开通博客赚积分
发布资源赚积分
分类

源码开发语言/平台
当前位置：首页 > 源码/资料 > 游戏 > 外挂编程 > 查看源码
ROAInject.cpp
资源名称：ROA3.40.rar　[点击查看]
上传用户：tianheyiqi
上传日期：2010-04-16
资源大小：282k
文件大小：18k
源码类别：

外挂编程

开发平台：

Visual C++

ROAInject.cpp：源码内容
  1. #define _WIN32_WINNT 0x0400
  2. #define NT
  4. #define DBG_TRACE   0
  6. #include <stdafx.h>
  7. #include <windows.h>
  8. #include <stdio.h>
  9. #include <winsock2.h>
  10. #include <malloc.h>
  11. #include "detours.h"
  13. #define PULONG_PTR PVOID
  14. #define PLONG_PTR PVOID
  15. #define ULONG_PTR PVOID
  16. #define LONG_PTR PVOID
  17. #define ENUMRESNAMEPROCA  PVOID
  18. #define ENUMRESNAMEPROCW  PVOID
  19. #define ENUMRESLANGPROCA  PVOID
  20. #define ENUMRESLANGPROCW  PVOID
  21. #define ENUMRESTYPEPROCA  PVOID
  22. #define ENUMRESTYPEPROCW  PVOID
  23. #define STGOPTIONS          PVOID
  25. static TCHAR wzExeName[MAX_PATH];
  26. static char infobuf[32];
  28. static HWND g_hWnd;
  29. static UINT g_wMsg;
  31. //////////////////////////////////////////////////////////////////////
  32. #pragma warning(disable:4127)   // Many of our asserts are constants.
  34. #ifndef _DEFINED_ASMBREAK_
  35. #define _DEFINED_ASMBREAK_
  36. #define ASMBREAK() __asm { int 3 }
  37. //#define ASMBREAK() DebugBreak()
  38. #endif // _DEFINED_ASMBREAK_
  40. #define ASSERT_ALWAYS(x)   
  41.     do {                                                        
  42. if (!(x)) {                                                 
  43.             AssertMessage(#x, __FILE__, __LINE__);              
  44. ASMBREAK();                                         
  45. }                                                           
  46.     } while (0)
  48. #ifndef NDEBUG
  49. #define ASSERT(x)           ASSERT_ALWAYS(x)
  50. #endif
  52. #define UNUSED(c)     (c) = (c)
  53. #define ARRAYOF(x)     (sizeof(x)/sizeof(x[0]))
  55. //////////////////////////////////////////////////////////////////////
  56. static HMODULE s_hInst = NULL;
  57. static WCHAR s_wzDllPath[MAX_PATH];
  59. VOID _PrintDump(SOCKET socket, PCHAR pszData, INT cbData);
  60. VOID _PrintEnter(PCSTR psz, ...);
  61. VOID _PrintExit(PCSTR psz, ...);
  62. VOID _Print(PCSTR psz, ...);
  63. VOID AssertMessage(CONST PCHAR pszMsg, CONST PCHAR pszFile, ULONG nLine);
  65. #define MakePtr( cast, ptr, addValue ) (cast)( (DWORD)(ptr)+(DWORD)(addValue))
  67. #define FALSECLIENT_TIMEOUT 12000
  68. #define FALSECLIENT_SEND_TIMEOUT 5000
  69. #define MAX_BUFFER_LENGTH 16384
  71. ////
  72. //FUNCTION PROTOTYPES AND TYPEDEF
  73. ////
  74. BOOL IsConnected(SOCKET s);
  75. void falseClientCom();
  77. ULONG falseClientComId;
  78. SOCKET falseClient;
  79. SOCKET currentServer;
  81. HINSTANCE g_hInst=0;
  82. WSADATA WSAData;
  83. char* falseClient_send;
  84. char* falseClient_recvInject;
  85. int falseClient_sendLength;
  86. int falseClient_recvInjectLength;
  87. CRITICAL_SECTION falseClient_sendSection;
  88. CRITICAL_SECTION falseClient_recvInjectSection;
  89. CRITICAL_SECTION address_section;
  90.  
  92. //////////////////////////////////////////////////////////////////////////////
  93. //
  94. #pragma warning(disable:4100)   // Trampolines don't use formal parameters.
  96. extern "C" {
  98.     DETOUR_TRAMPOLINE(int WINAPI
  99.                       Real_WSAAsyncSelect(SOCKET s,
  100.                                        HWND hWnd,
  101.                                        unsigned int wMsg,
  102.    long lEvent),
  103.  WSAAsyncSelect);
  104.     DETOUR_TRAMPOLINE(VOID WINAPI
  105.                       Real_InitializeCriticalSection(LPCRITICAL_SECTION lpSection),
  106.                       InitializeCriticalSection);
  107.     DETOUR_TRAMPOLINE(VOID WINAPI
  108.                       Real_EnterCriticalSection(LPCRITICAL_SECTION lpSection),
  109.                       EnterCriticalSection);
  110.     DETOUR_TRAMPOLINE(VOID WINAPI
  111.                       Real_LeaveCriticalSection(LPCRITICAL_SECTION lpSection),
  112.                       LeaveCriticalSection);
  113. }
  115. DETOUR_TRAMPOLINE(DWORD WINAPI Real_GetModuleFileNameW(HMODULE a0,
  116.                                                           LPWSTR a1,
  117.                                                           DWORD a2),
  118.                   GetModuleFileNameW);
  120. DETOUR_TRAMPOLINE(BOOL WINAPI Real_CreateProcessW(LPCWSTR a0,
  121.                                                      LPWSTR a1,
  122.                                                      LPSECURITY_ATTRIBUTES a2,
  123.                                                      LPSECURITY_ATTRIBUTES a3,
  124.                                                      BOOL a4,
  125.                                                      DWORD a5,
  126.                                                      LPVOID a6,
  127.                                                      LPCWSTR a7,
  128.                                                      struct _STARTUPINFOW* a8,
  129.                                                      LPPROCESS_INFORMATION a9),
  130.                   CreateProcessW);
  132. DETOUR_TRAMPOLINE(int WINAPI Real_connect(SOCKET a0,
  133.                                              sockaddr* a1,
  134.                                              int a2),
  135.                   connect);
  137. DETOUR_TRAMPOLINE(int WINAPI Real_recv(SOCKET a0,
  138.                                           char* a1,
  139.                                           int a2,
  140.                                           int a3),
  141.                   recv);
  143. DETOUR_TRAMPOLINE(int WINAPI Real_send(SOCKET a0,
  144.                                           char* a1,
  145.                                           int a2,
  146.                                           int a3),
  147.                   send);
  149. /////////////////////////////////////////////////////////////
  150. // Detours
  151. //
  152. BOOL WINAPI Mine_CreateProcessW(LPCWSTR lpApplicationName,
  153.                                 LPWSTR lpCommandLine,
  154.                                 LPSECURITY_ATTRIBUTES lpProcessAttributes,
  155.                                 LPSECURITY_ATTRIBUTES lpThreadAttributes,
  156.                                 BOOL bInheritHandles,
  157.                                 DWORD dwCreationFlags,
  158.                                 LPVOID lpEnvironment,
  159.                                 LPCWSTR lpCurrentDirectory,
  160.                                 LPSTARTUPINFOW lpStartupInfo,
  161.                                 LPPROCESS_INFORMATION lpProcessInformation)
  162. {
  163.     _PrintEnter("CreateProcessW(%ls,%ls,%lx,%lx,%lx,%lx,%lx,%ls,%lx,%lx)n",
  164.                 lpApplicationName,
  165.                 lpCommandLine,
  166.                 lpProcessAttributes,
  167.                 lpThreadAttributes,
  168.                 bInheritHandles,
  169.                 dwCreationFlags,
  170.                 lpEnvironment,
  171.                 lpCurrentDirectory,
  172.                 lpStartupInfo,
  173.                 lpProcessInformation);
  175.     _Print("Calling DetourCreateProcessWithDllW(,%ls)n", s_wzDllPath);
  176.     
  177.     BOOL rv = 0;
  178.     __try {
  179.         rv = DetourCreateProcessWithDllW(lpApplicationName,
  180.                                    lpCommandLine,
  181.                                    lpProcessAttributes,
  182.                                    lpThreadAttributes,
  183.                                    bInheritHandles,
  184.                                    dwCreationFlags,
  185.                                    lpEnvironment,
  186.                                    lpCurrentDirectory,
  187.                                    lpStartupInfo,
  188.                                    lpProcessInformation,
  189.                                    s_wzDllPath,
  190.                                    Real_CreateProcessW);
  191.     } __finally {
  192.         _PrintExit("CreateProcessW(,,,,,,,,,) -> %lxn", rv);
  193.     };
  194.     return rv;
  195. }
  197. int WINAPI Mine_WSAAsyncSelect(
  198.   SOCKET s,           
  199.   HWND hWnd,          
  200.   unsigned int wMsg,  
  201.   long lEvent         
  202. )
  203. {
  204. currentServer = s;
  205. Real_WSAAsyncSelect(s,hWnd,wMsg, lEvent);
  206. g_hWnd = hWnd;
  207. g_wMsg = wMsg;
  208. return 0;
  209. }
  211. int WINAPI Mine_connect(SOCKET a0,
  212.                            sockaddr* name,
  213.                            int namelen)
  214. {
  215. currentServer = a0;
  216. Real_connect(a0, name, namelen);
  218. EnterCriticalSection(&address_section);
  219. memcpy(infobuf, name->sa_data, 6);
  220. LeaveCriticalSection(&address_section);
  222.     return 0;
  223. }
  225. int WINAPI Mine_recv(SOCKET s,
  226.                         char* buf,
  227.                         int len,
  228.                         int flags)
  229. {
  230. int ret = 0;
  231. int ret2 = 0;
  232. currentServer = s;
  233. if (falseClient_recvInjectLength) {
  234. EnterCriticalSection(&falseClient_recvInjectSection);
  235. memcpy(buf,falseClient_recvInject,falseClient_recvInjectLength);
  236. ret = falseClient_recvInjectLength;
  237. falseClient_recvInjectLength = 0;
  238. LeaveCriticalSection(&falseClient_recvInjectSection);
  239. }
  240. ret2 = Real_recv(s, buf+ret, len, flags);
  241. if (ret2 != SOCKET_ERROR && ret2>0 && falseClient_sendLength + ret2 + 1 < MAX_BUFFER_LENGTH) {
  242. char* newbuf = (char*)malloc(ret2+3);
  243. unsigned short sLen = (unsigned short)ret2;
  244. memcpy(newbuf,"R",1);
  245. memcpy(newbuf+1, &sLen,2);
  246. memcpy(newbuf+3, buf+ret,ret2);
  247. EnterCriticalSection(&falseClient_sendSection);
  248. memcpy(falseClient_send+falseClient_sendLength,newbuf,ret2+3);
  249. falseClient_sendLength += ret2+3;
  250. LeaveCriticalSection(&falseClient_sendSection);
  251. free(newbuf);
  252. }
  253. if (ret2 != SOCKET_ERROR) {
  254. ret += ret2;
  255. }
  256. if (!ret) {
  257. ret = SOCKET_ERROR;
  258. WSASetLastError(WSAEWOULDBLOCK);
  259. }
  260. return ret;
  261. }
  263. int WINAPI Mine_send(SOCKET s,
  264.                         char* buf,
  265.                         int len,
  266.                         int flags)
  267. {
  268. int ret;
  269. currentServer = s;
  271. ret = Real_send(s, buf, 0, flags);
  273. if (ret != SOCKET_ERROR && len > 0 && falseClient_sendLength + len + 3 < MAX_BUFFER_LENGTH) {
  274. char* newbuf = (char*)malloc(len+3);
  275. unsigned short sLen = (unsigned short)len;
  276. memcpy(newbuf,"S",1);
  277. memcpy(newbuf+1,&sLen,2);
  278. memcpy(newbuf+3, buf,len);
  279. EnterCriticalSection(&falseClient_sendSection);
  280. memcpy(falseClient_send+falseClient_sendLength,newbuf,len+3);
  281. falseClient_sendLength += len+3;
  282. LeaveCriticalSection(&falseClient_sendSection);
  283. free(newbuf);
  284. } else {
  285. return ret;
  286. }
  287. return len;
  288. }
  289. /////////////////////////////////////////////////////////////
  290. // TrampolineWith
  291. //
  293. VOID SetDetour(PBYTE pbTrampoline, PBYTE pbDetour)
  294. {
  295. PBYTE pbRealTrampoline = NULL;
  296. PBYTE pbRealTarget = NULL;
  298. if (!DetourFunctionWithTrampolineEx(pbTrampoline, pbDetour,
  299. &pbRealTrampoline, &pbRealTarget)) {
  300. // ASSERT(!"DetourFailed!");
  301. }
  302. }
  304. VOID TrampolineWith(VOID)
  305. {
  306.     DetourFunctionWithTrampoline((PBYTE)Real_CreateProcessW,
  307.                                  (PBYTE)Mine_CreateProcessW);
  308.     DetourFunctionWithTrampoline((PBYTE)Real_WSAAsyncSelect,
  309.                                  (PBYTE)Mine_WSAAsyncSelect);
  310.     DetourFunctionWithTrampoline((PBYTE)Real_connect,
  311.                                  (PBYTE)Mine_connect);
  312.     DetourFunctionWithTrampoline((PBYTE)Real_recv,
  313.                                  (PBYTE)Mine_recv);
  314.     DetourFunctionWithTrampoline((PBYTE)Real_send,
  315.                                  (PBYTE)Mine_send);
  316. }
  317. //
  318. //////////////////////////////////////////////////////////////////////////////
  320. ////////////////////////////////////////////////////////////// Logging System.
  321. //
  322. static BOOL s_bLog = 1;
  323. static LONG s_nTlsIndent = -1;
  324. static LONG s_nTlsThread = -1;
  325. static LONG s_nThreadCnt = 0;
  327. VOID _PrintEnter(const CHAR *psz, ...)
  328. {
  329. return;
  330. }
  332. VOID _PrintExit(const CHAR *psz, ...)
  333. {
  334. return;
  335. }
  337. VOID _Print(const CHAR *psz, ...)
  338. {
  339. return;
  340. }
  342. VOID _PrintDump(SOCKET socket, PCHAR pszData, INT cbData)
  343. {
  344. return;
  345. }
  346. VOID AssertMessage(CONST PCHAR pszMsg, CONST PCHAR pszFile, ULONG nLine)
  347. {
  348. //    Syelog(SYELOG_SEVERITY_FATAL,
  349. //           "ASSERT(%s) failed in %s, line %d.n", pszMsg, pszFile, nLine);
  350. }
  352. VOID NullExport()
  353. {
  354. }
  356. //////////////////////////////////////////////////////////////////////////////
  357. //
  358. // DLL module information
  359. //
  360. BOOL ThreadAttach(HMODULE hDll)
  361. {
  362. if (s_nTlsIndent >= 0) {
  363. TlsSetValue(s_nTlsIndent, (PVOID)0);
  364. }
  365. if (s_nTlsThread >= 0) {
  366. LONG nThread = InterlockedIncrement(&s_nThreadCnt);
  367. TlsSetValue(s_nTlsThread, (PVOID)nThread);
  368. }
  369. return TRUE;
  370. }
  372. BOOL ThreadDetach(HMODULE hDll)
  373. {
  374. if (s_nTlsIndent >= 0) {
  375. TlsSetValue(s_nTlsIndent, (PVOID)0);
  376. }
  377. if (s_nTlsThread >= 0) {
  378. TlsSetValue(s_nTlsThread, (PVOID)0);
  379. }
  380. return TRUE;
  381. }
  383. BOOL ProcessAttach(HMODULE hDll)
  384. {
  385. s_bLog = FALSE;
  386. s_nTlsIndent = TlsAlloc();
  387. s_nTlsThread = TlsAlloc();
  390.     s_hInst = hDll;
  391.     memset(wzExeName, 0, sizeof(wzExeName));
  392. Real_GetModuleFileNameW(hDll, s_wzDllPath, ARRAYOF(s_wzDllPath));
  393. // Real_GetModuleFileNameW(NULL, wzExeName, ARRAYOF(wzExeName));
  395. HKEY hKey = 0;
  396. LONG lRet;
  397. lRet = RegOpenKey(HKEY_LOCAL_MACHINE, "SOFTWARE\Gravity Soft", &hKey);
  398. if(lRet == ERROR_SUCCESS && hKey != 0)
  399. {
  400. LONG lSize = 1024;
  401. lRet = RegQueryValue(hKey, "LaunchTarget", wzExeName, &lSize);
  402. RegCloseKey(hKey);
  403. }
  405.  /*   SyelogOpen("tracetcp", SYELOG_FACILITY_APPLICATION);
  406.     Syelog(SYELOG_SEVERITY_INFORMATION,
  407.            "##################################################################n");
  408.     Syelog(SYELOG_SEVERITY_INFORMATION,
  409.            "### %lsn", wzExeName);
  410. */ TrampolineWith();
  412. ThreadAttach(hDll);
  414. s_bLog = TRUE;
  415. return TRUE;
  416. }
  418. BOOL ProcessDetach(HMODULE hDll)
  419. {
  420. ThreadDetach(hDll);
  422. s_bLog = FALSE;
  423. //    SyelogClose();
  425. if (s_nTlsIndent >= 0) {
  426. TlsFree(s_nTlsIndent);
  427. }
  428. if (s_nTlsThread >= 0) {
  429. TlsFree(s_nTlsThread);
  430. }
  431. return TRUE;
  432. }
  434. BOOL APIENTRY DllMain(HINSTANCE hModule, DWORD dwReason, PVOID lpReserved)
  435. {
  436. switch (dwReason) {
  437.   case DLL_PROCESS_ATTACH:
  438. // return ProcessAttach(hModule);
  439. g_hInst = hModule;
  440. falseClient_send = (char*)malloc(MAX_BUFFER_LENGTH);
  441. falseClient_sendLength = 0;
  442. falseClient_recvInject = (char*)malloc(MAX_BUFFER_LENGTH);
  443. falseClient_recvInjectLength = 0;
  444. currentServer = 0;
  445. WSAStartup(MAKEWORD(2,2),&WSAData);
  446. InitializeCriticalSection(&falseClient_sendSection);
  447. InitializeCriticalSection(&falseClient_recvInjectSection);
  448. InitializeCriticalSection(&address_section);
  449. CreateThread(0, 0, (LPTHREAD_START_ROUTINE)falseClientCom, 0, 0, &falseClientComId);
  450. return ProcessAttach(hModule);
  451.   case DLL_PROCESS_DETACH:
  452. free(falseClient_send);
  453. free(falseClient_recvInject);
  454. return ProcessDetach(hModule);
  455.   case DLL_THREAD_ATTACH:
  456. return ThreadAttach(hModule);
  457.   case DLL_THREAD_DETACH:
  458. return ThreadDetach(hModule);
  459. }
  460. return TRUE;
  461. }
  462. //
  464. ////
  465. //FUNCTIONS
  466. ////
  468. BOOL IsConnected(SOCKET s) {
  469. fd_set udtWrite_fd;
  470. timeval tv;
  471. tv.tv_sec = 0;
  472. tv.tv_usec = 1;
  473. long lngSocketCount = 0;
  474.     udtWrite_fd.fd_count = 1;
  475.     udtWrite_fd.fd_array[0] = s;
  476.     lngSocketCount = select(0, 0, &udtWrite_fd, 0, &tv);
  477.     return (BOOL)(lngSocketCount);
  478. }
  481. void falseClientCom() {
  482. char * falseClient_recv = (char*)malloc(MAX_BUFFER_LENGTH);
  483. unsigned short falseClient_recvLength;
  484. int index;
  485. int ret;
  486. int type;
  487. DWORD falseClient_timeout = 0;
  488. DWORD falseClient_send_timeout = 0;
  489. sockaddr_in addr;
  490. DWORD arg = 1;
  491. addr.sin_family = AF_INET;
  492. addr.sin_port = htons(2350);
  493. addr.sin_addr.s_addr = inet_addr("127.0.0.1");
  494. falseClient = socket(AF_INET, SOCK_STREAM, 0);
  496. char* keepAlivePacket = (char*)malloc(3);
  497. unsigned short keepAlivePacketLength = 0;
  498. memcpy(keepAlivePacket,"K",1);
  499. memcpy(keepAlivePacket+1,&keepAlivePacketLength,2);
  501. char* ipPackcet = (char*) malloc(32);
  502. unsigned short ipPacketLength = 32;
  503. memcpy(ipPackcet,"I",1);
  504. memcpy(ipPackcet+1, &ipPacketLength, 2);
  506. while (1) {
  507. while (!falseClient || !IsConnected(falseClient) || (GetTickCount() - falseClient_timeout >= FALSECLIENT_TIMEOUT)) {
  508. closesocket(falseClient);
  509. falseClient = socket(AF_INET, SOCK_STREAM, 0);
  510. connect(falseClient, (struct sockaddr *) &addr, sizeof(sockaddr_in));
  511. ioctlsocket(falseClient,FIONBIO,&arg);
  512. falseClient_timeout = GetTickCount();
  513. falseClient_send_timeout = GetTickCount();
  514. falseClient_sendLength = 0;
  515. }
  516. ret = Real_recv(falseClient,falseClient_recv,MAX_BUFFER_LENGTH,0);
  517. if (ret != SOCKET_ERROR && ret >= 3) {
  518. index = 0;
  519. while (index < ret) {
  520. falseClient_recvLength = *(unsigned short *)(falseClient_recv+index+1);
  521. if (ret-index < falseClient_recvLength) {
  522. MessageBox(0,"False client sent a bad message!", "False client error",0);
  523. break;
  524. }
  525. if (*(falseClient_recv+index) == 'S') {
  526. type = 0;
  527. } else if (*(falseClient_recv+index) == 'R') {
  528. type = 1;
  529. } else if (*(falseClient_recv+index) == 'K') {
  530. //Keep alive
  531. type = 2;
  532. } else {
  533. type = -1;
  534. }
  536. if (!type && currentServer && IsConnected(currentServer)) {
  537. if(strlen(wzExeName) > 0)
  538. {
  539. EnterCriticalSection(&falseClient_sendSection);
  540. int cnt = 0;
  541. int cntMax = (int)strlen(wzExeName);
  542. for(int i=0; i<falseClient_recvLength; i++)
  543. {
  544. *(falseClient_recv+index+3+i) = (*(falseClient_recv+index+3+i)) - wzExeName[cnt];
  545. if(++cnt >= cntMax)
  546. cnt = 0;
  547. }
  548. LeaveCriticalSection(&falseClient_sendSection);
  549. }
  550. Real_send(currentServer,falseClient_recv+index+3,falseClient_recvLength,0);
  551. } else if (type == 1) {
  552. EnterCriticalSection(&falseClient_recvInjectSection);
  553. memcpy(falseClient_recvInject+falseClient_recvInjectLength,falseClient_recv+index+3,falseClient_recvLength);
  554. falseClient_recvInjectLength += falseClient_recvLength;
  555. LeaveCriticalSection(&falseClient_recvInjectSection);
  556. if(falseClient_recvInjectLength > 0 && ::IsWindow(g_hWnd))
  557. {
  558. PostMessage(g_hWnd, g_wMsg, currentServer, FD_READ);
  559. }
  560. }
  561. index += falseClient_recvLength + 3;
  562. }
  563. falseClient_timeout = GetTickCount();
  564. }
  565. if (falseClient_sendLength) {
  566. EnterCriticalSection(&falseClient_sendSection);
  567. Real_send(falseClient,falseClient_send,falseClient_sendLength,0);
  568. falseClient_sendLength = 0;
  569. LeaveCriticalSection(&falseClient_sendSection);
  570. }
  571. if (GetTickCount() - falseClient_send_timeout >= FALSECLIENT_SEND_TIMEOUT) {
  572. EnterCriticalSection(&falseClient_sendSection);
  573. Real_send(falseClient,keepAlivePacket,3,0);
  574. LeaveCriticalSection(&falseClient_sendSection);
  575. falseClient_send_timeout = GetTickCount();
  576. }
  577. EnterCriticalSection(&address_section);
  578. if(infobuf[0] != 0)
  579. {
  580. memcpy(ipPackcet+3, infobuf, 6);
  581. Real_send(falseClient, ipPackcet, 32+3, 0);
  582. infobuf[0] = 0;
  583. }
  584. LeaveCriticalSection(&address_section);
  585. Sleep(50);
  586. }
  588. if(ipPackcet != 0)
  589. free(ipPackcet);
  590. if(keepAlivePacket != 0)
  591. free(keepAlivePacket);
  592. if(falseClient_recv != 0)
  593. free(falseClient_recv);
  594. }
  595. ///////////////////////////////////////////////////////////////// End of File.