Exemplo n.º 1
0
        private bool AreInstructionTasksEqual(IEnumerable <DataPatcherUnitTask> instructionTasks)
        {
            using (var executableConnection = new ExecutableConnection(_executableFilePath))
            {
                foreach (var instructionTask in instructionTasks)
                {
                    var realPosition        = InstructionHelper.CalculateRealPositionFromVirtualPosition(instructionTask.VirtualPosition);
                    var currentInstructions = executableConnection.ReadByteArray(realPosition, instructionTask.Instructions.Length);

#if DEBUG
                    var virtualPosition = instructionTask.VirtualPosition;
                    Debug.WriteLine($"Evaluating task {instructionTask.TaskId:D2} at location {virtualPosition:X8} ({realPosition:X8})");

                    // If current instructions (file) do not equal task instructions (code)
                    var debugStringCollection = new StringCollection();
                    for (var i = 0; i < currentInstructions.Count(); i++)
                    {
                        if (currentInstructions[i].Equals(instructionTask.Instructions[i]))
                        {
                            continue;
                        }

                        var debugVirtualPosition = virtualPosition + i;
                        var debugRealPosition    = realPosition + i;

                        debugStringCollection.Add($"Mismatch at location {debugVirtualPosition:X8} ({debugRealPosition:X8}) at byte index {i:X8}. Value {currentInstructions[i]:X2} vs. {instructionTask.Instructions[i]:X2} (File vs. Code).");
                    }
                    if (debugStringCollection.Count > 0)
                    {
                        Debug.WriteLine("WARNING - Instructions in code are not equal to instructions in file.");
                        foreach (var line in debugStringCollection)
                        {
                            Debug.WriteLine(line);
                        }
                        return(false);
                    }
#else
                    // If current instructions (file) do not equal task instructions (code)
                    if (!currentInstructions.SequenceEqual(instructionTask.Instructions))
                    {
                        return(false);
                    }
#endif
                }

                return(true);
            }
        }
Exemplo n.º 2
0
        /// <summary>
        /// Applys the bypass on all detected references to jump functions.
        /// This method is only intended for use with gpw.exe v1.01b.
        /// Do not invoke this method more than once on the same file.
        /// </summary>
        public void Apply()
        {
            // Stats counters
            var textBypassStatsCounter     = 0;
            var text68BypassStatsCounter   = 0;
            var textE8BypassStatsCounter   = 0;
            var textC704BypassStatsCounter = 0;
            var textC705BypassStatsCounter = 0;
            var textC745BypassStatsCounter = 0;
            var textC784BypassStatsCounter = 0;
            var rdataBypassStatsCounter    = 0;
            var dataBypassStatsCounter     = 0;
            var totalBypassesStatsCounter  = 0;

            // Define range where jump functions are located
            const int jumpFunctionFirstReference = 0x00401000; // 0x00000400
            const int jumpFunctionLastReference  = 0x0040452A; // 0x0000392A
            const int jumpFunctionReferenceStep  = 0x00000005; // Bytes

            // Define range of .text section
            const int textSectionFirstByte = 0x00407A60;
            const int textSectionLastByte  = 0x00689FFF;

            // Define range of .rdata section
            const int rdataSectionFirstByte = 0x015ED000;
            const int rdataSectionLastByte  = 0x015EF7CF;

            // Define range of .data section
            const int dataSectionFirstByte = 0x015F0000;
            const int dataSectionLastByte  = 0x0160CBFF;

            // Create collection to hold details of each jump function
            var jumpFunctions = new Collection <JumpFunction>();

            // Populate collection with the positions of the jump functions
            for (var i = jumpFunctionFirstReference; i <= jumpFunctionLastReference; i += jumpFunctionReferenceStep)
            {
                jumpFunctions.Add(new JumpFunction()
                {
                    Position = i
                });
            }

            // Collection of changes to make after read
            var jumpBypasses = new Collection <JumpFunction>();

            // Open file and read
            using (var executableConnection = new ExecutableConnection(_executableFilePath))
            {
                // Populate collection with the referenced function inside each jump function
                foreach (var item in jumpFunctions)
                {
                    var instructions = new byte[4];

                    instructions = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(item.Position) + 1, instructions.Length);

                    item.Function = item.Position + 5 + BitConverter.ToInt32(instructions, 0);
                }

                // Analyse .text section for opcodes with references to jump functions
                for (var i = textSectionFirstByte; i <= textSectionLastByte - 4; i++)
                {
                    // Read two bytes
                    var opcodeCheck = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i), 2);

                    // Check for matching opcodes
                    if (opcodeCheck[0] == 0x68)
                    {
                        // Read last four bytes of five byte signature
                        var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i + 1), 4);
                        var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                        // Do bytes match a reference to a jump function in the collection
                        foreach (var item in jumpFunctions)
                        {
                            if (referenceCheckValue == item.Position)
                            {
                                // Add bypass to collection
                                jumpBypasses.Add(new JumpFunction()
                                {
                                    Position = i + 1, Function = item.Function
                                });
                                textBypassStatsCounter++;
                                text68BypassStatsCounter++;
                            }
                        }
                    }
                    else if (opcodeCheck[0] == 0xE8)
                    {
                        // Read last four bytes of five byte signature
                        var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i + 1), 4);
                        var referenceCheckValue = i + 5 + BitConverter.ToInt32(referenceCheckBytes, 0);

                        // Do bytes match a reference to a jump function in the collection
                        foreach (var item in jumpFunctions)
                        {
                            if (referenceCheckValue == item.Position)
                            {
                                // Calc relative function position for opcode xE8
                                var functionOffset = BitConverter.GetBytes(item.Function - (i + 5));

                                // Add bypass to collection
                                jumpBypasses.Add(new JumpFunction()
                                {
                                    Position = i + 1, Function = BitConverter.ToInt32(functionOffset, 0)
                                });
                                textBypassStatsCounter++;
                                textE8BypassStatsCounter++;
                            }
                        }
                    }
                    else if ((opcodeCheck[0] == 0xC7) && (opcodeCheck[1] == 0x04))
                    {
                        // Read last four bytes of eleven byte signature
                        var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i + 7), 4);
                        var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                        // Do bytes match a reference to a jump function in the collection
                        foreach (var item in jumpFunctions)
                        {
                            if (referenceCheckValue == item.Position)
                            {
                                // Add bypass to collection
                                jumpBypasses.Add(new JumpFunction()
                                {
                                    Position = i + 7, Function = item.Function
                                });
                                textBypassStatsCounter++;
                                textC704BypassStatsCounter++;
                            }
                        }
                    }
                    else if ((opcodeCheck[0] == 0xC7) && (opcodeCheck[1] == 0x05))
                    {
                        // Read last four bytes of ten byte signature
                        var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i + 6), 4);
                        var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                        // Do bytes match a reference to a jump function in the collection
                        foreach (var item in jumpFunctions)
                        {
                            if (referenceCheckValue == item.Position)
                            {
                                // Add bypass to collection
                                jumpBypasses.Add(new JumpFunction()
                                {
                                    Position = i + 6, Function = item.Function
                                });
                                textBypassStatsCounter++;
                                textC705BypassStatsCounter++;
                            }
                        }
                    }
                    else if ((opcodeCheck[0] == 0xC7) && (opcodeCheck[1] == 0x45))
                    {
                        // Read last four bytes of seven byte signature
                        var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i + 3), 4);
                        var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                        // Do bytes match a reference to a jump function in the collection
                        foreach (var item in jumpFunctions)
                        {
                            if (referenceCheckValue == item.Position)
                            {
                                // Add bypass to collection
                                jumpBypasses.Add(new JumpFunction()
                                {
                                    Position = i + 3, Function = item.Function
                                });
                                textBypassStatsCounter++;
                                textC745BypassStatsCounter++;
                            }
                        }
                    }
                    else if ((opcodeCheck[0] == 0xC7) && (opcodeCheck[1] == 0x84))
                    {
                        // Read last four bytes of eleven byte signature
                        var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i + 7), 4);
                        var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                        // Do bytes match a reference to a jump function in the collection
                        foreach (var item in jumpFunctions)
                        {
                            if (referenceCheckValue == item.Position)
                            {
                                // Add bypass to collection
                                jumpBypasses.Add(new JumpFunction()
                                {
                                    Position = i + 7, Function = item.Function
                                });
                                textBypassStatsCounter++;
                                textC784BypassStatsCounter++;
                            }
                        }
                    }
                }

                // Analyse .rdata section for references to jump functions
                for (var i = rdataSectionFirstByte; i <= rdataSectionLastByte - 3; i++)
                {
                    // Read four bytes
                    var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i), 4);
                    var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                    // Do bytes match a reference to a jump function in the collection
                    foreach (var item in jumpFunctions)
                    {
                        if (referenceCheckValue == item.Position)
                        {
                            // Add bypass to collection
                            jumpBypasses.Add(new JumpFunction()
                            {
                                Position = i, Function = item.Function
                            });
                            rdataBypassStatsCounter++;
                        }
                    }
                }

                // Analyse .data section for references to jump functions
                for (var i = dataSectionFirstByte; i <= dataSectionLastByte - 3; i++)
                {
                    // Read four bytes
                    var referenceCheckBytes = executableConnection.ReadByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(i), 4);
                    var referenceCheckValue = BitConverter.ToInt32(referenceCheckBytes, 0);

                    // Do bytes match a reference to a jump function in the collection
                    foreach (var item in jumpFunctions)
                    {
                        if (referenceCheckValue == item.Position)
                        {
                            // Add bypass to collection
                            jumpBypasses.Add(new JumpFunction()
                            {
                                Position = i, Function = item.Function
                            });
                            dataBypassStatsCounter++;
                        }
                    }
                }
            }

            // Open file and write
            using (var executableConnection = new ExecutableConnection(_executableFilePath))
            {
                // Apply bypasses
                foreach (var item in jumpBypasses)
                {
                    // Write four bytes
                    executableConnection.WriteByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(item.Position), BitConverter.GetBytes(item.Function));
                    totalBypassesStatsCounter++;
                }

                // Remove redundant jump functions
                var clearByteArray = new byte[0x352F];
                for (var i = 0; i < clearByteArray.Length; i++)
                {
                    clearByteArray[i] = 0xCC; // Fill array with int3 opcode
                }
                executableConnection.WriteByteArray(InstructionHelper.CalculateRealPositionFromVirtualPosition(jumpFunctionFirstReference), clearByteArray);
            }

            Debug.WriteLine(" .text section bypass count: " + textBypassStatsCounter);
            Debug.WriteLine("   .text opCode    68 count: " + text68BypassStatsCounter);
            Debug.WriteLine("   .text opCode    E8 count: " + textE8BypassStatsCounter);
            Debug.WriteLine("   .text opCode C7 04 count: " + textC704BypassStatsCounter);
            Debug.WriteLine("   .text opCode C7 05 count: " + textC705BypassStatsCounter);
            Debug.WriteLine("   .text opCode C7 45 count: " + textC745BypassStatsCounter);
            Debug.WriteLine("   .text opCode C7 84 count: " + textC784BypassStatsCounter);
            Debug.WriteLine(".rdata section bypass count: " + rdataBypassStatsCounter);
            Debug.WriteLine(" .data section bypass count: " + dataBypassStatsCounter);
            Debug.WriteLine("----------------------------");
            Debug.WriteLine("             Total bypasses: " + totalBypassesStatsCounter);
        }
Exemplo n.º 3
0
        /// <summary>
        /// Applys the new switch idiom to all predefined target addresses within.
        /// This method is only intended for use with gpw.exe v1.01b.
        /// Do not invoke this method more than once on the same file.
        /// </summary>
        public void Apply()
        {
            // New instruction template, 0x00 will be overwritten by jump/indirect table locations
            var newInstructions = new byte[] {
                0x33, 0xD2, 0x8A, 0x90, 0x00, 0x00, 0x00, 0x00, 0xFF,
                0x24, 0x95, 0x00, 0x00, 0x00, 0x00, 0x90, 0x90, 0x90
            };

            // File location of each switch idiom to modify
            var switchIdiomLocation = new long[] {
                0x00021A9C, 0x0002EFE2, 0x00034FC5, 0x000387AE, 0x0003AD71, 0x00044C99,
                0x0004EFD4, 0x0004FEDF, 0x0005F0EB, 0x00078996, 0x0008E2F7, 0x0008E850,
                0x0008EE9E, 0x00093B02, 0x0009507E, 0x0009ED62, 0x000A5F9E, 0x001130A4,
                0x001131B2, 0x00116871, 0x001170FA, 0x00117198, 0x001180EF, 0x0011C88A,
                0x00120DB0, 0x00120E1E, 0x0012DE99, 0x00130D87, 0x00138A8E, 0x00139B64,
                0x0013F6D1, 0x0013FE4B, 0x0013FF79, 0x001499BF, 0x00149A59, 0x0014A727,
                0x0014A7F6, 0x0014B09F, 0x0014B5EF, 0x0014BC5D, 0x0014BCEE, 0x00154C42,
                0x00154F47, 0x00155176, 0x0015533B, 0x001556C7, 0x0015BC0B, 0x0015DC59,
                0x0015DE57, 0x0015DF24, 0x0015DFA2, 0x0015E1C0, 0x001675AA, 0x0017344E,
                0x0018BF05, 0x0019012B, 0x001A1AEE, 0x001A1D23, 0x001A1DCC, 0x001A2F62,
                0x001AE631, 0x001B4CAE, 0x001B50EC, 0x001D4F47, 0x001DCC1B, 0x001DE2A5,
                0x001E30E6, 0x001F4FE5, 0x001F51EF, 0x001F74D8, 0x00203BFE, 0x0021862C,
                0x00218788, 0x00218977, 0x0021BFB7, 0x0021C26A, 0x0025FF17, 0x0026028F,
                0x0026082B, 0x002622D7, 0x002638F9, 0x002739E7, 0x00276F01, 0x00276FE8,
                0x00278CB2, 0x00278D53, 0x00278FDD, 0x002790F0
            };

            // For every switch idiom (represented by the target address)
            for (var i = 0; i < switchIdiomLocation.Length; i++)
            {
                var instructions = new byte[18];

                // Get current instructions at target address
                using (var executableConnection = new ExecutableConnection(_executableFilePath))
                {
                    instructions = executableConnection.ReadByteArray(switchIdiomLocation[i], instructions.Length);
                }

                // Extract table location values
                var indirectTableLocation = new byte[4];
                var jumpTableLocation     = new byte[4];

                // Indirect table location is represented in little endian byte order
                for (var j = 0; j < indirectTableLocation.Length; j++)
                {
                    // Read four bytes
                    indirectTableLocation[j] = instructions[j + 2];
                }

                // Jump table location is represented in little endian byte order
                for (var j = 0; j < jumpTableLocation.Length; j++)
                {
                    // Read four bytes
                    jumpTableLocation[j] = instructions[j + 14];
                }

                // Create copy of new instructions by overwriting current instructions
                Array.Copy(newInstructions, instructions, instructions.Length);

                // Modify with new instructions
                for (var j = 4; j < 8; j++)
                {
                    // Write four bytes
                    instructions[j] = indirectTableLocation[j - 4];
                }
                for (var j = 11; j < 15; j++)
                {
                    // Write four bytes
                    instructions[j] = jumpTableLocation[j - 11];
                }

                using (var executableConnection = new ExecutableConnection(_executableFilePath))
                {
                    // Write new instructions to target address
                    executableConnection.WriteByteArray(switchIdiomLocation[i], instructions);
                }
            }
        }