home *** CD-ROM | disk | FTP | other *** search
/ Guide To Cracking 2002 / Guide_to_Cracking_2002.iso / Programming / yPP-B-SRC.ZIP / loader_src / ProcPatch_Patcher.cpp < prev    next >
Encoding:
C/C++ Source or Header  |  2000-08-31  |  8.5 KB  |  343 lines
  1. // YPP - C++ Loader source
  2. //
  3.  
  4. #define    WIN32_LEAN_AND_MEAN
  5.  
  6. #include "stdafx.h"
  7.  
  8. // variables
  9. DWORD  dwPatchDataPos  =      0; // say hello to our datapointer
  10. char * DataSectionName = "yoda";
  11.  
  12. DWORD *                pDW;
  13. WORD *                 pW;
  14. char *                 pCHR;
  15. char                   cTest;
  16. char *                 sztargetfile;
  17. DWORD                  NumberOfAttacks;
  18. DWORD                  NoAcounter;
  19. char                   buff[255];
  20. char *                 szCmdl;
  21. HANDLE                 hfile,hFileMap;
  22. DWORD                  dwFileSize;
  23. LPVOID                 pMap;
  24. int                    what;
  25. BOOL                   ReplaceAll,Changes;
  26.  
  27. STARTUPINFO            SI;
  28. PROCESS_INFORMATION    PI;
  29. PIMAGE_DOS_HEADER      dosh;
  30. PIMAGE_NT_HEADERS      peh;
  31. PIMAGE_SECTION_HEADER  sectionh;
  32. DWORD                  dwBytesWritten;
  33. DWORD                   dwBytesRead;
  34. DWORD                  dwPatchVA;
  35. LPVOID                 pPatchData;
  36. LPVOID                 pOrgData;
  37. LPVOID                 pRead;
  38. BYTE                   bPatchLength;
  39. BOOL                   Resumed = FALSE;
  40. BOOL                   gotit;
  41. DWORD                  dwOldProt;
  42. DWORD                  i = 0;
  43.  
  44.  
  45. // shows the error messages
  46. void showerr(char* text)
  47. {
  48.     MessageBox(0,text,":(",MB_ICONERROR | MB_TOPMOST);
  49.     return;
  50. }
  51.  
  52. void KillProcess()
  53. {
  54.         TerminateProcess(PI.hProcess,0);
  55.         CloseHandle(PI.hProcess);
  56.         CloseHandle(PI.hThread);
  57. }
  58.  
  59. BOOL MemCmp (char* buff1,char* buff2,int len)
  60. {
  61.     int i;
  62.     for (i=0;(buff1[i]==buff2[i]) && (i<len);i++);
  63.     if (i==len)
  64.         return TRUE;
  65.     else
  66.         return FALSE;
  67. }
  68.  
  69. DWORD Offset2VA (DWORD Offset)
  70. {
  71.     if (Offset < peh->OptionalHeader.SizeOfHeaders)
  72.       return Offset+peh->OptionalHeader.ImageBase;
  73.     // in which section is Offset ?
  74.     sectionh = PIMAGE_SECTION_HEADER((DWORD)peh+0xf8);
  75.     while (Offset >= sectionh->PointerToRawData)
  76.     {
  77.         ++sectionh;
  78.         if (sectionh->Characteristics == 0)
  79.             break;
  80.     }
  81.     --sectionh;
  82.     return Offset+peh->OptionalHeader.ImageBase+(sectionh->VirtualAddress-sectionh->PointerToRawData);
  83. }
  84.  
  85. // Main
  86. int APIENTRY WinMain(HINSTANCE hInstance,
  87.                      HINSTANCE hPrevInstance,
  88.                      LPSTR     lpCmdLine,
  89.                      int       nCmdShow )
  90. {
  91.     // int1 ??? ;)
  92.     // process the commandline
  93.     szCmdl = GetCommandLine();
  94.     ++szCmdl;
  95.     for(i=0;(szCmdl[i] != 0x22);szCmdl++);
  96.     ++szCmdl;
  97.  
  98.     // search the data section
  99.     dosh = PIMAGE_DOS_HEADER(GetModuleHandle(0));
  100.     peh = PIMAGE_NT_HEADERS((DWORD)dosh+dosh->e_lfanew);
  101.     sectionh = PIMAGE_SECTION_HEADER((DWORD)peh+0xf8);
  102.     while (i < peh->FileHeader.NumberOfSections)
  103.     {
  104.         if ((sectionh->Name[0] == DataSectionName[0]) && (sectionh->Name[1] == DataSectionName[1]) \
  105.           && (sectionh->Name[2] == DataSectionName[2]) && (sectionh->Name[3] == DataSectionName[3]))
  106.         {
  107.             dwPatchDataPos = sectionh->VirtualAddress+peh->OptionalHeader.ImageBase;
  108.         }
  109.         ++sectionh;
  110.         ++i;
  111.     }
  112.     if (dwPatchDataPos == 0)
  113.     {
  114.         showerr("Couldn't find my data section !");
  115.         return 0;
  116.     }
  117.  
  118.     // get the attack number
  119.     pDW = (DWORD*)dwPatchDataPos;
  120.     NumberOfAttacks = *pDW;
  121.     dwPatchDataPos += 4;
  122.  
  123.     // get the filename
  124.     sztargetfile = (char*)dwPatchDataPos;
  125.     // test whether the file is in the current directory (better than CreateProcess)
  126.     hfile = CreateFile(sztargetfile,GENERIC_READ,FILE_SHARE_READ,NULL,OPEN_EXISTING,0,0);
  127.     if (hfile == INVALID_HANDLE_VALUE)
  128.     {
  129.         showerr(strcat(sztargetfile," wasn't found in the current directory !"));
  130.         return 0;
  131.     }
  132.     CloseHandle(hfile);
  133.  
  134.     // get the end of the filename
  135.     pCHR = (char*)dwPatchDataPos;
  136.     do
  137.     {
  138.     cTest= *pCHR;
  139.     ++pCHR;
  140.     ++dwPatchDataPos;
  141.     }
  142.     while (cTest != 0);
  143.  
  144.     // create the process
  145.     ZeroMemory(&SI,sizeof(STARTUPINFO));
  146.     ZeroMemory(&PI,sizeof(PROCESS_INFORMATION));
  147.     SI.cb = sizeof(STARTUPINFO);
  148.     if (0==CreateProcess(sztargetfile,szCmdl,NULL,NULL,FALSE,NORMAL_PRIORITY_CLASS | CREATE_SUSPENDED,NULL,NULL,&SI,&PI))
  149.     {
  150.         showerr("Error while creating Process !");
  151.         return 0;
  152.     }
  153.  
  154.     // MAIN LOOP
  155.     do
  156.     {
  157.     pDW = (DWORD*)dwPatchDataPos;
  158.     dwPatchVA = *pDW; // get target VA or COMMAND
  159.     dwPatchDataPos += 4;
  160.  
  161.     switch(dwPatchVA)
  162.     {
  163.     case 0x00000000:
  164.         break;
  165.     case 0x00000001: // it's a wait command
  166.         pW = (WORD*)dwPatchDataPos;
  167.         Sleep(*pW); // sleep a bit
  168.         dwPatchDataPos += 2;
  169.         break;
  170.     case 0x00000002: // resume the process
  171.         ResumeThread(PI.hThread);    
  172.         Resumed = TRUE;
  173.         break;
  174.     case 0x00000003: // Search and Replace
  175.         // get infos
  176.         pCHR = (char *)dwPatchDataPos;
  177.            if (*pCHR == 0)
  178.             ReplaceAll = FALSE;
  179.             else
  180.             ReplaceAll = TRUE;    
  181.         ++pCHR;
  182.         ++dwPatchDataPos;
  183.         bPatchLength = *pCHR;
  184.     
  185.         dwPatchDataPos += (2*bPatchLength+1);
  186.         ++pCHR;
  187.         pOrgData = pCHR;
  188.         pCHR += bPatchLength;
  189.         pPatchData = pCHR;        
  190.         // map the target file (readonly)
  191.         hfile = CreateFile ( sztargetfile, GENERIC_READ,FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL, 0);
  192.         if (!hfile)
  193.         {
  194.             KillProcess();
  195.             showerr("Error while mapping the target file (S&R) !");
  196.             return 0;
  197.         }
  198.         dwFileSize = GetFileSize(hfile,NULL);
  199.         hFileMap = CreateFileMapping (hfile, NULL, PAGE_READONLY, 0, 0,NULL);
  200.         if (!hFileMap)
  201.         {
  202.             KillProcess();
  203.             showerr("Error while mapping the target file (S&R) !");
  204.             CloseHandle (hfile);
  205.             return 0;
  206.         }
  207.         pMap = MapViewOfFile ( hFileMap, FILE_MAP_READ, 0, 0, 0);
  208.         if (!pMap)
  209.         {
  210.             KillProcess();
  211.             showerr("Error while mapping the target file (S&R) !");
  212.             CloseHandle (hFileMap);
  213.             CloseHandle (hfile);
  214.             return 0;
  215.         }
  216.         CloseHandle(hFileMap);
  217.         CloseHandle(hfile);
  218.         // get the ImageBase
  219.         dosh = PIMAGE_DOS_HEADER(pMap);
  220.         if (dosh->e_magic != IMAGE_DOS_SIGNATURE)
  221.         {
  222.             KillProcess();
  223.             showerr("Error - invalid PE file (S&R) !");
  224.             UnmapViewOfFile(pMap);
  225.             return 0;
  226.         }
  227.         peh = PIMAGE_NT_HEADERS((DWORD)dosh+dosh->e_lfanew);
  228.         if (peh->Signature != IMAGE_NT_SIGNATURE)
  229.         {
  230.             KillProcess();
  231.             showerr("Error - invalid PE file (S&R) !");
  232.             UnmapViewOfFile(pMap);
  233.             return 0;
  234.         }
  235.         pCHR = (char*)pOrgData;
  236.         // fill buff with the Search Bytes
  237.         i=0;
  238.         while (i<bPatchLength)
  239.         {
  240.             buff[i]=pCHR[i];
  241.             ++i;
  242.         }
  243.         what = 0;
  244.         i = 0;
  245.         Changes = FALSE;
  246.         pCHR = (char*)pMap;
  247.         // start the search routine
  248.         searchagain:
  249.         do 
  250.         {
  251.             if (*pCHR == buff[what])
  252.                 ++what;
  253.             else
  254.                 what=0;
  255.             ++i;
  256.             ++pCHR;
  257.         } while ((what != bPatchLength) && (i < dwFileSize));
  258.         if (i >= dwFileSize)
  259.             goto searchdone;
  260.         Changes = TRUE;
  261.         VirtualProtectEx(PI.hProcess,(LPVOID)Offset2VA(i-bPatchLength),bPatchLength,PAGE_READWRITE,&dwOldProt);
  262.         if (!WriteProcessMemory(PI.hProcess,(LPVOID)Offset2VA(i-bPatchLength),pPatchData,bPatchLength,&dwBytesWritten))
  263.         {
  264.             KillProcess();
  265.             showerr("Error while writing into the Process Memory !");
  266.             UnmapViewOfFile(pMap);
  267.             return 0;
  268.         }
  269.         if ((i<dwFileSize) && (ReplaceAll))
  270.         {
  271.             what=0;
  272.             goto searchagain;
  273.         }
  274.         searchdone:
  275.         UnmapViewOfFile(pMap);
  276.         if (!Changes)
  277.         {
  278.             KillProcess();
  279.             showerr("Wrong version (S&R) !");
  280.             return 0;
  281.         }
  282.         break;
  283.     default: // hey !! something to fix
  284.     // get patch infos 
  285.     pCHR = (char *)dwPatchDataPos;
  286.     bPatchLength = *pCHR; // got patch length
  287.     dwPatchDataPos += (2*bPatchLength+1);
  288.     ++pCHR;
  289.     pOrgData = pCHR;
  290.     pCHR += bPatchLength;
  291.     pPatchData = pCHR;
  292.     NoAcounter = NumberOfAttacks;
  293.  
  294.     // version check !
  295.     gotit = FALSE;
  296.     do
  297.     {
  298.       if (!ReadProcessMemory(PI.hProcess,LPVOID(dwPatchVA),&buff,bPatchLength,&dwBytesRead))
  299.       {
  300.             KillProcess();
  301.             showerr("Error while reading the Process Memory !");
  302.             return 0;
  303.       }
  304.       pRead = &buff;
  305.     
  306.         if (!MemCmp((char*)pOrgData,(char*)pRead,bPatchLength))
  307.         {
  308.             --NoAcounter;
  309.             if (NoAcounter == 0) // versionerror
  310.             {
  311.                 KillProcess();
  312.                 showerr("Wrong version !");
  313.                 return 0;
  314.             }
  315.         }
  316.         else gotit = TRUE; // the check bytes are there
  317.  
  318.     } while (!gotit);
  319.  
  320.     // fix access protection (code stolen from the rpp patcher source)
  321.     VirtualProtectEx(PI.hProcess,(LPVOID)dwPatchVA,bPatchLength,PAGE_READWRITE,&dwOldProt);
  322.     // patch it !
  323.     if (!WriteProcessMemory(PI.hProcess,(LPVOID)dwPatchVA,pPatchData,bPatchLength,&dwBytesWritten))
  324.     {
  325.         KillProcess();
  326.         showerr("Error while writing into the Process Memory !");
  327.         return 0;
  328.     }
  329.     } // end of the case struct
  330.     } while (dwPatchVA != 0); // end of the main loop
  331.      
  332.     // THE END.
  333.     if (!Resumed)
  334.     {
  335.         ResumeThread(PI.hThread);
  336.     }
  337.     // clean up
  338.     CloseHandle(PI.hProcess);
  339.     CloseHandle(PI.hThread);
  340.     return 0;
  341. }
  342. // sorry for this bad source code :] I am new in C/C++
  343.