1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
|
#include "manual_map.hpp"
namespace remote_code {
//i really hope you do this the turbochad way and sigscan your own shellcode for 69696969
// u rite
constexpr size_t shellcode_size = 83;
constexpr uint8_t shellcode_code[] = {
0x55, // push ebp
0x8B, 0xEC, // mov ebp, esp
0x51, // push ecx
0x56, // push esi
0x8D, 0x45, 0xFC, // lea eax, dword ptr[ ebp-4 ]
0xC7, 0x45, 0xFC, 0x00, 0x00, 0x00, 0x00, // mov dword ptr[ ebp-4 ], 0
// ; remove memory protection so we can write
0x50, // push eax
0x6A, 0x40, // push 40h
0x6A, 0x04, // push 4h
0x68, 0x69, 0x69, 0x69, 0x69, // push dword ptr[ vmt_endscene ]
0xBE, 0xEF, 0xBE, 0xAD, 0xDE, // mov esi, dword ptr[ virtual_protect ]
0xFF, 0xD6, // call esi
0x84, 0xC0, // test al, al
0x74, 0x2A, // jz clean_up
0x8D, 0x45, 0xFC, // lea eax, dword ptr[ ebp-4 ]
// ; restore endscene ptr
0xC7, 0x05, 0x69, 0x69, 0x69, 0x69, 0x0F, 0xD0, 0x0F, 0xD0, // mov [ vmt_endscene ], [ vmt_endscene_o ]
// ; restore memory protection
0x50, // push eax
0xFF, 0x75, 0xFC, // push dword ptr[ ebp-4 ]
0x6A, 0x04, // push 4h
0x68, 0x69, 0x69, 0x69, 0x69, // push dword ptr[ vmt_endscene ]
0xFF, 0xD6, // call esi
// ; call cheat entrypoint
0x6A, 0x00, // push 0h
0x6A, 0x01, // push 1h
0x68, 0xDE, 0xC0, 0xAD, 0xDE, // push dword ptr[ cheat_header ]
0xB8, 0x0D, 0xF0, 0xAD, 0xDE, // mov eax, dword ptr[ cheat_entry ]
0xFF, 0xD0, // call eax
// clean_up:
0x5E, // pop esi
0x8B, 0xE5, // mov esp, ebp
0x5D, // pop ebp
0xC3 // retn
};
struct shellcode_args_t {
uint32_t m_virtual_protect; // 0xDEADBEEF
uint32_t m_cheat_entrypoint; // 0xDEADF00D
uint32_t m_cheat_header; // 0xDEADC0DE
uint32_t m_endscene; // 0x69696969
uint32_t m_endscene_o; // 0xD00FD00F
};
// turbo chad sig scanner (c) bowis
int32_t find_byte_pattern(std::vector<uint8_t> &code, std::vector<uint8_t> pattern) {
for (int32_t n = 0; n < code.size(); ++n) {
// check if code matches
if ((code.size() - n) >= pattern.size()) {
if (!memcmp(&code[n], pattern.data(), pattern.size()))
return n;
}
}
return -1;
}
// turbo chad code patcher (c) bowis
void patch_code(std::vector<uint8_t> &code, int32_t offset, uint32_t value) {
std::memset(&code[offset], value, sizeof uint32_t);
}
std::vector<uint8_t> make_code(shellcode_args_t *arg) {
std::vector<uint8_t> code;
code.insert(code.begin(), shellcode_code, shellcode_code + shellcode_size);
patch_code(code, find_byte_pattern(code, { 0xEF, 0xBE, 0xAD, 0xDE }), arg->m_virtual_protect);
patch_code(code, find_byte_pattern(code, { 0x0D, 0xF0, 0xAD, 0xDE }), arg->m_cheat_entrypoint);
patch_code(code, find_byte_pattern(code, { 0xDE, 0xC0, 0xAD, 0xDE }), arg->m_cheat_header);
patch_code(code, find_byte_pattern(code, { 0x0F, 0xD0, 0x0F, 0xD0 }), arg->m_endscene_o);
// there are three occurences of endscene
for(int n = 0; n < 3; ++n)
patch_code(code, find_byte_pattern(code, { 0x69, 0x69, 0x69, 0x69 }), arg->m_endscene);
for (auto &c : code) {
printf("%02x ", c);
}
return code;
}
}
namespace inject {
// pe file implementation
c_pe_file::c_pe_file(const char *file) {
std::ifstream pe_file(file, std::ifstream::in | std::ifstream::binary);
if (!pe_file.is_open()) {
printf("file (%s) does not exist\n", file);
return;
}
pe_file.seekg(0, pe_file.end);
auto pe_size = pe_file.tellg();
m_file.resize(pe_size);
pe_file.seekg(0, pe_file.beg);
// HOMOSEXUAL CAST FUCKERY PLEASE SKIP THIS LINE
// AAAAAAAAAAAA BAD
pe_file.read((char*)&m_file[0], pe_size);
pe_file.close();
//remote_code::shellcode_args_t args;
//args = { 0x11111111, 0x22222222, 0x33333333, 0x44444444, 0x55555555 };
//remote_code::make_code(&args);
}
bool c_pe_file::valid() {
nt::dos_header_t *dos_header;
nt::nt_headers_t *nt_headers;
// check dos header
dos_header = reinterpret_cast<decltype(dos_header)>(data());
if (dos_header->e_magic != 0x45DA)
return false;
// check nt header
nt_headers = reinterpret_cast<decltype(nt_headers)>(data() + dos_header->e_lfanew);
if (nt_headers->signature != 0x50450000)
return false;
return true;
}
uint8_t *c_pe_file::data() {
// go to the beginning of the file
return m_file.data();
}
size_t c_pe_file::size() const {
return m_file.size();
}
}
|
