xerox
4 years ago
parent
9515084357
commit
096fc8e5bc
@ -1,16 +0,0 @@
|
|||||||
<?xml version="1.0" encoding="utf-8"?>
|
|
||||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
|
||||||
<ItemGroup>
|
|
||||||
<Filter Include="Source">
|
|
||||||
<UniqueIdentifier>{2b8b1874-15b5-4680-a2ec-0f2fca832098}</UniqueIdentifier>
|
|
||||||
</Filter>
|
|
||||||
<Filter Include="Header">
|
|
||||||
<UniqueIdentifier>{3299c48f-c301-4b0c-8a25-a26bc0c92311}</UniqueIdentifier>
|
|
||||||
</Filter>
|
|
||||||
</ItemGroup>
|
|
||||||
<ItemGroup>
|
|
||||||
<ClCompile Include="main.cpp">
|
|
||||||
<Filter>Source</Filter>
|
|
||||||
</ClCompile>
|
|
||||||
</ItemGroup>
|
|
||||||
</Project>
|
|
||||||
@ -1,12 +0,0 @@
|
|||||||
#include <android/log.h>
|
|
||||||
#define LOGI(...) ((void)__android_log_print(ANDROID_LOG_INFO, "CODM", __VA_ARGS__))
|
|
||||||
#define LOGW(...) ((void)__android_log_print(ANDROID_LOG_WARN, "CODM", __VA_ARGS__))
|
|
||||||
|
|
||||||
//
|
|
||||||
// code runs on image load :)
|
|
||||||
//
|
|
||||||
__attribute__((constructor))
|
|
||||||
void init()
|
|
||||||
{
|
|
||||||
LOGI("> hello world!");
|
|
||||||
}
|
|
||||||
Binary file not shown.
Binary file not shown.
@ -1,10 +0,0 @@
|
|||||||
# Overview
|
|
||||||
|
|
||||||
This anti cheat is usermode and mostly cares about signatures of executable sections and the apk itself. The MD5 hash of the apk signature is uploaded to the server along with the apk
|
|
||||||
name and application name, same with a few other things related to the application.
|
|
||||||
|
|
||||||
<img src="https://imgur.com/KgQNpaI.png"/>
|
|
||||||
|
|
||||||
<img src="https://imgur.com/Hukr03X.png"/>
|
|
||||||
|
|
||||||
<img src="https://imgur.com/5cJFprU.png"/>
|
|
||||||
Binary file not shown.
Binary file not shown.
@ -0,0 +1,103 @@
|
|||||||
|
#include "bypass.h"
|
||||||
|
|
||||||
|
namespace ligma
|
||||||
|
{
|
||||||
|
namespace bypass
|
||||||
|
{
|
||||||
|
void init()
|
||||||
|
{
|
||||||
|
fopen_ptr = dlsym(dlopen("libc.so", RTLD_NOLOAD), "fopen");
|
||||||
|
system_prop_get = dlsym(dlopen("libc.so", RTLD_NOLOAD), "__system_property_get");
|
||||||
|
|
||||||
|
const auto cubehawk_base = reinterpret_cast<std::uintptr_t>(dlopen("libcubehawk.so", RTLD_LAZY));
|
||||||
|
const auto libtersafe_base = reinterpret_cast<std::uintptr_t>(dlopen("libtersafe.so", RTLD_LAZY));
|
||||||
|
|
||||||
|
shithook::make_hook(fopen_ptr, reinterpret_cast<void*>(&fopen_hook));
|
||||||
|
shithook::make_hook(reinterpret_cast<void*>(cubehawk_base + offset_emulator_check), reinterpret_cast<void*>(&emulator_check));
|
||||||
|
|
||||||
|
LOGI("disabled emulator checks....");
|
||||||
|
LOGI("disabled patch checks....");
|
||||||
|
|
||||||
|
shithook::make_hook(reinterpret_cast<void*>(libtersafe_base + offset_ischeat_packet), reinterpret_cast<void*>(&tss_sdk_ischeatpacket));
|
||||||
|
shithook::make_hook(system_prop_get, reinterpret_cast<void*>(&system_property_hook));
|
||||||
|
|
||||||
|
LOGI("disabled is cheat packet checks.....");
|
||||||
|
LOGI("disabled hwid checks.....");
|
||||||
|
|
||||||
|
shithook::make_hook(reinterpret_cast<void*>(cubehawk_base + offset_mshook_function), reinterpret_cast<void*>(&ms_hook_function));
|
||||||
|
LOGI("disabling all MSHookFunction calls! (no more back buffer hook!)");
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// the first module loaded by default is libtprt.so, it opens base.apk and checks its MD5.
|
||||||
|
//
|
||||||
|
__attribute__((noinline))
|
||||||
|
FILE* fopen_hook(const char* path, const char* mode)
|
||||||
|
{
|
||||||
|
LOGI("fopen called! path = %s, mode = %s", path, mode);
|
||||||
|
if (strstr(path, "base.apk"))
|
||||||
|
{
|
||||||
|
path = "/data/app/com.activision.callofduty.shooter-1/base_orig.apk";
|
||||||
|
LOGI("spoofing to original base.apk!");
|
||||||
|
}
|
||||||
|
|
||||||
|
fopen_mutex.lock();
|
||||||
|
shithook::disable(fopen_ptr);
|
||||||
|
const auto result = fopen(path, mode);
|
||||||
|
shithook::enable(fopen_ptr);
|
||||||
|
fopen_mutex.unlock();
|
||||||
|
|
||||||
|
LOGI("fopen result = %p", result);
|
||||||
|
return result;
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// the original function returns 1 if no emulator is found else a number associated with an emulator.
|
||||||
|
//
|
||||||
|
__attribute__((noinline))
|
||||||
|
signed int emulator_check(const char* a1, const char* a2)
|
||||||
|
{
|
||||||
|
LOGI("emulator check called.... spoofing emulator....");
|
||||||
|
return 1;
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// never send is cheat packet....
|
||||||
|
//
|
||||||
|
__attribute__((noinline))
|
||||||
|
int tss_sdk_ischeatpacket(int a1)
|
||||||
|
{
|
||||||
|
return false;
|
||||||
|
}
|
||||||
|
|
||||||
|
//
|
||||||
|
// spoof all hwids to "what do you call nuts on your chin? a dick down your throat you fucking retard!"
|
||||||
|
//
|
||||||
|
__attribute__((noinline))
|
||||||
|
int system_property_hook(const char* name, char* value)
|
||||||
|
{
|
||||||
|
LOGI("trying to get HWID = %s", name);
|
||||||
|
system_prop_mutex.lock();
|
||||||
|
shithook::disable(system_prop_get);
|
||||||
|
__system_property_get(name, value);
|
||||||
|
shithook::enable(system_prop_get);
|
||||||
|
system_prop_mutex.unlock();
|
||||||
|
|
||||||
|
//
|
||||||
|
// dont spoof persist.sys.timezone.
|
||||||
|
//
|
||||||
|
if (strcmp(name, "persist.sys.timezone") != 0)
|
||||||
|
{
|
||||||
|
LOGI("spoofing hwid = %s, to = %s", value, HWID_VALUE);
|
||||||
|
value = HWID_VALUE;
|
||||||
|
}
|
||||||
|
return strlen(value);
|
||||||
|
}
|
||||||
|
|
||||||
|
void ms_hook_function(int* a1, int a2, int* a3)
|
||||||
|
{
|
||||||
|
LOGI("MSHookFunction called, hooking = %p, to = %p", a1, a2);
|
||||||
|
return;
|
||||||
|
}
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,30 @@
|
|||||||
|
#pragma once
|
||||||
|
#include <dlfcn.h>
|
||||||
|
#include <mutex>
|
||||||
|
#include <android/log.h>
|
||||||
|
#include <sys/system_properties.h>
|
||||||
|
#include "shithook.h"
|
||||||
|
|
||||||
|
#define HWID_VALUE "what do you call nuts on your chin? a dick down your throat you fucking retard!"
|
||||||
|
#define LOGI(...) ((void)__android_log_print(ANDROID_LOG_INFO, "ligma", __VA_ARGS__))
|
||||||
|
#define offset_emulator_check 0x000D7B4
|
||||||
|
#define offset_ischeat_packet 0x00128E0
|
||||||
|
#define offset_mshook_function 0x0010358
|
||||||
|
|
||||||
|
namespace ligma
|
||||||
|
{
|
||||||
|
namespace bypass
|
||||||
|
{
|
||||||
|
inline void* fopen_ptr = nullptr;
|
||||||
|
inline void* system_prop_get = nullptr;
|
||||||
|
inline std::mutex fopen_mutex; // every shithook you make you will need a mutex.
|
||||||
|
inline std::mutex system_prop_mutex;
|
||||||
|
|
||||||
|
void init();
|
||||||
|
signed int emulator_check(const char* a1, const char* a2);
|
||||||
|
FILE* fopen_hook(const char* path, const char* mode);
|
||||||
|
int tss_sdk_ischeatpacket(int a1);
|
||||||
|
int system_property_hook(const char* name, char* value);
|
||||||
|
void ms_hook_function(int* a1, int a2, int* a3);
|
||||||
|
}
|
||||||
|
}
|
||||||
@ -0,0 +1,8 @@
|
|||||||
|
#include "bypass.h"
|
||||||
|
|
||||||
|
__attribute__((constructor))
|
||||||
|
void init()
|
||||||
|
{
|
||||||
|
ligma::bypass::init();
|
||||||
|
LOGI("bypassed anti cheat.....");
|
||||||
|
}
|
||||||
@ -0,0 +1,27 @@
|
|||||||
|
<?xml version="1.0" encoding="utf-8"?>
|
||||||
|
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||||
|
<ItemGroup>
|
||||||
|
<Filter Include="source">
|
||||||
|
<UniqueIdentifier>{8fc1c384-bc0c-40ad-91fd-d12eb8f15083}</UniqueIdentifier>
|
||||||
|
</Filter>
|
||||||
|
<Filter Include="headers">
|
||||||
|
<UniqueIdentifier>{a802d5b1-4373-45ec-9899-a56dcab8effb}</UniqueIdentifier>
|
||||||
|
</Filter>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClCompile Include="ligma.cpp">
|
||||||
|
<Filter>source</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
<ClCompile Include="bypass.cpp">
|
||||||
|
<Filter>source</Filter>
|
||||||
|
</ClCompile>
|
||||||
|
</ItemGroup>
|
||||||
|
<ItemGroup>
|
||||||
|
<ClInclude Include="shithook.h">
|
||||||
|
<Filter>headers</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
<ClInclude Include="bypass.h">
|
||||||
|
<Filter>headers</Filter>
|
||||||
|
</ClInclude>
|
||||||
|
</ItemGroup>
|
||||||
|
</Project>
|
||||||
@ -0,0 +1,134 @@
|
|||||||
|
/*
|
||||||
|
MIT License
|
||||||
|
|
||||||
|
Copyright (c) 2020 xerox
|
||||||
|
|
||||||
|
Permission is hereby granted, free of charge, to any person obtaining a copy
|
||||||
|
of this software and associated documentation files (the "Software"), to deal
|
||||||
|
in the Software without restriction, including without limitation the rights
|
||||||
|
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
|
||||||
|
copies of the Software, and to permit persons to whom the Software is
|
||||||
|
furnished to do so, subject to the following conditions:
|
||||||
|
|
||||||
|
The above copyright notice and this permission notice shall be included in all
|
||||||
|
copies or substantial portions of the Software.
|
||||||
|
|
||||||
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
|
||||||
|
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
||||||
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
|
||||||
|
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
|
||||||
|
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
|
||||||
|
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
|
||||||
|
SOFTWARE.
|
||||||
|
*/
|
||||||
|
|
||||||
|
#pragma once
|
||||||
|
#include <map>
|
||||||
|
#include <atomic>
|
||||||
|
#include <memory>
|
||||||
|
#include <unistd.h>
|
||||||
|
#include <sys/mman.h>
|
||||||
|
|
||||||
|
#define PAGE_START(ptr) reinterpret_cast<void*>(reinterpret_cast<std::uintptr_t>(ptr) >> 12 << 12)
|
||||||
|
#define ARM_JMP_CODE 0xE51FF004
|
||||||
|
|
||||||
|
namespace shithook
|
||||||
|
{
|
||||||
|
class detour
|
||||||
|
{
|
||||||
|
public:
|
||||||
|
detour(void* addr_to_hook, void* jmp_to, bool enable = true)
|
||||||
|
:
|
||||||
|
hook_addr(addr_to_hook),
|
||||||
|
detour_addr(jmp_to),
|
||||||
|
hook_installed(false)
|
||||||
|
{
|
||||||
|
reinterpret_cast<std::uint32_t*>(jmp_code)[0] = ARM_JMP_CODE; // LDR PC, [PC, #-4]
|
||||||
|
reinterpret_cast<void**>(jmp_code)[1] = jmp_to;
|
||||||
|
memcpy(org_bytes, hook_addr, sizeof(org_bytes));
|
||||||
|
if (enable) install();
|
||||||
|
}
|
||||||
|
|
||||||
|
void install()
|
||||||
|
{
|
||||||
|
if (hook_installed.load())
|
||||||
|
return;
|
||||||
|
|
||||||
|
if (!mprotect(PAGE_START(hook_addr), getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC))
|
||||||
|
{
|
||||||
|
memcpy((void*)((long)hook_addr), jmp_code, sizeof(jmp_code));
|
||||||
|
mprotect(PAGE_START(hook_addr), getpagesize(), PROT_READ | PROT_EXEC);
|
||||||
|
cacheflush(reinterpret_cast<long>(hook_addr), reinterpret_cast<long>(hook_addr) + getpagesize(), NULL);
|
||||||
|
hook_installed.exchange(true);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
void uninstall()
|
||||||
|
{
|
||||||
|
if (!hook_installed.load())
|
||||||
|
return;
|
||||||
|
|
||||||
|
if (!mprotect(PAGE_START(hook_addr), getpagesize(), PROT_READ | PROT_WRITE | PROT_EXEC))
|
||||||
|
{
|
||||||
|
memcpy(hook_addr, org_bytes, sizeof(jmp_code));
|
||||||
|
mprotect(PAGE_START(hook_addr), getpagesize(), PROT_READ | PROT_EXEC);
|
||||||
|
cacheflush(reinterpret_cast<long>(hook_addr), reinterpret_cast<long>(hook_addr) + getpagesize(), NULL);
|
||||||
|
hook_installed.exchange(false);
|
||||||
|
}
|
||||||
|
}
|
||||||
|
|
||||||
|
~detour() { uninstall(); }
|
||||||
|
bool installed() { return hook_installed; }
|
||||||
|
void* hook_address() { return hook_addr; }
|
||||||
|
void* detour_address() { return detour_addr; }
|
||||||
|
private:
|
||||||
|
std::atomic<bool> hook_installed;
|
||||||
|
void* hook_addr, * detour_addr;
|
||||||
|
|
||||||
|
unsigned char jmp_code[8]{};
|
||||||
|
std::uint8_t org_bytes[sizeof(jmp_code)];
|
||||||
|
};
|
||||||
|
|
||||||
|
// this is jank, but needed because the OS isnt initalizing statics/inlined globals... :|
|
||||||
|
inline std::map<void*, std::unique_ptr<detour>>* get_hooks()
|
||||||
|
{
|
||||||
|
static std::map<void*, std::unique_ptr<detour>> hooks{};
|
||||||
|
return &hooks;
|
||||||
|
}
|
||||||
|
|
||||||
|
inline void make_hook(void* addr_to_hook, void* jmp_to_addr, bool enable = true)
|
||||||
|
{
|
||||||
|
if (!addr_to_hook)
|
||||||
|
return;
|
||||||
|
|
||||||
|
get_hooks()->insert({
|
||||||
|
addr_to_hook,
|
||||||
|
std::make_unique<detour>(
|
||||||
|
addr_to_hook,
|
||||||
|
jmp_to_addr,
|
||||||
|
enable
|
||||||
|
) }
|
||||||
|
);
|
||||||
|
}
|
||||||
|
|
||||||
|
inline void enable(void* addr)
|
||||||
|
{
|
||||||
|
if (!addr)
|
||||||
|
return;
|
||||||
|
get_hooks()->at(addr)->install();
|
||||||
|
}
|
||||||
|
|
||||||
|
inline void disable(void* addr)
|
||||||
|
{
|
||||||
|
if (!addr)
|
||||||
|
return;
|
||||||
|
get_hooks()->at(addr)->uninstall();
|
||||||
|
}
|
||||||
|
|
||||||
|
inline void remove(void* addr)
|
||||||
|
{
|
||||||
|
if (!addr)
|
||||||
|
return;
|
||||||
|
get_hooks()->erase(addr);
|
||||||
|
}
|
||||||
|
}
|
||||||
Loading…
Reference in new issue