1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 160
|
#define _WIN32_WINNT 0x501
#define WIN32_LEAN_AND_MEAN
#include <windows.h>
#include <iostream>
#include <stdio.h>
#include <stdlib.h>
#include <Tlhelp32.h>
using namespace std;
HANDLE hProc;
DWORD GetProcessId (char *prcName)
{
PROCESSENTRY32 procEntry;
BOOL working=0;
DWORD targetPid=0;
HANDLE snapshot =CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS ,0);
procEntry.dwSize=sizeof(PROCESSENTRY32);
if (Process32First(snapshot,&procEntry) )
{
do
{
if(stricmp(procEntry.szExeFile,prcName)==0)
{
CloseHandle(snapshot);
return procEntry.th32ProcessID;
}
}
while (Process32Next(snapshot,&procEntry));
}
CloseHandle(snapshot);
return -1;
}
bool DebugPriviligesEnable()
{
HANDLE hToken;
TOKEN_PRIVILEGES tokPriv;
LUID dbgValue;
if ( ! OpenProcessToken( GetCurrentProcess(),
TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, &hToken ) )
return false;
if ( ! LookupPrivilegeValue( NULL, SE_DEBUG_NAME, &dbgValue ) ){
CloseHandle( hToken );
return false;
}
tokPriv.PrivilegeCount = 1;
tokPriv.Privileges[0].Luid = dbgValue;
tokPriv.Privileges[0].Attributes = SE_PRIVILEGE_ENABLED;
if ( ! AdjustTokenPrivileges( hToken, FALSE, &tokPriv, sizeof(tokPriv), NULL, NULL ) )
{
CloseHandle( hToken );
return false;
}
return true;
}
DWORD GetModuleBaseAddr(char* modName, DWORD procId)
{
HANDLE snapMod;
MODULEENTRY32 me32;
snapMod = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, procId);
me32.dwSize = sizeof(MODULEENTRY32);
if (Module32First(snapMod, &me32)){
do
{
if (stricmp(modName,me32.szModule) == 0){
CloseHandle(snapMod);
return (DWORD) me32.modBaseAddr;
}
}
while(Module32Next(snapMod,&me32));
}
CloseHandle(snapMod);
return 0;
}
DWORD GetIndex(DWORD BaseAddr)
{
DWORD ret;
ReadProcessMemory(hProc,(LPVOID)(BaseAddr+0xACEA4C),&ret,sizeof(DWORD),NULL);
return ret;
}
DWORD GetW3TlsForIndex(DWORD index,DWORD BaseAddr,DWORD pid)
{
THREADENTRY32 te32;
HANDLE hSnap=CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, pid );
te32.dwSize = sizeof(THREADENTRY32);
if ( Thread32First( hSnap, &te32 ) )
{
do
{
if ( te32.th32OwnerProcessID == pid )
{
HANDLE hThread = OpenThread( THREAD_ALL_ACCESS, false, te32.th32ThreadID );
CONTEXT ctx = { CONTEXT_SEGMENTS };
LDT_ENTRY ldt;
GetThreadContext( hThread, &ctx );
GetThreadSelectorEntry( hThread, ctx.SegFs, &ldt );
DWORD dwThreadBase = ldt.BaseLow|(ldt.HighWord.Bytes.BaseMid<<16)|(ldt.HighWord.Bytes.BaseHi<<24);
CloseHandle( hThread );
if ( dwThreadBase == NULL )
continue;
DWORD dwTls;
ReadProcessMemory(hProc,(LPVOID)(dwThreadBase+0xE10+4*index),&dwTls,4,NULL);
printf("Thread: %X , TLS for index %X : %X\n",te32.th32ThreadID,index,(DWORD)dwTls);
if ( dwTls == NULL )
continue;
return (DWORD)dwTls;
}
} while( Thread32Next( hSnap, &te32 ) );
}
return NULL;
}
DWORD GetGameStateValue(DWORD TlsValue)
{
DWORD rt;
if(!ReadProcessMemory(hProc,(LPVOID)(TlsValue+0x0D*4),&rt,4,NULL))
return -1;
if(!ReadProcessMemory(hProc,(LPVOID)(rt+0x10),&rt,4,NULL))
return -1;
if(!ReadProcessMemory(hProc,(LPVOID)(rt+0x8),&rt,4,NULL))
return -1;
if(!ReadProcessMemory(hProc,(LPVOID)(rt+0x278),&rt,4,NULL))
return -1;
return rt;
}
int main()
{
if(!DebugPriviligesEnable())
{
cout<<"Can't get debug privs, cant read wc3 memory buh bye!\n";
system("PAUSE");
return 0;
}
DWORD procId = GetProcessId("war3.exe");
if(procId==-1)
{
cout<<"Can't get wc3 process id buh bye!\n";
system("PAUSE");
return 0;
}
hProc = OpenProcess(PROCESS_VM_READ|PROCESS_QUERY_INFORMATION,FALSE,procId);
DWORD baseAddr= GetModuleBaseAddr("Game.dll",procId);
if(!baseAddr)
{
cout<<"Can't get Game.dll base address buh bye!\n";
CloseHandle(hProc);
system("PAUSE");
return 0;
}
DWORD tlsIndex= GetIndex(baseAddr);
DWORD tlsValue = GetW3TlsForIndex(tlsIndex,baseAddr,procId);
DWORD GState=GetGameStateValue(tlsValue);
cout<<"Game state is : "<<GState<<"\n";
CloseHandle(hProc);
system("PAUSE");
return 0;
} |
Partager