/*
EasyAntiCheat exploit for Paladins
By Omdihar
*/
 
#include <Windows.h>
#include <string>
#include <process.h>
 
 
bool DataCompare(const unsigned char* OpCodes, const unsigned char* Mask, const char* StrMask);
unsigned long FindPattern(unsigned long StartAddress, unsigned long CodeLen, unsigned char* Mask, char* StrMask, unsigned short ignore);
 
 
using loadgamewitheac_type = int(__thiscall*)(DWORD*, LPCWSTR, int, char, DWORD*, LPHANDLE);
loadgamewitheac_type loadgamewitheac_orig = nullptr;
 
using closehandle_type = BOOL(WINAPI*)(HANDLE);
closehandle_type closehandle_orig = nullptr;
 
HANDLE PaladinsThreadHandle = nullptr;
HANDLE PaladinsHandle = nullptr;
 
//Hook Functions
BOOL WINAPI closehandle_hook(HANDLE handle)
{
	static int count = 0;
	
	if (count == 1)
		PaladinsHandle = handle;
 
	++count;
	return true;
}
 
int __fastcall loadgamewitheac_hook(DWORD *_this, void *edx, LPCWSTR application_name, int a3, char a4, DWORD *process_id_out, LPHANDLE target_handle)
{
	//Hook CloseHandle first and remove it after EAC loading
	closehandle_orig = (closehandle_type)DetourFunction((PBYTE)CloseHandle, (PBYTE)closehandle_hook);
	auto ret = loadgamewitheac_orig(_this, application_name, a3, a4, process_id_out, target_handle);
	DetourRemove((PBYTE)closehandle_orig, (PBYTE)closehandle_hook);
	
    //PaladinsHandle access rights == PROCESS_ALL_ACCESS. INJECT CODE HERE
	/*DetourContinueProcessWithDllW(PaladinsHandle, L"your_dll_to_inject.dll");*/
 
	return ret;
}
 
 
//Threads Function
void __cdecl main_thread(void*)
{
	HMODULE eac_module = nullptr;
 
	while (eac_module == nullptr)
	{
		eac_module = GetModuleHandleW(L"EasyAntiCheat_x86.dll");
		Sleep(10);
	}
 
	//B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC 9C 02 00 00
	auto loadeac_addr = FindPattern((DWORD)eac_module, 0xFFFFF, (BYTE*)"\xB8\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x81\xEC\x9C\x02\x00", "x????x????xxxxxx", 0);
 
	if (loadeac_addr == 0)
	{
		MessageBoxW(nullptr, L"EasyAntiCheat signature broken", L"Bypass Error", MB_TOPMOST);
		ExitProcess(-1);
	}
 
	loadgamewitheac_orig = (loadgamewitheac_type)DetourFunction((PBYTE)loadeac_addr, (PBYTE)loadgamewitheac_hook);
 
	if (loadgamewitheac_orig == nullptr)
	{
		MessageBoxW(nullptr, L"EasyAntiCheat signature broken (2)", L"Exploit Error", MB_TOPMOST);
		ExitProcess(-1);
	}
}
 
BOOL WINAPI DllMain(_In_ void* _DllHandle, _In_ unsigned long _Reason, _In_opt_ void* _Reserved)
{
	if (_Reason == DLL_PROCESS_ATTACH)
	{
		DisableThreadLibraryCalls((HMODULE)_DllHandle);
		_beginthread(main_thread, 0, nullptr);
	}
 
	return true;
}
 
bool DataCompare(const BYTE* OpCodes, const BYTE* Mask, const char* StrMask)
{
	while (*StrMask)
	{
		if (*StrMask == 'x' && *OpCodes != *Mask)
			return false;
 
		++StrMask;
		++OpCodes;
		++Mask;
	}
 
	return true;
}
 
DWORD FindPattern(DWORD StartAddress, DWORD CodeLen, BYTE* Mask, char* StrMask, unsigned short ignore)
{
	unsigned short Ign = 0;
	DWORD i = 0;
 
	while (Ign <= ignore)
	{
		if (DataCompare((BYTE*)(StartAddress + i++), Mask, StrMask))
			++Ign;
 
		else if (i >= CodeLen)
			return 0;
	}
	return StartAddress + i - 1;
}