├── DynamicPanoramaInjection ├── DynamicPanoramaInjection │ ├── stdafx.h │ ├── dllmain.cpp │ ├── stdafx.cpp │ ├── targetver.h │ ├── DynamicPanoramaInjection.vcxproj.filters │ ├── iZip.h │ ├── panoramahook.cpp │ └── DynamicPanoramaInjection.vcxproj └── DynamicPanoramaInjection.sln ├── .gitignore └── README.md /DynamicPanoramaInjection/DynamicPanoramaInjection/stdafx.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Galenika/DynamicPanoramic/HEAD/DynamicPanoramaInjection/DynamicPanoramaInjection/stdafx.h -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/dllmain.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Galenika/DynamicPanoramic/HEAD/DynamicPanoramaInjection/DynamicPanoramaInjection/dllmain.cpp -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/stdafx.cpp: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Galenika/DynamicPanoramic/HEAD/DynamicPanoramaInjection/DynamicPanoramaInjection/stdafx.cpp -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/targetver.h: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/Galenika/DynamicPanoramic/HEAD/DynamicPanoramaInjection/DynamicPanoramaInjection/targetver.h -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Prerequisites 2 | *.d 3 | 4 | # Compiled Object files 5 | *.slo 6 | *.lo 7 | *.o 8 | *.obj 9 | 10 | # Precompiled Headers 11 | *.gch 12 | *.pch 13 | 14 | # Compiled Dynamic libraries 15 | *.so 16 | *.dylib 17 | *.dll 18 | 19 | # Fortran module files 20 | *.mod 21 | *.smod 22 | 23 | # Compiled Static libraries 24 | *.lai 25 | *.la 26 | *.a 27 | *.lib 28 | 29 | # Executables 30 | *.exe 31 | *.out 32 | *.app 33 | /DynamicPanoramaInjection/.vs/DynamicPanoramaInjection/v15 34 | /.vs 35 | -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection.sln: -------------------------------------------------------------------------------- 1 | 2 | Microsoft Visual Studio Solution File, Format Version 12.00 3 | # Visual Studio 15 4 | VisualStudioVersion = 15.0.27004.2005 5 | MinimumVisualStudioVersion = 10.0.40219.1 6 | Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "DynamicPanoramaInjection", "DynamicPanoramaInjection\DynamicPanoramaInjection.vcxproj", "{CB656FA3-0DB4-46CF-8A0F-84623981B986}" 7 | EndProject 8 | Global 9 | GlobalSection(SolutionConfigurationPlatforms) = preSolution 10 | Debug|x64 = Debug|x64 11 | Debug|x86 = Debug|x86 12 | Release|x64 = Release|x64 13 | Release|x86 = Release|x86 14 | EndGlobalSection 15 | GlobalSection(ProjectConfigurationPlatforms) = postSolution 16 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Debug|x64.ActiveCfg = Debug|x64 17 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Debug|x64.Build.0 = Debug|x64 18 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Debug|x86.ActiveCfg = Debug|Win32 19 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Debug|x86.Build.0 = Debug|Win32 20 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Release|x64.ActiveCfg = Release|x64 21 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Release|x64.Build.0 = Release|x64 22 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Release|x86.ActiveCfg = Release|Win32 23 | {CB656FA3-0DB4-46CF-8A0F-84623981B986}.Release|x86.Build.0 = Release|Win32 24 | EndGlobalSection 25 | GlobalSection(SolutionProperties) = preSolution 26 | HideSolutionNode = FALSE 27 | EndGlobalSection 28 | GlobalSection(ExtensibilityGlobals) = postSolution 29 | SolutionGuid = {1FE624AD-A891-47E7-AA44-CE9B2A856B60} 30 | EndGlobalSection 31 | EndGlobal 32 | -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/DynamicPanoramaInjection.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;hm;inl;inc;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | Header Files 20 | 21 | 22 | Header Files 23 | 24 | 25 | Header Files 26 | 27 | 28 | 29 | 30 | Source Files 31 | 32 | 33 | Source Files 34 | 35 | 36 | Source Files 37 | 38 | 39 | 40 | 41 | Resource Files 42 | 43 | 44 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # DynamicPanoramic 2 | 3 | A Program used to edit Counter Strike's new Panorama UI 4 | 5 | This method bypasses the crypto checks of code.pbin by injecting into the process and editing the zip file as it loads, but after the checks done with crypto by valve. 6 | 7 | Please Ensure you load the DLL as soon as possable, the module MUST hook before CSGO parses the zip file else it will not work. 8 | 9 | # Credits: 10 | qtKite-> I had not touched csgo in a while and he pointed out a few things, such as VEH Hooking 11 | 12 | PolyHook-> Is used to apply the VEH Hooking 13 | 14 | UnknownCheats User __or_75-> His explaination of the checks valve is doing on the code.pbin (as i originally was looking at editing the code.pbin itself) 15 | 16 | UnknownCheats User Slidy-> His observation that the code.pbin is just a zip file 17 | 18 | Probably some others that i have missed, if i have missed you feel free to leave a message saying who you are and how you may have helped. 19 | 20 | Pattern Scanning-> I cant accually remember where I pulled this from, it was a csgo cheat source, if somebody could let me know ill update this file and my comments with the name of the owner of the code 21 | 22 | # Use: 23 | in dllmain.cpp i have an example use of the code, all you have todo is 24 | 25 | 1. Create a std::vector of std::pairs with both params as std::strings, the first string in each pair is the position on the disk of the file to inject, the second is where you wish it to be placed inside the panorama zip. 26 | 2. Inject as CSGO starts. Injecting later will cause this not to work due to hooking the parsing of panorama. 27 | 3. Win. 28 | 29 | # Notes: 30 | If you wish to edit panorama you may wish to check out WesserEsser's github OR dump it yourself for latest version: https://github.com/WasserEsser/panorama 31 | 32 | If you have any improvements please let me know <3 33 | -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/iZip.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include 4 | #include 5 | 6 | // Based On https://github.com/ValveSoftware/source-sdk-2013/blob/master/mp/src/public/zip_utils.h 7 | class iZip 8 | { 9 | public: 10 | // Note, Paddings files contianed stuff from SDK i couldnt be bothered copying over 11 | // if you want them you can grab it all from source sdk 12 | enum eCompressionType 13 | { 14 | // Type of compression used for this file in the zip 15 | eCompressionType_Unknown = -1, 16 | eCompressionType_None = 0, 17 | eCompressionType_LZMA = 14 18 | }; 19 | virtual void Reset() = 0; 20 | virtual void AddFileToZip(const char *relativename, const char *fullpath, eCompressionType compressionType = eCompressionType_None) = 0; 21 | virtual bool FileExistsInZip(const char *pRelativeName) = 0; 22 | virtual void Padding_0() = 0; 23 | virtual void Padding_1() = 0; 24 | virtual void RemoveFileFromZip(const char *relativename) = 0; 25 | virtual int GetNextFilename(int id, char *pBuffer, int bufferSize, int &fileSize) = 0; 26 | virtual void PrintDirectory(void) = 0; 27 | virtual unsigned int EstimateSize(void) = 0; 28 | virtual void AddBufferToZip(const char *relativename, void *data, int length, bool bTextMode, eCompressionType compressionType = eCompressionType_None) = 0; 29 | virtual void Padding_2() = 0; 30 | virtual void SaveToDisk(FILE *fout) = 0; 31 | virtual void SaveToDisk(HANDLE hFileOut) = 0; 32 | virtual void ParseFromBuffer(void *buffer, int bufferlength) = 0; 33 | virtual HANDLE ParseFromDisk(const char *pFilename) = 0; 34 | virtual void ForceAlignment(bool aligned, bool bCompatibleFormat, unsigned int alignmentSize = 0) = 0; 35 | virtual unsigned int GetAlignment() = 0; 36 | virtual void SetBigEndian(bool bigEndian) = 0; 37 | virtual void ActivateByteSwapping(bool bActivate) = 0; 38 | 39 | }; -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/panoramahook.cpp: -------------------------------------------------------------------------------- 1 | #include "stdafx.h" 2 | #include 3 | #include 4 | #include 5 | #include 6 | #include 7 | 8 | // Requires PolyHook 9 | #include "../../../PolyHook/PolyHook/PolyHook.hpp" 10 | 11 | // iZip File Structure 12 | #include "iZip.h" 13 | 14 | #define INVALID_HANDLE 0 15 | 16 | PLH::VEHHook ParseFromBufferHook; 17 | 18 | // Files to Inject are stored here for injection 19 | std::vector> Injection_Filelist = {}; 20 | 21 | // Check if zip file is code.pbin 22 | bool IsZipFile_Panorama(iZip* ZipFile) 23 | { 24 | // Note, this is probably not needed as 25 | // im pretty sure the only code using the 26 | // zip utils inside panorama.dll is 27 | // in creation of panorama, but i guess this just 28 | // will futureproof it a littlebit :P 29 | 30 | char Filename[260] = { 0 }; 31 | int FileSize = 0; 32 | 33 | int Fileid = ZipFile->GetNextFilename(-1, Filename, 260, FileSize); 34 | 35 | if (Filename[0] == 'p' && // There is probably a better way to check this 36 | Filename[1] == 'a' && // But im lazy and tired 37 | Filename[2] == 'n' && 38 | Filename[3] == 'o' && 39 | Filename[4] == 'r' && 40 | Filename[5] == 'a' && 41 | Filename[6] == 'm' && 42 | Filename[7] == 'a') 43 | { 44 | return true; 45 | } 46 | 47 | return false; 48 | } 49 | 50 | //void __thiscall iZip::ParseFromBuffer(char *thisptr, void *Buffer, size_t Size) 51 | void __stdcall Hooked_ParseFromBuffer(void* Buffer, int Size) 52 | { 53 | // __thiscall - this pointer stored inside the ecx register 54 | // Probably a better way to get this but im too tired to do that now 55 | iZip* ZipFile = nullptr; 56 | __asm 57 | { 58 | mov ZipFile, ecx 59 | } 60 | 61 | // VEH Stuffs :P 62 | auto Object = ParseFromBufferHook.GetProtectionObject(); 63 | 64 | // Call the original Parse from buffer 65 | ZipFile->ParseFromBuffer(Buffer, Size); 66 | 67 | if (/*IsZipFile_Panorama(ZipFile)*/ true) // I havn't accually testeed IsZipFile_Panorama and i cbf because im done working on this 68 | { 69 | // Loop though the files we wish to inject and inject them 70 | for (const auto& File : Injection_Filelist) 71 | { 72 | const char* File_Path = File.first.c_str(); 73 | const char* File_Reletive = File.second.c_str(); 74 | 75 | // If we overwrite a file, we want to delete it first. 76 | if (ZipFile->FileExistsInZip(File_Reletive)) 77 | { 78 | ZipFile->RemoveFileFromZip(File_Reletive); 79 | } 80 | 81 | // Add our file to zip 82 | ZipFile->AddFileToZip(File_Reletive, File_Path); 83 | } 84 | // Unhook ParseFromBuffer as we do not need to 85 | // Run this code for any more zip files to come 86 | ParseFromBufferHook.UnHook(); 87 | 88 | #ifdef _DEBUG 89 | // Output all files inside zip file 90 | ZipFile->PrintDirectory(); 91 | #endif 92 | } 93 | } 94 | 95 | // pattern scan pulled from a random source on internet 96 | // sorry i cant remember where i pulled it from i was 97 | // being lazy 98 | // If anyone knows who made it ill happly update this 99 | // comment 100 | DWORD FindPattern(HMODULE Module, std::string pattern) 101 | { 102 | #define INRANGE(x,a,b) (x >= a && x <= b) 103 | #define getBits( x ) (INRANGE((x&(~0x20)),'A','F') ? ((x&(~0x20)) - 'A' + 0xa) : (INRANGE(x,'0','9') ? x - '0' : 0)) 104 | #define getByte( x ) (getBits(x[0]) << 4 | getBits(x[1])) 105 | 106 | const char* pat = pattern.c_str(); 107 | DWORD firstMatch = 0; 108 | DWORD rangeStart = (DWORD)Module; 109 | MODULEINFO miModInfo; 110 | GetModuleInformation(GetCurrentProcess(), (HMODULE)rangeStart, &miModInfo, sizeof(MODULEINFO)); 111 | DWORD rangeEnd = rangeStart + miModInfo.SizeOfImage; 112 | for (DWORD pCur = rangeStart; pCur < rangeEnd; pCur++) 113 | { 114 | if (!*pat) return firstMatch; 115 | 116 | if (*(PBYTE)pat == '\?' || *(BYTE*)pCur == getByte(pat)) 117 | { 118 | if (!firstMatch) firstMatch = pCur; 119 | 120 | if (!pat[2]) return firstMatch; 121 | 122 | if (*(PWORD)pat == '\?\?' || *(PBYTE)pat != '\?') 123 | pat += 3; 124 | else pat += 2; //one ? 125 | } 126 | else 127 | { 128 | pat = pattern.c_str(); 129 | firstMatch = 0; 130 | } 131 | } 132 | return NULL; 133 | } 134 | 135 | void HookPanoramaUI(const std::vector>& FilesToInject) 136 | { 137 | Injection_Filelist = FilesToInject; 138 | 139 | HMODULE Panorama_Dll = GetModuleHandleA("panorama.dll"); 140 | 141 | while (Panorama_Dll == INVALID_HANDLE) 142 | { 143 | Panorama_Dll = GetModuleHandleA("panorama.dll"); // If panorama.dll hasnt been loaded in yet 144 | // Wait until we can find panorama.dll 145 | } 146 | 147 | // Find Parse From Buffer in panorama.dll 148 | // This function is called when valve go to parse code.pbin after the 149 | // cryto checks and stuff like that 150 | // If we hook this we can edit the zip 151 | // while it loads 152 | uint8_t* OriginalParseFromBuffer = (uint8_t*)FindPattern(Panorama_Dll, "55 8B EC 56 8D 71 04 8D 4E 0C E8 ? ? ? ? 8B 46 34 83 F8 FF 74 23 50 FF 15 ? ? ? ? 83 7E 44 00 B8 ? ? ? ? 74 03 8B 46 38 50 FF 15 ? ? ? ? C7 46 ? ? ? ? ? 80 7E 30 00 74 0E 8D 56 38 8D 4E 48 E8 ? ? ? ? 89 46 34 FF 75 0C"); 153 | if (!OriginalParseFromBuffer) 154 | { 155 | #ifdef _DEBUG 156 | std::cout << "Cannot Find ParseFromBuffer(), press enter to exit" << std::endl; 157 | std::cin.get(); 158 | #endif 159 | return; 160 | } 161 | 162 | // Hook Parse from buffer 163 | ParseFromBufferHook.SetupHook(OriginalParseFromBuffer, (uint8_t*)Hooked_ParseFromBuffer, PLH::VEHHook::VEHMethod::INT3_BP); 164 | ParseFromBufferHook.Hook(); 165 | 166 | } -------------------------------------------------------------------------------- /DynamicPanoramaInjection/DynamicPanoramaInjection/DynamicPanoramaInjection.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 15.0 23 | {CB656FA3-0DB4-46CF-8A0F-84623981B986} 24 | Win32Proj 25 | DynamicPanoramaInjection 26 | 10.0.16299.0 27 | 28 | 29 | 30 | DynamicLibrary 31 | true 32 | v141 33 | Unicode 34 | 35 | 36 | DynamicLibrary 37 | false 38 | v141 39 | true 40 | Unicode 41 | 42 | 43 | DynamicLibrary 44 | true 45 | v141 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v141 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | true 78 | 79 | 80 | false 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Use 88 | Level3 89 | Disabled 90 | true 91 | WIN32;_DEBUG;DYNAMICPANORAMAINJECTION_EXPORTS;_WINDOWS;_USRDLL;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) 92 | 93 | 94 | Windows 95 | true 96 | 97 | 98 | 99 | 100 | Use 101 | Level3 102 | Disabled 103 | true 104 | _DEBUG;DYNAMICPANORAMAINJECTION_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 105 | 106 | 107 | Windows 108 | true 109 | 110 | 111 | 112 | 113 | Use 114 | Level3 115 | MaxSpeed 116 | true 117 | true 118 | true 119 | WIN32;NDEBUG;DYNAMICPANORAMAINJECTION_EXPORTS;_WINDOWS;_USRDLL;_CRT_SECURE_NO_WARNINGS;%(PreprocessorDefinitions) 120 | Cdecl 121 | 122 | 123 | Windows 124 | true 125 | true 126 | true 127 | 128 | 129 | 130 | 131 | Use 132 | Level3 133 | MaxSpeed 134 | true 135 | true 136 | true 137 | NDEBUG;DYNAMICPANORAMAINJECTION_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 138 | 139 | 140 | Windows 141 | true 142 | true 143 | true 144 | 145 | 146 | 147 | 148 | 149 | 150 | 151 | 152 | 153 | 154 | 155 | Create 156 | Create 157 | Create 158 | Create 159 | 160 | 161 | 162 | 163 | 164 | 165 | 166 | 167 | --------------------------------------------------------------------------------