fork(18) download
copy 
  1. #include <winsock2.h>
  2. #include <windows.h>
  3. #include <iphlpapi.h>
  4. #include <stdio.h>
  5. #include <time.h>
  6. #include <tlhelp32.h>
  7. #include <psapi.h>
  8. #include <icmpapi.h>
  9. #include <io.h>
  10.  
  11. #include "hook.h"
  12. #include "blowfish.h"
  13. #include "resource.h"
  14. #include "Obfuscator.h"
  15.  
  16. #include "stdafx.h"
  17. #include "ThemidaSDK.h"
  18. #include "splash.h"
  19.  
  20. #pragma comment(lib, "User32.lib")
  21. #pragma comment(lib, "ws2_32.lib")
  22. #pragma comment(lib, "iphlpapi.lib")
  23. #pragma comment(lib, "psapi.lib")
  24.  
  25. struct TFontDrawInfo
  26. {
  27. 	int font;
  28. 	unsigned int color, u1, u2, u3, u4;
  29. };
  30.  
  31. struct TNetworkPacket
  32. {
  33.     unsigned char id, p1;
  34.     unsigned short int subid, size, p2;
  35.     unsigned char *data;
  36. };
  37.  
  38. struct TSpecialString
  39. {
  40. 	bool isDraw;
  41. 	TFontDrawInfo FontDrawInfo;
  42. 	int x, y;
  43. 	wchar_t text[64];
  44. };
  45.  
  46. #pragma pack(1)
  47. typedef struct _IDENTIFY_DATA
  48. {
  49. 	USHORT GeneralConfiguration;
  50.     USHORT NumberOfCylinders;
  51.     USHORT Reserved1;
  52.     USHORT NumberOfHeads;
  53.     USHORT UnformattedBytesPerTrack;
  54.     USHORT UnformattedBytesPerSector;
  55.     USHORT SectorsPerTrack;
  56.     USHORT VendorUnique1[3];
  57.     USHORT SerialNumber[10];
  58.     USHORT BufferType;
  59.     USHORT BufferSectorSize;
  60.     USHORT NumberOfEccBytes;
  61.     USHORT FirmwareRevision[4];
  62.     USHORT ModelNumber[20];
  63.     UCHAR  MaximumBlockTransfer;
  64.     UCHAR  VendorUnique2;
  65.     USHORT DoubleWordIo;
  66.     USHORT Capabilities;
  67.     USHORT Reserved2;
  68.     UCHAR  VendorUnique3;
  69.     UCHAR  PioCycleTimingMode;
  70.     UCHAR  VendorUnique4;
  71.     UCHAR  DmaCycleTimingMode;
  72.     USHORT TranslationFieldsValid:1;
  73.     USHORT Reserved3:15;
  74.     USHORT NumberOfCurrentCylinders;
  75.     USHORT NumberOfCurrentHeads;
  76.     USHORT CurrentSectorsPerTrack;
  77.     ULONG  CurrentSectorCapacity;
  78.     USHORT CurrentMultiSectorSetting;
  79.     ULONG  UserAddressableSectors;
  80.     USHORT SingleWordDMASupport : 8;
  81.     USHORT SingleWordDMAActive : 8;
  82.     USHORT MultiWordDMASupport : 8;
  83.     USHORT MultiWordDMAActive : 8;
  84.     USHORT AdvancedPIOModes : 8;
  85.     USHORT Reserved4 : 8;
  86.     USHORT MinimumMWXferCycleTime;
  87.     USHORT RecommendedMWXferCycleTime;
  88.     USHORT MinimumPIOCycleTime;
  89.     USHORT MinimumPIOCycleTimeIORDY;
  90.     USHORT Reserved5[2];
  91.     USHORT ReleaseTimeOverlapped;
  92.     USHORT ReleaseTimeServiceCommand;
  93.     USHORT MajorRevision;
  94.     USHORT MinorRevision;
  95.     USHORT Reserved6[50];
  96.     USHORT SpecialFunctionsEnabled;
  97.     USHORT Reserved7[128];
  98. } IDENTIFY_DATA, *PIDENTIFY_DATA;
  99. #pragma pack()
  100.  
  101. typedef int (__stdcall *_connect) (SOCKET s, const struct sockaddr *name, int namelen);
  102. _connect true_connect;
  103.  
  104. typedef int (__fastcall *_AddNetworkQueue) (unsigned int This, unsigned int EDX, TNetworkPacket *NetworkPacket);
  105. _AddNetworkQueue true_AddNetworkQueue;
  106.  
  107. typedef void (__cdecl *_SendPacket) (unsigned int This, char *Format, ...);
  108. _SendPacket true_SendPacket;
  109.  
  110. typedef void (_fastcall *_MasterProcessPreRender) (unsigned int This, unsigned int EDX, unsigned int UCanvas);
  111. _MasterProcessPreRender true_MasterProcessPreRender;
  112.  
  113. typedef int (_fastcall *_DrawTextTTFToCanvas) (unsigned int This, unsigned int EDX, int X, int Y, wchar_t *text, TFontDrawInfo *FontDrawInfo, unsigned char, int, int, unsigned int FontDrawInfoSection);
  114. _DrawTextTTFToCanvas true_DrawTextTTFToCanvas;
  115.  
  116. typedef void (_fastcall *_Render) (unsigned int This, unsigned int EDX, unsigned int FRenderInterface);
  117. _Render true_Render;
  118.  
  119. RECT rc;
  120. HWND hWND;
  121. TSpecialString SpecialStrings[16];
  122. unsigned int Canvas, hEngineStart, hEngineEnd, mainThread, lastPing = 0, KiUserExceptDispADR, hNtDllStart, hNtDllEnd;
  123. HANDLE ghMutex;
  124.  
  125. void ErrorExit(char *msg)
  126. {
  127. 	FILE *f;
  128.  
  129. 	fopen_s(&f, "Protection.log", "a+");
  130.  
  131. 	if (f != 0)
  132. 	{
  133. 		fprintf(f, "%s\n", msg);
  134. 		fclose(f);
  135. 	}
  136.  
  137. 	ExitProcess(0);
  138. }
  139.  
  140. void Logger(char *msg)
  141. {
  142. 	FILE *f;
  143.  
  144. 	fopen_s(&f, "Debug.log", "a+");
  145.  
  146. 	if (f != 0)
  147. 	{
  148. 		fprintf(f, "%s\n", msg);
  149. 		fclose(f);
  150. 	}
  151. }
  152.  
  153. bool SetPrivileges(HANDLE hProcess, DWORD dwPrivilegeCount, LPCTSTR *ppPrivilegeName)
  154. {
  155. 	HANDLE hToken = 0;
  156. 	if(!::OpenProcessToken(hProcess, TOKEN_ALL_ACCESS, &hToken))
  157. 		return false;
  158.  
  159. 	PTOKEN_PRIVILEGES Privileges = (PTOKEN_PRIVILEGES)
  160. 		new char[sizeof(DWORD) + sizeof(LUID_AND_ATTRIBUTES) * dwPrivilegeCount];
  161.  
  162. 	LUID_AND_ATTRIBUTES *LuidAndAttr = (LUID_AND_ATTRIBUTES *)(((char *)Privileges) + sizeof(DWORD));
  163.  
  164. 	Privileges->PrivilegeCount = dwPrivilegeCount;
  165.  
  166. 	for(DWORD i = 0; i < dwPrivilegeCount; i++)
  167. 	{
  168. 		if(!::LookupPrivilegeValue(0, 
  169. 			ppPrivilegeName[i], 
  170. 			&LuidAndAttr[i].Luid))
  171. 		{
  172. 			::CloseHandle(hToken);
  173. 			delete[]Privileges;
  174. 			return false; 
  175. 		}
  176.  
  177. 		LuidAndAttr[i].Attributes = SE_PRIVILEGE_ENABLED;
  178. 	}
  179. 	if(!::AdjustTokenPrivileges(hToken, FALSE, Privileges, 0, 0, 0))
  180. 	{
  181. 		::CloseHandle(hToken);
  182. 		delete[]Privileges;
  183. 		return false;
  184. 	}
  185. 	::CloseHandle(hToken);
  186. 	delete[]Privileges;
  187. 	return true;
  188. }
  189.  
  190. bool checkRun(char* NAmePorc)
  191. {
  192.     HANDLE hProcessSnap = NULL; 
  193.     PROCESSENTRY32 pe32;
  194.     hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0); 
  195.     if(hProcessSnap == INVALID_HANDLE_VALUE) 
  196. 	{
  197. 		return true;
  198. 	}
  199.     pe32.dwSize = sizeof(PROCESSENTRY32); 
  200.     if(Process32First(hProcessSnap, &pe32)) 
  201.     { 
  202.         while(Process32Next(hProcessSnap, &pe32));
  203. 		{
  204. 			if(strstr(NAmePorc, (char*)pe32.szExeFile))
  205. 			{
  206. 				CloseHandle (hProcessSnap);
  207. 				return true;
  208. 			}
  209. 		}
  210.     }
  211.     CloseHandle(hProcessSnap);
  212.     return false;
  213. }
  214.  
  215. int __stdcall new_connect(SOCKET s, const struct sockaddr *name, int namelen)
  216. {
  217. 	struct sockaddr_in *name_in = (struct sockaddr_in*) name;
  218. 	if (name_in->sin_port == htons(2106))
  219. 	{
  220. 		name_in->sin_port = htons(2106);
  221. 		name_in->sin_addr.S_un.S_addr = inet_addr("91.203.194.67");
  222. 	}
  223.  
  224. 	if (name_in->sin_port == htons(7777))
  225. 	{
  226. 		name_in->sin_port = htons(7777);
  227. 		name_in->sin_addr.S_un.S_addr = inet_addr("91.203.194.67");
  228. 	}
  229. 	return true_connect(s, name, namelen);
  230. }
  231.  
  232. void decodeKey(unsigned char *buf)
  233. {
  234. 	unsigned char bfkey[16] =  {110, 36, 2, 15, -5, 17, 24, 23, 18, 45, 1, 21, 122, 16, -5, 12}; //STATIC KEY
  235. 	unsigned char tmp[24];
  236. 	Blowfish_CTX ctx;
  237.  
  238. 	memcpy(tmp, buf, 16);
  239.  
  240. 	Blowfish_Init(&ctx, bfkey, 16);
  241. 	Blowfish_Decrypt(&ctx, tmp, 16);
  242.  
  243. 	memcpy(buf, tmp, 16);
  244. }
  245.  
  246. int __fastcall new_AddNetworkQueue(unsigned int This, unsigned int EDX, TNetworkPacket *NetworkPacket)
  247. {
  248. 	if ((*(unsigned int*) (KiUserExceptDispADR + 10) + KiUserExceptDispADR < hNtDllStart) || (*(unsigned int*) (KiUserExceptDispADR + 10) + KiUserExceptDispADR > hNtDllEnd))
  249. 		ErrorExit("Bot Program Detected #0!");
  250.  
  251. 	unsigned int retAddr = *((unsigned int*) &NetworkPacket - 1);
  252.  
  253. 	if ((retAddr < hEngineStart) || (retAddr > hEngineEnd))
  254. 		ErrorExit("Bot Program Detected #1!");
  255.  
  256. 	if (NetworkPacket->subid == 0xFFFF)
  257. 	{
  258. 		switch (NetworkPacket->id)
  259. 		{
  260. 			case 0x2E:
  261. 				decodeKey(NetworkPacket->data + 1);
  262. 				break;
  263. 			case 0xB0:
  264. 				memset(&SpecialStrings[NetworkPacket->data[0]].FontDrawInfo, 0, sizeof(TFontDrawInfo));
  265. 				SpecialStrings[NetworkPacket->data[0]].isDraw = (NetworkPacket->data[1] == 1) ? true : false;
  266. 				SpecialStrings[NetworkPacket->data[0]].FontDrawInfo.font = (char) NetworkPacket->data[2];
  267. 				SpecialStrings[NetworkPacket->data[0]].x = *(int*) (NetworkPacket->data + 3);
  268. 				SpecialStrings[NetworkPacket->data[0]].y = *(int*) (NetworkPacket->data + 7);
  269. 				SpecialStrings[NetworkPacket->data[0]].FontDrawInfo.color = *(unsigned int*) (NetworkPacket->data + 11);
  270. 				wcscpy_s(SpecialStrings[NetworkPacket->data[0]].text, (wchar_t*) (NetworkPacket->data + 15));
  271. 				if (NetworkPacket->data[0] == 14)
  272. 				{
  273. 					HANDLE hIcmpFile = IcmpCreateFile();
  274. 					ICMP_ECHO_REPLY Reply;
  275. 					if (hIcmpFile != 0)
  276. 					{
  277. 						if (IcmpSendEcho(hIcmpFile, inet_addr("91.203.194.67"), 0, 0, 0, &Reply, sizeof(ICMP_ECHO_REPLY), 500) != 0)
  278. 							lastPing = Reply.RoundTripTime;
  279. 						IcmpCloseHandle(hIcmpFile);
  280. 					}
  281. 					wsprintf(SpecialStrings[NetworkPacket->data[0]].text, L"%ls%d", (wchar_t*) (NetworkPacket->data + 15), lastPing);
  282. 				}
  283. 				break;
  284. 		}
  285. 	}
  286.  
  287. 	return true_AddNetworkQueue(This, EDX, NetworkPacket);
  288. }
  289.  
  290. bool getHWID(wchar_t *str)
  291. {
  292. 	HW_PROFILE_INFO   HwProfInfo;
  293. 	char HWID[1024];
  294.  
  295. 	if (!GetCurrentHwProfile(&HwProfInfo)) 
  296. 	{
  297. 		return false;
  298. 	}
  299. 	sprintf_s(HWID, 1000, "%02X%02X%02X%02X", HwProfInfo.szHwProfileGuid);
  300. 	mbstowcs_s(0, str, 1000, HWID, 1000);
  301.  
  302. 	return true;
  303. }
  304.  
  305. bool getMAC(wchar_t *str)
  306. {
  307. 	IP_ADAPTER_INFO AdapterInfo[16];
  308. 	PIP_ADAPTER_INFO pAdapterInfo;
  309. 	unsigned long dwBufLen;
  310. 	char MAC[1024];
  311.  
  312. 	dwBufLen = sizeof(AdapterInfo);
  313.  
  314. 	if (GetAdaptersInfo(AdapterInfo, &dwBufLen) != ERROR_SUCCESS)
  315. 		return false;
  316.  
  317. 	pAdapterInfo = AdapterInfo;
  318.  
  319. 	while ((pAdapterInfo->Address[0] == 0) && (pAdapterInfo->Address[1] == 0) && (pAdapterInfo->Address[2] == 0) &&(pAdapterInfo->Address[3] == 0) && (pAdapterInfo->Address[4] == 0) && (pAdapterInfo->Address[5] == 0))
  320. 		pAdapterInfo = pAdapterInfo->Next;
  321.  
  322. 	sprintf_s(MAC, 1000, "%02X%02X%02X%02X%02X%02X", pAdapterInfo->Address[0], pAdapterInfo->Address[1], pAdapterInfo->Address[2], pAdapterInfo->Address[3], pAdapterInfo->Address[4], pAdapterInfo->Address[5]);
  323.  
  324. 	mbstowcs_s(0, str, 1000, MAC, 1000);
  325.  
  326. 	return true;
  327. }
  328.  
  329. char *flipAndCodeBytes (const char *str, int pos, int flip, char *buf)
  330. {
  331. 	int i;
  332. 	int j = 0;
  333. 	int k = 0;
  334.  
  335. 	buf[0] = '\0';
  336.  
  337. 	if (pos <= 0)
  338. 		return buf;
  339.  
  340. 	if (!j)
  341. 	{
  342. 		char p = 0;
  343.  
  344. 		j = 1;
  345. 		k = 0;
  346. 		buf[k] = 0;
  347.  
  348. 		for (i = pos; j && str[i] != '\0'; ++i)
  349. 		{
  350. 			char c = tolower(str[i]);
  351.  
  352. 			if (isspace(c))
  353. 				c = '0';
  354.  
  355. 			++p;
  356. 			buf[k] <<= 4;
  357.  
  358. 			if (c >= '0' && c <= '9')
  359. 				buf[k] |= (unsigned char) (c - '0');
  360. 			else if (c >= 'a' && c <= 'f')
  361. 				buf[k] |= (unsigned char) (c - 'a' + 10);
  362. 			else
  363. 			{
  364. 				j = 0;
  365. 				break;
  366. 			}
  367.  
  368. 			if (p == 2)
  369. 			{
  370. 				if (buf[k] != '\0' && ! isprint(buf[k]))
  371. 				{
  372. 					j = 0;
  373. 					break;
  374. 				}
  375.  
  376. 				++k;
  377. 				p = 0;
  378. 				buf[k] = 0;
  379. 			}
  380. 		}
  381. 	}
  382.  
  383. 	if (!j)
  384. 	{
  385. 		j = 1;
  386. 		k = 0;
  387.  
  388. 		for (i = pos; j && str[i] != '\0'; ++i)
  389. 		{
  390. 			char c = str[i];
  391.  
  392. 			if ( ! isprint(c))
  393. 			{
  394. 				j = 0;
  395. 				break;
  396. 			}
  397.  
  398. 			buf[k++] = c;
  399. 		}
  400. 	}
  401.  
  402. 	if (!j)
  403. 	{
  404. 		k = 0;
  405. 	}
  406.  
  407. 	buf[k] = '\0';
  408.  
  409. 	if (flip)
  410. 		for (j = 0; j < k; j += 2)
  411. 		{
  412. 			char t = buf[j];
  413. 			buf[j] = buf[j + 1];
  414. 			buf[j + 1] = t;
  415. 		}
  416.  
  417. 		i = j = -1;
  418.  
  419. 		for (k = 0; buf[k] != '\0'; ++k)
  420. 		{
  421. 			if (! isspace(buf[k]))
  422. 			{
  423. 				if (i < 0)
  424. 					i = k;
  425.  
  426. 				j = k;
  427. 			}
  428. 		}
  429.  
  430. 		if ((i >= 0) && (j >= 0))
  431. 		{
  432. 			for (k = i; (k <= j) && (buf[k] != '\0'); ++k)
  433. 				buf[k - i] = buf[k];
  434.  
  435. 			buf[k - i] = '\0';
  436. 		}
  437.  
  438. 		return buf;
  439. }
  440.  
  441. bool getHDDSerialNumber(wchar_t *str)
  442. {
  443. 	HANDLE hPhysicalDriveIOCTL = 0;
  444. 	char serialNumber[1024], windir[256], filename[256];
  445.  
  446. 	if (GetWindowsDirectoryA(windir, 256) == 0)
  447. 		return false;
  448.  
  449. 	memset(filename, 0, 256);
  450.  
  451. 	strcpy_s(filename, "\\\\.\\\\");
  452. 	windir[2] = 0;
  453. 	strcat_s(filename, windir);
  454.  
  455. 	hPhysicalDriveIOCTL = CreateFileA(filename, 0, FILE_SHARE_READ | FILE_SHARE_WRITE, 0, OPEN_EXISTING, 0, 0);
  456.  
  457. 	if (hPhysicalDriveIOCTL == INVALID_HANDLE_VALUE)
  458. 		return false;
  459.  
  460. 	STORAGE_PROPERTY_QUERY query;
  461. 	unsigned long cbBytesReturned = 0;
  462. 	char buffer[10000];
  463.  
  464. 	memset ((void *) &query, 0, sizeof (query));
  465. 	query.PropertyId = StorageDeviceProperty;
  466. 	query.QueryType = PropertyStandardQuery;
  467.  
  468. 	memset (buffer, 0, sizeof (buffer));
  469.  
  470. 	if (!(DeviceIoControl(hPhysicalDriveIOCTL, IOCTL_STORAGE_QUERY_PROPERTY, &query, sizeof(query), &buffer, sizeof(buffer), &cbBytesReturned, 0)))
  471. 	{
  472. 		CloseHandle(hPhysicalDriveIOCTL);
  473. 		return false;
  474. 	}
  475.  
  476. 	STORAGE_DEVICE_DESCRIPTOR * descrip = (STORAGE_DEVICE_DESCRIPTOR *) & buffer;
  477.  
  478. 	sprintf_s(serialNumber, 1000, "%02X%02X", flipAndCodeBytes(buffer, descrip->SerialNumberOffset, 1, serialNumber));
  479.  
  480. 	mbstowcs_s(0, str, 1000, serialNumber, 1000);
  481.  
  482. 	return true;
  483. }
  484.  
  485. bool getHwGuid(wchar_t *str)
  486. {
  487. 	HW_PROFILE_INFOA HwProfInfo;
  488. 	char HWID[1024];
  489.  
  490. 	if (GetCurrentHwProfileA(&HwProfInfo) == 0)
  491. 		return false;
  492.  
  493. 	sprintf_s(HWID, 1000, "%02X%02X", HwProfInfo.szHwProfileGuid);
  494.  
  495. 	mbstowcs_s(0, str, 1000, HWID, 1000);
  496.  
  497. 	return true;
  498. }
  499.  
  500. void __cdecl new_SendPacket(unsigned int This, char *Format, ...)
  501. {
  502. 	if ((*(unsigned int*) (KiUserExceptDispADR + 10) + KiUserExceptDispADR < hNtDllStart) || (*(unsigned int*) (KiUserExceptDispADR + 10) + KiUserExceptDispADR > hNtDllEnd))
  503. 		ErrorExit("Bot Program Detected #2!");
  504.  
  505. 	unsigned int retAddr = *((unsigned int*) &This - 1);
  506.  
  507. 	if ((retAddr < hEngineStart) || (retAddr > hEngineEnd))
  508. 	{
  509. 		true_SendPacket(This, "cc", 0xA1, 0x01);
  510. 		ErrorExit("Bot Program Detected #3!");
  511. 	}
  512.  
  513. 	if (((unsigned int) Format < hEngineStart) || ( (unsigned int) Format > hEngineEnd))
  514. 	{
  515. 		true_SendPacket(This, "cc", 0xA1, 0x02);
  516. 		ErrorExit("Bot Program Detected #4!");
  517. 	}
  518.  
  519. 	if (GetCurrentThreadId() != mainThread)
  520. 	{
  521. 		true_SendPacket(This, "cc", 0xA1, 0x03);
  522. 		ErrorExit("Bot Program Detected #5!");
  523. 	}
  524.  
  525. 	unsigned char buf[10240];
  526. 	int size = 0, len;
  527. 	wchar_t *wstr;
  528.  
  529.     va_list args;
  530. 	va_start(args, Format);
  531.  
  532. 	while (*Format != 0)
  533. 	{
  534. 		switch (*Format)
  535. 		{
  536. 			case 'c':
  537. 				*(unsigned char*) (buf + size) = va_arg(args, unsigned char);
  538. 				size++;
  539. 				break;
  540. 			case 'h':
  541. 				*(unsigned short int*) (buf + size) = va_arg(args, unsigned short int);
  542. 				size += 2;
  543. 				break;
  544. 			case 'd':
  545. 				*(unsigned int*) (buf + size) = va_arg(args, unsigned int);
  546. 				size += 4;
  547. 				break;
  548. 			case 'Q':
  549. 				*(unsigned __int64*) (buf + size) = va_arg(args, unsigned __int64);
  550. 				size += 8;
  551. 				break;
  552. 			case 'b':
  553. 				len = va_arg(args, unsigned int);
  554. 				memcpy(buf + size, va_arg(args, void*), len);
  555. 				size += len;
  556. 				break;			
  557. 			case 'S':
  558. 				wstr = va_arg(args, wchar_t*);
  559. 				if (wstr == 0)
  560. 				{
  561. 					len = 2;
  562. 					*(unsigned short int*) (buf + size) = 0;
  563. 				}
  564. 				else
  565. 				{
  566. 					len = wcslen(wstr) * 2 + 2;
  567. 					memcpy(buf + size, wstr, len);
  568. 				}
  569. 				size += len;
  570. 				break;
  571. 			default:
  572. 				true_SendPacket(This, "cc", 0xA1, 0x04);
  573. 				ErrorExit("Send Packet Unknown Format!");
  574. 				break;
  575. 		}
  576. 		Format++;	
  577. 	}
  578.  
  579. 	va_end(args);
  580.  
  581. 	switch(buf[0])
  582. 	{
  583. 		case 0x0E:
  584. 			wchar_t serialNumber[1024], MAC[1024], HwGuid[1024];
  585. 			memset(serialNumber, 0, 1024 * 2);
  586. 			memset(MAC, 0, 1024 * 2);
  587. 			if (!getHDDSerialNumber(serialNumber))
  588. 			{
  589. 				true_SendPacket(This, "cc", 0xA1, 0x05);
  590. 				ErrorExit("Get HDD Serial Number Fail!");
  591. 				return;
  592. 			}
  593. 			if (!getMAC(MAC))
  594. 			{
  595. 				true_SendPacket(This, "cc", 0xA1, 0x06);
  596. 				ErrorExit("Get MAC Fail!");
  597. 				return;
  598. 			}
  599. 			if (!getHwGuid(HwGuid))
  600. 			{
  601. 				true_SendPacket(This, "cc", 0xA1, 0x07);
  602. 				ErrorExit("Get HWID Fail!\n");
  603. 			}
  604. 			if ((wcslen(MAC) == 0) || (wcslen(serialNumber) == 0) || (wcslen(HwGuid) == 0))
  605. 			{
  606. 				true_SendPacket(This, "cc", 0xA1, 0x08);
  607. 				ErrorExit("Wrong MAC / Serial Number / HWID!");
  608. 				return;
  609. 			}
  610.  
  611. 			memcpy(buf + size, serialNumber, wcslen(serialNumber) * 2 + 2);
  612. 			size += wcslen(serialNumber) * 2 + 2;
  613. 			memcpy(buf + size, MAC, wcslen(MAC) * 2 + 2);
  614. 			size += wcslen(MAC) * 2 + 2;
  615. 			memcpy(buf + size, HwGuid, wcslen(HwGuid) * 2 + 2);
  616. 			size += wcslen(HwGuid) * 2 + 2;
  617. 			break;
  618. 	}
  619. 	true_SendPacket(This, "b", size, (int)buf);
  620. }
  621.  
  622.  
  623. void _fastcall new_Render(unsigned int This, unsigned int EDX, unsigned int FRenderInterface)
  624. {
  625. 	mainThread = GetCurrentThreadId();
  626.  
  627. 	RECT L2Rect;
  628. 	HWND *L2hWND = (HWND*) GetProcAddress(LoadLibraryA("core.dll"), "?GTopWnd@@3PAUHWND__@@A");
  629.  
  630. 	true_Render(This, EDX, FRenderInterface);
  631.  
  632. 	GetClientRect(*L2hWND, &L2Rect);
  633.  
  634. 	for (int i = 0; i < 16; i++)
  635. 	{
  636. 		if (SpecialStrings[i].isDraw)
  637. 		{
  638. 			if (i == 15)
  639. 			{
  640. 				time_t rawtime;
  641. 				struct tm timeinfo;
  642. 				wchar_t exstr[16], newstr[64];
  643.  
  644. 				time(&rawtime);
  645. 				localtime_s(&timeinfo, &rawtime);
  646. 				wcsftime(exstr, 15, L"%H:%M", &timeinfo);
  647. 				wcscpy_s(newstr, SpecialStrings[i].text);
  648. 				wcscat_s(newstr, exstr);
  649.  
  650. 				true_DrawTextTTFToCanvas(Canvas, 0, L2Rect.right - SpecialStrings[i].x, L2Rect.top + SpecialStrings[i].y, newstr, &SpecialStrings[i].FontDrawInfo, 0xFF, 0, 0, 0);
  651. 			}
  652. 			else
  653. 				true_DrawTextTTFToCanvas(Canvas, 0, L2Rect.right - SpecialStrings[i].x, L2Rect.top + SpecialStrings[i].y, SpecialStrings[i].text, &SpecialStrings[i].FontDrawInfo, 0xFF, 0, 0, 0);
  654. 		}
  655. 	}
  656. }
  657.  
  658. void _fastcall new_MasterProcessPreRender(unsigned int This, unsigned int EDX, unsigned int UCanvas)
  659. {
  660. 	Canvas = UCanvas;
  661.  
  662. 	true_MasterProcessPreRender(This, EDX, UCanvas);
  663. }
  664.  
  665. bool DisableGameGuard(void)
  666. {
  667. 	unsigned long oldProtect;
  668. 	unsigned char *GL2UseGameGuard;
  669.  
  670. 	GL2UseGameGuard = (unsigned char *) GetProcAddress(LoadLibraryA("core.dll"), "?GL2UseGameGuard@@3HA");
  671.  
  672. 	if(GL2UseGameGuard == 0)
  673. 		return false;
  674.  
  675. 	if(!VirtualProtect(GL2UseGameGuard, 1, PAGE_READWRITE, &oldProtect))
  676. 		return false;
  677.  
  678. 	*GL2UseGameGuard = 0;
  679.  
  680. 	if(!VirtualProtect(GL2UseGameGuard, 1, oldProtect, &oldProtect))
  681. 		return false;
  682.  
  683. 	return true;
  684. }
  685.  
  686. unsigned int GetSendPacketAddress(void)
  687. {
  688. 	HMODULE hEngine = LoadLibraryA("engine.dll");
  689.  
  690. 	unsigned int startVMT = (unsigned int) hEngine + 0x51F658;
  691. 	unsigned int AddNetworkQueue = (unsigned int) GetProcAddress(hEngine, "?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPacket@@@Z");
  692. 	unsigned int currVMT = startVMT;
  693.  
  694. 	if (AddNetworkQueue == 0)
  695. 	{
  696. 		return 0;
  697. 	}
  698.  
  699. 	while (true)
  700. 	{
  701. 		if (*(unsigned int*) currVMT == AddNetworkQueue)
  702. 		{
  703. 			return *(unsigned int*) (currVMT - 0xA4);
  704. 		}
  705.  
  706. 		currVMT++;
  707. 		if (currVMT - startVMT > 10000)
  708. 		{
  709. 			return 0;
  710. 		}
  711. 	}
  712. 	return 0;
  713. }
  714.  
  715. void TitleReplaceHookThread(void *param)
  716. {
  717. 	while(true)
  718. 	{
  719. 		Sleep(50);
  720. 		HWND hWnd = FindWindow(NULL, L"Lineage II");
  721. 		if(hWnd)
  722. 		{
  723. 			SetWindowText(hWnd, L" ");
  724. 			break;
  725. 		}
  726. 	}
  727. }
  728.  
  729. void TitleReplaceHook()
  730. {
  731. 	_beginthread(TitleReplaceHookThread, 0, NULL);
  732. 	CloseHandle(TitleReplaceHookThread);
  733. }
  734.  
  735. bool SetHooks(void)
  736. {
  737. 	FARPROC addr;
  738. 	HMODULE hEngine = LoadLibraryA("engine.dll"), hNtDlll = LoadLibraryA("ntdll.dll");
  739. 	MODULEINFO modinfo;
  740.  
  741. 	GetModuleInformation(GetCurrentProcess(), hEngine, &modinfo, sizeof(MODULEINFO));
  742.  
  743. 	hEngineStart = (unsigned int) hEngine;
  744. 	hEngineEnd = hEngineStart + modinfo.SizeOfImage - 1;
  745.  
  746. 	GetModuleInformation(GetCurrentProcess(), hNtDlll, &modinfo, sizeof(MODULEINFO));
  747.  
  748. 	hNtDllStart = (unsigned int) hNtDlll;
  749. 	hNtDllEnd = hNtDllStart + modinfo.SizeOfImage - 1;
  750.  
  751. 	if ((KiUserExceptDispADR = (unsigned int) GetProcAddress(LoadLibraryA("ntdll.dll"), "KiUserExceptionDispatcher")) == 0)
  752. 		return false;
  753.  
  754. 	if (*(unsigned char*) (KiUserExceptDispADR) == 0xFC)
  755. 		KiUserExceptDispADR++;
  756.  
  757. 	if ((addr = GetProcAddress(LoadLibraryA("ws2_32.dll"), "connect")) == 0)
  758. 		return false;
  759.  
  760. 	true_connect = (_connect) splice((unsigned char*) addr, new_connect);
  761.  
  762. 	if ((addr = GetProcAddress(hEngine, "?AddNetworkQueue@UNetworkHandler@@UAEHPAUNetworkPacket@@@Z")) == 0)
  763. 		return false;
  764.  
  765. 	true_AddNetworkQueue = (_AddNetworkQueue) splice((unsigned char*) addr, new_AddNetworkQueue);
  766.  
  767. 	if ((addr = (FARPROC) GetSendPacketAddress()) == 0)
  768. 		return false;
  769.  
  770. 	true_SendPacket = (_SendPacket) splice((unsigned char*) addr, new_SendPacket);
  771.  
  772. 	if ((addr = GetProcAddress(hEngine, "?MasterProcessPreRender@UInteractionMaster@@QAEXPAVUCanvas@@@Z")) == 0)
  773. 		return false;
  774.  
  775. 	true_MasterProcessPreRender = (_MasterProcessPreRender) splice((unsigned char*) addr, new_MasterProcessPreRender);
  776.  
  777. 	if ((addr = GetProcAddress(hEngine, "?DrawTextTTFToCanvas@UCanvas@@QAEHHHPB_WPBVFontDrawInfo@@EHHPBV?$TArray@PAVFontDrawInfoSection@@@@@Z")) == 0)
  778. 		return false;
  779.  
  780. 	true_DrawTextTTFToCanvas = (_DrawTextTTFToCanvas) addr;
  781.  
  782. 	if ((addr = GetProcAddress(hEngine, "?Render@FPlayerSceneNode@@UAEXPAVFRenderInterface@@@Z")) == 0)
  783. 		return false;
  784.  
  785. 	true_Render = (_Render) splice((unsigned char*) addr, new_Render);
  786.  
  787. 	TitleReplaceHook();
  788. 	return true;
  789. }
  790.  
  791. LRESULT CALLBACK WndProc(HWND hWnd, UINT uMsg, WPARAM wParam, LPARAM lParam)
  792. {
  793. 	return DefWindowProc(hWnd, uMsg, wParam, lParam);
  794. }
  795.  
  796. DWORD GetCurrentIP()
  797. {
  798. 	WSADATA wsaData;
  799. 	WSAStartup(MAKEWORD(1,1), &wsaData);
  800.  
  801. 	char HostName[1024];
  802. 	DWORD m_HostIP = 0;
  803.  
  804. 	if(!gethostname(HostName, 1024))
  805. 	{
  806. 		if(LPHOSTENT lphost = gethostbyname(HostName))
  807. 			m_HostIP = ((LPIN_ADDR)lphost->h_addr)->s_addr;
  808. 	}
  809. 	WSACleanup();
  810. 	return m_HostIP;
  811. }
  812. bool LoadTrayIcon(HINSTANCE hInst, unsigned int ID)
  813. {
  814. 	ghMutex = CreateMutexA(0, false, "Protected on "/*+GetCurrentIP()*/);
  815.  
  816. 	if (GetLastError() == ERROR_ALREADY_EXISTS)
  817. 	{
  818. 		CloseHandle(ghMutex);
  819. 		return true;
  820. 	}
  821.  
  822. 	WNDCLASSEXA wcx;
  823. 	NOTIFYICONDATAA niData; 
  824.  
  825. 	memset(&wcx, 0, sizeof(WNDCLASSEXA));
  826.  
  827. 	wcx.cbSize = sizeof(wcx);
  828. 	wcx.lpfnWndProc = WndProc;
  829. 	wcx.hInstance = hInst;
  830. 	wcx.lpszClassName = "tray_icon";
  831.  
  832. 	if ((RegisterClassExA(&wcx) == 0) && (GetLastError() != ERROR_CLASS_ALREADY_EXISTS))
  833. 		return false;
  834.  
  835. 	if ((hWND = CreateWindowExA(0, "tray_icon", 0, 0, 0, 0, 0, 0, 0, 0, hInst, 0)) == 0)
  836. 		return false;
  837.  
  838. 	memset(&niData, 0, sizeof(NOTIFYICONDATAA));
  839.  
  840. 	niData.cbSize = sizeof(NOTIFYICONDATAA);
  841. 	niData.uID = ID;
  842. 	niData.uFlags = NIF_ICON | NIF_TIP;
  843. 	niData.hWnd = hWND;
  844. 	strcpy_s(niData.szTip, "Protected on "/*+GetCurrentIP()*/);
  845.  
  846. 	niData.hIcon = (HICON) LoadImageA(hInst, MAKEINTRESOURCEA(IDI_TRAYICON), IMAGE_ICON, GetSystemMetrics(SM_CXSMICON), GetSystemMetrics(SM_CYSMICON), LR_DEFAULTCOLOR);
  847.  
  848. 	if (!Shell_NotifyIconA(NIM_ADD, &niData))
  849. 		return false;
  850.  
  851. 	return true;
  852. }
  853.  
  854. void FreeTrayIcon(unsigned int ID)
  855. {
  856. 	NOTIFYICONDATAA niData; 
  857.  
  858. 	memset(&niData, 0, sizeof(NOTIFYICONDATAA));
  859. 	niData.cbSize = sizeof(NOTIFYICONDATAA);
  860. 	niData.hWnd = hWND;
  861. 	niData.uID = ID;
  862.  
  863. 	Shell_NotifyIconA(NIM_DELETE, &niData);
  864.  
  865. 	CloseHandle(ghMutex);
  866. }
  867.  
  868. int DirectXSetupGetVersion(void)
  869. {
  870. 	return 0;
  871. }
  872.  
  873. void InitConsole(void)
  874. {
  875. 	AllocConsole();
  876.  
  877. 	stdout->_file = _open_osfhandle((intptr_t) GetStdHandle(STD_OUTPUT_HANDLE), 0);
  878. 	stdin->_file = _open_osfhandle((intptr_t) GetStdHandle(STD_INPUT_HANDLE), 0);
  879. 	stderr->_file = _open_osfhandle((intptr_t) GetStdHandle(STD_ERROR_HANDLE), 0);
  880. }
  881.  
  882. BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpvReserved)
  883. {
  884. 	if (fdwReason == DLL_PROCESS_ATTACH)
  885. 	{
  886. 		HBITMAP hBmp = LoadBitmap(hinstDLL,MAKEINTRESOURCE(102)); //Load bitmap
  887. 		if(hBmp)
  888. 		{
  889. 			CSplash splash; //Init class
  890. 			splash.SetBitmap(hBmp); //Set image(BMP + alpha)
  891. 			splash.SetTransparentColor(RGB(255, 255, 255)); //Select color for mask
  892. 			splash.ShowSplash(); //Show splash window and image
  893. 			Sleep(5000); //Sleep for freeze window
  894. 			splash.CloseSplash(); //Close class handler
  895. 		}
  896.  
  897. 		DisableThreadLibraryCalls(hinstDLL);
  898.  
  899. 		LoadTrayIcon(hinstDLL, 1);
  900.  
  901. 		if (!DisableGameGuard())
  902. 		{
  903. 			ErrorExit("Game Guard is not allow this client!");
  904. 			Sleep(INFINITE);
  905. 		}
  906.  
  907. 		if (!SetHooks())
  908. 		{
  909. 			ErrorExit("Protection is not attached this client!");
  910. 			Sleep(INFINITE);
  911. 		}
  912. 	}
  913.  
  914. 	if (fdwReason == DLL_PROCESS_DETACH)
  915. 	{
  916. 		FreeTrayIcon(1);
  917. 	}
  918.  
  919. 	return true;
  920. }
Compilation error #stdin compilation error #stdout 0s 0KB
comments (?)
stdin
copy 
Standard input is empty
compilation info 
prog.cpp:1:22: fatal error: winsock2.h: No such file or directory
compilation terminated.
stdout
copy 
Standard output is empty
https://ideone.com/U60Uc5
language:
C++ (gcc 8.3)
created:
8 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!