SHARE
TWEET

onetap fix by HoShiMin

a guest Aug 21st, 2019 443 Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
  1. #include <iostream>
  2. #include <Windows.h>
  3.  
  4. const unsigned int ValidOffsets[] = {
  5.     0x008CED10,
  6.     0x003E9BA0,
  7.     0x001CA9E0,
  8.     0x001CABA0,
  9.     0x002E4523,
  10.     0x001B99F0,
  11.     0x00306430,
  12.     0x00293AD1,
  13.     0x0039D520,
  14.     0x0039DF60,
  15.     0x001D1E70,
  16.     0x0039CB20,
  17.     0x00372BDD,
  18.     0x0034A229,
  19.     0x0039F915,
  20.     0x002FA851,
  21.     0x0023C2FE,
  22.     0x0065BB5F,
  23.     0x003D3B20,
  24.     0x003AAA3C,
  25.     0x00388B10,
  26.     0x00388B67,
  27.     0x003DAAE0,
  28.     0x003459B9,
  29.     0x002A7430,
  30.     0x004ABDC0,
  31.     0x0024F548,
  32.     0x004B0B80,
  33.     0x00372345,
  34.     0x004ECC90,
  35.     0x0039D584,
  36.     0x001B1BCC,
  37.     0x001B3BC5,
  38.     0x001B38D9,
  39.     0x00198990,
  40.     0x002177E0,
  41.     0x00691AD0,
  42.     0x001EAC10,
  43.     0x00199320,
  44.     0x00601C20,
  45.     0x00248830,
  46.     0x001CAD50,
  47.     0x001904A0,
  48.     0x001CB660,
  49.     0x003EE85F,
  50.     0x006E1780,
  51.     0x006E10D0,
  52.     0x001B38C0,
  53.     0x003EA510,
  54.     0x003EE7D0,
  55.     0x001991E0,
  56.     0x002C749F,
  57.     0x001BEB09,
  58.     0x0034DACA,
  59.     0x003C2B62,
  60.     0x0039D566,
  61.     0x003EE819,
  62.     0x006015DE,
  63.     0x006018B0,
  64.     0x00396A48,
  65.     0x001C9DEC,
  66.     0x003B8B23,
  67.     0x001B4760,
  68.     0x003DDBD8,
  69.     0x005FA0FC,
  70.     0x001935CD,
  71.     0x00180763,
  72.     0x008C37A7,
  73.     0x0029D0D7,
  74.     0x001C9A60,
  75.     0x00296910,
  76.     0x00340CD5,
  77.     0x00394BD0,
  78.     0x005F6B97,
  79.     0x005F6BA5,
  80.     0x003AAA4A,
  81.     0x00388B10,
  82.     0x005F6B97,
  83.     0x005F6BA5,
  84.     0x00193E14,
  85.     0x008C62E0,
  86.     0x008C69E0,
  87.     0x002493A7,
  88.     0x001C9E78,
  89.     0x00335B70,
  90.     0x001B24D0,
  91. };
  92.  
  93. class Patcher {
  94. private:
  95.     HANDLE hFile;
  96.     DWORD Size;
  97.     HANDLE hMapping;
  98.     PVOID Mapping;
  99.  
  100.     void Cleanup() {
  101.         if (Mapping) UnmapViewOfFile(Mapping);
  102.         if (hMapping) CloseHandle(hMapping);
  103.         if (hFile) {
  104.             FlushFileBuffers(hFile);
  105.             CloseHandle(hFile);
  106.         }
  107.  
  108.         Mapping = NULL;
  109.         hMapping = NULL;
  110.         hFile = NULL;
  111.     }
  112.  
  113. public:
  114.     Patcher() : hFile(NULL), Size(0), hMapping(NULL), Mapping(NULL) {}
  115.     ~Patcher() {
  116.         Cleanup();
  117.     }
  118.  
  119.     bool LoadFile(LPCWSTR File) {
  120.         Cleanup();
  121.  
  122.         hFile = CreateFile(File, FILE_ALL_ACCESS, FILE_SHARE_READ | FILE_SHARE_WRITE, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, NULL);
  123.         if (hFile == INVALID_HANDLE_VALUE) {
  124.             DWORD LE = GetLastError();
  125.             Cleanup();
  126.             return false;
  127.         }
  128.  
  129.         Size = GetFileSize(hFile, NULL);
  130.         if (!Size) {
  131.             Cleanup();
  132.             return false;
  133.         }
  134.  
  135.         hMapping = CreateFileMapping(hFile, NULL, PAGE_READWRITE, 0, Size, L"OnetapFileMapping");
  136.         if (!hMapping) {
  137.             Cleanup();
  138.             return false;
  139.         }
  140.  
  141.         Mapping = MapViewOfFile(hMapping, FILE_MAP_ALL_ACCESS, 0, 0, Size);
  142.         if (!Mapping) {
  143.             Cleanup();
  144.             return false;
  145.         }
  146.  
  147.         return true;
  148.     }
  149.  
  150.     bool Patch(const unsigned int* OffsetsTable, ULONG OffsetsCount, SIZE_T PatchSectionOffsetInFile, SIZE_T JmpToPatchSectionOffset) {
  151.         static const unsigned char Shell[] = {
  152.             0xE8, 0x00, 0x00, 0x00, 0x00, // call @NextInstruction  ; --+
  153.             0x8B, 0x04, 0x24,             // mov eax, [esp]  ; <--------+
  154.             0x83, 0xC4, 0x04,             // add esp, 4
  155.             0x83, 0xE8, 0x05,             // sub eax, 5
  156.             0x83, 0xC0, 0x20,             // add eax, 32
  157.             0x8B, 0x04, 0x88,             // mov eax, [eax + ecx * 4]
  158.             0x03, 0x45, 0x80,             // add eax, [ebp - 80h]
  159.             0xE9, 0xCA, 0xF6, 0xE6, 0xFF, // jmp @Continue
  160.             0x90, 0x90, 0x90, 0x90        // Just for alignment*/
  161.         };
  162.  
  163.         auto PatchSection = reinterpret_cast<PBYTE>(Mapping) + PatchSectionOffsetInFile;
  164.         memcpy(PatchSection, Shell, sizeof(Shell));
  165.         memcpy(PatchSection + sizeof(Shell), OffsetsTable, OffsetsCount * sizeof(DWORD));
  166.  
  167.         static const unsigned char JmpToShellInstr[] = { 0xE9, 0x1B, 0x09, 0x19, 0x00 };
  168.         auto JmpToPatch = reinterpret_cast<PBYTE>(Mapping) + JmpToPatchSectionOffset;
  169.         memcpy(JmpToPatch, JmpToShellInstr, sizeof(JmpToShellInstr));
  170.  
  171.         return true;
  172.     }
  173. };
  174.  
  175. int main()
  176. {
  177.     constexpr ULONG PatchSectionOffsetInFile = 0x1CE600;
  178.     constexpr ULONG TxtSectionOffsetInFile = 0x400;
  179.     constexpr ULONG JumpToPatchOffsetFromTxtSection = 0x3F6E0;
  180.     constexpr ULONG JumpToPatchOffsetInFile = TxtSectionOffsetInFile + JumpToPatchOffsetFromTxtSection;
  181.  
  182.     Patcher patcher;
  183.     bool Status = patcher.LoadFile(L"C:\\Temp\\onetap.dll");
  184.     if (!Status) {
  185.         printf("Unable to load file!\r\n");
  186.         return 0;
  187.     }
  188.     //sizeof(ValidOffsets) / sizeof(ValidOffsets*)
  189.     Status = patcher.Patch(ValidOffsets, sizeof(ValidOffsets), PatchSectionOffsetInFile, JumpToPatchOffsetInFile);
  190.     if (!Status) {
  191.         printf("Unable to patch file!\r\n");
  192.         system("pause");
  193.         return 0;
  194.     }
  195.  
  196.     printf("Well done!\r\n");
  197.     system("pause");
  198.     return 0;
  199. }
RAW Paste Data
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy. OK, I Understand
 
Top