├── .gitignore ├── README.md └── veh.c /.gitignore: -------------------------------------------------------------------------------- 1 | ## Ignore Visual Studio temporary files, build results, and 2 | ## files generated by popular Visual Studio add-ons. 3 | ## 4 | ## Get latest from https://github.com/github/gitignore/blob/master/VisualStudio.gitignore 5 | 6 | # User-specific files 7 | *.rsuser 8 | *.suo 9 | *.user 10 | *.userosscache 11 | *.sln.docstates 12 | 13 | # User-specific files (MonoDevelop/Xamarin Studio) 14 | *.userprefs 15 | 16 | # Mono auto generated files 17 | mono_crash.* 18 | 19 | # Build results 20 | [Dd]ebug/ 21 | [Dd]ebugPublic/ 22 | [Rr]elease/ 23 | [Rr]eleases/ 24 | x64/ 25 | x86/ 26 | [Aa][Rr][Mm]/ 27 | [Aa][Rr][Mm]64/ 28 | bld/ 29 | [Bb]in/ 30 | [Oo]bj/ 31 | [Ll]og/ 32 | [Ll]ogs/ 33 | 34 | # Visual Studio 2015/2017 cache/options directory 35 | .vs/ 36 | # Uncomment if you have tasks that create the project's static files in wwwroot 37 | #wwwroot/ 38 | 39 | # Visual Studio 2017 auto generated files 40 | Generated\ Files/ 41 | 42 | # MSTest test Results 43 | [Tt]est[Rr]esult*/ 44 | [Bb]uild[Ll]og.* 45 | 46 | # NUnit 47 | *.VisualState.xml 48 | TestResult.xml 49 | nunit-*.xml 50 | 51 | # Build Results of an ATL Project 52 | [Dd]ebugPS/ 53 | [Rr]eleasePS/ 54 | dlldata.c 55 | 56 | # Benchmark Results 57 | BenchmarkDotNet.Artifacts/ 58 | 59 | # .NET Core 60 | project.lock.json 61 | project.fragment.lock.json 62 | artifacts/ 63 | 64 | # StyleCop 65 | StyleCopReport.xml 66 | 67 | # Files built by Visual Studio 68 | *_i.c 69 | *_p.c 70 | *_h.h 71 | *.ilk 72 | *.meta 73 | *.obj 74 | *.iobj 75 | *.pch 76 | *.pdb 77 | *.ipdb 78 | *.pgc 79 | *.pgd 80 | *.rsp 81 | *.sbr 82 | *.tlb 83 | *.tli 84 | *.tlh 85 | *.tmp 86 | *.tmp_proj 87 | *_wpftmp.csproj 88 | *.log 89 | *.vspscc 90 | *.vssscc 91 | .builds 92 | *.pidb 93 | *.svclog 94 | *.scc 95 | 96 | # Chutzpah Test files 97 | _Chutzpah* 98 | 99 | # Visual C++ cache files 100 | ipch/ 101 | *.aps 102 | *.ncb 103 | *.opendb 104 | *.opensdf 105 | *.sdf 106 | *.cachefile 107 | *.VC.db 108 | *.VC.VC.opendb 109 | 110 | # Visual Studio profiler 111 | *.psess 112 | *.vsp 113 | *.vspx 114 | *.sap 115 | 116 | # Visual Studio Trace Files 117 | *.e2e 118 | 119 | # TFS 2012 Local Workspace 120 | $tf/ 121 | 122 | # Guidance Automation Toolkit 123 | *.gpState 124 | 125 | # ReSharper is a .NET coding add-in 126 | _ReSharper*/ 127 | *.[Rr]e[Ss]harper 128 | *.DotSettings.user 129 | 130 | # TeamCity is a build add-in 131 | _TeamCity* 132 | 133 | # DotCover is a Code Coverage Tool 134 | *.dotCover 135 | 136 | # AxoCover is a Code Coverage Tool 137 | .axoCover/* 138 | !.axoCover/settings.json 139 | 140 | # Visual Studio code coverage results 141 | *.coverage 142 | *.coveragexml 143 | 144 | # NCrunch 145 | _NCrunch_* 146 | .*crunch*.local.xml 147 | nCrunchTemp_* 148 | 149 | # MightyMoose 150 | *.mm.* 151 | AutoTest.Net/ 152 | 153 | # Web workbench (sass) 154 | .sass-cache/ 155 | 156 | # Installshield output folder 157 | [Ee]xpress/ 158 | 159 | # DocProject is a documentation generator add-in 160 | DocProject/buildhelp/ 161 | DocProject/Help/*.HxT 162 | DocProject/Help/*.HxC 163 | DocProject/Help/*.hhc 164 | DocProject/Help/*.hhk 165 | DocProject/Help/*.hhp 166 | DocProject/Help/Html2 167 | DocProject/Help/html 168 | 169 | # Click-Once directory 170 | publish/ 171 | 172 | # Publish Web Output 173 | *.[Pp]ublish.xml 174 | *.azurePubxml 175 | # Note: Comment the next line if you want to checkin your web deploy settings, 176 | # but database connection strings (with potential passwords) will be unencrypted 177 | *.pubxml 178 | *.publishproj 179 | 180 | # Microsoft Azure Web App publish settings. Comment the next line if you want to 181 | # checkin your Azure Web App publish settings, but sensitive information contained 182 | # in these scripts will be unencrypted 183 | PublishScripts/ 184 | 185 | # NuGet Packages 186 | *.nupkg 187 | # NuGet Symbol Packages 188 | *.snupkg 189 | # The packages folder can be ignored because of Package Restore 190 | **/[Pp]ackages/* 191 | # except build/, which is used as an MSBuild target. 192 | !**/[Pp]ackages/build/ 193 | # Uncomment if necessary however generally it will be regenerated when needed 194 | #!**/[Pp]ackages/repositories.config 195 | # NuGet v3's project.json files produces more ignorable files 196 | *.nuget.props 197 | *.nuget.targets 198 | 199 | # Microsoft Azure Build Output 200 | csx/ 201 | *.build.csdef 202 | 203 | # Microsoft Azure Emulator 204 | ecf/ 205 | rcf/ 206 | 207 | # Windows Store app package directories and files 208 | AppPackages/ 209 | BundleArtifacts/ 210 | Package.StoreAssociation.xml 211 | _pkginfo.txt 212 | *.appx 213 | *.appxbundle 214 | *.appxupload 215 | 216 | # Visual Studio cache files 217 | # files ending in .cache can be ignored 218 | *.[Cc]ache 219 | # but keep track of directories ending in .cache 220 | !?*.[Cc]ache/ 221 | 222 | # Others 223 | ClientBin/ 224 | ~$* 225 | *~ 226 | *.dbmdl 227 | *.dbproj.schemaview 228 | *.jfm 229 | *.pfx 230 | *.publishsettings 231 | orleans.codegen.cs 232 | 233 | # Including strong name files can present a security risk 234 | # (https://github.com/github/gitignore/pull/2483#issue-259490424) 235 | #*.snk 236 | 237 | # Since there are multiple workflows, uncomment next line to ignore bower_components 238 | # (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) 239 | #bower_components/ 240 | 241 | # RIA/Silverlight projects 242 | Generated_Code/ 243 | 244 | # Backup & report files from converting an old project file 245 | # to a newer Visual Studio version. Backup files are not needed, 246 | # because we have git ;-) 247 | _UpgradeReport_Files/ 248 | Backup*/ 249 | UpgradeLog*.XML 250 | UpgradeLog*.htm 251 | ServiceFabricBackup/ 252 | *.rptproj.bak 253 | 254 | # SQL Server files 255 | *.mdf 256 | *.ldf 257 | *.ndf 258 | 259 | # Business Intelligence projects 260 | *.rdl.data 261 | *.bim.layout 262 | *.bim_*.settings 263 | *.rptproj.rsuser 264 | *- [Bb]ackup.rdl 265 | *- [Bb]ackup ([0-9]).rdl 266 | *- [Bb]ackup ([0-9][0-9]).rdl 267 | 268 | # Microsoft Fakes 269 | FakesAssemblies/ 270 | 271 | # GhostDoc plugin setting file 272 | *.GhostDoc.xml 273 | 274 | # Node.js Tools for Visual Studio 275 | .ntvs_analysis.dat 276 | node_modules/ 277 | 278 | # Visual Studio 6 build log 279 | *.plg 280 | 281 | # Visual Studio 6 workspace options file 282 | *.opt 283 | 284 | # Visual Studio 6 auto-generated workspace file (contains which files were open etc.) 285 | *.vbw 286 | 287 | # Visual Studio LightSwitch build output 288 | **/*.HTMLClient/GeneratedArtifacts 289 | **/*.DesktopClient/GeneratedArtifacts 290 | **/*.DesktopClient/ModelManifest.xml 291 | **/*.Server/GeneratedArtifacts 292 | **/*.Server/ModelManifest.xml 293 | _Pvt_Extensions 294 | 295 | # Paket dependency manager 296 | .paket/paket.exe 297 | paket-files/ 298 | 299 | # FAKE - F# Make 300 | .fake/ 301 | 302 | # CodeRush personal settings 303 | .cr/personal 304 | 305 | # Python Tools for Visual Studio (PTVS) 306 | __pycache__/ 307 | *.pyc 308 | 309 | # Cake - Uncomment if you are using it 310 | # tools/** 311 | # !tools/packages.config 312 | 313 | # Tabs Studio 314 | *.tss 315 | 316 | # Telerik's JustMock configuration file 317 | *.jmconfig 318 | 319 | # BizTalk build output 320 | *.btp.cs 321 | *.btm.cs 322 | *.odx.cs 323 | *.xsd.cs 324 | 325 | # OpenCover UI analysis results 326 | OpenCover/ 327 | 328 | # Azure Stream Analytics local run output 329 | ASALocalRun/ 330 | 331 | # MSBuild Binary and Structured Log 332 | *.binlog 333 | 334 | # NVidia Nsight GPU debugger configuration file 335 | *.nvuser 336 | 337 | # MFractors (Xamarin productivity tool) working folder 338 | .mfractor/ 339 | 340 | # Local History for Visual Studio 341 | .localhistory/ 342 | 343 | # BeatPulse healthcheck temp database 344 | healthchecksdb 345 | 346 | # Backup folder for Package Reference Convert tool in Visual Studio 2017 347 | MigrationBackup/ 348 | 349 | # Ionide (cross platform F# VS Code tools) working folder 350 | .ionide/ 351 | -------------------------------------------------------------------------------- /README.md: -------------------------------------------------------------------------------- 1 | # BEClient2 -------------------------------------------------------------------------------- /veh.c: -------------------------------------------------------------------------------- 1 | /* This file was generated by the Hex-Rays decompiler. 2 | Copyright (c) 2007-2018 Hex-Rays 3 | 4 | Detected compiler: Visual C++ 5 | */ 6 | 7 | 8 | struct __unaligned __declspec(align(1)) battleye_stack_report 9 | { 10 | __int8 unknown; 11 | __int8 report_id; 12 | __int8 hook_id; 13 | __int64 caller; 14 | __int64 function_dump[4]; 15 | __int64 allocation_base; 16 | __int64 base_address; 17 | __int32 region_size; 18 | __int32 type_protect_state; 19 | }; 20 | 21 | void __fastcall VHE(FARPROC (__stdcall *GetProcAddress)(HMODULE, LPCSTR), __int64 SendReport, HMODULE (__stdcall *GetModuleHandleA)(LPCSTR), __int64 a4, __int64 last_status); // idb 22 | LONG __fastcall VectoredHandler(_EXCEPTION_POINTERS *exception); 23 | void *unknown_fn(); 24 | 25 | void __fastcall VHE(FARPROC (__stdcall *GetProcAddress)(HMODULE, LPCSTR), __int64 SendReport, HMODULE (__stdcall *GetModuleHandleA)(LPCSTR), __int64 a4, __int64 last_status) 26 | { 27 | int index; // [rsp+30h] [rbp-3E8h] 28 | char byte_copy; // [rsp+34h] [rbp-3E4h] 29 | int i; // [rsp+38h] [rbp-3E0h] 30 | char status; // [rsp+3Ch] [rbp-3DCh] 31 | int l; // [rsp+40h] [rbp-3D8h] 32 | int j; // [rsp+44h] [rbp-3D4h] 33 | int n; // [rsp+48h] [rbp-3D0h] 34 | int jj; // [rsp+4Ch] [rbp-3CCh] 35 | int ll; // [rsp+50h] [rbp-3C8h] 36 | int k; // [rsp+54h] [rbp-3C4h] 37 | int m; // [rsp+58h] [rbp-3C0h] 38 | int ii; // [rsp+5Ch] [rbp-3BCh] 39 | int kk; // [rsp+60h] [rbp-3B8h] 40 | CHAR str_CallWindowProcW[16]; // [rsp+68h] [rbp-3B0h] 41 | CHAR str_sqrtf[6]; // [rsp+78h] [rbp-3A0h] 42 | CHAR str_Sleep[6]; // [rsp+80h] [rbp-398h] 43 | BYTE array_1[7]; // [rsp+88h] [rbp-390h] 44 | BYTE array_3[7]; // [rsp+90h] [rbp-388h] 45 | CHAR str_dxgi[9]; // [rsp+98h] [rbp-380h] 46 | CHAR str_ntdll[10]; // [rsp+A8h] [rbp-370h] 47 | BYTE array_2[10]; // [rsp+B8h] [rbp-360h] 48 | CHAR str_d3d11[10]; // [rsp+C8h] [rbp-350h] 49 | CHAR str_NtSetEvent[11]; // [rsp+D8h] [rbp-340h] 50 | CHAR str_win32u[11]; // [rsp+E8h] [rbp-330h] 51 | CHAR str_USER32[11]; // [rsp+F8h] [rbp-320h] 52 | CHAR str_ucrtbase[13]; // [rsp+108h] [rbp-310h] 53 | CHAR str_IsBadReadPtr[13]; // [rsp+118h] [rbp-300h] 54 | CHAR str_GetCursorPos[13]; // [rsp+128h] [rbp-2F0h] 55 | CHAR str_KERNEL32[13]; // [rsp+138h] [rbp-2E0h] 56 | CHAR str_UnityPlayer[16]; // [rsp+148h] [rbp-2D0h] 57 | CHAR str_GetAsyncKeyState[17]; // [rsp+158h] [rbp-2C0h] 58 | CHAR str_BEClient_x64[17]; // [rsp+170h] [rbp-2A8h] 59 | CHAR str_NtUserPeekMessage[18]; // [rsp+188h] [rbp-290h] 60 | CHAR str_GetForegroundWindow[20]; // [rsp+1A0h] [rbp-278h] 61 | CHAR str_NtQueryVirtualMemory[21]; // [rsp+1B8h] [rbp-260h] 62 | CHAR str_NtProtectVirtualMemory[23]; // [rsp+1D0h] [rbp-248h] 63 | CHAR str_NtUserGetAsyncKeyState[23]; // [rsp+1E8h] [rbp-230h] 64 | BYTE array[25]; // [rsp+200h] [rbp-218h] 65 | CHAR str_vsprintf_s[26]; // [rsp+220h] [rbp-1F8h] 66 | CHAR str_AddVectoredExceptionHandler[28]; // [rsp+240h] [rbp-1D8h] 67 | CHAR str_RemoveVectoredExceptionHandler[31]; // [rsp+260h] [rbp-1B8h] 68 | int mm; // [rsp+280h] [rbp-198h] 69 | PVECTORED_EXCEPTION_HANDLER Handler; // [rsp+288h] [rbp-190h] 70 | HMODULE hNtdll_1; // [rsp+290h] [rbp-188h] 71 | int unknown; // [rsp+298h] [rbp-180h] 72 | ULONG NewAccessProtection; // [rsp+29Ch] [rbp-17Ch] 73 | HMODULE hUSER32l; // [rsp+2A0h] [rbp-178h] 74 | __int64 d3d11_code_section_start; // [rsp+2A8h] [rbp-170h] 75 | HMODULE hD3d11; // [rsp+2B0h] [rbp-168h] 76 | HMODULE hDxgi; // [rsp+2B8h] [rbp-160h] 77 | HMODULE hUnityPlayer; // [rsp+2C0h] [rbp-158h] 78 | void (__stdcall *Sleep)(DWORD); // [rsp+2C8h] [rbp-150h] 79 | HMODULE hkernel32; // [rsp+2D0h] [rbp-148h] 80 | HMODULE hUcrtbase; // [rsp+2D8h] [rbp-140h] 81 | __int64 d3d11_nt_headers; // [rsp+2E0h] [rbp-138h] 82 | char *last_status_1; // [rsp+2E8h] [rbp-130h] 83 | __int64 ntdll_code_section_start; // [rsp+2F0h] [rbp-128h] 84 | __int64 dxgi_nt_headers; // [rsp+2F8h] [rbp-120h] 85 | __int64 dxgi_code_section_start; // [rsp+300h] [rbp-118h] 86 | ULONG NumberOfBytesToProtect[2]; // [rsp+308h] [rbp-110h] 87 | HMODULE hBEClient; // [rsp+310h] [rbp-108h] 88 | __int64 ntdll_nt_headers; // [rsp+318h] [rbp-100h] 89 | PVOID (__stdcall *AddVectoredExceptionHandler)(ULONG, PVECTORED_EXCEPTION_HANDLER); // [rsp+320h] [rbp-F8h] 90 | HMODULE hWin32u; // [rsp+328h] [rbp-F0h] 91 | PVOID Vectored_Handler; // [rsp+330h] [rbp-E8h] 92 | NTSTATUS (__stdcall *NtProtectVirtualMemory)(HANDLE, PVOID *, PULONG, ULONG, PULONG); // [rsp+338h] [rbp-E0h] 93 | PVOID BaseAddress; // [rsp+340h] [rbp-D8h] 94 | ULONG (__stdcall *RemoveVectoredExceptionHandler)(PVOID); // [rsp+348h] [rbp-D0h] 95 | __int64 NtQueryVirtualMemory_1; // [rsp+350h] [rbp-C8h] 96 | __int64 functions[22]; // [rsp+360h] [rbp-B8h] 97 | __int64 SendReport_1; // [rsp+428h] [rbp+10h] 98 | HMODULE (__stdcall *GetModuleHandleA_1)(LPCSTR); // [rsp+430h] [rbp+18h] 99 | FARPROC (__stdcall *GetProcAddress_1)(HMODULE, LPCSTR); // [rsp+438h] [rbp+20h] 100 | 101 | LODWORD(GetProcAddress_1) = (_DWORD)GetProcAddress; 102 | GetModuleHandleA_1 = GetModuleHandleA; 103 | SendReport_1 = SendReport; 104 | strcpy(str_KERNEL32, "KERNEL32.dll"); 105 | hkernel32 = GetModuleHandleA(str_KERNEL32); 106 | status = 1; 107 | strcpy(str_BEClient_x64, "BEClient_x64.dll"); 108 | hBEClient = GetModuleHandleA_1(str_BEClient_x64); 109 | if ( *(_DWORD *)((char *)hBEClient + *((int *)hBEClient + 0xF) + 8) < 0x5D7AA2AFu ) 110 | last_status_1 = &status; 111 | else 112 | last_status_1 = (char *)last_status; 113 | strcpy(str_AddVectoredExceptionHandler, "AddVectoredExceptionHandler"); 114 | AddVectoredExceptionHandler = (PVOID (__stdcall *)(ULONG, PVECTORED_EXCEPTION_HANDLER))GetProcAddress_1( 115 | hkernel32, 116 | str_AddVectoredExceptionHandler); 117 | if ( AddVectoredExceptionHandler ) 118 | { 119 | Handler = (PVECTORED_EXCEPTION_HANDLER)VectoredHandler; 120 | *(_QWORD *)((char *)VectoredHandler + 0xE) = SendReport_1; 121 | strcpy(str_ntdll, "ntdll.dll"); 122 | hNtdll_1 = GetModuleHandleA_1(str_ntdll); 123 | strcpy(str_NtQueryVirtualMemory, "NtQueryVirtualMemory"); 124 | NtQueryVirtualMemory_1 = (__int64)GetProcAddress_1(hNtdll_1, str_NtQueryVirtualMemory); 125 | *(_QWORD *)((char *)Handler + 0x1D) = NtQueryVirtualMemory_1; 126 | *(_QWORD *)((char *)Handler + 0x2F) = GetModuleHandleA_1(0i64); 127 | Vectored_Handler = AddVectoredExceptionHandler(1u, Handler); 128 | if ( Vectored_Handler ) 129 | { 130 | memset(functions, 0, sizeof(functions)); 131 | strcpy(str_USER32, "USER32.dll"); 132 | hUSER32l = GetModuleHandleA_1(str_USER32); 133 | strcpy(str_GetAsyncKeyState, "GetAsyncKeyState"); 134 | functions[0] = (__int64)GetProcAddress_1(hUSER32l, str_GetAsyncKeyState); 135 | strcpy(str_GetCursorPos, "GetCursorPos"); 136 | functions[1] = (__int64)GetProcAddress_1(hUSER32l, str_GetCursorPos); 137 | strcpy(str_IsBadReadPtr, "IsBadReadPtr"); 138 | functions[2] = (__int64)GetProcAddress_1(hkernel32, str_IsBadReadPtr); 139 | strcpy(str_win32u, "win32u.dll"); 140 | hWin32u = GetModuleHandleA_1(str_win32u); 141 | strcpy(str_NtUserGetAsyncKeyState, "NtUserGetAsyncKeyState"); 142 | functions[3] = (__int64)GetProcAddress_1(hWin32u, str_NtUserGetAsyncKeyState); 143 | strcpy(str_GetForegroundWindow, "GetForegroundWindow"); 144 | functions[4] = (__int64)GetProcAddress_1(hUSER32l, str_GetForegroundWindow); 145 | strcpy(str_CallWindowProcW, "CallWindowProcW"); 146 | functions[5] = (__int64)GetProcAddress_1(hUSER32l, str_CallWindowProcW); 147 | strcpy(str_NtUserPeekMessage, "NtUserPeekMessage"); 148 | functions[6] = (__int64)GetProcAddress_1(hWin32u, str_NtUserPeekMessage); 149 | strcpy(str_NtSetEvent, "NtSetEvent"); 150 | functions[7] = (__int64)GetProcAddress_1(hNtdll_1, str_NtSetEvent); 151 | for ( i = 6; i <= 7; ++i ) 152 | { 153 | if ( functions[i] ) 154 | { 155 | for ( j = 0; j < 0x20; ++j ) 156 | { 157 | _mm_lfence(); 158 | if ( *(_WORD *)(functions[i] + j) == 0x50F ) 159 | { 160 | _mm_lfence(); 161 | if ( *(unsigned __int8 *)(functions[i] + j + 2) == 0xC3 ) 162 | { 163 | functions[i] += j; 164 | break; 165 | } 166 | } 167 | } 168 | } 169 | } 170 | strcpy(str_UnityPlayer, "UnityPlayer.dll"); 171 | hUnityPlayer = GetModuleHandleA_1(str_UnityPlayer); 172 | *(_QWORD *)((char *)Handler + 0x2F) = hUnityPlayer; 173 | if ( *(_DWORD *)((char *)hUnityPlayer + 0x55B942) == 0xC35B5D5F 174 | && *(_DWORD *)((char *)hUnityPlayer + 0x54B6CB) == 0x48038B48 ) 175 | { 176 | functions[8] = (__int64)hUnityPlayer + 0x55B945;// present_fn retn 177 | } 178 | if ( functions[2] && *(_DWORD *)functions[2] == 0x18EC8348 ) 179 | functions[12] = functions[2] + 4; 180 | array[0] = 0x48; 181 | array[1] = 0x89u; 182 | array[2] = 0x45; 183 | array[3] = 0x58; 184 | array[4] = 0x48; 185 | array[5] = 0x8Bu; 186 | array[6] = 0xCDu; 187 | array[7] = 0x48; 188 | array[8] = 0x8Bu; 189 | array[9] = 0x43; 190 | array[10] = 0x58; 191 | array[11] = 0x48; 192 | array[12] = 0x89u; 193 | array[13] = 0x45; 194 | array[14] = 0x60; 195 | array[15] = 0x48; 196 | array[16] = 0x8Bu; 197 | array[17] = 0x53; 198 | array[18] = 0x58; 199 | array[19] = 0x48; 200 | array[20] = 0x8Bu; 201 | array[21] = 0x43; 202 | array[22] = 0x50; 203 | array[23] = 0xFFu; 204 | array[24] = 0x15; 205 | ntdll_nt_headers = (__int64)hNtdll_1 + *((int *)hNtdll_1 + 0xF) + 0x18; 206 | ntdll_code_section_start = (__int64)hNtdll_1 + *(unsigned int *)(ntdll_nt_headers + 0x14); 207 | for ( k = 0; k + 0x19i64 <= (unsigned __int64)*(unsigned int *)(ntdll_nt_headers + 4); ++k ) 208 | { 209 | for ( l = 0; (unsigned __int64)l < 0x19 && *(unsigned __int8 *)(ntdll_code_section_start + l + k) == array[l]; ++l ) 210 | ; 211 | if ( l == 0x19i64 ) 212 | { 213 | functions[13] = k + ntdll_code_section_start + l - 2;// call cs:__guard_dispatch_icall_fptr 214 | break; 215 | } 216 | } 217 | strcpy(str_ucrtbase, "ucrtbase.dll"); 218 | hUcrtbase = GetModuleHandleA_1(str_ucrtbase); 219 | if ( hUcrtbase ) 220 | { 221 | strcpy(str_sqrtf, "sqrtf"); 222 | functions[14] = (__int64)GetProcAddress_1(hUcrtbase, str_sqrtf); 223 | strcpy(str_vsprintf_s, "__stdio_common_vsprintf_s"); 224 | functions[15] = (__int64)GetProcAddress_1(hUcrtbase, str_vsprintf_s); 225 | } 226 | strcpy(str_dxgi, "dxgi.dll"); 227 | hDxgi = GetModuleHandleA_1(str_dxgi); 228 | if ( hDxgi ) 229 | { 230 | array_1[0] = 0x48; 231 | array_1[1] = 0x83u; 232 | array_1[2] = 0xC1u; 233 | array_1[3] = 0x80u; 234 | array_1[4] = 0x48; 235 | array_1[5] = 0xFFu; 236 | array_1[6] = 0x25; 237 | dxgi_nt_headers = (__int64)hDxgi + *((int *)hDxgi + 0xF) + 0x18; 238 | dxgi_code_section_start = (__int64)hDxgi + *(unsigned int *)(dxgi_nt_headers + 0x14); 239 | for ( m = 0; m + 7i64 <= (unsigned __int64)*(unsigned int *)(dxgi_nt_headers + 4); ++m ) 240 | { 241 | for ( n = 0; (unsigned __int64)n < 7 && *(unsigned __int8 *)(dxgi_code_section_start + n + m) == array_1[n]; ++n ) 242 | ; 243 | if ( n == 7i64 ) 244 | { 245 | functions[16] = m + dxgi_code_section_start;// CDXGIFactory::TakeLock add rcx, 0FFFFFFFFFFFFFF80h 246 | break; 247 | } 248 | } 249 | } 250 | str_CallWindowProcW[14] = 0x41; 251 | functions[18] = (__int64)GetProcAddress_1(hUSER32l, str_CallWindowProcW); 252 | strcpy(str_d3d11, "d3d11.dll"); 253 | hD3d11 = GetModuleHandleA_1(str_d3d11); 254 | if ( hD3d11 ) 255 | { 256 | array_2[0] = 0; 257 | array_2[1] = 0; 258 | array_2[2] = 0x45; 259 | array_2[3] = 0x33; 260 | array_2[4] = 0xC9u; 261 | array_2[5] = 0x44; 262 | array_2[6] = 0x3B; 263 | array_2[7] = 0xD0u; 264 | array_2[8] = 0x77; 265 | array_2[9] = 8; 266 | d3d11_nt_headers = (__int64)hD3d11 + *((int *)hD3d11 + 0xF) + 0x18; 267 | d3d11_code_section_start = (__int64)hD3d11 + *(unsigned int *)(d3d11_nt_headers + 0x14); 268 | for ( ii = 0; ii + 0xAi64 <= (unsigned __int64)*(unsigned int *)(d3d11_nt_headers + 4); ++ii ) 269 | { 270 | for ( jj = 0; 271 | (unsigned __int64)jj < 0xA && *(unsigned __int8 *)(d3d11_code_section_start + jj + ii) == array_2[jj]; 272 | ++jj ) 273 | { 274 | ; 275 | } 276 | if ( jj == 0xAi64 ) 277 | { 278 | functions[19] = d3d11_code_section_start + ii - 0x13;// CContext::TID3D11DeviceContext_RSGetViewports lea rbx, [rcx-0D8h] 279 | break; 280 | } 281 | } 282 | array_3[0] = 0x48; 283 | array_3[1] = 0x83u; 284 | array_3[2] = 0xC1u; 285 | array_3[3] = 0x10; 286 | array_3[4] = 0x48; 287 | array_3[5] = 0xFFu; 288 | array_3[6] = 0x25; 289 | for ( kk = 0; kk + 7i64 <= (unsigned __int64)*(unsigned int *)(d3d11_nt_headers + 4); ++kk ) 290 | { 291 | for ( ll = 0; 292 | (unsigned __int64)ll < 7 && *(unsigned __int8 *)(d3d11_code_section_start + ll + kk) == array_3[ll];// NOutermost::CDevice::LOEnter add rcx, 10h 293 | ++ll ) 294 | { 295 | ; 296 | } 297 | if ( ll == 7i64 ) 298 | { 299 | functions[20] = kk + d3d11_code_section_start; 300 | break; 301 | } 302 | } 303 | } 304 | strcpy(str_Sleep, "Sleep"); 305 | Sleep = (void (__stdcall *)(DWORD))GetProcAddress_1(hkernel32, str_Sleep); 306 | strcpy(str_NtProtectVirtualMemory, "NtProtectVirtualMemory"); 307 | NtProtectVirtualMemory = (NTSTATUS (__stdcall *)(HANDLE, PVOID *, PULONG, ULONG, PULONG))GetProcAddress_1( 308 | hNtdll_1, 309 | str_NtProtectVirtualMemory); 310 | for ( index = 0; *last_status_1 && (unsigned __int64)index < 0x16; ++index ) 311 | { 312 | if ( functions[index] ) 313 | { 314 | *(_QWORD *)NumberOfBytesToProtect = 1i64; 315 | BaseAddress = (PVOID)functions[index]; 316 | if ( NtProtectVirtualMemory((HANDLE)-1i64, &BaseAddress, NumberOfBytesToProtect, 0x40u, &NewAccessProtection) >= 0 ) 317 | { 318 | *((_BYTE *)Handler + 0x40) = index; 319 | byte_copy = *(_BYTE *)functions[index]; 320 | *((_BYTE *)Handler + 0x45) = byte_copy; 321 | *(_BYTE *)functions[index] = 0xCCu; 322 | if ( index != 6 && index != 7 && index != 8 ) 323 | { 324 | for ( mm = 0; *last_status_1; ++mm ) 325 | { 326 | unknown = index == 19 ? 400 : 200; 327 | if ( mm >= unknown ) 328 | break; 329 | Sleep(5u); 330 | if ( *(unsigned __int8 *)functions[index] != 0xCC ) 331 | *(_BYTE *)functions[index] = 0xCCu; 332 | } 333 | } 334 | else 335 | { 336 | Sleep(0x3E8u); 337 | } 338 | *(_BYTE *)functions[index] = byte_copy; 339 | Sleep(0x3E8u); 340 | NtProtectVirtualMemory( 341 | (HANDLE)-1i64, 342 | &BaseAddress, 343 | NumberOfBytesToProtect, 344 | NewAccessProtection, 345 | &NewAccessProtection); 346 | } 347 | } 348 | } 349 | strcpy(str_RemoveVectoredExceptionHandler, "RemoveVectoredExceptionHandler"); 350 | RemoveVectoredExceptionHandler = (ULONG (__stdcall *)(PVOID))GetProcAddress_1( 351 | hkernel32, 352 | str_RemoveVectoredExceptionHandler); 353 | RemoveVectoredExceptionHandler(Vectored_Handler); 354 | Sleep(0x64u); 355 | } 356 | } 357 | } 358 | 359 | //----- (00000000000018A8) ---------------------------------------------------- 360 | LONG __fastcall VectoredHandler(_EXCEPTION_POINTERS *exception) 361 | { 362 | LONG result; // eax 363 | __int64 *caller_function; // [rsp+38h] [rbp-1E0h] 364 | bool call_failed; // [rsp+44h] [rbp-1D4h] 365 | __int32 region_size; // [rsp+48h] [rbp-1D0h] 366 | __int32 memory_info; // [rsp+4Ch] [rbp-1CCh] 367 | _BYTE *unknown_check; // [rsp+60h] [rbp-1B8h] 368 | PVOID allocation_base; // [rsp+68h] [rbp-1B0h] 369 | PVOID base_address; // [rsp+70h] [rbp-1A8h] 370 | _BYTE *unknown_check_1; // [rsp+78h] [rbp-1A0h] 371 | battleye_stack_report report; // [rsp+80h] [rbp-198h] 372 | battleye_stack_report report_1; // [rsp+D0h] [rbp-148h] 373 | battleye_stack_report report_2; // [rsp+120h] [rbp-F8h] 374 | NTSTATUS (__stdcall *NtQueryVirtualMemory)(HANDLE, PVOID, ULONG, PVOID, SIZE_T, PSIZE_T); // [rsp+170h] [rbp-A8h] 375 | MEMORY_BASIC_INFORMATION MemoryInformation; // [rsp+178h] [rbp-A0h] 376 | __int64 v15; // [rsp+200h] [rbp-18h] 377 | ULONG_PTR ReturnLength; // [rsp+208h] [rbp-10h] 378 | _EXCEPTION_POINTERS *exception_1; // [rsp+220h] [rbp+8h] 379 | 380 | exception_1 = exception; 381 | NtQueryVirtualMemory = (NTSTATUS (__stdcall *)(HANDLE, PVOID, ULONG, PVOID, SIZE_T, PSIZE_T))0x7FFC1FD9C4C0i64; 382 | if ( exception->ExceptionRecord->ExceptionCode == 0x80000003 ) 383 | { 384 | *(_BYTE *)exception->ContextRecord->Rip = 0x44; 385 | 386 | unknown_check = (char *)unknown_fn() + 3; 387 | if ( *unknown_check ) 388 | { 389 | caller_function = *(__int64 **)exception_1->ContextRecord->Rsp; 390 | call_failed = NtQueryVirtualMemory((HANDLE)-1i64, caller_function, 0, &MemoryInformation, 0x30ui64, &ReturnLength) < 0; 391 | if ( call_failed 392 | || MemoryInformation.State != 0x1000 393 | || MemoryInformation.Type != 0x1000000 && MemoryInformation.RegionSize > 0x2000 394 | || *(_WORD *)caller_function == 0x23FF 395 | || *(_WORD *)caller_function == 0x26FF 396 | || *(_WORD *)caller_function == 0x27FF 397 | || *(_WORD *)caller_function == 0x65FF 398 | || *(unsigned __int16 *)caller_function == 0xE3FF ) 399 | { 400 | *unknown_check = 0xB; 401 | report.unknown = 0; 402 | report.report_id = 0x31; 403 | report.hook_id = 51; 404 | report.caller = (__int64)caller_function; 405 | report.function_dump[0] = *caller_function; 406 | report.function_dump[1] = caller_function[1]; 407 | report.function_dump[2] = caller_function[2]; 408 | report.function_dump[3] = caller_function[3]; 409 | if ( call_failed ) 410 | allocation_base = 0i64; 411 | else 412 | allocation_base = MemoryInformation.AllocationBase; 413 | report.allocation_base = (__int64)allocation_base; 414 | if ( call_failed ) 415 | base_address = 0i64; 416 | else 417 | base_address = MemoryInformation.BaseAddress; 418 | report.base_address = (__int64)base_address; 419 | if ( call_failed ) 420 | region_size = 0; 421 | else 422 | region_size = MemoryInformation.RegionSize; 423 | report.region_size = region_size; 424 | if ( call_failed ) 425 | memory_info = 0; 426 | else 427 | memory_info = MemoryInformation.Type | MemoryInformation.Protect | MemoryInformation.State; 428 | report.type_protect_state = memory_info; 429 | SendReport(&report, 0x43i64, 0i64); 430 | } 431 | } 432 | result = -1; 433 | } 434 | else if ( exception->ExceptionRecord->ExceptionCode == 0x80000004 ) 435 | { 436 | if ( exception->ContextRecord->Rip >= 0x8000000000000000ui64 ) 437 | { 438 | report_1.unknown = 0; 439 | report_1.report_id = 0x31; 440 | report_1.hook_id = 51; 441 | report_1.caller = exception->ContextRecord->Rip; 442 | report_1.function_dump[0] = *(_QWORD *)report_1.caller; 443 | report_1.function_dump[1] = *(_QWORD *)(report_1.caller + 8); 444 | report_1.function_dump[2] = *(_QWORD *)(report_1.caller + 16); 445 | report_1.function_dump[3] = *(_QWORD *)(report_1.caller + 24); 446 | report_1.allocation_base = 0i64; 447 | report_1.base_address = 0i64; 448 | report_1.region_size = 0; 449 | report_1.type_protect_state = 0; 450 | SendReport(&report_1, 0x43i64, 0i64); 451 | } 452 | result = -1; 453 | } 454 | else 455 | { 456 | if ( exception->ExceptionRecord->ExceptionCode == 0xC0000005 457 | && *(_DWORD *)exception->ContextRecord->Rip == 0x70408B48 ) 458 | { 459 | unknown_check_1 = (char *)unknown_fn() + 3; 460 | if ( *unknown_check_1 ) 461 | { 462 | *unknown_check_1 = 0xB; 463 | report_2.unknown = 0; 464 | report_2.report_id = 0x31; 465 | report_2.hook_id = -1; 466 | report_2.caller = exception_1->ContextRecord->Rip - 3; 467 | report_2.function_dump[0] = *(_QWORD *)report_2.caller; 468 | report_2.function_dump[1] = *(_QWORD *)(report_2.caller + 8); 469 | report_2.function_dump[2] = *(_QWORD *)(report_2.caller + 16); 470 | report_2.function_dump[3] = *(_QWORD *)(report_2.caller + 24); 471 | report_2.allocation_base = 0i64; 472 | report_2.base_address = 0i64; 473 | report_2.region_size = 0; 474 | report_2.type_protect_state = 0; 475 | SendReport(&report_2, 67i64, 0i64); 476 | } 477 | } 478 | result = 0; 479 | } 480 | return result; 481 | } 482 | 483 | 484 | void *unknown_fn() 485 | { 486 | void *retaddr; // [rsp+0h] [rbp+0h] 487 | 488 | return retaddr; 489 | } 490 | --------------------------------------------------------------------------------