Пример #1
0
        static void Main(string[] args)
        {
            Console.Title = "Xenon Dumper";
            if (!Directory.Exists("Dumps"))
            {
                Directory.CreateDirectory("Dumps");
            }

            Process[] Instances = Process.GetProcessesByName("RobloxPlayerBeta");
            if (Instances.Length < 1)
            {
                Console.WriteLine("Please open roblox and restart the program.");
                Console.ReadLine();
                Environment.Exit(-1);
            }
            EyeStep.open("RobloxPlayerBeta.exe");

            string RobloxVersion = Path.GetDirectoryName(Instances[0].MainModule.FileName).Split('\\').Last();
            string DumpPath      = "Dumps\\" + RobloxVersion;

            if (!Directory.Exists(DumpPath))
            {
                Directory.CreateDirectory(DumpPath);
            }

            Dumper.DumpAddresses();
            File.WriteAllText(DumpPath + "\\BasicFormat.txt", Formatter.BasicFormat());
            File.WriteAllText(DumpPath + "\\HeaderFormat.txt", Formatter.HeaderFormat());
            File.WriteAllText(DumpPath + "\\IDAPython.txt", Formatter.IDAPythonFormat());
        }
Пример #2
0
        static void Main(string[] args)
        {
            // AOBs
            string gettop      = "55 8B EC 8B 4D 08 8B 41 ?? 2B 41 ?? C1 F8 04 5D";                                                                /*this will never change*/
            string index2adr   = "55 8B EC 8B 55 ?? 81 FA F0 D8 FF FF 7E 0F ?? ?? ?? ?? E2 04 03 51 10 8B C2 5D C2 08 00 8B 45 08";                /*may break at some point*/
            string retcheck    = "55 8B EC 64 A1 00 00 00 00 6A ?? 68 E8 ?? ?? ?? ?? 64 89 25 00 00 00 00 83 EC ?? 53 56 57 6A ?? E9 ?? ?? ?? ??"; /*may break at some point*/
            string deserialize = "55 8B EC 6A FF 68 70 ?? ?? ?? ?? A1 00 00 00 00 50 64 89 25 00 00 00 00 81 EC 58 01 00 00 56 57";                /*Again not 100% sure about this one's integrity*/

            Console.Title = "C# Address Dumper";
            if (Process.GetProcessesByName("RobloxPlayerBeta").Length < 1)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                ; Console.WriteLine("Please open Roblox first!");
                Thread.Sleep(3000);
                Environment.Exit(0);
            }
            EyeStep.open("RobloxPlayerBeta.exe");
            Console.WriteLine("Scanning RBX...");
            watch.Start();

            // Scan AOBs
            int gettop_addr      = scanner.scan(gettop)[0];
            int index2adr_addr   = scanner.scan(index2adr)[0];
            int retcheck_addr    = scanner.scan(retcheck)[0];
            int deserialize_addr = scanner.scan(deserialize)[0];

            // More scanning
            var retcheck_xrefs  = scanner.scan_xrefs(retcheck_addr);
            var index2adr_xrefs = scanner.scan_xrefs(index2adr_addr);

            // Log addresses
            LogFunc("deserializer", deserialize_addr);
            LogFunc("index2adr", index2adr_addr);

            LogFunc("lua_call", retcheck_xrefs[1]);
            LogFunc("lua_concat", retcheck_xrefs[3]);
            LogFunc("lua_createtable", retcheck_xrefs[4]);
            LogFunc("lua_gc", retcheck_xrefs[5]);
            LogFunc("lua_getargument", retcheck_xrefs[57]);
            LogFunc("lua_getfenv", retcheck_xrefs[6]);
            LogFunc("lua_getfield", retcheck_xrefs[7]);
            LogFunc("lua_getinfo", retcheck_xrefs[58]);
            LogFunc("lua_getmetatable", retcheck_xrefs[8]);
            LogFunc("lua_gettable", retcheck_xrefs[9]);
            LogFunc("lua_gettop", gettop_addr);
            LogFunc("lua_getupvalue", retcheck_xrefs[10]);
            LogFunc("lua_insert", retcheck_xrefs[11]);
            LogFunc("lua_iscfunction", index2adr_xrefs[8]);
            LogFunc("lua_isnumber", index2adr_xrefs[9]);
            LogFunc("lua_isstring", index2adr_xrefs[10]);
            LogFunc("lua_isuserdata", index2adr_xrefs[7]);
            LogFunc("lua_lessthan", retcheck_xrefs[12]);
            LogFunc("lua_newthread", retcheck_xrefs[13]);
            LogFunc("lua_newuserdata", retcheck_xrefs[14]);
            LogFunc("lua_next", retcheck_xrefs[15]);
            LogFunc("lua_objlen", retcheck_xrefs[16]);
            LogFunc("lua_pcall", retcheck_xrefs[17]);
            LogFunc("lua_pushboolean", retcheck_xrefs[18]);
            LogFunc("lua_pushcclosure", retcheck_xrefs[19]);
            LogFunc("lua_pushfstring", retcheck_xrefs[20]);
            LogFunc("lua_pushinteger", retcheck_xrefs[21]);
            LogFunc("lua_pushlightuserdata", retcheck_xrefs[22]);
            LogFunc("lua_pushlstring", retcheck_xrefs[23]);
            LogFunc("lua_pushnil", retcheck_xrefs[24]);
            LogFunc("lua_pushnumber", retcheck_xrefs[25]);
            LogFunc("lua_pushstring", retcheck_xrefs[26]);
            LogFunc("lua_pushthread", retcheck_xrefs[28]);
            LogFunc("lua_pushvalue", retcheck_xrefs[30]);
            LogFunc("lua_pushvfstring", retcheck_xrefs[31]);
            LogFunc("lua_checkstack", retcheck_xrefs[32]);
            LogFunc("lua_rawget", retcheck_xrefs[33]);
            LogFunc("lua_rawgeti", retcheck_xrefs[35]);
            LogFunc("lua_rawset", retcheck_xrefs[36]);
            LogFunc("lua_rawseti", retcheck_xrefs[37]);
            LogFunc("lua_rawvalue", index2adr_xrefs[0]);
            LogFunc("lua_remove", retcheck_xrefs[38]);
            LogFunc("lua_replace", retcheck_xrefs[39]);
            LogFunc("lua_resume", retcheck_xrefs[53]);
            LogFunc("lua_setfenv", retcheck_xrefs[40]);
            LogFunc("lua_setfield", retcheck_xrefs[41]);
            LogFunc("lua_setlocal", retcheck_xrefs[60]);
            LogFunc("lua_setmetatable", retcheck_xrefs[42]);
            LogFunc("lua_setreadonly", retcheck_xrefs[43]);
            LogFunc("lua_setsafeenv", retcheck_xrefs[44]);
            LogFunc("lua_settable", retcheck_xrefs[45]);
            LogFunc("lua_settop", retcheck_xrefs[46]);
            LogFunc("lua_setupvalue", retcheck_xrefs[47]);
            LogFunc("lua_toboolean", index2adr_xrefs[33]);
            LogFunc("lua_tointeger", index2adr_xrefs[34]);
            LogFunc("lua_tolstring", retcheck_xrefs[48]);
            LogFunc("lua_tonumber", index2adr_xrefs[37]);
            LogFunc("lua_topointer", index2adr_xrefs[38]);
            LogFunc("lua_tostring", index2adr_xrefs[40]);
            LogFunc("lua_tothread", index2adr_xrefs[42]);
            LogFunc("lua_tounsignedx", index2adr_xrefs[43]);
            LogFunc("lua_touserdata", index2adr_xrefs[44]);
            LogFunc("lua_type", index2adr_xrefs[47]);
            LogFunc("lua_yield", retcheck_xrefs[54]);
            LogFunc("lua_xmove", retcheck_xrefs[50]);

            LogFunc("luaU_callhook", retcheck_xrefs[56]);

            LogFunc("f_call", retcheck_xrefs[0]);
            LogFunc("resume_error", retcheck_xrefs[55]);

            watch.Stop();
            Console.WriteLine();
            Console.ForegroundColor = ConsoleColor.Green;
            Console.WriteLine("Scanned " + addycount + " addresses" + " in " + watch.ElapsedMilliseconds + "ms");
            Thread.Sleep(-1);
        }
Пример #3
0
        // start dumper
        static void Main(string[] args)
        {
            // AOBs
            string gettop       = "55 8B EC 8B 4D 08 8B 41 ?? 2B 41 ?? C1 F8 04 5D"; /*this will never change*/
            string delay        = "55 8B EC 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 F0 FF";
            string print        = "55 8B EC 6A FF 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 18 8D 45 10 50 FF";
            string checklstring = "55 8B EC FF 75 ?? 8B 55 ?? 8B 4D ?? E8 ?? ?? ?? ?? 85 C0 74 02 5D C3 6A ?? FF 75 ?? FF 75 ?? E8 6C 07 00 00";

            Console.Title = "C# Address Dumper";
            if (Process.GetProcessesByName("RobloxPlayerBeta").Length < 1)
            {
                Console.ForegroundColor = ConsoleColor.Red;
                Console.WriteLine("Please open Roblox first!");
                Thread.Sleep(3000);
                Environment.Exit(0);
            }
            EyeStep.open("RobloxPlayerBeta.exe");
            Console.ForegroundColor = ConsoleColor.Red;
            Console.WriteLine("Scanning RBX...");
            Console.ForegroundColor = ConsoleColor.Gray;
            watch.Start();

            // get index2adr
            var tostring       = scanner.scan_xrefs("'tostring' must return a string to 'print'")[0];
            var tostring_calls = util.getCalls(util.getPrologue(tostring));

            int getfield_addr  = tostring_calls[2];
            var getfield_calls = util.getCalls(getfield_addr);

            // Scan AOBs
            int gettop_addr      = scanner.scan(gettop)[0];
            int index2adr_addr   = getfield_calls[0];
            int retcheck_addr    = getfield_calls[3];
            int deserialize_addr = util.getPrologue(scanner.scan_xrefs(": bytecode")[0]);

            // More scanning
            var retcheck_xrefs  = scanner.scan_xrefs(retcheck_addr);
            var index2adr_xrefs = scanner.scan_xrefs(index2adr_addr);

            Console.WriteLine();
            Console.WriteLine("Addresses:");
            // Log addresses
            LogFunc("deserializer", deserialize_addr, 5);
            LogFunc("index2adr", index2adr_addr, 2);

            LogFunc("lua_call", retcheck_xrefs[1], 3);
            LogFunc("lua_checkstack", retcheck_xrefs[32], 2);
            LogFunc("lua_concat", retcheck_xrefs[3], 2);
            LogFunc("lua_createtable", retcheck_xrefs[4], 3);
            LogFunc("lua_gc", retcheck_xrefs[5], 3);
            LogFunc("lua_getargument", retcheck_xrefs[57], 3);
            LogFunc("lua_getfenv", retcheck_xrefs[6], 2);
            LogFunc("lua_getfield", retcheck_xrefs[7], 3);
            LogFunc("lua_getinfo", retcheck_xrefs[58], 3);
            LogFunc("lua_getmetatable", retcheck_xrefs[8], 2);
            LogFunc("lua_gettable", retcheck_xrefs[9], 2);
            LogFunc("lua_gettop", gettop_addr, 1);
            LogFunc("lua_getupvalue", retcheck_xrefs[10], 3);
            LogFunc("lua_insert", retcheck_xrefs[11], 2);
            LogFunc("lua_iscfunction", index2adr_xrefs[8], 2);
            LogFunc("lua_isnumber", index2adr_xrefs[9], 2);
            LogFunc("lua_isstring", index2adr_xrefs[10], 2);
            LogFunc("lua_isuserdata", index2adr_xrefs[7], 2);
            LogFunc("lua_lessthan", retcheck_xrefs[12], 3);
            LogFunc("lua_newthread", retcheck_xrefs[13], 1);
            LogFunc("lua_newuserdata", retcheck_xrefs[14], 3);
            LogFunc("lua_next", retcheck_xrefs[15], 2);
            LogFunc("lua_objlen", retcheck_xrefs[16], 2);
            LogFunc("lua_pcall", retcheck_xrefs[17], 4);
            LogFunc("lua_pushboolean", retcheck_xrefs[18], 2);
            LogFunc("lua_pushcclosure", retcheck_xrefs[19], 5);
            LogFunc("lua_pushfstring", retcheck_xrefs[20], 3);
            LogFunc("lua_pushinteger", retcheck_xrefs[21], 2);
            LogFunc("lua_pushlightuserdata", retcheck_xrefs[22], 2);
            LogFunc("lua_pushlstring", retcheck_xrefs[23], 3);
            LogFunc("lua_pushnil", retcheck_xrefs[24], 1);
            LogFunc("lua_pushnumber", retcheck_xrefs[25], 2);
            LogFunc("lua_pushstring", retcheck_xrefs[26], 2);
            LogFunc("lua_pushthread", retcheck_xrefs[28], 1);
            LogFunc("lua_pushvalue", retcheck_xrefs[30], 2);
            LogFunc("lua_pushvfstring", retcheck_xrefs[31], 3);
            LogFunc("lua_rawget", retcheck_xrefs[33], 2);
            LogFunc("lua_rawgeti", retcheck_xrefs[35], 3);
            LogFunc("lua_rawset", retcheck_xrefs[36], 2);
            LogFunc("lua_rawseti", retcheck_xrefs[37], 3);
            LogFunc("lua_rawvalue", index2adr_xrefs[0], 2);
            LogFunc("lua_remove", retcheck_xrefs[38], 2);
            LogFunc("lua_replace", retcheck_xrefs[39], 2);
            LogFunc("lua_resume", retcheck_xrefs[53], 2);
            LogFunc("lua_setfenv", retcheck_xrefs[40], 2);
            LogFunc("lua_setfield", retcheck_xrefs[41], 3);
            LogFunc("lua_setmetatable", retcheck_xrefs[42], 2);
            LogFunc("lua_setreadonly", retcheck_xrefs[43], 3);
            LogFunc("lua_setsafeenv", retcheck_xrefs[44], 3);
            LogFunc("lua_settable", retcheck_xrefs[45], 2);
            LogFunc("lua_settop", retcheck_xrefs[46], 2);
            LogFunc("lua_setupvalue", retcheck_xrefs[47], 3);
            LogFunc("lua_toboolean", index2adr_xrefs[33], 2);
            LogFunc("lua_tointeger", index2adr_xrefs[34], 3);
            LogFunc("lua_tolstring", retcheck_xrefs[48], 3);
            LogFunc("lua_tonumber", index2adr_xrefs[37], 3);
            LogFunc("lua_topointer", index2adr_xrefs[38], 2);
            LogFunc("lua_tostring", index2adr_xrefs[40], 2);
            LogFunc("lua_tothread", index2adr_xrefs[42], 2);
            LogFunc("lua_tounsignedx", index2adr_xrefs[43], 3);
            LogFunc("lua_touserdata", index2adr_xrefs[44], 2);
            LogFunc("lua_type", index2adr_xrefs[47], 2);
            LogFunc("lua_yield", retcheck_xrefs[54], 2);
            LogFunc("lua_xmove", retcheck_xrefs[50], 3);

            LogFunc("luaU_callhook", retcheck_xrefs[56], 3);

            LogFunc("delay", scanner.scan(delay)[0], 1);
            LogFunc("print", scanner.scan(print)[0], 3);
            LogFunc("f_call", retcheck_xrefs[0], 2);
            LogFunc("resume_error", retcheck_xrefs[55], 2);
            LogAddr("retcheck", getfield_calls[3]);
            LogAddr("RCCServiceDeserializeCall", scanner.scan_xrefs(deserialize_addr)[0]); // Log without ccv

            // log and get offsets
            Console.WriteLine();
            Console.WriteLine("Offsets:");

            int iscfunc_addr = util.getPrologue(index2adr_xrefs[8]);

            for (int i = 0; i < 72; i++) // 72 is all the bytes in lua_iscfunction
            {
                if (util.readByte(iscfunc_addr + i) == 0x80)
                {                                                          /*80 is the CMP instruction we're looking for*/
                    LogOffset("IsC", util.readByte(iscfunc_addr + i + 2)); //the offset is the second register of the CMP inst
                    break;
                }
                else if (util.isEpilogue(iscfunc_addr + i))
                {
                    Console.WriteLine("Unable to find IsC offset");
                    break;
                }
            }

            for (int i = 0; i < 16; i++) // gettop is 16 bytes
            {
                if (util.readByte(gettop_addr + i) == 0x2B)
                {                                                             /*2B is the sub instruction that uses base*/
                    LogOffset("ls_base", util.readByte(gettop_addr + i + 2)); /*second register*/
                    LogOffset("ls_top", util.readByte(gettop_addr + i - 1));  /*top is just 1 byte back from the sub inst*/
                    break;
                }
                else if (util.isEpilogue(gettop_addr + i))
                {
                    Console.WriteLine("Unable to find top and base");
                    break;
                }
            }
            // the IsC dumping might die at one point but it shouldnt for a long time


            watch.Stop();
            Console.WriteLine();
            Console.ForegroundColor = ConsoleColor.Green;
            Console.WriteLine("Scanned " + addycount + " addresses" + " in " + watch.ElapsedMilliseconds + "ms");
            Thread.Sleep(-1);
        }