arxan class [skip ci]

This commit is contained in:
Skull Merlin 2022-03-18 02:58:43 +02:00
parent 34b2fcd4cc
commit a59bcbf442
2 changed files with 195 additions and 19 deletions

View File

@ -0,0 +1,164 @@
#include <std_include.hpp>
#include "loader/component_loader.hpp"
#include "scheduler.hpp"
#include "game/game.hpp"
#include <utils/hook.hpp>
namespace arxan
{
namespace
{
utils::hook::detour nt_close_hook;
utils::hook::detour nt_query_information_process_hook;
NTSTATUS WINAPI nt_query_information_process_stub(const HANDLE handle, const PROCESSINFOCLASS info_class,
const PVOID info,
const ULONG info_length, const PULONG ret_length)
{
auto* orig = static_cast<decltype(NtQueryInformationProcess)*>(nt_query_information_process_hook.
get_original());
const auto status = orig(handle, info_class, info, info_length, ret_length);
if (NT_SUCCESS(status))
{
if (info_class == ProcessBasicInformation)
{
static DWORD explorer_pid = 0;
if (!explorer_pid)
{
auto* const shell_window = GetShellWindow();
GetWindowThreadProcessId(shell_window, &explorer_pid);
}
static_cast<PPROCESS_BASIC_INFORMATION>(info)->Reserved3 = PVOID(DWORD64(explorer_pid));
}
else if (info_class == 30) // ProcessDebugObjectHandle
{
*static_cast<HANDLE*>(info) = nullptr;
return 0xC0000353;
}
else if (info_class == 7) // ProcessDebugPort
{
*static_cast<HANDLE*>(info) = nullptr;
}
else if (info_class == 31)
{
*static_cast<ULONG*>(info) = 1;
}
}
return status;
}
NTSTATUS NTAPI nt_close_stub(const HANDLE handle)
{
char info[16];
if (NtQueryObject(handle, OBJECT_INFORMATION_CLASS(4), &info, 2, nullptr) >= 0 && size_t(handle) != 0x12345)
{
auto* orig = static_cast<decltype(NtClose)*>(nt_close_hook.get_original());
return orig(handle);
}
return STATUS_INVALID_HANDLE;
}
LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info)
{
if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE)
{
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
void hide_being_debugged()
{
auto* const peb = PPEB(__readgsqword(0x60));
peb->BeingDebugged = false;
*reinterpret_cast<PDWORD>(LPSTR(peb) + 0xBC) &= ~0x70;
}
void remove_hardware_breakpoints()
{
CONTEXT context;
ZeroMemory(&context, sizeof(context));
context.ContextFlags = CONTEXT_DEBUG_REGISTERS;
auto* const thread = GetCurrentThread();
GetThreadContext(thread, &context);
context.Dr0 = 0;
context.Dr1 = 0;
context.Dr2 = 0;
context.Dr3 = 0;
context.Dr6 = 0;
context.Dr7 = 0;
SetThreadContext(thread, &context);
}
BOOL WINAPI set_thread_context_stub(const HANDLE thread, CONTEXT* context)
{
if (!game::environment::is_sp()
&& game::dwGetLogOnStatus() == game::DW_LIVE_CONNECTED
&& context->ContextFlags == CONTEXT_DEBUG_REGISTERS)
{
return TRUE;
}
return SetThreadContext(thread, context);
}
}
int just_return()
{
return 1;
}
class component final : public component_interface
{
public:
void* load_import(const std::string& library, const std::string& function) override
{
if (function == "SetThreadContext")
{
//return set_thread_context_stub;
}
if (function == "LoadStringA" || function == "LoadStringW")
{
return just_return;
}
return nullptr;
}
void post_load() override
{
hide_being_debugged();
scheduler::loop(hide_being_debugged, scheduler::pipeline::async);
const utils::nt::library ntdll("ntdll.dll");
nt_close_hook.create(ntdll.get_proc<void*>("NtClose"), nt_close_stub);
nt_query_information_process_hook.create(ntdll.get_proc<void*>("NtQueryInformationProcess"),
nt_query_information_process_stub);
AddVectoredExceptionHandler(1, exception_filter);
}
void post_unpack() override
{
// cba to implement sp, not sure if it's even needed
if (game::environment::is_sp()) return;
// some of arxan crashes
utils::hook::nop(0x14CDEFCAA, 6);
utils::hook::call(0x1405BCAD1, &just_return);
}
};
}
REGISTER_COMPONENT(arxan::component)

View File

@ -51,7 +51,7 @@ launcher::mode detect_mode_from_arguments()
}
FARPROC load_binary(const launcher::mode mode)
FARPROC load_binary(const launcher::mode mode, uint64_t* base_address)
{
loader loader;
utils::nt::library self;
@ -97,11 +97,11 @@ FARPROC load_binary(const launcher::mode mode)
if (!utils::io::read_file(binary, &data))
{
throw std::runtime_error(utils::string::va(
"Failed to read game binary (%s)!\nPlease copy the h1-mod.exe into your Call of Duty: Modern Warfare Remastered installation folder and run it from there.",
"Failed to read game binary (%s)!\nPlease copy the h1x.exe into your Call of Duty: Modern Warfare Remastered installation folder and run it from there.",
binary.data()));
}
return loader.load_library(binary);
return loader.load_library(binary, base_address);
}
void remove_crash_file()
@ -111,7 +111,7 @@ void remove_crash_file()
void enable_dpi_awareness()
{
const utils::nt::library user32{"user32.dll"};
const utils::nt::library user32{ "user32.dll" };
const auto set_dpi = user32
? user32.get_proc<BOOL(WINAPI*)(DPI_AWARENESS_CONTEXT)>("SetProcessDpiAwarenessContext")
: nullptr;
@ -149,14 +149,15 @@ void limit_parallel_dll_loading()
int main()
{
ShowWindow(GetConsoleWindow(), SW_HIDE);
FARPROC entry_point;
enable_dpi_awareness();
// This requires admin privilege, but I suppose many
// people will start with admin rights if it crashes.
limit_parallel_dll_loading();
srand(uint32_t(time(nullptr)));
remove_crash_file();
{
auto premature_shutdown = true;
@ -170,27 +171,38 @@ int main()
try
{
remove_crash_file();
if (!component_loader::post_start()) return 0;
if (!component_loader::post_start())
{
return 0;
}
auto mode = detect_mode_from_arguments();
if (mode == launcher::mode::none)
{
const launcher launcher;
mode = launcher.run();
if (mode == launcher::mode::none) return 0;
if (mode == launcher::mode::none)
{
return 0;
}
}
game::environment::set_mode(mode);
entry_point = load_binary(mode);
uint64_t base_address{};
entry_point = load_binary(mode, &base_address);
if (!entry_point)
{
throw std::runtime_error("Unable to load binary into memory");
}
if (!component_loader::post_load()) return 0;
game::base_address = base_address;
//verify_version();
if (!component_loader::post_load())
{
return 0;
}
premature_shutdown = false;
}