188 lines
5.5 KiB
C++
188 lines
5.5 KiB
C++
|
||
//
|
||
// created by AheadLib
|
||
// github:https://github.com/strivexjun/AheadLib-x86-x64
|
||
//
|
||
|
||
#include <windows.h>
|
||
#include <Shlwapi.h>
|
||
|
||
#pragma comment( lib, "Shlwapi.lib")
|
||
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoA=AheadLib_GetFileVersionInfoA,@1")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoByHandle=AheadLib_GetFileVersionInfoByHandle,@2")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoExA=AheadLib_GetFileVersionInfoExA,@3")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoExW=AheadLib_GetFileVersionInfoExW,@4")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeA=AheadLib_GetFileVersionInfoSizeA,@5")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeExA=AheadLib_GetFileVersionInfoSizeExA,@6")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeExW=AheadLib_GetFileVersionInfoSizeExW,@7")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoSizeW=AheadLib_GetFileVersionInfoSizeW,@8")
|
||
#pragma comment(linker, "/EXPORT:GetFileVersionInfoW=AheadLib_GetFileVersionInfoW,@9")
|
||
#pragma comment(linker, "/EXPORT:VerFindFileA=AheadLib_VerFindFileA,@10")
|
||
#pragma comment(linker, "/EXPORT:VerFindFileW=AheadLib_VerFindFileW,@11")
|
||
#pragma comment(linker, "/EXPORT:VerInstallFileA=AheadLib_VerInstallFileA,@12")
|
||
#pragma comment(linker, "/EXPORT:VerInstallFileW=AheadLib_VerInstallFileW,@13")
|
||
#pragma comment(linker, "/EXPORT:VerLanguageNameA=KERNEL32.VerLanguageNameA,@14")
|
||
#pragma comment(linker, "/EXPORT:VerLanguageNameW=KERNEL32.VerLanguageNameW,@15")
|
||
#pragma comment(linker, "/EXPORT:VerQueryValueA=AheadLib_VerQueryValueA,@16")
|
||
#pragma comment(linker, "/EXPORT:VerQueryValueW=AheadLib_VerQueryValueW,@17")
|
||
|
||
|
||
extern "C"
|
||
{
|
||
PVOID pfnAheadLib_GetFileVersionInfoA;
|
||
PVOID pfnAheadLib_GetFileVersionInfoByHandle;
|
||
PVOID pfnAheadLib_GetFileVersionInfoExA;
|
||
PVOID pfnAheadLib_GetFileVersionInfoExW;
|
||
PVOID pfnAheadLib_GetFileVersionInfoSizeA;
|
||
PVOID pfnAheadLib_GetFileVersionInfoSizeExA;
|
||
PVOID pfnAheadLib_GetFileVersionInfoSizeExW;
|
||
PVOID pfnAheadLib_GetFileVersionInfoSizeW;
|
||
PVOID pfnAheadLib_GetFileVersionInfoW;
|
||
PVOID pfnAheadLib_VerFindFileA;
|
||
PVOID pfnAheadLib_VerFindFileW;
|
||
PVOID pfnAheadLib_VerInstallFileA;
|
||
PVOID pfnAheadLib_VerInstallFileW;
|
||
PVOID pfnAheadLib_VerQueryValueA;
|
||
PVOID pfnAheadLib_VerQueryValueW;
|
||
}
|
||
|
||
|
||
static
|
||
HMODULE g_OldModule = NULL;
|
||
|
||
VOID WINAPI Free()
|
||
{
|
||
if (g_OldModule)
|
||
{
|
||
FreeLibrary(g_OldModule);
|
||
}
|
||
}
|
||
|
||
|
||
BOOL WINAPI Load()
|
||
{
|
||
TCHAR tzPath[MAX_PATH];
|
||
TCHAR tzTemp[MAX_PATH * 2];
|
||
|
||
//
|
||
// <20><><EFBFBD><EFBFBD><EFBFBD>Ƿ<EFBFBD><C7B7><EFBFBD>ϵͳĿ¼<C4BF><C2BC><EFBFBD><EFBFBD>ǰĿ¼<C4BF><C2BC><EFBFBD><EFBFBD>ԭʼDLL
|
||
//
|
||
//GetModuleFileName(NULL,tzPath,MAX_PATH); //<2F><>ȡ<EFBFBD><C8A1>Ŀ¼<C4BF>µ<EFBFBD>
|
||
//PathRemoveFileSpec(tzPath);
|
||
|
||
GetSystemDirectory(tzPath, MAX_PATH); //Ĭ<>ϻ<EFBFBD>ȡϵͳĿ¼<C4BF><C2BC>
|
||
|
||
lstrcat(tzPath, TEXT("\\version.dll"));
|
||
|
||
g_OldModule = LoadLibrary(tzPath);
|
||
if (g_OldModule == NULL)
|
||
{
|
||
wsprintf(tzTemp, TEXT("<EFBFBD><EFBFBD><EFBFBD>ҵ<EFBFBD>ģ<EFBFBD><EFBFBD> %s,<2C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"), tzPath);
|
||
MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP);
|
||
}
|
||
|
||
return (g_OldModule != NULL);
|
||
|
||
}
|
||
|
||
|
||
FARPROC WINAPI GetAddress(PCSTR pszProcName)
|
||
{
|
||
FARPROC fpAddress;
|
||
CHAR szProcName[64];
|
||
TCHAR tzTemp[MAX_PATH];
|
||
|
||
fpAddress = GetProcAddress(g_OldModule, pszProcName);
|
||
if (fpAddress == NULL)
|
||
{
|
||
if (HIWORD(pszProcName) == 0)
|
||
{
|
||
wsprintfA(szProcName, "#%d", pszProcName);
|
||
pszProcName = szProcName;
|
||
}
|
||
|
||
wsprintf(tzTemp, TEXT("<EFBFBD><EFBFBD><EFBFBD>ҵ<EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD> %hs,<2C><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><DEB7><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>"), pszProcName);
|
||
MessageBox(NULL, tzTemp, TEXT("AheadLib"), MB_ICONSTOP);
|
||
ExitProcess(-2);
|
||
}
|
||
return fpAddress;
|
||
}
|
||
|
||
BOOL WINAPI Init()
|
||
{
|
||
pfnAheadLib_GetFileVersionInfoA = GetAddress("GetFileVersionInfoA");
|
||
pfnAheadLib_GetFileVersionInfoByHandle = GetAddress("GetFileVersionInfoByHandle");
|
||
pfnAheadLib_GetFileVersionInfoExA = GetAddress("GetFileVersionInfoExA");
|
||
pfnAheadLib_GetFileVersionInfoExW = GetAddress("GetFileVersionInfoExW");
|
||
pfnAheadLib_GetFileVersionInfoSizeA = GetAddress("GetFileVersionInfoSizeA");
|
||
pfnAheadLib_GetFileVersionInfoSizeExA = GetAddress("GetFileVersionInfoSizeExA");
|
||
pfnAheadLib_GetFileVersionInfoSizeExW = GetAddress("GetFileVersionInfoSizeExW");
|
||
pfnAheadLib_GetFileVersionInfoSizeW = GetAddress("GetFileVersionInfoSizeW");
|
||
pfnAheadLib_GetFileVersionInfoW = GetAddress("GetFileVersionInfoW");
|
||
pfnAheadLib_VerFindFileA = GetAddress("VerFindFileA");
|
||
pfnAheadLib_VerFindFileW = GetAddress("VerFindFileW");
|
||
pfnAheadLib_VerInstallFileA = GetAddress("VerInstallFileA");
|
||
pfnAheadLib_VerInstallFileW = GetAddress("VerInstallFileW");
|
||
pfnAheadLib_VerQueryValueA = GetAddress("VerQueryValueA");
|
||
pfnAheadLib_VerQueryValueW = GetAddress("VerQueryValueW");
|
||
return TRUE;
|
||
}
|
||
|
||
DWORD WINAPI ThreadProc(LPVOID lpThreadParameter)
|
||
{
|
||
HANDLE hProcess;
|
||
|
||
PVOID addr1 = reinterpret_cast<PVOID>(0x00401000);
|
||
BYTE data1[] = { 0x90, 0x90, 0x90, 0x90 };
|
||
|
||
//
|
||
// <20>ƹ<EFBFBD>VMP3.x <20><><EFBFBD>ڴ汣<DAB4><E6B1A3>
|
||
//
|
||
hProcess = OpenProcess(PROCESS_VM_OPERATION | PROCESS_VM_READ | PROCESS_VM_WRITE, FALSE, GetCurrentProcessId());
|
||
if (hProcess)
|
||
{
|
||
WriteProcessMemory(hProcess, addr1, data1, sizeof(data1), NULL);
|
||
|
||
CloseHandle(hProcess);
|
||
}
|
||
|
||
return 0;
|
||
}
|
||
|
||
|
||
BOOL APIENTRY VersionHijack_DllMain(HMODULE hModule, DWORD dwReason, PVOID pvReserved)
|
||
{
|
||
if (dwReason == DLL_PROCESS_ATTACH)
|
||
{
|
||
DisableThreadLibraryCalls(hModule);
|
||
|
||
if (Load() && Init())
|
||
{
|
||
TCHAR szAppName[MAX_PATH] = TEXT("cs2.exe");//<2F><><EFBFBD><EFBFBD><DEB8><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||
TCHAR szCurName[MAX_PATH];
|
||
|
||
GetModuleFileName(NULL, szCurName, MAX_PATH);
|
||
PathStripPath(szCurName);
|
||
|
||
//<2F>Ƿ<EFBFBD><C7B7>ж<EFBFBD><D0B6><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||
if (StrCmpI(szCurName, szAppName) == 0)
|
||
{
|
||
//<2F><><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>̻߳<DFB3><CCBB><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD><EFBFBD>
|
||
HANDLE hThread = CreateThread(NULL, NULL, ThreadProc, NULL, NULL, NULL);
|
||
if (hThread)
|
||
{
|
||
CloseHandle(hThread);
|
||
}
|
||
}
|
||
}
|
||
}
|
||
else if (dwReason == DLL_PROCESS_DETACH)
|
||
{
|
||
Free();
|
||
}
|
||
|
||
return TRUE;
|
||
}
|
||
|