Advertisement
Guest User

Untitled

a guest
Jan 23rd, 2018
96
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 4.81 KB | None | 0 0
  1. #include <Windows.h>
  2. #include <vector>
  3. #include <string>
  4. #include "ball.h"
  5.  
  6. DWORD_PTR FindPattern(const char *szPattern, DWORD_PTR dwBase, size_t dwSize)
  7. {
  8. //hab das von ner alten eo source kopiert lol
  9. unsigned char *code = (unsigned char *)dwBase;
  10. size_t patternLength = strlen(szPattern);
  11. const unsigned char *pattern = reinterpret_cast<const unsigned char *>(szPattern);
  12.  
  13. if (pattern[0] == ' ')
  14. return NULL;
  15.  
  16. std::vector<byte> mask, nativepattern;
  17.  
  18. for (unsigned char *current = const_cast<unsigned char*>(pattern); current < (pattern + patternLength);)
  19. {
  20. if (*current == '?')
  21. {
  22. mask.push_back(0);
  23. nativepattern.push_back(0);
  24. current += 2;
  25. }
  26. else
  27. {
  28. mask.push_back(1);
  29. nativepattern.push_back((unsigned char)(strtol(reinterpret_cast<char*>(current), 0, 16)));
  30. current += 3;
  31. }
  32. }
  33.  
  34. patternLength = nativepattern.size();
  35.  
  36. for (size_t current = 0; current < dwSize; current++)
  37. {
  38. for (size_t patternidx = 0; patternidx < patternLength; patternidx++)
  39. {
  40. if (mask.at(patternidx))
  41. {
  42. if (nativepattern.at(patternidx) != *PBYTE(code + current + patternidx))
  43. break;
  44.  
  45. if (patternidx == patternLength - 1)
  46. {
  47. return DWORD(code) + current;
  48. }
  49. }
  50. }
  51. }
  52.  
  53. return NULL;
  54. }
  55.  
  56. CBall *ballPtr = nullptr;
  57.  
  58. DWORD eip_strokeCounter = 0;
  59.  
  60. LONG CALLBACK VectoredHandler(
  61. _In_ PEXCEPTION_POINTERS ExceptionInfo
  62. )
  63. {
  64. if (ExceptionInfo->ContextRecord->Eip == (DWORD)eip_strokeCounter)
  65. {
  66. ballPtr = (CBall*)ExceptionInfo->ContextRecord->Edi;
  67.  
  68. //printf("Ball 0x%X\n", ballPtr);
  69.  
  70. //das macht 1fach die originalen instructions nur ohne inline asm und trampolin LOL
  71. ballPtr->StrokeCount = ExceptionInfo->ContextRecord->Eax;
  72.  
  73. ExceptionInfo->ContextRecord->Eip++;
  74. return EXCEPTION_CONTINUE_EXECUTION;
  75. }
  76. }
  77.  
  78. DWORD WINAPI doStuff(LPVOID)
  79. {
  80. FILE *allah = nullptr;
  81.  
  82. AllocConsole();
  83. SetConsoleTitleA("wtf man");
  84. freopen_s(&allah, "CONOUT$", "w", stdout);
  85.  
  86. printf("Golf with ur frends hack by lion\nwww.EngineOwning.com\n\n");
  87.  
  88. MEMORY_BASIC_INFORMATION *buffer = (MEMORY_BASIC_INFORMATION*)VirtualAlloc(0, 0x10000, MEM_COMMIT, PAGE_READWRITE);
  89.  
  90. bool found1 = false;
  91. bool found2 = false;
  92.  
  93. DWORD currAaaaa = 0;
  94. DWORD dwOld = 0;
  95.  
  96. AddVectoredExceptionHandler(TRUE, VectoredHandler);
  97.  
  98. while (!found1 || !found2)
  99. {
  100. VirtualQuery((LPCVOID)currAaaaa, buffer, 0x10000);
  101.  
  102. currAaaaa += buffer->RegionSize;
  103.  
  104. if (buffer->Protect == PAGE_EXECUTE_READ || buffer->Protect == PAGE_EXECUTE_READWRITE)
  105. {
  106. printf("Found pages: 0x%X (0x%X bytes)\n", buffer->BaseAddress, buffer->RegionSize);
  107.  
  108. DWORD_PTR dw1 = FindPattern("89 87 ? ? ? ? d9 ee d9 9f ? ? ? ? c6 87 5a 02 00 00", (DWORD_PTR)buffer->BaseAddress, (DWORD_PTR)buffer->RegionSize);
  109. DWORD_PTR dw2 = FindPattern("48 89 87 ? ? ? ? 8b 87", (DWORD_PTR)buffer->BaseAddress, (DWORD_PTR)buffer->RegionSize);
  110.  
  111. if (dw1)
  112. {
  113. // NICE
  114. found1 = true;
  115.  
  116. printf("Found stroke counter at 0x%X\n", dw1);
  117.  
  118. eip_strokeCounter = dw1;
  119.  
  120. VirtualProtect((LPVOID)dw1, 6, PAGE_EXECUTE_READWRITE, &dwOld);
  121.  
  122. *(BYTE*)(dw1) = 0xCC;
  123. *(BYTE*)(dw1 + 1) = 0x90;
  124. *(BYTE*)(dw1 + 2) = 0x90;
  125. *(BYTE*)(dw1 + 3) = 0x90;
  126. *(BYTE*)(dw1 + 4) = 0x90;
  127. *(BYTE*)(dw1 + 5) = 0x90;
  128.  
  129. VirtualProtect((LPVOID)dw1, 6, dwOld, &dwOld);
  130. }
  131.  
  132. if (dw2)
  133. {
  134. found2 = true;
  135.  
  136. printf("Found freecam at 0x%X\n", dw2);
  137.  
  138. VirtualProtect((LPVOID)dw2, 1, PAGE_EXECUTE_READWRITE, &dwOld);
  139. *(BYTE*)(dw2) = 0x90;
  140. VirtualProtect((LPVOID)dw2, 1, dwOld, &dwOld);
  141. }
  142.  
  143. }
  144. }
  145.  
  146. while (true)
  147. {
  148. if (ballPtr)
  149. {
  150. if (GetAsyncKeyState(VK_NUMPAD9) & 1)
  151. {
  152. ballPtr->StrokeCount++;
  153. }
  154. else if (GetAsyncKeyState(VK_NUMPAD3) & 1)
  155. {
  156. ballPtr->StrokeCount--;
  157. }
  158. }
  159.  
  160. Sleep(50);
  161. }
  162. }
  163.  
  164. BOOL WINAPI DllMain(HINSTANCE hinstDll, DWORD fdwReason, LPVOID lpvReserved)
  165. {
  166. switch (fdwReason)
  167. {
  168. case DLL_PROCESS_ATTACH:
  169. CreateThread(NULL, 0, doStuff, hinstDll, 0, NULL);
  170.  
  171. return TRUE;
  172. default: break;
  173. }
  174.  
  175. return FALSE;
  176. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement