#include #include "loader/component_loader.hpp" #include "scheduler.hpp" #include "steam/steam.hpp" #include #define ProcessDebugPort 7 #define ProcessDebugObjectHandle 30 // WinXP source says 31? #define ProcessDebugFlags 31 // WinXP source says 32? namespace arxan { namespace { const auto pseudo_steam_id = 0x1337; const auto pseudo_steam_handle = reinterpret_cast(reinterpret_cast(INVALID_HANDLE_VALUE) - pseudo_steam_id); utils::hook::detour nt_close_hook; utils::hook::detour nt_query_system_information_hook; utils::hook::detour nt_query_information_process_hook; utils::hook::detour create_mutex_ex_a_hook; utils::hook::detour open_process_hook; HANDLE process_id_to_handle(const DWORD pid) { return reinterpret_cast(static_cast(pid)); } void check_steam_install() { if (!*steam::SteamAPI_GetSteamInstallPath()) { MessageBoxA(nullptr, "Steam must be installed for the game to run. Please install steam!", "Error", MB_ICONERROR); TerminateProcess(GetCurrentProcess(), 1); } } HANDLE WINAPI open_process_stub(const DWORD access, const BOOL inherit, const DWORD pid) { if (pid == pseudo_steam_id) { return pseudo_steam_handle; } return open_process_hook.invoke(access, inherit, pid); } HANDLE create_mutex_ex_a_stub(const LPSECURITY_ATTRIBUTES attributes, const LPCSTR name, const DWORD flags, const DWORD access) { if (name == "$ IDA trusted_idbs"s || name == "$ IDA registry mutex $"s) { return nullptr; } return create_mutex_ex_a_hook.invoke(attributes, name, flags, access); } bool remove_evil_keywords_from_string(const UNICODE_STRING& string) { static const std::wstring evil_keywords[] = { L"IDA", L"ida", L"HxD", L"cheatengine", L"Cheat Engine", }; if (!string.Buffer || !string.Length) { return false; } std::wstring_view path(string.Buffer, string.Length / sizeof(string.Buffer[0])); bool modified = false; for (const auto& keyword : evil_keywords) { while (true) { const auto pos = path.find(keyword); if (pos == std::wstring::npos) { break; } modified = true; for (size_t i = 0; i < keyword.size(); ++i) { string.Buffer[pos + i] = L'a'; } } } return modified; } bool remove_evil_keywords_from_string(wchar_t* str, const size_t length) { UNICODE_STRING unicode_string{}; unicode_string.Buffer = str; unicode_string.Length = static_cast(length); unicode_string.MaximumLength = unicode_string.Length; return remove_evil_keywords_from_string(unicode_string); } bool remove_evil_keywords_from_string(char* str, const size_t length) { std::string_view str_view(str, length); std::wstring wstr(str_view.begin(), str_view.end()); if (!remove_evil_keywords_from_string(&wstr[0], wstr.size())) { return false; } const std::string regular_str(wstr.begin(), wstr.end()); memcpy(str, regular_str.data(), length); return true; } int WINAPI get_window_text_a_stub(const HWND wnd, const LPSTR str, const int max_count) { std::wstring wstr{}; wstr.resize(max_count); const auto res = GetWindowTextW(wnd, &wstr[0], max_count); if (res) { remove_evil_keywords_from_string(wstr.data(), res); const std::string regular_str(wstr.begin(), wstr.end()); memset(str, 0, max_count); memcpy(str, regular_str.data(), res); } return res; } NTSTATUS NTAPI nt_query_system_information_stub(const SYSTEM_INFORMATION_CLASS system_information_class, const PVOID system_information, const ULONG system_information_length, const PULONG return_length) { const auto status = nt_query_system_information_hook.invoke( system_information_class, system_information, system_information_length, return_length); if (NT_SUCCESS(status)) { if (system_information_class == SystemProcessInformation) { bool injected_steam = false; auto addr = static_cast(system_information); while (true) { const auto info = reinterpret_cast(addr); remove_evil_keywords_from_string(info->ImageName); static const auto our_pid = process_id_to_handle(GetCurrentProcessId()); if (!injected_steam && info->UniqueProcessId != our_pid) { static wchar_t steam_path[] = L"steam.exe"; info->UniqueProcessId = process_id_to_handle(pseudo_steam_id); info->ImageName.Buffer = steam_path; info->ImageName.Length = static_cast(wcslen(steam_path) * 2u); info->ImageName.MaximumLength = info->ImageName.Length; injected_steam = true; } if (!info->NextEntryOffset) { break; } addr = addr + info->NextEntryOffset; } } } return status; } bool handle_pseudo_steam_process(const HANDLE handle, const PROCESSINFOCLASS info_class, const PVOID info, const ULONG info_length, const PULONG ret_length, NTSTATUS* status) { if (handle != pseudo_steam_handle || info_class != 43) { return false; } const auto steam_folder = steam::SteamAPI_GetSteamInstallPath(); const auto steam_path = steam_folder + "\\steam.exe"s; const std::wstring wide_path(steam_path.begin(), steam_path.end()); const auto required_size = static_cast((wide_path.size() + 1u) * 2u + sizeof(UNICODE_STRING)); if (ret_length) { *ret_length = required_size; } if (info_length < required_size) { *status = static_cast(0xC0000004); return true; } memset(info, 0, info_length); auto& str = *static_cast(info); str.Buffer = reinterpret_cast(&str + 1); str.Length = static_cast(wide_path.size() * 2u); str.MaximumLength = str.Length; memcpy(str.Buffer, wide_path.data(), str.Length); *status = 0; return true; } NTSTATUS WINAPI nt_query_information_process_stub(const HANDLE handle, const PROCESSINFOCLASS info_class, const PVOID info, const ULONG info_length, const PULONG ret_length) { NTSTATUS status{0}; if (handle_pseudo_steam_process(handle, info_class, info, info_length, ret_length, &status)) { return status; } status = nt_query_information_process_hook.invoke(handle, info_class, info, info_length, ret_length); if (NT_SUCCESS(status)) { if (info_class == ProcessBasicInformation) { static_cast(info)->Reserved3 = process_id_to_handle(pseudo_steam_id); } else if (info_class == ProcessDebugObjectHandle) { *static_cast(info) = nullptr; return static_cast(0xC0000353); } else if (info_class == ProcessImageFileName || info_class == 43 /* ? */) { remove_evil_keywords_from_string(*static_cast(info)); } else if (info_class == ProcessDebugPort) { *static_cast(info) = nullptr; } else if (info_class == ProcessDebugFlags) { *static_cast(info) = 1; } } return status; } NTSTATUS NTAPI nt_close_stub(const HANDLE handle) { if (handle == pseudo_steam_handle) { return 0; } char info[16]; if (NtQueryObject(handle, OBJECT_INFORMATION_CLASS(4), &info, 2, nullptr) >= 0 && size_t(handle) != 0x12345) { return nt_close_hook.invoke(handle); } return STATUS_INVALID_HANDLE; } LONG WINAPI exception_filter(const LPEXCEPTION_POINTERS info) { if (info->ExceptionRecord->ExceptionCode == STATUS_INVALID_HANDLE) { return EXCEPTION_CONTINUE_EXECUTION; } if (info->ExceptionRecord->ExceptionCode == STATUS_ACCESS_VIOLATION) { //MessageBoxA(0, 0, "AV", 0); } return EXCEPTION_CONTINUE_SEARCH; } void hide_being_debugged() { auto* const peb = reinterpret_cast(__readgsqword(0x60)); peb->BeingDebugged = false; *reinterpret_cast(LPSTR(peb) + 0xBC) &= ~0x70; } void restore_debug_functions() { static const char* functions[] = { "DbgBreakPoint", "DbgUserBreakPoint", "DbgUiConnectToDbg", "DbgUiContinue", "DbgUiConvertStateChangeStructure", "DbgUiDebugActiveProcess", "DbgUiGetThreadDebugObject", "DbgUiIssueRemoteBreakin", "DbgUiRemoteBreakin", "DbgUiSetThreadDebugObject", "DbgUiStopDebugging", "DbgUiWaitStateChange", "DbgPrintReturnControlC", "DbgPrompt", }; using buffer = uint8_t[15]; static buffer buffers[ARRAYSIZE(functions)] = {}; static bool loaded = false; const utils::nt::library ntdll("ntdll.dll"); for (auto i = 0u; i < ARRAYSIZE(functions); ++i) { const auto func = ntdll.get_proc(functions[i]); if (!loaded) { memcpy(buffers[i], func, sizeof(buffer)); } else { utils::hook::copy(func, buffers[i], sizeof(buffer)); } } loaded = true; } const char* get_command_line_a_stub() { static auto cmd = [] { std::string cmd_line = GetCommandLineA(); if (!strstr(cmd_line.data(), "fs_game")) { cmd_line += " +set fs_game \"T7x\""; } return cmd_line; }(); return cmd.data(); } } class component final : public component_interface { public: void post_load() override { check_steam_install(); hide_being_debugged(); scheduler::loop(hide_being_debugged, scheduler::pipeline::async); //restore_debug_functions(); create_mutex_ex_a_hook.create(CreateMutexExA, create_mutex_ex_a_stub); const utils::nt::library ntdll("ntdll.dll"); nt_close_hook.create(ntdll.get_proc("NtClose"), nt_close_stub); const auto nt_query_information_process = ntdll.get_proc("NtQueryInformationProcess"); nt_query_information_process_hook.create(nt_query_information_process, nt_query_information_process_stub); const auto nt_query_system_information = ntdll.get_proc("NtQuerySystemInformation"); nt_query_system_information_hook.create(nt_query_system_information, nt_query_system_information_stub); nt_query_system_information_hook.move(); open_process_hook.create(OpenProcess, open_process_stub); utils::hook::copy(this->window_text_buffer_, GetWindowTextA, sizeof(this->window_text_buffer_)); utils::hook::jump(GetWindowTextA, get_window_text_a_stub, true, true); utils::hook::move_hook(GetWindowTextA); AddVectoredExceptionHandler(1, exception_filter); // TODO: Remove as soon as real hooking works auto* cmd_func = utils::nt::library{}.get_iat_entry("kernel32.dll", "GetCommandLineA"); if (cmd_func) { utils::hook::set(cmd_func, get_command_line_a_stub); } } void pre_destroy() override { utils::hook::copy(GetWindowTextA, this->window_text_buffer_, sizeof(this->window_text_buffer_)); nt_query_system_information_hook.clear(); nt_query_information_process_hook.clear(); nt_close_hook.clear(); create_mutex_ex_a_hook.clear(); open_process_hook.clear(); } private: uint8_t window_text_buffer_[15]{}; }; } REGISTER_COMPONENT(arxan::component)