From 63d2acbde6d1346da3cf3bd8dc176c7573d50480 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Wed, 14 Sep 2022 19:55:39 +0200 Subject: [PATCH 1/9] Integrity experiments --- src/client/component/arxan.cpp | 703 ++++++++++++++++----------------- 1 file changed, 351 insertions(+), 352 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index bb09e84c..2ac4b3c9 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -5,8 +5,10 @@ #include "steam/steam.hpp" #include +#include "utils/finally.hpp" #include "utils/string.hpp" #include "utils/hardware_breakpoint.hpp" +#include "utils/io.hpp" #define ProcessDebugPort 7 #define ProcessDebugObjectHandle 30 // WinXP source says 31? @@ -390,10 +392,13 @@ namespace arxan loaded = true; } - const std::pair& get_text_section() + const std::vector>& get_text_sections() { - static const std::pair text = []() -> std::pair + static const std::vector> text = [ + ]() -> std::vector> { + std::vector> texts; + const utils::nt::library game{}; for (const auto& section : game.get_section_headers()) { @@ -402,69 +407,249 @@ namespace arxan if (name == ".text"s) { - return {game.get_ptr() + section->VirtualAddress, section->Misc.VirtualSize}; + texts.emplace_back(game.get_ptr() + section->VirtualAddress, section->Misc.VirtualSize); } } - return {nullptr, 0}; + return texts; } (); return text; } - bool was_in_text(const ULONG_PTR addr) + bool was_in_texts(const ULONG_PTR addr) { - return addr >= reinterpret_cast(get_text_section().first) && addr <= reinterpret_cast( - get_text_section().first + - get_text_section().second); + const auto& texts = get_text_sections(); + for (const auto& text : texts) + { + if (addr >= reinterpret_cast(text.first) && addr <= reinterpret_cast(text.first + + text.second)) + { + return true; + } + } + + return false; } - void protect_text() + void protect_texts() { - DWORD old_protect{}; - VirtualProtect(get_text_section().first, get_text_section().second, PAGE_EXECUTE_READ, &old_protect); + const auto& texts = get_text_sections(); + for (const auto& text : texts) + { + DWORD old_protect{}; + VirtualProtect(text.first, text.second, PAGE_EXECUTE_READ, &old_protect); + } } - void unprotect_text() + void unprotect_texts() { - DWORD old_protect{}; - VirtualProtect(get_text_section().first, get_text_section().second, PAGE_EXECUTE_READWRITE, &old_protect); + const auto& texts = get_text_sections(); + for (const auto& text : texts) + { + DWORD old_protect{}; + VirtualProtect(text.first, text.second, PAGE_EXECUTE_READWRITE, &old_protect); + } + } + + struct integrity_handler_context + { + uint32_t* computed_checksum; + uint32_t* original_checksum; + }; + + struct integrity_handler_data + { + uint64_t address; + uint64_t checksum_address; + uint32_t checksum; + uint32_t frame_offset; + + std::string to_string() const + { + return utils::string::va("%llX,%llX,%X,%X", this->address, this->checksum_address, this->checksum, + this->frame_offset); + } + + static integrity_handler_data from_string(const std::string& line) + { + integrity_handler_data res{}; + sscanf_s(line.data(), "%llX,%llX,%X,%X", &res.address, &res.checksum_address, &res.checksum, + &res.frame_offset); + + return res; + } + }; + + std::unordered_map integrity_handlers; + + void load_handlers() + { + std::string data{}; + if (!utils::io::read_file("integrity.txt", &data)) return; + + const auto lines = utils::string::split(data, '\n'); + for (const auto& line : lines) + { + if (line.empty())continue; + auto handler = integrity_handler_data::from_string(line); + integrity_handlers[operator"" _g(handler.address)] = handler; + } + } + + void write_handlers() + { + std::string txt{}; + for (auto& h : integrity_handlers) + { + txt += h.second.to_string(); + txt += "\n"; + } + + utils::io::write_file("integrity.txt", txt); } LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info) { - /*static thread_local struct + static thread_local struct { bool needs_protect_change = false; bool had_single_step = false; - } analysis_context;*/ + } analysis_context{}; if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE) { return EXCEPTION_CONTINUE_EXECUTION; } - /*if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) + if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP && false) { + auto dr6_clear = utils::finally([info] + { + info->ContextRecord->Dr6 = 0; + }); + //utils::thread::suspend_other_threads(); //restore_debug_functions(); //MessageBoxA(0, "SS", 0, 0); - OutputDebugStringA("SINGLESTEP!\n"); - return EXCEPTION_CONTINUE_EXECUTION; - }*/ + static uint64_t addr = 0; + /*if (info->ContextRecord->Rip == 0x15E4EBF6B_g) + { + OutputDebugStringA(utils::string::va("Lul: %X | %X", (uint32_t)info->ContextRecord->Rax, + (uint32_t)info->ContextRecord->Rdx)); - /*if (info->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION) - { - utils::thread::suspend_other_threads(); - restore_debug_functions(); - MessageBoxA(nullptr, utils::string::va("AV at: %llX %llX", - info->ContextRecord->Rip, reverse_g(info->ContextRecord->Rip)), - nullptr, 0); - return EXCEPTION_CONTINUE_EXECUTION; - }*/ + return EXCEPTION_CONTINUE_EXECUTION; + }*/ - /*if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) + static const std::unordered_map> lulul = { + {0x15AF356A9_g, {0x58, true}}, + {0x15BC7D9D4_g, {0x54, false}}, // ? + {0x15BC4905F_g, {0x64, true}}, + {0x15B2D7326_g, {0x64, true}}, + {0x15B4ABC16_g, {0x5C, true}}, + + {0x15EF9A75B_g, {0x54, true}}, + {0x15E5FD1E9_g, {0x58, true}}, + {0x15CA3965D_g, {0x58, true}}, + {0x15F3397B2_g, {0x64, true}}, + {0x15DCB1A2C_g, {0x50, true}}, + {0x15F6B4001_g, {0x5C, true}}, + {0x15BE521F1_g, {0x5C, true}}, + + {0x15F6AE373_g, {0x54, true}}, + {0x15C4CACB2_g, {0x54, true}}, + {0x15EF6AF3F_g, {0x5C, true}}, + {0x15BB1DAB8_g, {0x5C, true}}, + {0x15D1C5569_g, {0x50, false}}, // -> 15EAE384F, 15EA9C476 + {0x15BF469D7_g, {0x5C, true}}, + {0x15F9801A6_g, {0x60, false}}, // -> 15C2B8D85, 15D93EF1E + {0x15B5C48A3_g, {0x60, true}}, + {0x15E49ABC2_g, {0x64, true}}, + //{0x_g, {0x0, true}}, + + // OLD + + {0x15C0EDE96_g, {0x58, false}}, // -> 15D390285, 15CE36ADD, 15BDEC8E2 + {0x15F0643FD_g, {0x58, false}}, // -> 14219FDD3, 15E4EBF68, 15C02F8BD -> 4FF3DF01 + {0x142306BD9_g, {0x50, false}}, // -> 15B923CD2, 15B7F5204, 15EFBB4C9 + + {0x15BEA0BE8_g, {0x60, false}}, // -> 15B2FB386, 15D0379AC + {0x15CC4E93C_g, {0x60, false}}, // -> 15CCDC12E, 15DB862E9 + {0x15C2BB16B_g, {0x50, false}}, // -> 15EEC0E00, 15F5CA333 + {0x15C34F5BB_g, {0x58, false}}, // -> 15D7FFF48, 15CAAB671 + {0x15EA91E38_g, {0x50, false}}, // -> 15E54D475, 15F5C90B6 -> 4B7F42B5 + + {0x15C998E3C_g, {0x5C, false}}, // ? + {0x15EA018CD_g, {0x5C, false}}, // ? + {0x15C591543_g, {0x54, false}}, // ? + {0x15F9ADF78_g, {0x6C, false}}, // ? + + {0x15D5F91F7_g, {0x58, false}}, // <- 0x15F0643FD + {0x15D5F91E4_g, {0x58, false}}, // <- 0x15F0643FD + }; + + if (!addr && lulul.contains(info->ContextRecord->Rip) && lulul.at(info->ContextRecord->Rip).second) + { + addr = info->ContextRecord->Rbp + lulul.at(info->ContextRecord->Rip).first; + + OutputDebugStringA(utils::string::va("Begin Trace: %llX -> %llX", info->ContextRecord->Rip, addr)); + utils::hardware_breakpoint::deactivate_all(*info->ContextRecord); + activate(addr, 4, utils::hardware_breakpoint::read_write, *info->ContextRecord); + //activate(0x15E4EBFAA_g, 1, utils::hardware_breakpoint::execute, *info->ContextRecord); + + //info->ContextRecord->Rax = 0xC3; + //utils::hook::nop(0x15E4EBFA6_g, 4); + //utils::hook::nop(0x15EA17E28_g, 4); + + return EXCEPTION_CONTINUE_EXECUTION; + } + else if (!lulul.contains(info->ContextRecord->Rip)) + { + if (addr) + { + static std::unordered_set aaa; + if (aaa.emplace(info->ContextRecord->Rip).second) + { + /*if (info->ContextRecord->Rip == 0x14219FDD3_g) + { + OutputDebugStringA(utils::string::va("OOO: %X - %llX | %llX", + *(uint32_t*)addr, info->ContextRecord->Rcx, + 0x1421E54A7_g + info->ContextRecord->Rcx * 4)); + *(uint32_t*)addr = 0x4FF3DF01; + //info->ContextRecord->Rax = 0x4FF3DF01; + utils::hardware_breakpoint::deactivate_all(*info->ContextRecord); + }*/ + if (info->ContextRecord->Rip == 0x15E4EBF68_g) + { + auto other = info->ContextRecord->Rbx + info->ContextRecord->Rcx * 4; + OutputDebugStringA(utils::string::va("Singlestep: %llX | %X | %X | %llX", + info->ContextRecord->Rip, + *(uint32_t*)addr, *(uint32_t*)other, other)); + utils::hardware_breakpoint::deactivate_all(*info->ContextRecord); + } + else + { + OutputDebugStringA(utils::string::va("Singlestep: %llX | %X", + info->ContextRecord->Rip, *(uint32_t*)addr)); + } + } + } + else + { + static std::unordered_set bbb; + if (!lulul.contains(info->ContextRecord->Rip) && bbb.emplace(info->ContextRecord->Rip).second) + { + OutputDebugStringA(utils::string::va("Singlestep: %llX", info->ContextRecord->Rip)); + } + } + } + + return EXCEPTION_CONTINUE_EXECUTION; + } + + + if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) { if (!analysis_context.needs_protect_change) { @@ -478,7 +663,7 @@ namespace arxan info->ContextRecord->EFlags &= 0x0100; } - protect_text(); + protect_texts(); return EXCEPTION_CONTINUE_EXECUTION; } @@ -491,7 +676,7 @@ namespace arxan } const auto addr = info->ExceptionRecord->ExceptionInformation[1]; - if (!was_in_text(addr)) + if (!was_in_texts(addr)) { return EXCEPTION_CONTINUE_SEARCH; } @@ -500,13 +685,81 @@ namespace arxan analysis_context.had_single_step = info->ContextRecord->EFlags & 0x0100; info->ContextRecord->EFlags |= 0x0100; - OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr, reverse_g(addr), - info->ContextRecord->Rip, reverse_g(info->ContextRecord->Rip))); + const auto data = *reinterpret_cast(info->ContextRecord->Rip); + if ((data & 0xFFFFFF) == 0x8A0489 && !integrity_handlers.contains(info->ContextRecord->Rip)) + { + auto checksum = static_cast(info->ContextRecord->Rax); + auto offset = static_cast(info->ContextRecord->Rcx); + if (offset != 0) + { + OutputDebugStringA(utils::string::va("OFFSET: %X\n", offset)); + } - unprotect_text(); + std::vector discoveries{}; + + for (uint32_t stack = 0x30; stack < 0x80; stack += 8) + { + auto* value_ptr = *(uint32_t**)(info->ContextRecord->Rbp + stack); + auto* _addr = &value_ptr[offset]; + if (IsBadReadPtr(_addr, 4) || *_addr != checksum) + { + continue; + } + + discoveries.push_back(stack); + } + + if (discoveries.size() != 2) + { + OutputDebugStringA(utils::string::va( + "!!! Unknown handler: %llX - Checksum: %X | rbp: %llX - offset: %X | discoveries: %zX", + info->ContextRecord->Rip, + checksum, info->ContextRecord->Rbp, offset, discoveries.size())); + + for (auto discovery : discoveries) + { + OutputDebugStringA(utils::string::va( + "%X --> %llX", + discovery, *(uint32_t**)(info->ContextRecord->Rbp + discovery) + offset)); + } + } + else + { + uint32_t* value_ptrs[] = { + *(uint32_t**)(info->ContextRecord->Rbp + discoveries[0]) + offset, + *(uint32_t**)(info->ContextRecord->Rbp + discoveries[1]) + offset + }; + + auto diff_0 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[0]); + auto diff_1 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[1]); + + auto store_index = diff_0 < diff_1 ? 0 : 1; + auto other_index = 1 - store_index; + + OutputDebugStringA(utils::string::va( + "Handler: %llX\t| Checksum: %X\t| Checksum in memory: %llX\t(%X)\t| Calculated checksum location: %llX\t(%X)", + info->ContextRecord->Rip, + checksum, value_ptrs[other_index], discoveries[other_index], value_ptrs[store_index], + discoveries[store_index])); + + integrity_handler_data h{}; + h.address = reverse_g(info->ContextRecord->Rip); + h.checksum = checksum; + h.checksum_address = reverse_g(value_ptrs[other_index]); + h.frame_offset = discoveries[store_index]; + + integrity_handlers[info->ContextRecord->Rip] = h; + write_handlers(); + } + } + /* OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr, + reverse_g(addr), + info->ContextRecord->Rip, + reverse_g(info->ContextRecord->Rip)));*/ + + unprotect_texts(); return EXCEPTION_CONTINUE_EXECUTION; - //restore_debug_functions(); - }*/ + } return EXCEPTION_CONTINUE_SEARCH; } @@ -556,295 +809,6 @@ namespace arxan return get_thread_context_hook.invoke(thread_handle, context); } - uint64_t get_integrity_data_qword(const uint8_t* address) - { - OutputDebugStringA(utils::string::va("8 bytes -> %p", address)); - const auto og_data = utils::hook::query_original_data(address, 8); - return *reinterpret_cast(og_data.data()); - } - - uint32_t get_integrity_data_dword(const uint8_t* address) - { - OutputDebugStringA(utils::string::va("4 bytes -> %p", address)); - const auto og_data = utils::hook::query_original_data(address, 4); - return *reinterpret_cast(og_data.data()); - } - - uint8_t get_integrity_data_byte(const uint8_t* address) - { - OutputDebugStringA(utils::string::va("1 bytes -> %p", address)); - const auto og_data = utils::hook::query_original_data(address, 1); - return og_data[0]; - } - - void patch_check_type_1_direct() - { - auto patch_addr = [](uint8_t* addr) - { - // Skip false positives - // Prefixed 0x41 encodes a different instruction - if (addr[-1] == 0x41) - { - return; - } - - utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a) - { - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_dword); - - a.mov(rcx, qword_ptr(rsp, 128)); - a.mov(ecx, eax); - a.mov(qword_ptr(rsp, 128), rcx); - - a.popad64(); - a.pop(rax); - - a.embedUInt8(addr[3]); - a.embedUInt8(addr[4]); - a.embedUInt8(addr[5]); - - a.jmp(addr + 5); - })); - }; - - // mov [rbp+??h], eax - auto checks = "8B 00 89 45 ??"_sig; - for (auto* addr : checks) - { - patch_addr(addr); - } - - // xor eax, [rbp+??h] - checks = "8B 00 33 45 ??"_sig; - for (auto* addr : checks) - { - patch_addr(addr); - } - } - - void patch_check_type_1_indirect() - { - auto patch_addr = [](uint8_t* addr) - { - const auto rex_prefixed = *addr == 0x48; - const auto jump_target = utils::hook::follow_branch(addr + (rex_prefixed ? 3 : 2)); - - utils::hook::jump(addr, utils::hook::assemble([addr, jump_target, rex_prefixed](utils::hook::assembler& a) - { - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - - if (rex_prefixed) - { - a.call_aligned(get_integrity_data_dword); - - a.mov(rcx, qword_ptr(rsp, 128)); - a.mov(ecx, eax); - a.mov(qword_ptr(rsp, 128), rcx); - } - else - { - a.mov(qword_ptr(rsp, 128), rax); - } - - a.popad64(); - a.pop(rax); - - a.jmp(jump_target); - })); - }; - - // mov rax, [rax]; jmp ... - auto checks = "48 8B 00 E9"_sig; - for (auto* addr : checks) - { - patch_addr(addr); - } - - // mov eax, [rax]; jmp ... - checks = "8B 00 E9"_sig; - for (auto* addr : checks) - { - patch_addr(addr); - } - } - - void patch_check_type_2_direct() - { - const auto checks = "0F B6 00 0F B6 C0"_sig; - for (auto* addr : checks) - { - utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a) - { - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_byte); - - a.mov(rcx, qword_ptr(rsp, 128)); - a.movzx(ecx, al); - a.mov(qword_ptr(rsp, 128), rcx); - - a.popad64(); - a.pop(rax); - - a.movzx(eax, al); - a.jmp(addr + 6); - })); - } - } - - void patch_check_type_2_indirect() - { - const auto checks = "0F B6 00 E9"_sig; - for (auto* addr : checks) - { - const auto jump_target = utils::hook::follow_branch(addr + 3); - - utils::hook::jump(addr, utils::hook::assemble([jump_target](utils::hook::assembler& a) - { - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_byte); - - a.mov(rcx, qword_ptr(rsp, 128)); - a.movzx(ecx, al); - a.mov(qword_ptr(rsp, 128), rcx); - - a.popad64(); - a.pop(rax); - - a.jmp(jump_target); - })); - } - } - - void patch_check_type_4_direct() - { - const auto checks = "48 8B 04 10 48 89 45 20"_sig; - for (auto* addr : checks) - { - utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a) - { - a.mov(rax, qword_ptr(rax, rdx)); - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_qword); - a.mov(qword_ptr(rsp, 128), rax); - - a.popad64(); - a.pop(rax); - - a.mov(qword_ptr(rbp, 0x20), rax); - a.jmp(addr + 8); - })); - } - } - - void patch_check_type_4_indirect() - { - const auto checks = "48 8B 04 10 E9"_sig; - for (auto* addr : checks) - { - const auto jump_target = utils::hook::follow_branch(addr + 4); - - utils::hook::jump(addr, utils::hook::assemble([jump_target](utils::hook::assembler& a) - { - a.mov(rax, qword_ptr(rax, rdx)); - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_qword); - a.mov(qword_ptr(rsp, 128), rax); - - a.popad64(); - a.pop(rax); - - a.jmp(jump_target); - })); - } - } - - void patch_check_type_5_direct() - { - const auto checks = "0F B6 00 88 02"_sig; - for (auto* addr : checks) - { - // Skip false positives - // Prefixed 0x41 encodes a different instruction - if (addr[-1] == 0x41) - { - continue; - } - - utils::hook::jump(addr, utils::hook::assemble([addr](utils::hook::assembler& a) - { - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_byte); - - a.mov(rcx, qword_ptr(rsp, 128)); - a.movzx(ecx, al); - a.mov(qword_ptr(rsp, 128), rcx); - - a.popad64(); - a.pop(rax); - - a.mov(byte_ptr(rdx), al); - a.jmp(addr + 5); - })); - } - } - - - void patch_check_type_5_indirect() - { - const auto checks = "0F B6 00 E9"_sig; - for (auto* addr : checks) - { - // Skip false positives - // Prefixed 0x41 encodes a different instruction - if (addr[-1] == 0x41) - { - continue; - } - - const auto jump_target = utils::hook::follow_branch(addr + 4); - - utils::hook::jump(addr, utils::hook::assemble([jump_target](utils::hook::assembler& a) - { - a.push(rax); - a.pushad64(); - - a.mov(rcx, rax); - a.call_aligned(get_integrity_data_byte); - - a.mov(rcx, qword_ptr(rsp, 128)); - a.movzx(ecx, al); - a.mov(qword_ptr(rsp, 128), rcx); - - a.popad64(); - a.pop(rax); - - a.jmp(jump_target); - })); - } - } - NTSTATUS NTAPI get_proc_address_stub(const HMODULE module_handle, const PANSI_STRING function_name, const WORD oridinal, PVOID* function_address, const BOOL b_value, @@ -884,6 +848,8 @@ namespace arxan hide_being_debugged(); scheduler::loop(hide_being_debugged, scheduler::pipeline::async); + load_handlers(); + create_thread_hook.create(CreateThread, create_thread_stub); create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub); @@ -917,6 +883,7 @@ namespace arxan // TODO: Remove as soon as real hooking works auto* get_cmd_import = utils::nt::library{}.get_iat_entry("kernel32.dll", "GetCommandLineA"); if (get_cmd_import) utils::hook::set(get_cmd_import, get_command_line_a_stub); + //zw_terminate_process_hook.create(ntdll.get_proc("ZwTerminateProcess"), zw_terminate_process_stub); //zw_terminate_process_hook.move(); @@ -929,46 +896,78 @@ namespace arxan { //restore_debug_functions(); /* - patch_check_type_1_direct(); - patch_check_type_1_indirect(); - patch_check_type_2_direct(); - patch_check_type_2_indirect(); - patch_check_type_4_direct(); - patch_check_type_4_indirect(); - patch_check_type_5_direct(); - patch_check_type_5_indirect(); MessageBoxA(0, "done", 0, 0); */ - //protect_text(); - - /*auto tid = GetCurrentThreadId(); - std::thread([tid]() + std::thread([]() { MessageBoxA(0, 0, 0, 0); - //utils::hook::set(0x1423339C0_g, 0xC3); - utils::hardware_breakpoint::activate(0x1423339C0_g, 4, - utils::hardware_breakpoint::read_write, tid); - }).detach();*/ + protect_texts(); + }).detach(); + + + auto tid = GetCurrentThreadId(); + //activate(0x15D5F922A_g, 1, utils::hardware_breakpoint::execute, tid); + //activate(0x15BCA4A2A_g, 1, utils::hardware_breakpoint::execute, tid); + //activate(0x15C4BC192_g, 1, utils::hardware_breakpoint::execute, tid); + //activate(0x15DA1FBA1_g, 1, utils::hardware_breakpoint::execute, tid); // <-- + + //activate(0x15DB61C4A_g, 1, utils::hardware_breakpoint::execute, tid); + //activate(0x15BE5BC6D_g, 1, utils::hardware_breakpoint::execute, tid); // <-- + + //activate(0x15B88A716_g, 1, utils::hardware_breakpoint::execute, tid); + //activate(0x15DBD74A0_g, 1, utils::hardware_breakpoint::execute, tid); // <-- + + //activate(0x15CA2514F_g, 1, utils::hardware_breakpoint::execute, tid); // <-- + //activate(0x15CD0B431_g, 1, utils::hardware_breakpoint::execute, tid); + + //activate(0x15B8447FF_g, 1, utils::hardware_breakpoint::execute, tid); + //activate(0x15C74FE9C_g, 1, utils::hardware_breakpoint::execute, tid); + + OutputDebugStringA("Trigger..."); + //activate(0x1423339C0_g, 1, utils::hardware_breakpoint::read_write, tid); + //activate(0x15D0379D0_g, 1, utils::hardware_breakpoint::execute, tid); + + /* + activate(0x142AA20A1_g, 1, utils::hardware_breakpoint::read_write, tid); + activate(0x15BDEC91F_g, 1, utils::hardware_breakpoint::read_write, tid); + activate(0x15E4EBFA6_g, 1, utils::hardware_breakpoint::read_write, tid); + activate(0x15EA17E28_g, 1, utils::hardware_breakpoint::read_write, tid); + */ + //activate(0x15B7F5209_g, 4, utils::hardware_breakpoint::read_write, tid); + //activate(0x15EFBB508_g, 4, utils::hardware_breakpoint::read_write, tid); + //activate(0x15D0379CC_g, 4, utils::hardware_breakpoint::read_write, tid); + //activate(0x15D1177B8_g, 4, utils::hardware_breakpoint::read_write, tid); // Some integrity check patches. More to come. - /* + /*constexpr auto rdx_rbx = 0xda894890; + constexpr auto rcx_rdx = 0xd1894890; + constexpr auto rax_rcx = 0xc8894890; + constexpr auto rbx_rax = 0xc3894890; + utils::hook::nop(0x142AA20A1_g, 4); - utils::hook::set(0x15BDEC91F_g, 0xda894890); + utils::hook::set(0x15BDEC91F_g, rdx_rbx); utils::hook::nop(0x15E4EBFA6_g, 4); - utils::hook::set(0x15EA17E28_g, 0xd1894890); + utils::hook::set(0x15EA17E28_g, rcx_rdx); utils::hook::nop(0x15B7F5209_g, 6); - utils::hook::set(0x15EFBB508_g, 0xc3894890); + utils::hook::set(0x15EFBB508_g, rbx_rax); - utils::hook::set(0x15D0379CC_g, 0xda894890); // rdx, rbx - utils::hook::set(0x15D1177B8_g, 0xd1894890); // rcx, rdx - utils::hook::set(0x15BFFF30D_g, 0xda894890); // rdx, rbx - utils::hook::set(0x15DE3AAE7_g, 0xc8894890); // rax, rcx - utils::hook::set(0x15E48F80C_g, 0xc3894890); // rbx, rax - */ + utils::hook::set(0x15D0379CC_g, rdx_rbx); + utils::hook::set(0x15D1177B8_g, rcx_rdx); + utils::hook::set(0x15BFFF30D_g, rdx_rbx); + utils::hook::set(0x15DE3AAE7_g, rax_rcx); + utils::hook::set(0x15E48F80C_g, rbx_rax);*/ + + /*std::thread([tid]() + { + MessageBoxA(0, 0, 0, 0); + //utils::hook::set(0x1423339C0_g, 0xC3); + OutputDebugStringA("Logging..\n"); + activate(0x1423339C0_g, 1, utils::hardware_breakpoint::read_write, tid); + }).detach();*/ } void pre_destroy() override From 99400afa986373c0a3c110bfbceacb9ac9050db0 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Wed, 14 Sep 2022 20:30:10 +0200 Subject: [PATCH 2/9] First working patch with hooking support :D --- src/client/component/arxan.cpp | 127 +++++++++++++++++++++------------ 1 file changed, 81 insertions(+), 46 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index 2ac4b3c9..beafc707 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -482,6 +482,7 @@ namespace arxan } }; + bool patchMode = true; std::unordered_map integrity_handlers; void load_handlers() @@ -686,70 +687,102 @@ namespace arxan info->ContextRecord->EFlags |= 0x0100; const auto data = *reinterpret_cast(info->ContextRecord->Rip); - if ((data & 0xFFFFFF) == 0x8A0489 && !integrity_handlers.contains(info->ContextRecord->Rip)) + if ((data & 0xFFFFFF) == 0x8A0489) { - auto checksum = static_cast(info->ContextRecord->Rax); - auto offset = static_cast(info->ContextRecord->Rcx); - if (offset != 0) - { - OutputDebugStringA(utils::string::va("OFFSET: %X\n", offset)); - } + auto handler = integrity_handlers.find(info->ContextRecord->Rip); + const auto contains = handler != integrity_handlers.end(); - std::vector discoveries{}; - - for (uint32_t stack = 0x30; stack < 0x80; stack += 8) + if (patchMode) { - auto* value_ptr = *(uint32_t**)(info->ContextRecord->Rbp + stack); - auto* _addr = &value_ptr[offset]; - if (IsBadReadPtr(_addr, 4) || *_addr != checksum) + unprotect_texts(); + + if (!contains) { - continue; + OutputDebugStringA("Unknown handler executed :("); + return EXCEPTION_CONTINUE_EXECUTION; } - discoveries.push_back(stack); + const auto old = info->ContextRecord->Rax; + + auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + handler->second.frame_offset); + *h->computed_checksum = *h->original_checksum; + info->ContextRecord->Rax = *h->original_checksum; + + static bool once = false; + if (!once) + { + //once = true; + OutputDebugStringA(utils::string::va("Adjusted wrong checksum: %X -> %X (%X)", old, *h->original_checksum, handler->second.checksum)); + } + + return EXCEPTION_CONTINUE_EXECUTION; } - if (discoveries.size() != 2) + if (!contains) { - OutputDebugStringA(utils::string::va( - "!!! Unknown handler: %llX - Checksum: %X | rbp: %llX - offset: %X | discoveries: %zX", - info->ContextRecord->Rip, - checksum, info->ContextRecord->Rbp, offset, discoveries.size())); + auto checksum = static_cast(info->ContextRecord->Rax); + auto offset = static_cast(info->ContextRecord->Rcx); + if (offset != 0) + { + OutputDebugStringA(utils::string::va("OFFSET: %X\n", offset)); + } - for (auto discovery : discoveries) + std::vector discoveries{}; + + for (uint32_t stack = 0x30; stack < 0x80; stack += 8) + { + auto* value_ptr = *(uint32_t**)(info->ContextRecord->Rbp + stack); + auto* _addr = &value_ptr[offset]; + if (IsBadReadPtr(_addr, 4) || *_addr != checksum) + { + continue; + } + + discoveries.push_back(stack); + } + + if (discoveries.size() != 2) { OutputDebugStringA(utils::string::va( - "%X --> %llX", - discovery, *(uint32_t**)(info->ContextRecord->Rbp + discovery) + offset)); + "!!! Unknown handler: %llX - Checksum: %X | rbp: %llX - offset: %X | discoveries: %zX", + info->ContextRecord->Rip, + checksum, info->ContextRecord->Rbp, offset, discoveries.size())); + + for (auto discovery : discoveries) + { + OutputDebugStringA(utils::string::va( + "%X --> %llX", + discovery, *(uint32_t**)(info->ContextRecord->Rbp + discovery) + offset)); + } } - } - else - { - uint32_t* value_ptrs[] = { - *(uint32_t**)(info->ContextRecord->Rbp + discoveries[0]) + offset, - *(uint32_t**)(info->ContextRecord->Rbp + discoveries[1]) + offset - }; + else + { + uint32_t* value_ptrs[] = { + *(uint32_t**)(info->ContextRecord->Rbp + discoveries[0]) + offset, + *(uint32_t**)(info->ContextRecord->Rbp + discoveries[1]) + offset + }; - auto diff_0 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[0]); - auto diff_1 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[1]); + auto diff_0 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[0]); + auto diff_1 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[1]); - auto store_index = diff_0 < diff_1 ? 0 : 1; - auto other_index = 1 - store_index; + auto store_index = diff_0 < diff_1 ? 0 : 1; + auto other_index = 1 - store_index; - OutputDebugStringA(utils::string::va( - "Handler: %llX\t| Checksum: %X\t| Checksum in memory: %llX\t(%X)\t| Calculated checksum location: %llX\t(%X)", - info->ContextRecord->Rip, - checksum, value_ptrs[other_index], discoveries[other_index], value_ptrs[store_index], - discoveries[store_index])); + OutputDebugStringA(utils::string::va( + "Handler: %llX\t| Checksum: %X\t| Checksum in memory: %llX\t(%X)\t| Calculated checksum location: %llX\t(%X)", + info->ContextRecord->Rip, + checksum, value_ptrs[other_index], discoveries[other_index], value_ptrs[store_index], + discoveries[store_index])); - integrity_handler_data h{}; - h.address = reverse_g(info->ContextRecord->Rip); - h.checksum = checksum; - h.checksum_address = reverse_g(value_ptrs[other_index]); - h.frame_offset = discoveries[store_index]; + integrity_handler_data h{}; + h.address = reverse_g(info->ContextRecord->Rip); + h.checksum = checksum; + h.checksum_address = reverse_g(value_ptrs[other_index]); + h.frame_offset = discoveries[store_index]; - integrity_handlers[info->ContextRecord->Rip] = h; - write_handlers(); + integrity_handlers[info->ContextRecord->Rip] = h; + write_handlers(); + } } } /* OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr, @@ -903,6 +936,8 @@ namespace arxan { MessageBoxA(0, 0, 0, 0); protect_texts(); + if (patchMode) + utils::hook::set(0x1423339C0_g, 0xC3); }).detach(); From f768b276376583f3cd5290881422d291f3be9222 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Wed, 14 Sep 2022 21:23:19 +0200 Subject: [PATCH 3/9] Optimizations --- src/client/component/arxan.cpp | 36 ++++++++++++++++++++++++++++------ 1 file changed, 30 insertions(+), 6 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index beafc707..8e13b58e 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -482,7 +482,7 @@ namespace arxan } }; - bool patchMode = true; + bool patchMode = false; std::unordered_map integrity_handlers; void load_handlers() @@ -708,11 +708,14 @@ namespace arxan *h->computed_checksum = *h->original_checksum; info->ContextRecord->Rax = *h->original_checksum; - static bool once = false; - if (!once) + if (old != *h->original_checksum) { //once = true; - OutputDebugStringA(utils::string::va("Adjusted wrong checksum: %X -> %X (%X)", old, *h->original_checksum, handler->second.checksum)); + OutputDebugStringA(utils::string::va("Adjusted wrong checksum: %X -> %X", old, handler->second.checksum)); + } + else + { + OutputDebugStringA("Nothing to adjust"); } return EXCEPTION_CONTINUE_EXECUTION; @@ -936,8 +939,29 @@ namespace arxan { MessageBoxA(0, 0, 0, 0); protect_texts(); - if (patchMode) - utils::hook::set(0x1423339C0_g, 0xC3); + MessageBoxA(0, "PATCH?", 0, 0); + patchMode = true; + utils::hook::set(0x1423339C0_g, 0xC3); + + constexpr auto rdx_rbx = 0xda894890; + constexpr auto rcx_rdx = 0xd1894890; + constexpr auto rax_rcx = 0xc8894890; + constexpr auto rbx_rax = 0xc3894890; + + utils::hook::nop(0x142AA20A1_g, 4); + utils::hook::set(0x15BDEC91F_g, rdx_rbx); + + utils::hook::nop(0x15E4EBFA6_g, 4); + utils::hook::set(0x15EA17E28_g, rcx_rdx); + + utils::hook::nop(0x15B7F5209_g, 6); + utils::hook::set(0x15EFBB508_g, rbx_rax); + + utils::hook::set(0x15D0379CC_g, rdx_rbx); + utils::hook::set(0x15D1177B8_g, rcx_rdx); + utils::hook::set(0x15BFFF30D_g, rdx_rbx); + utils::hook::set(0x15DE3AAE7_g, rax_rcx); + utils::hook::set(0x15E48F80C_g, rbx_rax); }).detach(); From e761a12d8c341586833237241e863393d4583913 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Thu, 15 Sep 2022 19:07:47 +0200 Subject: [PATCH 4/9] Patch integrity checks using hooks --- src/client/component/arxan.cpp | 281 +++++++++++++++++++++++++-------- src/common/utils/hook.cpp | 2 +- 2 files changed, 216 insertions(+), 67 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index 8e13b58e..db373599 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -5,10 +5,11 @@ #include "steam/steam.hpp" #include +#include "utils/io.hpp" #include "utils/finally.hpp" #include "utils/string.hpp" +#include "utils/thread.hpp" #include "utils/hardware_breakpoint.hpp" -#include "utils/io.hpp" #define ProcessDebugPort 7 #define ProcessDebugObjectHandle 30 // WinXP source says 31? @@ -482,21 +483,25 @@ namespace arxan } }; - bool patchMode = false; std::unordered_map integrity_handlers; void load_handlers() { - std::string data{}; - if (!utils::io::read_file("integrity.txt", &data)) return; - - const auto lines = utils::string::split(data, '\n'); - for (const auto& line : lines) + static auto x = []() -> int { - if (line.empty())continue; - auto handler = integrity_handler_data::from_string(line); - integrity_handlers[operator"" _g(handler.address)] = handler; - } + std::string data{}; + if (!utils::io::read_file("integrity.txt", &data)) return 0; + + const auto lines = utils::string::split(data, '\n'); + for (const auto& line : lines) + { + if (line.empty())continue; + auto handler = integrity_handler_data::from_string(line); + integrity_handlers[operator"" _g(handler.address)] = handler; + } + return 0; + }(); + (void)x; } void write_handlers() @@ -511,6 +516,136 @@ namespace arxan utils::io::write_file("integrity.txt", txt); } + + uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, bool type) + { + if(type) + { + OutputDebugStringA("Type1"); + }else + { + OutputDebugStringA("Type2"); + } + // MessageBoxA(0, "III", 0, 0); + const auto handler_address = return_address - 5; + const auto handler = integrity_handlers.at(handler_address); + + const auto* context = reinterpret_cast(stack_frame + handler.frame_offset); + + if (*context->computed_checksum != *context->original_checksum) + { + OutputDebugStringA("Patching checksum :3"); + } + else + { + OutputDebugStringA("Not patching"); + } + + *context->computed_checksum = *context->original_checksum; + return *context->original_checksum; + } + + void patch_integrity_check(const integrity_handler_data& handler) + { + + OutputDebugStringA(utils::string::va("Patching: %llX", handler.address)); + + const auto game_address = operator"" _g(handler.address); + constexpr auto inst_len = 3; // mov [rdx+rcx*4], eax + + const auto next_inst_addr = game_address + inst_len; + const auto next_inst = *reinterpret_cast(next_inst_addr); + + // Basicblock is intact + if ((next_inst & 0xFF00FFFF) == 0xFF004583) + { + const uint8_t other_frame_offset = next_inst >> 16; + static const auto stub = utils::hook::assemble([](utils::hook::assembler& a) + { + a.mov(rax, qword_ptr(rsp)); + a.sub(rax, 2); // Skip the push we inserted + + a.push(rax); + a.pushad64(); + + a.mov(r8, 0); + a.mov(rcx, rax); + a.mov(rdx, rbp); + a.call_aligned(adjust_integrity_checksum); + + a.mov(qword_ptr(rsp, 0x80), rax); + + a.popad64(); + a.pop(rax); + + a.mov(dword_ptr(rdx, rcx, 4), eax); + + a.pop(rax); // return addr + a.xchg(rax, qword_ptr(rsp)); // switch with push + + a.add(dword_ptr(rbp, rax), 0xFFFFFFFF); + + a.mov(rax, dword_ptr(rdx, rcx, 4)); // restore rax + + a.ret(); + }); + + utils::hook::set(game_address, 0x6A | (other_frame_offset << 8)); // push other_frame_offset + utils::hook::call(game_address + 2, stub); + } + else if (*(uint8_t*)next_inst_addr == 0xE9) + { + const auto jump_target = utils::hook::extract(reinterpret_cast(next_inst_addr + 1)); + const auto stub = utils::hook::assemble([jump_target](utils::hook::assembler& a) + { + a.mov(rax, qword_ptr(rsp)); + + a.push(rax); + a.pushad64(); + + a.mov(r8, 1); + a.mov(rcx, rax); + a.mov(rdx, rbp); + a.call_aligned(adjust_integrity_checksum); + + a.mov(qword_ptr(rsp, 0x80), rax); + + a.popad64(); + a.pop(rax); + + a.mov(dword_ptr(rdx, rcx, 4), eax); + + a.add(rsp, 8); + + a.jmp(jump_target); + }); + + utils::hook::call(game_address, stub); + } + else + { + OutputDebugStringA(utils::string::va("Unknown :( %llX", game_address)); + } + + OutputDebugStringA(utils::string::va("Patching done: %llX", handler.address)); + } + + void patch_integrity_checks() + { + load_handlers(); + + //utils::thread::suspend_other_threads(); + + for (const auto& handler : integrity_handlers) + { + patch_integrity_check(handler.second); + // break; + } + + OutputDebugStringA("Done patching"); + //utils::thread::resume_other_threads(); + } + LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info) { static thread_local struct @@ -687,40 +822,11 @@ namespace arxan info->ContextRecord->EFlags |= 0x0100; const auto data = *reinterpret_cast(info->ContextRecord->Rip); - if ((data & 0xFFFFFF) == 0x8A0489) + if (was_in_texts(info->ContextRecord->Rip) && (data & 0xFFFFFF) == 0x8A0489) { auto handler = integrity_handlers.find(info->ContextRecord->Rip); const auto contains = handler != integrity_handlers.end(); - if (patchMode) - { - unprotect_texts(); - - if (!contains) - { - OutputDebugStringA("Unknown handler executed :("); - return EXCEPTION_CONTINUE_EXECUTION; - } - - const auto old = info->ContextRecord->Rax; - - auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + handler->second.frame_offset); - *h->computed_checksum = *h->original_checksum; - info->ContextRecord->Rax = *h->original_checksum; - - if (old != *h->original_checksum) - { - //once = true; - OutputDebugStringA(utils::string::va("Adjusted wrong checksum: %X -> %X", old, handler->second.checksum)); - } - else - { - OutputDebugStringA("Nothing to adjust"); - } - - return EXCEPTION_CONTINUE_EXECUTION; - } - if (!contains) { auto checksum = static_cast(info->ContextRecord->Rax); @@ -735,16 +841,19 @@ namespace arxan for (uint32_t stack = 0x30; stack < 0x80; stack += 8) { auto* value_ptr = *(uint32_t**)(info->ContextRecord->Rbp + stack); + auto* value_ptr2 = *(uint32_t**)(info->ContextRecord->Rbp + stack + 8); auto* _addr = &value_ptr[offset]; - if (IsBadReadPtr(_addr, 4) || *_addr != checksum) + auto* _addr2 = &value_ptr2[offset]; + if (IsBadReadPtr(_addr, 4) || *_addr != checksum || IsBadReadPtr(_addr2, 4)) { continue; } discoveries.push_back(stack); + break; } - if (discoveries.size() != 2) + if (discoveries.size() != 1) { OutputDebugStringA(utils::string::va( "!!! Unknown handler: %llX - Checksum: %X | rbp: %llX - offset: %X | discoveries: %zX", @@ -760,33 +869,61 @@ namespace arxan } else { - uint32_t* value_ptrs[] = { - *(uint32_t**)(info->ContextRecord->Rbp + discoveries[0]) + offset, - *(uint32_t**)(info->ContextRecord->Rbp + discoveries[1]) + offset - }; + auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + discoveries[0]); - auto diff_0 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[0]); - auto diff_1 = std::abs((int64_t)info->ContextRecord->Rbp - (int64_t)value_ptrs[1]); - - auto store_index = diff_0 < diff_1 ? 0 : 1; - auto other_index = 1 - store_index; + const auto correct_checksum = *h->original_checksum; OutputDebugStringA(utils::string::va( "Handler: %llX\t| Checksum: %X\t| Checksum in memory: %llX\t(%X)\t| Calculated checksum location: %llX\t(%X)", info->ContextRecord->Rip, - checksum, value_ptrs[other_index], discoveries[other_index], value_ptrs[store_index], - discoveries[store_index])); + correct_checksum, h->original_checksum, discoveries[0] + 8, h->computed_checksum, + discoveries[0])); + if (correct_checksum != checksum) + { + info->ContextRecord->Rax = correct_checksum; + *h->computed_checksum = correct_checksum; + OutputDebugStringA("Corrected checksum of new handler"); + } - integrity_handler_data h{}; - h.address = reverse_g(info->ContextRecord->Rip); - h.checksum = checksum; - h.checksum_address = reverse_g(value_ptrs[other_index]); - h.frame_offset = discoveries[store_index]; + integrity_handler_data hh{}; + hh.address = reverse_g(info->ContextRecord->Rip); + hh.checksum = correct_checksum; + hh.checksum_address = reverse_g(h->original_checksum); + hh.frame_offset = discoveries[0]; - integrity_handlers[info->ContextRecord->Rip] = h; + integrity_handlers[info->ContextRecord->Rip] = hh; write_handlers(); } } + else + { + /*OutputDebugStringA("Patching..."); + info->ContextRecord->EFlags &= ~0x0100; + analysis_context.needs_protect_change = false; + patch_integrity_check(handler->second);*/ + + //utils::thread::suspend_other_threads(); + //restore_debug_functions(); + //MessageBoxA(0,0,0,0); + + const auto old = info->ContextRecord->Rax; + + auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + handler->second.frame_offset); + + *h->computed_checksum = *h->original_checksum; + info->ContextRecord->Rax = *h->original_checksum; + + if (old != *h->original_checksum) + { + //once = true; + OutputDebugStringA(utils::string::va("Adjusted wrong checksum: %X -> %X", old, + handler->second.checksum)); + } + else + { + OutputDebugStringA("Nothing to adjust"); + } + } } /* OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr, reverse_g(addr), @@ -865,6 +1002,19 @@ namespace arxan return zw_terminate_process_hook.invoke(process_handle, exit_status); } + void verify_handlers() + { + for (auto& h : integrity_handlers) + { + if (h.second.checksum != *reinterpret_cast(operator"" _g(h.second.checksum_address))) + { + OutputDebugStringA(utils::string::va("Value does not match: %X -> %X | %llX", h.second.checksum, + *reinterpret_cast(operator"" _g( + h.second.checksum_address), h.second.address))); + } + } + } + class component final : public component_interface { public: @@ -938,10 +1088,10 @@ namespace arxan std::thread([]() { MessageBoxA(0, 0, 0, 0); - protect_texts(); - MessageBoxA(0, "PATCH?", 0, 0); - patchMode = true; - utils::hook::set(0x1423339C0_g, 0xC3); + protect_texts(); + patch_integrity_checks(); + //verify_handlers(); + /*utils::hook::set(0x1423339C0_g, 0xC3); constexpr auto rdx_rbx = 0xda894890; constexpr auto rcx_rdx = 0xd1894890; @@ -961,7 +1111,7 @@ namespace arxan utils::hook::set(0x15D1177B8_g, rcx_rdx); utils::hook::set(0x15BFFF30D_g, rdx_rbx); utils::hook::set(0x15DE3AAE7_g, rax_rcx); - utils::hook::set(0x15E48F80C_g, rbx_rax); + utils::hook::set(0x15E48F80C_g, rbx_rax);*/ }).detach(); @@ -969,7 +1119,6 @@ namespace arxan //activate(0x15D5F922A_g, 1, utils::hardware_breakpoint::execute, tid); //activate(0x15BCA4A2A_g, 1, utils::hardware_breakpoint::execute, tid); //activate(0x15C4BC192_g, 1, utils::hardware_breakpoint::execute, tid); - //activate(0x15DA1FBA1_g, 1, utils::hardware_breakpoint::execute, tid); // <-- //activate(0x15DB61C4A_g, 1, utils::hardware_breakpoint::execute, tid); //activate(0x15BE5BC6D_g, 1, utils::hardware_breakpoint::execute, tid); // <-- diff --git a/src/common/utils/hook.cpp b/src/common/utils/hook.cpp index 23badf2b..c7f506c7 100644 --- a/src/common/utils/hook.cpp +++ b/src/common/utils/hook.cpp @@ -43,7 +43,7 @@ namespace utils::hook } const auto res = VirtualAlloc(const_cast(target_address), size, MEM_RESERVE | MEM_COMMIT, - PAGE_READWRITE); + PAGE_EXECUTE_READWRITE); if (res) { if (is_relatively_far(base_address, target_address)) From 92312dcf2f4e6be01a9e508e3ed7fef67f3e87b3 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Thu, 15 Sep 2022 20:55:29 +0200 Subject: [PATCH 5/9] Formatting --- src/client/component/arxan.cpp | 249 +++++++++++++++++---------------- 1 file changed, 132 insertions(+), 117 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index db373599..c4bd52a0 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -434,8 +434,12 @@ namespace arxan return false; } + bool ignore = false; + void protect_texts() { + if(ignore) return; + const auto& texts = get_text_sections(); for (const auto& text : texts) { @@ -517,134 +521,134 @@ namespace arxan } - uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, bool type) - { - if(type) + uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, bool type) + { + if (type) { - OutputDebugStringA("Type1"); - }else - { - OutputDebugStringA("Type2"); + OutputDebugStringA("Type1"); } - // MessageBoxA(0, "III", 0, 0); - const auto handler_address = return_address - 5; - const auto handler = integrity_handlers.at(handler_address); - - const auto* context = reinterpret_cast(stack_frame + handler.frame_offset); - - if (*context->computed_checksum != *context->original_checksum) - { - OutputDebugStringA("Patching checksum :3"); - } - else - { - OutputDebugStringA("Not patching"); - } - - *context->computed_checksum = *context->original_checksum; - return *context->original_checksum; - } - - void patch_integrity_check(const integrity_handler_data& handler) - { - - OutputDebugStringA(utils::string::va("Patching: %llX", handler.address)); - - const auto game_address = operator"" _g(handler.address); - constexpr auto inst_len = 3; // mov [rdx+rcx*4], eax - - const auto next_inst_addr = game_address + inst_len; - const auto next_inst = *reinterpret_cast(next_inst_addr); - - // Basicblock is intact - if ((next_inst & 0xFF00FFFF) == 0xFF004583) - { - const uint8_t other_frame_offset = next_inst >> 16; - static const auto stub = utils::hook::assemble([](utils::hook::assembler& a) + else { - a.mov(rax, qword_ptr(rsp)); - a.sub(rax, 2); // Skip the push we inserted + OutputDebugStringA("Type2"); + } + // MessageBoxA(0, "III", 0, 0); + const auto handler_address = return_address - 5; + const auto handler = integrity_handlers.at(handler_address); - a.push(rax); - a.pushad64(); + const auto* context = reinterpret_cast(stack_frame + handler.frame_offset); - a.mov(r8, 0); - a.mov(rcx, rax); - a.mov(rdx, rbp); - a.call_aligned(adjust_integrity_checksum); - - a.mov(qword_ptr(rsp, 0x80), rax); - - a.popad64(); - a.pop(rax); - - a.mov(dword_ptr(rdx, rcx, 4), eax); - - a.pop(rax); // return addr - a.xchg(rax, qword_ptr(rsp)); // switch with push - - a.add(dword_ptr(rbp, rax), 0xFFFFFFFF); - - a.mov(rax, dword_ptr(rdx, rcx, 4)); // restore rax - - a.ret(); - }); - - utils::hook::set(game_address, 0x6A | (other_frame_offset << 8)); // push other_frame_offset - utils::hook::call(game_address + 2, stub); - } - else if (*(uint8_t*)next_inst_addr == 0xE9) - { - const auto jump_target = utils::hook::extract(reinterpret_cast(next_inst_addr + 1)); - const auto stub = utils::hook::assemble([jump_target](utils::hook::assembler& a) + if (*context->computed_checksum != *context->original_checksum) { - a.mov(rax, qword_ptr(rsp)); + OutputDebugStringA("Patching checksum :3"); + } + else + { + OutputDebugStringA("Not patching"); + } - a.push(rax); - a.pushad64(); - - a.mov(r8, 1); - a.mov(rcx, rax); - a.mov(rdx, rbp); - a.call_aligned(adjust_integrity_checksum); - - a.mov(qword_ptr(rsp, 0x80), rax); - - a.popad64(); - a.pop(rax); - - a.mov(dword_ptr(rdx, rcx, 4), eax); - - a.add(rsp, 8); - - a.jmp(jump_target); - }); - - utils::hook::call(game_address, stub); + *context->computed_checksum = *context->original_checksum; + return *context->original_checksum; } - else + + void patch_integrity_check(const integrity_handler_data& handler) { - OutputDebugStringA(utils::string::va("Unknown :( %llX", game_address)); - } + OutputDebugStringA(utils::string::va("Patching: %llX", handler.address)); + + const auto game_address = operator"" _g(handler.address); + constexpr auto inst_len = 3; // mov [rdx+rcx*4], eax + + const auto next_inst_addr = game_address + inst_len; + const auto next_inst = *reinterpret_cast(next_inst_addr); + + // Basicblock is intact + if ((next_inst & 0xFF00FFFF) == 0xFF004583) + { + const uint8_t other_frame_offset = next_inst >> 16; + static const auto stub = utils::hook::assemble([](utils::hook::assembler& a) + { + a.mov(rax, qword_ptr(rsp)); + a.sub(rax, 2); // Skip the push we inserted + + a.push(rax); + a.pushad64(); + + a.mov(r8, 0); + a.mov(rcx, rax); + a.mov(rdx, rbp); + a.call_aligned(adjust_integrity_checksum); + + a.mov(qword_ptr(rsp, 0x80), rax); + + a.popad64(); + a.pop(rax); + + a.mov(dword_ptr(rdx, rcx, 4), eax); + + a.pop(rax); // return addr + a.xchg(rax, qword_ptr(rsp)); // switch with push + + a.add(dword_ptr(rbp, rax), 0xFFFFFFFF); + + a.mov(rax, dword_ptr(rdx, rcx, 4)); // restore rax + + a.ret(); + }); + + utils::hook::set(game_address, 0x6A | (other_frame_offset << 8)); // push other_frame_offset + utils::hook::call(game_address + 2, stub); + } + else if (*(uint8_t*)next_inst_addr == 0xE9) + { + const auto jump_target = utils::hook::extract(reinterpret_cast(next_inst_addr + 1)); + const auto stub = utils::hook::assemble([jump_target](utils::hook::assembler& a) + { + a.mov(rax, qword_ptr(rsp)); + + a.push(rax); + a.pushad64(); + + a.mov(r8, 1); + a.mov(rcx, rax); + a.mov(rdx, rbp); + a.call_aligned(adjust_integrity_checksum); + + a.mov(qword_ptr(rsp, 0x80), rax); + + a.popad64(); + a.pop(rax); + + a.mov(dword_ptr(rdx, rcx, 4), eax); + + a.add(rsp, 8); + + a.jmp(jump_target); + }); + + utils::hook::call(game_address, stub); + } + else + { + OutputDebugStringA(utils::string::va("Unknown :( %llX", game_address)); + } OutputDebugStringA(utils::string::va("Patching done: %llX", handler.address)); - } - - void patch_integrity_checks() - { - load_handlers(); - - //utils::thread::suspend_other_threads(); - - for (const auto& handler : integrity_handlers) - { - patch_integrity_check(handler.second); - // break; } - OutputDebugStringA("Done patching"); - //utils::thread::resume_other_threads(); - } + void patch_integrity_checks() + { + load_handlers(); + + //utils::thread::suspend_other_threads(); + + for (const auto& handler : integrity_handlers) + { + patch_integrity_check(handler.second); + // break; + } + + OutputDebugStringA("Done patching"); + //utils::thread::resume_other_threads(); + } LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info) { @@ -909,7 +913,7 @@ namespace arxan const auto old = info->ContextRecord->Rax; auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + handler->second.frame_offset); - + *h->computed_checksum = *h->original_checksum; info->ContextRecord->Rax = *h->original_checksum; @@ -1085,11 +1089,22 @@ namespace arxan MessageBoxA(0, "done", 0, 0); */ + std::thread([]() { MessageBoxA(0, 0, 0, 0); - protect_texts(); + protect_texts(); patch_integrity_checks(); + + while (true) + { + MessageBoxA(0, "Remove guard", 0, 0); + ignore = true; + unprotect_texts(); + MessageBoxA(0, "Apply guard", 0, 0); + ignore = false; + protect_texts(); + } //verify_handlers(); /*utils::hook::set(0x1423339C0_g, 0xC3); From 7ea589d3b4339096b87ed9343281252c5aa90bc3 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Fri, 16 Sep 2022 17:18:20 +0200 Subject: [PATCH 6/9] Working integrity check bypass --- src/client/component/arxan.cpp | 108 ++++++++++++++++++++++++--------- 1 file changed, 80 insertions(+), 28 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index c4bd52a0..74ff5219 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -438,7 +438,7 @@ namespace arxan void protect_texts() { - if(ignore) return; + if (ignore) return; const auto& texts = get_text_sections(); for (const auto& text : texts) @@ -521,58 +521,81 @@ namespace arxan } - uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, bool type) + uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, const uint32_t current_checksum) { - if (type) + uint32_t frame_offset = 0; + const auto handler_address = return_address - 5; + const auto handler = integrity_handlers.find(handler_address); + if(handler != integrity_handlers.end()) { - OutputDebugStringA("Type1"); + frame_offset = handler->second.frame_offset; } else { - OutputDebugStringA("Type2"); - } - // MessageBoxA(0, "III", 0, 0); - const auto handler_address = return_address - 5; - const auto handler = integrity_handlers.at(handler_address); + for(frame_offset = 0x38; frame_offset < 0x90; frame_offset += 8) + { + auto* potential_address = *reinterpret_cast(stack_frame + frame_offset); - const auto* context = reinterpret_cast(stack_frame + handler.frame_offset); + int64_t diff = (uint64_t)stack_frame - (uint64_t)potential_address; + diff = std::abs(diff); + + if(diff < 0x1000 && *potential_address == current_checksum) + { + break; + } + } + + if(frame_offset >= 0x90) + { + OutputDebugStringA(utils::string::va("Unable to find frame offset for: %llX", return_address)); + return current_checksum; + } + else + { + //OutputDebugStringA("Found frame for unknown handler"); + } + } + + const auto* context = reinterpret_cast(stack_frame + frame_offset); if (*context->computed_checksum != *context->original_checksum) { - OutputDebugStringA("Patching checksum :3"); + OutputDebugStringA(utils::string::va("Adjusting checksum (%llX): %X -> %X", handler_address, *context->computed_checksum, *context->original_checksum)); } else { - OutputDebugStringA("Not patching"); + //OutputDebugStringA("Not patching"); } *context->computed_checksum = *context->original_checksum; return *context->original_checksum; } - void patch_integrity_check(const integrity_handler_data& handler) + void patch_integrity_check(void* address) { - OutputDebugStringA(utils::string::va("Patching: %llX", handler.address)); + //OutputDebugStringA(utils::string::va("Patching: %llX", address)); - const auto game_address = operator"" _g(handler.address); + const auto game_address = (uint64_t)address; constexpr auto inst_len = 3; // mov [rdx+rcx*4], eax const auto next_inst_addr = game_address + inst_len; const auto next_inst = *reinterpret_cast(next_inst_addr); - // Basicblock is intact + // Basic block is intact if ((next_inst & 0xFF00FFFF) == 0xFF004583) { const uint8_t other_frame_offset = next_inst >> 16; static const auto stub = utils::hook::assemble([](utils::hook::assembler& a) { - a.mov(rax, qword_ptr(rsp)); + a.push(rax); + + a.mov(rax, qword_ptr(rsp, 8)); a.sub(rax, 2); // Skip the push we inserted a.push(rax); a.pushad64(); - a.mov(r8, 0); + a.mov(r8, qword_ptr(rsp, 0x88)); a.mov(rcx, rax); a.mov(rdx, rbp); a.call_aligned(adjust_integrity_checksum); @@ -582,6 +605,8 @@ namespace arxan a.popad64(); a.pop(rax); + a.add(rsp, 8); + a.mov(dword_ptr(rdx, rcx, 4), eax); a.pop(rax); // return addr @@ -597,17 +622,20 @@ namespace arxan utils::hook::set(game_address, 0x6A | (other_frame_offset << 8)); // push other_frame_offset utils::hook::call(game_address + 2, stub); } + // Split basic blocks else if (*(uint8_t*)next_inst_addr == 0xE9) { const auto jump_target = utils::hook::extract(reinterpret_cast(next_inst_addr + 1)); const auto stub = utils::hook::assemble([jump_target](utils::hook::assembler& a) { - a.mov(rax, qword_ptr(rsp)); - a.push(rax); + + a.mov(rax, qword_ptr(rsp, 8)); + a.push(rax); + a.pushad64(); - a.mov(r8, 1); + a.mov(r8, qword_ptr(rsp, 0x88)); a.mov(rcx, rax); a.mov(rdx, rbp); a.call_aligned(adjust_integrity_checksum); @@ -617,6 +645,8 @@ namespace arxan a.popad64(); a.pop(rax); + a.add(rsp, 8); + a.mov(dword_ptr(rdx, rcx, 4), eax); a.add(rsp, 8); @@ -630,8 +660,6 @@ namespace arxan { OutputDebugStringA(utils::string::va("Unknown :( %llX", game_address)); } - - OutputDebugStringA(utils::string::va("Patching done: %llX", handler.address)); } void patch_integrity_checks() @@ -642,7 +670,7 @@ namespace arxan for (const auto& handler : integrity_handlers) { - patch_integrity_check(handler.second); + patch_integrity_check((void*)handler.first); // break; } @@ -650,6 +678,29 @@ namespace arxan //utils::thread::resume_other_threads(); } + void search_and_patch_integrity_checks() + { + OutputDebugStringA("Searching integrity handlers..."); + + auto intact_results = "89 04 8A 83 45 ? FF"_sig; + auto split_results = "89 04 8A E9"_sig; + + int count = 0; + for(auto i : intact_results) + { + patch_integrity_check(i); + ++count; + } + + for(auto i : split_results) + { + patch_integrity_check(i); + ++count; + } + + OutputDebugStringA(utils::string::va("Patched %i integrity handlers!", count)); + } + LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info) { static thread_local struct @@ -1089,12 +1140,13 @@ namespace arxan MessageBoxA(0, "done", 0, 0); */ + search_and_patch_integrity_checks(); - std::thread([]() + /*std::thread([]() { MessageBoxA(0, 0, 0, 0); protect_texts(); - patch_integrity_checks(); + search_and_patch_integrity_checks(); while (true) { @@ -1106,7 +1158,7 @@ namespace arxan protect_texts(); } //verify_handlers(); - /*utils::hook::set(0x1423339C0_g, 0xC3); + /utils::hook::set(0x1423339C0_g, 0xC3); constexpr auto rdx_rbx = 0xda894890; constexpr auto rcx_rdx = 0xd1894890; @@ -1127,7 +1179,7 @@ namespace arxan utils::hook::set(0x15BFFF30D_g, rdx_rbx); utils::hook::set(0x15DE3AAE7_g, rax_rcx); utils::hook::set(0x15E48F80C_g, rbx_rax);*/ - }).detach(); + //}).detach(); auto tid = GetCurrentThreadId(); From d616aa46cdbc18e6a452544f864abd13df131f73 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Fri, 16 Sep 2022 17:39:52 +0200 Subject: [PATCH 7/9] Cleanup code --- src/client/component/arxan.cpp | 750 +++++---------------------------- 1 file changed, 105 insertions(+), 645 deletions(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index 74ff5219..a1b884ce 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -393,602 +393,183 @@ namespace arxan loaded = true; } - const std::vector>& get_text_sections() - { - static const std::vector> text = [ - ]() -> std::vector> - { - std::vector> texts; - - const utils::nt::library game{}; - for (const auto& section : game.get_section_headers()) - { - std::string name(reinterpret_cast(section->Name), sizeof(section->Name)); - while (!name.empty() && !name.back()) name.pop_back(); - - if (name == ".text"s) - { - texts.emplace_back(game.get_ptr() + section->VirtualAddress, section->Misc.VirtualSize); - } - } - - return texts; - } - (); - - return text; - } - - bool was_in_texts(const ULONG_PTR addr) - { - const auto& texts = get_text_sections(); - for (const auto& text : texts) - { - if (addr >= reinterpret_cast(text.first) && addr <= reinterpret_cast(text.first + - text.second)) - { - return true; - } - } - - return false; - } - - bool ignore = false; - - void protect_texts() - { - if (ignore) return; - - const auto& texts = get_text_sections(); - for (const auto& text : texts) - { - DWORD old_protect{}; - VirtualProtect(text.first, text.second, PAGE_EXECUTE_READ, &old_protect); - } - } - - void unprotect_texts() - { - const auto& texts = get_text_sections(); - for (const auto& text : texts) - { - DWORD old_protect{}; - VirtualProtect(text.first, text.second, PAGE_EXECUTE_READWRITE, &old_protect); - } - } - struct integrity_handler_context { uint32_t* computed_checksum; uint32_t* original_checksum; }; - struct integrity_handler_data + // Pretty trashy, but working, heuristic to search integrity the handler context + bool is_handler_context(uint8_t* stack_frame, const uint32_t computed_checksum, const uint32_t frame_offset) { - uint64_t address; - uint64_t checksum_address; - uint32_t checksum; - uint32_t frame_offset; + auto* potential_address = *reinterpret_cast(stack_frame + frame_offset); - std::string to_string() const - { - return utils::string::va("%llX,%llX,%X,%X", this->address, this->checksum_address, this->checksum, - this->frame_offset); - } + int64_t diff = reinterpret_cast(stack_frame) - reinterpret_cast(potential_address); + diff = std::abs(diff); - static integrity_handler_data from_string(const std::string& line) - { - integrity_handler_data res{}; - sscanf_s(line.data(), "%llX,%llX,%X,%X", &res.address, &res.checksum_address, &res.checksum, - &res.frame_offset); + return diff < 0x1000 && *potential_address == computed_checksum; + } - return res; - } - }; - - std::unordered_map integrity_handlers; - - void load_handlers() + integrity_handler_context* search_handler_context(uint8_t* stack_frame, const uint32_t computed_checksum) { - static auto x = []() -> int + for (uint32_t frame_offset = 0x38; frame_offset < 0x90; frame_offset += 8) { - std::string data{}; - if (!utils::io::read_file("integrity.txt", &data)) return 0; - - const auto lines = utils::string::split(data, '\n'); - for (const auto& line : lines) + if (is_handler_context(stack_frame, computed_checksum, frame_offset)) { - if (line.empty())continue; - auto handler = integrity_handler_data::from_string(line); - integrity_handlers[operator"" _g(handler.address)] = handler; + return reinterpret_cast(stack_frame + frame_offset); } - return 0; - }(); - (void)x; - } - - void write_handlers() - { - std::string txt{}; - for (auto& h : integrity_handlers) - { - txt += h.second.to_string(); - txt += "\n"; } - utils::io::write_file("integrity.txt", txt); + return nullptr; } - - uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, const uint32_t current_checksum) + uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, + const uint32_t current_checksum) { - uint32_t frame_offset = 0; const auto handler_address = return_address - 5; - const auto handler = integrity_handlers.find(handler_address); - if(handler != integrity_handlers.end()) + const auto* context = search_handler_context(stack_frame, current_checksum); + + if (!context) { - frame_offset = handler->second.frame_offset; - } - else - { - for(frame_offset = 0x38; frame_offset < 0x90; frame_offset += 8) - { - auto* potential_address = *reinterpret_cast(stack_frame + frame_offset); - - int64_t diff = (uint64_t)stack_frame - (uint64_t)potential_address; - diff = std::abs(diff); - - if(diff < 0x1000 && *potential_address == current_checksum) - { - break; - } - } - - if(frame_offset >= 0x90) - { - OutputDebugStringA(utils::string::va("Unable to find frame offset for: %llX", return_address)); - return current_checksum; - } - else - { - //OutputDebugStringA("Found frame for unknown handler"); - } + OutputDebugStringA(utils::string::va("Unable to find frame offset for: %llX", return_address)); + return current_checksum; } - const auto* context = reinterpret_cast(stack_frame + frame_offset); + const auto correct_checksum = *context->original_checksum; + *context->computed_checksum = correct_checksum; - if (*context->computed_checksum != *context->original_checksum) + /*if (current_checksum != correct_checksum) { - OutputDebugStringA(utils::string::va("Adjusting checksum (%llX): %X -> %X", handler_address, *context->computed_checksum, *context->original_checksum)); - } - else - { - //OutputDebugStringA("Not patching"); - } + OutputDebugStringA(utils::string::va("Adjusting checksum (%llX): %X -> %X", handler_address, + current_checksum, correct_checksum)); + }*/ - *context->computed_checksum = *context->original_checksum; - return *context->original_checksum; + return correct_checksum; } - void patch_integrity_check(void* address) + void patch_intact_basic_block_integrity_check(void* address) { - //OutputDebugStringA(utils::string::va("Patching: %llX", address)); - - const auto game_address = (uint64_t)address; - constexpr auto inst_len = 3; // mov [rdx+rcx*4], eax + const auto game_address = reinterpret_cast(address); + constexpr auto inst_len = 3; const auto next_inst_addr = game_address + inst_len; const auto next_inst = *reinterpret_cast(next_inst_addr); - // Basic block is intact - if ((next_inst & 0xFF00FFFF) == 0xFF004583) + if ((next_inst & 0xFF00FFFF) != 0xFF004583) { - const uint8_t other_frame_offset = next_inst >> 16; - static const auto stub = utils::hook::assemble([](utils::hook::assembler& a) - { - a.push(rax); - - a.mov(rax, qword_ptr(rsp, 8)); - a.sub(rax, 2); // Skip the push we inserted - - a.push(rax); - a.pushad64(); - - a.mov(r8, qword_ptr(rsp, 0x88)); - a.mov(rcx, rax); - a.mov(rdx, rbp); - a.call_aligned(adjust_integrity_checksum); - - a.mov(qword_ptr(rsp, 0x80), rax); - - a.popad64(); - a.pop(rax); - - a.add(rsp, 8); - - a.mov(dword_ptr(rdx, rcx, 4), eax); - - a.pop(rax); // return addr - a.xchg(rax, qword_ptr(rsp)); // switch with push - - a.add(dword_ptr(rbp, rax), 0xFFFFFFFF); - - a.mov(rax, dword_ptr(rdx, rcx, 4)); // restore rax - - a.ret(); - }); - - utils::hook::set(game_address, 0x6A | (other_frame_offset << 8)); // push other_frame_offset - utils::hook::call(game_address + 2, stub); + throw std::runtime_error(utils::string::va("Unable to patch intact basic block: %llX", game_address)); } - // Split basic blocks - else if (*(uint8_t*)next_inst_addr == 0xE9) + + const auto other_frame_offset = static_cast(next_inst >> 16); + static const auto stub = utils::hook::assemble([](utils::hook::assembler& a) { - const auto jump_target = utils::hook::extract(reinterpret_cast(next_inst_addr + 1)); - const auto stub = utils::hook::assemble([jump_target](utils::hook::assembler& a) - { - a.push(rax); + a.push(rax); - a.mov(rax, qword_ptr(rsp, 8)); - a.push(rax); + a.mov(rax, qword_ptr(rsp, 8)); + a.sub(rax, 2); // Skip the push we inserted - a.pushad64(); + a.push(rax); + a.pushad64(); - a.mov(r8, qword_ptr(rsp, 0x88)); - a.mov(rcx, rax); - a.mov(rdx, rbp); - a.call_aligned(adjust_integrity_checksum); + a.mov(r8, qword_ptr(rsp, 0x88)); + a.mov(rcx, rax); + a.mov(rdx, rbp); + a.call_aligned(adjust_integrity_checksum); - a.mov(qword_ptr(rsp, 0x80), rax); + a.mov(qword_ptr(rsp, 0x80), rax); - a.popad64(); - a.pop(rax); + a.popad64(); + a.pop(rax); - a.add(rsp, 8); + a.add(rsp, 8); - a.mov(dword_ptr(rdx, rcx, 4), eax); + a.mov(dword_ptr(rdx, rcx, 4), eax); - a.add(rsp, 8); + a.pop(rax); // return addr + a.xchg(rax, qword_ptr(rsp)); // switch with push - a.jmp(jump_target); - }); + a.add(dword_ptr(rbp, rax), 0xFFFFFFFF); - utils::hook::call(game_address, stub); - } - else - { - OutputDebugStringA(utils::string::va("Unknown :( %llX", game_address)); - } + a.mov(rax, dword_ptr(rdx, rcx, 4)); // restore rax + + a.ret(); + }); + + // push other_frame_offset + utils::hook::set(game_address, static_cast(0x6A | (other_frame_offset << 8))); + utils::hook::call(game_address + 2, stub); } - void patch_integrity_checks() + void patch_split_basic_block_integrity_check(void* address) { - load_handlers(); + const auto game_address = reinterpret_cast(address); + constexpr auto inst_len = 3; - //utils::thread::suspend_other_threads(); + const auto next_inst_addr = game_address + inst_len; - for (const auto& handler : integrity_handlers) + if (*reinterpret_cast(next_inst_addr) != 0xE9) { - patch_integrity_check((void*)handler.first); - // break; + throw std::runtime_error(utils::string::va("Unable to patch split basic block: %llX", game_address)); } - OutputDebugStringA("Done patching"); - //utils::thread::resume_other_threads(); + const auto jump_target = utils::hook::extract(reinterpret_cast(next_inst_addr + 1)); + const auto stub = utils::hook::assemble([jump_target](utils::hook::assembler& a) + { + a.push(rax); + + a.mov(rax, qword_ptr(rsp, 8)); + a.push(rax); + + a.pushad64(); + + a.mov(r8, qword_ptr(rsp, 0x88)); + a.mov(rcx, rax); + a.mov(rdx, rbp); + a.call_aligned(adjust_integrity_checksum); + + a.mov(qword_ptr(rsp, 0x80), rax); + + a.popad64(); + a.pop(rax); + + a.add(rsp, 8); + + a.mov(dword_ptr(rdx, rcx, 4), eax); + + a.add(rsp, 8); + + a.jmp(jump_target); + }); + + utils::hook::call(game_address, stub); } void search_and_patch_integrity_checks() { - OutputDebugStringA("Searching integrity handlers..."); + // There seem to be 1219 results. + // Searching them is quite slow. + // Maybe precomputing that might be better? + const auto intact_results = "89 04 8A 83 45 ? FF"_sig; + const auto split_results = "89 04 8A E9"_sig; - auto intact_results = "89 04 8A 83 45 ? FF"_sig; - auto split_results = "89 04 8A E9"_sig; - - int count = 0; - for(auto i : intact_results) + for (auto* i : intact_results) { - patch_integrity_check(i); - ++count; + patch_intact_basic_block_integrity_check(i); } - for(auto i : split_results) + for (auto* i : split_results) { - patch_integrity_check(i); - ++count; + patch_split_basic_block_integrity_check(i); } - - OutputDebugStringA(utils::string::va("Patched %i integrity handlers!", count)); } LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info) { - static thread_local struct - { - bool needs_protect_change = false; - bool had_single_step = false; - } analysis_context{}; - if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE) { return EXCEPTION_CONTINUE_EXECUTION; } - if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP && false) - { - auto dr6_clear = utils::finally([info] - { - info->ContextRecord->Dr6 = 0; - }); - - //utils::thread::suspend_other_threads(); - //restore_debug_functions(); - //MessageBoxA(0, "SS", 0, 0); - static uint64_t addr = 0; - /*if (info->ContextRecord->Rip == 0x15E4EBF6B_g) - { - OutputDebugStringA(utils::string::va("Lul: %X | %X", (uint32_t)info->ContextRecord->Rax, - (uint32_t)info->ContextRecord->Rdx)); - - return EXCEPTION_CONTINUE_EXECUTION; - }*/ - - static const std::unordered_map> lulul = { - {0x15AF356A9_g, {0x58, true}}, - {0x15BC7D9D4_g, {0x54, false}}, // ? - {0x15BC4905F_g, {0x64, true}}, - {0x15B2D7326_g, {0x64, true}}, - {0x15B4ABC16_g, {0x5C, true}}, - - {0x15EF9A75B_g, {0x54, true}}, - {0x15E5FD1E9_g, {0x58, true}}, - {0x15CA3965D_g, {0x58, true}}, - {0x15F3397B2_g, {0x64, true}}, - {0x15DCB1A2C_g, {0x50, true}}, - {0x15F6B4001_g, {0x5C, true}}, - {0x15BE521F1_g, {0x5C, true}}, - - {0x15F6AE373_g, {0x54, true}}, - {0x15C4CACB2_g, {0x54, true}}, - {0x15EF6AF3F_g, {0x5C, true}}, - {0x15BB1DAB8_g, {0x5C, true}}, - {0x15D1C5569_g, {0x50, false}}, // -> 15EAE384F, 15EA9C476 - {0x15BF469D7_g, {0x5C, true}}, - {0x15F9801A6_g, {0x60, false}}, // -> 15C2B8D85, 15D93EF1E - {0x15B5C48A3_g, {0x60, true}}, - {0x15E49ABC2_g, {0x64, true}}, - //{0x_g, {0x0, true}}, - - // OLD - - {0x15C0EDE96_g, {0x58, false}}, // -> 15D390285, 15CE36ADD, 15BDEC8E2 - {0x15F0643FD_g, {0x58, false}}, // -> 14219FDD3, 15E4EBF68, 15C02F8BD -> 4FF3DF01 - {0x142306BD9_g, {0x50, false}}, // -> 15B923CD2, 15B7F5204, 15EFBB4C9 - - {0x15BEA0BE8_g, {0x60, false}}, // -> 15B2FB386, 15D0379AC - {0x15CC4E93C_g, {0x60, false}}, // -> 15CCDC12E, 15DB862E9 - {0x15C2BB16B_g, {0x50, false}}, // -> 15EEC0E00, 15F5CA333 - {0x15C34F5BB_g, {0x58, false}}, // -> 15D7FFF48, 15CAAB671 - {0x15EA91E38_g, {0x50, false}}, // -> 15E54D475, 15F5C90B6 -> 4B7F42B5 - - {0x15C998E3C_g, {0x5C, false}}, // ? - {0x15EA018CD_g, {0x5C, false}}, // ? - {0x15C591543_g, {0x54, false}}, // ? - {0x15F9ADF78_g, {0x6C, false}}, // ? - - {0x15D5F91F7_g, {0x58, false}}, // <- 0x15F0643FD - {0x15D5F91E4_g, {0x58, false}}, // <- 0x15F0643FD - }; - - if (!addr && lulul.contains(info->ContextRecord->Rip) && lulul.at(info->ContextRecord->Rip).second) - { - addr = info->ContextRecord->Rbp + lulul.at(info->ContextRecord->Rip).first; - - OutputDebugStringA(utils::string::va("Begin Trace: %llX -> %llX", info->ContextRecord->Rip, addr)); - utils::hardware_breakpoint::deactivate_all(*info->ContextRecord); - activate(addr, 4, utils::hardware_breakpoint::read_write, *info->ContextRecord); - //activate(0x15E4EBFAA_g, 1, utils::hardware_breakpoint::execute, *info->ContextRecord); - - //info->ContextRecord->Rax = 0xC3; - //utils::hook::nop(0x15E4EBFA6_g, 4); - //utils::hook::nop(0x15EA17E28_g, 4); - - return EXCEPTION_CONTINUE_EXECUTION; - } - else if (!lulul.contains(info->ContextRecord->Rip)) - { - if (addr) - { - static std::unordered_set aaa; - if (aaa.emplace(info->ContextRecord->Rip).second) - { - /*if (info->ContextRecord->Rip == 0x14219FDD3_g) - { - OutputDebugStringA(utils::string::va("OOO: %X - %llX | %llX", - *(uint32_t*)addr, info->ContextRecord->Rcx, - 0x1421E54A7_g + info->ContextRecord->Rcx * 4)); - *(uint32_t*)addr = 0x4FF3DF01; - //info->ContextRecord->Rax = 0x4FF3DF01; - utils::hardware_breakpoint::deactivate_all(*info->ContextRecord); - }*/ - if (info->ContextRecord->Rip == 0x15E4EBF68_g) - { - auto other = info->ContextRecord->Rbx + info->ContextRecord->Rcx * 4; - OutputDebugStringA(utils::string::va("Singlestep: %llX | %X | %X | %llX", - info->ContextRecord->Rip, - *(uint32_t*)addr, *(uint32_t*)other, other)); - utils::hardware_breakpoint::deactivate_all(*info->ContextRecord); - } - else - { - OutputDebugStringA(utils::string::va("Singlestep: %llX | %X", - info->ContextRecord->Rip, *(uint32_t*)addr)); - } - } - } - else - { - static std::unordered_set bbb; - if (!lulul.contains(info->ContextRecord->Rip) && bbb.emplace(info->ContextRecord->Rip).second) - { - OutputDebugStringA(utils::string::va("Singlestep: %llX", info->ContextRecord->Rip)); - } - } - } - - return EXCEPTION_CONTINUE_EXECUTION; - } - - - if (info->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) - { - if (!analysis_context.needs_protect_change) - { - return EXCEPTION_CONTINUE_SEARCH; - } - - analysis_context.needs_protect_change = false; - - if (!analysis_context.had_single_step) - { - info->ContextRecord->EFlags &= 0x0100; - } - - protect_texts(); - return EXCEPTION_CONTINUE_EXECUTION; - } - - if (info->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION) - { - // Was write? - if (info->ExceptionRecord->ExceptionInformation[0] != 1) - { - return EXCEPTION_CONTINUE_SEARCH; - } - - const auto addr = info->ExceptionRecord->ExceptionInformation[1]; - if (!was_in_texts(addr)) - { - return EXCEPTION_CONTINUE_SEARCH; - } - - analysis_context.needs_protect_change = true; - analysis_context.had_single_step = info->ContextRecord->EFlags & 0x0100; - info->ContextRecord->EFlags |= 0x0100; - - const auto data = *reinterpret_cast(info->ContextRecord->Rip); - if (was_in_texts(info->ContextRecord->Rip) && (data & 0xFFFFFF) == 0x8A0489) - { - auto handler = integrity_handlers.find(info->ContextRecord->Rip); - const auto contains = handler != integrity_handlers.end(); - - if (!contains) - { - auto checksum = static_cast(info->ContextRecord->Rax); - auto offset = static_cast(info->ContextRecord->Rcx); - if (offset != 0) - { - OutputDebugStringA(utils::string::va("OFFSET: %X\n", offset)); - } - - std::vector discoveries{}; - - for (uint32_t stack = 0x30; stack < 0x80; stack += 8) - { - auto* value_ptr = *(uint32_t**)(info->ContextRecord->Rbp + stack); - auto* value_ptr2 = *(uint32_t**)(info->ContextRecord->Rbp + stack + 8); - auto* _addr = &value_ptr[offset]; - auto* _addr2 = &value_ptr2[offset]; - if (IsBadReadPtr(_addr, 4) || *_addr != checksum || IsBadReadPtr(_addr2, 4)) - { - continue; - } - - discoveries.push_back(stack); - break; - } - - if (discoveries.size() != 1) - { - OutputDebugStringA(utils::string::va( - "!!! Unknown handler: %llX - Checksum: %X | rbp: %llX - offset: %X | discoveries: %zX", - info->ContextRecord->Rip, - checksum, info->ContextRecord->Rbp, offset, discoveries.size())); - - for (auto discovery : discoveries) - { - OutputDebugStringA(utils::string::va( - "%X --> %llX", - discovery, *(uint32_t**)(info->ContextRecord->Rbp + discovery) + offset)); - } - } - else - { - auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + discoveries[0]); - - const auto correct_checksum = *h->original_checksum; - - OutputDebugStringA(utils::string::va( - "Handler: %llX\t| Checksum: %X\t| Checksum in memory: %llX\t(%X)\t| Calculated checksum location: %llX\t(%X)", - info->ContextRecord->Rip, - correct_checksum, h->original_checksum, discoveries[0] + 8, h->computed_checksum, - discoveries[0])); - if (correct_checksum != checksum) - { - info->ContextRecord->Rax = correct_checksum; - *h->computed_checksum = correct_checksum; - OutputDebugStringA("Corrected checksum of new handler"); - } - - integrity_handler_data hh{}; - hh.address = reverse_g(info->ContextRecord->Rip); - hh.checksum = correct_checksum; - hh.checksum_address = reverse_g(h->original_checksum); - hh.frame_offset = discoveries[0]; - - integrity_handlers[info->ContextRecord->Rip] = hh; - write_handlers(); - } - } - else - { - /*OutputDebugStringA("Patching..."); - info->ContextRecord->EFlags &= ~0x0100; - analysis_context.needs_protect_change = false; - patch_integrity_check(handler->second);*/ - - //utils::thread::suspend_other_threads(); - //restore_debug_functions(); - //MessageBoxA(0,0,0,0); - - const auto old = info->ContextRecord->Rax; - - auto h = (integrity_handler_context*)(info->ContextRecord->Rbp + handler->second.frame_offset); - - *h->computed_checksum = *h->original_checksum; - info->ContextRecord->Rax = *h->original_checksum; - - if (old != *h->original_checksum) - { - //once = true; - OutputDebugStringA(utils::string::va("Adjusted wrong checksum: %X -> %X", old, - handler->second.checksum)); - } - else - { - OutputDebugStringA("Nothing to adjust"); - } - } - } - /* OutputDebugStringA(utils::string::va("Switch at: %llX -> %llX (%llX -> %llX)", addr, - reverse_g(addr), - info->ContextRecord->Rip, - reverse_g(info->ContextRecord->Rip)));*/ - - unprotect_texts(); - return EXCEPTION_CONTINUE_EXECUTION; - } - return EXCEPTION_CONTINUE_SEARCH; } @@ -1057,19 +638,6 @@ namespace arxan return zw_terminate_process_hook.invoke(process_handle, exit_status); } - void verify_handlers() - { - for (auto& h : integrity_handlers) - { - if (h.second.checksum != *reinterpret_cast(operator"" _g(h.second.checksum_address))) - { - OutputDebugStringA(utils::string::va("Value does not match: %X -> %X | %llX", h.second.checksum, - *reinterpret_cast(operator"" _g( - h.second.checksum_address), h.second.address))); - } - } - } - class component final : public component_interface { public: @@ -1089,8 +657,6 @@ namespace arxan hide_being_debugged(); scheduler::loop(hide_being_debugged, scheduler::pipeline::async); - load_handlers(); - create_thread_hook.create(CreateThread, create_thread_stub); create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub); @@ -1135,114 +701,8 @@ namespace arxan void post_unpack() override { - //restore_debug_functions(); - /* - MessageBoxA(0, "done", 0, 0); - */ - search_and_patch_integrity_checks(); - - /*std::thread([]() - { - MessageBoxA(0, 0, 0, 0); - protect_texts(); - search_and_patch_integrity_checks(); - - while (true) - { - MessageBoxA(0, "Remove guard", 0, 0); - ignore = true; - unprotect_texts(); - MessageBoxA(0, "Apply guard", 0, 0); - ignore = false; - protect_texts(); - } - //verify_handlers(); - /utils::hook::set(0x1423339C0_g, 0xC3); - - constexpr auto rdx_rbx = 0xda894890; - constexpr auto rcx_rdx = 0xd1894890; - constexpr auto rax_rcx = 0xc8894890; - constexpr auto rbx_rax = 0xc3894890; - - utils::hook::nop(0x142AA20A1_g, 4); - utils::hook::set(0x15BDEC91F_g, rdx_rbx); - - utils::hook::nop(0x15E4EBFA6_g, 4); - utils::hook::set(0x15EA17E28_g, rcx_rdx); - - utils::hook::nop(0x15B7F5209_g, 6); - utils::hook::set(0x15EFBB508_g, rbx_rax); - - utils::hook::set(0x15D0379CC_g, rdx_rbx); - utils::hook::set(0x15D1177B8_g, rcx_rdx); - utils::hook::set(0x15BFFF30D_g, rdx_rbx); - utils::hook::set(0x15DE3AAE7_g, rax_rcx); - utils::hook::set(0x15E48F80C_g, rbx_rax);*/ - //}).detach(); - - - auto tid = GetCurrentThreadId(); - //activate(0x15D5F922A_g, 1, utils::hardware_breakpoint::execute, tid); - //activate(0x15BCA4A2A_g, 1, utils::hardware_breakpoint::execute, tid); - //activate(0x15C4BC192_g, 1, utils::hardware_breakpoint::execute, tid); - - //activate(0x15DB61C4A_g, 1, utils::hardware_breakpoint::execute, tid); - //activate(0x15BE5BC6D_g, 1, utils::hardware_breakpoint::execute, tid); // <-- - - //activate(0x15B88A716_g, 1, utils::hardware_breakpoint::execute, tid); - //activate(0x15DBD74A0_g, 1, utils::hardware_breakpoint::execute, tid); // <-- - - //activate(0x15CA2514F_g, 1, utils::hardware_breakpoint::execute, tid); // <-- - //activate(0x15CD0B431_g, 1, utils::hardware_breakpoint::execute, tid); - - //activate(0x15B8447FF_g, 1, utils::hardware_breakpoint::execute, tid); - //activate(0x15C74FE9C_g, 1, utils::hardware_breakpoint::execute, tid); - - OutputDebugStringA("Trigger..."); - //activate(0x1423339C0_g, 1, utils::hardware_breakpoint::read_write, tid); - //activate(0x15D0379D0_g, 1, utils::hardware_breakpoint::execute, tid); - - /* - activate(0x142AA20A1_g, 1, utils::hardware_breakpoint::read_write, tid); - activate(0x15BDEC91F_g, 1, utils::hardware_breakpoint::read_write, tid); - activate(0x15E4EBFA6_g, 1, utils::hardware_breakpoint::read_write, tid); - activate(0x15EA17E28_g, 1, utils::hardware_breakpoint::read_write, tid); - */ - //activate(0x15B7F5209_g, 4, utils::hardware_breakpoint::read_write, tid); - //activate(0x15EFBB508_g, 4, utils::hardware_breakpoint::read_write, tid); - //activate(0x15D0379CC_g, 4, utils::hardware_breakpoint::read_write, tid); - //activate(0x15D1177B8_g, 4, utils::hardware_breakpoint::read_write, tid); - - // Some integrity check patches. More to come. - - /*constexpr auto rdx_rbx = 0xda894890; - constexpr auto rcx_rdx = 0xd1894890; - constexpr auto rax_rcx = 0xc8894890; - constexpr auto rbx_rax = 0xc3894890; - - utils::hook::nop(0x142AA20A1_g, 4); - utils::hook::set(0x15BDEC91F_g, rdx_rbx); - - utils::hook::nop(0x15E4EBFA6_g, 4); - utils::hook::set(0x15EA17E28_g, rcx_rdx); - - utils::hook::nop(0x15B7F5209_g, 6); - utils::hook::set(0x15EFBB508_g, rbx_rax); - - utils::hook::set(0x15D0379CC_g, rdx_rbx); - utils::hook::set(0x15D1177B8_g, rcx_rdx); - utils::hook::set(0x15BFFF30D_g, rdx_rbx); - utils::hook::set(0x15DE3AAE7_g, rax_rcx); - utils::hook::set(0x15E48F80C_g, rbx_rax);*/ - - /*std::thread([tid]() - { - MessageBoxA(0, 0, 0, 0); - //utils::hook::set(0x1423339C0_g, 0xC3); - OutputDebugStringA("Logging..\n"); - activate(0x1423339C0_g, 1, utils::hardware_breakpoint::read_write, tid); - }).detach();*/ + //restore_debug_functions(); } void pre_destroy() override From 7750233435291682dba5fea175f1a1f6d7b9ad71 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Fri, 16 Sep 2022 17:40:29 +0200 Subject: [PATCH 8/9] Yeah baby --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 3b9014a6..9294e6f9 100644 --- a/README.md +++ b/README.md @@ -16,8 +16,8 @@ Reverse engineering and analysis of Call of Duty: Black Ops 3. Very experimental - [x] Offline Multiplayer/Zombies/Campaign Support - [x] RE Tool Detection Bypass (IDA Pro, HxD, ...) - [x] Disable Hardware Breakpoint Detection +- [x] Disable Integrity Checks - [ ] Disable Anti-Debugging Mechanisms -- [ ] Disable Integrity Checks - [ ] Demonware Emulation ## Download From 9b6dfe6d5aa825c319567a35cfe68bfaa3ccf060 Mon Sep 17 00:00:00 2001 From: momo5502 Date: Fri, 16 Sep 2022 17:43:56 +0200 Subject: [PATCH 9/9] Fix build --- src/client/component/arxan.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/client/component/arxan.cpp b/src/client/component/arxan.cpp index a1b884ce..21178d29 100644 --- a/src/client/component/arxan.cpp +++ b/src/client/component/arxan.cpp @@ -426,7 +426,7 @@ namespace arxan uint32_t adjust_integrity_checksum(const uint64_t return_address, uint8_t* stack_frame, const uint32_t current_checksum) { - const auto handler_address = return_address - 5; + //const auto handler_address = return_address - 5; const auto* context = search_handler_context(stack_frame, current_checksum); if (!context)