From cf5b78a92c522acf46a816ff3b190fbc34fc8b4b Mon Sep 17 00:00:00 2001 From: weak1337 <57501119+weak1337@users.noreply.github.com> Date: Fri, 1 Apr 2022 18:47:47 +0200 Subject: [PATCH] Add files via upload --- main.cpp | 244 +++++++++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 244 insertions(+) create mode 100644 main.cpp diff --git a/main.cpp b/main.cpp new file mode 100644 index 0000000..a52f078 --- /dev/null +++ b/main.cpp @@ -0,0 +1,244 @@ +#include +#include +#include +#include +#include +#include +#include "utils.h" + + +typedef HRESULT(__stdcall* D3D11PresentHook) (IDXGISwapChain* This, UINT SyncInterval, UINT Flags); +volatile static D3D11PresentHook oPresent = NULL; +uintptr_t** present_pointer; +IDXGISwapChain* globalchain; +extern "C" HRESULT __stdcall hookD3D11Present(IDXGISwapChain * This, UINT SyncInterval, UINT Flags) +{ + printf("[>] Handler called! Saving swapchain\n"); + globalchain = This; + *present_pointer = (uintptr_t*)oPresent; + return oPresent(This, SyncInterval, Flags); +} + + +std::unordered_map>modules{ + { "gameoverlayrenderer64.dll", std::tuple("33 F6 83 E5 F7 44 8B C5 8B D6 49 8B CE FF 15", 15) }, + { "DiscordHook64.dll", std::tuple("48 89 D9 89 FA 41 89 F0 FF 15", 10) }, + { "overlay64.dll", std::tuple("48 8B 5C 24 40 44 8B 44 24 30 8B 54 24 38 48 8B CB FF 15", 19) }, + { "DiscordHook64.dll", std::tuple("44 8B C7 8B D6 48 8B CB FF 15", 10) } +}; + +bool func_anomaly(uintptr_t& present) { + bool found_anomaly = false; + + while (true) { + + + while (true) { + while (*(BYTE*)present == 0xE9) { + if (*(DWORD*)(present + 5) == 0xCCCCCCCC) + found_anomaly = true; + present += *(signed int*)(present + 1) + 5; + } + if (*(WORD*)present != 0x25FF) + break; + present = *(uintptr_t*)(present + 6); + } + + if (*(WORD*)present != 0xB848 || *((WORD*)present + 5) != 0xE0FF) + break; + present = *(uintptr_t*)(present + 2); + found_anomaly = true; + } + return found_anomaly; +} + +bool find_memory_anomaly(uintptr_t present) { + bool found_anomaly = false; + MEMORY_BASIC_INFORMATION mbi = { 0 }; + MEMORY_BASIC_INFORMATION mbi2 = { 0 }; + NTSTATUS v27 = NtQueryVirtualMemory((HANDLE) - 1, (LPVOID)present, MemoryBasicInformation, &mbi, 48i64, 0) < 0; + NTSTATUS v7 = v27; + NTSTATUS v28; + bool v31 = v27 + || mbi.State != MEM_COMMIT + || mbi.Type != MEM_IMAGE + && (mbi.Type != MEM_PRIVATE + || mbi.State != MEM_FREE + || *((uintptr_t*)present + 20) != 0xEBFFFFFF41058D48ui64 + || (present = *((uintptr_t*)present - 3), + v28 = NtQueryVirtualMemory((HANDLE) - 1i64, (LPVOID)present, MemoryBasicInformation, &mbi2, 48i64, 0) < 0, + v7 = v28) + || mbi2.State != MEM_COMMIT + || mbi2.Type != MEM_IMAGE) + || mbi.Protect != 16 && mbi.Protect != 32 && mbi.Protect != 64 && mbi.Protect != 128 + || *(uintptr_t*)present == 0x74894808245C8948i64 + && (*((uintptr_t*)present + 1) == 0x4140EC8348571024i64 + || *((uintptr_t*)present + 1) == 0x5518247C89481024i64) + || *(uintptr_t*)present == 0x57565520245C8948i64 + || *(uintptr_t*)present == 0x4157551824748948i64 + || *(uintptr_t*)present == 0x8D48564157565540ui64 + || *(DWORD*)present == 1220840264 && *((WORD*)present + 2) == 22665 + || *(uintptr_t*)present == 0x5741564157565340i64 + || *(uintptr_t*)present == 0x5741564155C48B48i64 + || *(uintptr_t*)present == 0x4156415441575540i64; + found_anomaly = v31; + return found_anomaly; +} + +int main() { + bool reported = false; + + //General report + { + + uintptr_t base = (uintptr_t)GetModuleHandleA("dxgi.dll"); + if (base) { + PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)base; + PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(base + dos->e_lfanew); + DWORD code_base = nt->OptionalHeader.BaseOfCode; + DWORD code_size = nt->OptionalHeader.SizeOfCode; + uintptr_t code_start = code_base + base; + uintptr_t sig_base = utils::scanpattern(code_start, code_size, "48 C7 40 B8 FE FF FF FF 48 89 58 18"); + if (sig_base) { + uintptr_t swap_chain = sig_base + *(signed int*)(sig_base + 0x25) + 0x29; + uintptr_t present = *(uintptr_t*)(swap_chain + 0x40); + MEMORY_BASIC_INFORMATION mbi_globalchain = { 0 }; + NTSTATUS globalchainstatus = NtQueryVirtualMemory((HANDLE)-1, (PVOID)swap_chain, MemoryBasicInformation, (PVOID)&mbi_globalchain, sizeof(mbi_globalchain), 0); + if (globalchainstatus || func_anomaly(present)) { + reported = true; + printf("[!!!] Anomaly at: %p\n", present); + } + + else + { + printf("[>] No anomalys found jump chain ends at %p\n", present); + printf("[>] Verifying memory!\n"); + if (find_memory_anomaly(present)) { + printf("[!!!] Memory anomaly at destination!\n"); + reported = true; + } + + } + printf("==GENERAL REPORT==\n"); + printf("Report: %x %x\n", 0x47, 0x1); + printf("Present: %p\n", present); + printf("First 32 bytes...\n"); + printf("Allocation base: %p\n", mbi_globalchain.AllocationBase); + printf("Base address: %p\n", mbi_globalchain.BaseAddress); + } + + + } + + } + + //Module specific detections + int idx = 0; + for (auto pair : modules) { + if (uintptr_t base = (uintptr_t)GetModuleHandleA(pair.first.c_str())) { + present_pointer = 0; + PIMAGE_DOS_HEADER dos = (PIMAGE_DOS_HEADER)base; + PIMAGE_NT_HEADERS nt = (PIMAGE_NT_HEADERS)(base + dos->e_lfanew); + DWORD code_base = nt->OptionalHeader.BaseOfCode; + DWORD code_size = nt->OptionalHeader.SizeOfCode; + uintptr_t code_start = code_base + base; + + uintptr_t sig_base = utils::scanpattern(code_start, code_size, std::get<0>(pair.second).c_str()); + if (!sig_base) + continue; + printf("[>] Sig at %p\n", sig_base); + if (idx == 0) { //gameoverlayrenderer64.dll + uintptr_t jmp_dst = sig_base - 0x45; + if (*(BYTE*)jmp_dst == 0xE8 && + (jmp_dst += *(signed int*)(jmp_dst + 1) + 5, *(DWORD*)jmp_dst != 0x83485340)) { + present_pointer = (uintptr_t**)&jmp_dst; + } + + } + else if (idx == 1) { //DiscordHook64.dll + uintptr_t jmp_dst = sig_base - 0x13; + if (*(BYTE*)jmp_dst == 0xE8 && + (jmp_dst += *(signed int*)(jmp_dst + 1) + 5, *(BYTE*)jmp_dst == 0xE9) && + (jmp_dst += *(signed int*)(jmp_dst + 1) + 15, *(BYTE*)jmp_dst == 0xE9) && + (jmp_dst += *(signed int*)(jmp_dst + 1) + 5, *(BYTE*)jmp_dst != 0x56535540) + ) { + present_pointer = (uintptr_t**)&jmp_dst; + } + + else { + jmp_dst = sig_base - 0xA6; + if (*(BYTE*)jmp_dst == 0xE9 && + (jmp_dst += *(signed int*)(jmp_dst + 1) + 5, *(BYTE*)jmp_dst == 0xE9) && + (jmp_dst += *(signed int*)(jmp_dst + 1) + 6, **(uintptr_t**)jmp_dst == 0x2454891824448944) + ) { + present_pointer = (uintptr_t**)jmp_dst; + } + } + } + + if(!present_pointer) { //overlay64.dll or DiscordHook64.dll + present_pointer = (uintptr_t**)(sig_base + std::get<1>(pair.second)+ *(DWORD*)(sig_base + std::get<1>(pair.second)) + 4); + } + if (present_pointer && *present_pointer) { + + MEMORY_BASIC_INFORMATION mbi = { 0 }; + NTSTATUS status = NtQueryVirtualMemory((HANDLE) - 1, *present_pointer, MemoryBasicInformation, (PVOID) & mbi, sizeof(mbi), 0); + if (status || mbi.State != MEM_COMMIT || mbi.Type != MEM_PRIVATE || mbi.Protect != PAGE_EXECUTE_READWRITE || *(DWORD*)(*present_pointer) == 0x50C03148) { //xor rax, rax push rax + printf("[!!!] Present is invalid memory! %p %p\n", status, &mbi); + reported = true; + + } + + printf("[>] Present pointer in %s at %p\n", pair.first.c_str(), present_pointer); + + oPresent = (D3D11PresentHook)*present_pointer; + *present_pointer = (uintptr_t*)hookD3D11Present; + + Sleep(1000); //Sleep and hope that present got called once + printf("[>] Found SwapChain at %p\n", globalchain); + MEMORY_BASIC_INFORMATION mbi_globalchain = { 0 }; + NTSTATUS globalchainstatus = NtQueryVirtualMemory((HANDLE)-1, globalchain, MemoryBasicInformation, (PVOID)&mbi_globalchain, sizeof(mbi_globalchain), 0); + uintptr_t present_from_vtable = *(uintptr_t*)(*(uintptr_t*)(globalchain)+0x40); + if (globalchainstatus || func_anomaly(present_from_vtable)) { + reported = true; + printf("[!!!] Anomaly at: %p\n", present_from_vtable); + } + + else + { + printf("[>] No anomalys found jump chain ends at %p\n", present_from_vtable); + printf("[>] Verifying memory!\n"); + if (find_memory_anomaly(present_from_vtable)) { + printf("[!!!] Memory anomaly at destination!\n"); + reported = true; + } + + } + } + } + idx++; + } + if (reported) { + printf("[!!!] You received reports!\n"); + } + else { + printf("[>] No reports! You're good to go\n"); + } +} + +BOOL WINAPI DllMain(HINSTANCE hinstDLL, // handle to DLL module + DWORD fdwReason, // reason for calling function + LPVOID lpReserved) +{ + switch (fdwReason) { + case DLL_PROCESS_ATTACH: { + AllocConsole(); + FILE* f; + freopen_s(&f, "CONOUT$", "w", stdout); + main(); + break; + } + + } + return TRUE; +} \ No newline at end of file