Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- /*
- I now understand how this code works.
- Include these headers on the header file:
- #include <fcntl.h>
- #include <stdio.h>
- #include <stdlib.h>
- #include <io.h>
- #include <string>
- #include <sstream>
- #include <iostream>
- #include <Scintilla.h>
- #include <SciLexer.h>
- */
- #include "stdafx.h"
- void Codecave(DWORD destAddress, void (*func)(void), BYTE nopCount);
- void WriteBytesASM(DWORD destAddress, LPVOID patch, DWORD numBytes);
- void setStyle(int style, COLORREF fore, COLORREF back = RGB(255, 255, 255), int size = -1, const char *face = 0);
- DWORD RetAddr = 0;
- HINSTANCE hInst;
- HWND hWnd;
- HWND hWndScintilla;
- HWND executeButton;
- CRITICAL_SECTION cs;
- HANDLE lsEvent;
- char* initial_injection = "coroutine.resume(coroutine.create(function() while wait(.5) do coroutine.resume(coroutine.create(loadstring(\"assert()\", \"Y_SO_CHUNKY\"))) end end))";
- char* ptrToRealScript;
- char* chunkName;
- char* codeToRun;
- bool runningCode = false;
- size_t newLength = 0;
- void print(const wchar_t* msg)
- {
- MessageBoxW(NULL, msg, NULL, 0);
- }
- void print(const char* msg)
- {
- MessageBoxA(NULL, msg, NULL, 0);
- }
- void LULZ()
- {
- if (strcmp(chunkName, "=Studio.ashx") == 0) //Also "=Script Context.StarterScript"
- {
- char* newScript = new char[strlen(ptrToRealScript) + strlen(initial_injection) + 3];
- ZeroMemory(newScript, strlen(ptrToRealScript) + strlen(initial_injection) + 3);
- strcat(newScript, initial_injection);
- strcat(newScript, "\r\n");
- strcat(newScript, ptrToRealScript);
- ptrToRealScript = newScript;
- newLength = strlen(newScript);
- }
- if (strcmp(chunkName, "Y_SO_CHUNKY") == 0 && runningCode)
- {
- EnterCriticalSection(&cs);
- runningCode = false;
- char* newScript = new char[strlen(codeToRun) + 1];
- ZeroMemory(newScript, strlen(codeToRun) + 1);
- strcat(newScript, codeToRun);
- ptrToRealScript = newScript;
- newLength = strlen(newScript);
- SetEvent(lsEvent);
- LeaveCriticalSection(&cs);
- }
- }
- bool APIENTRY DllMain(HMODULE hModule, DWORD ulReason, LPVOID lpReserved)
- {
- hInst = (HINSTANCE)hModule;
- //Get rid of compiler warnings since we do not use this parameter.
- UNREFERENCED_PARAMETER(lpReserved);
- //If we are attaching to a process.
- if (ulReason == DLL_PROCESS_ATTACH)
- {
- //Do no need the thread-based attach/detach messages in this DLL.
- DisableThreadLibraryCalls(hModule);
- }
- //Signal for Loading/Unloading
- return (true);
- }
- __declspec(naked) void CC_EditScript(void)
- {
- __asm
- {
- pop RetAddr
- //Save the script address.
- mov ptrToRealScript, eax
- mov newLength, ecx
- mov chunkName, edx
- //Protect the stack.
- pushad
- pushfd
- }
- LULZ();
- __asm
- {
- popfd
- popad
- mov eax, ptrToRealScript
- mov ecx, newLength
- //Run the code we replaced.
- push edx
- mov DWORD PTR SS:[ESP+4], eax
- push RetAddr
- ret
- }
- }
- LRESULT SendEditor(UINT Msg, WPARAM wParam = 0, LPARAM lParam = 0)
- {
- return ::SendMessage(hWndScintilla, Msg, wParam, lParam);
- }
- void setStyle(int style, COLORREF fore, COLORREF back, int size, const char *face)
- {
- SendEditor(SCI_STYLESETFORE, style, fore);
- SendEditor(SCI_STYLESETBACK, style, back);
- if (size >= 1)
- {
- SendEditor(SCI_STYLESETSIZE, style, size);
- }
- if (face)
- {
- SendEditor(SCI_STYLESETFONT, style, reinterpret_cast<LPARAM>(face));
- }
- }
- const char luaKeyWords[] = "and break do else elseif end false for function if in local nil not or repeat return then true until while";
- LRESULT CALLBACK WndProc(HWND hwnd, UINT msg, WPARAM wParam, LPARAM lParam)
- {
- switch(msg)
- {
- case WM_CREATE:
- executeButton = CreateWindow("BUTTON", "Execute Script", BS_PUSHBUTTON | WS_CHILD | WS_VISIBLE, 0, 377, 500, 20, hwnd, NULL, hInst, NULL);
- hWndScintilla = CreateWindowEx(NULL, "Scintilla", "", WS_CHILD | WS_VISIBLE | WS_TABSTOP | WS_CLIPCHILDREN, 0, 0, 500, 380, hwnd, NULL, hInst, NULL);
- SendEditor(SCI_SETTABWIDTH, 4);
- SendEditor(SCI_SETLEXER, SCLEX_LUA);
- SendEditor(SCI_SETSTYLEBITS, SendEditor(SCI_GETSTYLEBITSNEEDED));
- SendEditor(SCI_SETKEYWORDS, 0, reinterpret_cast<LPARAM>(luaKeyWords));
- setStyle(STYLE_DEFAULT, RGB(0, 0, 0), RGB(255, 255, 255), 11, "courier new");
- SendEditor(SCI_STYLECLEARALL);
- setStyle(SCE_LUA_OPERATOR, RGB(0x80, 0x80, 0));
- setStyle(SCE_LUA_COMMENTLINE, RGB(0, 0x80, 0));
- setStyle(SCE_LUA_COMMENT, RGB(0, 0x80, 0));
- setStyle(SCE_LUA_NUMBER, RGB(0, 0x80, 0x80));
- setStyle(SCE_LUA_LITERALSTRING, RGB(0x80, 0, 0x80));
- setStyle(SCE_LUA_STRING, RGB(0x80, 0, 0x80));
- SendEditor(SCI_STYLESETBOLD, SCE_LUA_WORD, 1);
- setStyle(SCE_LUA_WORD, RGB(0, 0, 0x80));
- ShowWindow(executeButton, SW_SHOW);
- ShowWindow(hWndScintilla, SW_SHOW);
- SetFocus(hWndScintilla);
- break;
- case WM_SIZE:
- if (wParam != 1)
- {
- RECT rc;
- GetClientRect(hWnd, &rc);
- SetWindowPos(hWndScintilla, 0, rc.left, rc.top, rc.right - rc.left, rc.bottom - rc.top - 23, 0);
- SetWindowPos(executeButton, 0, rc.left, rc.bottom - 20, rc.right - rc.left, 20, 0);
- }
- break;
- case WM_COMMAND:
- if ((lParam == (long)executeButton) && (HIWORD(wParam) == BN_CLICKED))
- {
- EnterCriticalSection(&cs);
- runningCode = true;
- codeToRun = new char[SendEditor(SCI_GETLENGTH) + 1];
- TextRange tr;
- tr.chrg.cpMin = 0;
- tr.chrg.cpMax = SendEditor(SCI_GETLENGTH);
- tr.lpstrText = codeToRun;
- SendMessage(hWndScintilla, SCI_GETTEXTRANGE, 0, reinterpret_cast<LPARAM>(&tr));
- EnableWindow(executeButton, false);
- LeaveCriticalSection(&cs);
- WaitForSingleObject(lsEvent, INFINITE);
- }
- break;
- case WM_CLOSE:
- DestroyWindow(hwnd);
- break;
- case WM_DESTROY:
- PostQuitMessage(0);
- break;
- default:
- return DefWindowProc(hwnd, msg, wParam, lParam);
- }
- return 0;
- }
- DWORD WINAPI InputLoop(LPVOID lpParam)
- {
- LoadLibrary("SciLexer.dll");
- WNDCLASSEX wc;
- MSG msg;
- wc.cbSize = sizeof(WNDCLASSEX);
- wc.style = 0;
- wc.lpfnWndProc = WndProc;
- wc.hInstance = hInst;
- wc.hCursor = LoadCursor(NULL, IDC_ARROW);
- wc.hbrBackground = (HBRUSH)COLOR_WINDOW;
- wc.lpszClassName = "ExPro";
- RegisterClassEx(&wc);
- hWnd = CreateWindowEx(NULL, "ExPro", "I like pie. :L", WS_OVERLAPPEDWINDOW, 0, 0, 500, 400, NULL, NULL, hInst, NULL);
- ShowWindow(hWnd, SW_SHOW);
- UpdateWindow(hWnd);
- while (GetMessage(&msg, NULL, 0, 0) > 0)
- {
- EnableWindow(executeButton, true);
- TranslateMessage(&msg);
- DispatchMessage(&msg);
- }
- return msg.wParam;
- }
- extern "C" __declspec(dllexport) void Initialize()
- {
- lsEvent = CreateEvent(NULL, false, false, NULL);
- InitializeCriticalSection(&cs);
- Codecave(0x0073908F, CC_EditScript, 0);
- CreateThread(NULL, 0, InputLoop, NULL, 0, 0);
- }
- //Write bytes in the current process using an ASM method.
- void WriteBytesASM(DWORD destAddress, LPVOID patch, DWORD numBytes)
- {
- //Store old protection of the memory page.
- DWORD oldProtect = 0;
- //Store the source address.
- DWORD srcAddress = PtrToUlong(patch);
- //Make sure page is writeable.
- VirtualProtect((void*)(destAddress), numBytes, PAGE_EXECUTE_READWRITE, &oldProtect);
- //Do the patch (Oldschool style to avoid memcpy)
- __asm
- {
- nop //Filler.
- nop //Filler.
- nop //Filler.
- mov esi, srcAddress //Save the address.
- mov edi, destAddress //Save the destination address.
- mov ecx, numBytes //Save the size of the patch.
- Start:
- cmp ecx, 0 //Are we done yet?
- jz Exit //If so, go to end of the function.
- mov al, [esi] //Move the byte at the patch into AL.
- mov [edi], al //Move AL into the destination byte.
- dec ecx //1 less byte to patch.
- inc esi //Next source byte.
- inc edi //Next destination byte.
- jmp Start //Repeat the process.
- Exit:
- nop //Filler.
- nop //Filler.
- nop //Filler.
- }
- //Restore old page protection.
- VirtualProtect((void*)(destAddress), numBytes, oldProtect, &oldProtect);
- }
- //Codecave function.
- void Codecave(DWORD destAddress, void (*func)(void), BYTE nopCount)
- {
- //Calculate the code cave for chat interception.
- DWORD offset = (PtrToUlong(func) - destAddress) - 5;
- //Buffer of NOPs, static since we limit to 'UCHAR_MAX' NOPs.
- BYTE nopPatch[0xFF] = {0};
- //Construct the patch to the function call.
- BYTE patch[5] = {0xE8, 0x00, 0x00, 0x00, 0x00};
- memcpy(patch + 1, &offset, sizeof(DWORD));
- WriteBytesASM(destAddress, patch, 5);
- //We are done if we do not have NOPs.
- if (nopCount == 0)
- {
- BYTE push7[2] = {0x6A, 0x07};
- WriteBytesASM(0x005E18E4, push7, 2);
- return;
- }
- //Fill it with NOPs.
- memset(nopPatch, 0x90, nopCount);
- //Make the patch now.
- WriteBytesASM(destAddress + 5, nopPatch, nopCount);
- }
Add Comment
Please, Sign In to add comment