Saitamag

SUBMITTED BY: Saitamag

DATE: June 15, 2020, 11:32 p.m.

FORMAT: Text only

SIZE: 3.2 kB

Raw Download

HITS: 412

Report
  1. /*
  2. EasyAntiCheat exploit for Paladins
  3. By Omdihar
  4. */
  6. #include <Windows.h>
  7. #include <string>
  8. #include <process.h>
  11. bool DataCompare(const unsigned char* OpCodes, const unsigned char* Mask, const char* StrMask);
  12. unsigned long FindPattern(unsigned long StartAddress, unsigned long CodeLen, unsigned char* Mask, char* StrMask, unsigned short ignore);
  15. using loadgamewitheac_type = int(__thiscall*)(DWORD*, LPCWSTR, int, char, DWORD*, LPHANDLE);
  16. loadgamewitheac_type loadgamewitheac_orig = nullptr;
  18. using closehandle_type = BOOL(WINAPI*)(HANDLE);
  19. closehandle_type closehandle_orig = nullptr;
  21. HANDLE PaladinsThreadHandle = nullptr;
  22. HANDLE PaladinsHandle = nullptr;
  24. //Hook Functions
  25. BOOL WINAPI closehandle_hook(HANDLE handle)
  26. {
  27. static int count = 0;
  29. if (count == 1)
  30. PaladinsHandle = handle;
  32. ++count;
  33. return true;
  34. }
  36. int __fastcall loadgamewitheac_hook(DWORD *_this, void *edx, LPCWSTR application_name, int a3, char a4, DWORD *process_id_out, LPHANDLE target_handle)
  37. {
  38. //Hook CloseHandle first and remove it after EAC loading
  39. closehandle_orig = (closehandle_type)DetourFunction((PBYTE)CloseHandle, (PBYTE)closehandle_hook);
  40. auto ret = loadgamewitheac_orig(_this, application_name, a3, a4, process_id_out, target_handle);
  41. DetourRemove((PBYTE)closehandle_orig, (PBYTE)closehandle_hook);
  43. //PaladinsHandle access rights == PROCESS_ALL_ACCESS. INJECT CODE HERE
  44. /*DetourContinueProcessWithDllW(PaladinsHandle, L"your_dll_to_inject.dll");*/
  46. return ret;
  47. }
  50. //Threads Function
  51. void __cdecl main_thread(void*)
  52. {
  53. HMODULE eac_module = nullptr;
  55. while (eac_module == nullptr)
  56. {
  57. eac_module = GetModuleHandleW(L"EasyAntiCheat_x86.dll");
  58. Sleep(10);
  59. }
  61. //B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 81 EC 9C 02 00 00
  62. auto loadeac_addr = FindPattern((DWORD)eac_module, 0xFFFFF, (BYTE*)"\xB8\x00\x00\x00\x00\xE8\x00\x00\x00\x00\x81\xEC\x9C\x02\x00", "x????x????xxxxxx", 0);
  64. if (loadeac_addr == 0)
  65. {
  66. MessageBoxW(nullptr, L"EasyAntiCheat signature broken", L"Bypass Error", MB_TOPMOST);
  67. ExitProcess(-1);
  68. }
  70. loadgamewitheac_orig = (loadgamewitheac_type)DetourFunction((PBYTE)loadeac_addr, (PBYTE)loadgamewitheac_hook);
  72. if (loadgamewitheac_orig == nullptr)
  73. {
  74. MessageBoxW(nullptr, L"EasyAntiCheat signature broken (2)", L"Exploit Error", MB_TOPMOST);
  75. ExitProcess(-1);
  76. }
  77. }
  79. BOOL WINAPI DllMain(_In_ void* _DllHandle, _In_ unsigned long _Reason, _In_opt_ void* _Reserved)
  80. {
  81. if (_Reason == DLL_PROCESS_ATTACH)
  82. {
  83. DisableThreadLibraryCalls((HMODULE)_DllHandle);
  84. _beginthread(main_thread, 0, nullptr);
  85. }
  87. return true;
  88. }
  90. bool DataCompare(const BYTE* OpCodes, const BYTE* Mask, const char* StrMask)
  91. {
  92. while (*StrMask)
  93. {
  94. if (*StrMask == 'x' && *OpCodes != *Mask)
  95. return false;
  97. ++StrMask;
  98. ++OpCodes;
  99. ++Mask;
  100. }
  102. return true;
  103. }
  105. DWORD FindPattern(DWORD StartAddress, DWORD CodeLen, BYTE* Mask, char* StrMask, unsigned short ignore)
  106. {
  107. unsigned short Ign = 0;
  108. DWORD i = 0;
  110. while (Ign <= ignore)
  111. {
  112. if (DataCompare((BYTE*)(StartAddress + i++), Mask, StrMask))
  113. ++Ign;
  115. else if (i >= CodeLen)
  116. return 0;
  117. }
  118. return StartAddress + i - 1;
  119. }
comments powered by Disqus