Ejemplo n.º 1
0
        private static void PatchSleepLoop(ProcessC war3, Module md, int zmroffset1)
        {
            int  tmp     = 0;
            uint oldprot = 0;

            war3.VirtualProtectEx(md.BaseAddress + zmroffset1, 12, ProcessC.Protection.PAGE_EXECUTE_READWRITE, ref oldprot);
            DllPinvoke kernel32 = new DllPinvoke("kernel32.dll");
            int        Saddr    = kernel32.GetProcAddress("Sleep");

            //int ExitThreadAddr = kernel32.GetProcAddress("ExitThread");
            byte[] AddrBt = BitConverter.GetBytes(Saddr - (md.BaseAddress + zmroffset1 + 0x5 + 0x5));//0xaf657a);
            //0xd96580
            war3.WriteBytes(md.BaseAddress + zmroffset1,
                            new byte[] { 0x68, 0x00, 0x00, 0x01, 0x00,
                                         0xe8, AddrBt[0], AddrBt[1], AddrBt[2], AddrBt[3],
                                         0xeb, 0xf4 },
                            12, out tmp);
        }
Ejemplo n.º 2
0
        private static bool DisjoyZMR(ProcessC war3, Module md)
        {
            //Process warp = Process.GetProcessesByName("war3")[0];
            //ProcessC war3p = new ProcessC(warp);
            Module[] Moudles = //war3p.Modules;
                               war3.Modules;

            FileVersionInfo fvi        = FileVersionInfo.GetVersionInfo(md.FullName);
            string          zmrversion = fvi.FileVersion.ToString().Replace(", ", ".");
            string          filename   = Path.GetFileName(md.FullName).ToLower();
            int             zmroffset1 = 0;
            int             outb;

            byte[] hash = FileHash.GetFileHash(md.FullName);

            if (filename == "vlanproxy.dll")
            {
                switch (zmrversion)
                {
                case "1.0.0.1":

                    //zmroffset1 = 0x16570;
                    if (Extension.ArrayEquals(hash, new byte[] { 0x48, 0x06, 0x3B, 0x94, 0xD2, 0x27, 0x79, 0x95, 0x24, 0x82, 0x44, 0x82, 0x6E, 0x46, 0x30, 0x22 }))
                    {
                        PatchSleepExit(war3, md, 0xD6B0);
                        //war3.WriteBytes(md.BaseAddress + 0xD6B0, new byte[] { 0xe9, 0x08, 0xe7, 0x02, 0x00 });
                    }
                    else
                    {
                        return(false);
                    }
                    break;

                default:
                    return(false);
                }
            }
            else if (filename == "tvlanproxy.dll")
            {
                switch (zmrversion)
                {
                case "1.0.0.1":
                    if (Extension.ArrayEquals(hash, new byte[] { 0xE9, 0x4E, 0x72, 0x26, 0xCF, 0x52, 0xFE, 0x6E, 0x4B, 0x56, 0xD4, 0xC2, 0xD0, 0x1B, 0x02, 0xDF }))
                    {
                        PatchSleepExit(war3, md, 0x35CDD);
                        war3.WriteBytes(md.BaseAddress + 0x75D0, new byte[] { 0xe9, 0x08, 0xe7, 0x02, 0x00 });
                    }
                    if (Extension.ArrayEquals(hash, new byte[] { 0xF5, 0x96, 0x35, 0x87, 0x9F, 0x77, 0xCD, 0x27, 0xA0, 0x4D, 0x4A, 0xFF, 0x54, 0xF6, 0xF7, 0xF7 }))
                    {
                        PatchSleepExit(war3, md, 0x365db);    // 165BA57B
                        war3.WriteBytes(md.BaseAddress + 0x7a50, new byte[] { 0xe9, 0x86, 0xeb, 0x02, 0x00 });
                    }

                    else if (Extension.ArrayEquals(hash, new byte[] { 0x62, 0x99, 0xBC, 0x91, 0xF3, 0xB3, 0x3D, 0x92, 0x46, 0xEC, 0xFE, 0xE5, 0xDF, 0xB5, 0xF0, 0xFC }))     // 110331
                    {
                        PatchSleepExit(war3, md, 0x39037);
                        war3.WriteBytes(md.BaseAddress + 0x82e0, new byte[] { 0xE9, 0x52, 0x0D, 0x03, 0x00 });
                    }
                    else if (Extension.ArrayEquals(hash, new byte[] { 0x1B, 0xAC, 0x9C, 0xDC, 0x2C, 0x15, 0xF5, 0xA6, 0xDF, 0x76, 0x7C, 0x7C, 0xA1, 0x34, 0xAC, 0xC8 })) // 110422
                    {
                        PatchSleepExit(war3, md, 0x54971);
                        war3.WriteBytes(md.BaseAddress + 0x7DB0, new byte[] { 0xE9, 0xBC, 0xCB, 0x04, 0x00 });
                    }
                    else
                    {
                        return(false);
                    }

                    //zmroffset1 = 0x90168;

                    break;

                default:
                {
                    return(false);
                }
                }
            }

            if (zmroffset1 != 0)
            {
                PatchSleepLoop(war3, md, zmroffset1);
            }

            return(true);
        }// end of private void DisjoyZMR()