Advertisement
Guest User

Untitled

a guest
Jun 27th, 2019
196
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <Windows.h>
  2. #include <stdio.h>
  3. #include <detours.h>
  4.  
  5. #include "MemoryUtils.h"
  6.  
  7. #pragma comment(lib, "detours.lib")
  8.  
  9. #define VAC_LOADLIBRARY_FORCE_SIGNATURE "\x74\x47\x6A\x01\x6A"
  10. #define LOGFILE_A "C:\\Users\\Username\\Desktop\\vaclog.txt"
  11.  
  12. typedef HMODULE(WINAPI* LoadLibraryExW_t)(
  13.     LPCWSTR,
  14.     HANDLE,
  15.     DWORD
  16. );
  17.  
  18. LoadLibraryExW_t originalLoadLibrary;
  19. FILE* log;
  20. HMODULE self;
  21.  
  22. VOID WriteLog(const char* data) {
  23.     log = fopen(LOGFILE_A, "a");
  24.     fwrite(data, strlen(data), 1, log);
  25.     fclose(log);
  26. }
  27.  
  28. HMODULE WINAPI HookedLoadLibrary(LPCWSTR lpLibFileName, HANDLE  hFile, DWORD dwFlags) {
  29.  
  30.     HMODULE loadedModule = originalLoadLibrary(lpLibFileName, hFile, dwFlags);
  31.  
  32.     if (GetProcAddress(loadedModule, "_runfunc@20")) {
  33.  
  34.         WriteLog("[*] Blocking VAC loader thread ...\n");
  35.         SuspendThread(GetCurrentThread());
  36.  
  37.         return 0;
  38.     }
  39.  
  40.     return loadedModule;
  41. }
  42.  
  43. VOID PatchVACLoader() {
  44.  
  45.     Module steamService;
  46.     GetModule("SteamService.dll", &steamService);
  47.  
  48.     DWORD foundAddress = SearchForSignature(
  49.         steamService.base,
  50.         (unsigned char*)VAC_LOADLIBRARY_FORCE_SIGNATURE,
  51.         5,
  52.         steamService.size
  53.     );
  54.  
  55.     DWORD oldProtection = 0;
  56.  
  57.     VirtualProtect((LPVOID)foundAddress, 1, PAGE_EXECUTE_READWRITE, &oldProtection);
  58.     *(BYTE*)foundAddress = 0xEB;
  59.     VirtualProtect((LPVOID)foundAddress, 1, oldProtection, &oldProtection);
  60.  
  61.  
  62. }
  63.  
  64. VOID HookLoadLibrary() {
  65.     DetourTransactionBegin();
  66.     DetourUpdateThread(GetCurrentThread());
  67.  
  68.     HMODULE kernel = GetModuleHandleA("kernel32.dll");
  69.  
  70.     originalLoadLibrary =
  71.         (LoadLibraryExW_t)GetProcAddress(kernel, "LoadLibraryExW");
  72.  
  73.     DetourAttach(&(PVOID&)originalLoadLibrary, HookedLoadLibrary);
  74.  
  75.     DetourTransactionCommit();
  76. }
  77.  
  78. BOOL WINAPI DllMain(
  79.     _In_ HINSTANCE hinstDLL,
  80.     _In_ DWORD     fdwReason,
  81.     _In_ LPVOID    lpvReserved
  82. ) {
  83.  
  84.     if (fdwReason != DLL_PROCESS_ATTACH) {
  85.         return TRUE;
  86.     }
  87.  
  88.     self = hinstDLL;
  89.  
  90.     log = fopen(LOGFILE_A, "w");
  91.     fwrite("[*] Starting VacBlocker v0.1\n", strlen("[*] Starting VacBlocker v0.1\n") , 1, log);
  92.     fclose(log);
  93.  
  94.     WriteLog("[*] Hooking LoadLibraryW ...\n");
  95.     HookLoadLibrary();
  96.  
  97.     WriteLog("[*] Patching SteamService.dll ...\n");
  98.     PatchVACLoader();
  99.  
  100.     fclose(log);
  101.  
  102.     return TRUE;
  103. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement