-
Notifications
You must be signed in to change notification settings - Fork 0
/
Source.cpp
193 lines (146 loc) · 6.04 KB
/
Source.cpp
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
#define _CRT_SECURE_NO_WARNINGS
#include <stdio.h>
#include <Windows.h>
#define ORIGINAL_DLL "RendDX9_ori.dll"
struct {
char *gpcm;
char *gpsp;
char *gamestats;
char *qr_wildcard;
char *avail_wildcard;
char *sb;
char *sb_wildcard;
void **fesl_dns_address;
void **fesl_base_domain;
char *stella_hostname;
char *stella_http_name;
} sGameSpyInfo;
void patchString(char *dstAddress, char *srcAddress) {
DWORD old;
VirtualProtect(dstAddress, strlen(dstAddress), PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(GetCurrentProcess(), dstAddress, srcAddress, strlen(srcAddress), NULL);
VirtualProtect(dstAddress, strlen(dstAddress), old, &old);
FlushInstructionCache(GetCurrentProcess(), dstAddress, strlen(dstAddress));
}
void patchSSL() {
const char *update_string = "\xB8\x15\x00\x00\x00\xC3\xCC\xCC\xCC\xCC\xCC\xCC";
int instruction_length = 12;
void *instruction_address = (void *)0x860A87;
DWORD old;
VirtualProtect(instruction_address, instruction_length, PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(GetCurrentProcess(), instruction_address, update_string, instruction_length, NULL);
VirtualProtect(instruction_address, instruction_length, old, &old);
FlushInstructionCache(GetCurrentProcess(), instruction_address, instruction_length);
}
void patchErrorNeg206() {
const char *update_string = "\xEB\x2E\x90";
int instruction_length = 3;
void *instruction_address = (void *)0x833F7F;
DWORD old;
VirtualProtect(instruction_address, instruction_length, PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(GetCurrentProcess(), instruction_address, update_string, instruction_length, NULL);
VirtualProtect(instruction_address, instruction_length, old, &old);
FlushInstructionCache(GetCurrentProcess(), instruction_address, instruction_length);
}
void patchDeleteSoldierHang() {
//patch infinite loop of waiting for findnextfile to fail...???
int instruction_length = 6;
void *instruction_address = (void *)0x69F7CD;
const char *update_string = "\x90\x90\x90\x90\x90\x90";
DWORD old;
VirtualProtect(instruction_address, instruction_length, PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(GetCurrentProcess(), instruction_address, update_string, instruction_length, NULL);
VirtualProtect(instruction_address, instruction_length, old, &old);
FlushInstructionCache(GetCurrentProcess(), instruction_address, instruction_length);
}
#define BASE_ADDRESS 0x400000
static int patched = false;
const char *fesl_hostname = "fesl.openspy.net";
int debugPrint(int arg0, int arg4, char *fmt, ...) {
char buffer[1024];
va_list args;
va_start(args, fmt);
vsprintf(buffer, fmt, args);
OutputDebugStringA(buffer);
va_end(args);
return 0;
}
int FESL_ResolveHandler(void *this_ptr, const char *ea_gamename, int a3, const char *a4, int a5, int a6) {
return 0;
}
//HMODULE original_dll;
BOOL WINAPI DllMain(
HINSTANCE hinstDLL,
DWORD fdwReason,
LPVOID lpvReserved
) {
char buff[1024];
DWORD old;
switch (fdwReason) {
default:
case DLL_PROCESS_ATTACH:
case DLL_THREAD_ATTACH:
if (!patched) {
patched = true;
void *fesldebugFuncAddr = (void *)0x009C11DC;
void *debugPrintAddr = (void *)debugPrint;
VirtualProtect(fesldebugFuncAddr, sizeof(void *), PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(GetCurrentProcess(), fesldebugFuncAddr, &debugPrintAddr, sizeof(void *), NULL);
VirtualProtect(fesldebugFuncAddr, sizeof(void *), old, &old);
FlushInstructionCache(GetCurrentProcess(), fesldebugFuncAddr, sizeof(void *));
//OutputDebugString("Patching hostnames...\n");
sGameSpyInfo.gamestats = (char *)(0x00A081A0);
sGameSpyInfo.gpsp = (char *)(0x00A08BC0);
sGameSpyInfo.gpcm = (char *)(0x00A08B80);
sGameSpyInfo.qr_wildcard = (char *)(0x0099F57C);
sGameSpyInfo.avail_wildcard = (char *)(0x0099F2E8);
sGameSpyInfo.sb_wildcard = (char *)(0x009A0208);
sGameSpyInfo.stella_hostname = (char *)(0x009645C4);
sGameSpyInfo.stella_http_name = (char *)(0x009645A4);
patchString(sGameSpyInfo.avail_wildcard, "%s.available.openspy.net");
patchString(sGameSpyInfo.sb_wildcard, "%s.ms%d.openspy.net");
patchString(sGameSpyInfo.qr_wildcard, "%s.master.openspy.net");
patchString(sGameSpyInfo.gpsp, "gpsp.openspy.net");
patchString(sGameSpyInfo.gpcm, "gpcm.openspy.net");
patchString(sGameSpyInfo.gamestats, "gamestats.openspy.net");
//.rdata:009645A4 00000020 C http://stella.prod.gamespy.com/
patchString(sGameSpyInfo.stella_hostname, "stella.prod.openspy.net");
patchString(sGameSpyInfo.stella_http_name, "http://stella.prod.openspy.net");
sGameSpyInfo.fesl_dns_address = (void **)0x833DB7;
sGameSpyInfo.fesl_base_domain = (void **)0x8342CA;
patchString((char *)0x9C5C7C, ".open");
patchString((char *)0x9C5C74, "spy");
patchString((char *)0x9C5C78, "net");
patchSSL();
patchErrorNeg206();
patchDeleteSoldierHang();
VirtualProtect((void *)sGameSpyInfo.fesl_dns_address, sizeof(void *), PAGE_EXECUTE_READWRITE, &old);
WriteProcessMemory(GetCurrentProcess(), sGameSpyInfo.fesl_dns_address, (void *)&fesl_hostname, sizeof(void *), NULL);
VirtualProtect((void *)sGameSpyInfo.fesl_dns_address, sizeof(void *), old, &old);
FlushInstructionCache(GetCurrentProcess(), sGameSpyInfo.fesl_dns_address, sizeof(void *));
//OutputDebugString("Done patching hostnames...\n");
}
// sprintf(buff, "dns: %s - %s - %s - %s - %s, FESL: %s - %p\n", sGameSpyInfo.gamestats, sGameSpyInfo.gpsp, sGameSpyInfo.gpcm, sGameSpyInfo.sb_wildcard, sGameSpyInfo.qr_wildcard, *sGameSpyInfo.fesl_dns_address, fesl_hostname);
// OutputDebugString(buff);
break;
case DLL_PROCESS_DETACH:
//fclose(fd);
//FreeLibrary(original_dll);
break;
}
return TRUE;
}
extern "C" int __cdecl deinitDll() {
/*int (*true_deinitDll)();
true_deinitDll = (int (*)())GetProcAddress(original_dll, "deinitDll");
return true_deinitDll();
*/
return 0;
}
extern "C" bool __cdecl initDll(int a1) {
/*bool (*true_initDll)(int);
true_initDll = (bool (*)(int))GetProcAddress(original_dll, "initDll");
fprintf(fd, "test: %p\n", true_initDll);
return true_initDll(a1);*/
return true;
}