View difference between Paste ID: WibsLyYh and hquqtHCf

 /*
 ** Stack-based Gmod script enforcer bypass
 ** (c) TEAM METALSLAVE RAGE CO.
 **
 ** REVISION HISTORY
 **
 ** 00/00/0000 initial implementation in private release as MSSEB.DLL
 **
 ** MEET THE SCRIPT ENFORCER
 **
 ** Due to a large amount of cheaters in Gmod servers running scripts like aimbots, wallhacks
 ** and so on, Garry Jewman finally decided to implement something called the Script Enforcer.
 ** Unfortunately, like everything he's created, it didn't work out as well as he had hoped.
 **
 ** The function that blocks scripts is:
 **
 ** bool __thiscall CScriptEnforcer::CanLoadScript( void* );
 **
 ** THE BYPASS EXPLAINED
 **
 ** Before the script enforcer can block a script, it first notifies us in the console via
 ** Msg. Msg will pass through some formatting functions before eventually landing at whatever
 ** has been initialized as the SpewOutputFunc. We change the SpewOutputFunc on it and when it
 ** is called, we check for returns to the script enforcer and rewrite them so the program returns
 ** into code that is specified in our bypass DLL (see below).
 **
 ** When the Msg() call to the string is called, we catch it and redirect the code. When returning
 ** we pretend that the script was actually blocked by setting the "blocked" flag but returning 1,
 ** allowing the script to load.
 **
 ** This only works on scripts that the server has blocked entirely. It does not work on
 ** scripts that are different from the server's due to multiple CRC and MD5 checks that
 ** run in-game.
 **
 ** msseb.lib is cleared for public release.
 ** This source code is kept private for obvious reasons.
 **
 ** No thanks to FPS, because we are ugly and you suck!
 **
 */
 
 #include <stdio.h>
 #include <windows.h>
 #include "convar.h"
 #include "dbg.h"
 
 static SpewOutputFunc_t ZeOldSpewOutput = 0; // the old function that handles debug msgs.
 static UINT32 se_blockscriptaddr = 0; // the address where the script is blocked
 static ConVar seb_enable ( "seb_enable", "0", FCVAR_SERVER_CANNOT_QUERY, "enable dat scriptenforcer bypass mufugga");
 
 
 // GetStackPtr: obfuscated utility function for getting the stack pointer.
 // this doesn't return the *exact* stack frame, but hey, it works.
 static __stdcall UINT32* GetStackPointer() {
 	UINT32 *stackptr;
 	__asm {
 		mov eax, esp
 		mov stackptr, eax
 	};
 	return stackptr;
 }
 
 UINT8 SEBypass[20] = {
 	0x83, 0xC4, 0x08,			// add esp, 8h
 	0xC6, 0x46, 0x44, 0x01,		// set scriptenforce flag as blocked
 	0xB0, 0x01,					// mov al, 1h to return TRUE
 	0x5E,						// pop esi
 	0x81, 0xC4, 0x08, 0x01, 0x00, 0x00,	// add esp, 108h
 	0xC2, 0x08, 0x00,			// retn 8
 };
 
 
 /*
 ** ZeNewSpewOutput
 ** This is our new debug message handler. It just so happens that the
 ** Script Enforcer calls this before blocking a script.
 */
 
 static SpewRetval_t ZeNewSpewOutput( SpewType_t type, const char* msg )
 {
 	if (strstr(msg,"ScriptEnforce:") && !strstr(msg, "CRC"))
 	{
 		Msg("ScriptEnforcer is attempting to block a script.\n");
 		// get the stack pointer
 		UINT32* theSp = GetStackPointer();
 		Msg("ESP = %p\n", theSp);
 
 		// If the script enforcer is trying to block something, step a few stack
 		// frames and rewrite anything that's returning to the scriptenforcer
 		// validation so it goes to the bypass code when retn is hit in Msg().
 		// This verification is done to prevent false positives jumping into
 		// code that crashes the thing hilariously.
 		int isFound = 0;
 		for (int i = 0; i < 0x1000; i ++)
 		{
 			if (theSp[i] == se_blockscriptaddr)
 			{
 				theSp[i] = (UINT32)SEBypass;
 				Msg("*** ScriptEnforcer tried to block a script. Stack modified.\n");
 				isFound = 1;
 				break;
 			}
 		}
 		if (!isFound) Msg("ERROR: Couldn't find the return address in the stack!\n");
 	}
 
 	// jump off to the old spew output function
 	return ZeOldSpewOutput( type, msg );
 }
 
 void SEBypasser_Init()
 {
 	// get the return address following the Msg()
 	se_blockscriptaddr = (UINT32)GetModuleHandleA("client.dll");
 	se_blockscriptaddr += 0x1CC22A;
 
 	// get the original spew fcn using Msg (there's a pointer in there
 	// to the output function). this is yet another module garry has no
 	// control over so we can care less about what changes here.
 	ZeOldSpewOutput = GetSpewOutputFunc();
 
 	if (!ZeOldSpewOutput) {
 		Msg("Old spew function was ZERO\n");
 		return;
 	}
 
 	// Switch the output on us. All messages now go through our filter.
 	SpewOutputFunc( ZeNewSpewOutput );
 
 	// just let the user know that we initialized the module OK.
 	Msg("*** msseb.lib built " __DATE__ " " __TIME__" ***\n");
 	Msg("(c) 2010 TEAM METALSLAVE RAGE CO.\n");
 	Msg("this software is provided to you without warranty or terms.\n");
 	Msg("see msseb.txt for further information.\n");
 }