rendered paste body#include "Inject.h"//###########################################################// ForceLib (c) Y0da! :)//############################################################include "ForceLib/ForceLib.h"//// Extern Prototypes//extern void LogText( TCHAR* );//// Global Variables//PROCESS_INFORMATION pi;STARTUPINFO si;PROCESSENTRY32 pe32;MODULEENTRY32 me32;THREADENTRY32 te32;//###########################################################//## InjectHook()//##//## Determines the method of injection to use, returns//## true or false. The return value is given from the//## method function used.//##//## Returns: FALSE(failed), TRUE(success)//###########################################################BOOL InjectHook(){//###########################################################//## bMethodToUse//## 0 - None [Failed]//## 1 - Proccess already running, CreateRemoteThread()//## 2 - No Process Found, Launch and inject.//########################################################### BYTE bMethodToUse = 0;//###########################################################//##//## INJECTION SELECTOR -- SCAN PROC LIST FOR RUNNING GAME//##//########################################################### HANDLE hSnapshot = NULL; pe32.dwSize = sizeof(PROCESSENTRY32); hSnapshot = CreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); if( Process32First( hSnapshot, &pe32 ) ) { do{ if( _tcsstr( pe32.szExeFile, "NostaleX.dat" ) != NULL ) { bMethodToUse = 1; break; } }while( Process32Next( hSnapshot, &pe32 ) ); } if( hSnapshot != INVALID_HANDLE_VALUE ) CloseHandle( hSnapshot ); // Found Process Running, Using Method 1 if( bMethodToUse == 1 ) { LogText( "[INFO] Found Process!" ); LogText( "[INFO] Using injection method 1.." ); return InjectMethod1(); } else { LogText( "[INFO] Process Was Not Found!" ); LogText( "[INFO] Using injection method 2.." ); return InjectMethod2(); }}//###########################################################//## INJECTION METHOD #1//##//## The process was found in memory so we will attempt//## to hook into it using CreateRemoteThread.//##//## Returns: FALSE(failed), TRUE(success)//###########################################################BOOL InjectMethod1(){ // // Although we landed here, we may not // want to inject. Check for the hook. // HANDLE hSnapModules = NULL; me32.dwSize = sizeof(MODULEENTRY32); hSnapModules = CreateToolhelp32Snapshot( TH32CS_SNAPMODULE, pe32.th32ProcessID ); if( Module32First( hSnapModules, &me32 ) ) { do{ if( _tcsstr( me32.szModule, "NosHook.dll" ) != NULL ) { // // Our hook was found, so lets exit. // CloseHandle( hSnapModules ); LogText( "[ERROR] Injection has failed." ); LogText( "[ERROR] Hook already installed." ); return FALSE; } }while( Module32Next( hSnapModules, &me32 ) ); } CloseHandle( hSnapModules ); // // Our hook was not previous injected so // lets attempt to inject now. [Forcelib] // // First, grab the process thread. // HANDLE hSnapthreads = NULL; te32.dwSize = sizeof(THREADENTRY32); hSnapthreads = CreateToolhelp32Snapshot( TH32CS_SNAPTHREAD, 0 ); if( Thread32First( hSnapthreads, &te32 ) ) { do{ if( te32.th32OwnerProcessID == pe32.th32ProcessID ) { break; } }while( Thread32Next( hSnapthreads, &te32 ) ); } // // Setup our variables for ForceLib // pi.dwProcessId = pe32.th32ProcessID; pi.dwThreadId = te32.th32ThreadID; pi.hProcess = OpenProcess( PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID ); // // Suspend the main thread before injection. // SuspendThread( pi.hThread ); Sleep( 10 ); // Let Windows Catch Up ;) // // Make sure the hook exists :) // TCHAR szHookPath[MAX_PATH]; _tfullpath( szHookPath, "NosHook.dll", MAX_PATH ); if( GetFileAttributes( szHookPath ) == 0xFFFFFFFF ) { LogText( "[ERROR] Hook not found!" ); return FALSE; } // // Attempt to force our hook. [ForceLib] // if( !ForceLibrary( szHookPath, &pi ) ) { LogText( "[ERROR] Injection failed. :(" ); ResumeThread( pi.hThread ); CloseHandle( pi.hThread ); CloseHandle( pi.hProcess ); return FALSE; } else { LogText( "[INFO] Injection successful! :)" ); ResumeThread( pi.hThread ); WaitForSingleObject( pi.hThread, INFINITE ); CloseHandle( pi.hThread ); CloseHandle( pi.hProcess ); return TRUE; } // // Something went wrong :( // LogText( "[CRIT] Unknown error in method 1." ); return FALSE;}//###########################################################//## INJECTION METHOD #2//##//## The process was not found in memory so we will attempt//## to launch the process and inject into it at startup.//##//## Returns: FALSE(failed), TRUE(success)//###########################################################BOOL InjectMethod2(){ // // The process was not found so lets create the // process ourself. THIS BYPASSES THE UPDATER!! // // // First lets make sure the hook exists. // TCHAR szHookPath[MAX_PATH]; _tfullpath( szHookPath, "NosHook.dll", MAX_PATH ); if( GetFileAttributes( szHookPath ) == 0xFFFFFFFF ) { LogText( "[ERROR] Hook not found!" ); return FALSE; } // // Next lets read the registry for the install path. // DWORD dwDataSize = NULL; HKEY hKey = NULL; TCHAR tKey[MAX_PATH] = {0}; TCHAR tGamePath[MAX_PATH] = {0}; _stprintf_s( tKey, sizeof(tKey), "SOFTWARE\\Nostale(UK)" ); if( RegOpenKeyEx( HKEY_LOCAL_MACHINE, tKey, NULL, KEY_READ, &hKey ) != ERROR_SUCCESS ) { LogText( "[ERROR] Registry entry missing..." ); return FALSE; } else { DWORD dwType = REG_SZ; if( RegQueryValueEx( hKey, _T("DestDir"), 0, &dwType, (PBYTE)NULL, &dwDataSize ) == ERROR_SUCCESS ) { RegQueryValueEx( hKey, _T("DestDir"), 0, &dwType, (PBYTE)(LPTSTR)tGamePath, &dwDataSize ); } else { LogText( "[ERROR] Reg: Failed to locate game path." ); return FALSE; } } RegCloseKey( hKey ); // // Create clean variables from path. // TCHAR tGameExe[MAX_PATH] = {0}; _tcscat_s( tGameExe, sizeof(tGamePath), tGamePath ); _tcscat_s( tGameExe, sizeof(tGameExe), _T("\\NostaleX.dat") ); // // Setup our variables for process launching. // ZeroMemory( &si, sizeof(STARTUPINFO) ); TCHAR tCmdArgs[MAX_PATH] = {0}; _tcscat_s( tCmdArgs, sizeof(tGameExe), tGameExe ); _tcscat_s( tCmdArgs, sizeof(tCmdArgs), _T(" EntwellNostaleClient") ); // // Create the process, suspended. // BOOL bResult = CreateProcess(tGameExe, tCmdArgs, NULL, NULL, FALSE, CREATE_SUSPENDED|NORMAL_PRIORITY_CLASS, NULL, tGamePath, &si, &pi); if( !bResult ) { LogText( "[ERROR] Failed to launch the process.." ); return FALSE; } // // Inject our hook into the suspended process. // int hLibModule = 0; LPVOID pLibRemote = VirtualAllocEx( pi.hProcess, NULL, sizeof(szHookPath), MEM_COMMIT, PAGE_EXECUTE_READWRITE ); WriteProcessMemory( pi.hProcess, pLibRemote, szHookPath, sizeof(szHookPath), NULL ); HANDLE hThread = CreateRemoteThread( pi.hProcess, NULL, 0, (LPTHREAD_START_ROUTINE)::GetProcAddress(GetModuleHandle(_T("Kernel32")), "LoadLibraryA"), pLibRemote, 0, NULL ); WaitForSingleObject( hThread, INFINITE ); GetExitCodeThread( hThread, (PDWORD)&hLibModule ); CloseHandle( hThread ); VirtualFreeEx( pi.hProcess, pLibRemote, sizeof(szHookPath), MEM_RELEASE ); // // Check if the hook loaded. // if( !hLibModule ) { LogText( "[ERROR] Failed to load hook." ); LogText( "[ERROR] Killing suspended process." ); TerminateThread( pi.hThread, 0 ); return FALSE; } else { LogText( "[INFO] Injection successful!" ); ResumeThread( pi.hThread ); CloseHandle( pi.hProcess ); CloseHandle( pi.hThread ); return TRUE; } // // Something went wrong :( // LogText( "[CRIT] Unknown error in method 2." ); return FALSE;}