├── demo.png ├── source └── dllToInject │ ├── pch.cpp │ ├── framework.h │ ├── dllToInject.vcxproj.user │ ├── pch.h │ ├── dllToInject.vcxproj.filters │ ├── dllmain.cpp │ └── dllToInject.vcxproj ├── .gitignore ├── LICENSE └── README.md /demo.png: -------------------------------------------------------------------------------- https://raw.githubusercontent.com/aaaddress1/goodGarena/HEAD/demo.png -------------------------------------------------------------------------------- /source/dllToInject/pch.cpp: -------------------------------------------------------------------------------- 1 | // pch.cpp: 對應到先行編譯標頭的來源檔案 2 | 3 | #include "pch.h" 4 | 5 | // 使用先行編譯的標頭時,需要來源檔案才能使編譯成功。 6 | -------------------------------------------------------------------------------- /source/dllToInject/framework.h: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #define WIN32_LEAN_AND_MEAN // 從 Windows 標頭排除不常使用的項目 4 | // Windows 標頭檔 5 | #include 6 | -------------------------------------------------------------------------------- /source/dllToInject/dllToInject.vcxproj.user: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | -------------------------------------------------------------------------------- /source/dllToInject/pch.h: -------------------------------------------------------------------------------- 1 | // pch.h: 此為先行編譯的標頭檔。 2 | // 以下所列檔案只會編譯一次,可改善之後組建的組建效能。 3 | // 這也會影響 IntelliSense 效能,包括程式碼完成以及許多程式碼瀏覽功能。 4 | // 但此處所列的檔案,如果其中任一在組建之間進行了更新,即會重新編譯所有檔案。 5 | // 請勿於此處新增會經常更新的檔案,如此將會對於效能優勢產生負面的影響。 6 | 7 | #ifndef PCH_H 8 | #define PCH_H 9 | 10 | // 請於此新增您要先行編譯的標頭 11 | #include "framework.h" 12 | 13 | #endif //PCH_H 14 | -------------------------------------------------------------------------------- /.gitignore: -------------------------------------------------------------------------------- 1 | # Prerequisites 2 | *.d 3 | 4 | # Compiled Object files 5 | *.slo 6 | *.lo 7 | *.o 8 | *.obj 9 | 10 | # Precompiled Headers 11 | *.gch 12 | *.pch 13 | 14 | # Compiled Dynamic libraries 15 | *.so 16 | *.dylib 17 | *.dll 18 | 19 | # Fortran module files 20 | *.mod 21 | *.smod 22 | 23 | # Compiled Static libraries 24 | *.lai 25 | *.la 26 | *.a 27 | *.lib 28 | 29 | # Executables 30 | *.exe 31 | *.out 32 | *.app 33 | -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | MIT License 2 | 3 | Copyright (c) 2022 Sheng-Hao Ma 4 | 5 | Permission is hereby granted, free of charge, to any person obtaining a copy 6 | of this software and associated documentation files (the "Software"), to deal 7 | in the Software without restriction, including without limitation the rights 8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell 9 | copies of the Software, and to permit persons to whom the Software is 10 | furnished to do so, subject to the following conditions: 11 | 12 | The above copyright notice and this permission notice shall be included in all 13 | copies or substantial portions of the Software. 14 | 15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, 20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE 21 | SOFTWARE. 22 | -------------------------------------------------------------------------------- /source/dllToInject/dllToInject.vcxproj.filters: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF} 6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx 7 | 8 | 9 | {93995380-89BD-4b04-88EB-625FBE52EBFB} 10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd 11 | 12 | 13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01} 14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms 15 | 16 | 17 | 18 | 19 | 標頭檔 20 | 21 | 22 | 標頭檔 23 | 24 | 25 | 26 | 27 | 來源檔案 28 | 29 | 30 | 來源檔案 31 | 32 | 33 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # goodGarena 2 | Garena 競時通順暢開遊戲小補丁 3 | 4 | ## 問題定義 5 | []() 6 | 7 | 台灣版英雄聯盟需由 Garena 競時通按下「啟動」來對背景服務 `gxxsvc.exe` 8 | 進行 IPC 溝通來透過 `CreateProcessEx` 喚醒 Riot 原廠的 LOL 遊戲大廳... 不過 Garena 寫得很爛 ^^ 9 | 10 | 經常遇到 LOL 遊戲異常崩潰等情況、但 LOL 背景服務沒關乾淨,因此 Garena 競時通會誤以為遊戲還在進行中、所以不讓你創建新的 LOL 遊戲大廳。 11 | 12 | ## 本專案解法 13 | 通過逆向工程可以發現 Garena 競時通基於 QT5 撰寫,底層調用了自行開發的 `commutil.dll` 內部串 google IPC 模組進行溝通。 14 | 並且可以發現此模組導出函數 `ProcessHelper::checkProcessRunning(WCHAR* exeName)` 用於檢查指定 Process 是否存活。 15 | 在每次 Garena 確認遊戲是否存活前會先比對 `gxxapphelper.exe` 是否存活,因此對這個函數掛鉤就可以在用戶按下「啟動鍵」的當下將背景 LOL 背景程式關乾淨。 16 | 17 | ## 使用方式 18 | 解壓縮後有三份文件 `dllPatch.dll`, `goodGarena.sdb` 與 `RunMe.bat` 19 | 20 | 對 `RunMe.bat` 右鍵以工作管理員執行安裝即可上補丁: 21 | (1.) 將會把 `dllPatch.dll` 拷貝至 `C:\30cm_tw\goodGarena.dll` 22 | (2.) 並安裝 `goodGarena.sdb` 來對 `Garena.exe` 自動注入 `goodGarena.dll` 23 | 24 | 補丁僅需執行一次永久有效(即便 Garena 版本更新)重開機也不必再次執行補丁工具 25 | 每次 Garena 啟動後會有一聲 500ms 的 Beep 聲通知你當前 Patch 已被掛載 :) 26 | 27 | aaaddress1

28 | 29 | aaaddress1 30 | aaaddress1 31 | aaaddress1 32 | aaaddr1 33 | 34 | -------------------------------------------------------------------------------- /source/dllToInject/dllmain.cpp: -------------------------------------------------------------------------------- 1 | // dllmain.cpp : 定義 DLL 應用程式的進入點。 2 | #include "pch.h" 3 | #include 4 | #include 5 | #include 6 | #include 7 | #include 8 | #pragma comment(lib, "Shlwapi.lib") 9 | #pragma warning(disable:4996) 10 | #define JMP(from, to) (int)(((int)to - (int)from) - 5); 11 | 12 | void Jump(unsigned long ulAddress, void* Function, unsigned long ulNops) { 13 | try { 14 | DWORD OldProtection; 15 | VirtualProtect((LPVOID)ulAddress, 0x4, PAGE_EXECUTE_READWRITE, &OldProtection); 16 | 17 | *(unsigned char*)ulAddress = 0xE9; 18 | *(unsigned long*)(ulAddress + 1) = JMP(ulAddress, Function); 19 | memset((void*)(ulAddress + 5), 0x90, ulNops); 20 | 21 | VirtualProtect((LPVOID)ulAddress, 0x4, OldProtection, &OldProtection); 22 | } 23 | catch (...) {} 24 | } 25 | 26 | void killProcessByName(const wchar_t* filename) 27 | { 28 | HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL); 29 | if (!hSnapShot) return; 30 | 31 | PROCESSENTRY32W pEntry; 32 | pEntry.dwSize = sizeof(pEntry); 33 | 34 | BOOL hRes = Process32FirstW(hSnapShot, &pEntry); 35 | while (hRes) 36 | { 37 | if (StrStrIW(pEntry.szExeFile, filename)) 38 | { 39 | 40 | HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0, pEntry.th32ProcessID); 41 | if (hProcess) 42 | { 43 | TerminateProcess(hProcess, 9); 44 | CloseHandle(hProcess); 45 | } 46 | } 47 | hRes = Process32NextW(hSnapShot, &pEntry); 48 | } 49 | 50 | CloseHandle(hSnapShot); 51 | } 52 | 53 | 54 | // char __cdecl ProcessHelper::checkProcessRunning(LPCWSTR lpString2) 55 | size_t __cdecl hook_checkProcessRunning(LPCWSTR lpString2) { 56 | 57 | if (!lstrcmpiW(L"gxxapphelper.exe", lpString2)) { 58 | // check lol agent? 59 | killProcessByName(L"league"); // league of lengend blablabla 60 | Sleep(300); 61 | } 62 | 63 | 64 | HANDLE Toolhelp32Snapshot; // esi 65 | char v3; // [esp+Bh] [ebp-231h] 66 | PROCESSENTRY32W pe; // [esp+Ch] [ebp-230h] BYREF 67 | 68 | Toolhelp32Snapshot = CreateToolhelp32Snapshot(2u, 0); 69 | if (Toolhelp32Snapshot == (HANDLE)-1) 70 | return 0; 71 | memset(&pe, 0, sizeof(pe)); 72 | pe.dwSize = 556; 73 | if (!Process32FirstW(Toolhelp32Snapshot, &pe)) 74 | { 75 | CloseHandle(Toolhelp32Snapshot); 76 | return 0; 77 | } 78 | v3 = 0; 79 | while (lstrcmpiW(pe.szExeFile, lpString2)) 80 | { 81 | if (!Process32NextW(Toolhelp32Snapshot, &pe)) 82 | goto LABEL_10; 83 | } 84 | v3 = 1; 85 | LABEL_10: 86 | CloseHandle(Toolhelp32Snapshot); 87 | return v3; 88 | } 89 | 90 | 91 | 92 | DWORD WINAPI callback(LPVOID lpParameter) { 93 | 94 | size_t targetFunc = 0; 95 | while (!targetFunc) { 96 | targetFunc = (size_t)GetProcAddress(LoadLibraryA("commutil.dll"), "?checkProcessRunning@ProcessHelper@@YA_NPB_W@Z"); 97 | Sleep(300); 98 | } 99 | orginalPtr_checkProcessRunning = targetFunc + 9; 100 | Jump(targetFunc, hook_checkProcessRunning, 0); 101 | Beep(500, 500); 102 | 103 | return true; 104 | } 105 | 106 | BOOL APIENTRY DllMain( HMODULE hModule, 107 | DWORD ul_reason_for_call, 108 | LPVOID lpReserved 109 | ) 110 | { 111 | switch (ul_reason_for_call) 112 | { 113 | case DLL_PROCESS_ATTACH: 114 | CreateThread(NULL, 0xFF, callback, NULL, 0, NULL); 115 | case DLL_THREAD_ATTACH: 116 | case DLL_THREAD_DETACH: 117 | case DLL_PROCESS_DETACH: 118 | break; 119 | } 120 | return TRUE; 121 | } 122 | 123 | -------------------------------------------------------------------------------- /source/dllToInject/dllToInject.vcxproj: -------------------------------------------------------------------------------- 1 | 2 | 3 | 4 | 5 | Debug 6 | Win32 7 | 8 | 9 | Release 10 | Win32 11 | 12 | 13 | Debug 14 | x64 15 | 16 | 17 | Release 18 | x64 19 | 20 | 21 | 22 | 16.0 23 | Win32Proj 24 | {14a05bda-a4a0-4dff-acdf-04d24f6d1f32} 25 | dllToInject 26 | 10.0 27 | 28 | 29 | 30 | DynamicLibrary 31 | true 32 | v143 33 | Unicode 34 | 35 | 36 | DynamicLibrary 37 | false 38 | v143 39 | true 40 | Unicode 41 | 42 | 43 | DynamicLibrary 44 | true 45 | v143 46 | Unicode 47 | 48 | 49 | DynamicLibrary 50 | false 51 | v143 52 | true 53 | Unicode 54 | 55 | 56 | 57 | 58 | 59 | 60 | 61 | 62 | 63 | 64 | 65 | 66 | 67 | 68 | 69 | 70 | 71 | 72 | 73 | 74 | true 75 | 76 | 77 | false 78 | 79 | 80 | true 81 | 82 | 83 | false 84 | 85 | 86 | 87 | Level3 88 | true 89 | WIN32;_DEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 90 | true 91 | Use 92 | pch.h 93 | 94 | 95 | Windows 96 | true 97 | false 98 | 99 | 100 | 101 | 102 | Level3 103 | true 104 | true 105 | true 106 | WIN32;NDEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 107 | true 108 | Use 109 | pch.h 110 | MultiThreaded 111 | false 112 | 113 | 114 | Windows 115 | true 116 | true 117 | true 118 | false 119 | 120 | 121 | 122 | 123 | Level3 124 | true 125 | _DEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 126 | true 127 | Use 128 | pch.h 129 | 130 | 131 | Windows 132 | true 133 | false 134 | 135 | 136 | 137 | 138 | Level3 139 | true 140 | true 141 | true 142 | NDEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions) 143 | true 144 | Use 145 | pch.h 146 | 147 | 148 | Windows 149 | true 150 | true 151 | true 152 | false 153 | 154 | 155 | 156 | 157 | 158 | 159 | 160 | 161 | 162 | Create 163 | Create 164 | Create 165 | Create 166 | 167 | 168 | 169 | 170 | 171 | --------------------------------------------------------------------------------