Advertisement
yasi04

Untitled

Jan 22nd, 2025
37
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 7.50 KB | None | 0 0
  1. #include <windows.h>
  2. #include <tlhelp32.h>
  3. #include <fstream>
  4. #include <iostream>
  5. #include <string>
  6. #include <vector>
  7. #include <psapi.h>
  8.  
  9. // Определения для PE-структур
  10. typedef ULONGLONG QWORD;
  11. #define IMAGE_REL_BASED_DIR64 10
  12.  
  13. // Структура для записей релокации
  14. typedef struct _BASE_RELOCATION_ENTRY {
  15.     USHORT Offset : 12;
  16.     USHORT Type : 4;
  17. } BASE_RELOCATION_ENTRY, *PBASE_RELOCATION_ENTRY;
  18.  
  19. struct MANUAL_MAPPING_DATA {
  20.     PVOID ImageBase;
  21.     PVOID EntryPoint;
  22. };
  23.  
  24. // Логирование
  25. void Log(const std::string& message) {
  26.     std::ofstream log("injector.log", std::ios::app);
  27.     if (log) {
  28.         log << "[" << __TIME__ << "] " << message << std::endl;
  29.     }
  30. }
  31.  
  32. DWORD GetProcessIdByName(const std::wstring& processName) {
  33.     DWORD processId = 0;
  34.     HANDLE snapshot = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
  35.    
  36.     if (snapshot == INVALID_HANDLE_VALUE) {
  37.         Log("Snapshot error: " + std::to_string(GetLastError()));
  38.         return 0;
  39.     }
  40.  
  41.     PROCESSENTRY32W entry = { sizeof(PROCESSENTRY32W) };
  42.     if (Process32FirstW(snapshot, &entry)) {
  43.         do {
  44.             if (processName == entry.szExeFile) {
  45.                 processId = entry.th32ProcessID;
  46.                 break;
  47.             }
  48.         } while (Process32NextW(snapshot, &entry));
  49.     }
  50.    
  51.     CloseHandle(snapshot);
  52.     return processId;
  53. }
  54.  
  55. void ApplyRelocations(PIMAGE_NT_HEADERS64 pNtHeaders, PVOID base, ULONGLONG delta) {
  56.     if (delta == 0) return;
  57.  
  58.     auto dir = &pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_BASERELOC];
  59.     if (dir->Size == 0) return;
  60.  
  61.     auto reloc = (PIMAGE_BASE_RELOCATION)((ULONGLONG)base + dir->VirtualAddress);
  62.     while (reloc->VirtualAddress > 0) {
  63.         ULONGLONG relocAddr = (ULONGLONG)base + reloc->VirtualAddress;
  64.         UINT numEntries = (reloc->SizeOfBlock - sizeof(IMAGE_BASE_RELOCATION)) / sizeof(WORD);
  65.         auto entries = (PBASE_RELOCATION_ENTRY)(reloc + 1);
  66.  
  67.         for (UINT i = 0; i < numEntries; i++) {
  68.             if (entries[i].Type == IMAGE_REL_BASED_DIR64) {
  69.                 ULONGLONG* patchAddr = (ULONGLONG*)(relocAddr + entries[i].Offset);
  70.                 *patchAddr += delta;
  71.             }
  72.         }
  73.         reloc = (PIMAGE_BASE_RELOCATION)((ULONGLONG)reloc + reloc->SizeOfBlock);
  74.     }
  75. }
  76.  
  77. bool ResolveImports(HANDLE hProcess, PIMAGE_NT_HEADERS64 pNtHeaders, PVOID base) {
  78.     auto dir = &pNtHeaders->OptionalHeader.DataDirectory[IMAGE_DIRECTORY_ENTRY_IMPORT];
  79.     if (dir->Size == 0) return true;
  80.  
  81.     auto importDesc = (PIMAGE_IMPORT_DESCRIPTOR)((ULONGLONG)base + dir->VirtualAddress);
  82.     while (importDesc->Name) {
  83.         char* moduleName = (char*)((ULONGLONG)base + importDesc->Name);
  84.         HMODULE hModule = GetModuleHandleA(moduleName);
  85.         if (!hModule) {
  86.             hModule = LoadLibraryA(moduleName);
  87.             if (!hModule) return false;
  88.         }
  89.  
  90.         auto thunk = (PIMAGE_THUNK_DATA64)((ULONGLONG)base + importDesc->FirstThunk);
  91.         while (thunk->u1.AddressOfData) {
  92.             if (IMAGE_SNAP_BY_ORDINAL64(thunk->u1.Ordinal)) {
  93.                 auto proc = GetProcAddress(hModule, (LPCSTR)IMAGE_ORDINAL64(thunk->u1.Ordinal));
  94.                 if (!proc) return false;
  95.                 thunk->u1.Function = (ULONGLONG)proc;
  96.             }
  97.             else {
  98.                 auto import = (PIMAGE_IMPORT_BY_NAME)((ULONGLONG)base + thunk->u1.AddressOfData);
  99.                 auto proc = GetProcAddress(hModule, import->Name);
  100.                 if (!proc) return false;
  101.                 thunk->u1.Function = (ULONGLONG)proc;
  102.             }
  103.             thunk++;
  104.         }
  105.         importDesc++;
  106.     }
  107.     return true;
  108. }
  109.  
  110. bool ManualMap(HANDLE hProcess, const std::string& dllPath) {
  111.     Log("Starting manual mapping...");
  112.  
  113.     HANDLE hFile = CreateFileA(dllPath.c_str(), GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, 0, NULL);
  114.     if (hFile == INVALID_HANDLE_VALUE) {
  115.         Log("CreateFile failed: " + std::to_string(GetLastError()));
  116.         return false;
  117.     }
  118.  
  119.     DWORD fileSize = GetFileSize(hFile, NULL);
  120.     std::vector<BYTE> dllData(fileSize);
  121.     DWORD bytesRead;
  122.    
  123.     if (!ReadFile(hFile, dllData.data(), fileSize, &bytesRead, NULL)) {
  124.         Log("ReadFile failed: " + std::to_string(GetLastError()));
  125.         CloseHandle(hFile);
  126.         return false;
  127.     }
  128.     CloseHandle(hFile);
  129.  
  130.     auto pDosHeader = (PIMAGE_DOS_HEADER)dllData.data();
  131.     if (pDosHeader->e_magic != IMAGE_DOS_SIGNATURE) {
  132.         Log("Invalid DOS header");
  133.         return false;
  134.     }
  135.  
  136.     auto pNtHeaders = (PIMAGE_NT_HEADERS64)((ULONGLONG)dllData.data() + pDosHeader->e_lfanew);
  137.     if (pNtHeaders->Signature != IMAGE_NT_SIGNATURE ||
  138.         pNtHeaders->OptionalHeader.Magic != IMAGE_NT_OPTIONAL_HDR64_MAGIC) {
  139.         Log("Invalid NT header");
  140.         return false;
  141.     }
  142.  
  143.     PVOID remoteBase = VirtualAllocEx(hProcess, (PVOID)pNtHeaders->OptionalHeader.ImageBase,
  144.         pNtHeaders->OptionalHeader.SizeOfImage, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  145.    
  146.     if (!remoteBase) {
  147.         remoteBase = VirtualAllocEx(hProcess, NULL, pNtHeaders->OptionalHeader.SizeOfImage,
  148.             MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE);
  149.         if (!remoteBase) {
  150.             Log("Memory allocation failed: " + std::to_string(GetLastError()));
  151.             return false;
  152.         }
  153.     }
  154.  
  155.     WriteProcessMemory(hProcess, remoteBase, dllData.data(), pNtHeaders->OptionalHeader.SizeOfHeaders, NULL);
  156.  
  157.     auto pSection = IMAGE_FIRST_SECTION(pNtHeaders);
  158.     for (int i = 0; i < pNtHeaders->FileHeader.NumberOfSections; i++, pSection++) {
  159.         PVOID secDest = (BYTE*)remoteBase + pSection->VirtualAddress;
  160.         WriteProcessMemory(hProcess, secDest, dllData.data() + pSection->PointerToRawData, pSection->SizeOfRawData, NULL);
  161.     }
  162.  
  163.     ULONGLONG delta = (ULONGLONG)remoteBase - pNtHeaders->OptionalHeader.ImageBase;
  164.     ApplyRelocations(pNtHeaders, remoteBase, delta);
  165.  
  166.     if (!ResolveImports(hProcess, pNtHeaders, remoteBase)) {
  167.         Log("Import resolution failed");
  168.         VirtualFreeEx(hProcess, remoteBase, 0, MEM_RELEASE);
  169.         return false;
  170.     }
  171.  
  172.     MANUAL_MAPPING_DATA mappingData{};
  173.     mappingData.ImageBase = remoteBase;
  174.     mappingData.EntryPoint = (PVOID)((ULONGLONG)remoteBase + pNtHeaders->OptionalHeader.AddressOfEntryPoint);
  175.  
  176.     HANDLE hThread = CreateRemoteThread(hProcess, NULL, 0,
  177.         (LPTHREAD_START_ROUTINE)mappingData.EntryPoint,
  178.         mappingData.ImageBase, 0, NULL);
  179.    
  180.     if (!hThread) {
  181.         Log("Thread creation failed: " + std::to_string(GetLastError()));
  182.         VirtualFreeEx(hProcess, remoteBase, 0, MEM_RELEASE);
  183.         return false;
  184.     }
  185.  
  186.     WaitForSingleObject(hThread, INFINITE);
  187.     CloseHandle(hThread);
  188.     Log("Manual mapping completed");
  189.     return true;
  190. }
  191.  
  192. int main() {
  193.     const std::string dllPath = "C:\\Downloads\\d3d11hook_[unknowncheats.me]_.dll";
  194.     const std::wstring targetProcess = L"RainbowSix_DX11.exe";
  195.  
  196.     DWORD pid = GetProcessIdByName(targetProcess);
  197.     if (!pid) {
  198.         Log("Process not found");
  199.         return 1;
  200.     }
  201.  
  202.     HANDLE hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pid);
  203.     if (!hProcess) {
  204.         Log("OpenProcess failed: " + std::to_string(GetLastError()));
  205.         return 1;
  206.     }
  207.  
  208.     if (!ManualMap(hProcess, dllPath)) {
  209.         Log("Injection failed");
  210.         CloseHandle(hProcess);
  211.         return 1;
  212.     }
  213.  
  214.     CloseHandle(hProcess);
  215.     Log("Injection succeeded");
  216.     return 0;
  217. }
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement