: ''
 )

game_payload/src/core.md

@@ -0,0 +1,14 @@
+### 1.0.0
+- First version
+
+### 1.1.0
+- HSR support
+
+### 1.1.9
+- Fixed a bug which could cause the game to crash in odd scenarios
+
+### 1.1.10
+- Fixed a subtle bug introduced in 1.1.9
+
+### 1.1.11
+- Fixed an additional issue introduced in 1.1.9

game_payload/src/hsr.c

@@ -17,14 +17,14 @@ struct crc_id_pair {
 const struct crc_id_pair HSR_REGIONS[] = {
     // It may be possible to get rid of region-specific data altogether in the future
 
-    { 0x2df53005, GAME_HSR_OS }, // os v1.1.0
-    { 0x3e644d26, GAME_HSR_CN }  // cn v1.1.0
+    { 0x9eb3084e, GAME_HSR_OS }, // os v1.2.0
+    { 0x14be07e9, GAME_HSR_CN }  // cn v1.2.0
 };
 
 #define JUMP_SIZE (6 + sizeof(void*))
 
 // Temporarily hardcoded offset
-// v1.1.0, same for os and cn
+// v1.2.0, same for os and cn
 #define WTSUD_PATCH_OFFSET 0x16430
 
 char wtsud_original_bytes[JUMP_SIZE];
@@ -71,12 +71,6 @@ static void _unityplayer_callback(HMODULE unityModule) {
 }
 
 void hsr_fill_data(struct game_data *buf) {
-    if (!utils_env_enabled("I_WANT_A_BAN")) {
-        msg_err_a("Using this tool with HSR is unsafe. Refer to the readme for more details: https://codeberg.org/mkrsym1/jadeite");
-    } else {
-        msg_warn_a("Using this tool with HSR will most likely result in a ban. Please only use testing accounts");
-    }
-
     uint32_t crc = utils_file_crc32c("UnityPlayer.dll");
     
     enum game_id id = GAME_INVALID;

game_payload/src/main.c

@@ -3,7 +3,7 @@
 #include <ntdll.h>
 #include <ace.h>
 #include <game.h>
-#include <tp6.h>
+#include <core.h>
 #include <utils.h>
 
 #include <main.h>
@@ -46,7 +46,7 @@ BOOL WINAPI DllMain(HINSTANCE instance, DWORD reason, LPVOID reserved) {
     ace_load_driver_module();
 
     // ...magic
-    tp6_setup_patcher(&game, baseModule);
+    core_setup_patcher(&game, baseModule);
 
     // Load the UnityPlayer module and invoke the callback
     HMODULE unityModule = LoadLibraryA("UnityPlayer.dll");

game_payload/src/tp6.md

@@ -1,5 +0,0 @@
-### 1.0.0
-- First version
-
-### 1.1.0
-- HSR support

injector/src/game_p.asm

@@ -1,5 +1,50 @@
 BITS 64
 
+; Macro definitions
+
+; read dst, pSrc, size
+%macro read 3
+
+    mov %1, [%2]
+    add %2, %3
+
+%endmacro
+
+; copy pDst, pSrc, temp, tempSize
+%macro copy 4
+
+    mov %3, [%2]
+    mov [%1], %3
+    add %1, %4
+    add %2, %4
+
+%endmacro
+
+; unprotect addr, size, fn
+%macro unprotect 3
+
+    mov rcx, %1
+    mov rdx, %2
+    mov r8, 40h  ; PAGE_EXECUTE_READWRITE
+    lea r9, [rel oldProtect]
+
+    call %3
+
+%endmacro
+
+; reprotect addr, size, fn
+%macro reprotect 3
+
+    mov rcx, %1
+    mov rdx, %2
+    lea r9, [rel oldProtect]
+    mov r8d, [r9]
+
+    call %3
+
+%endmacro
+
+
 main: ; Replacement entry point
     push rsi
     push rdi
@@ -16,6 +61,14 @@ main: ; Replacement entry point
     mov rdi, rax   ; *GetProcAddress
 
 
+    mov rcx, rsi          ; kernel32.dll
+    lea rdx, [rel s_VirtualProtect]
+    call rdi              ; rax = *VirtualProtect
+    
+    mov rcx, rax
+    call RecoverExecutable
+
+
     mov rcx, rsi          ; kernel32.dll
     lea rdx, [rel s_LoadLibraryW]
     call rdi              ; rax = *LoadLibraryW
@@ -63,10 +116,65 @@ main: ; Replacement entry point
     ret
 
 
+RecoverExecutable:  ; expects *VirtualProtect in rcx
+    push rbx
+    push r12
+    push r13
+    push r14
+    sub rsp, 8
+
+    mov r13, rcx
+
+    ; Find the recovery data structure
+    lea rbx, [rel dllPath]
+
+.search:
+    read ax, rbx, 2
+    test ax, ax
+    jnz .search
+
+    ; Recover entry point bytes (6 + 8 = 14 total)
+    read r12, rbx, 8  ; Address
+    mov r14, r12
+
+    unprotect r14, 14, r13
+    copy r12, rbx, rax, 8
+    copy r12, rbx, eax, 4
+    copy r12, rbx, ax,  2
+    reprotect r14, 14, r13
+
+    ; Recover import descriptor bytes (20 total)
+    read r12, rbx, 8
+    mov r14, r12
+
+    unprotect r14, 20, r13
+    copy r12, rbx, rax, 8
+    copy r12, rbx, rax, 8
+    copy r12, rbx, eax, 4
+    reprotect r14, 20, r13
+
+    ; Recover import data directory entry size bytes (4 total)
+    read r12, rbx, 8
+    mov r14, r12
+
+    unprotect r14, 4, r13
+    copy r12, rbx, eax, 4
+    reprotect r14, 4, r13
+
+    add rsp, 8
+    pop r14
+    pop r13
+    pop r12
+    pop rbx
+    ret
+
+
 %include "gpa.asm"
 
+oldProtect: dd 0
 
 ; Strings
+s_VirtualProtect:    db "VirtualProtect", 0
 s_LoadLibraryW:      db "LoadLibraryW", 0
 s_GetModuleHandleA:  db "GetModuleHandleA", 0
 s_GetCommandLineW:   db "GetCommandLineW", 0

injector/src/inject.c

@@ -1,5 +1,22 @@
 #include <inject.h>
 
+#define JUMP_SIZE (6 + sizeof(void*))
+
+// Original values to recover after the injection
+// Recovery is performed by the assembly payload
+#pragma pack(push, 1)
+struct recovery_data {
+    void *entryPointAddress;
+    char entryPointData[JUMP_SIZE];
+
+    void *importDescriptorAddress;
+    IMAGE_IMPORT_DESCRIPTOR importDescriptorData;
+
+    void *sizeFieldAddress;
+    DWORD sizeFieldData;
+};
+#pragma pack(pop)
+
 static inline void write_protected_process_memory(HANDLE process, void *address, const void *buf, size_t size) {
     DWORD oldProtect;
     VirtualProtectEx(process, address, size, PAGE_EXECUTE_READWRITE, &oldProtect);
@@ -13,13 +30,6 @@ static inline void write_protected_process_memory(HANDLE process, void *address,
 void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar_t *dllPath) {
     size_t _; // Contrary to the docs, {Write,Read}ProcessMemory likes to crash if the last arg is NULL
 
-    // Inject the loader into the module
-    size_t dllPathLen = (wcslen(dllPath) + 1) * sizeof(wchar_t);
-
-    char *remoteAlloc = VirtualAllocEx(process, NULL, payloadSize + dllPathLen, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
-    WriteProcessMemory(process, remoteAlloc, payload, payloadSize, &_);
-    WriteProcessMemory(process, remoteAlloc + payloadSize, dllPath, dllPathLen, &_);
-
     // Find the EXE header in the process
     char exeHeader[1024];
     IMAGE_DOS_HEADER *dosHeader = NULL;
@@ -64,25 +74,60 @@ void inject(HANDLE process, const void *payload, size_t payloadSize, const wchar
 
     char *exe = (char*)memoryInfo.BaseAddress;
 
+
+    // Inject the loader into the process
+    const unsigned char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
+   
+    size_t dllPathSize = (wcslen(dllPath) + 1) * sizeof(wchar_t);
+
+    size_t allocSize = payloadSize + dllPathSize + sizeof(struct recovery_data);
+    char *remoteAlloc = VirtualAllocEx(process, NULL, allocSize, MEM_COMMIT, PAGE_EXECUTE_READWRITE);
+
+    // Write the assembly payload and dll path
+    WriteProcessMemory(process, remoteAlloc, payload, payloadSize, &_);
+    WriteProcessMemory(process, remoteAlloc + payloadSize, dllPath, dllPathSize, &_);
+
+
+    // Modify the executable to run the assembly payload
+    // Recovery data structure
+    struct recovery_data rd;
+
     // Replace the entry point with a jump to the loader
     char *entryPoint = exe + ntHeaders->OptionalHeader.AddressOfEntryPoint;
 
-    const unsigned char JUMP_INST[] = { 0xFF, 0x25, 0x00, 0x00, 0x00, 0x00 };
+    // Save the original entry point address and bytes
+    rd.entryPointAddress = entryPoint;
+    ReadProcessMemory(process, rd.entryPointAddress, rd.entryPointData, sizeof(rd.entryPointData), &_);
 
+    // Replace the entry point with a jump to the assembly payload
     write_protected_process_memory(process, entryPoint, JUMP_INST, sizeof(JUMP_INST));
     write_protected_process_memory(process, entryPoint + sizeof(JUMP_INST), &remoteAlloc, sizeof(remoteAlloc));
 
+
     // Break the import table to prevent any dlls from being loaded
     // Step 1: break the first import descriptor
     char *importDescriptors = exe + ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].VirtualAddress;
+
+    // Save the original descriptor address and bytes
+    rd.importDescriptorAddress = importDescriptors;
+    ReadProcessMemory(process, rd.importDescriptorAddress, &rd.importDescriptorData, sizeof(rd.importDescriptorData), &_);
+
+    // Overwrite with zeroes    
     IMAGE_IMPORT_DESCRIPTOR firstDescriptor;
     ZeroMemory(&firstDescriptor, sizeof(firstDescriptor));
-
     write_protected_process_memory(process, importDescriptors, &firstDescriptor, sizeof(firstDescriptor));
 
     // Step 2: break the image data directory entry
-    size_t ddOffset = ((char*)&(ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)) - exeHeader;
-    DWORD newSize = 0;
+    char* ddAddr = ((char*)&(ntHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT].Size)) - exeHeader + exe;
+    
+    // Save the original value
+    rd.sizeFieldAddress = ddAddr;
+    ReadProcessMemory(process, rd.sizeFieldAddress, &rd.sizeFieldData, sizeof(rd.sizeFieldData), &_);
 
-    write_protected_process_memory(process, exe + ddOffset, &newSize, sizeof(newSize));
+    // Set to 0
+    DWORD newSize = 0;
+    write_protected_process_memory(process, ddAddr, &newSize, sizeof(newSize));
+
+    // Write recovery data to the allocation
+    WriteProcessMemory(process, remoteAlloc + payloadSize + dllPathSize, &rd, sizeof(rd), &_);
 }

meson.build

@@ -1,4 +1,4 @@
-project('jadeite', 'c', version: '1.1.8')
+project('jadeite', 'c', version: '1.1.13')
 
 nasm = find_program('nasm')
 gen_res = find_program('gen_resources.sh')

metadata.json

@@ -1,6 +1,6 @@
 {
     "jadeite": {
-        "version": "1.1.8"
+        "version": "1.1.13"
     },
     "games": {
         "hi3rd": {
@@ -11,12 +11,12 @@
         },
         "hsr": {
             "global": {
-                "status": "unsafe",
-                "version": "1.1.0"
+                "status": "verified",
+                "version": "1.2.0"
             },
             "china": {
-                "status": "unsafe",
-                "version": "1.1.0"
+                "status": "verified",
+                "version": "1.2.0"
             }
         }
     }