rendered paste body/* z e R a^ Anti-Cheat * Copyright by z e R a^ * * Not Ready Yet **/#include <stdio.h>#include <windows.h>#include <tlhelp32.h>#include <stdlib.h>#include "config.h"int getProcs( void );int getProcModules( char*, DWORD, HANDLE );int checkModuleForHack( char* );void writeToLog( char* );void startLog( void );void endLog( void );__int32 genCRC32( char*, int );extern int c_liCRC32[6];extern unsigned long CRC32Table[256];int main( void ){ startLog(); //printf( "\ngetProcs(): %d\n", getProcs() ); printf( "%X\n", genCRC32( "hallo",6) ); endLog(); getchar(); return 0;}void startLog( void ){ FILE *Log = fopen( "zac.log", "a" ); fputs( "START LOGGING\n----------------------------------------\n", Log ); fclose( Log );}void endLog( void ){ FILE *Log = fopen( "zac.log", "a" ); fputs( "-----------------------------------------\nSTOP LOGGING\n", Log ); fclose( Log );}void writeToLog( char* txt ){ FILE *Log = fopen( "zac.log", "a" ); fputs( txt, Log ); fclose( Log );}int getProcs( void ){ // // Handles, etc. // char szFilePath[MAX_PATH]; char szLogText[MAX_PATH]; HANDLE hProc, hProcList, hModList; HINSTANCE hInstLib; MODULEENTRY32 ProcModuleInformation; PROCESSENTRY32 ProcessInformation; // // ToolHelp Function Pointer // HANDLE (WINAPI *lpfCreateToolhelp32Snapshot)( DWORD, DWORD ); BOOL (WINAPI *lpfProcess32First)( HANDLE, LPPROCESSENTRY32 ); BOOL (WINAPI *lpfProcess32Next)( HANDLE, LPPROCESSENTRY32 ); hInstLib = LoadLibraryA( "Kernel32.dll" ); if( NULL == hInstLib ) { return PROC_DLL_RESTRICTED; } lpfCreateToolhelp32Snapshot = ( HANDLE (WINAPI*) (DWORD, DWORD) )GetProcAddress( hInstLib, "CreateToolhelp32Snapshot" ); lpfProcess32First = ( BOOL (WINAPI*) (HANDLE, LPPROCESSENTRY32) )GetProcAddress( hInstLib, "Process32First" ); lpfProcess32Next = ( BOOL (WINAPI*) (HANDLE, LPPROCESSENTRY32) )GetProcAddress( hInstLib, "Process32Next" ); if( NULL != lpfCreateToolhelp32Snapshot || NULL != lpfProcess32First || NULL != lpfProcess32Next ) { hProcList = lpfCreateToolhelp32Snapshot( TH32CS_SNAPPROCESS, 0 ); if( FAILED( hProcList ) ) { FreeLibrary( hInstLib ); return PROC_SNAP; } ProcessInformation.dwSize = sizeof( PROCESSENTRY32 ); if( !lpfProcess32First( hProcList, &ProcessInformation ) ) { FreeLibrary( hInstLib ); return PROC_GET_PROCS; } do { if( 0 == strcmp( ProcessInformation.szExeFile, "hl.exe" ) ) { hProc = OpenProcess( PROCESS_ALL_ACCESS, FALSE, ProcessInformation.th32ProcessID ); if( FAILED( hProc ) ) { CloseHandle( hProc ); continue; } memset( szLogText, 0x00, MAX_PATH ); memset( szFilePath, 0x00, MAX_PATH ); _snprintf( szLogText, MAX_PATH-1, "%d: %s\n", ProcessInformation.th32ProcessID, ProcessInformation.szExeFile ); writeToLog( szLogText ); printf( "%d\n", GetFinalPathNameByHandleA( hProc, szFilePath, MAX_PATH, FILE_NAME_NORMALIZED ) ); printf( "%s\n", szFilePath ); printf( "getProcModules(): %d\n", getProcModules( szFilePath, ProcessInformation.th32ProcessID, hProc ) ); CloseHandle( hProc ); } }while( lpfProcess32Next( hProcList, &ProcessInformation ) ); CloseHandle( hProcList ); } else { FreeLibrary( hInstLib ); return PROC_DLL_INV_FUNC; } FreeLibrary( hInstLib ); return PROC_OK;}int getProcModules( char* basepath, DWORD id, HANDLE hProc ){ // // Toolhelp Function Pointer // HANDLE (WINAPI *lpfCreateToolhelp32Snapshot) (DWORD, DWORD); BOOL (WINAPI *lpfModule32First)( HANDLE, LPMODULEENTRY32 ); BOOL (WINAPI *lpfModule32Next)( HANDLE, LPMODULEENTRY32 ); DWORD (WINAPI *lpfGetModuleFileNameExA)( HANDLE, HMODULE, LPTSTR, DWORD ); char szLogText[MAX_PATH]; char szModPath[MAX_PATH]; char szModDir[MAX_PATH]; HANDLE hModList; HINSTANCE hInstLib; HINSTANCE hPSAPILib; MODULEENTRY32 ProcModuleInformation; ProcModuleInformation.dwSize = sizeof( MODULEENTRY32 ); hInstLib = LoadLibraryA( "Kernel32.dll" ); hPSAPILib = LoadLibraryA( "PSAPI.dll" ); if( NULL == hInstLib || NULL == hPSAPILib ) { return MOD_DLL_RESTRICTED; } lpfGetModuleFileNameExA = ( DWORD (WINAPI*) (HANDLE, HMODULE, LPTSTR, DWORD ) )GetProcAddress( hPSAPILib, "GetModuleFileNameExA" ); lpfCreateToolhelp32Snapshot = ( HANDLE (WINAPI*) (DWORD, DWORD) )GetProcAddress( hInstLib, "CreateToolhelp32Snapshot" ); lpfModule32First = ( BOOL (WINAPI*) (HANDLE, LPMODULEENTRY32) )GetProcAddress( hInstLib, "Module32First" ); lpfModule32Next = ( BOOL (WINAPI*) (HANDLE, LPMODULEENTRY32) )GetProcAddress( hInstLib, "Module32Next" ); if( NULL != lpfModule32First || NULL != lpfModule32Next || NULL != lpfCreateToolhelp32Snapshot || NULL != lpfGetModuleFileNameExA ) { hModList = lpfCreateToolhelp32Snapshot( TH32CS_SNAPMODULE, id ); if( FAILED( hModList ) ) { CloseHandle( hModList ); FreeLibrary( hPSAPILib ); FreeLibrary( hInstLib ); return MOD_RIGHTS; } if( !lpfModule32First( hModList, &ProcModuleInformation ) ) { FreeLibrary( hInstLib ); FreeLibrary( hPSAPILib ); CloseHandle( hModList ); return MOD_NO_MODS; } writeToLog( "Modules:\n" ); do { memset( szLogText, 0x00, MAX_PATH ); memset( szModPath, 0x00, MAX_PATH ); lpfGetModuleFileNameExA( hProc, ProcModuleInformation.hModule, szModPath, MAX_PATH-1 ); strncpy( szModDir, szModPath, MAX_PATH ); szModDir[strlen(szModDir)] = '\0'; if( strlen( szModDir ) > 3 ) { _snprintf( szLogText, MAX_PATH-1, "\t%s: %s\n", ProcModuleInformation.szModule, szModDir ); } else { _snprintf( szLogText, MAX_PATH-1, "\t%s: n\\A\n", ProcModuleInformation.szModule ); } writeToLog( szLogText ); printf( "checkModuleForHack(): %d\n", checkModuleForHack( szModDir ) ); }while( lpfModule32Next( hModList, &ProcModuleInformation ) ); } CloseHandle( hModList ); FreeLibrary( hInstLib ); FreeLibrary( hPSAPILib ); return MOD_OK;}//// 0 = no Hack// 1 = Hack detected//int checkModuleForHack( char* file ){ int fileSize = 0; FILE* module = fopen( file, "r" ); char* text = NULL; fseek( module, 0, SEEK_END ); fileSize = ftell( module ); rewind( module ); text = malloc( fileSize+1 ); if( NULL == text ) { return -1; } memset( text, 0x00, fileSize ); fgets( text, fileSize, module ); text[fileSize]='\n'; printf( "%s : %x\n", file, genCRC32( text, fileSize ) ); free( text ); fclose( module ); return 0;}__int32 genCRC32( char* text, int size ){ __int32 CRC32 = 0xFFFFFFFF; int i = size; while( i-- ) { CRC32 = CRC32Table[ ( CRC32 ^ *text++ ) & 0xFF ] ^ ( CRC32 >> 8 ); } CRC32 ^= 0xFFFFFFFF; return CRC32;}