Untitled

// Proof of concept code for a CoH 1.7 MapHack#include <windows.h>#include <stdio.h>// Definitions of classes to be usedstruct tLocString{	wchar_t const* c_str() const;};struct tVector3f{	float x,y,z;};struct tPlayer{	tLocString const&	GetName		() const;	char const*			GetRaceName	() const;};struct tEntity{	tPlayer*			GetOwner	() const;	tVector3f const&	GetPosition	() const;};// Function forward definitionsbool InjectIntoRelicCoh		();void CreateHook				(unsigned char* pInterceptLoc, DWORD pHookFunction, DWORD iHookLen);void CreateHook_WriteJump	(unsigned char *pInterceptLoc, DWORD pTarget);void CreateHook_WriteCall	(unsigned char *pInterceptLoc, DWORD pTarget);void Hook_ScarCreated		();void Hook_ScarUpdated		();void Hook_ScarDestroyed		();HWND Graphical_CreateWindow	();void Graphical_Render		(HDC hDC);// Imported functionstPlayer*		(__stdcall *g_fGetPlayerAt)		(unsigned long);unsigned long	(__stdcall *g_fGetPlayerCount)	(void);tEntity*		(__stdcall *g_fGetEntityAt)		(unsigned long);unsigned long	(__stdcall *g_fGetEntityCount)	(void);float			(__stdcall *g_fGetWorldWidth)	(void);float			(__stdcall *g_fGetWorldLength)	(void);// GlobalsHWND	g_hOurWindow;HMODULE g_hLocalizerDll;HMODULE g_hSimEngineDll;HMODULE g_hModDll;// Constantsconst unsigned char k_opcode_NOP	= 0x90;const unsigned char k_opcode_CALL	= 0xE8;const int			k_oplen_CALL	= 5;const unsigned char k_opcode_JMP	= 0xE9;const int			k_oplen_JMP		= 5;// Template functionstemplate <class R, class T>void GetUnexportedProcAddress(R pRoot, unsigned long iOffset, T& pDest){	pDest = (T)(((unsigned char*)pRoot) + iOffset);}template <class T>T upper(T a, T b){	if(a > b) return a;	return b;}// FunctionsBOOL APIENTRY DllMain(HMODULE hModule, DWORD iReason, LPVOID pReserved){	if(iReason == DLL_PROCESS_ATTACH)	{		DisableThreadLibraryCalls(hModule);		return InjectIntoRelicCoh() ? TRUE : FALSE;	}    return TRUE;}bool InjectIntoRelicCoh(){	g_hSimEngineDll = LoadLibrary("SimEngine.dll");	g_hModDll = LoadLibrary("WW2Mod.dll");	if( (g_hSimEngineDll == 0) || (g_hModDll == 0) )		return false;	GetUnexportedProcAddress(GetProcAddress(g_hModDll, "GetDllInterface"),		0x230A0,g_fGetEntityCount);	GetUnexportedProcAddress(GetProcAddress(g_hModDll, "GetDllInterface"),		0x23670,g_fGetEntityAt);	GetUnexportedProcAddress(GetProcAddress(g_hSimEngineDll,		"?Init@LuaRuleSystem@@QAEXPAVLuaConfig@@@Z"), 0x300, g_fGetWorldLength);	GetUnexportedProcAddress(GetProcAddress(g_hSimEngineDll,		"?Init@LuaRuleSystem@@QAEXPAVLuaConfig@@@Z"), 0x320, g_fGetWorldWidth);	GetUnexportedProcAddress(GetProcAddress(g_hSimEngineDll,		"?Init@LuaRuleSystem@@QAEXPAVLuaConfig@@@Z"), 0x390, g_fGetPlayerCount);	GetUnexportedProcAddress(GetProcAddress(g_hSimEngineDll,		"?Init@LuaRuleSystem@@QAEXPAVLuaConfig@@@Z"), 0x900, g_fGetPlayerAt);	CreateHook((unsigned char*)GetProcAddress(g_hSimEngineDll, "?StartScript@Scar@@QAE_NXZ"),				(DWORD)Hook_ScarCreated, 6);	CreateHook((unsigned char*)GetProcAddress(g_hSimEngineDll, "?Update@Scar@@QAEXM@Z"),				(DWORD)Hook_ScarUpdated, 6);	CreateHook((unsigned char*)GetProcAddress(g_hSimEngineDll, "??1Scar@@QAE@XZ"),				(DWORD)Hook_ScarDestroyed, 7);	return true;}// Hooks__declspec(naked) void Hook_ScarCreated(){	__asm push eax; push ecx; push edx; push esi;	g_hOurWindow = Graphical_CreateWindow();	__asm pop esi; pop edx; pop ecx; pop eax; ret;}void Hook_ScarUpdated_Real(){	HDC hDC = GetDC(g_hOurWindow);	try	{		Graphical_Render(hDC);	}	catch(...) {}	ReleaseDC(g_hOurWindow, hDC);}__declspec(naked) void Hook_ScarUpdated(){	__asm push eax; push ecx; push edx; push esi;	Hook_ScarUpdated_Real();	__asm pop esi; pop edx; pop ecx; pop eax; ret;}__declspec(naked) void Hook_ScarDestroyed(){	__asm push eax; push ecx; push edx; push esi;	DestroyWindow(g_hOurWindow);	UnregisterClass("ConceptHaxx_Window", (HINSTANCE)GetModuleHandle(0));	__asm pop esi; pop edx; pop ecx; pop eax; ret;}// Graphicalsvoid Graphical_Render(HDC hDC){	RECT r;	r.left = 0; r.top = 0; r.right = 1280; r.bottom = 1024;	FillRect(hDC, &r, (HBRUSH)(COLOR_WINDOW + 1));	unsigned long iEntityCount = g_fGetEntityCount();	int iXOff = 0;	for(unsigned long iPlayer = 1; iPlayer <= g_fGetPlayerCount(); ++iPlayer,iXOff+=151)	{		tPlayer* pPlayer = g_fGetPlayerAt(iPlayer);		char sBuff[256];		sprintf(sBuff, "%S", pPlayer->GetName().c_str());		TextOut(hDC, iXOff,  0, sBuff, strlen(sBuff));		sprintf(sBuff, "%s", pPlayer->GetRaceName());		TextOut(hDC, iXOff,  24, sBuff, strlen(sBuff));		HBRUSH hbrBlack = (HBRUSH)GetStockObject(BLACK_BRUSH);		int iMapYOff = 50;		r.left = iXOff;		r.right = iXOff + 150;		r.top = iMapYOff;		r.bottom = iMapYOff + 150;		FillRect(hDC, &r, hbrBlack);		++r.left;		--r.right;		--r.bottom;		++r.top;		float fMapN = upper(g_fGetWorldLength(), g_fGetWorldWidth());		float fMapMul = ((float)(r.right - r.left)) / (fMapN * 2.0);		for(unsigned long i = 0; i < iEntityCount; ++i)		{			tEntity *pEntity = g_fGetEntityAt(i);			const tVector3f & oPos = pEntity->GetPosition();			float fX = ((oPos.x + fMapN) * fMapMul) + 0.5;			float fY = ((-oPos.z + fMapN) * fMapMul) + 0.5;			tPlayer *pOwner = pEntity->GetOwner();			if(pOwner == pPlayer)			{				SetPixel(hDC, r.left + (int)fX, r.top + (int)fY, RGB(0, 255, 0));			}			else if(pOwner)			{				SetPixel(hDC, r.left + (int)fX, r.top + (int)fY, RGB(255, 0, 0));			}		}	}}HWND Graphical_CreateWindow(){	WNDCLASSEX    wndclass;	wndclass.cbSize         = sizeof(wndclass);	wndclass.style          = CS_HREDRAW | CS_VREDRAW;	wndclass.lpfnWndProc    = DefWindowProc;	wndclass.cbClsExtra     = 0;	wndclass.cbWndExtra     = 0;	wndclass.hInstance      = (HINSTANCE)GetModuleHandle(0);	wndclass.hIcon          = 0;	wndclass.hIconSm        = 0;	wndclass.hCursor        = LoadCursor(NULL, IDC_ARROW);	wndclass.hbrBackground  = (HBRUSH)(COLOR_WINDOW + 1);	wndclass.lpszMenuName   = NULL;	wndclass.lpszClassName  = "ConceptHaxx_Window";	RegisterClassEx(&wndclass);	HWND hWnd = CreateWindow("ConceptHaxx_Window", "MapHack", WS_POPUPWINDOW |    WS_CAPTION | WS_MINIMIZEBOX, 1280, 0, 1280,    1024, NULL, NULL, (HINSTANCE)GetModuleHandle(0), NULL);	ShowWindow(hWnd, SW_SHOWNOACTIVATE);	return hWnd;}// Hook creating functionsvoid CreateHook(unsigned char* pInterceptLoc, DWORD pHookFunction, DWORD iHookLen){	DWORD dwPermission;	unsigned char *pTrampoline; 		VirtualProtect((LPVOID)pInterceptLoc, iHookLen, PAGE_EXECUTE_READWRITE, &dwPermission);	pTrampoline = new unsigned char[k_oplen_CALL + iHookLen + k_oplen_JMP];	CreateHook_WriteCall(pTrampoline, pHookFunction);	memcpy(pTrampoline + k_oplen_CALL, pInterceptLoc, iHookLen);	CreateHook_WriteJump(pTrampoline + k_oplen_CALL + iHookLen, (DWORD)(pInterceptLoc + iHookLen));	CreateHook_WriteJump(pInterceptLoc, (DWORD)pTrampoline);	for(DWORD i = k_oplen_JMP; i < iHookLen; ++i) pInterceptLoc[i] = k_opcode_NOP;	VirtualProtect((LPVOID)pInterceptLoc, iHookLen, dwPermission, &dwPermission);	VirtualProtect((LPVOID)pTrampoline, k_oplen_CALL + iHookLen + k_oplen_JMP,		PAGE_EXECUTE_READWRITE, &dwPermission);}void CreateHook_WriteJump(unsigned char *pInterceptLoc, DWORD pTarget){	*pInterceptLoc = k_opcode_JMP;	*((LPDWORD)( pInterceptLoc + 1 ) ) = pTarget - ( ((DWORD)pInterceptLoc) + 5 );}void CreateHook_WriteCall(unsigned char *pInterceptLoc, DWORD pTarget){	*pInterceptLoc = k_opcode_CALL;	*((LPDWORD)( pInterceptLoc + 1 ) ) = pTarget - ( ((DWORD)pInterceptLoc) + 5 );}// Reimplemented functions for Relic classes__declspec(naked) tLocString const& tPlayer::GetName() const{	__asm lea eax, [ecx+12];	__asm retn;}__declspec(naked) char const* tPlayer::GetRaceName() const{	__asm mov eax, [ecx+196];	__asm add eax, 12;	__asm retn;}__declspec(naked) wchar_t const* tLocString::c_str() const{	__asm mov eax, [ecx];	__asm mov eax, [eax];	__asm retn;}__declspec(naked) tPlayer* tEntity::GetOwner() const{	__asm mov eax, [ecx+52];	__asm retn;}__declspec(naked) tVector3f const& tEntity::GetPosition() const{	__asm lea eax, [ecx+124];	__asm retn;}