├── demo.png
├── source
└── dllToInject
│ ├── pch.cpp
│ ├── framework.h
│ ├── dllToInject.vcxproj.user
│ ├── pch.h
│ ├── dllToInject.vcxproj.filters
│ ├── dllmain.cpp
│ └── dllToInject.vcxproj
├── .gitignore
├── LICENSE
└── README.md
/demo.png:
--------------------------------------------------------------------------------
https://raw.githubusercontent.com/aaaddress1/goodGarena/HEAD/demo.png
--------------------------------------------------------------------------------
/source/dllToInject/pch.cpp:
--------------------------------------------------------------------------------
1 | // pch.cpp: 對應到先行編譯標頭的來源檔案
2 |
3 | #include "pch.h"
4 |
5 | // 使用先行編譯的標頭時,需要來源檔案才能使編譯成功。
6 |
--------------------------------------------------------------------------------
/source/dllToInject/framework.h:
--------------------------------------------------------------------------------
1 | #pragma once
2 |
3 | #define WIN32_LEAN_AND_MEAN // 從 Windows 標頭排除不常使用的項目
4 | // Windows 標頭檔
5 | #include
6 |
--------------------------------------------------------------------------------
/source/dllToInject/dllToInject.vcxproj.user:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
--------------------------------------------------------------------------------
/source/dllToInject/pch.h:
--------------------------------------------------------------------------------
1 | // pch.h: 此為先行編譯的標頭檔。
2 | // 以下所列檔案只會編譯一次,可改善之後組建的組建效能。
3 | // 這也會影響 IntelliSense 效能,包括程式碼完成以及許多程式碼瀏覽功能。
4 | // 但此處所列的檔案,如果其中任一在組建之間進行了更新,即會重新編譯所有檔案。
5 | // 請勿於此處新增會經常更新的檔案,如此將會對於效能優勢產生負面的影響。
6 |
7 | #ifndef PCH_H
8 | #define PCH_H
9 |
10 | // 請於此新增您要先行編譯的標頭
11 | #include "framework.h"
12 |
13 | #endif //PCH_H
14 |
--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | # Prerequisites
2 | *.d
3 |
4 | # Compiled Object files
5 | *.slo
6 | *.lo
7 | *.o
8 | *.obj
9 |
10 | # Precompiled Headers
11 | *.gch
12 | *.pch
13 |
14 | # Compiled Dynamic libraries
15 | *.so
16 | *.dylib
17 | *.dll
18 |
19 | # Fortran module files
20 | *.mod
21 | *.smod
22 |
23 | # Compiled Static libraries
24 | *.lai
25 | *.la
26 | *.a
27 | *.lib
28 |
29 | # Executables
30 | *.exe
31 | *.out
32 | *.app
33 |
--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
1 | MIT License
2 |
3 | Copyright (c) 2022 Sheng-Hao Ma
4 |
5 | Permission is hereby granted, free of charge, to any person obtaining a copy
6 | of this software and associated documentation files (the "Software"), to deal
7 | in the Software without restriction, including without limitation the rights
8 | to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9 | copies of the Software, and to permit persons to whom the Software is
10 | furnished to do so, subject to the following conditions:
11 |
12 | The above copyright notice and this permission notice shall be included in all
13 | copies or substantial portions of the Software.
14 |
15 | THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16 | IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17 | FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18 | AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19 | LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20 | OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21 | SOFTWARE.
22 |
--------------------------------------------------------------------------------
/source/dllToInject/dllToInject.vcxproj.filters:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | {4FC737F1-C7A5-4376-A066-2A32D752A2FF}
6 | cpp;c;cc;cxx;c++;cppm;ixx;def;odl;idl;hpj;bat;asm;asmx
7 |
8 |
9 | {93995380-89BD-4b04-88EB-625FBE52EBFB}
10 | h;hh;hpp;hxx;h++;hm;inl;inc;ipp;xsd
11 |
12 |
13 | {67DA6AB6-F800-4c08-8B7A-83BB121AAD01}
14 | rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms
15 |
16 |
17 |
18 |
19 | 標頭檔
20 |
21 |
22 | 標頭檔
23 |
24 |
25 |
26 |
27 | 來源檔案
28 |
29 |
30 | 來源檔案
31 |
32 |
33 |
--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
1 | # goodGarena
2 | Garena 競時通順暢開遊戲小補丁
3 |
4 | ## 問題定義
5 | [
]()
6 |
7 | 台灣版英雄聯盟需由 Garena 競時通按下「啟動」來對背景服務 `gxxsvc.exe`
8 | 進行 IPC 溝通來透過 `CreateProcessEx` 喚醒 Riot 原廠的 LOL 遊戲大廳... 不過 Garena 寫得很爛 ^^
9 |
10 | 經常遇到 LOL 遊戲異常崩潰等情況、但 LOL 背景服務沒關乾淨,因此 Garena 競時通會誤以為遊戲還在進行中、所以不讓你創建新的 LOL 遊戲大廳。
11 |
12 | ## 本專案解法
13 | 通過逆向工程可以發現 Garena 競時通基於 QT5 撰寫,底層調用了自行開發的 `commutil.dll` 內部串 google IPC 模組進行溝通。
14 | 並且可以發現此模組導出函數 `ProcessHelper::checkProcessRunning(WCHAR* exeName)` 用於檢查指定 Process 是否存活。
15 | 在每次 Garena 確認遊戲是否存活前會先比對 `gxxapphelper.exe` 是否存活,因此對這個函數掛鉤就可以在用戶按下「啟動鍵」的當下將背景 LOL 背景程式關乾淨。
16 |
17 | ## 使用方式
18 | 解壓縮後有三份文件 `dllPatch.dll`, `goodGarena.sdb` 與 `RunMe.bat`
19 |
20 | 對 `RunMe.bat` 右鍵以工作管理員執行安裝即可上補丁:
21 | (1.) 將會把 `dllPatch.dll` 拷貝至 `C:\30cm_tw\goodGarena.dll`
22 | (2.) 並安裝 `goodGarena.sdb` 來對 `Garena.exe` 自動注入 `goodGarena.dll`
23 |
24 | 補丁僅需執行一次永久有效(即便 Garena 版本更新)重開機也不必再次執行補丁工具
25 | 每次 Garena 啟動後會有一聲 500ms 的 Beep 聲通知你當前 Patch 已被掛載 :)
26 |
27 | 
28 |
29 |
30 |
31 |
32 |
33 |
34 |
--------------------------------------------------------------------------------
/source/dllToInject/dllmain.cpp:
--------------------------------------------------------------------------------
1 | // dllmain.cpp : 定義 DLL 應用程式的進入點。
2 | #include "pch.h"
3 | #include
4 | #include
5 | #include
6 | #include
7 | #include
8 | #pragma comment(lib, "Shlwapi.lib")
9 | #pragma warning(disable:4996)
10 | #define JMP(from, to) (int)(((int)to - (int)from) - 5);
11 |
12 | void Jump(unsigned long ulAddress, void* Function, unsigned long ulNops) {
13 | try {
14 | DWORD OldProtection;
15 | VirtualProtect((LPVOID)ulAddress, 0x4, PAGE_EXECUTE_READWRITE, &OldProtection);
16 |
17 | *(unsigned char*)ulAddress = 0xE9;
18 | *(unsigned long*)(ulAddress + 1) = JMP(ulAddress, Function);
19 | memset((void*)(ulAddress + 5), 0x90, ulNops);
20 |
21 | VirtualProtect((LPVOID)ulAddress, 0x4, OldProtection, &OldProtection);
22 | }
23 | catch (...) {}
24 | }
25 |
26 | void killProcessByName(const wchar_t* filename)
27 | {
28 | HANDLE hSnapShot = CreateToolhelp32Snapshot(TH32CS_SNAPALL, NULL);
29 | if (!hSnapShot) return;
30 |
31 | PROCESSENTRY32W pEntry;
32 | pEntry.dwSize = sizeof(pEntry);
33 |
34 | BOOL hRes = Process32FirstW(hSnapShot, &pEntry);
35 | while (hRes)
36 | {
37 | if (StrStrIW(pEntry.szExeFile, filename))
38 | {
39 |
40 | HANDLE hProcess = OpenProcess(PROCESS_TERMINATE, 0, pEntry.th32ProcessID);
41 | if (hProcess)
42 | {
43 | TerminateProcess(hProcess, 9);
44 | CloseHandle(hProcess);
45 | }
46 | }
47 | hRes = Process32NextW(hSnapShot, &pEntry);
48 | }
49 |
50 | CloseHandle(hSnapShot);
51 | }
52 |
53 |
54 | // char __cdecl ProcessHelper::checkProcessRunning(LPCWSTR lpString2)
55 | size_t __cdecl hook_checkProcessRunning(LPCWSTR lpString2) {
56 |
57 | if (!lstrcmpiW(L"gxxapphelper.exe", lpString2)) {
58 | // check lol agent?
59 | killProcessByName(L"league"); // league of lengend blablabla
60 | Sleep(300);
61 | }
62 |
63 |
64 | HANDLE Toolhelp32Snapshot; // esi
65 | char v3; // [esp+Bh] [ebp-231h]
66 | PROCESSENTRY32W pe; // [esp+Ch] [ebp-230h] BYREF
67 |
68 | Toolhelp32Snapshot = CreateToolhelp32Snapshot(2u, 0);
69 | if (Toolhelp32Snapshot == (HANDLE)-1)
70 | return 0;
71 | memset(&pe, 0, sizeof(pe));
72 | pe.dwSize = 556;
73 | if (!Process32FirstW(Toolhelp32Snapshot, &pe))
74 | {
75 | CloseHandle(Toolhelp32Snapshot);
76 | return 0;
77 | }
78 | v3 = 0;
79 | while (lstrcmpiW(pe.szExeFile, lpString2))
80 | {
81 | if (!Process32NextW(Toolhelp32Snapshot, &pe))
82 | goto LABEL_10;
83 | }
84 | v3 = 1;
85 | LABEL_10:
86 | CloseHandle(Toolhelp32Snapshot);
87 | return v3;
88 | }
89 |
90 |
91 |
92 | DWORD WINAPI callback(LPVOID lpParameter) {
93 |
94 | size_t targetFunc = 0;
95 | while (!targetFunc) {
96 | targetFunc = (size_t)GetProcAddress(LoadLibraryA("commutil.dll"), "?checkProcessRunning@ProcessHelper@@YA_NPB_W@Z");
97 | Sleep(300);
98 | }
99 | orginalPtr_checkProcessRunning = targetFunc + 9;
100 | Jump(targetFunc, hook_checkProcessRunning, 0);
101 | Beep(500, 500);
102 |
103 | return true;
104 | }
105 |
106 | BOOL APIENTRY DllMain( HMODULE hModule,
107 | DWORD ul_reason_for_call,
108 | LPVOID lpReserved
109 | )
110 | {
111 | switch (ul_reason_for_call)
112 | {
113 | case DLL_PROCESS_ATTACH:
114 | CreateThread(NULL, 0xFF, callback, NULL, 0, NULL);
115 | case DLL_THREAD_ATTACH:
116 | case DLL_THREAD_DETACH:
117 | case DLL_PROCESS_DETACH:
118 | break;
119 | }
120 | return TRUE;
121 | }
122 |
123 |
--------------------------------------------------------------------------------
/source/dllToInject/dllToInject.vcxproj:
--------------------------------------------------------------------------------
1 |
2 |
3 |
4 |
5 | Debug
6 | Win32
7 |
8 |
9 | Release
10 | Win32
11 |
12 |
13 | Debug
14 | x64
15 |
16 |
17 | Release
18 | x64
19 |
20 |
21 |
22 | 16.0
23 | Win32Proj
24 | {14a05bda-a4a0-4dff-acdf-04d24f6d1f32}
25 | dllToInject
26 | 10.0
27 |
28 |
29 |
30 | DynamicLibrary
31 | true
32 | v143
33 | Unicode
34 |
35 |
36 | DynamicLibrary
37 | false
38 | v143
39 | true
40 | Unicode
41 |
42 |
43 | DynamicLibrary
44 | true
45 | v143
46 | Unicode
47 |
48 |
49 | DynamicLibrary
50 | false
51 | v143
52 | true
53 | Unicode
54 |
55 |
56 |
57 |
58 |
59 |
60 |
61 |
62 |
63 |
64 |
65 |
66 |
67 |
68 |
69 |
70 |
71 |
72 |
73 |
74 | true
75 |
76 |
77 | false
78 |
79 |
80 | true
81 |
82 |
83 | false
84 |
85 |
86 |
87 | Level3
88 | true
89 | WIN32;_DEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
90 | true
91 | Use
92 | pch.h
93 |
94 |
95 | Windows
96 | true
97 | false
98 |
99 |
100 |
101 |
102 | Level3
103 | true
104 | true
105 | true
106 | WIN32;NDEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
107 | true
108 | Use
109 | pch.h
110 | MultiThreaded
111 | false
112 |
113 |
114 | Windows
115 | true
116 | true
117 | true
118 | false
119 |
120 |
121 |
122 |
123 | Level3
124 | true
125 | _DEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
126 | true
127 | Use
128 | pch.h
129 |
130 |
131 | Windows
132 | true
133 | false
134 |
135 |
136 |
137 |
138 | Level3
139 | true
140 | true
141 | true
142 | NDEBUG;DLLTOINJECT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)
143 | true
144 | Use
145 | pch.h
146 |
147 |
148 | Windows
149 | true
150 | true
151 | true
152 | false
153 |
154 |
155 |
156 |
157 |
158 |
159 |
160 |
161 |
162 | Create
163 | Create
164 | Create
165 | Create
166 |
167 |
168 |
169 |
170 |
171 |
--------------------------------------------------------------------------------