summaryrefslogtreecommitdiff
path: root/csgo-loader/csgo-client/Security/SyscallManager.cpp
diff options
context:
space:
mode:
authorboris <wzn@moneybot.cc>2018-12-20 21:38:04 +1300
committerboris <wzn@moneybot.cc>2018-12-20 21:38:04 +1300
commita5acd4c9a3b24c9d5af3a8f504e5af053fa7fa09 (patch)
tree27bc30d3f35e5daaaa15ee6de066119df8d352c7 /csgo-loader/csgo-client/Security/SyscallManager.cpp
parent77b52da44b263df4884be2f35f885d8edccbb6fa (diff)
yo is this loss
Diffstat (limited to 'csgo-loader/csgo-client/Security/SyscallManager.cpp')
-rw-r--r--csgo-loader/csgo-client/Security/SyscallManager.cpp40
1 files changed, 25 insertions, 15 deletions
diff --git a/csgo-loader/csgo-client/Security/SyscallManager.cpp b/csgo-loader/csgo-client/Security/SyscallManager.cpp
index 55d68a3..9de2459 100644
--- a/csgo-loader/csgo-client/Security/SyscallManager.cpp
+++ b/csgo-loader/csgo-client/Security/SyscallManager.cpp
@@ -4,17 +4,21 @@
// Global accessor for SyscallManager.
Wrapper::SyscallManagerPtr Syscalls = std::make_unique<Wrapper::SyscallManager>();
-namespace Wrapper {
- void SyscallStub::SetIndex(uint32_t Index) {
+namespace Wrapper
+{
+ void SyscallStub::SetIndex(uint32_t Index)
+ {
unsigned long OldProtection{};
-
+
// Make the code executable and set the index.
- if(VirtualProtect(m_Shellcode, sizeof m_Shellcode, PAGE_EXECUTE_READWRITE, &OldProtection)) {
+ if(VirtualProtect(m_Shellcode, sizeof m_Shellcode, PAGE_EXECUTE_READWRITE, &OldProtection))
+ {
*(uint32_t *)(&m_Shellcode[4]) = Index;
}
}
- ByteArray SyscallManager::GetNtdllFromDisk() {
+ ByteArray SyscallManager::GetNtdllFromDisk()
+ {
char SystemPath[MAX_PATH];
GetSystemDirectoryA(SystemPath, MAX_PATH);
@@ -42,7 +46,8 @@ namespace Wrapper {
}
// Stolen :-)
- uint64_t SyscallManager::GetRawOffsetByRva(IMAGE_SECTION_HEADER *SectionHeader, uint64_t Sections, uint64_t FileSize, uint64_t Rva) {
+ uint64_t SyscallManager::GetRawOffsetByRva(IMAGE_SECTION_HEADER *SectionHeader, uint64_t Sections, uint64_t FileSize, uint64_t Rva)
+ {
IMAGE_SECTION_HEADER *Header = GetSectionByRva(SectionHeader, Sections, Rva);
if(!Header)
@@ -59,10 +64,12 @@ namespace Wrapper {
return Offset;
}
- IMAGE_SECTION_HEADER *SyscallManager::GetSectionByRva(IMAGE_SECTION_HEADER *SectionHeader, uint64_t Sections, uint64_t Rva) {
+ IMAGE_SECTION_HEADER *SyscallManager::GetSectionByRva(IMAGE_SECTION_HEADER *SectionHeader, uint64_t Sections, uint64_t Rva)
+ {
IMAGE_SECTION_HEADER *Header = SectionHeader;
- for(size_t i{}; i < Sections; ++i, ++Header) {
+ for(size_t i{}; i < Sections; ++i, ++Header)
+ {
uint64_t VirtualAddress = Header->VirtualAddress;
uint64_t AddressBounds = VirtualAddress + Header->SizeOfRawData;
@@ -74,9 +81,10 @@ namespace Wrapper {
}
// Sick macros, retard.
- #define GetRvaPointer(Rva) (Buffer + GetRawOffsetByRva(SectionHeader, SectionCount, FileSize, Rva))
+#define GetRvaPointer(Rva) (Buffer + GetRawOffsetByRva(SectionHeader, SectionCount, FileSize, Rva))
- bool SyscallManager::Start() {
+ bool SyscallManager::Start()
+ {
// Read contents of NTDLL.
ByteArray Ntdll = GetNtdllFromDisk();
@@ -101,7 +109,7 @@ namespace Wrapper {
if(!SectionHeader)
return false;
-
+
uint64_t ExportRva = NtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].VirtualAddress;
uint64_t ExportSize = NtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_EXPORT].Size;
uint64_t ExportRaw = GetRawOffsetByRva(SectionHeader, SectionCount, FileSize, ExportRva);
@@ -120,7 +128,8 @@ namespace Wrapper {
return false;
// Loop each exported symbol.
- for(uint32_t n{}; n < ExportDirectory->NumberOfNames; ++n) {
+ for(uint32_t n{}; n < ExportDirectory->NumberOfNames; ++n)
+ {
uint32_t NameRva = Names[n];
uint32_t FunctionRva = Functions[Ordinals[n]];
@@ -129,10 +138,11 @@ namespace Wrapper {
// We've found a syscall.
uint8_t *Opcodes = (uint8_t *)(Buffer + FunctionRawOffset);
-
- if(!memcmp(Opcodes, "\x4C\x8B\xD1\xB8", 4)) {
+
+ if(!memcmp(Opcodes, "\x4C\x8B\xD1\xB8", 4))
+ {
uint32_t SyscallIndex = *(uint32_t *)(Buffer + FunctionRawOffset + 4);
-
+
char *SyscallName = (char *)(Buffer + NameRawOffset);
uint64_t SyscallNameHash = fnv::hash_runtime(SyscallName);