2022-05-21 06:04:08 -04:00
|
|
|
#include <std_include.hpp>
|
|
|
|
#include "loader/component_loader.hpp"
|
|
|
|
#include "scheduler.hpp"
|
|
|
|
|
2022-05-24 14:56:15 -04:00
|
|
|
#include "steam/steam.hpp"
|
2022-05-21 06:04:08 -04:00
|
|
|
#include <utils/hook.hpp>
|
|
|
|
|
2022-05-28 13:13:44 -04:00
|
|
|
#include "utils/string.hpp"
|
|
|
|
|
2022-05-26 04:20:41 -04:00
|
|
|
#define ProcessDebugPort 7
|
|
|
|
#define ProcessDebugObjectHandle 30 // WinXP source says 31?
|
|
|
|
#define ProcessDebugFlags 31 // WinXP source says 32?
|
|
|
|
|
2022-05-21 06:04:08 -04:00
|
|
|
namespace arxan
|
|
|
|
{
|
|
|
|
namespace
|
|
|
|
{
|
2022-05-27 13:08:39 -04:00
|
|
|
constexpr auto pseudo_steam_id = 0x1337;
|
2022-05-26 04:50:04 -04:00
|
|
|
const auto pseudo_steam_handle = reinterpret_cast<HANDLE>(reinterpret_cast<uint64_t>(INVALID_HANDLE_VALUE) -
|
|
|
|
pseudo_steam_id);
|
2022-05-24 14:56:15 -04:00
|
|
|
|
2022-05-26 04:20:41 -04:00
|
|
|
utils::hook::detour nt_close_hook;
|
|
|
|
utils::hook::detour nt_query_system_information_hook;
|
|
|
|
utils::hook::detour nt_query_information_process_hook;
|
|
|
|
utils::hook::detour create_mutex_ex_a_hook;
|
|
|
|
utils::hook::detour open_process_hook;
|
2022-05-24 14:56:15 -04:00
|
|
|
|
2022-05-26 04:20:41 -04:00
|
|
|
HANDLE process_id_to_handle(const DWORD pid)
|
2022-05-24 14:56:15 -04:00
|
|
|
{
|
2022-05-26 04:29:29 -04:00
|
|
|
return reinterpret_cast<HANDLE>(static_cast<DWORD64>(pid));
|
2022-05-24 14:56:15 -04:00
|
|
|
}
|
|
|
|
|
2022-05-26 04:20:41 -04:00
|
|
|
HANDLE WINAPI open_process_stub(const DWORD access, const BOOL inherit, const DWORD pid)
|
2022-05-24 14:56:15 -04:00
|
|
|
{
|
2022-05-26 04:20:41 -04:00
|
|
|
if (pid == pseudo_steam_id)
|
2022-05-24 14:56:15 -04:00
|
|
|
{
|
2022-05-26 04:20:41 -04:00
|
|
|
return pseudo_steam_handle;
|
|
|
|
}
|
2022-05-21 06:04:08 -04:00
|
|
|
|
2022-05-26 04:20:41 -04:00
|
|
|
return open_process_hook.invoke<HANDLE>(access, inherit, pid);
|
2022-05-21 06:04:08 -04:00
|
|
|
}
|
|
|
|
|
2022-05-23 13:18:57 -04:00
|
|
|
HANDLE create_mutex_ex_a_stub(const LPSECURITY_ATTRIBUTES attributes, const LPCSTR name, const DWORD flags,
|
|
|
|
const DWORD access)
|
2022-05-22 09:46:30 -04:00
|
|
|
{
|
|
|
|
if (name == "$ IDA trusted_idbs"s || name == "$ IDA registry mutex $"s)
|
|
|
|
{
|
|
|
|
return nullptr;
|
|
|
|
}
|
|
|
|
|
|
|
|
return create_mutex_ex_a_hook.invoke<HANDLE>(attributes, name, flags, access);
|
|
|
|
}
|
2022-05-21 06:04:08 -04:00
|
|
|
|
2022-05-23 14:42:07 -04:00
|
|
|
bool remove_evil_keywords_from_string(const UNICODE_STRING& string)
|
2022-05-23 13:19:28 -04:00
|
|
|
{
|
|
|
|
static const std::wstring evil_keywords[] =
|
|
|
|
{
|
|
|
|
L"IDA",
|
|
|
|
L"ida",
|
|
|
|
L"HxD",
|
|
|
|
L"cheatengine",
|
|
|
|
L"Cheat Engine",
|
2022-05-30 13:06:59 -04:00
|
|
|
L"x96dbg",
|
|
|
|
L"x32dbg",
|
|
|
|
L"x64dbg",
|
2022-05-23 13:19:28 -04:00
|
|
|
};
|
|
|
|
|
|
|
|
if (!string.Buffer || !string.Length)
|
|
|
|
{
|
2022-05-23 14:42:07 -04:00
|
|
|
return false;
|
2022-05-23 13:19:28 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
std::wstring_view path(string.Buffer, string.Length / sizeof(string.Buffer[0]));
|
|
|
|
|
2022-05-23 14:42:07 -04:00
|
|
|
bool modified = false;
|
2022-05-23 13:19:28 -04:00
|
|
|
for (const auto& keyword : evil_keywords)
|
|
|
|
{
|
|
|
|
while (true)
|
|
|
|
{
|
|
|
|
const auto pos = path.find(keyword);
|
|
|
|
if (pos == std::wstring::npos)
|
|
|
|
{
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
2022-05-23 14:42:07 -04:00
|
|
|
modified = true;
|
|
|
|
|
2022-05-23 13:19:28 -04:00
|
|
|
for (size_t i = 0; i < keyword.size(); ++i)
|
|
|
|
{
|
|
|
|
string.Buffer[pos + i] = L'a';
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
2022-05-23 14:42:07 -04:00
|
|
|
|
|
|
|
return modified;
|
|
|
|
}
|
|
|
|
|
|
|
|
bool remove_evil_keywords_from_string(wchar_t* str, const size_t length)
|
|
|
|
{
|
|
|
|
UNICODE_STRING unicode_string{};
|
|
|
|
unicode_string.Buffer = str;
|
|
|
|
unicode_string.Length = static_cast<uint16_t>(length);
|
|
|
|
unicode_string.MaximumLength = unicode_string.Length;
|
|
|
|
|
|
|
|
return remove_evil_keywords_from_string(unicode_string);
|
|
|
|
}
|
|
|
|
|
|
|
|
bool remove_evil_keywords_from_string(char* str, const size_t length)
|
|
|
|
{
|
|
|
|
std::string_view str_view(str, length);
|
|
|
|
std::wstring wstr(str_view.begin(), str_view.end());
|
|
|
|
|
|
|
|
if (!remove_evil_keywords_from_string(&wstr[0], wstr.size()))
|
|
|
|
{
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
const std::string regular_str(wstr.begin(), wstr.end());
|
|
|
|
memcpy(str, regular_str.data(), length);
|
|
|
|
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
|
|
|
|
int WINAPI get_window_text_a_stub(const HWND wnd, const LPSTR str, const int max_count)
|
|
|
|
{
|
2022-05-24 13:02:04 -04:00
|
|
|
std::wstring wstr{};
|
|
|
|
wstr.resize(max_count);
|
2022-05-23 14:42:07 -04:00
|
|
|
|
2022-05-24 13:02:04 -04:00
|
|
|
const auto res = GetWindowTextW(wnd, &wstr[0], max_count);
|
2022-05-23 14:42:07 -04:00
|
|
|
if (res)
|
|
|
|
{
|
2022-05-24 13:02:04 -04:00
|
|
|
remove_evil_keywords_from_string(wstr.data(), res);
|
2022-05-23 14:42:07 -04:00
|
|
|
|
2022-05-24 13:02:04 -04:00
|
|
|
const std::string regular_str(wstr.begin(), wstr.end());
|
|
|
|
memset(str, 0, max_count);
|
|
|
|
memcpy(str, regular_str.data(), res);
|
2022-05-23 14:42:07 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
return res;
|
2022-05-23 13:19:28 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI nt_query_system_information_stub(const SYSTEM_INFORMATION_CLASS system_information_class,
|
|
|
|
const PVOID system_information,
|
|
|
|
const ULONG system_information_length,
|
|
|
|
const PULONG return_length)
|
|
|
|
{
|
|
|
|
const auto status = nt_query_system_information_hook.invoke<NTSTATUS>(
|
|
|
|
system_information_class, system_information, system_information_length, return_length);
|
|
|
|
|
|
|
|
if (NT_SUCCESS(status))
|
|
|
|
{
|
|
|
|
if (system_information_class == SystemProcessInformation)
|
|
|
|
{
|
2022-05-26 04:20:41 -04:00
|
|
|
bool injected_steam = false;
|
2022-05-23 13:19:28 -04:00
|
|
|
auto addr = static_cast<uint8_t*>(system_information);
|
|
|
|
while (true)
|
|
|
|
{
|
|
|
|
const auto info = reinterpret_cast<SYSTEM_PROCESS_INFORMATION*>(addr);
|
2022-05-23 14:42:07 -04:00
|
|
|
remove_evil_keywords_from_string(info->ImageName);
|
2022-05-23 13:19:28 -04:00
|
|
|
|
2022-05-26 04:29:29 -04:00
|
|
|
static const auto our_pid = process_id_to_handle(GetCurrentProcessId());
|
2022-05-26 04:20:41 -04:00
|
|
|
|
|
|
|
if (!injected_steam && info->UniqueProcessId != our_pid)
|
|
|
|
{
|
|
|
|
static wchar_t steam_path[] = L"steam.exe";
|
|
|
|
|
|
|
|
info->UniqueProcessId = process_id_to_handle(pseudo_steam_id);
|
|
|
|
info->ImageName.Buffer = steam_path;
|
|
|
|
info->ImageName.Length = static_cast<uint16_t>(wcslen(steam_path) * 2u);
|
|
|
|
info->ImageName.MaximumLength = info->ImageName.Length;
|
|
|
|
|
|
|
|
injected_steam = true;
|
|
|
|
}
|
|
|
|
|
2022-05-23 13:19:28 -04:00
|
|
|
if (!info->NextEntryOffset)
|
|
|
|
{
|
|
|
|
break;
|
|
|
|
}
|
|
|
|
|
|
|
|
addr = addr + info->NextEntryOffset;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
2022-05-26 04:29:29 -04:00
|
|
|
bool handle_pseudo_steam_process(const HANDLE handle, const PROCESSINFOCLASS info_class,
|
|
|
|
const PVOID info,
|
|
|
|
const ULONG info_length, const PULONG ret_length, NTSTATUS* status)
|
2022-05-26 04:20:41 -04:00
|
|
|
{
|
|
|
|
if (handle != pseudo_steam_handle || info_class != 43)
|
|
|
|
{
|
|
|
|
return false;
|
|
|
|
}
|
|
|
|
|
|
|
|
const auto steam_folder = steam::SteamAPI_GetSteamInstallPath();
|
|
|
|
const auto steam_path = steam_folder + "\\steam.exe"s;
|
|
|
|
const std::wstring wide_path(steam_path.begin(), steam_path.end());
|
|
|
|
|
|
|
|
const auto required_size = static_cast<ULONG>((wide_path.size() + 1u) * 2u + sizeof(UNICODE_STRING));
|
|
|
|
|
|
|
|
if (ret_length)
|
|
|
|
{
|
|
|
|
*ret_length = required_size;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (info_length < required_size)
|
|
|
|
{
|
|
|
|
*status = static_cast<LONG>(0xC0000004);
|
|
|
|
return true;
|
|
|
|
}
|
|
|
|
|
|
|
|
memset(info, 0, info_length);
|
|
|
|
|
|
|
|
auto& str = *static_cast<UNICODE_STRING*>(info);
|
|
|
|
str.Buffer = reinterpret_cast<wchar_t*>(&str + 1);
|
|
|
|
str.Length = static_cast<uint16_t>(wide_path.size() * 2u);
|
|
|
|
str.MaximumLength = str.Length;
|
|
|
|
|
|
|
|
memcpy(str.Buffer, wide_path.data(), str.Length);
|
|
|
|
|
|
|
|
*status = 0;
|
|
|
|
return true;
|
|
|
|
}
|
2022-05-24 14:56:15 -04:00
|
|
|
|
2022-05-26 04:29:29 -04:00
|
|
|
NTSTATUS WINAPI nt_query_information_process_stub(const HANDLE handle, const PROCESSINFOCLASS info_class,
|
2022-05-23 13:18:57 -04:00
|
|
|
const PVOID info,
|
|
|
|
const ULONG info_length, const PULONG ret_length)
|
2022-05-21 06:04:08 -04:00
|
|
|
{
|
2022-05-26 04:20:41 -04:00
|
|
|
NTSTATUS status{0};
|
2022-05-26 04:29:29 -04:00
|
|
|
if (handle_pseudo_steam_process(handle, info_class, info, info_length, ret_length, &status))
|
2022-05-26 04:20:41 -04:00
|
|
|
{
|
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
2022-05-26 04:50:04 -04:00
|
|
|
status = nt_query_information_process_hook.invoke<NTSTATUS>(handle, info_class, info, info_length,
|
|
|
|
ret_length);
|
2022-05-21 06:04:08 -04:00
|
|
|
|
|
|
|
if (NT_SUCCESS(status))
|
|
|
|
{
|
|
|
|
if (info_class == ProcessBasicInformation)
|
|
|
|
{
|
2022-05-26 04:20:41 -04:00
|
|
|
static_cast<PPROCESS_BASIC_INFORMATION>(info)->Reserved3 = process_id_to_handle(pseudo_steam_id);
|
2022-05-21 06:04:08 -04:00
|
|
|
}
|
2022-05-24 14:56:15 -04:00
|
|
|
else if (info_class == ProcessDebugObjectHandle)
|
2022-05-21 06:04:08 -04:00
|
|
|
{
|
|
|
|
*static_cast<HANDLE*>(info) = nullptr;
|
2022-05-26 04:20:41 -04:00
|
|
|
return static_cast<LONG>(0xC0000353);
|
2022-05-21 06:04:08 -04:00
|
|
|
}
|
2022-05-24 14:56:15 -04:00
|
|
|
else if (info_class == ProcessImageFileName || info_class == 43 /* ? */)
|
2022-05-23 13:19:28 -04:00
|
|
|
{
|
2022-05-23 14:42:07 -04:00
|
|
|
remove_evil_keywords_from_string(*static_cast<UNICODE_STRING*>(info));
|
2022-05-23 13:19:28 -04:00
|
|
|
}
|
2022-05-24 14:56:15 -04:00
|
|
|
else if (info_class == ProcessDebugPort)
|
2022-05-21 06:04:08 -04:00
|
|
|
{
|
|
|
|
*static_cast<HANDLE*>(info) = nullptr;
|
|
|
|
}
|
2022-05-24 14:56:15 -04:00
|
|
|
else if (info_class == ProcessDebugFlags)
|
2022-05-21 06:04:08 -04:00
|
|
|
{
|
|
|
|
*static_cast<ULONG*>(info) = 1;
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return status;
|
|
|
|
}
|
|
|
|
|
|
|
|
NTSTATUS NTAPI nt_close_stub(const HANDLE handle)
|
|
|
|
{
|
2022-05-26 04:20:41 -04:00
|
|
|
if (handle == pseudo_steam_handle)
|
|
|
|
{
|
|
|
|
return 0;
|
|
|
|
}
|
|
|
|
|
2022-05-21 06:04:08 -04:00
|
|
|
char info[16];
|
|
|
|
if (NtQueryObject(handle, OBJECT_INFORMATION_CLASS(4), &info, 2, nullptr) >= 0 && size_t(handle) != 0x12345)
|
|
|
|
{
|
2022-05-26 04:29:29 -04:00
|
|
|
return nt_close_hook.invoke<NTSTATUS>(handle);
|
2022-05-21 06:04:08 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
return STATUS_INVALID_HANDLE;
|
|
|
|
}
|
|
|
|
|
|
|
|
void hide_being_debugged()
|
|
|
|
{
|
2022-05-26 04:29:29 -04:00
|
|
|
auto* const peb = reinterpret_cast<PPEB>(__readgsqword(0x60));
|
2022-05-21 06:04:08 -04:00
|
|
|
peb->BeingDebugged = false;
|
|
|
|
*reinterpret_cast<PDWORD>(LPSTR(peb) + 0xBC) &= ~0x70;
|
|
|
|
}
|
2022-05-23 13:19:28 -04:00
|
|
|
|
|
|
|
void restore_debug_functions()
|
|
|
|
{
|
|
|
|
static const char* functions[] = {
|
|
|
|
"DbgBreakPoint",
|
|
|
|
"DbgUserBreakPoint",
|
|
|
|
"DbgUiConnectToDbg",
|
|
|
|
"DbgUiContinue",
|
|
|
|
"DbgUiConvertStateChangeStructure",
|
|
|
|
"DbgUiDebugActiveProcess",
|
|
|
|
"DbgUiGetThreadDebugObject",
|
|
|
|
"DbgUiIssueRemoteBreakin",
|
|
|
|
"DbgUiRemoteBreakin",
|
|
|
|
"DbgUiSetThreadDebugObject",
|
|
|
|
"DbgUiStopDebugging",
|
|
|
|
"DbgUiWaitStateChange",
|
|
|
|
"DbgPrintReturnControlC",
|
|
|
|
"DbgPrompt",
|
|
|
|
};
|
|
|
|
|
|
|
|
using buffer = uint8_t[15];
|
|
|
|
static buffer buffers[ARRAYSIZE(functions)] = {};
|
|
|
|
static bool loaded = false;
|
|
|
|
|
|
|
|
const utils::nt::library ntdll("ntdll.dll");
|
|
|
|
|
2022-05-24 14:56:15 -04:00
|
|
|
for (auto i = 0u; i < ARRAYSIZE(functions); ++i)
|
2022-05-23 13:19:28 -04:00
|
|
|
{
|
|
|
|
const auto func = ntdll.get_proc<void*>(functions[i]);
|
|
|
|
if (!loaded)
|
|
|
|
{
|
|
|
|
memcpy(buffers[i], func, sizeof(buffer));
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
utils::hook::copy(func, buffers[i], sizeof(buffer));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
loaded = true;
|
|
|
|
}
|
2022-05-26 04:50:04 -04:00
|
|
|
|
2022-05-28 13:13:44 -04:00
|
|
|
LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info)
|
|
|
|
{
|
|
|
|
if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE)
|
|
|
|
{
|
|
|
|
return EXCEPTION_CONTINUE_EXECUTION;
|
|
|
|
}
|
|
|
|
|
|
|
|
if (info->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION)
|
|
|
|
{
|
|
|
|
//MessageBoxA(0, 0, "AV", 0);
|
|
|
|
//restore_debug_functions();
|
|
|
|
}
|
|
|
|
|
|
|
|
return EXCEPTION_CONTINUE_SEARCH;
|
|
|
|
}
|
|
|
|
|
2022-05-26 04:50:04 -04:00
|
|
|
const char* get_command_line_a_stub()
|
|
|
|
{
|
|
|
|
static auto cmd = []
|
|
|
|
{
|
|
|
|
std::string cmd_line = GetCommandLineA();
|
|
|
|
if (!strstr(cmd_line.data(), "fs_game"))
|
|
|
|
{
|
2022-05-27 13:14:07 -04:00
|
|
|
cmd_line += " +set fs_game \"boiii\"";
|
2022-05-26 04:50:04 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
return cmd_line;
|
|
|
|
}();
|
|
|
|
|
|
|
|
return cmd.data();
|
|
|
|
}
|
2022-05-21 06:04:08 -04:00
|
|
|
}
|
|
|
|
|
2022-05-28 13:13:44 -04:00
|
|
|
uint64_t get_integrity_data_qword(const uint8_t* address)
|
|
|
|
{
|
2022-05-30 12:14:12 -04:00
|
|
|
OutputDebugStringA(utils::string::va("8 bytes -> %p", address));
|
2022-05-28 13:13:44 -04:00
|
|
|
const auto og_data = utils::hook::query_original_data(address, 8);
|
|
|
|
return *reinterpret_cast<const uint64_t*>(og_data.data());
|
|
|
|
}
|
|
|
|
|
|
|
|
uint32_t get_integrity_data_dword(const uint8_t* address)
|
|
|
|
{
|
2022-05-30 12:14:12 -04:00
|
|
|
OutputDebugStringA(utils::string::va("4 bytes -> %p", address));
|
2022-05-28 13:13:44 -04:00
|
|
|
const auto og_data = utils::hook::query_original_data(address, 4);
|
|
|
|
return *reinterpret_cast<const uint32_t*>(og_data.data());
|
|
|
|
}
|
|
|
|
|
|
|
|
uint8_t get_integrity_data_byte(const uint8_t* address)
|
|
|
|
{
|
2022-05-30 12:14:12 -04:00
|
|
|
OutputDebugStringA(utils::string::va("1 bytes -> %p", address));
|
2022-05-28 13:13:44 -04:00
|
|
|
const auto og_data = utils::hook::query_original_data(address, 1);
|
|
|
|
return og_data[0];
|
|
|
|
}
|
2022-05-30 12:14:12 -04:00
|
|
|
|
2022-05-28 13:13:44 -04:00
|
|
|
void patch_check_type_1_direct()
|
|
|
|
{
|
|
|
|
auto patch_addr = [](uint8_t* addr)
|
|
|
|
{
|
|
|
|
// Skip false positives
|
|
|
|
// Prefixed 0x41 encodes a different instruction
|
|
|
|
if (addr[-1] == 0x41)
|
|
|
|
{
|
|
|
|
return;
|
|
|
|
}
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_dword);
|
|
|
|
|
|
|
|
a.mov(rcx, qword_ptr(rsp, 128));
|
|
|
|
a.mov(ecx, eax);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rcx);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.embedUInt8(addr[3]);
|
|
|
|
a.embedUInt8(addr[4]);
|
|
|
|
a.embedUInt8(addr[5]);
|
|
|
|
|
|
|
|
a.jmp(addr + 5);
|
|
|
|
}));
|
|
|
|
};
|
|
|
|
|
|
|
|
// mov [rbp+??h], eax
|
|
|
|
auto checks = "8B 00 89 45 ??"_sig;
|
2022-05-30 12:14:12 -04:00
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
patch_addr(addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
// xor eax, [rbp+??h]
|
|
|
|
checks = "8B 00 33 45 ??"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
patch_addr(addr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void patch_check_type_1_indirect()
|
|
|
|
{
|
|
|
|
auto patch_addr = [](uint8_t* addr)
|
|
|
|
{
|
|
|
|
const auto rex_prefixed = *addr == 0x48;
|
|
|
|
const auto jump_target = utils::hook::follow_branch(addr + (rex_prefixed ? 3 : 2));
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr, jump_target, rex_prefixed](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
|
2022-05-30 12:14:12 -04:00
|
|
|
if (rex_prefixed)
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
|
|
|
a.call_aligned(get_integrity_data_dword);
|
|
|
|
|
|
|
|
a.mov(rcx, qword_ptr(rsp, 128));
|
|
|
|
a.mov(ecx, eax);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rcx);
|
|
|
|
}
|
|
|
|
else
|
|
|
|
{
|
|
|
|
a.mov(qword_ptr(rsp, 128), rax);
|
|
|
|
}
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.jmp(jump_target);
|
|
|
|
}));
|
|
|
|
};
|
|
|
|
|
|
|
|
// mov rax, [rax]; jmp ...
|
|
|
|
auto checks = "48 8B 00 E9"_sig;
|
2022-05-30 12:14:12 -04:00
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
patch_addr(addr);
|
|
|
|
}
|
|
|
|
|
|
|
|
// mov eax, [rax]; jmp ...
|
|
|
|
checks = "8B 00 E9"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
patch_addr(addr);
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-30 12:14:12 -04:00
|
|
|
void patch_check_type_2_direct()
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
2022-05-30 12:14:12 -04:00
|
|
|
const auto checks = "0F B6 00 0F B6 C0"_sig;
|
2022-05-28 13:13:44 -04:00
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_byte);
|
|
|
|
|
|
|
|
a.mov(rcx, qword_ptr(rsp, 128));
|
|
|
|
a.movzx(ecx, al);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rcx);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.movzx(eax, al);
|
|
|
|
a.jmp(addr + 6);
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-30 12:14:12 -04:00
|
|
|
void patch_check_type_2_indirect()
|
|
|
|
{
|
|
|
|
const auto checks = "0F B6 00 E9"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
const auto jump_target = utils::hook::follow_branch(addr + 3);
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr, jump_target](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_byte);
|
|
|
|
|
|
|
|
a.mov(rcx, qword_ptr(rsp, 128));
|
|
|
|
a.movzx(ecx, al);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rcx);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.jmp(jump_target);
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void patch_check_type_4_direct()
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
|
|
|
const auto checks = "48 8B 04 10 48 89 45 20"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.mov(rax, qword_ptr(rax, rdx));
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_qword);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rax);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.mov(qword_ptr(rbp, 0x20), rax);
|
|
|
|
a.jmp(addr + 8);
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-30 12:14:12 -04:00
|
|
|
void patch_check_type_4_indirect()
|
|
|
|
{
|
|
|
|
const auto checks = "48 8B 04 10 E9"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
const auto jump_target = utils::hook::follow_branch(addr + 4);
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr, jump_target](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.mov(rax, qword_ptr(rax, rdx));
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_qword);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rax);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.jmp(jump_target);
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
void patch_check_type_5_direct()
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
|
|
|
const auto checks = "0F B6 00 88 02"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
|
|
|
|
// Skip false positives
|
|
|
|
// Prefixed 0x41 encodes a different instruction
|
2022-05-30 12:14:12 -04:00
|
|
|
if (addr[-1] == 0x41)
|
2022-05-28 13:13:44 -04:00
|
|
|
{
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_byte);
|
|
|
|
|
|
|
|
a.mov(rcx, qword_ptr(rsp, 128));
|
|
|
|
a.movzx(ecx, al);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rcx);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.mov(byte_ptr(rdx), al);
|
|
|
|
a.jmp(addr + 5);
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-30 12:14:12 -04:00
|
|
|
|
|
|
|
void patch_check_type_5_indirect()
|
|
|
|
{
|
|
|
|
const auto checks = "0F B6 00 E9"_sig;
|
|
|
|
for (size_t i = 0; i < checks.count(); ++i)
|
|
|
|
{
|
|
|
|
auto* addr = checks.get(i);
|
|
|
|
|
|
|
|
// Skip false positives
|
|
|
|
// Prefixed 0x41 encodes a different instruction
|
|
|
|
if (addr[-1] == 0x41)
|
|
|
|
{
|
|
|
|
continue;
|
|
|
|
}
|
|
|
|
|
|
|
|
const auto jump_target = utils::hook::follow_branch(addr + 4);
|
|
|
|
|
|
|
|
utils::hook::jump(addr, utils::hook::assemble([addr, jump_target](utils::hook::assembler& a)
|
|
|
|
{
|
|
|
|
a.push(rax);
|
|
|
|
a.pushad64();
|
|
|
|
|
|
|
|
a.mov(rcx, rax);
|
|
|
|
a.call_aligned(get_integrity_data_byte);
|
|
|
|
|
|
|
|
a.mov(rcx, qword_ptr(rsp, 128));
|
|
|
|
a.movzx(ecx, al);
|
|
|
|
a.mov(qword_ptr(rsp, 128), rcx);
|
|
|
|
|
|
|
|
a.popad64();
|
|
|
|
a.pop(rax);
|
|
|
|
|
|
|
|
a.jmp(jump_target);
|
|
|
|
}));
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2022-05-21 06:04:08 -04:00
|
|
|
class component final : public component_interface
|
|
|
|
{
|
|
|
|
public:
|
2022-05-29 10:46:49 -04:00
|
|
|
void pre_start() override
|
2022-05-21 06:04:08 -04:00
|
|
|
{
|
|
|
|
hide_being_debugged();
|
|
|
|
scheduler::loop(hide_being_debugged, scheduler::pipeline::async);
|
|
|
|
|
2022-05-22 09:46:30 -04:00
|
|
|
create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub);
|
|
|
|
|
2022-05-21 06:04:08 -04:00
|
|
|
const utils::nt::library ntdll("ntdll.dll");
|
|
|
|
nt_close_hook.create(ntdll.get_proc<void*>("NtClose"), nt_close_stub);
|
2022-05-23 13:19:28 -04:00
|
|
|
|
|
|
|
const auto nt_query_information_process = ntdll.get_proc<void*>("NtQueryInformationProcess");
|
|
|
|
nt_query_information_process_hook.create(nt_query_information_process,
|
2022-05-23 13:18:57 -04:00
|
|
|
nt_query_information_process_stub);
|
2022-05-23 13:19:28 -04:00
|
|
|
|
|
|
|
const auto nt_query_system_information = ntdll.get_proc<void*>("NtQuerySystemInformation");
|
|
|
|
nt_query_system_information_hook.create(nt_query_system_information, nt_query_system_information_stub);
|
2022-05-24 13:02:04 -04:00
|
|
|
nt_query_system_information_hook.move();
|
2022-05-23 14:42:07 -04:00
|
|
|
|
2022-05-26 04:20:41 -04:00
|
|
|
open_process_hook.create(OpenProcess, open_process_stub);
|
|
|
|
|
2022-05-24 13:02:04 -04:00
|
|
|
utils::hook::copy(this->window_text_buffer_, GetWindowTextA, sizeof(this->window_text_buffer_));
|
|
|
|
utils::hook::jump(GetWindowTextA, get_window_text_a_stub, true, true);
|
2022-05-23 14:42:07 -04:00
|
|
|
utils::hook::move_hook(GetWindowTextA);
|
|
|
|
|
2022-05-21 06:04:08 -04:00
|
|
|
AddVectoredExceptionHandler(1, exception_filter);
|
2022-05-26 04:50:04 -04:00
|
|
|
|
|
|
|
// TODO: Remove as soon as real hooking works
|
|
|
|
auto* cmd_func = utils::nt::library{}.get_iat_entry("kernel32.dll", "GetCommandLineA");
|
|
|
|
if (cmd_func)
|
|
|
|
{
|
|
|
|
utils::hook::set(cmd_func, get_command_line_a_stub);
|
|
|
|
}
|
2022-05-21 06:04:08 -04:00
|
|
|
}
|
2022-05-24 13:02:04 -04:00
|
|
|
|
2022-05-28 13:13:44 -04:00
|
|
|
void post_unpack() override
|
|
|
|
{
|
2022-05-30 12:14:33 -04:00
|
|
|
/*
|
2022-05-29 12:23:52 -04:00
|
|
|
patch_check_type_1_direct();
|
2022-05-28 13:13:44 -04:00
|
|
|
patch_check_type_1_indirect();
|
2022-05-30 12:14:12 -04:00
|
|
|
patch_check_type_2_direct();
|
|
|
|
patch_check_type_2_indirect();
|
|
|
|
patch_check_type_4_direct();
|
|
|
|
patch_check_type_4_indirect();
|
|
|
|
patch_check_type_5_direct();
|
|
|
|
patch_check_type_5_indirect();
|
|
|
|
MessageBoxA(0, "done", 0, 0);
|
2022-05-30 12:14:33 -04:00
|
|
|
*/
|
2022-05-28 13:13:44 -04:00
|
|
|
}
|
|
|
|
|
2022-05-24 13:02:04 -04:00
|
|
|
void pre_destroy() override
|
|
|
|
{
|
|
|
|
utils::hook::copy(GetWindowTextA, this->window_text_buffer_, sizeof(this->window_text_buffer_));
|
|
|
|
nt_query_system_information_hook.clear();
|
|
|
|
nt_query_information_process_hook.clear();
|
|
|
|
nt_close_hook.clear();
|
|
|
|
create_mutex_ex_a_hook.clear();
|
2022-05-26 04:50:04 -04:00
|
|
|
open_process_hook.clear();
|
2022-05-24 13:02:04 -04:00
|
|
|
}
|
|
|
|
|
|
|
|
private:
|
|
|
|
uint8_t window_text_buffer_[15]{};
|
2022-05-21 06:04:08 -04:00
|
|
|
};
|
|
|
|
}
|
|
|
|
|
|
|
|
REGISTER_COMPONENT(arxan::component)
|