ok there it is
.h
#pragma once
class WardenHandler
{
public:
WardenHandler(void);
~WardenHandler(void);
typedef struct _WardenFuncList WardenFuncList;
//from preparation.h
unsigned char* PrepareModule(const unsigned char* pModule);
unsigned int getInteger(const unsigned char* pArray, unsigned int dwLocation);
void insertInteger(const unsigned char* pArray, unsigned int dwLocation, unsigned int dwValue);
//from intialize.h
unsigned char* GenerateRC4KeysEx(_WardenFuncList** ppWFuncList, void* seed, int len);
WardenFuncList** InitializeWarden(const unsigned char* pModule);
void test();
private:
};
.cpp
#include "WardenHandler.h"
#include <stdio.h>
#include <stdlib.h>
#include <windows.h>
typedef unsigned int uint32_t;
typedef unsigned short uint16_t;
typedef unsigned char uint8_t;
#define module_get_prep_size(a) getInteger(a, 0)
#define memalloc malloc
#define module_get_int32(a, b) \
(*(uint32_t*)(a + (uint32_t)b))
#define module_get_aint32(a, b) \
(*(uint32_t*)(&a[b]))
#define module_get_int16(a, b) \
(*(uint16_t*)&a[(uint32_t)b])
#define module_swap_int16(a) \
(((a & 0xFF00) >> 8) | ((a & 0xFF) << 8))
#define module_set_int32(a, b, c)\
(*(uint32_t*)(a + b) = c)
typedef struct{
uint32_t maped_size; /*00*/
uint32_t unknown1; /*04*/
uint32_t ref_table; /*08*/
uint32_t ref_count; /*0C*/
uint32_t init_addr; /*10*/
uint32_t unknown3; /*14*/
uint32_t unknown4; /*18*/
uint32_t lib_table; /*1C*/
uint32_t lib_count; /*20*/
uint32_t unknown5; /*24*/
}module_header, *pmodule_header;
typedef struct{
uint32_t name_address;
uint32_t function_table;
}library_referance, *plibrary_referance;
typedef struct _FuncList
{
void *fpSendPacket; //0x00
void *fpCheckModule; //0x04
void *fpLoadModule; //0x08
void *fpAllocateMemory;//0xC
void *fpReleaseMemory;//0x10
void *fpSetRC4Data;//0x14
void *fpGetRC4Data;//0x18
} FuncList;
//
typedef void (__thiscall *fnGenerateRC4Keys)(_WardenFuncList** ppFncList, void* lpData, DWORD dwSize);
typedef void (__thiscall *fnUnloadModule)(_WardenFuncList** ppFncList);
typedef void (__thiscall *fnPacketHandler)(_WardenFuncList** ppFncList, BYTE* pPacket, DWORD dwSize, DWORD* dwBuffer);
typedef void (__thiscall *fnTick)(_WardenFuncList** ppFncList, DWORD _2); // _2 is sum dwOldTick - GetTickCount(); shit ..
typedef struct _WardenFuncList
{
fnGenerateRC4Keys fpGenerateRC4Keys;//0x00
fnUnloadModule * fpUnload;//0x04 - Before it frees everything it will call FuncList:fpSetRC4Data and store the RC4 key
fnPacketHandler * fpPacketHandler;//0x8
fnTick * fpTick;//0xC
} WardenFuncList;
typedef WardenFuncList** (__fastcall *fnInitializeModule)(DWORD* lpPtr2Table);
WardenHandler::WardenHandler(void)
{
}
WardenHandler::~WardenHandler(void)
{
}
unsigned char *
WardenHandler::PrepareModule(const unsigned char* source)
{
uint32_t src_location;
uint32_t dest_location;
uint16_t length = 0;
uint8_t bskip = 0;
uint16_t *refs;
uint32_t x = 0;
uint32_t y = 0;
library_referance *libs;
uint8_t *lib;
HMODULE handle;
uint32_t function;
uint32_t func;
//uint8_t *msgbuff;
uint32_t dest;
uint32_t max_size;
module_header *header = (pmodule_header)source;
LPCSTR procName;
max_size = module_get_prep_size(source);
dest = (uint32_t)memalloc(max_size);
memset((uint8_t*)dest, 0, max_size);
memcpy((uint8_t*)dest, source, sizeof(module_header));
src_location = sizeof(module_header) + (header->unknown5 * 12);
dest_location = module_get_aint32(source, 40);
while(dest_location < header->maped_size){
length = module_get_int16(source, src_location);
src_location += 2;
if(!bskip){
memcpy((uint8_t*)(dest + dest_location), source + src_location, length);
src_location += length;
}
bskip = !bskip;
dest_location += length;
}
refs = (uint16_t*)(dest + header->ref_table);
dest_location = 0;
for(x = 0; x < header->ref_count; x++){
dest_location += module_swap_int16(refs[x]);
module_set_int32(dest, dest_location, (module_get_int32(dest, dest_location) % max_size) + dest);
}
libs = (plibrary_referance)(dest + header->lib_table);
for(x = 0; x < header->lib_count; x++){
lib = (uint8_t*)(dest + libs[x].name_address);
//handle = LoadLibrary((const char*)lib);
LPCSTR libName = (LPCSTR)lib;
handle = LoadLibrary(libName);
printf("Loaded library %s at address %x\n", lib, handle);
function = libs[x].function_table;
while(module_get_int32(dest, function) != 0){
func = module_get_int32(dest, function);
if((func & 0x7FFFFFFF) > max_size){
//sprintf_s(msgbuff, 500, "Attempted to read API from offset pass end of module: 0x%08Xn", func); write_to_file(msgbuff);
printf("Attempted to read API from offset pass end of module, BIG ERROR");
break;
}
if(func & 0x80000000){
procName = (LPCSTR)(func & 0x7FFFFFFF);
y = (uint32_t)GetProcAddress(handle, procName);
printf("\t%s mapped at %x\n",procName, y);
}else{
procName = (const char*)(dest + func);
y = (uint32_t)GetProcAddress(handle, procName);
printf("\t%s mapped at %x\n",procName, y);
}
module_set_int32(dest, function, y);
function += 4;
}
}
return (BYTE*)dest;
return 0;
}
unsigned int
WardenHandler::getInteger(const unsigned char* pArray, unsigned int dwLocation)
{
return *(int*)&pArray[dwLocation];
}
void
WardenHandler::insertInteger(const unsigned char* pArray, unsigned int dwLocation, unsigned int dwValue)
{
*(unsigned int*)&pArray[dwLocation] = dwValue;
}
void __stdcall cSendPacket(BYTE* pPacket, DWORD dwSize)
{
printf("cSendPacket called.");
}
BOOL __stdcall cCheckModule(BYTE* pModName, DWORD _2)
{
printf("cCheckModule called.");
return 0;
}
WardenFuncList** __stdcall cLoadModule(BYTE* pRC4Key, BYTE* pModule, DWORD dwModSize)
{
printf("cLoadModule called.\n");
return 0;
}
LPVOID __stdcall cAllocateMemory(DWORD dwSize)
{
void * res = malloc(dwSize);
printf("cAllocateMemory of size %u\n", dwSize);
return res;
}
VOID __stdcall cReleaseMemory(LPVOID lpMemory)
{
printf("cReleaseMemory called.");
free(lpMemory);
}
VOID __stdcall cSetRC4Data(LPVOID lpKeys, DWORD dwSize)
{
printf("cSetRC4Data called.");
}
DWORD __stdcall cGetRC4Data(LPVOID lpBuffer, LPDWORD dwSize)
{
printf("cGetRC4Data buffer=%x, size=%x\n",lpBuffer, *dwSize);
return 0;
}
WardenFuncList**
WardenHandler::InitializeWarden(const unsigned char *pModule)
{
FuncList dwTable;
DWORD A, B, C;
fnInitializeModule fpInitializeModule;
fnGenerateRC4Keys fpGenerateRC4Keys;
FuncList *tableptr = NULL;
WardenFuncList** ppWFuncList;
printf("pModule: %u\n", pModule);
C = getInteger(pModule, 0x18);
B = 1 - C;
if(B > getInteger(pModule, 0x14))
return FALSE;
A = getInteger(pModule, 0x10); // offsetWardenSetup
A = getInteger(pModule, A + (B * 4)) + (DWORD)pModule;
fpInitializeModule = (fnInitializeModule)A;
printf("Initialize Function is mapped at %x (%x)\n", A, A - (DWORD)pModule);
memset(&dwTable, 0, sizeof(FuncList));
dwTable.fpSendPacket = cSendPacket;
dwTable.fpCheckModule = cCheckModule;
dwTable.fpLoadModule = cLoadModule;
dwTable.fpAllocateMemory = cAllocateMemory;
dwTable.fpReleaseMemory = cReleaseMemory;
dwTable.fpSetRC4Data = cSetRC4Data;
dwTable.fpGetRC4Data = cGetRC4Data;
tableptr = &dwTable;
ppWFuncList = fpInitializeModule((DWORD*)&tableptr);
return ppWFuncList;
}
unsigned char* GenerateRC4KeysEx(_WardenFuncList** ppWFuncList, void* seed, int len)
{
/*fnGenerateRC4Keys fpGenerateRC4Keys;
void* ptr = (void*)*ppWFuncList;
WardenFuncList* pWardenFuncList = (WardenFuncList*)ptr;
fpGenerateRC4Keys = pWardenFuncList->fpGenerateRC4Keys;
uint32_t dwGameHash = 0xaef0e532;
uint32_t *pGameGash = &dwGameHash;
fpGenerateRC4Keys(ppWFuncList, pGameGash, 4);*/
return 0;
}
void test()
{
}
1: 2: 3: 4: 5: 6: 7: 8: 9: 10: 11: 12: 13: 14: 15: 16: 17: 18: 19: 20: 21: 22: 23: 24: 25: 26: 27: 28: 29: 30: 31: 32: 33: 34: 35: 36: 37: 38: 39: 40: 41: 42: 43: 44: 45: 46: 47: 48: 49: 50: 51: 52: 53: 54: 55: 56: 57: 58: 59: 60: 61: 62: 63: 64: 65: 66: 67: 68: 69: 70: 71: 72: 73: 74: 75: 76: 77: 78: 79: 80: 81: 82: 83: 84: 85: 86: 87: 88: 89: 90: 91: 92: 93: 94: 95: 96: 97: 98: 99: 100: 101: 102: 103: 104: 105: 106: 107: 108: 109: 110: 111: 112: 113: 114: 115: 116: 117: 118: 119: 120: 121: 122: 123: 124: 125: 126: 127: 128: 129: 130: 131: 132: 133: 134: 135: 136: 137: 138: 139: 140: 141: 142: 143: 144: 145: 146: 147: 148: 149: 150: 151: 152: 153: 154: 155: 156: 157: 158: 159: 160: 161: 162: 163: 164: 165: 166: 167: 168: 169: 170: 171: 172: 173: 174: 175: 176: 177: 178: 179: 180: 181: 182: 183: 184: 185: 186: 187: 188: 189: 190: 191: 192: 193: 194: 195: 196: 197: 198: 199: 200: 201: 202: 203: 204: 205: 206: 207: 208: 209: 210: 211: 212: 213: 214: 215: 216: 217: 218: 219: 220: 221: 222: 223: 224: 225: 226: 227: 228: 229: 230: 231: 232: 233: 234: 235: 236: 237: 238: 239: 240: 241: 242: 243: 244: 245: 246: 247: 248: 249: 250: 251: 252: 253: 254: 255: 256: 257: 258: 259: 260: 261: 262: 263: 264: 265: 266: 267: 268: 269: 270: 271: 272: 273: 274: 275: 276: 277: 278: 279: 280: 281: 282: 283: 284: 285: 286: 287: 288: 289: 290: 291: 292: 293: 294: 295: 296: 297: 298: 299: 300: 301: 302: 303: 304: 305: 306: 307:





by: jkrPosted on 2009-11-02 at 09:23:20ID: 25721377
Please post your code (both .h and .cpp).