Riremito

Untitled

Mar 3rd, 2020
553
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 3.50 KB | None | 0 0
  1. /*
  2.     ぱけっとえでぃたー
  3. */
  4. #include<Windows.h>
  5. #include<string>
  6.  
  7. /*
  8.     SendPacket関数に渡される構造体
  9. */
  10. typedef struct OutPacket {
  11.     LPVOID unk1;
  12.     BYTE *Packet;
  13.     DWORD Length;
  14.     LPVOID unk2;
  15. };
  16.  
  17. /*
  18.     数値から文字に変換
  19. */
  20. WCHAR toWCHAR(BYTE b) {
  21.     BYTE tb = b & 0x0F;
  22.  
  23.     if (tb <= 0x09) {
  24.         return 0x30 + tb;
  25.     }
  26.  
  27.     tb -= 0x0A;
  28.  
  29.     return 0x41 + tb;
  30. }
  31.  
  32. /*
  33.     デバッグ出力
  34.     DbgView.exeを利用すると簡単に出力が得られる
  35. */
  36. bool DebugOutput(OutPacket *Packet) {
  37.     if (!Packet) {
  38.         return false;
  39.     }
  40.  
  41.     if (!Packet->Packet) {
  42.         return false;
  43.     }
  44.  
  45.     if (Packet->Length == 0) {
  46.         OutputDebugStringW(L"PacketLength is 0");
  47.         return false;
  48.     }
  49.  
  50.     if (Packet->Length > 10000) {
  51.         OutputDebugStringW(L"PacketLength is too large");
  52.         return false;
  53.     }
  54.  
  55.     // XX XX...という形で文字列化するため16進数1つにつき空白を含めて3文字必要
  56.     WCHAR* wcPacket = new WCHAR[Packet->Length * 3];
  57.  
  58.     if (!wcPacket) {
  59.         OutputDebugStringW(L"failed to allocate buffer");
  60.         return false;
  61.     }
  62.  
  63.     for (DWORD i = 0; i < Packet->Length; i++) {
  64.         wcPacket[i * 3] = toWCHAR(Packet->Packet[i] >> 16);
  65.         wcPacket[i * 3 + 1] = toWCHAR(Packet->Packet[i] & 0x0F);
  66.         wcPacket[i * 3 + 2] = L' ';
  67.     }
  68.  
  69.     wcPacket[Packet->Length * 3 - 1] = L'\0';
  70.  
  71.     std::wstring Output = L"[AnyPE] ";
  72.     Output += wcPacket;
  73.  
  74.     OutputDebugStringW(Output.c_str());
  75.  
  76.     delete[] wcPacket;
  77.  
  78.     return true;
  79. }
  80.  
  81. #define JMS 1
  82. #if JMS == 1
  83. /*
  84.     JMS ver
  85. */
  86. DWORD dwSendPacket = 0x0123B400;
  87. DWORD dwFakeRet = 0x0402D3C3; // 難読化されているアドレスの内 nop ret となる適当なアドレス
  88. //DWORD dwSendPacketClass = 0x03AECEF0;
  89. #else
  90. /*
  91.     Emu ver
  92. */
  93. DWORD dwSendPacket = 0x0049637B;
  94. //DWORD dwSendPacketClass = 0x00BE7914;
  95. #endif
  96.  
  97.  
  98. /*
  99.     フック関数
  100. */
  101. void (__thiscall *_SendPacket)(LPVOID, OutPacket*) = NULL;
  102. void __fastcall SendPacket_Hook(LPVOID RegEcx, LPVOID RegEdx, OutPacket *Packet) {
  103.     DebugOutput(Packet);
  104.  
  105.     __asm {
  106.         mov ecx,dword ptr [RegEcx]
  107.         push CONTINUE
  108.         push dword ptr [Packet]
  109.         push dword ptr [dwFakeRet]
  110.         jmp dword ptr [_SendPacket]
  111.         CONTINUE:
  112.     }
  113. }
  114.  
  115. /*
  116.     関数フック書き込み
  117. */
  118. bool HookFunction(DWORD Address, DWORD Overwrite, void* Function, void *Hook) {
  119.     DWORD dwProtect;
  120.  
  121.     if (Overwrite < 5) {
  122.         return false;
  123.     }
  124.  
  125.     BYTE* Enter = new BYTE[Overwrite + 5];
  126.  
  127.     if (!Enter) {
  128.         return false;
  129.     }
  130.  
  131.     DWORD dw;
  132.     if (!VirtualProtect((LPVOID)Enter, Overwrite + 5, PAGE_EXECUTE_READWRITE, &dw)) {
  133.         return false;
  134.     }
  135.  
  136.     if (!VirtualProtect((LPVOID)Address, Overwrite, PAGE_EXECUTE_READWRITE, &dwProtect)) {
  137.         return false;
  138.     }
  139.  
  140.     // 元の関数復元
  141.     memcpy(Enter, (void *)Address, Overwrite);
  142.     Enter[Overwrite] = 0xE9;
  143.     *(DWORD*)&Enter[Overwrite + 1] = (Address + Overwrite) - (DWORD)&Enter[Overwrite] - 0x05;
  144.     *(DWORD *)Function = (DWORD)Enter;
  145.  
  146.     // フック
  147.     *(BYTE *)Address = 0xE9;
  148.     *(DWORD *)(Address + 1) = (DWORD)Hook - Address - 0x05;
  149.  
  150.     if (Overwrite > 5) {
  151.         memset((void*)Address, 0x90, Overwrite - 5);
  152.     }
  153.  
  154.     if (!VirtualProtect((LPVOID)Address, Overwrite, dwProtect, &dwProtect)) {
  155.         return false;
  156.     }
  157.  
  158.     return true;
  159. }
  160.  
  161.  
  162. void Init() {
  163.     HookFunction(dwSendPacket, 5, &_SendPacket, SendPacket_Hook);
  164. }
  165.  
  166. BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved) {
  167.     switch (fdwReason) {
  168.     case DLL_PROCESS_ATTACH:
  169.     {
  170.         DisableThreadLibraryCalls(hinstDLL);
  171.         Init();
  172.         break;
  173.     }
  174.     case DLL_PROCESS_DETACH:
  175.     {
  176.         break;
  177.     }
  178.     default:
  179.     {
  180.         break;
  181.     }
  182.     }
  183.     return TRUE;
  184. }
Advertisement
Add Comment
Please, Sign In to add comment