Skip to content

Commit 5a09875

Browse files
Burnt-oBurnt-o
committed
* Rewrote injector in CSharp, it also now can access exported functions of the DLL to call shutdown on old injection & initialize the new one with data (in this case, path to the injector directory). This should also fix false positive issues with Windows Defender.
* Added very basic serialization of the custom json path. Config data stored in injector directory. Default json path is now the injector directory. * Rewrote the dump function to now use structs instead of mlp_groupUpdateAddress. Now gets more data, including info on all the variants in a custom game and all the maps in each variant. * Renamed many classes to follow the same naming convention
1 parent 8262a12 commit 5a09875

28 files changed

+1240
-408
lines changed

‎CSInjector/CSInjector - Backup.csproj‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,12 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net6.0</TargetFramework>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
<Nullable>enable</Nullable>
8+
<BaseOutputPath>$(SolutionDir)$(Platform)\$(Configuration)\</BaseOutputPath>
9+
<PlatformTarget>x64</PlatformTarget>
10+
</PropertyGroup>
11+
12+
</Project>

‎CSInjector/CSInjector.csproj‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
<Project Sdk="Microsoft.NET.Sdk">
2+
3+
<PropertyGroup>
4+
<OutputType>Exe</OutputType>
5+
<TargetFramework>net6.0</TargetFramework>
6+
<ImplicitUsings>enable</ImplicitUsings>
7+
<Nullable>enable</Nullable>
8+
<BaseOutputPath>$(SolutionDir)x64\</BaseOutputPath>
9+
<PlatformTarget>x64</PlatformTarget>
10+
<AllowUnsafeBlocks>True</AllowUnsafeBlocks>
11+
</PropertyGroup>
12+
13+
</Project>

‎CSInjector/InitializationParameter.cs‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
using System;
2+
using System.Collections.Generic;
3+
using System.Linq;
4+
using System.Runtime.InteropServices;
5+
using System.Text;
6+
using System.Threading.Tasks;
7+
8+
namespace CSInjector
9+
{
10+
// Important - the injected DLL must have a definition of this same struct that has the exact same order and size of struct members
11+
// Any types that are stored as pointers will not work either, so strings are out
12+
13+
14+
[StructLayout(LayoutKind.Sequential)]
15+
public unsafe struct InitializationParameter
16+
{
17+
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = PInvoke.MAX_PATH)]
18+
public string InjectorPath;
19+
}
20+
}
21+
22+

‎CSInjector/PInvoke.cs‎

Lines changed: 333 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,333 @@
1+
using System.Runtime.InteropServices;
2+
3+
namespace CSInjector
4+
{
5+
public static class PInvoke
6+
{
7+
[DllImport("kernel32", CharSet = CharSet.Ansi, ExactSpelling = true, SetLastError = true)]
8+
public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
9+
10+
[DllImport("kernel32.dll")]
11+
public static extern IntPtr OpenProcess(ProcessAccessFlags dwDesiredAccess, bool bInheritHandle, int dwProcessId);
12+
13+
[DllImport("kernel32.dll", SetLastError = true)]
14+
public static extern bool CloseHandle(IntPtr hThread);
15+
16+
[DllImport("kernel32.dll", CharSet = CharSet.Auto)]
17+
public static extern IntPtr GetModuleHandle(string lpModuleName);
18+
19+
[DllImport("kernel32.dll")]
20+
public static extern IntPtr CreateRemoteThread(IntPtr hProcess,
21+
IntPtr lpThreadAttributes, uint dwStackSize, IntPtr lpStartAddress, IntPtr lpParameter, uint dwCreationFlags, IntPtr lpThreadId);
22+
23+
[DllImport("kernel32.dll")]
24+
public static extern uint GetLastError();
25+
26+
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
27+
public static extern IntPtr VirtualAllocEx(IntPtr hProcess, IntPtr lpAddress,
28+
int dwSize, uint flAllocationType, uint flProtect);
29+
30+
[DllImport("kernel32.dll", SetLastError = true, ExactSpelling = true)]
31+
public static extern bool VirtualFreeEx(IntPtr hProcess, IntPtr lpAddress,
32+
int dwSize, AllocationType dwFreeType);
33+
34+
[DllImport("kernel32.dll", SetLastError = true)]
35+
public static extern bool WriteProcessMemory(IntPtr hProcess, IntPtr lpBaseAddress, byte[] lpBuffer, int dwSize, out int lpNumberOfBytesWritten);
36+
37+
[DllImport("kernel32.dll", SetLastError = true)]
38+
public static extern bool ReadProcessMemory(
39+
IntPtr hProcess,
40+
IntPtr lpBaseAddress,
41+
[Out] byte[] lpBuffer,
42+
int dwSize,
43+
out IntPtr lpNumberOfBytesRead);
44+
45+
[DllImport("kernel32.dll", SetLastError = true)]
46+
public static extern bool VirtualProtectEx(IntPtr hProcess, IntPtr lpAddress,
47+
int dwSize, uint flNewProtect, out uint lpflOldProtect);
48+
49+
[DllImport("kernel32.dll", SetLastError = true)]
50+
public static extern UInt32 WaitForSingleObject(IntPtr hHandle, UInt32 dwMilliseconds);
51+
52+
[DllImport("kernel32.dll", SetLastError = true)]
53+
public static extern bool GetExitCodeThread(IntPtr hThread, out uint lpExitCode);
54+
55+
[Flags]
56+
public enum ProcessAccessFlags : uint
57+
{
58+
All = 0x001F0FFF,
59+
Terminate = 0x00000001,
60+
CreateThread = 0x00000002,
61+
VirtualMemoryOperation = 0x00000008,
62+
VirtualMemoryRead = 0x00000010,
63+
VirtualMemoryWrite = 0x00000020,
64+
DuplicateHandle = 0x00000040,
65+
CreateProcess = 0x000000080,
66+
SetQuota = 0x00000100,
67+
SetInformation = 0x00000200,
68+
QueryInformation = 0x00000400,
69+
QueryLimitedInformation = 0x00001000,
70+
Synchronize = 0x00100000
71+
}
72+
73+
74+
// used for memory allocation
75+
public struct ALLOC_FLAGS
76+
{
77+
public const uint MEM_COMMIT = 0x00001000;
78+
public const uint MEM_RESERVE = 0x00002000;
79+
public const uint PAGE_READWRITE = 4;
80+
public const uint PAGE_EXECUTE_READWRITE = 0x40;
81+
}
82+
83+
[Flags]
84+
public enum AllocationType
85+
{
86+
Commit = 0x1000,
87+
Reserve = 0x2000,
88+
Decommit = 0x4000,
89+
Release = 0x8000,
90+
Reset = 0x80000,
91+
Physical = 0x400000,
92+
TopDown = 0x100000,
93+
WriteWatch = 0x200000,
94+
LargePages = 0x20000000
95+
}
96+
97+
98+
public const int PAGE_READWRITE = 0x40;
99+
100+
public const int MAX_PATH = 260; // Max string length of a file path
101+
102+
103+
104+
[StructLayout(LayoutKind.Sequential)]
105+
public struct IMAGE_DOS_HEADER
106+
{
107+
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 2)]
108+
public char[] e_magic; // Magic number
109+
public UInt16 e_cblp; // Bytes on last page of file
110+
public UInt16 e_cp; // Pages in file
111+
public UInt16 e_crlc; // Relocations
112+
public UInt16 e_cparhdr; // Size of header in paragraphs
113+
public UInt16 e_minalloc; // Minimum extra paragraphs needed
114+
public UInt16 e_maxalloc; // Maximum extra paragraphs needed
115+
public UInt16 e_ss; // Initial (relative) SS value
116+
public UInt16 e_sp; // Initial SP value
117+
public UInt16 e_csum; // Checksum
118+
public UInt16 e_ip; // Initial IP value
119+
public UInt16 e_cs; // Initial (relative) CS value
120+
public UInt16 e_lfarlc; // File address of relocation table
121+
public UInt16 e_ovno; // Overlay number
122+
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 4)]
123+
public UInt16[] e_res1; // Reserved words
124+
public UInt16 e_oemid; // OEM identifier (for e_oeminfo)
125+
public UInt16 e_oeminfo; // OEM information; e_oemid specific
126+
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 10)]
127+
public UInt16[] e_res2; // Reserved words
128+
public Int32 e_lfanew; // File address of new exe header
129+
130+
private string _e_magic
131+
{
132+
get { return new string(e_magic); }
133+
}
134+
135+
public bool isValid
136+
{
137+
get { return _e_magic == "MZ"; }
138+
}
139+
}
140+
141+
[StructLayout(LayoutKind.Sequential)]
142+
public struct IMAGE_FILE_HEADER
143+
{
144+
public ushort Machine;
145+
public ushort NumberOfSections;
146+
public uint TimeDateStamp;
147+
public uint PointerToSymbolTable;
148+
public uint NumberOfSymbols;
149+
public ushort SizeOfOptionalHeader;
150+
public ushort Characteristics;
151+
}
152+
153+
[StructLayout(LayoutKind.Sequential)]
154+
public struct IMAGE_DATA_DIRECTORY
155+
{
156+
public uint VirtualAddress;
157+
public uint Size;
158+
}
159+
160+
[StructLayout(LayoutKind.Explicit)]
161+
public struct IMAGE_OPTIONAL_HEADER64
162+
{
163+
[FieldOffset(0)]
164+
public ushort Magic;
165+
166+
[FieldOffset(2)]
167+
public byte MajorLinkerVersion;
168+
169+
[FieldOffset(3)]
170+
public byte MinorLinkerVersion;
171+
172+
[FieldOffset(4)]
173+
public uint SizeOfCode;
174+
175+
[FieldOffset(8)]
176+
public uint SizeOfInitializedData;
177+
178+
[FieldOffset(12)]
179+
public uint SizeOfUninitializedData;
180+
181+
[FieldOffset(16)]
182+
public uint AddressOfEntryPoint;
183+
184+
[FieldOffset(20)]
185+
public uint BaseOfCode;
186+
187+
[FieldOffset(24)]
188+
public ulong ImageBase;
189+
190+
[FieldOffset(32)]
191+
public uint SectionAlignment;
192+
193+
[FieldOffset(36)]
194+
public uint FileAlignment;
195+
196+
[FieldOffset(40)]
197+
public ushort MajorOperatingSystemVersion;
198+
199+
[FieldOffset(42)]
200+
public ushort MinorOperatingSystemVersion;
201+
202+
[FieldOffset(44)]
203+
public ushort MajorImageVersion;
204+
205+
[FieldOffset(46)]
206+
public ushort MinorImageVersion;
207+
208+
[FieldOffset(48)]
209+
public ushort MajorSubsystemVersion;
210+
211+
[FieldOffset(50)]
212+
public ushort MinorSubsystemVersion;
213+
214+
[FieldOffset(52)]
215+
public uint Win32VersionValue;
216+
217+
[FieldOffset(56)]
218+
public uint SizeOfImage;
219+
220+
[FieldOffset(60)]
221+
public uint SizeOfHeaders;
222+
223+
[FieldOffset(64)]
224+
public uint CheckSum;
225+
226+
[FieldOffset(68)]
227+
public ushort Subsystem;
228+
229+
[FieldOffset(70)]
230+
public ushort DllCharacteristics;
231+
232+
[FieldOffset(72)]
233+
public ulong SizeOfStackReserve;
234+
235+
[FieldOffset(80)]
236+
public ulong SizeOfStackCommit;
237+
238+
[FieldOffset(88)]
239+
public ulong SizeOfHeapReserve;
240+
241+
[FieldOffset(96)]
242+
public ulong SizeOfHeapCommit;
243+
244+
[FieldOffset(104)]
245+
public uint LoaderFlags;
246+
247+
[FieldOffset(108)]
248+
public uint NumberOfRvaAndSizes;
249+
250+
[FieldOffset(112)]
251+
public IMAGE_DATA_DIRECTORY ExportTable;
252+
253+
[FieldOffset(120)]
254+
public IMAGE_DATA_DIRECTORY ImportTable;
255+
256+
[FieldOffset(128)]
257+
public IMAGE_DATA_DIRECTORY ResourceTable;
258+
259+
[FieldOffset(136)]
260+
public IMAGE_DATA_DIRECTORY ExceptionTable;
261+
262+
[FieldOffset(144)]
263+
public IMAGE_DATA_DIRECTORY CertificateTable;
264+
265+
[FieldOffset(152)]
266+
public IMAGE_DATA_DIRECTORY BaseRelocationTable;
267+
268+
[FieldOffset(160)]
269+
public IMAGE_DATA_DIRECTORY Debug;
270+
271+
[FieldOffset(168)]
272+
public IMAGE_DATA_DIRECTORY Architecture;
273+
274+
[FieldOffset(176)]
275+
public IMAGE_DATA_DIRECTORY GlobalPtr;
276+
277+
[FieldOffset(184)]
278+
public IMAGE_DATA_DIRECTORY TLSTable;
279+
280+
[FieldOffset(192)]
281+
public IMAGE_DATA_DIRECTORY LoadConfigTable;
282+
283+
[FieldOffset(200)]
284+
public IMAGE_DATA_DIRECTORY BoundImport;
285+
286+
[FieldOffset(208)]
287+
public IMAGE_DATA_DIRECTORY IAT;
288+
289+
[FieldOffset(216)]
290+
public IMAGE_DATA_DIRECTORY DelayImportDescriptor;
291+
292+
[FieldOffset(224)]
293+
public IMAGE_DATA_DIRECTORY CLRRuntimeHeader;
294+
295+
[FieldOffset(232)]
296+
public IMAGE_DATA_DIRECTORY Reserved;
297+
}
298+
299+
[StructLayout(LayoutKind.Explicit)]
300+
public struct IMAGE_NT_HEADERS64
301+
{
302+
[FieldOffset(0)]
303+
public uint Signature;
304+
305+
[FieldOffset(4)]
306+
public IMAGE_FILE_HEADER FileHeader;
307+
308+
[FieldOffset(24)]
309+
public IMAGE_OPTIONAL_HEADER64 OptionalHeader;
310+
311+
312+
}
313+
314+
[StructLayout(LayoutKind.Sequential)]
315+
public struct IMAGE_EXPORT_DIRECTORY
316+
{
317+
public uint Characteristics;
318+
public uint TimeDateStamp;
319+
public ushort MajorVersion;
320+
public ushort MinorVersion;
321+
public uint Name;
322+
public uint Base;
323+
public uint NumberOfFunctions;
324+
public uint NumberOfNames;
325+
public uint AddressOfFunctions; // RVA from base of image
326+
public uint AddressOfNames; // RVA from base of image
327+
public uint AddressOfNameOrdinals; // RVA from base of image
328+
}
329+
330+
public const uint IMAGE_NT_SIGNATURE = 0x00004550;
331+
332+
}
333+
}

0 commit comments

Comments
 (0)