fork download
copy 
  1. #include <ctime>
  2. #include <vector>
  3. #include <cstdio>
  4. #include <cstdlib>
  5. #include <iostream>
  6. #include <windows.h>
  7.  
  8. /*
  9.  
  10.   SMBIOS information can be found at http://d...content-available-to-author-only...f.org/sites/default/files/standards/documents/DSP0134_2.7.1.pdf
  11. */
  12.  
  13. using namespace std;
  14.  
  15. typedef __int8 int8;
  16. typedef __int16 int16;
  17. typedef __int32 int32;
  18. typedef __int64 int64;
  19. typedef unsigned __int8 uint8;
  20. typedef unsigned __int16 uint16;
  21. typedef unsigned __int32 uint32;
  22. typedef unsigned __int64 uint64;
  23.  
  24. typedef vector<uint8> BufferType; 
  25.  
  26. #define JMP_HOOK_SIZE 5
  27. typedef struct _HookData
  28. {
  29.   LPVOID pTargetAddress;
  30.   BYTE OrgData[JMP_HOOK_SIZE];
  31. }HookData;
  32.  
  33. #define MALLOC(x) HeapAlloc(GetProcessHeap(), 0, (x))
  34. #define FREE(x) HeapFree(GetProcessHeap(), 0, (x))
  35.  
  36. typedef LONG (WINAPI *pZwQuerySystemInformation)(
  37.   DWORD SystemInformationClass,
  38.   PVOID SystemInformation,
  39.   ULONG SystemInformationLength,
  40.   PULONG ReturnLength
  41. );
  42.  
  43. pZwQuerySystemInformation ZwQuerySystemInformation;
  44.  
  45. #define SYSTEMINFO_CLASS_FIRM_TABLE 0x4C
  46. #define SMBIOS_STRUCTURE_SEPARATOR_SIZE 2
  47. #define SMBIOS_STRUCTURE_SEPARATOR "\0\0"
  48. #define SMBIOS_TABLE_SIGNATURE 0x52534D42
  49.  
  50.  
  51. #define XNADDR_LEN 0x1C
  52. #define ADDRESS_XUID 0x05A7B1D8
  53. #define ADDRESS_PLAYER_INFO 0x05CCB138
  54. #define ADDRESS_XNADDRESS_BUFFER 0x00464A58
  55. #define ADDRESS_UNNAMEDPLAYER_NAME 0x007E5AC4
  56.  
  57. inline uint32 rand32( void )
  58. {
  59.   return (rand() << 0x11) | (rand() << 2) | (rand() & 3);
  60. }
  61.  
  62. namespace SMBIOS
  63. {
  64.  
  65.   typedef struct _StructureHeader
  66.   {
  67.     uint8 Type;
  68.     uint8 FormattedSize;
  69.     uint16 Handle; //Unique handle for this structure for later recall
  70.     uint8 Data[];
  71.   }StructureHeader;
  72.  
  73.   enum StructureType
  74.   {
  75.     BIOS_INFO_TYPE = 0x00,
  76.     SYSTEM_INFO_TYPE = 0x01,
  77.     BASEBOARD_INFO_TYPE = 0x02,
  78.     CHASSIS_INFO_TYPE = 0x03,
  79.     PROCESSOR_INFO_TYPE = 0x04,
  80.     CACHE_INFO_TYPE = 0x07,
  81.     PORTS_INFO_TYPE = 0x08,
  82.     SYSTEMSLOTS_INFO_TYPE = 0x09,
  83.     ONBOARDDEVS_INFO_TYPE = 0x0A,
  84.     OEMSTRING_INFO_TYPE = 0x0B,
  85.     SYSTEMCONFIG_INFO_TYPE = 0x0C,
  86.     BIOSLANG_INFO_TYPE = 0x0D,
  87.     GROUPASSOCS_INFO_TYPE = 0x0E,
  88.     SYSLOG_INFO_TYPE = 0x0F,
  89.     PHYSMEM_INFO_TYPE = 0x10,
  90.     MEMDEV_INFO_TYPE = 0x11,
  91.     MEMERROR32_INFO_TYPE = 0x12,
  92.     MEMARRAYMAPPED_INFO_TYPE = 0x13,
  93.     MEMDEVMAPPED_INFO_TYPE = 0x14,
  94.     BUILTINPTRDEV_INFO_TYPE = 0x15,
  95.     BATTERY_INFO_TYPE = 0x16,
  96.     SYSRESET_INFO_TYPE = 0x17,
  97.     HARDSEC_INFO_TYPE = 0x18,
  98.     SYSPOWER_INFO_TYPE = 0x19,
  99.     VOLTPROBE_INFO_TYPE = 0x1A,
  100.     COOLINGDEV_INFO_TYPE = 0x1B,
  101.     TEMPPROBE_INFO_TYPE = 0x1C,
  102.     ELECPROBE_INFO_TYPE = 0x1D,
  103.     OOBRA_INFO_TYPE = 0x1E,
  104.     SYSBOOT_INFO_TYPE = 0x20,
  105.     MEMERROR64_INFO_TYPE = 0x21,
  106.     MNGDEV_INFO_TYPE = 0x22,
  107.     MNGDEVCOMP_INFO_TYPE = 0x23,
  108.     MNGDEVTHRES_INFO_TYPE = 0x24,
  109.     MEMCHAN_INFO_TYPE = 0x25,
  110.     IPMIDEV_INFO_TYPE = 0x26,
  111.     POWERSUPPLY_INFO_TYPE = 0x27,
  112.     ADDITIONAL_INFO_TYPE = 0x28,
  113.     ONBOARDDEVSEX_INFO_TYPE = 0x29,
  114.     MNGCTRLHOSTIF_INFO_TYPE = 0x2A,
  115.     INACTIVE_INFO_TYPE = 0x7E,
  116.     EOF_INFO_TYPE = 0x7F,
  117.   };
  118.  
  119.   class AlterInfo
  120.   {
  121.     public:
  122.       AlterInfo(uint8 *_buffer, uint32 _size) : m_Buffer(_buffer), m_BufferSize(_size), m_BufferPtr(sizeof(uint32) + sizeof(uint32)){} //Skip version and length
  123.  
  124.       void Process( void )
  125.       {
  126.         static const char *rand32StrMask = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
  127.  
  128.         int32 currentStLen = 0;
  129.         uint8 rand32MaskLen = strlen(rand32StrMask);
  130.         while((currentStLen = GetStructureLen()) > (SMBIOS_STRUCTURE_SEPARATOR_SIZE+sizeof(uint32)))
  131.         {
  132.           StructureHeader* pHeader = ((StructureHeader *)&m_Buffer[m_BufferPtr]);
  133.           char *pStringBuffer = ((char *)&m_Buffer[m_BufferPtr+pHeader->FormattedSize]);
  134.           while(*pStringBuffer)
  135.           {
  136.             //Fill strings with rand32om chars within the mask
  137.             while(*pStringBuffer)
  138.             {
  139.               *pStringBuffer = rand32StrMask[rand32() % rand32MaskLen];
  140.               ++pStringBuffer;
  141.             }
  142.             ++pStringBuffer;
  143.           }
  144.  
  145.           switch(pHeader->Type)
  146.           {
  147.             case BIOS_INFO_TYPE:
  148.              StCallback_BiosInfo(pHeader);
  149.             break;
  150.             case SYSTEM_INFO_TYPE:
  151.              StCallback_SysInfo(pHeader);
  152.             break;
  153.             case BASEBOARD_INFO_TYPE:
  154.              StCallback_MBInfo(pHeader);
  155.             break;
  156.             case CHASSIS_INFO_TYPE:
  157.              StCallback_ChassisInfo(pHeader);
  158.             break;
  159.             case PROCESSOR_INFO_TYPE:
  160.              StCallback_CpuInfo(pHeader);
  161.             break;
  162.             case CACHE_INFO_TYPE:
  163.              StCallback_CacheInfo(pHeader);
  164.             break;
  165.             case PORTS_INFO_TYPE:
  166.              StCallback_PortsInfo(pHeader);
  167.             break;
  168.             case SYSTEMSLOTS_INFO_TYPE:
  169.              StCallback_SystemSlotsInfo(pHeader);
  170.             break;
  171.             case ONBOARDDEVS_INFO_TYPE:
  172.              StCallback_OnBoardDevsInfo(pHeader);
  173.             break;
  174.             case OEMSTRING_INFO_TYPE:
  175.              StCallback_OemStringsInfo(pHeader);
  176.             break;
  177.             case SYSTEMCONFIG_INFO_TYPE:
  178.              StCallback_SysConfigInfo(pHeader);
  179.             break;
  180.             case BIOSLANG_INFO_TYPE:
  181.              StCallback_BiosLangInfo(pHeader);
  182.             break;
  183.             case GROUPASSOCS_INFO_TYPE:
  184.              StCallback_GroupAssocsInfo(pHeader);
  185.             break;
  186.             case SYSLOG_INFO_TYPE:
  187.              StCallback_SysLogInfo(pHeader);
  188.             break;
  189.             case PHYSMEM_INFO_TYPE:
  190.              StCallback_PhysMemInfo(pHeader);
  191.             break;
  192.             case MEMDEV_INFO_TYPE:
  193.              StCallback_MemDevInfo(pHeader);
  194.             break;
  195.             case MEMERROR32_INFO_TYPE:
  196.              StCallback_MemError32Info(pHeader);
  197.             break;
  198.             case MEMARRAYMAPPED_INFO_TYPE:
  199.              StCallback_MemArrayMappedInfo(pHeader);
  200.             break;
  201.             case MEMDEVMAPPED_INFO_TYPE:
  202.              StCallback_MemDevMappedInfo(pHeader);
  203.             break;
  204.             case BUILTINPTRDEV_INFO_TYPE:
  205.              StCallback_BuiltInPtrDevInfo(pHeader);
  206.             break;
  207.             case BATTERY_INFO_TYPE:
  208.              StCallback_BatteryInfo(pHeader);
  209.             break;
  210.             case SYSRESET_INFO_TYPE:
  211.              StCallback_SysResetInfo(pHeader);
  212.             break;
  213.             case HARDSEC_INFO_TYPE:
  214.              StCallback_HardwareSecurityInfo(pHeader);
  215.             break;
  216.             case SYSPOWER_INFO_TYPE:
  217.              StCallback_SysPowerInfo(pHeader);
  218.             break;
  219.             case VOLTPROBE_INFO_TYPE:
  220.              StCallback_VoltageProbeInfo(pHeader);
  221.             break;
  222.             case COOLINGDEV_INFO_TYPE:
  223.              StCallback_CoolingDevInfo(pHeader);
  224.             break;
  225.             case TEMPPROBE_INFO_TYPE:
  226.              StCallback_TempProbeInfo(pHeader);
  227.             break;
  228.             case ELECPROBE_INFO_TYPE:
  229.              StCallback_ElectricalProbeInfo(pHeader);
  230.             break;
  231.             case OOBRA_INFO_TYPE:
  232.              StCallback_OobRemoteAccessInfo(pHeader);
  233.             break;
  234.             case SYSBOOT_INFO_TYPE:
  235.              StCallback_SysBootInfo(pHeader);
  236.             break;
  237.             case MEMERROR64_INFO_TYPE:
  238.              StCallback_MemError64Info(pHeader);
  239.             break;
  240.             case MNGDEV_INFO_TYPE:
  241.              StCallback_ManageDevInfo(pHeader);
  242.             break;
  243.             case MNGDEVCOMP_INFO_TYPE:
  244.              StCallback_ManageDevCompInfo(pHeader);
  245.             break;
  246.             case MNGDEVTHRES_INFO_TYPE:
  247.              StCallback_ManageDevThresholdInfo(pHeader);
  248.             break;
  249.             case MEMCHAN_INFO_TYPE:
  250.              StCallback_MemChannelInfo(pHeader);
  251.             break;
  252.             case IPMIDEV_INFO_TYPE:
  253.              StCallback_IpmiDevInfo(pHeader);
  254.             break;
  255.             case POWERSUPPLY_INFO_TYPE:
  256.              StCallback_PowerSupplyInfo(pHeader);
  257.             break;
  258.             case ADDITIONAL_INFO_TYPE:
  259.              StCallback_AdditionalInfo(pHeader);
  260.             break;
  261.             case ONBOARDDEVSEX_INFO_TYPE:
  262.              StCallback_OnBoardDevExInfo(pHeader);
  263.             break;
  264.             case MNGCTRLHOSTIF_INFO_TYPE:
  265.              StCallback_ManageControlHostInterfaceInfo(pHeader);
  266.             break;
  267.           }
  268.  
  269.           m_BufferPtr+=currentStLen;
  270.         }
  271.  
  272.  
  273.       }
  274.  
  275.     private:
  276.       int32 GetStructureLen( void )
  277.       {
  278.         uint16 Offset = m_BufferPtr;
  279.         uint16 BufferLen = m_BufferSize;
  280.         StructureHeader* pHeader = ((StructureHeader *)&m_Buffer[m_BufferPtr]);
  281.  
  282.         Offset+=pHeader->FormattedSize;
  283.  
  284.         while(Offset < BufferLen)
  285.           if(!memcmp(&m_Buffer[Offset], SMBIOS_STRUCTURE_SEPARATOR, SMBIOS_STRUCTURE_SEPARATOR_SIZE))
  286.             return Offset-m_BufferPtr+SMBIOS_STRUCTURE_SEPARATOR_SIZE;
  287.           else ++Offset;
  288.  
  289.         return -1;
  290.       }
  291.  
  292.       //BIOS_INFO_TYPE:
  293.       void StCallback_BiosInfo(StructureHeader *Header)
  294.       {
  295.         uint8 rTo = Header->FormattedSize-sizeof(uint32);
  296.         *((uint16 *)(Header->Data + 0x02)) = rand32() & 0xFFFF;
  297.         Header->Data[0x05] = rand32() & 0xFF;
  298.         *((uint32 *)(Header->Data + 0x06)) = rand32();
  299.         *((uint32 *)(Header->Data + 0x0A)) = rand32();
  300.         for(uint8 i = 0x0E; i < rTo; ++i)
  301.           Header->Data[i] = rand32() & 0xFF;
  302.       } 
  303.  
  304.       //SYSTEM_INFO_TYPE:
  305.       void StCallback_SysInfo(StructureHeader *Header)
  306.       {
  307.         if(Header->FormattedSize < 0x19)
  308.           return;
  309.  
  310.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  311.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  312.         *((uint32 *)(Header->Data + 0x0C)) = rand32();
  313.         *((uint32 *)(Header->Data + 0x10)) = rand32();
  314.         Header->Data[0x14] = rand32() & 0xFF;
  315.       } 
  316.  
  317.       //BASEBOARD_INFO_TYPE:
  318.       void StCallback_MBInfo(StructureHeader *Header)
  319.       {
  320.         uint8 rTo = Header->FormattedSize-sizeof(uint32);
  321.         Header->Data[0x05] = rand32() & 0xFF;
  322.         *((uint16 *)(Header->Data + 0x07)) = rand32() & 0xFFFF;
  323.         Header->Data[0x09] = rand32() & 0xFF;
  324.         Header->Data[0x0A] = rand32() & 0xFF;
  325.         for(uint8 i = 0x0B; i < rTo; ++i)
  326.           Header->Data[i] = rand32() & 0xFF;
  327.       } 
  328.  
  329.       //CHASSIS_INFO_TYPE:
  330.       void StCallback_ChassisInfo(StructureHeader *Header)
  331.       {
  332.         uint8 rTo = Header->FormattedSize-sizeof(uint8)-sizeof(uint32);
  333.         Header->Data[0x01] = rand32() & 0xFF;
  334.         *((uint32 *)(Header->Data + 0x05)) = rand32();
  335.         *((uint32 *)(Header->Data + 0x09)) = rand32();
  336.         *((uint32 *)(Header->Data + 0x0D)) = rand32();
  337.         for(uint8 i = 0x11; i < rTo; ++i)
  338.           Header->Data[i] = rand32() & 0xFF;
  339.       } 
  340.  
  341.       //PROCESSOR_INFO_TYPE:
  342.       void StCallback_CpuInfo(StructureHeader *Header)
  343.       {
  344.         *((uint16 *)(Header->Data + 0x01)) = rand32() & 0xFFFF;
  345.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  346.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  347.         Header->Data[0x0D] = rand32() & 0xFF;
  348.         *((uint32 *)(Header->Data + 0x0E)) = rand32();
  349.         *((uint32 *)(Header->Data + 0x12)) = rand32();
  350.         *((uint32 *)(Header->Data + 0x16)) = rand32();
  351.         *((uint16 *)(Header->Data + 0x1A)) = rand32() & 0xFFFF;
  352.         Header->Data[0x1F] = rand32() & 0xFF;
  353.         *((uint16 *)(Header->Data + 0x20)) = rand32() & 0xFFFF;
  354.         *((uint32 *)(Header->Data + 0x22)) = rand32();
  355.       } 
  356.  
  357.       //CACHE_INFO_TYPE:
  358.       void StCallback_CacheInfo(StructureHeader *Header)
  359.       {
  360.         *((uint32 *)(Header->Data + 0x01)) = rand32();
  361.         *((uint32 *)(Header->Data + 0x05)) = rand32();
  362.         *((uint32 *)(Header->Data + 0x09)) = rand32();
  363.         *((uint16 *)(Header->Data + 0x0D)) = rand32() & 0xFFFF;
  364.       } 
  365.  
  366.       //PORTS_INFO_TYPE:
  367.       void StCallback_PortsInfo(StructureHeader *Header)
  368.       {
  369.         Header->Data[0x01] = rand32() & 0xFF;
  370.         *((uint16 *)(Header->Data + 0x03)) = rand32() & 0xFFFF;
  371.       } 
  372.  
  373.       //SYSTEMSLOTS_INFO_TYPE:
  374.       void StCallback_SystemSlotsInfo(StructureHeader *Header)
  375.       {
  376.         *((uint32 *)(Header->Data + 0x01)) = rand32();
  377.         *((uint32 *)(Header->Data + 0x05)) = rand32();
  378.         *((uint32 *)(Header->Data + 0x09)) = rand32();
  379.       } 
  380.  
  381.       //ONBOARDDEVS_INFO_TYPE:
  382.       void StCallback_OnBoardDevsInfo(StructureHeader *Header)
  383.       {
  384.         uint8 devCount = (Header->FormattedSize - sizeof(uint32))/sizeof(uint16);
  385.         for(uint8 i = 0; i < devCount; ++i)
  386.           Header->Data[2*i] = rand32() & 0xFF;
  387.       } 
  388.  
  389.       //OEMSTRING_INFO_TYPE:
  390.       void StCallback_OemStringsInfo(StructureHeader *Header)
  391.       {//Nothing to do here
  392.       } 
  393.  
  394.       //SYSTEMCONFIG_INFO_TYPE:
  395.       void StCallback_SysConfigInfo(StructureHeader *Header)
  396.       {//Nothing to do here
  397.       } 
  398.  
  399.       //BIOSLANG_INFO_TYPE:
  400.       void StCallback_BiosLangInfo(StructureHeader *Header)
  401.       {
  402.         Header->Data[0x01] = rand32() & 0x01;
  403.       } 
  404.  
  405.       //GROUPASSOCS_INFO_TYPE:
  406.       void StCallback_GroupAssocsInfo(StructureHeader *Header)
  407.       {
  408.         uint8 rTo = Header->FormattedSize-sizeof(uint32);
  409.         for(uint8 i = 0x01; i < rTo; ++i)
  410.           Header->Data[i] = rand32() & 0xFF;
  411.       } 
  412.  
  413.       //SYSLOG_INFO_TYPE:
  414.       void StCallback_SysLogInfo(StructureHeader *Header)
  415.       {
  416.         uint8 rTo = Header->FormattedSize-sizeof(uint32); 
  417.         *((uint16 *)(Header->Data + 0x06)) = rand32() & 0xFFFF;
  418.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  419.         *((uint32 *)(Header->Data + 0x0C)) = rand32();
  420.         Header->Data[0x10] = rand32() & 0xFF;
  421.         for(uint8 i = 0x13; i < rTo; ++i)
  422.           Header->Data[i] = rand32() & 0xFF;
  423.       } 
  424.  
  425.       //PHYSMEM_INFO_TYPE:
  426.       void StCallback_PhysMemInfo(StructureHeader *Header)
  427.       {
  428.         Header->Data[0x00] = rand32() & 0xFF;
  429.         *((uint16 *)(Header->Data + 0x01)) = rand32() & 0xFFFF;
  430.         *((uint32 *)(Header->Data + 0x03)) = rand32();
  431.         *((uint16 *)(Header->Data + 0x09)) = rand32() & 0xFFFF;
  432.         *((uint32 *)(Header->Data + 0x0B)) = rand32();
  433.         *((uint32 *)(Header->Data + 0x0F)) = rand32();
  434.       } 
  435.  
  436.       //MEMDEV_INFO_TYPE:
  437.       void StCallback_MemDevInfo(StructureHeader *Header)
  438.       {
  439.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  440.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  441.         Header->Data[0x0E] = rand32() & 0xFF;
  442.         *((uint32 *)(Header->Data + 0x0F)) = rand32();
  443.         Header->Data[0x17] = rand32() & 0xFF;
  444.         *((uint32 *)(Header->Data + 0x18)) = rand32();
  445.         *((uint16 *)(Header->Data + 0x1C)) = rand32() & 0xFFFF;
  446.       } 
  447.  
  448.       //MEMERROR32_INFO_TYPE:
  449.       void StCallback_MemError32Info(StructureHeader *Header)
  450.       {
  451.         Header->Data[0x00] = rand32() & 0xFF;
  452.         *((uint16 *)(Header->Data + 0x01)) = rand32() & 0xFFFF;
  453.         *((uint32 *)(Header->Data + 0x03)) = rand32();
  454.         *((uint32 *)(Header->Data + 0x07)) = rand32();
  455.         *((uint32 *)(Header->Data + 0x0B)) = rand32();
  456.         *((uint32 *)(Header->Data + 0x0F)) = rand32();
  457.       } 
  458.  
  459.       //MEMARRAYMAPPED_INFO_TYPE:
  460.       void StCallback_MemArrayMappedInfo(StructureHeader *Header)
  461.       {
  462.         *((uint32 *)(Header->Data + 0x00)) = rand32();
  463.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  464.         Header->Data[0x0A] = rand32() & 0xFF;
  465.         *((uint32 *)(Header->Data + 0x0B)) = rand32();
  466.         *((uint32 *)(Header->Data + 0x0F)) = rand32();
  467.         *((uint32 *)(Header->Data + 0x13)) = rand32();
  468.         *((uint32 *)(Header->Data + 0x17)) = rand32();
  469.       } 
  470.  
  471.       //MEMDEVMAPPED_INFO_TYPE:
  472.       void StCallback_MemDevMappedInfo(StructureHeader *Header)
  473.       {
  474.         *((uint32 *)(Header->Data + 0x00)) = rand32();
  475.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  476.         Header->Data[0x0C] = rand32() & 0xFF;
  477.         *((uint16 *)(Header->Data + 0x0D)) = rand32() & 0xFFFF;
  478.         *((uint32 *)(Header->Data + 0x0F)) = rand32();
  479.         *((uint32 *)(Header->Data + 0x13)) = rand32();
  480.         *((uint32 *)(Header->Data + 0x17)) = rand32();
  481.         *((uint32 *)(Header->Data + 0x1B)) = rand32();
  482.       } 
  483.  
  484.       //BUILTINPTRDEV_INFO_TYPE:
  485.       void StCallback_BuiltInPtrDevInfo(StructureHeader *Header)
  486.       {
  487.         *((uint16 *)(Header->Data + 0x00)) = rand32() & 0xFFFF; 
  488.       } 
  489.  
  490.       //BATTERY_INFO_TYPE:
  491.       void StCallback_BatteryInfo(StructureHeader *Header)
  492.       {
  493.         Header->Data[0x05] = rand32() & 0xFF;
  494.         *((uint32 *)(Header->Data + 0x06)) = rand32();
  495.         Header->Data[0x0B] = rand32() & 0xFF;
  496.         *((uint32 *)(Header->Data + 0x0C)) = rand32();
  497.         Header->Data[0x11] = rand32() & 0xFF;
  498.         *((uint32 *)(Header->Data + 0x12)) = rand32();
  499.       } 
  500.  
  501.       //SYSRESET_INFO_TYPE:
  502.       void StCallback_SysResetInfo(StructureHeader *Header)
  503.       {
  504.         Header->Data[0x00] = rand32() & 0xFF;
  505.         *((uint32 *)(Header->Data + 0x01)) = rand32();
  506.         *((uint32 *)(Header->Data + 0x05)) = rand32();
  507.       } 
  508.  
  509.       //HARDSEC_INFO_TYPE:
  510.       void StCallback_HardwareSecurityInfo(StructureHeader *Header)
  511.       {
  512.         Header->Data[0x00] = rand32() & 0xFF;
  513.       } 
  514.  
  515.       //SYSPOWER_INFO_TYPE:
  516.       void StCallback_SysPowerInfo(StructureHeader *Header)
  517.       {
  518.         Header->Data[0x00] = rand32() & 0xFF;
  519.         *((uint32 *)(Header->Data + 0x01)) = rand32();
  520.       } 
  521.  
  522.       //VOLTPROBE_INFO_TYPE:
  523.       void StCallback_VoltageProbeInfo(StructureHeader *Header)
  524.       {
  525.         Header->Data[0x01] = rand32() & 0xFF;
  526.         *((uint32 *)(Header->Data + 0x02)) = rand32();
  527.         *((uint32 *)(Header->Data + 0x06)) = rand32();
  528.         *((uint32 *)(Header->Data + 0x0A)) = rand32();
  529.         *((uint32 *)(Header->Data + 0x0E)) = rand32();
  530.       } 
  531.  
  532.       //COOLINGDEV_INFO_TYPE:
  533.       void StCallback_CoolingDevInfo(StructureHeader *Header)
  534.       {
  535.         *((uint16 *)(Header->Data + 0x02)) = rand32() & 0xFFFF;
  536.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  537.         *((uint16 *)(Header->Data + 0x08)) = rand32() & 0xFFFF;
  538.       } 
  539.  
  540.       //TEMPPROBE_INFO_TYPE:
  541.       void StCallback_TempProbeInfo(StructureHeader *Header)
  542.       {
  543.         Header->Data[0x01] = rand32() & 0xFF;
  544.         *((uint32 *)(Header->Data + 0x02)) = rand32();
  545.         *((uint32 *)(Header->Data + 0x06)) = rand32();
  546.         *((uint16 *)(Header->Data + 0x0A)) = rand32() & 0xFFFF;
  547.         *((uint32 *)(Header->Data + 0x0C)) = rand32();
  548.         *((uint16 *)(Header->Data + 0x10)) = rand32() & 0xFFFF;
  549.       } 
  550.  
  551.       //ELECPROBE_INFO_TYPE:
  552.       void StCallback_ElectricalProbeInfo(StructureHeader *Header)
  553.       {
  554.         Header->Data[0x01] = rand32() & 0xFF;
  555.         *((uint32 *)(Header->Data + 0x02)) = rand32();
  556.         *((uint32 *)(Header->Data + 0x06)) = rand32();
  557.         *((uint16 *)(Header->Data + 0x0A)) = rand32() & 0xFFFF;
  558.         *((uint32 *)(Header->Data + 0x0C)) = rand32();
  559.         *((uint16 *)(Header->Data + 0x10)) = rand32() & 0xFFFF;
  560.       } 
  561.  
  562.       //OOBRA_INFO_TYPE:
  563.       void StCallback_OobRemoteAccessInfo(StructureHeader *Header)
  564.       {
  565.         Header->Data[0x01] = rand32() & 0xFF;
  566.       } 
  567.  
  568.       //SYSBOOT_INFO_TYPE:
  569.       void StCallback_SysBootInfo(StructureHeader *Header)
  570.       {
  571.         *((uint32 *)(Header->Data + 0x06)) = rand32();
  572.         *((uint32 *)(Header->Data + 0x0A)) = rand32();
  573.         *((uint16 *)(Header->Data + 0x0A)) = rand32() & 0xFFFF;
  574.       } 
  575.  
  576.       //MEMERROR64_INFO_TYPE:
  577.       void StCallback_MemError64Info(StructureHeader *Header)
  578.       {
  579.         Header->Data[0x00] = rand32() & 0xFF;
  580.         *((uint16 *)(Header->Data + 0x01)) = rand32() & 0xFFFF;
  581.         *((uint32 *)(Header->Data + 0x03)) = rand32();
  582.         *((uint32 *)(Header->Data + 0x07)) = rand32();
  583.         *((uint32 *)(Header->Data + 0x0B)) = rand32();
  584.         *((uint32 *)(Header->Data + 0x0F)) = rand32();
  585.         *((uint32 *)(Header->Data + 0x13)) = rand32();
  586.         *((uint32 *)(Header->Data + 0x17)) = rand32();
  587.       } 
  588.  
  589.       //MNGDEV_INFO_TYPE:
  590.       void StCallback_ManageDevInfo(StructureHeader *Header)
  591.       {
  592.         Header->Data[0x01] = rand32() & 0xFF;
  593.         *((uint32 *)(Header->Data + 0x02)) = rand32();
  594.         Header->Data[0x06] = rand32() & 0xFF;
  595.       } 
  596.  
  597.       //MNGDEVCOMP_INFO_TYPE:
  598.       void StCallback_ManageDevCompInfo(StructureHeader *Header)
  599.       {//Nothing to do
  600.       } 
  601.  
  602.       //MNGDEVTHRES_INFO_TYPE:
  603.       void StCallback_ManageDevThresholdInfo(StructureHeader *Header)
  604.       {
  605.         *((uint32 *)(Header->Data + 0x00)) = rand32();
  606.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  607.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  608.       } 
  609.  
  610.       //MEMCHAN_INFO_TYPE:
  611.       void StCallback_MemChannelInfo(StructureHeader *Header)
  612.       {
  613.         uint8 DevCount = (Header->FormattedSize-sizeof(uint32)-sizeof(uint16)-sizeof(uint8))/(sizeof(uint16) + sizeof(uint8));
  614.         *((uint16 *)(Header->Data + 0x00)) = rand32() & 0xFFFF;
  615.         for(uint8 i = 0x00; i < DevCount; ++i)
  616.           Header->Data[0x03 + 3*i] = rand32() & 0xFF;
  617.       } 
  618.  
  619.       //IPMIDEV_INFO_TYPE:
  620.       void StCallback_IpmiDevInfo(StructureHeader *Header)
  621.       {
  622.         *((uint32 *)(Header->Data + 0x00)) = rand32();
  623.         *((uint32 *)(Header->Data + 0x04)) = rand32();
  624.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  625.         *((uint16 *)(Header->Data + 0x0C)) = rand32() & 0xFFFF;
  626.       } 
  627.  
  628.       //POWERSUPPLY_INFO_TYPE:
  629.       void StCallback_PowerSupplyInfo(StructureHeader *Header)
  630.       {
  631.         Header->Data[0x00] = rand32() & 0xFF;
  632.         *((uint32 *)(Header->Data + 0x08)) = rand32();
  633.         *((uint32 *)(Header->Data + 0x0C)) = rand32();
  634.         *((uint16 *)(Header->Data + 0x10)) = rand32() & 0xFFFF;
  635.       } 
  636.  
  637.       //ADDITIONAL_INFO_TYPE:
  638.       void StCallback_AdditionalInfo(StructureHeader *Header)
  639.       {//Fomart has not a fix std, so we don't modify it
  640.       } 
  641.  
  642.       //ONBOARDDEVSEX_INFO_TYPE:
  643.       void StCallback_OnBoardDevExInfo(StructureHeader *Header)
  644.       {
  645.         *((uint32 *)(Header->Data + 0x01)) = rand32();
  646.         *((uint16 *)(Header->Data + 0x05)) = rand32() & 0xFFFF;
  647.       } 
  648.  
  649.       //MNGCTRLHOSTIF_INFO_TYPE:
  650.       void StCallback_ManageControlHostInterfaceInfo(StructureHeader *Header)
  651.       {
  652.         Header->Data[0x00] = rand32() & 0xFF;
  653.       }
  654.  
  655.     protected:
  656.       uint8 *m_Buffer;
  657.       uint32 m_BufferPtr;
  658.       uint32 m_BufferSize;
  659.   };
  660. };
  661.  
  662. uint8 *g_XnaddrData = NULL;
  663. HookData g_HookGetSystemFirmwareTable;
  664.  
  665. void Unban_NullName( void )
  666. {
  667.   //Change Name to nothing
  668.   DWORD dwProtection = PAGE_EXECUTE_READWRITE;
  669.   LPBYTE pPlayerName = LPBYTE(*LPDWORD(ADDRESS_PLAYER_INFO)+0x142);
  670.   VirtualProtect(pPlayerName, sizeof(uint8), dwProtection, &dwProtection);
  671.   *pPlayerName = 0;
  672.   VirtualProtect(pPlayerName, sizeof(uint8), dwProtection, &dwProtection);
  673. }
  674.  
  675. void Unban_ChangeXuid( void )
  676. {
  677.   //Change XUID
  678.   *LPDWORD(ADDRESS_XUID) = rand32();
  679.   *LPDWORD(ADDRESS_XUID + 0x04) = rand32();
  680. }
  681.  
  682. void Unban_ChangeXnaddr( void )
  683. {
  684.   //Change XNADDR
  685.   for(uint8 i = 0; i < XNADDR_LEN;)
  686.     g_XnaddrData[i++] = rand32() & 0xFF;
  687. }
  688.  
  689. void Unban_ChangeSteamId( void )
  690. {
  691.   LPDWORD pSteamId = LPDWORD(*LPDWORD(ADDRESS_PLAYER_INFO)+0x13A);
  692.   pSteamId[0] = rand32(); pSteamId[1] = rand32();
  693. }
  694.  
  695. UINT GetSystemFirmwareTableReal
  696. (
  697.   DWORD FirmwareTableProviderSignature,
  698.   DWORD FirmwareTableID,
  699.   PVOID pFirmwareTableBuffer,
  700.   DWORD BufferSize
  701. )
  702. {
  703.   ULONG uReturnedLen = 0;
  704.   LPBYTE pBuffer = LPBYTE(MALLOC(BufferSize+0x10));
  705.   *LPDWORD(&pBuffer[0x00]) = FirmwareTableProviderSignature;
  706.   *LPDWORD(&pBuffer[0x04]) = 0x00000001;
  707.   *LPDWORD(&pBuffer[0x08]) = FirmwareTableID;
  708.   *LPDWORD(&pBuffer[0x0C]) = BufferSize;
  709.  
  710.   LONG fnRet = ZwQuerySystemInformation(SYSTEMINFO_CLASS_FIRM_TABLE, pBuffer, BufferSize+0x10, NULL);
  711.  
  712.   uReturnedLen = *LPDWORD(&pBuffer[0x0C]);
  713.   if(fnRet < 0)
  714.   {
  715.     if(fnRet != 0xC0000023)
  716.       uReturnedLen = 0;
  717.   }
  718.   else
  719.     memcpy(pFirmwareTableBuffer, &pBuffer[0x10], uReturnedLen);
  720.  
  721.   FREE(pBuffer);
  722.   return uReturnedLen;
  723. }
  724.  
  725. UINT Hook_GetSystemFirmwareTable
  726. (
  727.   DWORD FirmwareTableProviderSignature,
  728.   DWORD FirmwareTableID,
  729.   PVOID pFirmwareTableBuffer,
  730.   DWORD BufferSize
  731. )
  732. {
  733.   UINT fnReturn = GetSystemFirmwareTableReal(FirmwareTableProviderSignature, FirmwareTableID, pFirmwareTableBuffer, BufferSize);
  734.  
  735.   if(BufferSize && fnReturn)
  736.   {
  737.     Unban_NullName();
  738.     Unban_ChangeXuid();
  739.     Unban_ChangeXnaddr();
  740.     Unban_ChangeSteamId();
  741.     //Change SMBIOS Info
  742.     SMBIOS::AlterInfo *alterSmBios = new SMBIOS::AlterInfo((uint8 *)pFirmwareTableBuffer, fnReturn);
  743.     alterSmBios->Process();    
  744.     delete alterSmBios;
  745.   }
  746.  
  747.   return fnReturn;
  748. }
  749.  
  750. void Hook( void )
  751. {
  752.   srand(time(NULL));
  753.   DWORD dwProtection = PAGE_EXECUTE_READWRITE;
  754.   ZwQuerySystemInformation = pZwQuerySystemInformation(GetProcAddress(GetModuleHandleA("ntdll.dll"), "ZwQuerySystemInformation"));
  755.   g_HookGetSystemFirmwareTable.pTargetAddress = GetProcAddress(GetModuleHandleA("kernel32.dll"), "GetSystemFirmwareTable");
  756.  
  757.   LPBYTE pTargetAddress = LPBYTE(Hook_GetSystemFirmwareTable);
  758.   LPBYTE pHookAddress = LPBYTE(g_HookGetSystemFirmwareTable.pTargetAddress);
  759.   VirtualProtect(pHookAddress, JMP_HOOK_SIZE, dwProtection, &dwProtection);
  760.   memcpy(g_HookGetSystemFirmwareTable.OrgData, pHookAddress, JMP_HOOK_SIZE);
  761.   *pHookAddress = 0xE9; *LPDWORD(pHookAddress + 1) = pTargetAddress-pHookAddress-JMP_HOOK_SIZE;
  762.   VirtualProtect(pHookAddress, JMP_HOOK_SIZE, dwProtection, &dwProtection);
  763.  
  764.   //Zero fill unnamed player name string
  765.   dwProtection = PAGE_EXECUTE_READWRITE;
  766.   LPBYTE pUnnamedPlayerName = LPBYTE(ADDRESS_UNNAMEDPLAYER_NAME);
  767.   VirtualProtect(pUnnamedPlayerName, sizeof(uint8), dwProtection, &dwProtection);
  768.   *pUnnamedPlayerName = 0;
  769.   VirtualProtect(pUnnamedPlayerName, sizeof(uint8), dwProtection, &dwProtection);
  770.  
  771.   //Change XNADDR Buffer
  772.   if(g_XnaddrData == NULL)
  773.     g_XnaddrData = ((uint8 *)MALLOC(XNADDR_LEN));
  774.  
  775.   LPDWORD pXnAddrBuffer = LPDWORD(ADDRESS_XNADDRESS_BUFFER);
  776.   VirtualProtect(pXnAddrBuffer, sizeof(uint32), dwProtection, &dwProtection);
  777.   *pXnAddrBuffer = DWORD(g_XnaddrData);
  778.   VirtualProtect(pXnAddrBuffer, sizeof(uint32), dwProtection, &dwProtection);
  779.  
  780.   Unban_ChangeXuid();
  781.   Unban_ChangeXnaddr();
  782.   Unban_ChangeSteamId();
  783. }
  784.  
  785. void Unhook( void )
  786. {
  787.   DWORD dwProtection = PAGE_EXECUTE_READWRITE;
  788.   LPBYTE pHookAddress = LPBYTE(g_HookGetSystemFirmwareTable.pTargetAddress);
  789.   VirtualProtect(pHookAddress, JMP_HOOK_SIZE, dwProtection, &dwProtection);
  790.   memcpy(pHookAddress, g_HookGetSystemFirmwareTable.OrgData, JMP_HOOK_SIZE);
  791.   VirtualProtect(pHookAddress, JMP_HOOK_SIZE, dwProtection, &dwProtection);
  792. }
  793.  
  794. BOOL APIENTRY DllMain( HMODULE hModule,
  795.                        DWORD  ul_reason_for_call,
  796.                        LPVOID lpReserved
  797. 					 )
  798. {
  799.   static bool bLoaded = false;
  800. 	switch (ul_reason_for_call)
  801. 	{
  802. 	case DLL_PROCESS_ATTACH:
  803.    if(!bLoaded)
  804.    {
  805.      Hook();
  806.      bLoaded = true;
  807.    }
  808.   break;
  809.  
  810. 	case DLL_THREAD_ATTACH:
  811. 	case DLL_THREAD_DETACH:
  812. 	case DLL_PROCESS_DETACH:
  813.   break;
  814.  
  815. 	}
  816. 	return TRUE;
  817. }
Runtime error #stdin #stdout 0.01s 7724KB
comments (?)
stdin
copy 
Standard input is empty
stdout
copy 
Standard output is empty
https://ideone.com/WPcn9r
language:
Python (cpython 2.7.16)
created:
11 years ago
visibility:
public

Share or Embed source code

Discover > Sphere Engine API

The brand new service which powers Ideone!

Discover > IDE Widget

Widget for compiling and running the source code in a web browser!