1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
|
#include <stdio.h>
#include <stdint.h>
#include <string.h>
//#pragma warning( push )
//#pragma warning( disable : 4668)
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <psapi.h>
//#pragma warning( pop )
static void* faddrs[6];
char fnames[] = "DirectInput8Create\0" "DllCanUnloadNow\0" "DllGetClassObject\0" \
"DllRegisterServer\0" "DllUnregisterServer\0" "GetdfDIJoystick\0" "\3";
/*[[nodiscard]]*/ size_t next_name(char *names[])
{
size_t len = 0;
while(names != NULL) {
if(**names == '\0') { (*names)++; break; }
else if(**names == '\3') break;
(*names)++; len++;
}
return len;
}
HMODULE init_faddrs(void)
{
HMODULE h = LoadLibrary("C:\\Windows\\SysWOW64\\dinput8.dll"); // perhaps i should ship my own original dinput8.dll and proxy from a renamed copy but uhhhh no
if (h == NULL) goto init_end;
char* fname = fnames;
size_t i = 0;
do {
faddrs[i] = (void*)GetProcAddress(h, fname);
i++;
} while(next_name(&fname));
init_end:
return h;
}
HMODULE hodll = NULL;
/*void* sigscan(const char* pattern, const char* mask)
{
HMODULE module = GetModuleHandle(NULL);
if(module == NULL) return NULL;
MODULEINFO minfo;
if(GetModuleInformation(GetCurrentProcess(), module, &minfo, sizeof(minfo)) == 0) return NULL;
size_t len = strlen(mask);
unsigned char* addr = (unsigned char*)minfo.lpBaseOfDll;
for(DWORD i = 0; i < minfo.SizeOfImage - (len-1); i++)
{
for(size_t j = 0; j < len; j++)
{
if(addr[i + j] == (unsigned char)(pattern[j]) && (unsigned char)(mask[j]) != '?')
{
if(j == (len-1))
return (void*)(addr + i);
}
else
break;
}
}
return NULL;
}*/
/*
void* GetStackBaseFromTEB(void)
{
#if defined(_WIN64)
return (void*)__readgsqword(0x08);
#elif defined(_WIN32)
return (void*)__readfsdword(0x04);
#endif
}
*/
void* GetEntryPointOfHostProcess(void)
{
HMODULE module = GetModuleHandle(NULL);
if(module == NULL) return NULL;
MODULEINFO minfo;
if(GetModuleInformation(GetCurrentProcess(), module, &minfo, sizeof(minfo)) == 0) return NULL;
return minfo.EntryPoint;
}
void* PD2_EBP = NULL;
uint8_t writeback[5] = { 0 };
void* retaddr = NULL;
#pragma pack(push, 4)
typedef struct _Patch {
uint8_t* writeback;
uint8_t NOPs; // to keep alignment, unsure if actually needed but would be nice if the debugger suddenly didn't re-disassemble everything incorrectly after the patch
void* addr;
void (*func)(void);
} Patch;
#pragma pack(pop)
void PatchCALL(Patch* patch, BOOL UnVProtect)
{
if(UnVProtect) {
DWORD _;
if(VirtualProtect(patch->addr, 5 + patch->NOPs, PAGE_EXECUTE_READWRITE, &_) == 0) {
char err[64] = { '\0' };
snprintf(err, 64, "%lu", GetLastError());
MessageBox(GetCurrentProcess(), err, NULL, MB_OK);
return;
}
}
}
void PatchGame(void* addr, void (*func)(void))
{
DWORD _;
if(VirtualProtect(addr, 5, PAGE_EXECUTE_READWRITE, &_) == 0)
{
char err[64] = { '\0' };
snprintf(err, 64, "%lu", GetLastError());
MessageBox(GetCurrentProcess(), err, NULL, MB_OK);
return;
}
uint8_t oinst[5] = { 0 };
memcpy_s(oinst, sizeof(*oinst) * 5, addr, 5);
uint8_t patched[5] = { 0xE9, 0x00, 0x00, 0x00, 0x00 };
((int32_t*)(patched + 1))[0] = (uintptr_t)func - ((uintptr_t)addr + 1 + sizeof(uintptr_t)); // math assumes patching over a jmp or call, not that it really matters
memcpy_s(addr, 5, patched, 5);
memcpy_s(writeback, 5, oinst, 5); // magic global that hopefully works
}
void __declspec(naked) GetEBPWithinGame(void)
{
__asm {
pushad
}
__asm {
mov PD2_EBP, ebp
}
memcpy_s(retaddr, 5, writeback, 5);
__asm {
popad
push retaddr
ret
}
}
BOOL WINAPI DllMain(/*[[maybe_unused]]*/ HINSTANCE h_dll, DWORD fwdReason, LPVOID lpvReserved)
{
switch(fwdReason)
{
case DLL_PROCESS_ATTACH:
hodll = init_faddrs();
if(hodll == NULL) return FALSE;
retaddr = GetEntryPointOfHostProcess();
PatchGame(retaddr, &GetEBPWithinGame);
break;
case DLL_THREAD_ATTACH:
// [[fallthrough]];
case DLL_THREAD_DETACH:
break;
case DLL_PROCESS_DETACH:
if(lpvReserved != NULL) break;
if(hodll != NULL) FreeLibrary(hodll);
break;
}
return TRUE;
}
|
