You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
65 lines
1.9 KiB
65 lines
1.9 KiB
3 years ago
|
#include "stdfax.hpp"
|
||
|
|
|
||
|
|
void search_thread( void )
|
||
|
|
{
|
||
|
|
while (true)
|
||
|
|
{
|
||
|
|
MEMORY_BASIC_INFORMATION mem_info{};
|
||
|
|
|
||
|
|
for ( std::uint32_t base = 0; VirtualQuery(reinterpret_cast< void* >( base ), &mem_info, sizeof( MEMORY_BASIC_INFORMATION ) ); base += mem_info.RegionSize)
|
||
|
|
{
|
||
|
|
// x86 package is manual mapped, therefore we must pattern scan this address space for it's contents.
|
||
|
|
// This doesn't necessarily take long, as we are running in a 32-bit address space where most memory will by skipped by VirtualQuery anyways.
|
||
|
|
|
||
|
|
if ( mem_info.Protect == PAGE_EXECUTE_READWRITE && mem_info.State & MEM_COMMIT )
|
||
|
|
{
|
||
|
|
const auto result =
|
||
|
|
utils::find_pattern(reinterpret_cast< std::uint8_t* >( mem_info.BaseAddress ), mem_info.RegionSize,
|
||
|
|
reinterpret_cast<std::uint8_t*>( const_cast<char*>( "\x55\x8B\xEC\x81\xEC\xAA\xAA\xAA\xAA\x89\x4D\x94\x83\x65\xA0\x00" ) ), 16, 0xAA);
|
||
|
|
|
||
|
|
if ( !result )
|
||
|
|
{
|
||
|
|
Sleep( 5 );
|
||
|
|
continue;
|
||
|
|
}
|
||
|
|
|
||
|
|
hooks::image_fn.handler_func = &hooks::map_image;
|
||
|
|
hooks::image_fn.hook_addr = result;
|
||
|
|
hooks::image_fn.original = *reinterpret_cast< std::uint8_t* >( result );
|
||
|
|
|
||
|
|
*reinterpret_cast< std::uint8_t* >( result ) = 0xCC;
|
||
|
|
return ExitThread( 0xEAC );
|
||
|
|
}
|
||
|
|
}
|
||
|
|
}
|
||
|
|
|
||
|
|
return ExitThread( 0xDEAD );
|
||
|
|
}
|
||
|
|
|
||
|
|
long __stdcall veh_handler( _EXCEPTION_POINTERS* ctx )
|
||
|
|
{
|
||
|
|
if ( ctx->ExceptionRecord->ExceptionAddress == hooks::image_fn.hook_addr &&
|
||
|
|
ctx->ExceptionRecord->ExceptionCode == STATUS_BREAKPOINT )
|
||
|
|
{
|
||
|
|
return hooks::image_fn.handler_func( ctx->ContextRecord );
|
||
|
|
}
|
||
|
|
|
||
|
|
return EXCEPTION_CONTINUE_SEARCH;
|
||
|
|
}
|
||
|
|
|
||
|
|
bool dll_main( void )
|
||
|
|
{
|
||
|
|
const auto init = []() -> bool
|
||
|
|
{
|
||
|
|
AddVectoredExceptionHandler(0, &veh_handler);
|
||
|
|
|
||
|
|
const auto handle = CreateThread(nullptr, 0, reinterpret_cast<LPTHREAD_START_ROUTINE>(&search_thread), nullptr, 0, nullptr);
|
||
|
|
if ( !handle || handle == INVALID_HANDLE_VALUE )
|
||
|
|
return false;
|
||
|
|
|
||
|
|
CloseHandle( handle );
|
||
|
|
return true;
|
||
|
|
};
|
||
|
|
|
||
|
|
return init( );
|
||
|
|
}
|