/*
** Stack-based Gmod script enforcer bypass
** (c) TEAM METALSLAVE RAGE CO.
**
** REVISION HISTORY
**
** 00/00/0000 initial implementation in private release as MSSEB.DLL
**
** MEET THE SCRIPT ENFORCER
**
** Due to a large amount of cheaters in Gmod servers running scripts like aimbots, wallhacks
** and so on, Garry Jewman finally decided to implement something called the Script Enforcer.
** Unfortunately, like everything he's created, it didn't work out as well as he had hoped.
**
** The function that blocks scripts is:
**
** bool __thiscall CScriptEnforcer::CanLoadScript( void* );
**
** THE BYPASS EXPLAINED
**
** Before the script enforcer can block a script, it first notifies us in the console via
** Msg. Msg will pass through some formatting functions before eventually landing at whatever
** has been initialized as the SpewOutputFunc. We change the SpewOutputFunc on it and when it
** is called, we check for returns to the script enforcer and rewrite them so the program returns
** into code that is specified in our bypass DLL (see below).
**
** When the Msg() call to the string is called, we catch it and redirect the code. When returning
** we pretend that the script was actually blocked by setting the "blocked" flag but returning 1,
** allowing the script to load.
**
** This only works on scripts that the server has blocked entirely. It does not work on
** scripts that are different from the server's due to multiple CRC and MD5 checks that
** run in-game.
**
** msseb.lib is cleared for public release.
** This source code is kept private for obvious reasons.
**
** No thanks to FPS, because we are ugly and you suck!
**
*/

#include <stdio.h>
#include <windows.h>
#include "convar.h"
#include "dbg.h"

static SpewOutputFunc_t ZeOldSpewOutput = 0; // the old function that handles debug msgs.
static UINT32 se_blockscriptaddr = 0; // the address where the script is blocked
static ConVar seb_enable ( "seb_enable", "0", FCVAR_SERVER_CANNOT_QUERY, "enable dat scriptenforcer bypass mufugga");


// GetStackPtr: obfuscated utility function for getting the stack pointer.
// this doesn't return the *exact* stack frame, but hey, it works.
static __stdcall UINT32* GetStackPointer() {
	UINT32 *stackptr;
	__asm {
		mov eax, esp
		mov stackptr, eax
	};
	return stackptr;
}

UINT8 SEBypass[20] = {
	0x83, 0xC4, 0x08,			// add esp, 8h
	0xC6, 0x46, 0x44, 0x01,		// set scriptenforce flag as blocked
	0xB0, 0x01,					// mov al, 1h to return TRUE
	0x5E,						// pop esi
	0x81, 0xC4, 0x08, 0x01, 0x00, 0x00,	// add esp, 108h
	0xC2, 0x08, 0x00,			// retn 8
};


/*
** ZeNewSpewOutput
** This is our new debug message handler. It just so happens that the
** Script Enforcer calls this before blocking a script.
*/

static SpewRetval_t ZeNewSpewOutput( SpewType_t type, const char* msg )
{
	if (strstr(msg,"ScriptEnforce:") && !strstr(msg, "CRC"))
	{
		Msg("ScriptEnforcer is attempting to block a script.\n");
		// get the stack pointer
		UINT32* theSp = GetStackPointer();
		Msg("ESP = %p\n", theSp);

		// If the script enforcer is trying to block something, step a few stack
		// frames and rewrite anything that's returning to the scriptenforcer
		// validation so it goes to the bypass code when retn is hit in Msg().
		// This verification is done to prevent false positives jumping into
		// code that crashes the thing hilariously.
		int isFound = 0;
		for (int i = 0; i < 0x1000; i ++)
		{
			if (theSp[i] == se_blockscriptaddr)
			{
				theSp[i] = (UINT32)SEBypass;
				Msg("*** ScriptEnforcer tried to block a script. Stack modified.\n");
				isFound = 1;
				break;
			}
		}
		if (!isFound) Msg("ERROR: Couldn't find the return address in the stack!\n");
	}

	// jump off to the old spew output function
	return ZeOldSpewOutput( type, msg );
}

void SEBypasser_Init()
{
	// get the return address following the Msg()
	se_blockscriptaddr = (UINT32)GetModuleHandleA("client.dll");
	se_blockscriptaddr += 0x1CC22A;

	// get the original spew fcn using Msg (there's a pointer in there
	// to the output function). this is yet another module garry has no
	// control over so we can care less about what changes here.
	ZeOldSpewOutput = GetSpewOutputFunc();

	if (!ZeOldSpewOutput) {
		Msg("Old spew function was ZERO\n");
		return;
	}

	// Switch the output on us. All messages now go through our filter.
	SpewOutputFunc( ZeNewSpewOutput );

	// just let the user know that we initialized the module OK.
	Msg("*** msseb.lib built " __DATE__ " " __TIME__" ***\n");
	Msg("(c) 2010 TEAM METALSLAVE RAGE CO.\n");
	Msg("this software is provided to you without warranty or terms.\n");
	Msg("see msseb.txt for further information.\n");
}