From 2fb289db4c9b37772a0ec6c6c2c8189eaec06aaa Mon Sep 17 00:00:00 2001 From: Ivan Molodetskikh Date: Mon, 26 Jan 2015 10:20:23 +0300 Subject: [PATCH] LoadAndDecryptHwDLL hook for doing stuff in NGHL and WON. --- BunnymodXT/modules/HwDLL.cpp | 24 ++++++++++++++++++++++++ BunnymodXT/modules/HwDLL.hpp | 1 + BunnymodXT/patterns.hpp | 19 +++++++++++++++++++ SPTLib | 2 +- 4 files changed, 45 insertions(+), 1 deletion(-) diff --git a/BunnymodXT/modules/HwDLL.cpp b/BunnymodXT/modules/HwDLL.cpp index b7ae4287..5f7530ac 100644 --- a/BunnymodXT/modules/HwDLL.cpp +++ b/BunnymodXT/modules/HwDLL.cpp @@ -29,6 +29,7 @@ void HwDLL::Hook(const std::wstring& moduleName, void* moduleHandle, void* modul if (needToIntercept) MemUtils::Intercept(moduleName, { + { reinterpret_cast(&ORIG_LoadAndDecryptHwDLL), reinterpret_cast(HOOKED_LoadAndDecryptHwDLL) }, { reinterpret_cast(&ORIG_Cbuf_Execute), reinterpret_cast(HOOKED_Cbuf_Execute) }, { reinterpret_cast(&ORIG_SeedRandomNumberGenerator), reinterpret_cast(HOOKED_SeedRandomNumberGenerator) }, { reinterpret_cast(&ORIG_time), reinterpret_cast(HOOKED_time) }, @@ -42,6 +43,7 @@ void HwDLL::Unhook() { if (m_Intercepted) MemUtils::RemoveInterception(m_Name, { + { reinterpret_cast(&ORIG_LoadAndDecryptHwDLL), reinterpret_cast(HOOKED_LoadAndDecryptHwDLL) }, { reinterpret_cast(&ORIG_Cbuf_Execute), reinterpret_cast(HOOKED_Cbuf_Execute) }, { reinterpret_cast(&ORIG_SeedRandomNumberGenerator), reinterpret_cast(HOOKED_SeedRandomNumberGenerator) }, { reinterpret_cast(&ORIG_time), reinterpret_cast(HOOKED_time) }, @@ -59,6 +61,7 @@ void HwDLL::Unhook() void HwDLL::Clear() { + ORIG_LoadAndDecryptHwDLL = nullptr; ORIG_Cbuf_Execute = nullptr; ORIG_SeedRandomNumberGenerator = nullptr; ORIG_time = nullptr; @@ -180,6 +183,12 @@ void HwDLL::FindStuff() //DEF_FUTURE(RandomFloat) //DEF_FUTURE(RandomLong) DEF_FUTURE(Host_Changelevel2_f) + bool oldEngine = (m_Name.find(L"hl.exe") != std::wstring::npos); + std::future fLoadAndDecryptHwDLL; + if (oldEngine) { + // In WON after the engine DLL has been loaded once for some reason there are multiple identical LoadAndDecrypt functions in the memory, we need the first one always. + fLoadAndDecryptHwDLL = std::async(MemUtils::FindFirstSequence, m_Base, m_Length, Patterns::ptnsLoadAndDecryptHwDLL, reinterpret_cast(&ORIG_LoadAndDecryptHwDLL)); + } #undef DEF_FUTURE auto fCbuf_Execute = MemUtils::FindPatternOnly(reinterpret_cast(&ORIG_Cbuf_Execute), m_Base, m_Length, Patterns::ptnsCbuf_Execute, @@ -324,6 +333,14 @@ void HwDLL::FindStuff() ORIG_Cmd_AddMallocCommand = nullptr; ORIG_Cbuf_Execute = nullptr; } + + if (oldEngine) { + n = fLoadAndDecryptHwDLL.get(); + if (ORIG_LoadAndDecryptHwDLL) + EngineDevMsg("[hw dll] Found LoadAndDecryptHwDLL at %p (using the %s pattern).\n", ORIG_LoadAndDecryptHwDLL, Patterns::ptnsLoadAndDecryptHwDLL[n].build.c_str()); + else + EngineDevWarning("[hw dll] Could not find LoadAndDecryptHwDLL.\n"); + } } if (ORIG_Cbuf_Execute && !ORIG_time) @@ -757,3 +774,10 @@ HOOK_DEF_0(HwDLL, void, __cdecl, Host_Changelevel2_f) return ORIG_Host_Changelevel2_f(); } + +HOOK_DEF_3(HwDLL, void, __cdecl, LoadAndDecryptHwDLL, int, a, void*, b, void*, c) +{ + ORIG_LoadAndDecryptHwDLL(a, b, c); + EngineDevMsg("[hw dll] LoadAndDecryptHwDLL has been called. Rehooking.\n"); + Hooks::HookModule(L"hl.exe"); +} diff --git a/BunnymodXT/modules/HwDLL.hpp b/BunnymodXT/modules/HwDLL.hpp index ff754745..6e184535 100644 --- a/BunnymodXT/modules/HwDLL.hpp +++ b/BunnymodXT/modules/HwDLL.hpp @@ -6,6 +6,7 @@ class HwDLL : public IHookableNameFilterOrdered { + HOOK_DECL(void, __cdecl, LoadAndDecryptHwDLL, int a, void* b, void* c) HOOK_DECL(void, __cdecl, Cbuf_Execute) HOOK_DECL(void, __cdecl, SeedRandomNumberGenerator) HOOK_DECL(time_t, __cdecl, time, time_t *Time) diff --git a/BunnymodXT/patterns.hpp b/BunnymodXT/patterns.hpp index 5630d7b4..8baea41b 100644 --- a/BunnymodXT/patterns.hpp +++ b/BunnymodXT/patterns.hpp @@ -5,6 +5,25 @@ namespace Patterns { // Engine patterns. + const MemUtils::ptnvec ptnsLoadAndDecryptHwDLL = + { + { + "HL-NGHL", + { + 0x8B, 0x0D, '?', '?', '?', '?', 0x53, 0x56, 0x33, 0xDB, 0x8B, 0x01, 0x57, 0x53, 0x68, '?', '?', '?', '?', 0xFF, 0x74, 0x24, 0x18, 0xFF, 0x50, 0x28, 0x8B, 0x0D, '?', '?', '?', '?', 0x8B, 0xF0, 0x6A, 0x02, 0x53, 0x8B, 0x01, 0x56, 0xFF, 0x50, 0x30, 0x8B, 0x0D + }, + "xx????xxxxxxxxx????xxxxxxxxx????xxxxxxxxxxxxx" + }, + + { + "HL-WON", + { + 0x8B, 0x44, 0x24, 0x04, 0x53, 0x56, 0x57, 0x68, '?', '?', '?', '?', 0x50, 0xE8, '?', '?', '?', '?', 0x8B, 0xF0, 0x6A, 0x02, 0x6A, 0x00, 0x56, 0xE8, '?', '?', '?', '?', 0x56, 0xE8, '?', '?', '?', '?', 0x56, 0x8B, 0xF8, 0xE8 + }, + "xxxxxxxx????xx????xxxxxxxx????xx????xxxx" + } + }; + const MemUtils::ptnvec ptnsCbuf_Execute = { { diff --git a/SPTLib b/SPTLib index 5f0a9608..785a6ebe 160000 --- a/SPTLib +++ b/SPTLib @@ -1 +1 @@ -Subproject commit 5f0a9608bd97675a59e1f2ed9a9aa035d1711dd0 +Subproject commit 785a6ebecbe8fb567f809230761f594d785f77e3