VAC key dumper, codecave style

/*
** Simple utility to dump VAC encryption keys
** (c) 2010 TEAM METALSLAVE RAGE CO. All Rights Reserved.
**
** HOW TO USE
** 1. Inject into Steam.exe
** 2. Start game
** 3. Join secure server
** 4. Wait for keys to dump; there are 14 in total
**
** WARNING
** Some obfuscation is included but this code is mostly out in the open.
** This is likely to translate into bans. Use at your own risk.
*/

#include <stdio.h>
#include <conio.h>
#include <Windows.h>
#include <Tlhelp32.h>

#define SCAN_TABLE_BASE 0x7275

HANDLE hCurProc = NULL;
BOOL   bIsJumpTableHooked = FALSE;
UINT8* bIsScanRunning = NULL;
UINT32* pJumpTablePtr = NULL;
UINT32 origJumpTable[14];
UINT8  haveKeys[14];


void Unhook();

void SetRunningThreadsStatus(int shouldSuspend) {
		HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);

		THREADENTRY32 te;

		te.dwSize = sizeof(THREADENTRY32);

		BOOL hasEntry = Thread32First( snapshot, &te );
		while ( hasEntry ) {
			if (te.th32OwnerProcessID == GetCurrentProcessId()
				&&
				te.th32ThreadID != GetCurrentThreadId()
			) {
				HANDLE hThread = OpenThread( THREAD_ALL_ACCESS, FALSE, te.th32ThreadID );

				if (hThread) {
					if (shouldSuspend) SuspendThread(hThread);
					else               ResumeThread (hThread);
				} else cprintf("WARNING: Can't suspend thread %d\n", te.th32ThreadID);
			}
			hasEntry = Thread32Next( snapshot, &te );
		}
}

const char* strfmt = "Got Key %p%p for Fcn %d\n";


void __declspec(naked) MarkFunctionRead() {
		__asm {
			mov haveKeys[eax], 1h
			retn
		};
}

//
// HookCallEncryption: Code cave for the function jumptable.
// This will print out keys as we get them, then unhook from
// VAC so scans can run.
//

void __stdcall HookMsgHandler( UINT32 fcnId, UINT32* keys ) {

		cprintf("Key dumped for FCN #%d: 0x%p%p\n", fcnId, keys[1], keys[0]);
		Unhook();
}

void __declspec(naked) HookCallEncryption() {
		UINT32 fcn_number;

		__asm {
			pushad

			push [ebp + 0xC]
			push eax
			call HookMsgHandler

			popad
			jmp origJumpTable[eax * 4]
		};
}

void Hook() {
		// Freeze other threads
		SetRunningThreadsStatus(1);

		MEMORY_BASIC_INFORMATION buf;

		VirtualQueryEx( hCurProc, (LPCVOID)pJumpTablePtr, &buf, sizeof(MEMORY_BASIC_INFORMATION));

		DWORD oldProtect;



		if (
			VirtualProtectEx( hCurProc,(LPVOID)buf.BaseAddress, buf.RegionSize, PAGE_EXECUTE_READWRITE, &oldProtect )
			== FALSE ) {
				cprintf("FATAL ERROR: Jumptable hook failed.\nBaseAddress %p, RegionSize %p, LastError = %d\n", buf.BaseAddress, buf.RegionSize, GetLastError());
				cprintf("Program locked. Hit Ctrl+C to exit.\n");
				while(1) Sleep(1);
		}

		// Copy over the pointer to our code cave, while saving the original pointers

		if ( bIsJumpTableHooked == FALSE ) {

			for (int i = 0; i < 14; i++) {
				origJumpTable[i] = pJumpTablePtr[i];
				pJumpTablePtr[i] = (UINT32) HookCallEncryption;
			}

			bIsJumpTableHooked = TRUE;

		} else
			cprintf("WARNING! Jump table was already hooked!\n");


		// Restore original protection
		VirtualProtectEx( hCurProc, (LPVOID)buf.BaseAddress, buf.RegionSize, PAGE_EXECUTE_READ, &oldProtect );

		// Unfreeze threads
		SetRunningThreadsStatus(0);
}


void Unhook() {
		// Freeze other threads
		SetRunningThreadsStatus(1);

		DWORD oldProtect;
		MEMORY_BASIC_INFORMATION buf;
		VirtualQueryEx( hCurProc, (LPCVOID)pJumpTablePtr, &buf, sizeof(MEMORY_BASIC_INFORMATION));

		if (
			VirtualProtectEx( hCurProc,(LPVOID)buf.BaseAddress, buf.RegionSize, PAGE_EXECUTE_READWRITE, &oldProtect )
			== FALSE ) {
				cprintf("FATAL ERROR: Jumptable hook failed.\nBaseAddress %p, RegionSize %p, LastError = %d\n", buf.BaseAddress, buf.RegionSize, GetLastError());
				cprintf("Program locked. Hit Ctrl+C to exit.\n");
				while(1) Sleep(1);
		}

		// Restore the original values
		if (bIsJumpTableHooked == TRUE) {
				for (int i = 0; i < 14; i++) {
					pJumpTablePtr[i] = origJumpTable[i];
				}
				bIsJumpTableHooked = FALSE;
		} else
			cprintf("WARNING! Jump table was already unhooked!\n");

		// Restore original protection
		VirtualProtectEx( hCurProc, (LPVOID)buf.BaseAddress, buf.RegionSize, PAGE_EXECUTE_READ, &oldProtect );

		// Unfreeze threads
		SetRunningThreadsStatus(0);
}


void ExecutionThread() {

		AllocConsole();
		cprintf("Grabbing VAC pointers...\n");

		MODULEENTRY32 module;
		HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, 0);
		if (!snapshot) {
				cprintf("Snapshot couldn't be taken.\n");
				return;
		}

		module.dwSize = sizeof( MODULEENTRY32 );

		// Grab the first module
		BOOL moduleFound = Module32First( snapshot, &module );

		while ( moduleFound ) {
			if ( strstr(module.szModule, ".tmp") ) {
				cprintf("VAC found in module list as %s\n", module.szModule);

				// Initialize pointers
				bIsScanRunning = (UINT8*)module.hModule + 0x2D1AD;
				pJumpTablePtr  = (UINT32*)((UINT8*)module.hModule + 0x7275);
			}

			moduleFound = Module32Next( snapshot, &module );
		}

		hCurProc = OpenProcess( PROCESS_ALL_ACCESS | PROCESS_VM_OPERATION, FALSE, GetCurrentProcessId() );

		cprintf("bIsScanRunning %p\n", bIsScanRunning);
		cprintf("pJumpTablePtr  %p\n", pJumpTablePtr );

		// Run this loop for the rest of the time
		while ( 1 ) {
			if ( *bIsScanRunning == 0 && !bIsJumpTableHooked ) {
					Hook();
			} else {
					// If the scan's running it likely means we've intercepted it already
			}


			// Output a message around every 10 seconds

			Sleep(1);
		}
}

BOOL WINAPI DllMain( HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved ) {

		if ( fdwReason == DLL_PROCESS_ATTACH )
				CreateThread(NULL, 1000000, (LPTHREAD_START_ROUTINE)ExecutionThread,NULL,NULL,NULL);

		return TRUE;

}