More anticheat detections

This commit is contained in:
momo5502 2016-08-07 21:46:30 +02:00
parent ad604de8b4
commit 9e9967b9d1
6 changed files with 92 additions and 13 deletions

View File

@ -2,7 +2,7 @@
namespace Components namespace Components
{ {
int AntiCheat::LastCheck; int AntiCheat::LastCheck = 0;
std::string AntiCheat::Hash; std::string AntiCheat::Hash;
Utils::Hook AntiCheat::LoadLibHook[4]; Utils::Hook AntiCheat::LoadLibHook[4];
@ -84,11 +84,38 @@ namespace Components
} }
} }
void AntiCheat::AssertLibraryCall(void* callee)
{
HMODULE hModuleSelf = nullptr;
GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, reinterpret_cast<char*>(AntiCheat::AssertLibraryCall), &hModuleSelf);
AntiCheat::AssertModuleCall(hModuleSelf, callee);
}
void AntiCheat::AssertProcessCall(void* callee)
{
AntiCheat::AssertModuleCall(GetModuleHandle(NULL), callee);
}
void AntiCheat::AssertModuleCall(HMODULE module, void* callee)
{
HMODULE hModuleTarget = nullptr;
GetModuleHandleExA(GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS, reinterpret_cast<char*>(callee), &hModuleTarget);
if (!module || !hModuleTarget || module != hModuleTarget)
{
//AntiCheat::CrashClient();
AntiCheat::Hash.append("\0", 1);
}
}
// This has to be called when doing .text changes during runtime // This has to be called when doing .text changes during runtime
void AntiCheat::EmptyHash() void AntiCheat::EmptyHash()
{ {
AntiCheat::LastCheck = 0; AntiCheat::LastCheck = 0;
AntiCheat::Hash.clear(); AntiCheat::Hash.clear();
AntiCheat::AssertLibraryCall(_ReturnAddress());
} }
void AntiCheat::InitLoadLibHook() void AntiCheat::InitLoadLibHook()
@ -115,6 +142,20 @@ namespace Components
//AntiCheat::LoadLibHook[3].Initialize(LoadLibraryExW, loadLibExStub, HOOK_JUMP); //AntiCheat::LoadLibHook[3].Initialize(LoadLibraryExW, loadLibExStub, HOOK_JUMP);
} }
void AntiCheat::IntegrityCheck()
{
int lastCheck = AntiCheat::LastCheck;
int milliseconds = Game::Sys_Milliseconds();
if (milliseconds < 1000 * 40) return;
// If there was no check within the last 90 seconds, crash!
if ((milliseconds - lastCheck) > 1000 * 90)
{
AntiCheat::CrashClient();
}
}
void AntiCheat::PerformCheck() void AntiCheat::PerformCheck()
{ {
// Hash .text segment // Hash .text segment
@ -196,7 +237,16 @@ namespace Components
AntiCheat::InstallLibHook(); AntiCheat::InstallLibHook();
} }
void AntiCheat::SoundInitStub() void AntiCheat::SoundInitStub(int a1, int a2, int a3)
{
AntiCheat::UninstallLibHook();
Game::SND_Init(a1, a2, a3);
AntiCheat::InstallLibHook();
}
void AntiCheat::SoundInitDriverStub()
{ {
AntiCheat::UninstallLibHook(); AntiCheat::UninstallLibHook();
@ -223,15 +273,23 @@ namespace Components
} }
} }
bool AntiCheat::EncodeInitStub(const char* param) void __declspec(naked) AntiCheat::AimTargetGetTagPosStub()
{ {
AntiCheat::UninstallLibHook(); __asm
{
pushad
push [esp + 20h]
bool result = Game::Encode_Init(param); call AntiCheat::AssertProcessCall
AntiCheat::InstallLibHook(); pop esi
popad
return result; sub esp, 14h
cmp dword ptr[esi + 0E0h], 1
push 56AC6Ah
ret
}
} }
AntiCheat::AntiCheat() AntiCheat::AntiCheat()
@ -246,12 +304,16 @@ namespace Components
#else #else
Utils::Hook(0x507BD5, AntiCheat::PatchWinAPI, HOOK_CALL).Install()->Quick(); Utils::Hook(0x507BD5, AntiCheat::PatchWinAPI, HOOK_CALL).Install()->Quick();
Utils::Hook(0x60BE8E, AntiCheat::SoundInitStub, HOOK_CALL).Install()->Quick();
Utils::Hook(0x418204, AntiCheat::SoundInitStub, HOOK_CALL).Install()->Quick();
Utils::Hook(0x51C76C, AntiCheat::CinematicStub, HOOK_CALL).Install()->Quick(); Utils::Hook(0x51C76C, AntiCheat::CinematicStub, HOOK_CALL).Install()->Quick();
Utils::Hook(0x4A22E5, AntiCheat::EncodeInitStub, HOOK_CALL).Install()->Quick(); Utils::Hook(0x418209, AntiCheat::SoundInitStub, HOOK_CALL).Install()->Quick();
Utils::Hook(0x60BE9D, AntiCheat::SoundInitStub, HOOK_CALL).Install()->Quick();
Utils::Hook(0x60BE8E, AntiCheat::SoundInitDriverStub, HOOK_CALL).Install()->Quick();
Utils::Hook(0x418204, AntiCheat::SoundInitDriverStub, HOOK_CALL).Install()->Quick();
QuickPatch::OnFrame(AntiCheat::Frame); QuickPatch::OnFrame(AntiCheat::Frame);
// Check AimTarget_GetTagPos
//Utils::Hook(0x56AC60, AntiCheat::AimTargetGetTagPosStub, HOOK_JUMP).Install()->Quick();
// TODO: Probably move that :P // TODO: Probably move that :P
AntiCheat::InitLoadLibHook(); AntiCheat::InitLoadLibHook();
#endif #endif

View File

@ -15,6 +15,8 @@ namespace Components
static void InitLoadLibHook(); static void InitLoadLibHook();
static void IntegrityCheck();
private: private:
static int LastCheck; static int LastCheck;
static std::string Hash; static std::string Hash;
@ -25,6 +27,10 @@ namespace Components
static void NullSub(); static void NullSub();
static void AssertLibraryCall(void* callee);
static void AssertProcessCall(void* callee);
static void AssertModuleCall(HMODULE module, void* callee);
static void UninstallLibHook(); static void UninstallLibHook();
static void InstallLibHook(); static void InstallLibHook();
@ -35,8 +41,10 @@ namespace Components
#endif #endif
static void CinematicStub(); static void CinematicStub();
static void SoundInitStub(); static void SoundInitStub(int a1, int a2, int a3);
static bool EncodeInitStub(const char* param); static void SoundInitDriverStub();
static void AimTargetGetTagPosStub();
static Utils::Hook LoadLibHook[4]; static Utils::Hook LoadLibHook[4];
}; };

View File

@ -69,7 +69,7 @@ namespace Components
CloseHandle(hFile); CloseHandle(hFile);
} }
Exception::UploadMinidump(filename); //Exception::UploadMinidump(filename);
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_STACK_OVERFLOW) if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_STACK_OVERFLOW)
{ {

View File

@ -174,6 +174,11 @@ namespace Components
Utils::Hook::Set<Game::XAssetEntry*>(0x5BAE91, Maps::EntryPool.data() + 1); Utils::Hook::Set<Game::XAssetEntry*>(0x5BAE91, Maps::EntryPool.data() + 1);
Utils::Hook::Set<Game::XAssetEntry*>(0x5BAEA2, Maps::EntryPool.data() + 1); Utils::Hook::Set<Game::XAssetEntry*>(0x5BAEA2, Maps::EntryPool.data() + 1);
// This is placed here in case the anticheat has been disabled!
#ifndef DEBUG
Renderer::OnFrame(AntiCheat::IntegrityCheck);
#endif
} }
Maps::Maps() Maps::Maps()

View File

@ -160,6 +160,7 @@ namespace Game
SL_ConvertToString_t SL_ConvertToString = (SL_ConvertToString_t)0x4EC1D0; SL_ConvertToString_t SL_ConvertToString = (SL_ConvertToString_t)0x4EC1D0;
SL_GetString_t SL_GetString = (SL_GetString_t)0x4CDC10; SL_GetString_t SL_GetString = (SL_GetString_t)0x4CDC10;
SND_Init_t SND_Init = (SND_Init_t)0x46A630;
SND_InitDriver_t SND_InitDriver = (SND_InitDriver_t)0x4F5090; SND_InitDriver_t SND_InitDriver = (SND_InitDriver_t)0x4F5090;
SockadrToNetadr_t SockadrToNetadr = (SockadrToNetadr_t)0x4F8460; SockadrToNetadr_t SockadrToNetadr = (SockadrToNetadr_t)0x4F8460;

View File

@ -368,6 +368,9 @@ namespace Game
typedef short(__cdecl * SL_GetString_t)(const char *str, unsigned int user); typedef short(__cdecl * SL_GetString_t)(const char *str, unsigned int user);
extern SL_GetString_t SL_GetString; extern SL_GetString_t SL_GetString;
typedef void(__cdecl * SND_Init_t)(int a1, int a2, int a3);
extern SND_Init_t SND_Init;
typedef void(__cdecl * SND_InitDriver_t)(); typedef void(__cdecl * SND_InitDriver_t)();
extern SND_InitDriver_t SND_InitDriver; extern SND_InitDriver_t SND_InitDriver;