From eb99597d0aad701c02c714cab692f767244d7572 Mon Sep 17 00:00:00 2001 From: quaK <38787176+Joelrau@users.noreply.github.com> Date: Tue, 21 Feb 2023 23:41:40 +0200 Subject: [PATCH] precomputed integirty checks --- src/client/component/{ => arxan}/arxan.cpp | 48 +- src/client/component/arxan/integrity.hpp | 680 +++++++++++++++++++++ 2 files changed, 712 insertions(+), 16 deletions(-) rename src/client/component/{ => arxan}/arxan.cpp (91%) create mode 100644 src/client/component/arxan/integrity.hpp diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan/arxan.cpp similarity index 91% rename from src/client/component/arxan.cpp rename to src/client/component/arxan/arxan.cpp index fba98c34..db05f31a 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan/arxan.cpp @@ -3,12 +3,20 @@ #include "game/game.hpp" -#include "game_module.hpp" -#include "scheduler.hpp" +#include "component/game_module.hpp" +#include "component/scheduler.hpp" #include #include +#include "integrity.hpp" + +#define PRECOMPUTED_INTEGRITY_CHECKS + +#define ProcessDebugPort 7 +#define ProcessDebugObjectHandle 30 +#define ProcessDebugFlags 31 + namespace arxan { namespace @@ -16,10 +24,6 @@ namespace arxan utils::hook::detour nt_close_hook; utils::hook::detour nt_query_information_process_hook; -#define ProcessDebugPort 7 -#define ProcessDebugObjectHandle 30 // WinXP source says 31? -#define ProcessDebugFlags 31 // WinXP source says 32? - HANDLE process_id_to_handle(const DWORD pid) { return reinterpret_cast(static_cast(pid)); @@ -29,8 +33,7 @@ namespace arxan const PVOID info, const ULONG info_length, const PULONG ret_length) { - auto* orig = static_cast(nt_query_information_process_hook. - get_original()); + auto* orig = static_cast(nt_query_information_process_hook.get_original()); const auto status = orig(handle, info_class, info, info_length, ret_length); if (NT_SUCCESS(status)) @@ -176,6 +179,7 @@ namespace arxan uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, const uint32_t current_checksum) { + [[maybe_unused]]const auto handler_address = return_address - 5; const auto* context = search_handler_context(stack_frame, current_checksum); if (!context) @@ -189,8 +193,7 @@ namespace arxan if (current_checksum != correct_checksum) { -#ifdef _DEBUG - const auto handler_address = return_address - 5; +#ifdef DEV_BUILD OutputDebugStringA(utils::string::va("Adjusting checksum (%llX): %X -> %X", handler_address, current_checksum, correct_checksum)); #endif @@ -296,29 +299,42 @@ namespace arxan utils::hook::call(game_address, stub); } +#ifdef PRECOMPUTED_INTEGRITY_CHECKS + void search_and_patch_integrity_checks_precomputed() + { + for (const auto i : intact_integrity_check_blocks) + { + patch_intact_basic_block_integrity_check(reinterpret_cast(i)); + } + + for (const auto i : split_integrity_check_blocks) + { + patch_split_basic_block_integrity_check(reinterpret_cast(i)); + } + } +#endif + void search_and_patch_integrity_checks() { +#ifdef PRECOMPUTED_INTEGRITY_CHECKS + search_and_patch_integrity_checks_precomputed(); +#else // There seem to be 670 results. // Searching them is quite slow. // Maybe precomputing that might be better? const auto intact_results = "89 04 8A 83 45 ? FF"_sig; const auto split_results = "89 04 8A E9"_sig; - int results = 0; - for (auto* i : intact_results) { patch_intact_basic_block_integrity_check(i); - results++; } for (auto* i : split_results) { patch_split_basic_block_integrity_check(i); - results++; } - - OutputDebugStringA(utils::string::va("integrity check amount: %d\n", results)); +#endif } } diff --git a/src/client/component/arxan/integrity.hpp b/src/client/component/arxan/integrity.hpp new file mode 100644 index 00000000..35176fdf --- /dev/null +++ b/src/client/component/arxan/integrity.hpp @@ -0,0 +1,680 @@ +#pragma once + +#include + +constexpr uint64_t intact_integrity_check_blocks[] = +{ + 0x1405513CA, + 0x140CF618F, + 0x140F17D3D, + 0x141264752, + 0x141268472, + 0x141293C98, + 0x1413A5CCD, + 0x141401C92, + 0x14B2B5D4C, + 0x14B2BB94B, + 0x14B2C1CDA, + 0x14B2C354D, + 0x14B2C59A8, + 0x14B2C6B9A, + 0x14B2C79AC, + 0x14B2CA156, + 0x14B2D09BA, + 0x14B2DA07D, + 0x14B2DCE29, + 0x14B2E093D, + 0x14B2E60C6, + 0x14B2E73F7, + 0x14B2EB04C, + 0x14B2ED7A1, + 0x14B2F066C, + 0x14B2F4C60, + 0x14B2F52B0, + 0x14B2F7B07, + 0x14B2FB430, + 0x14B2FE149, + 0x14B301C60, + 0x14B306D2A, + 0x14B34EAFF, + 0x14B34EF91, + 0x14B35E81C, + 0x14B365FE6, + 0x14B368633, + 0x14B36CD45, + 0x14B36E829, + 0x14B3709FC, + 0x14B372CB3, + 0x14B37CA76, + 0x14B39C9E9, + 0x14B39F39F, + 0x14B3A12C5, + 0x14B3A937F, + 0x14B3ADF24, + 0x14B3AECCE, + 0x14B3BA7EB, + 0x14B3BAC96, + 0x14B3BCF21, + 0x14B3BF232, + 0x14B3C06BA, + 0x14B3C0711, + 0x14B3E626B, + 0x14B3E686A, + 0x14B3E8971, + 0x14B3E9204, + 0x14B3E997D, + 0x14B3F3073, + 0x14B3F31A7, + 0x14B3F8A94, + 0x14B400A04, + 0x14B400B37, + 0x14B401901, + 0x14B403190, + 0x14B407B39, + 0x14B41020D, + 0x14B410779, + 0x14B4131B2, + 0x14B41DE34, + 0x14B423DD9, + 0x14B42502A, + 0x14B4263C0, + 0x14B4266A9, + 0x14B42707C, + 0x14B427B77, + 0x14B42B590, + 0x14B42C318, + 0x14B42DF7C, + 0x14B42E2B8, + 0x14B42FBE4, + 0x14B4317FF, + 0x14B432644, + 0x14B433A37, + 0x14B4395D1, + 0x14B43BEB8, + 0x14B43D812, + 0x14B447F50, + 0x14B4483D7, + 0x14B449E6A, + 0x14B44AD16, + 0x14B44C068, + 0x14B44C1EC, + 0x14B452CCB, + 0x14B454632, + 0x14B457E8C, + 0x14B45D032, + 0x14B461829, + 0x14B46D912, + 0x14B46E728, + 0x14B477A70, + 0x14B4786A2, + 0x14B47E1CE, + 0x14B485458, + 0x14B48E34D, + 0x14B4931E7, + 0x14B49346C, + 0x14B494E73, + 0x14B49796F, + 0x14B4A0B4B, + 0x14B4A494F, + 0x14B4AB536, + 0x14B4B9D23, + 0x14B4BA83C, + 0x14B4BD494, + 0x14B4CCF0A, + 0x14B4CF62A, + 0x14B4D0F15, + 0x14B4D1608, + 0x14B4D1E39, + 0x14B4D69E7, + 0x14B4D8EAD, + 0x14B52D094, + 0x14B52E6E1, + 0x14B52EE53, + 0x14B5352A6, + 0x14B542FAB, + 0x14B54503B, + 0x14B545DF0, + 0x14B545F65, + 0x14B552EE8, + 0x14B553AA8, + 0x14B5550E4, + 0x14B568DF8, + 0x14B57CA07, + 0x14B5801EB, + 0x14B583C85, + 0x14B5887C5, + 0x14B593270, + 0x14B59A75E, + 0x14B59FD10, + 0x14B5A4139, + 0x14B5B8C49, + 0x14B5BB8A7, + 0x14B5BE4E4, + 0x14B5C0046, + 0x14B5C023E, + 0x14B5C2748, + 0x14B5C99E5, + 0x14B61C0B9, + 0x14B62153F, + 0x14B624498, + 0x14B629AE0, + 0x14B64A453, + 0x14B64E311, + 0x14B651C9E, + 0x14B654AC6, + 0x14B656F32, + 0x14B65A14A, + 0x14B65A8A8, + 0x14B65EF32, + 0x14B6615EB, + 0x14B662B6C, + 0x14B668212, + 0x14B670FC0, + 0x14B677D66, + 0x14B67B7CD, + 0x14B680B1A, + 0x14B685CAD, + 0x14B68792E, + 0x14B6882D1, + 0x14B68A1BC, + 0x14B6915FE, + 0x14B6DD849, + 0x14B737C7C, + 0x14B739774, + 0x14B73A2FE, + 0x14B73DB3C, + 0x14B745C2A, + 0x14B746D6C, + 0x14B74780E, + 0x14B747AE7, + 0x14B74A87C, + 0x14B754174, + 0x14B75C1EE, + 0x14B75D577, + 0x14B764693, + 0x14B769CD8, + 0x14B76A3F6, + 0x14B771E7A, + 0x14B777373, + 0x14B77902F, + 0x14B77A98C, + 0x14B782E2A, + 0x14B796BD7, + 0x14B79AB7D, + 0x14B79FBA5, + 0x14B7A08C2, + 0x14B7A0B65, + 0x14B7A14EE, + 0x14B7A9132, + 0x14B7B64EC, + 0x14B7BB12D, + 0x14B7CA7FB, + 0x14B7CABC4, + 0x14B7D4E4D, + 0x14B7E46AC, + 0x14B7EA91C, + 0x14B7F1E3F, + 0x14B7F42E0, + 0x14B7F5DC8, + 0x14B7F88D6, + 0x14B80219B, + 0x14B80C9B0, + 0x14B80E9E2, + 0x14B81047C, + 0x14B8125A0, + 0x14B816D87, + 0x14B81B0A6, + 0x14B8256F5, + 0x14B82692A, + 0x14B82A39F, + 0x14B8702B8, + 0x14B872364, + 0x14B876400, + 0x14B8E53F0, + 0x14B8EED57, + 0x14B8F3DCE, + 0x14B8F5558, + 0x14B9002E1, + 0x14B9064E3, + 0x14B959C3D, + 0x14B95F229, + 0x14B9B4975, + 0x14B9D0C53, + 0x14B9D1DBF, + 0x14B9D4B3D, + 0x14B9E8970, + 0x14B9E98BD, + 0x14B9F34A5, + 0x14B9F74E9, + 0x14B9F9E0E, + 0x14B9FB1DD, + 0x14BA0295D, + 0x14BA0D9EC, + 0x14BA117A8, + 0x14BA1689D, + 0x14BA17CCF, + 0x14BA1905B, + 0x14BA197AE, + 0x14BA1AF96, + 0x14BA1E69C, + 0x14BA22B1A, + 0x14BA26ED0, + 0x14BA28CB9, + 0x14BA32405, + 0x14BA3816F, + 0x14BA3A6EF, + 0x14BA3E050, + 0x14BA41194, + 0x14BA4E533, + 0x14BA50A19, + 0x14BA563AB, + 0x14BA59D77, + 0x14BA5CE20, + 0x14BA5F4E4, + 0x14BA65528, + 0x14BA6C847, + 0x14BA7FBAC, + 0x14BA834D2, + 0x14BA8554F, + 0x14BA90B91, + 0x14BA9352E, + 0x14BA9528A, + 0x14BA9C8D0, + 0x14BA9F445, + 0x14BAA1D17, + 0x14BAA3ABA, + 0x14BAA61E1, + 0x14BAA9F0A, + 0x14BAAFCC6, + 0x14BAB1443, + 0x14BAB2AAA, + 0x14BAB3565, + 0x14BAC7D99, + 0x14BAC909F, + 0x14BACB9AE, + 0x14BAD0818, + 0x14BAD9B08, + 0x14BADA8EC, + 0x14BAEA4A7, + 0x14BAF1627, + 0x14BAF49EF, + 0x14BAF4EF1, + 0x14BAF963C, + 0x14BB04995, + 0x14BB0B169, + 0x14BB0C9A8, + 0x14BB0CF9C, + 0x14BB14F27, + 0x14BB1B0A5, + 0x14BB1E110, + 0x14BB1EFCA, + 0x14BB1FB5C, + 0x14BB20224, + 0x14BB3DA05, + 0x14BB43A6D, + 0x14BB4F2E8, + 0x14BB4F8B8, + 0x14BB54279, + 0x14BB54306, + 0x14BB6425A, + 0x14BB6614B, + 0x14BB68416, + 0x14BB6FE20, + 0x14BB71D2B, + 0x14BB7889D, + 0x14BB7A513, + 0x14BB83496, + 0x14BB857D9, + 0x14BB85C89, + 0x14BC087E5, + 0x14BC0A365, + 0x14BC0D8B6, + 0x14BC1443D, + 0x14BC14D50, + 0x14BC1D85D, + 0x14BC306B9, + 0x14BC30722, + 0x14BC460A8, + 0x14BC4BCD8, + 0x14BC5420A, + 0x14BC54EC3, + 0x14BC56D19, + 0x14BC57951, + 0x14BC587D7, + 0x14BC58D18, + 0x14BC5CA1B, + 0x14BCC09A5, + 0x14BCC0E54, + 0x14BCC3735, + 0x14BCC404C, + 0x14BCCAB24, + 0x14BCCBBF8, + 0x14BCCC864, + 0x14BCDA5EE, + 0x14BCE2BFE, + 0x14BCE47C3, + 0x14BCE96BB, + 0x14BCE9A1D, + 0x14BCF3F0C, + 0x14BCFD98E, + 0x14BD0097E, + 0x14BD07EEE, + 0x14BD09474, + 0x14BD0C24D, + 0x14BD0FAC2, + 0x14BD70956, + 0x14BDB2895, + 0x14BDB68A8, + 0x14BDBAB93, + 0x14BDBD1AF, + 0x14BDBDD09, + 0x14BDCCEC0, + 0x14BDD25D7, + 0x14BDD6873, + 0x14BDDC942, + 0x14BDE0654, + 0x14BDE4C6D, + 0x14BDEAC1E, + 0x14BDF7AF5, + 0x14BDFD390, + 0x14BDFDEC5, + 0x14BE00E14, + 0x14BE0B8BE, + 0x14BE27A98, + 0x14BE344BE, + 0x14BE5381E, + 0x14BE5A805, + 0x14BE5C080, + 0x14BE5EA6D, + 0x14BE60430, + 0x14BE63B34, + 0x14BE6A0BB, + 0x14BE6E01E, + 0x14BE7227A, + 0x14BE7A3B6, + 0x14BE7C786, + 0x14BE91677, + 0x14BE97C35, + 0x14BE9E57C, + 0x14BEA29D0, + 0x14BEADB62, + 0x14BEB6B5E, + 0x14BEC3304, + 0x14BEC5CD6, + 0x14BEC9714, + 0x14BECA1B8, + 0x14BECAEFF, + 0x14BECB924, + 0x14BECCEE1, + 0x14BECE414, + 0x14BECE570, + 0x14BED21BD, + 0x14BED676E, + 0x14BED7004, + 0x14BED83FA, + 0x14BEE14EE, + 0x14BEE9F1E, + 0x14BEEC6C1, + 0x14BEF50B0, + 0x14BEF53A9, + 0x14BEF9E3B, + 0x14BEFAB7E, + 0x14BEFDBD2, + 0x14BEFED27, + 0x14BF03CC4, + 0x14BF0BFE9, + 0x14BF12851, + 0x14BF15D29, + 0x14BF17039, + 0x14BF22E3F, + 0x14BF34A65, + 0x14BF35C80, + 0x14BF45E47, + 0x14BF4631B, + 0x14BF47DCF, + 0x14BF4EF06, + 0x14BF57A0C, + 0x14BF58BE2, + 0x14BF5D8C9, + 0x14BF6BFD2, + 0x14BF6C969, + 0x14BF6D427, + 0x14BF72629, + 0x14BF72C77, + 0x14BF79516, + 0x14BF7A2CB, + 0x14BF7E23D, + 0x14BF7F75B, + 0x14BF82E3D, + 0x14BF8414D, + 0x14BF8EDC3, + 0x14BF94FF6, + 0x14BF97763, + 0x14BF9E515, + 0x14BFA42BA, + 0x14BFA7857, + 0x14BFB2EA3, + 0x14BFBCBBE, + 0x14BFC7FF3, + 0x14BFCB8BB, + 0x14BFD46C6, + 0x14BFD4BBE, + 0x14BFE0104, + 0x14BFE3682, + 0x14C016217, + 0x14C017169, + 0x14C019255, + 0x14C01C246, + 0x14C01E682, + 0x14C069217, + 0x14C06DCB8, + 0x14C06F77E, + 0x14C08604D, + 0x14C0883B7, + 0x14C08E55C, + 0x14C090D1B, + 0x14C0A4EB1, + 0x14C0AE975, + 0x14C0B9DEA, + 0x14C0BD8E2, + 0x14C0BE011, + 0x14C0BEB0F, + 0x14C0C1857, + 0x14C0C318B, + 0x14C0CD46B, + 0x14C0ED485, + 0x14C0F5A83, + 0x14C0F94E8, + 0x14C0FADF7, + 0x14C16F1A9, + 0x14C171949, + 0x14C175458, + 0x14C177E58, + 0x14C17AE62, + 0x14C182A62, + 0x14C182C94, + 0x14C1855E9, + 0x14C185D82, + 0x14C18D6CC, + 0x14C1D55C1, + 0x14C1E4BAD, + 0x14C1E4C0C, + 0x14C1EDEAE, + 0x14C1EF2CC, + 0x14C1F2B67, + 0x14C1FC041, + 0x14C1FD82E, + 0x14C1FFBF9, + 0x14C200ABE, + 0x14C20604D, + 0x14C20AEF1, + 0x14C20D60E, + 0x14C20F17D, + 0x14C2126BD, + 0x14C21523A, + 0x14C223F6B, + 0x14C22A3A3, + 0x14C22E75C, + 0x14C22E83D, + 0x14C23204E, + 0x14C234907, + 0x14C24266E, + 0x14C244D51, + 0x14C256DA7, + 0x14C256F88, + 0x14C26388B, + 0x14C26945E, + 0x14C26AB3F, + 0x14C26E6FC, + 0x14C273D82, + 0x14C274BDB, + 0x14C274ECA, + 0x14C27558D, + 0x14C27659A, + 0x14C278748, +}; +constexpr uint64_t split_integrity_check_blocks[] = +{ + 0x1412878D4, + 0x14B2C17D9, + 0x14B2CE0AE, + 0x14B2CF464, + 0x14B2D4817, + 0x14B2EE86A, + 0x14B2F555B, + 0x14B3862EF, + 0x14B3879B6, + 0x14B3A00AF, + 0x14B3A3C3C, + 0x14B3A54BA, + 0x14B3A628E, + 0x14B3A714A, + 0x14B3DB71C, + 0x14B3E3173, + 0x14B41CDC5, + 0x14B45BA58, + 0x14B46C0B8, + 0x14B47A8F4, + 0x14B47C03C, + 0x14B48AB44, + 0x14B49FA2C, + 0x14B4B404A, + 0x14B4C4702, + 0x14B4D0C5B, + 0x14B5246D1, + 0x14B52F94F, + 0x14B58111E, + 0x14B599C89, + 0x14B63E876, + 0x14B63F3CF, + 0x14B6445CE, + 0x14B654062, + 0x14B65A74F, + 0x14B663424, + 0x14B66CC27, + 0x14B676FD4, + 0x14B679802, + 0x14B67CBAB, + 0x14B680E68, + 0x14B68D922, + 0x14B766388, + 0x14B771220, + 0x14B7741FB, + 0x14B7748B5, + 0x14B78764E, + 0x14B7C157D, + 0x14B7C7E84, + 0x14B7DC8AB, + 0x14B7FD70D, + 0x14B80B5C8, + 0x14B81CC2B, + 0x14B81E060, + 0x14B873A62, + 0x14B88933B, + 0x14B88CEA5, + 0x14B88CF3D, + 0x14B909643, + 0x14B960366, + 0x14B9B4D91, + 0x14B9C9155, + 0x14B9E0BA5, + 0x14BA1C4C4, + 0x14BA20E57, + 0x14BA2BA1C, + 0x14BA47A4F, + 0x14BA4BADD, + 0x14BA501D1, + 0x14BA50796, + 0x14BA51B18, + 0x14BA87AF4, + 0x14BAA513B, + 0x14BAB4C7B, + 0x14BADF68E, + 0x14BAEB4E9, + 0x14BAF0596, + 0x14BAFA3B7, + 0x14BB0C13B, + 0x14BB32B54, + 0x14BB369CC, + 0x14BB4BBE7, + 0x14BB54DFC, + 0x14BB74503, + 0x14BB7654E, + 0x14BC16394, + 0x14BC4D609, + 0x14BC59D36, + 0x14BC65AA9, + 0x14BC676DC, + 0x14BCB74F8, + 0x14BCDEEAB, + 0x14BCEF0DB, + 0x14BCFE978, + 0x14BD0B53E, + 0x14BDD4A1A, + 0x14BE279DA, + 0x14BE64CC9, + 0x14BE652D5, + 0x14BE65680, + 0x14BE66C17, + 0x14BEA5E67, + 0x14BEADAA5, + 0x14BEB51F5, + 0x14BEB5CCB, + 0x14BEC96D1, + 0x14BED8AA6, + 0x14BEDAA76, + 0x14BEE90A2, + 0x14BF00E50, + 0x14BF1C4A2, + 0x14BF23F04, + 0x14BF26212, + 0x14BF2AF73, + 0x14BF698CC, + 0x14BF9E0A1, + 0x14BFA1E57, + 0x14BFB5614, + 0x14BFCA31D, + 0x14C01642A, + 0x14C017071, + 0x14C01DFF4, + 0x14C066852, + 0x14C0761CB, + 0x14C0AA756, + 0x14C0CF3E1, + 0x14C0D194A, + 0x14C0E327E, + 0x14C0EFB1E, + 0x14C0FCBD5, + 0x14C0FF175, + 0x14C11148B, + 0x14C17E415, + 0x14C183DF2, + 0x14C1D4BD2, + 0x14C1D64A1, + 0x14C1DDC1B, + 0x14C1F22AD, + 0x14C200E2C, + 0x14C20C6C7, + 0x14C232A55, + 0x14C238BED, +}; \ No newline at end of file