BlackCipher v2.11.17.0

//BlackCipher v2.11.17.0
unsigned long UnknownFunction = 0x007F83C6; /* E9 ? ? ? ? FF D0 E9 [Any Result, in JMP] */
unsigned long topkek1 = 0x0061175E; /*  */
unsigned long topkek2 = 0x009843DB; /* C7 ? ? ? ? ? ? 50 89 ? ? C7 ? ? ? ? ? ? C1 ? ? ? FF [in MOV] */
unsigned long topkek3 = 0x00443EA4; /* 83 EC 0C A1 ? ? ? ? 33 C5 50 8D ? ? 64 A3 00 00 00 00 89 ? E8 [MOV ESI,ESI @ End of function] */
void __declspec(naked) UnknownFunction_Hook()
{
    __asm
    {
        push eax
        mov eax, [esp + 0x0C]
        cmp eax, dword ptr[topkek1]
        je Patch
        cmp eax, dword ptr[topkek2]
        je Redirect
        pop eax
        jmp dword ptr[UnknownFunction]

        Patch:
        mov eax, [ebp - 0x10]
        mov dword ptr[eax + 0x48], 0x00000002
        pop eax
        jmp dword ptr[UnknownFunction]

        Redirect:
        pop eax
        add esp, 0x0C
        push topkek3
        ret
    }
}

NTSTATUS NTAPI NtReadVirtualMemory(_In_ HANDLE ProcessHandle, _In_ PVOID BaseAddress, _Out_ PVOID Buffer, _In_ ULONG NumberOfBytesToRead, _Out_ PULONG NumberOfBytesReaded);
bool Detour_NtReadVirtualMemory_MS()
{
    static decltype(&NtReadVirtualMemory) _NtReadVirtualMemory = nullptr;
    void *pTarget = reinterpret_cast<void**>((unsigned long)GetProcAddress(LoadLibrary("ntdll.dll"), "NtReadVirtualMemory"));
    *(void**)&_NtReadVirtualMemory = pTarget;

    decltype(&NtReadVirtualMemory) NtReadVirtualMemory_Hook = [](
        _In_ HANDLE ProcessHandle,
        _In_ PVOID BaseAddress,
        _Out_ PVOID Buffer,
        _In_ ULONG NumberOfBytesToRead,
        _Out_ PULONG NumberOfBytesReaded) -> NTSTATUS
    {
        HMODULE hModule = LoadLibrary("BlackCipher\\BlackCall.aes");
        IMAGE_NT_HEADERS32 *nt = reinterpret_cast<IMAGE_NT_HEADERS32*>(reinterpret_cast<unsigned char*>(hModule)+PIMAGE_DOS_HEADER(hModule)->e_lfanew);

        unsigned long dw1, dw2;

        dw1 = (unsigned long)hModule + nt->OptionalHeader.BaseOfCode;
        dw2 = nt->OptionalHeader.SizeOfCode + dw1;

        if ((reinterpret_cast<unsigned long>(_ReturnAddress()) > dw1) && (reinterpret_cast<unsigned long>(_ReturnAddress()) < dw2))
        {
            printf("MapleStory is checking BlackCall.aes");
            return -1;
        }

        return _NtReadVirtualMemory(ProcessHandle, BaseAddress, Buffer, NumberOfBytesToRead, NumberOfBytesReaded);
    };

    return DetourFunction(true, reinterpret_cast<void**>(&_NtReadVirtualMemory), NtReadVirtualMemory_Hook);
}


BOOL Detour_SetWindowLongA() //Remove Client Border
{
        static decltype(&SetWindowLongA) _SetWindowLongA = SetWindowLongA;

        decltype(&SetWindowLongA) SetWindowLongA__Hook = [](
                _In_ HWND hWnd,
                _In_ int nIndex,
                _In_ LONG dwNewLong) -> LONG
        {
                if (hWnd == MShWnd)
                        if (nIndex == GWL_STYLE)
                                dwNewLong = WS_VISIBLE;

                return _SetWindowLongA(hWnd, nIndex, dwNewLong);
        };

        return DetourFunction(TRUE, reinterpret_cast<LPVOID*>(&_SetWindowLongA), SetWindowLongA__Hook);
}


bool Teleport(long x, long y)
{
    try
    {
         auto GetCVecCtrlUser = reinterpret_cast<void*(__thiscall*)(void*)>(0x01488810); //
         auto CVecCtrlUser__OnTeleport = reinterpret_cast<void(__thiscall*)(void* lpvEcx, bool bToggle, long x, long y)>(0x015F6640); //

             CVecCtrlUser__OnTeleport(GetCVecCtrlUser(PVOID(*reinterpret_cast<DWORD*>(CharBase)+4)), TRUE, x, y);
    }
    catch (std::exception& e)
    {
         return false;
    }
    return true;
}


#pragma warning(disable : 4102)
void HideModule(HINSTANCE__* hModule)
{
    unsigned long dwPEB_LDR_DATA = 0;

    _asm
    {
        pushad
        pushfd
        mov eax, fs:[0x30]                      //PEB
        mov eax, [eax + 0x0C]                   //PEB->ProcessModuleInfo
        mov dwPEB_LDR_DATA, eax

        InLoadOrderModuleList:
        mov esi, [eax + 0x0C]                   //ProcessModuleInfo->InLoadOrderModuleList[FORWARD]
        mov edx, [eax + 0x10]                   //ProcessModuleInfo->InLoadOrderModuleList[BACKWARD]

        LoopInLoadOrderModuleList:
        lodsd                                   //Load First Module
        mov esi, eax
        mov ecx, [eax + 0x18]                   //LDR_MODULE->BaseAddress
        cmp ecx, hModule
        jne SkipA
        mov ebx, [eax]                          //[FORWARD] Module
        mov ecx, [eax + 0x4]                    //[BACKWARD] Module
        mov [ecx], ebx
        mov [ebx + 0x4], ecx
        jmp InMemoryOrderModuleList

        SkipA:
        cmp edx, esi
        jne LoopInLoadOrderModuleList

        InMemoryOrderModuleList:
        mov eax, dwPEB_LDR_DATA                 //PEB->ProcessModuleInfo
        mov esi, [eax + 0x14]                   //ProcessModuleInfo->InMemoryOrderModuleList[START]
        mov edx, [eax + 0x18]                   //ProcessModuleInfo->InMemoryOrderModuleList[FINISH]

        LoopInMemoryOrderModuleList:
        lodsd
        mov esi, eax
        mov ecx, [eax + 0x10]
        cmp ecx, hModule
        jne SkipB
        mov ebx, [eax]
        mov ecx, [eax + 0x4]
        mov [ecx], ebx
        mov [ebx + 0x4], ecx
        jmp InInitializationOrderModuleList

        SkipB:
        cmp edx, esi
        jne LoopInMemoryOrderModuleList

        InInitializationOrderModuleList:
        mov eax, dwPEB_LDR_DATA                 //PEB->ProcessModuleInfo
        mov esi, [eax + 0x1C]                   //ProcessModuleInfo->InInitializationOrderModuleList[START]
        mov edx, [eax + 0x20]                   //ProcessModuleInfo->InInitializationOrderModuleList[FINISH]

        LoopInInitializationOrderModuleList:
        lodsd
        mov esi, eax
        mov ecx, [eax + 0x08]
        cmp ecx, hModule
        jne SkipC
        mov ebx, [eax]
        mov ecx, [eax + 0x4]
        mov [ecx], ebx
        mov [ebx + 0x4], ecx
        jmp Finished

        SkipC:
        cmp edx, esi
        jne LoopInInitializationOrderModuleList

        Finished:
        popfd
        popad
    }
}
#pragma warning(default : 4102)

/* Prevent XignCode from minimizing unwanted programs */
bool Detour_PostMessageW()
{
    static decltype(&PostMessageW) _PostMessageW = &PostMessageW;

    decltype(&PostMessageW) PostMessageW_Hook = [](HWND hWnd, UINT Msg, WPARAM wParam, LPARAM lParam) -> BOOL
    {
        return (Msg != WM_SYSCOMMAND ? _PostMessageW(hWnd, Msg, wParam, lParam) : false);
    };

    return DetourFunction(true, reinterpret_cast<void**>(&_PostMessageW), PostMessageW_Hook);
}

/* Stop the XignCode driver (xhunter1.sys) from starting */
bool Detour_StartServiceW()
{
    static decltype(&StartServiceW) _StartServiceW = &StartServiceW;

    decltype(&StartServiceW) StartServiceW_Hook = [](SC_HANDLE hService, DWORD dwNumServiceArgs, LPCWSTR* lpServiceArgVectors) -> BOOL
    {
        return TRUE; //TRUE or FALSE, doesn't matter
    };

    return functions::redirect(true, reinterpret_cast<void**>(&_StartServiceW), StartServiceW_Hook);
}