2022-05-21 06:04:08 -04:00
|
|
|
#include <std_include.hpp>
|
|
|
|
#include "loader/component_loader.hpp"
|
|
|
|
#include "scheduler.hpp"
|
|
|
|
|
|
|
|
#include <utils/hook.hpp>
|
|
|
|
|
|
|
|
namespace arxan
|
|
|
|
{
|
|
|
|
namespace
|
|
|
|
{
|
|
|
|
DWORD get_steam_pid()
|
|
|
|
{
|
2022-05-23 13:18:57 -04:00
|
|
|
static auto steam_pid = []
|
|
|
|
{
|
|
|
|
HKEY reg_key;
|
|
|
|
DWORD pid{};
|
2022-05-21 06:04:08 -04:00
|
|
|
|
2022-05-23 13:18:57 -04:00
|
|
|
if (RegOpenKeyExA(HKEY_CURRENT_USER, "Software\\Valve\\Steam\\ActiveProcess", 0, KEY_QUERY_VALUE,
|
|
|
|
®_key) != ERROR_SUCCESS)
|
|
|
|
return pid;
|
2022-05-21 06:04:08 -04:00
|
|
|
|
2022-05-23 13:18:57 -04:00
|
|
|
DWORD length = sizeof(pid);
|
|
|
|
RegQueryValueExA(reg_key, "pid", nullptr, nullptr, reinterpret_cast<BYTE*>(&pid), &length);
|
|
|
|
RegCloseKey(reg_key);
|
2022-05-21 06:04:08 -04:00
|
|
|
|
2022-05-23 13:18:57 -04:00
|
|
|
return pid;
|
2022-05-21 06:04:08 -04:00
|
|
|
}();
|
|
|
|
|
|
|
|
return steam_pid;
|
|
|
|
}
|
|
|
|
|
|
|
|
utils::hook::detour nt_close_hook;
|
|
|
|
utils::hook::detour nt_query_information_process_hook;
|
2022-05-22 09:46:30 -04:00
|
|
|
utils::hook::detour create_mutex_ex_a_hook;
|
|
|
|
|
2022-05-23 13:18:57 -04:00
|
|
|
HANDLE create_mutex_ex_a_stub(const LPSECURITY_ATTRIBUTES attributes, const LPCSTR name, const DWORD flags,
|
|
|
|
const DWORD access)
|
2022-05-22 09:46:30 -04:00
|
|
|
{
|
|
|
|
if (name == "$ IDA trusted_idbs"s || name == "$ IDA registry mutex $"s)
|
|
|
|
{
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
return create_mutex_ex_a_hook.invoke<HANDLE>(attributes, name, flags, access);
|
|
|
|
}
|
2022-05-21 06:04:08 -04:00
|
|
|
|
|
|
|
NTSTATUS WINAPI nt_query_information_process_stub(const HANDLE handle, const PROCESSINFOCLASS info_class,
|
2022-05-23 13:18:57 -04:00
|
|
|
const PVOID info,
|
|
|
|
const ULONG info_length, const PULONG ret_length)
|
2022-05-21 06:04:08 -04:00
|
|
|
{
|
|
|
|
auto* orig = static_cast<decltype(NtQueryInformationProcess)*>(nt_query_information_process_hook.
|
|
|
|
get_original());
|
|
|
|
const auto status = orig(handle, info_class, info, info_length, ret_length);
|
|
|
|
|
|
|
|
if (NT_SUCCESS(status))
|
|
|
|
{
|
|
|
|
if (info_class == ProcessBasicInformation)
|
|
|
|
{
|
|
|
|
static DWORD explorer_pid = 0;
|
|
|
|
if (!explorer_pid)
|
|
|
|
{
|
|
|
|
auto* const shell_window = GetShellWindow();
|
|
|
|
GetWindowThreadProcessId(shell_window, &explorer_pid);
|
|
|
|
}
|
|
|
|
|
|
|
|
static_cast<PPROCESS_BASIC_INFORMATION>(info)->Reserved3 = PVOID(DWORD64(get_steam_pid()));
|
|
|
|
}
|
|
|
|
else if (info_class == 30) // ProcessDebugObjectHandle
|
|
|
|
{
|
|
|
|
*static_cast<HANDLE*>(info) = nullptr;
|
|
|
|
|
|
|
|
return 0xC0000353;
|
|
|
|
}
|
|
|
|
else if (info_class == 7) // ProcessDebugPort
|
|
|
|
{
|
|
|
|
*static_cast<HANDLE*>(info) = nullptr;
|
|
|
|
}
|
|
|
|
else if (info_class == 31)
|
|
|
|
{
|
|
|
|
*static_cast<ULONG*>(info) = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI nt_close_stub(const HANDLE handle)
|
|
|
|
{
|
|
|
|
char info[16];
|
|
|
|
if (NtQueryObject(handle, OBJECT_INFORMATION_CLASS(4), &info, 2, nullptr) >= 0 && size_t(handle) != 0x12345)
|
|
|
|
{
|
|
|
|
auto* orig = static_cast<decltype(NtClose)*>(nt_close_hook.get_original());
|
|
|
|
return orig(handle);
|
|
|
|
}
|
|
|
|
|
|
|
|
return STATUS_INVALID_HANDLE;
|
|
|
|
}
|
|
|
|
|
|
|
|
LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info)
|
|
|
|
{
|
|
|
|
if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE)
|
|
|
|
{
|
|
|
|
return EXCEPTION_CONTINUE_EXECUTION;
|
|
|
|
}
|
|
|
|
|
|
|
|
return EXCEPTION_CONTINUE_SEARCH;
|
|
|
|
}
|
|
|
|
|
|
|
|
void hide_being_debugged()
|
|
|
|
{
|
|
|
|
auto* const peb = PPEB(__readgsqword(0x60));
|
|
|
|
peb->BeingDebugged = false;
|
|
|
|
*reinterpret_cast<PDWORD>(LPSTR(peb) + 0xBC) &= ~0x70;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
class component final : public component_interface
|
|
|
|
{
|
|
|
|
public:
|
|
|
|
void post_load() override
|
|
|
|
{
|
|
|
|
hide_being_debugged();
|
|
|
|
scheduler::loop(hide_being_debugged, scheduler::pipeline::async);
|
|
|
|
|
2022-05-22 09:46:30 -04:00
|
|
|
create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub);
|
|
|
|
|
2022-05-21 06:04:08 -04:00
|
|
|
const utils::nt::library ntdll("ntdll.dll");
|
|
|
|
nt_close_hook.create(ntdll.get_proc<void*>("NtClose"), nt_close_stub);
|
|
|
|
nt_query_information_process_hook.create(ntdll.get_proc<void*>("NtQueryInformationProcess"),
|
2022-05-23 13:18:57 -04:00
|
|
|
nt_query_information_process_stub);
|
2022-05-21 06:04:08 -04:00
|
|
|
|
|
|
|
AddVectoredExceptionHandler(1, exception_filter);
|
|
|
|
}
|
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
REGISTER_COMPONENT(arxan::component)
|