├── CMakeLists.txt ├── LICENSE ├── readme.md └── src ├── Vendor.hpp ├── primal ├── runtime │ ├── RuntimeEngine.cpp │ ├── RuntimeEngine.hpp │ └── reconstructor │ │ ├── Reconstructor.hpp │ │ └── reconstructors │ │ ├── IATReconstructor.cpp │ │ ├── IATReconstructor.hpp │ │ ├── RelocReconstructor.cpp │ │ └── RelocReconstructor.hpp ├── segment │ ├── SegmentTranslator.hpp │ └── internal │ │ ├── SegmentNativeData.cpp │ │ └── SegmentProvider.hpp └── util │ ├── CommonUtil.cpp │ ├── CommonUtil.hpp │ ├── PanicUtil.cpp │ ├── PanicUtil.hpp │ └── stuff │ ├── RuntimeDefinitions.cpp │ ├── RuntimeDefinitions.hpp │ └── Singleton.hpp └── segment ├── data ├── FataSegment.cpp ├── FataSegment.hpp └── sections │ ├── IAT.cpp │ ├── Reloc.cpp │ └── SectionAccessor.hpp ├── internal ├── SegmentInterpreter.hpp └── framework │ ├── FataEngine.cpp │ └── FataEngine.hpp └── loader └── bootstrap ├── Bootstrap.cpp ├── BootstrapTaskController.cpp └── BootstrapTaskController.hpp /CMakeLists.txt: -------------------------------------------------------------------------------- 1 | cmake_minimum_required(VERSION 3.16.5) 2 | 3 | #From scratch to sky. 4 | project(ftc-pl) 5 | set(CMAKE_CXX_STANDARD 14) 6 | 7 | #Loader. 8 | set( 9 | 10 | PRIMAL_LOADER_SOURCE 11 | 12 | #Segment data. 13 | src/primal/segment/internal/SegmentNativeData.cpp 14 | 15 | #Runtime handler's. 16 | src/primal/runtime/reconstructor/Reconstructor.hpp 17 | src/primal/runtime/reconstructor/reconstructors/IATReconstructor.cpp 18 | src/primal/runtime/reconstructor/reconstructors/RelocReconstructor.cpp 19 | src/primal/runtime/RuntimeEngine.cpp 20 | 21 | #Utils. 22 | src/primal/util/stuff/RuntimeDefinitions.cpp 23 | src/primal/util/CommonUtil.cpp 24 | src/primal/util/PanicUtil.cpp 25 | 26 | ) 27 | 28 | #Segment. 29 | set( 30 | FATA_SEGMENT_SOURCE 31 | 32 | #Segment data. 33 | src/segment/data/sections/IAT.cpp 34 | src/segment/data/sections/Reloc.cpp 35 | src/segment/data/FataSegment.cpp 36 | 37 | #Boot. 38 | src/segment/loader/bootstrap/Bootstrap.cpp 39 | src/segment/loader/bootstrap/BootstrapTaskController.cpp 40 | 41 | #Framework routine. 42 | src/segment/internal/framework/FataEngine.cpp 43 | 44 | ) 45 | 46 | #Build. 47 | add_library(ftc-pl SHARED ${PRIMAL_LOADER_SOURCE} ${FATA_SEGMENT_SOURCE}) -------------------------------------------------------------------------------- /LICENSE: -------------------------------------------------------------------------------- 1 | GNU GENERAL PUBLIC LICENSE 2 | Version 3, 29 June 2007 3 | 4 | Copyright (C) 2007 Free Software Foundation, Inc. 5 | Everyone is permitted to copy and distribute verbatim copies 6 | of this license document, but changing it is not allowed. 7 | 8 | Preamble 9 | 10 | The GNU General Public License is a free, copyleft license for 11 | software and other kinds of works. 12 | 13 | The licenses for most software and other practical works are designed 14 | to take away your freedom to share and change the works. By contrast, 15 | the GNU General Public License is intended to guarantee your freedom to 16 | share and change all versions of a program--to make sure it remains free 17 | software for all its users. We, the Free Software Foundation, use the 18 | GNU General Public License for most of our software; it applies also to 19 | any other work released this way by its authors. You can apply it to 20 | your programs, too. 21 | 22 | When we speak of free software, we are referring to freedom, not 23 | price. Our General Public Licenses are designed to make sure that you 24 | have the freedom to distribute copies of free software (and charge for 25 | them if you wish), that you receive source code or can get it if you 26 | want it, that you can change the software or use pieces of it in new 27 | free programs, and that you know you can do these things. 28 | 29 | To protect your rights, we need to prevent others from denying you 30 | these rights or asking you to surrender the rights. Therefore, you have 31 | certain responsibilities if you distribute copies of the software, or if 32 | you modify it: responsibilities to respect the freedom of others. 33 | 34 | For example, if you distribute copies of such a program, whether 35 | gratis or for a fee, you must pass on to the recipients the same 36 | freedoms that you received. You must make sure that they, too, receive 37 | or can get the source code. And you must show them these terms so they 38 | know their rights. 39 | 40 | Developers that use the GNU GPL protect your rights with two steps: 41 | (1) assert copyright on the software, and (2) offer you this License 42 | giving you legal permission to copy, distribute and/or modify it. 43 | 44 | For the developers' and authors' protection, the GPL clearly explains 45 | that there is no warranty for this free software. For both users' and 46 | authors' sake, the GPL requires that modified versions be marked as 47 | changed, so that their problems will not be attributed erroneously to 48 | authors of previous versions. 49 | 50 | Some devices are designed to deny users access to install or run 51 | modified versions of the software inside them, although the manufacturer 52 | can do so. This is fundamentally incompatible with the aim of 53 | protecting users' freedom to change the software. The systematic 54 | pattern of such abuse occurs in the area of products for individuals to 55 | use, which is precisely where it is most unacceptable. Therefore, we 56 | have designed this version of the GPL to prohibit the practice for those 57 | products. If such problems arise substantially in other domains, we 58 | stand ready to extend this provision to those domains in future versions 59 | of the GPL, as needed to protect the freedom of users. 60 | 61 | Finally, every program is threatened constantly by software patents. 62 | States should not allow patents to restrict development and use of 63 | software on general-purpose computers, but in those that do, we wish to 64 | avoid the special danger that patents applied to a free program could 65 | make it effectively proprietary. To prevent this, the GPL assures that 66 | patents cannot be used to render the program non-free. 67 | 68 | The precise terms and conditions for copying, distribution and 69 | modification follow. 70 | 71 | TERMS AND CONDITIONS 72 | 73 | 0. Definitions. 74 | 75 | "This License" refers to version 3 of the GNU General Public License. 76 | 77 | "Copyright" also means copyright-like laws that apply to other kinds of 78 | works, such as semiconductor masks. 79 | 80 | "The Program" refers to any copyrightable work licensed under this 81 | License. Each licensee is addressed as "you". "Licensees" and 82 | "recipients" may be individuals or organizations. 83 | 84 | To "modify" a work means to copy from or adapt all or part of the work 85 | in a fashion requiring copyright permission, other than the making of an 86 | exact copy. The resulting work is called a "modified version" of the 87 | earlier work or a work "based on" the earlier work. 88 | 89 | A "covered work" means either the unmodified Program or a work based 90 | on the Program. 91 | 92 | To "propagate" a work means to do anything with it that, without 93 | permission, would make you directly or secondarily liable for 94 | infringement under applicable copyright law, except executing it on a 95 | computer or modifying a private copy. Propagation includes copying, 96 | distribution (with or without modification), making available to the 97 | public, and in some countries other activities as well. 98 | 99 | To "convey" a work means any kind of propagation that enables other 100 | parties to make or receive copies. Mere interaction with a user through 101 | a computer network, with no transfer of a copy, is not conveying. 102 | 103 | An interactive user interface displays "Appropriate Legal Notices" 104 | to the extent that it includes a convenient and prominently visible 105 | feature that (1) displays an appropriate copyright notice, and (2) 106 | tells the user that there is no warranty for the work (except to the 107 | extent that warranties are provided), that licensees may convey the 108 | work under this License, and how to view a copy of this License. If 109 | the interface presents a list of user commands or options, such as a 110 | menu, a prominent item in the list meets this criterion. 111 | 112 | 1. Source Code. 113 | 114 | The "source code" for a work means the preferred form of the work 115 | for making modifications to it. "Object code" means any non-source 116 | form of a work. 117 | 118 | A "Standard Interface" means an interface that either is an official 119 | standard defined by a recognized standards body, or, in the case of 120 | interfaces specified for a particular programming language, one that 121 | is widely used among developers working in that language. 122 | 123 | The "System Libraries" of an executable work include anything, other 124 | than the work as a whole, that (a) is included in the normal form of 125 | packaging a Major Component, but which is not part of that Major 126 | Component, and (b) serves only to enable use of the work with that 127 | Major Component, or to implement a Standard Interface for which an 128 | implementation is available to the public in source code form. A 129 | "Major Component", in this context, means a major essential component 130 | (kernel, window system, and so on) of the specific operating system 131 | (if any) on which the executable work runs, or a compiler used to 132 | produce the work, or an object code interpreter used to run it. 133 | 134 | The "Corresponding Source" for a work in object code form means all 135 | the source code needed to generate, install, and (for an executable 136 | work) run the object code and to modify the work, including scripts to 137 | control those activities. However, it does not include the work's 138 | System Libraries, or general-purpose tools or generally available free 139 | programs which are used unmodified in performing those activities but 140 | which are not part of the work. For example, Corresponding Source 141 | includes interface definition files associated with source files for 142 | the work, and the source code for shared libraries and dynamically 143 | linked subprograms that the work is specifically designed to require, 144 | such as by intimate data communication or control flow between those 145 | subprograms and other parts of the work. 146 | 147 | The Corresponding Source need not include anything that users 148 | can regenerate automatically from other parts of the Corresponding 149 | Source. 150 | 151 | The Corresponding Source for a work in source code form is that 152 | same work. 153 | 154 | 2. Basic Permissions. 155 | 156 | All rights granted under this License are granted for the term of 157 | copyright on the Program, and are irrevocable provided the stated 158 | conditions are met. This License explicitly affirms your unlimited 159 | permission to run the unmodified Program. The output from running a 160 | covered work is covered by this License only if the output, given its 161 | content, constitutes a covered work. This License acknowledges your 162 | rights of fair use or other equivalent, as provided by copyright law. 163 | 164 | You may make, run and propagate covered works that you do not 165 | convey, without conditions so long as your license otherwise remains 166 | in force. You may convey covered works to others for the sole purpose 167 | of having them make modifications exclusively for you, or provide you 168 | with facilities for running those works, provided that you comply with 169 | the terms of this License in conveying all material for which you do 170 | not control copyright. Those thus making or running the covered works 171 | for you must do so exclusively on your behalf, under your direction 172 | and control, on terms that prohibit them from making any copies of 173 | your copyrighted material outside their relationship with you. 174 | 175 | Conveying under any other circumstances is permitted solely under 176 | the conditions stated below. Sublicensing is not allowed; section 10 177 | makes it unnecessary. 178 | 179 | 3. Protecting Users' Legal Rights From Anti-Circumvention Law. 180 | 181 | No covered work shall be deemed part of an effective technological 182 | measure under any applicable law fulfilling obligations under article 183 | 11 of the WIPO copyright treaty adopted on 20 December 1996, or 184 | similar laws prohibiting or restricting circumvention of such 185 | measures. 186 | 187 | When you convey a covered work, you waive any legal power to forbid 188 | circumvention of technological measures to the extent such circumvention 189 | is effected by exercising rights under this License with respect to 190 | the covered work, and you disclaim any intention to limit operation or 191 | modification of the work as a means of enforcing, against the work's 192 | users, your or third parties' legal rights to forbid circumvention of 193 | technological measures. 194 | 195 | 4. Conveying Verbatim Copies. 196 | 197 | You may convey verbatim copies of the Program's source code as you 198 | receive it, in any medium, provided that you conspicuously and 199 | appropriately publish on each copy an appropriate copyright notice; 200 | keep intact all notices stating that this License and any 201 | non-permissive terms added in accord with section 7 apply to the code; 202 | keep intact all notices of the absence of any warranty; and give all 203 | recipients a copy of this License along with the Program. 204 | 205 | You may charge any price or no price for each copy that you convey, 206 | and you may offer support or warranty protection for a fee. 207 | 208 | 5. Conveying Modified Source Versions. 209 | 210 | You may convey a work based on the Program, or the modifications to 211 | produce it from the Program, in the form of source code under the 212 | terms of section 4, provided that you also meet all of these conditions: 213 | 214 | a) The work must carry prominent notices stating that you modified 215 | it, and giving a relevant date. 216 | 217 | b) The work must carry prominent notices stating that it is 218 | released under this License and any conditions added under section 219 | 7. This requirement modifies the requirement in section 4 to 220 | "keep intact all notices". 221 | 222 | c) You must license the entire work, as a whole, under this 223 | License to anyone who comes into possession of a copy. This 224 | License will therefore apply, along with any applicable section 7 225 | additional terms, to the whole of the work, and all its parts, 226 | regardless of how they are packaged. This License gives no 227 | permission to license the work in any other way, but it does not 228 | invalidate such permission if you have separately received it. 229 | 230 | d) If the work has interactive user interfaces, each must display 231 | Appropriate Legal Notices; however, if the Program has interactive 232 | interfaces that do not display Appropriate Legal Notices, your 233 | work need not make them do so. 234 | 235 | A compilation of a covered work with other separate and independent 236 | works, which are not by their nature extensions of the covered work, 237 | and which are not combined with it such as to form a larger program, 238 | in or on a volume of a storage or distribution medium, is called an 239 | "aggregate" if the compilation and its resulting copyright are not 240 | used to limit the access or legal rights of the compilation's users 241 | beyond what the individual works permit. Inclusion of a covered work 242 | in an aggregate does not cause this License to apply to the other 243 | parts of the aggregate. 244 | 245 | 6. Conveying Non-Source Forms. 246 | 247 | You may convey a covered work in object code form under the terms 248 | of sections 4 and 5, provided that you also convey the 249 | machine-readable Corresponding Source under the terms of this License, 250 | in one of these ways: 251 | 252 | a) Convey the object code in, or embodied in, a physical product 253 | (including a physical distribution medium), accompanied by the 254 | Corresponding Source fixed on a durable physical medium 255 | customarily used for software interchange. 256 | 257 | b) Convey the object code in, or embodied in, a physical product 258 | (including a physical distribution medium), accompanied by a 259 | written offer, valid for at least three years and valid for as 260 | long as you offer spare parts or customer support for that product 261 | model, to give anyone who possesses the object code either (1) a 262 | copy of the Corresponding Source for all the software in the 263 | product that is covered by this License, on a durable physical 264 | medium customarily used for software interchange, for a price no 265 | more than your reasonable cost of physically performing this 266 | conveying of source, or (2) access to copy the 267 | Corresponding Source from a network server at no charge. 268 | 269 | c) Convey individual copies of the object code with a copy of the 270 | written offer to provide the Corresponding Source. This 271 | alternative is allowed only occasionally and noncommercially, and 272 | only if you received the object code with such an offer, in accord 273 | with subsection 6b. 274 | 275 | d) Convey the object code by offering access from a designated 276 | place (gratis or for a charge), and offer equivalent access to the 277 | Corresponding Source in the same way through the same place at no 278 | further charge. You need not require recipients to copy the 279 | Corresponding Source along with the object code. If the place to 280 | copy the object code is a network server, the Corresponding Source 281 | may be on a different server (operated by you or a third party) 282 | that supports equivalent copying facilities, provided you maintain 283 | clear directions next to the object code saying where to find the 284 | Corresponding Source. Regardless of what server hosts the 285 | Corresponding Source, you remain obligated to ensure that it is 286 | available for as long as needed to satisfy these requirements. 287 | 288 | e) Convey the object code using peer-to-peer transmission, provided 289 | you inform other peers where the object code and Corresponding 290 | Source of the work are being offered to the general public at no 291 | charge under subsection 6d. 292 | 293 | A separable portion of the object code, whose source code is excluded 294 | from the Corresponding Source as a System Library, need not be 295 | included in conveying the object code work. 296 | 297 | A "User Product" is either (1) a "consumer product", which means any 298 | tangible personal property which is normally used for personal, family, 299 | or household purposes, or (2) anything designed or sold for incorporation 300 | into a dwelling. In determining whether a product is a consumer product, 301 | doubtful cases shall be resolved in favor of coverage. For a particular 302 | product received by a particular user, "normally used" refers to a 303 | typical or common use of that class of product, regardless of the status 304 | of the particular user or of the way in which the particular user 305 | actually uses, or expects or is expected to use, the product. A product 306 | is a consumer product regardless of whether the product has substantial 307 | commercial, industrial or non-consumer uses, unless such uses represent 308 | the only significant mode of use of the product. 309 | 310 | "Installation Information" for a User Product means any methods, 311 | procedures, authorization keys, or other information required to install 312 | and execute modified versions of a covered work in that User Product from 313 | a modified version of its Corresponding Source. The information must 314 | suffice to ensure that the continued functioning of the modified object 315 | code is in no case prevented or interfered with solely because 316 | modification has been made. 317 | 318 | If you convey an object code work under this section in, or with, or 319 | specifically for use in, a User Product, and the conveying occurs as 320 | part of a transaction in which the right of possession and use of the 321 | User Product is transferred to the recipient in perpetuity or for a 322 | fixed term (regardless of how the transaction is characterized), the 323 | Corresponding Source conveyed under this section must be accompanied 324 | by the Installation Information. But this requirement does not apply 325 | if neither you nor any third party retains the ability to install 326 | modified object code on the User Product (for example, the work has 327 | been installed in ROM). 328 | 329 | The requirement to provide Installation Information does not include a 330 | requirement to continue to provide support service, warranty, or updates 331 | for a work that has been modified or installed by the recipient, or for 332 | the User Product in which it has been modified or installed. Access to a 333 | network may be denied when the modification itself materially and 334 | adversely affects the operation of the network or violates the rules and 335 | protocols for communication across the network. 336 | 337 | Corresponding Source conveyed, and Installation Information provided, 338 | in accord with this section must be in a format that is publicly 339 | documented (and with an implementation available to the public in 340 | source code form), and must require no special password or key for 341 | unpacking, reading or copying. 342 | 343 | 7. Additional Terms. 344 | 345 | "Additional permissions" are terms that supplement the terms of this 346 | License by making exceptions from one or more of its conditions. 347 | Additional permissions that are applicable to the entire Program shall 348 | be treated as though they were included in this License, to the extent 349 | that they are valid under applicable law. If additional permissions 350 | apply only to part of the Program, that part may be used separately 351 | under those permissions, but the entire Program remains governed by 352 | this License without regard to the additional permissions. 353 | 354 | When you convey a copy of a covered work, you may at your option 355 | remove any additional permissions from that copy, or from any part of 356 | it. (Additional permissions may be written to require their own 357 | removal in certain cases when you modify the work.) You may place 358 | additional permissions on material, added by you to a covered work, 359 | for which you have or can give appropriate copyright permission. 360 | 361 | Notwithstanding any other provision of this License, for material you 362 | add to a covered work, you may (if authorized by the copyright holders of 363 | that material) supplement the terms of this License with terms: 364 | 365 | a) Disclaiming warranty or limiting liability differently from the 366 | terms of sections 15 and 16 of this License; or 367 | 368 | b) Requiring preservation of specified reasonable legal notices or 369 | author attributions in that material or in the Appropriate Legal 370 | Notices displayed by works containing it; or 371 | 372 | c) Prohibiting misrepresentation of the origin of that material, or 373 | requiring that modified versions of such material be marked in 374 | reasonable ways as different from the original version; or 375 | 376 | d) Limiting the use for publicity purposes of names of licensors or 377 | authors of the material; or 378 | 379 | e) Declining to grant rights under trademark law for use of some 380 | trade names, trademarks, or service marks; or 381 | 382 | f) Requiring indemnification of licensors and authors of that 383 | material by anyone who conveys the material (or modified versions of 384 | it) with contractual assumptions of liability to the recipient, for 385 | any liability that these contractual assumptions directly impose on 386 | those licensors and authors. 387 | 388 | All other non-permissive additional terms are considered "further 389 | restrictions" within the meaning of section 10. If the Program as you 390 | received it, or any part of it, contains a notice stating that it is 391 | governed by this License along with a term that is a further 392 | restriction, you may remove that term. If a license document contains 393 | a further restriction but permits relicensing or conveying under this 394 | License, you may add to a covered work material governed by the terms 395 | of that license document, provided that the further restriction does 396 | not survive such relicensing or conveying. 397 | 398 | If you add terms to a covered work in accord with this section, you 399 | must place, in the relevant source files, a statement of the 400 | additional terms that apply to those files, or a notice indicating 401 | where to find the applicable terms. 402 | 403 | Additional terms, permissive or non-permissive, may be stated in the 404 | form of a separately written license, or stated as exceptions; 405 | the above requirements apply either way. 406 | 407 | 8. Termination. 408 | 409 | You may not propagate or modify a covered work except as expressly 410 | provided under this License. Any attempt otherwise to propagate or 411 | modify it is void, and will automatically terminate your rights under 412 | this License (including any patent licenses granted under the third 413 | paragraph of section 11). 414 | 415 | However, if you cease all violation of this License, then your 416 | license from a particular copyright holder is reinstated (a) 417 | provisionally, unless and until the copyright holder explicitly and 418 | finally terminates your license, and (b) permanently, if the copyright 419 | holder fails to notify you of the violation by some reasonable means 420 | prior to 60 days after the cessation. 421 | 422 | Moreover, your license from a particular copyright holder is 423 | reinstated permanently if the copyright holder notifies you of the 424 | violation by some reasonable means, this is the first time you have 425 | received notice of violation of this License (for any work) from that 426 | copyright holder, and you cure the violation prior to 30 days after 427 | your receipt of the notice. 428 | 429 | Termination of your rights under this section does not terminate the 430 | licenses of parties who have received copies or rights from you under 431 | this License. If your rights have been terminated and not permanently 432 | reinstated, you do not qualify to receive new licenses for the same 433 | material under section 10. 434 | 435 | 9. Acceptance Not Required for Having Copies. 436 | 437 | You are not required to accept this License in order to receive or 438 | run a copy of the Program. Ancillary propagation of a covered work 439 | occurring solely as a consequence of using peer-to-peer transmission 440 | to receive a copy likewise does not require acceptance. However, 441 | nothing other than this License grants you permission to propagate or 442 | modify any covered work. These actions infringe copyright if you do 443 | not accept this License. Therefore, by modifying or propagating a 444 | covered work, you indicate your acceptance of this License to do so. 445 | 446 | 10. Automatic Licensing of Downstream Recipients. 447 | 448 | Each time you convey a covered work, the recipient automatically 449 | receives a license from the original licensors, to run, modify and 450 | propagate that work, subject to this License. You are not responsible 451 | for enforcing compliance by third parties with this License. 452 | 453 | An "entity transaction" is a transaction transferring control of an 454 | organization, or substantially all assets of one, or subdividing an 455 | organization, or merging organizations. If propagation of a covered 456 | work results from an entity transaction, each party to that 457 | transaction who receives a copy of the work also receives whatever 458 | licenses to the work the party's predecessor in interest had or could 459 | give under the previous paragraph, plus a right to possession of the 460 | Corresponding Source of the work from the predecessor in interest, if 461 | the predecessor has it or can get it with reasonable efforts. 462 | 463 | You may not impose any further restrictions on the exercise of the 464 | rights granted or affirmed under this License. For example, you may 465 | not impose a license fee, royalty, or other charge for exercise of 466 | rights granted under this License, and you may not initiate litigation 467 | (including a cross-claim or counterclaim in a lawsuit) alleging that 468 | any patent claim is infringed by making, using, selling, offering for 469 | sale, or importing the Program or any portion of it. 470 | 471 | 11. Patents. 472 | 473 | A "contributor" is a copyright holder who authorizes use under this 474 | License of the Program or a work on which the Program is based. The 475 | work thus licensed is called the contributor's "contributor version". 476 | 477 | A contributor's "essential patent claims" are all patent claims 478 | owned or controlled by the contributor, whether already acquired or 479 | hereafter acquired, that would be infringed by some manner, permitted 480 | by this License, of making, using, or selling its contributor version, 481 | but do not include claims that would be infringed only as a 482 | consequence of further modification of the contributor version. For 483 | purposes of this definition, "control" includes the right to grant 484 | patent sublicenses in a manner consistent with the requirements of 485 | this License. 486 | 487 | Each contributor grants you a non-exclusive, worldwide, royalty-free 488 | patent license under the contributor's essential patent claims, to 489 | make, use, sell, offer for sale, import and otherwise run, modify and 490 | propagate the contents of its contributor version. 491 | 492 | In the following three paragraphs, a "patent license" is any express 493 | agreement or commitment, however denominated, not to enforce a patent 494 | (such as an express permission to practice a patent or covenant not to 495 | sue for patent infringement). To "grant" such a patent license to a 496 | party means to make such an agreement or commitment not to enforce a 497 | patent against the party. 498 | 499 | If you convey a covered work, knowingly relying on a patent license, 500 | and the Corresponding Source of the work is not available for anyone 501 | to copy, free of charge and under the terms of this License, through a 502 | publicly available network server or other readily accessible means, 503 | then you must either (1) cause the Corresponding Source to be so 504 | available, or (2) arrange to deprive yourself of the benefit of the 505 | patent license for this particular work, or (3) arrange, in a manner 506 | consistent with the requirements of this License, to extend the patent 507 | license to downstream recipients. "Knowingly relying" means you have 508 | actual knowledge that, but for the patent license, your conveying the 509 | covered work in a country, or your recipient's use of the covered work 510 | in a country, would infringe one or more identifiable patents in that 511 | country that you have reason to believe are valid. 512 | 513 | If, pursuant to or in connection with a single transaction or 514 | arrangement, you convey, or propagate by procuring conveyance of, a 515 | covered work, and grant a patent license to some of the parties 516 | receiving the covered work authorizing them to use, propagate, modify 517 | or convey a specific copy of the covered work, then the patent license 518 | you grant is automatically extended to all recipients of the covered 519 | work and works based on it. 520 | 521 | A patent license is "discriminatory" if it does not include within 522 | the scope of its coverage, prohibits the exercise of, or is 523 | conditioned on the non-exercise of one or more of the rights that are 524 | specifically granted under this License. You may not convey a covered 525 | work if you are a party to an arrangement with a third party that is 526 | in the business of distributing software, under which you make payment 527 | to the third party based on the extent of your activity of conveying 528 | the work, and under which the third party grants, to any of the 529 | parties who would receive the covered work from you, a discriminatory 530 | patent license (a) in connection with copies of the covered work 531 | conveyed by you (or copies made from those copies), or (b) primarily 532 | for and in connection with specific products or compilations that 533 | contain the covered work, unless you entered into that arrangement, 534 | or that patent license was granted, prior to 28 March 2007. 535 | 536 | Nothing in this License shall be construed as excluding or limiting 537 | any implied license or other defenses to infringement that may 538 | otherwise be available to you under applicable patent law. 539 | 540 | 12. No Surrender of Others' Freedom. 541 | 542 | If conditions are imposed on you (whether by court order, agreement or 543 | otherwise) that contradict the conditions of this License, they do not 544 | excuse you from the conditions of this License. If you cannot convey a 545 | covered work so as to satisfy simultaneously your obligations under this 546 | License and any other pertinent obligations, then as a consequence you may 547 | not convey it at all. For example, if you agree to terms that obligate you 548 | to collect a royalty for further conveying from those to whom you convey 549 | the Program, the only way you could satisfy both those terms and this 550 | License would be to refrain entirely from conveying the Program. 551 | 552 | 13. Use with the GNU Affero General Public License. 553 | 554 | Notwithstanding any other provision of this License, you have 555 | permission to link or combine any covered work with a work licensed 556 | under version 3 of the GNU Affero General Public License into a single 557 | combined work, and to convey the resulting work. The terms of this 558 | License will continue to apply to the part which is the covered work, 559 | but the special requirements of the GNU Affero General Public License, 560 | section 13, concerning interaction through a network will apply to the 561 | combination as such. 562 | 563 | 14. Revised Versions of this License. 564 | 565 | The Free Software Foundation may publish revised and/or new versions of 566 | the GNU General Public License from time to time. Such new versions will 567 | be similar in spirit to the present version, but may differ in detail to 568 | address new problems or concerns. 569 | 570 | Each version is given a distinguishing version number. If the 571 | Program specifies that a certain numbered version of the GNU General 572 | Public License "or any later version" applies to it, you have the 573 | option of following the terms and conditions either of that numbered 574 | version or of any later version published by the Free Software 575 | Foundation. If the Program does not specify a version number of the 576 | GNU General Public License, you may choose any version ever published 577 | by the Free Software Foundation. 578 | 579 | If the Program specifies that a proxy can decide which future 580 | versions of the GNU General Public License can be used, that proxy's 581 | public statement of acceptance of a version permanently authorizes you 582 | to choose that version for the Program. 583 | 584 | Later license versions may give you additional or different 585 | permissions. However, no additional obligations are imposed on any 586 | author or copyright holder as a result of your choosing to follow a 587 | later version. 588 | 589 | 15. Disclaimer of Warranty. 590 | 591 | THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY 592 | APPLICABLE LAW. EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT 593 | HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY 594 | OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, 595 | THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR 596 | PURPOSE. THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM 597 | IS WITH YOU. SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF 598 | ALL NECESSARY SERVICING, REPAIR OR CORRECTION. 599 | 600 | 16. Limitation of Liability. 601 | 602 | IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING 603 | WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS 604 | THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY 605 | GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE 606 | USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF 607 | DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD 608 | PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS), 609 | EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF 610 | SUCH DAMAGES. 611 | 612 | 17. Interpretation of Sections 15 and 16. 613 | 614 | If the disclaimer of warranty and limitation of liability provided 615 | above cannot be given local legal effect according to their terms, 616 | reviewing courts shall apply local law that most closely approximates 617 | an absolute waiver of all civil liability in connection with the 618 | Program, unless a warranty or assumption of liability accompanies a 619 | copy of the Program in return for a fee. 620 | 621 | END OF TERMS AND CONDITIONS 622 | 623 | How to Apply These Terms to Your New Programs 624 | 625 | If you develop a new program, and you want it to be of the greatest 626 | possible use to the public, the best way to achieve this is to make it 627 | free software which everyone can redistribute and change under these terms. 628 | 629 | To do so, attach the following notices to the program. It is safest 630 | to attach them to the start of each source file to most effectively 631 | state the exclusion of warranty; and each file should have at least 632 | the "copyright" line and a pointer to where the full notice is found. 633 | 634 | 635 | Copyright (C) 636 | 637 | This program is free software: you can redistribute it and/or modify 638 | it under the terms of the GNU General Public License as published by 639 | the Free Software Foundation, either version 3 of the License, or 640 | (at your option) any later version. 641 | 642 | This program is distributed in the hope that it will be useful, 643 | but WITHOUT ANY WARRANTY; without even the implied warranty of 644 | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 645 | GNU General Public License for more details. 646 | 647 | You should have received a copy of the GNU General Public License 648 | along with this program. If not, see . 649 | 650 | Also add information on how to contact you by electronic and paper mail. 651 | 652 | If the program does terminal interaction, make it output a short 653 | notice like this when it starts in an interactive mode: 654 | 655 | Copyright (C) 656 | This program comes with ABSOLUTELY NO WARRANTY; for details type `show w'. 657 | This is free software, and you are welcome to redistribute it 658 | under certain conditions; type `show c' for details. 659 | 660 | The hypothetical commands `show w' and `show c' should show the appropriate 661 | parts of the General Public License. Of course, your program's commands 662 | might be different; for a GUI interface, you would use an "about box". 663 | 664 | You should also get your employer (if you work as a programmer) or school, 665 | if any, to sign a "copyright disclaimer" for the program, if necessary. 666 | For more information on this, and how to apply and follow the GNU GPL, see 667 | . 668 | 669 | The GNU General Public License does not permit incorporating your program 670 | into proprietary programs. If your program is a subroutine library, you 671 | may consider it more useful to permit linking proprietary applications with 672 | the library. If this is what you want to do, use the GNU Lesser General 673 | Public License instead of this License. But first, please read 674 | . 675 | -------------------------------------------------------------------------------- /readme.md: -------------------------------------------------------------------------------- 1 | ``` 2 | 3 | CPUID. 4 | PRIOR: PRIVATE. 5 | PROJECT: FTC-PL. 6 | 7 | DESCRIPTION: 8 | > "Fatality crack based on primal-loader engine." 9 | 10 | AUTHORS: 11 | > 0x000cb. | Engine. 12 | 13 | ``` -------------------------------------------------------------------------------- /src/Vendor.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | //WinAPI stuff. 4 | #include 5 | #include 6 | #include 7 | #include 8 | #include 9 | #include 10 | #include 11 | #include 12 | #include 13 | #include 14 | #include 15 | #include 16 | #include 17 | #include 18 | 19 | //Legacy utils. 20 | #include "primal/util/CommonUtil.hpp" 21 | #include "primal/util/PanicUtil.hpp" 22 | #include "primal/util/stuff/Singleton.hpp" 23 | #include "primal/util/stuff/RuntimeDefinitions.hpp" -------------------------------------------------------------------------------- /src/primal/runtime/RuntimeEngine.cpp: -------------------------------------------------------------------------------- 1 | #include "RuntimeEngine.hpp" 2 | 3 | void RuntimeEngine::ExtractSegment () { 4 | 5 | //Allocate memory for segment. 6 | int alloca = reinterpret_cast (VirtualAlloc (reinterpret_cast (Primal::AllocParameters.m_base), Primal::AllocParameters.m_size, Primal::AllocParameters.m_type, Primal::AllocParameters.m_protect)); 7 | 8 | //Verify it. 9 | if (alloca == 0x00000000) { 10 | Primal::PanicUtil::Release ("RuntimeEngine@ExtractSegment->VirtualAlloc", "Can't allocate virtual memory."); 11 | } 12 | 13 | //Copy segment into new memory & verify it. 14 | if (!memcpy (reinterpret_cast (alloca), SegmentNativeData, GetSegmentData ().m_size)) { 15 | Primal::PanicUtil::Release ("RuntimeEngine@ExtractSegment->memcpy", "Can't copy segment to allocation memory."); 16 | } 17 | 18 | //Set new global allocation base. 19 | Primal::AllocParameters.m_base = alloca; 20 | 21 | } 22 | 23 | void RuntimeEngine::ExecuteReconstruction () { 24 | 25 | //Check if iat present. 26 | if (!GetReconstructProcessorDefinition().m_iat->empty ()) { 27 | //Do reconstruction... 28 | GetIatReconstructor().ReconstructNative (); 29 | } 30 | 31 | //Check if reloc's array present. 32 | if (GetReconstructProcessorDefinition().m_relocations->m_relocations != 0x00000000) { 33 | //Do reconstruction... 34 | GetRelocReconstructor().ReconstructNative (); 35 | } 36 | 37 | } 38 | 39 | void RuntimeEngine::InvokeOEP () { 40 | 41 | //Set template of oep & set call address. 42 | AdditionalRuntime::DllEntryPoint EntryPoint = reinterpret_cast (Primal::AllocParameters.m_base + GetSegmentData().m_oep); 43 | 44 | //Call OEP a.k.a DllEntryPoint. 45 | EntryPoint (reinterpret_cast (Primal::AllocParameters.m_base), DLL_PROCESS_ATTACH, NULL); 46 | 47 | } -------------------------------------------------------------------------------- /src/primal/runtime/RuntimeEngine.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../Vendor.hpp" 4 | #include "../segment/internal/SegmentProvider.hpp" 5 | #include "reconstructor/Reconstructor.hpp" 6 | #include "reconstructor/reconstructors/IATReconstructor.hpp" 7 | #include "reconstructor/reconstructors/RelocReconstructor.hpp" 8 | 9 | class RuntimeEngine { 10 | 11 | public: 12 | 13 | RuntimeEngine (Segment& segment) : m_segment (segment) { 14 | 15 | //Setup alloc data. 16 | Primal::AllocParameters = segment.GetAllocationParameters (); 17 | 18 | //Verify segment data. 19 | if ((segment.GetSegmentData().m_oep == 0 || segment.GetSegmentData().m_oep > segment.GetSegmentData().m_size) || segment.GetSegmentData().m_size == 0) { 20 | Primal::PanicUtil::Release ("RuntimeEngine@Constructor->VerifySegmentData.", "Invalid segment parameters. Please re-setup segment data."); 21 | } 22 | 23 | //Verify global allocation parameters data. 24 | if ((Primal::AllocParameters.m_size == 0 || Primal::AllocParameters.m_size < segment.GetSegmentData().m_size) || Primal::AllocParameters.m_type == 0 || Primal::AllocParameters.m_protect == 0) { 25 | Primal::PanicUtil::Release ("RuntimeEngine@Constructor->VerifyAllocaData.", "Invalid allocation parameters. Please re-setup segment allocation settings."); 26 | } 27 | 28 | }; 29 | 30 | /** 31 | * 32 | * @function - ExtractSegment. 33 | * @point - Allocate memory for segment & copy segment into new region. 34 | * 35 | * @function - ExecuteReconstruction. 36 | * @point - Call IATReconstructor and RelocReconstructor. 37 | * 38 | * @function - Invoke OEP. 39 | * @point - Call OriginalEntryPoint. 40 | * 41 | */ 42 | 43 | void ExtractSegment (), ExecuteReconstruction (), InvokeOEP (); 44 | 45 | //Getters. 46 | 47 | Segment::SegmentData GetSegmentData () { 48 | return m_segment.GetSegmentData(); 49 | } 50 | 51 | Segment::ReconstructProcessorDefinition GetReconstructProcessorDefinition () { 52 | return m_segment.GetReconstructProcessorDefinition(); 53 | } 54 | 55 | IATReconstructor GetIatReconstructor () { 56 | return m_iatReconstructor; 57 | } 58 | 59 | RelocReconstructor GetRelocReconstructor () { 60 | return m_relocReconstructor; 61 | } 62 | 63 | private: 64 | 65 | //Segment data. 66 | Segment& m_segment; 67 | 68 | //Reconstructors. 69 | IATReconstructor m_iatReconstructor = IATReconstructor (m_segment); 70 | RelocReconstructor m_relocReconstructor = RelocReconstructor (m_segment); 71 | 72 | }; -------------------------------------------------------------------------------- /src/primal/runtime/reconstructor/Reconstructor.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../../Vendor.hpp" 4 | #include "../../segment/internal/SegmentProvider.hpp" 5 | 6 | //You can provide new reconstructors by this abstract class. 7 | class Reconstructor { 8 | 9 | public: 10 | 11 | Reconstructor (Segment& segment) : m_segment (segment) {}; 12 | 13 | /** 14 | * 15 | * @point - Reconstruct action at call in engine. 16 | * 17 | */ 18 | 19 | virtual void ReconstructNative () = 0; 20 | 21 | protected: 22 | 23 | //Getters. 24 | 25 | AdditionalRuntime::AllocaParameters GetAllocationParameters () { 26 | return Primal::AllocParameters; 27 | } 28 | 29 | Segment& GetSegment () { 30 | return m_segment; 31 | } 32 | 33 | private: 34 | 35 | Segment& m_segment; 36 | 37 | }; -------------------------------------------------------------------------------- /src/primal/runtime/reconstructor/reconstructors/IATReconstructor.cpp: -------------------------------------------------------------------------------- 1 | #include "IATReconstructor.hpp" 2 | 3 | void IATReconstructor::ReconstructNative () { 4 | 5 | /** 6 | * 7 | * @point - Get additional shifting by import type. (!Segment dependency!) 8 | * 9 | * @args - Type: Import type. 10 | * 11 | */ 12 | 13 | auto GetAdditionalTypeRVAShift = [](AdditionalRuntime::ImportType type) { 14 | 15 | switch (type) { 16 | 17 | //Internal and etc. 18 | default: return 0; 19 | 20 | //Segment have +1 shift to all public import's. 21 | case AdditionalRuntime::ImportType::PUBLIC: return 1; 22 | 23 | } 24 | 25 | }; 26 | 27 | //Get import info. 28 | for (const auto& importInfo : *GetImportsInfo ()) { 29 | 30 | //Iterate import table. 31 | for (const auto& iat : importInfo.second) { 32 | 33 | //Get target function address in application. 34 | int function = reinterpret_cast (CommonUtil::GetOrLoadFunction (importInfo.first.c_str (), iat.m_function.c_str ())); 35 | 36 | //Iterate info about relocation's for function. 37 | for (const auto& relocationInfo : iat.m_relocations) { 38 | 39 | //Iterate all rva's for this ImportType of function. 40 | for (const auto& rva : relocationInfo.second) { 41 | 42 | //Parse & set new import address. 43 | *reinterpret_cast (GetAllocationParameters().m_base + rva + GetAdditionalTypeRVAShift (relocationInfo.first)) = GetImportAbsoluteAddress (relocationInfo.first, function, rva); 44 | 45 | } 46 | 47 | } 48 | 49 | } 50 | 51 | } 52 | 53 | } 54 | 55 | int IATReconstructor::GetImportAbsoluteAddress (AdditionalRuntime::ImportType type, int function, int rva) { 56 | 57 | //Parse import type. 58 | switch (type) { 59 | 60 | //JMP or CALL. 61 | default: 62 | case AdditionalRuntime::ImportType::PUBLIC: { 63 | return (function - rva) - GetAllocationParameters().m_base - 5; 64 | }; 65 | 66 | //LEA or MOV. 67 | case AdditionalRuntime::ImportType::INTERNAL: { 68 | return function; 69 | }; 70 | 71 | } 72 | 73 | } -------------------------------------------------------------------------------- /src/primal/runtime/reconstructor/reconstructors/IATReconstructor.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../Reconstructor.hpp" 4 | 5 | class IATReconstructor : public Reconstructor { 6 | 7 | public: 8 | 9 | IATReconstructor (Segment& segment) : Reconstructor (segment) {}; 10 | 11 | //Override handle. 12 | virtual void ReconstructNative () override; 13 | 14 | /** 15 | * 16 | * @point - Calculate absolute address for ImportType type. 17 | * 18 | * @args - Type: Import type of current relocation vector. Function: Function address. RVA: Relocation to function-dependency in segment. 19 | * 20 | **/ 21 | 22 | int GetImportAbsoluteAddress (AdditionalRuntime::ImportType type, int function, int rva); 23 | 24 | private: 25 | 26 | //Getters. 27 | 28 | std::map >* GetImportsInfo () { 29 | return GetSegment().GetReconstructProcessorDefinition().m_iat; 30 | } 31 | 32 | }; -------------------------------------------------------------------------------- /src/primal/runtime/reconstructor/reconstructors/RelocReconstructor.cpp: -------------------------------------------------------------------------------- 1 | #include "RelocReconstructor.hpp" 2 | 3 | void RelocReconstructor::ReconstructNative () { 4 | 5 | //Iterate relocations in memory. (4 bytes as unpacked) 6 | do { 7 | 8 | //Subtract value with old base address in segment from memory. 9 | *reinterpret_cast (GetAllocationParameters().m_base + *GetRelocationsInfo()->m_relocations) -= GetRelocationsInfo()->m_oldAllocationBase; 10 | //Add new base address in segment to relocations. 11 | *reinterpret_cast (GetAllocationParameters().m_base + *GetRelocationsInfo()->m_relocations) += GetAllocationParameters().m_base; 12 | 13 | //Change current relocation to next. 14 | GetRelocationsInfo()->m_relocations++; 15 | GetRelocationsInfo()->m_relocationCount--; 16 | 17 | } while (GetRelocationsInfo()->m_relocationCount != 0); 18 | 19 | } -------------------------------------------------------------------------------- /src/primal/runtime/reconstructor/reconstructors/RelocReconstructor.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../Reconstructor.hpp" 4 | 5 | class RelocReconstructor : public Reconstructor { 6 | 7 | public: 8 | 9 | RelocReconstructor (Segment& segment) : Reconstructor (segment) {}; 10 | 11 | //Override handle. 12 | virtual void ReconstructNative () override; 13 | 14 | private: 15 | 16 | //Getters. 17 | 18 | AdditionalRuntime::RelocationDefinition* GetRelocationsInfo () { 19 | return GetSegment().GetReconstructProcessorDefinition().m_relocations; 20 | } 21 | 22 | }; -------------------------------------------------------------------------------- /src/primal/segment/SegmentTranslator.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../Vendor.hpp" 4 | 5 | //This class is made to maintain separation between the primal-loader and the segment framework. 6 | //Since sometimes you have to change the loader itself, this class is ideal for this purpose. 7 | class SegmentTranslator { 8 | 9 | public: 10 | 11 | //Callback at OEP. 12 | enum class CallbackType { 13 | BEFORE, AFTER 14 | }; 15 | 16 | /** 17 | * 18 | * @point - This function is called before and after OEP in order for the segment to perform its routine work. 19 | * 20 | * @args - Type: Invoke type. (Before or After OEP) 21 | * 22 | **/ 23 | 24 | virtual void CallbackWithOEP (CallbackType type) = 0; 25 | 26 | }; -------------------------------------------------------------------------------- /src/primal/segment/internal/SegmentProvider.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../../Vendor.hpp" 4 | 5 | //Segment data. 6 | extern const unsigned char SegmentNativeData []; 7 | 8 | //Provider for segment. 9 | class Segment { 10 | 11 | public: 12 | 13 | struct SegmentData { 14 | 15 | //Size of segment. (For memcpy) 16 | int m_size; 17 | //RVA to OriginalEntryPoint. 18 | int m_oep; 19 | 20 | }; 21 | 22 | struct ReconstructProcessorDefinition { 23 | 24 | // ____________________________________ 25 | // 26 | // RELOCATIONS. 27 | // 28 | // Process view: 29 | // 30 | // Get RVA from iterator -> 31 | // Get address from segment by this RVA -> 32 | // Subtract old allocation from address -> 33 | // Add new allocation address to address -> 34 | // Get next relocation from iterator... 35 | // 36 | AdditionalRuntime::RelocationDefinition* m_relocations; 37 | // 38 | // ------------------------------------ 39 | // 40 | // IMPORT ADDRESS TABLE. 41 | // 42 | // Process view: 43 | // 44 | // Get ImportInfo from iterator -> 45 | // Get function address by ImportInfo [lib|name] -> 46 | // Get RelocationInfo from iterator -> 47 | // Get RVA's & RVA's type from RelocationInfo -> 48 | // Get new IAA* by RelocationInfo [PUBLIC/INTERNAL] -> 49 | // Set new IAA* to allocation + RVA for current RVA's type -> 50 | // Get next RVA's type from iterator... 51 | // 52 | // Remarks [1]: IAA - Import Absolute Address. 53 | // 54 | std::map >* m_iat; 55 | // 56 | // ____________________________________ 57 | 58 | }; 59 | 60 | /** 61 | * 62 | * @point - Get segment size & oep to offset. 63 | * 64 | */ 65 | 66 | virtual SegmentData GetSegmentData () = 0; 67 | 68 | /** 69 | * 70 | * @point - Get allocation size. (& Additional stuff like base, type, protect) 71 | * 72 | */ 73 | 74 | virtual AdditionalRuntime::AllocaParameters GetAllocationParameters () = 0; 75 | 76 | /** 77 | * 78 | * @point - Get pointer to relocations and IAT data. 79 | * 80 | */ 81 | 82 | virtual ReconstructProcessorDefinition GetReconstructProcessorDefinition () = 0; 83 | 84 | }; -------------------------------------------------------------------------------- /src/primal/util/CommonUtil.cpp: -------------------------------------------------------------------------------- 1 | #include "CommonUtil.hpp" 2 | 3 | HMODULE CommonUtil::GetModule (const char* module) { 4 | 5 | HMODULE hModule = GetModuleHandleA (module); 6 | 7 | return hModule ? LoadLibraryA (module) : hModule; 8 | } 9 | 10 | MODULEINFO CommonUtil::GetModuleInfo (const char* module) { 11 | 12 | //Docs: https://docs.microsoft.com/en-us/windows/win32/api/psapi/nf-psapi-getmoduleinformation. 13 | MODULEINFO moduleInfo = { nullptr }; 14 | 15 | GetModuleInformation (GetCurrentProcess (), CommonUtil::GetModule (module), &moduleInfo, sizeof (MODULEINFO)); 16 | 17 | return moduleInfo; 18 | } 19 | 20 | FARPROC CommonUtil::GetOrLoadFunction (const char* module, const char* function) { 21 | return GetProcAddress (CommonUtil::GetModule (module), function); 22 | } 23 | 24 | int CommonUtil::SearchSignature (const char* module, const char* signature) { 25 | 26 | //Fastest IDA-Style sigsearch. 27 | //Source code: https://github.com/learn-more/findpattern-bench/blob/master/patterns/learn_more.h#L75. 28 | //Benchmark: https://github.com/learn-more/findpattern-bench/blob/master/results.txt#L9. 29 | //Author: learn_more. 30 | 31 | auto IsPatternMatch = [](const unsigned char* address, const unsigned char* pattern, const unsigned char* mask) { 32 | 33 | size_t sizeSpaceIterator = 0; 34 | 35 | while (address [sizeSpaceIterator] == pattern [sizeSpaceIterator] || mask [sizeSpaceIterator] == static_cast ('?')) { 36 | 37 | if (!mask [++sizeSpaceIterator]) { 38 | return true; 39 | } 40 | 41 | } 42 | 43 | return false; 44 | }; 45 | 46 | MODULEINFO moduleInfo = GetModuleInfo (module); 47 | 48 | size_t signatureLength = std::strlen (signature); 49 | 50 | unsigned char* patternBase = static_cast (_alloca (signatureLength >> 1)); 51 | unsigned char* maskBase = static_cast (_alloca (signatureLength >> 1)); 52 | unsigned char* pattern = patternBase; 53 | unsigned char* mask = maskBase; 54 | 55 | signatureLength = 0; 56 | 57 | while (*signature) { 58 | 59 | if (*signature == ' ') signature++; 60 | if (!*signature) break; 61 | 62 | if (*signature == static_cast ('\?')) { 63 | 64 | *pattern++ = 0; 65 | *mask++ = '?'; 66 | signature += ((*signature == static_cast ('\?\?')) ? 2 : 1); 67 | 68 | } else { 69 | 70 | *pattern++ = GET_BYTE (signature); 71 | *mask++ = 'x'; 72 | signature += 2; 73 | 74 | } 75 | signatureLength++; 76 | } 77 | 78 | *mask = 0; 79 | pattern = patternBase; 80 | mask = maskBase; 81 | 82 | for (int searchIterator = 0; searchIterator < (moduleInfo.SizeOfImage - signatureLength); ++searchIterator) { 83 | 84 | if (IsPatternMatch (static_cast (moduleInfo.lpBaseOfDll) + searchIterator, patternBase, maskBase)) { 85 | return reinterpret_cast (moduleInfo.lpBaseOfDll) + searchIterator; 86 | } 87 | 88 | } 89 | 90 | return NULL; 91 | 92 | } 93 | 94 | int CommonUtil::GetChildProcessID (std::string process) { 95 | 96 | //Orignal source: https://docs.microsoft.com/en-us/windows/win32/toolhelp/taking-a-snapshot-and-viewing-processes. 97 | 98 | //Take snapshot of all x32 process. 99 | HANDLE snapshot = CreateToolhelp32Snapshot (TH32CS_SNAPPROCESS, 0); 100 | 101 | //Setup processEntry structure. 102 | PROCESSENTRY32 pe32; 103 | pe32.dwSize = sizeof (PROCESSENTRY32); 104 | 105 | //Check if first process valid. 106 | if (Process32First (snapshot,&pe32)) { 107 | 108 | //Iterate all process. 109 | while (Process32Next (snapshot, &pe32)) { 110 | 111 | //Cmp process name with target & check process id not equals. 112 | if (!strcmp (pe32.szExeFile, process.c_str ()) && pe32.th32ProcessID != GetCurrentProcessId ()) { 113 | 114 | //Close snapshot handle. 115 | CloseHandle (snapshot); 116 | 117 | //Return iterate process id. 118 | return pe32.th32ProcessID; 119 | } 120 | 121 | } 122 | 123 | } 124 | 125 | //Close snapshot handle. 126 | CloseHandle (snapshot); 127 | 128 | //Return zero. 129 | return NULL; 130 | 131 | } -------------------------------------------------------------------------------- /src/primal/util/CommonUtil.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../Vendor.hpp" 4 | 5 | class CommonUtil { 6 | 7 | public: 8 | 9 | //Bitwise operations && primitive math. 10 | #define IN_RANGE(x,a,b) (x >= a && x <= b) 11 | #define GET_BITS(x) (IN_RANGE (x,'0','9') ? (x - '0') : ((x&(~0x20)) - 'A' + 0xA)) 12 | #define GET_BYTE(x) (GET_BITS (x[0]) << 4 | GET_BITS (x[1])) 13 | 14 | /** 15 | * 16 | * @point - Get module base address from internal process. 17 | * 18 | * @args - Module: Module name. 19 | * 20 | **/ 21 | 22 | static HMODULE GetModule (const char* module); 23 | 24 | /** 25 | * 26 | * @point - Get module info from internal process. 27 | * 28 | * @args - Module: Module name. 29 | * 30 | **/ 31 | 32 | static MODULEINFO GetModuleInfo (const char* module); 33 | 34 | /** 35 | * 36 | * @point - Get function address from module. 37 | * 38 | * @args - Module: Module name. Function - Function name. 39 | * 40 | **/ 41 | 42 | static FARPROC GetOrLoadFunction (const char* module, const char* function); 43 | 44 | /** 45 | * 46 | * @point - Search signature in module memory space. 47 | * 48 | * @args - Module: Module name. Signature: IDA-styled signature. 49 | * 50 | **/ 51 | 52 | static int SearchSignature (const char *module, const char* signature); 53 | 54 | /** 55 | * 56 | * @point - Get child process id of second process by name. 57 | * 58 | * @args - Process: Target process name. 59 | * 60 | */ 61 | 62 | static int GetChildProcessID (std::string process); 63 | 64 | }; -------------------------------------------------------------------------------- /src/primal/util/PanicUtil.cpp: -------------------------------------------------------------------------------- 1 | #include "PanicUtil.hpp" 2 | 3 | void Primal::PanicUtil::Release (const char* caller, const char* reason) { 4 | 5 | /** 6 | * 7 | * @point - Format panic message. 8 | * 9 | * @args - Caller: Call-in function (Style: Class@Function->Stage). Reason: Panic release reason. 10 | * 11 | */ 12 | 13 | auto GenerateMessage = [](const char* caller, const char* reason) { return (std::stringstream () << "\n" << "_--------- PL_PANIC --------_\n" << "|\n" << "| Caller: " << caller << ".\n" << "| Reason: " << reason << ".\n" << "|\n" << "_--------- PL_PANIC --------_").str (); }; 14 | 15 | //TODO: Multi-output support? 16 | if (IsDebuggerPresent ()) { 17 | 18 | OutputDebugStringA (GenerateMessage (caller, reason).c_str ()); 19 | DebugBreak (); 20 | 21 | } else { 22 | 23 | ExitProcess (0xDEAD); 24 | 25 | } 26 | 27 | 28 | } -------------------------------------------------------------------------------- /src/primal/util/PanicUtil.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../Vendor.hpp" 4 | 5 | //Primal region: "Critical". 6 | namespace Primal { 7 | 8 | class PanicUtil { 9 | 10 | public: 11 | 12 | /** 13 | * 14 | * @point - Fast exit application due to internal crash, with additional info print support. (!Only debug mode) 15 | * 16 | * @args - Caller: Call-in trace. Reason: Exception reason. 17 | * 18 | */ 19 | 20 | static void Release (const char* caller, const char* reason); 21 | 22 | }; 23 | 24 | }; -------------------------------------------------------------------------------- /src/primal/util/stuff/RuntimeDefinitions.cpp: -------------------------------------------------------------------------------- 1 | #include "RuntimeDefinitions.hpp" 2 | 3 | //Externs... 4 | AdditionalRuntime::AllocaParameters Primal::AllocParameters = { }; -------------------------------------------------------------------------------- /src/primal/util/stuff/RuntimeDefinitions.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../../Vendor.hpp" 4 | 5 | namespace AdditionalRuntime { 6 | 7 | //Template of OriginalEntryPoint a.k.a DllEntryPoint. 8 | //More: https://reverseengineering.stackexchange.com/questions/2079/difference-between-dllmain-and-dllentrypoint. 9 | typedef BOOL (__stdcall* DllEntryPoint) (HMODULE hModule, DWORD callReason, LPVOID lpReserved); 10 | 11 | struct AllocaParameters { 12 | 13 | //Allocation base address. 14 | int m_base = 0x0; 15 | 16 | //Allocation size. (Must be bigger than segment size) 17 | int m_size; 18 | 19 | //Allocation type. 20 | int m_type = MEM_COMMIT | MEM_RESERVE; 21 | 22 | //Page protect type. 23 | int m_protect = PAGE_EXECUTE_READWRITE; 24 | 25 | }; 26 | 27 | enum ImportType { 28 | 29 | //Can be presented as LEA or MOV. 30 | // 31 | //Example [0]: lea $register, $function 32 | //Example [1]: mov $register, $function 33 | // 34 | INTERNAL, 35 | 36 | //Can be presented as JMP or CALL. 37 | // 38 | //Example [0]: jmp $function 39 | //Example [1]: call $function 40 | // 41 | PUBLIC 42 | 43 | }; 44 | 45 | struct ImportDefinition { 46 | 47 | //Import function name. 48 | std::string m_function; 49 | 50 | //RVA's of function. 51 | // 52 | // MAP VIEW: 53 | // 54 | // ImportType -> 55 | // RVA's 56 | // 57 | std::map > m_relocations; 58 | 59 | }; 60 | 61 | struct RelocationDefinition { 62 | 63 | //Old alloca base for subtract absolute relocation. 64 | int m_oldAllocationBase; 65 | 66 | //Relocation array pointer. 67 | int* m_relocations; 68 | 69 | //Relocations size. 70 | int m_relocationCount; 71 | 72 | }; 73 | 74 | }; 75 | 76 | //Primal region: "Allocation". 77 | namespace Primal { 78 | 79 | //Global allocation parameters. (Based on segment parameters) 80 | extern AdditionalRuntime::AllocaParameters AllocParameters; 81 | 82 | } -------------------------------------------------------------------------------- /src/primal/util/stuff/Singleton.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | //Singleton pattern by Scott Meyers. 4 | template class Singleton { 5 | 6 | protected: 7 | 8 | Singleton () {} 9 | ~Singleton () {} 10 | 11 | Singleton (const Singleton&) = delete; 12 | Singleton& operator= (const Singleton&) = delete; 13 | 14 | Singleton (Singleton&&) = delete; 15 | Singleton& operator= (Singleton&&) = delete; 16 | 17 | public: 18 | 19 | /** 20 | * 21 | * @point - Create stack-based instance. 22 | * 23 | **/ 24 | 25 | static T& GetInstance () { 26 | 27 | static T instance {}; 28 | 29 | return instance; 30 | } 31 | 32 | }; -------------------------------------------------------------------------------- /src/segment/data/FataSegment.cpp: -------------------------------------------------------------------------------- 1 | #include "FataSegment.hpp" 2 | 3 | Segment::SegmentData FataSegment::GetSegmentData () { 4 | return SegmentData { 0x2C6000, 0x15F2A2 }; 5 | } 6 | 7 | AdditionalRuntime::AllocaParameters FataSegment::GetAllocationParameters () { 8 | return AdditionalRuntime::AllocaParameters { 0x0, 0x500000, MEM_COMMIT | MEM_RESERVE, PAGE_EXECUTE_READWRITE }; 9 | } 10 | 11 | Segment::ReconstructProcessorDefinition FataSegment::GetReconstructProcessorDefinition () { 12 | return ReconstructProcessorDefinition { &m_relocationInfo, &m_importInfo }; 13 | } -------------------------------------------------------------------------------- /src/segment/data/FataSegment.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "sections/SectionAccessor.hpp" 4 | #include "../../primal/segment/internal/SegmentProvider.hpp" 5 | 6 | class FataSegment : public Segment { 7 | 8 | public: 9 | 10 | virtual Segment::SegmentData GetSegmentData () override; 11 | 12 | virtual AdditionalRuntime::AllocaParameters GetAllocationParameters () override; 13 | 14 | virtual Segment::ReconstructProcessorDefinition GetReconstructProcessorDefinition () override; 15 | 16 | private: 17 | 18 | AdditionalRuntime::RelocationDefinition m_relocationInfo = { 0xA00000, SectionAccessor::Relocations, 0x6B53 }; 19 | std::map > m_importInfo = SectionAccessor::IAT; 20 | 21 | }; -------------------------------------------------------------------------------- /src/segment/data/sections/IAT.cpp: -------------------------------------------------------------------------------- 1 | #include "SectionAccessor.hpp" 2 | 3 | //Full reconstruction of native import address table. 4 | //Author: 0x000cb & original fatal cracker. 5 | 6 | std::map > SectionAccessor::IAT = { 7 | 8 | //WINTRUST. 9 | { "wintrust", 10 | 11 | { 12 | 13 | { "WinVerifyTrust", 14 | 15 | { 16 | { AdditionalRuntime::ImportType::PUBLIC, { 0x15F85A } }, 17 | } 18 | 19 | } 20 | 21 | } 22 | 23 | }, 24 | 25 | //KERNEL32. 26 | { "kernel32", 27 | 28 | { 29 | 30 | { "GetFileAttributesW", 31 | { 32 | { AdditionalRuntime::ImportType::PUBLIC, { 0x13EA67, 0x13EBAA, 0x13EF86, 0x15F8CC } } 33 | } 34 | }, 35 | 36 | { "GetProcAddress", 37 | { 38 | { AdditionalRuntime::ImportType::PUBLIC, { 39 | 40 | 0x1173D8, 0x1175E0, 0x117615, 0x11F082, 41 | 0x11F28A, 0x11F2BF, 0x126003, 0x126083, 42 | 0x126103, 0x126183, 0x126203, 0x126283, 43 | 0x126303, 0x126383, 0x126403, 0x126483, 44 | 0x126503, 0x126583, 0x126603, 0x126863, 45 | 0x1268E3, 0x126963, 0x1269E3, 0x126F63, 46 | 0x127413, 0x13DA77, 0x13DA85, 0x13E26F, 47 | 0x13F135, 0x13F281, 0x13F39B, 0x14AFA9, 48 | 0x14B2B7, 0x15F65C 49 | 50 | } } 51 | } 52 | }, 53 | 54 | { "CloseHandle", 55 | { 56 | { AdditionalRuntime::ImportType::PUBLIC, { 57 | 58 | 0x267D, 0x26D5, 0x10E57A, 0x10E5D4, 59 | 0x13DAD4, 0x13E16C, 0x15F5C0 60 | 61 | } } 62 | } 63 | }, 64 | 65 | { "GetModuleFileNameA", 66 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x14AFF8, 0x15F950 } } } 67 | }, 68 | 69 | { "Beep", 70 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x18D0, 0x15F5A8 } } } 71 | }, 72 | 73 | { "VirtualProtect", 74 | { 75 | { AdditionalRuntime::ImportType::PUBLIC, { 76 | 77 | 0x7EA5D, 0x7EA78, 0x7FC84, 0x7FCA6, 78 | 0x863A6, 0x86418, 0x1164FD, 0x116518, 79 | 0x117A2F, 0x117A4A, 0x117C7F, 0x117C9A, 80 | 0x117ECF, 0x117EEA, 0x11835F, 0x11837A, 81 | 0x11862F, 0x11864A, 0x12423D, 0x124266, 82 | 0x124536, 0x124559, 0x1247D7, 0x124C5F, 83 | 0x124CAE, 0x124D7B, 0x124DCA, 0x124E6B, 84 | 0x124E9A, 0x124F3C, 0x124F6B, 0x12500D, 85 | 0x12503C, 0x15F5C6 86 | 87 | } }, 88 | { AdditionalRuntime::ImportType::INTERNAL, { 89 | 90 | 0x125F7C, 0x7A2A5, 0x7FB98, 0x28158, 91 | 0x1C05C4 92 | 93 | } } 94 | } 95 | }, 96 | 97 | { "Sleep", 98 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x116115, 0x125D5C, 0x15F64A, 0x11606A } } } 99 | }, 100 | 101 | { "SetCurrentDirectoryW", 102 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EC29, 0x15F896 } } } 103 | }, 104 | 105 | { "CreateEventW", 106 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13DAA8, 0x15F88A } } } 107 | }, 108 | 109 | { "GetCurrentProcessId", 110 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x10E54D, 0x15F3B2, 0x15F5EA } } } 111 | }, 112 | 113 | { "OpenProcess", 114 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x10E564, 0x15F5F0 } } } 115 | }, 116 | 117 | { "Module32Next", 118 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F5BA } } } 119 | }, 120 | 121 | { "CreateHardLinkW", 122 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EC60, 0x15F938 } } } 123 | }, 124 | 125 | { "TerminateProcess", 126 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x10E573, 0x157FD1, 0x15F5F6 } } } 127 | }, 128 | 129 | { "SetFileTime", 130 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EA17, 0x15F902 } } } 131 | }, 132 | 133 | { "GetModuleHandleA", 134 | { 135 | { AdditionalRuntime::ImportType::PUBLIC, { 136 | 137 | 0x1160FA, 0x1173D0, 0x1175D8, 0x10E5D4, 138 | 0x11760D, 0x11F07A, 0x11F282, 0x11F2B7, 139 | 0x13275A, 0x132A8F, 0x15F656 140 | 141 | } }, 142 | { AdditionalRuntime::ImportType::INTERNAL, { 143 | 144 | 0x116106 145 | 146 | } } 147 | }, 148 | }, 149 | 150 | { "QueryPerformanceCounter", 151 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F3BF, 0x15F986 } } } 152 | }, 153 | 154 | { "IsDebuggerPresent", 155 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1579AD, 0x15F962 } } } 156 | }, 157 | 158 | { "DeleteFileW", 159 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EDE1, 0x15F8AE } } } 160 | }, 161 | 162 | { "VirtualAlloc", 163 | { 164 | { AdditionalRuntime::ImportType::PUBLIC, { 165 | 166 | 0x1241EA, 0x1244EA, 0x12475A, 0x124BE6, 167 | 0x124D02, 0x124E17, 0x124EE8, 0x124FB9, 168 | 0x15F662 169 | 170 | } } 171 | }, 172 | }, 173 | 174 | { "WaitForSingleObjectEx", 175 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13D9F7, 0x15F884 } } } 176 | }, 177 | 178 | { "SetFileAttributesW", 179 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EB52, 0x15F8F6 } } } 180 | }, 181 | 182 | { "SetEvent", 183 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13DA29, 0x15F878 } } } 184 | }, 185 | 186 | { "FormatMessageA", 187 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x14B0CB, 0x15F95C } } } 188 | }, 189 | 190 | { "GetDiskFreeSpaceExW", 191 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13F368, 0x15F8C6 } } } 192 | }, 193 | 194 | { "ResetEvent", 195 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13DA35, 0x15F87E } } } 196 | }, 197 | 198 | { "GetCurrentThreadId", 199 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F3A9, 0x15F98C } } } 200 | }, 201 | 202 | { "RemoveDirectoryW", 203 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EDB9, 0x15F8EA } } } 204 | }, 205 | 206 | { "AreFileApisANSI", 207 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E80F, 0x15F90E } } } 208 | }, 209 | 210 | { "InitializeCriticalSectionAndSpinCount", 211 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13DA49, 0x15F86C } } } 212 | }, 213 | 214 | { "FindClose", 215 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E484, 0x13E78A, 0x15F8B4 } } } 216 | }, 217 | 218 | { "GetModuleHandleW", 219 | { 220 | { AdditionalRuntime::ImportType::PUBLIC, { 221 | 222 | 0x13DA54, 0x13DA65, 0x13E25F, 0x13F127, 223 | 0x13F273, 0x13F38D, 0x157881, 0x15F890 224 | 225 | } } 226 | }, 227 | }, 228 | 229 | { "SetFilePointerEx", 230 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EF1C, 0x15F8FC } } } 231 | }, 232 | 233 | { "GetTempPathW", 234 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EB8C, 0x15F908 } } } 235 | }, 236 | 237 | { "GetFullPathNameW", 238 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E10E, 0x15F8DE } } } 239 | }, 240 | 241 | { "SetEndOfFile", 242 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EF27, 0x15F8F0 } } } 243 | }, 244 | 245 | { "GetLastError", 246 | { 247 | { AdditionalRuntime::ImportType::PUBLIC, { 248 | 249 | 0x13E11A, 0x13E151, 0x13E1EC, 0x13E20B, 250 | 0x13E2A7, 0x13E339, 0x13E377, 0x13E441, 251 | 0x13E468, 0x13E55D, 0x13E63B, 0x13E7F3, 252 | 0x13E83C, 0x13E8BD, 0x13E8ED, 0x13E981, 253 | 0x13E9C0, 0x13EA21, 0x13EA74, 0x13EB32, 254 | 0x13EB9A, 0x13EC14, 0x13EC33, 0x13EC6E, 255 | 0x13ECB1, 0x13ED30, 0x13EDD1, 0x13EDEB, 256 | 0x13EDF5, 0x13EE63, 0x13EE99, 0x13EEDA, 257 | 0x13EF3B, 0x13EF91, 0x13F176, 0x13F1A6, 258 | 0x13F212, 0x13F247, 0x13F30B, 0x13F32F, 259 | 0x13F377, 0x13F42A, 0x14B0AD, 0x15F914 260 | 261 | } } 262 | } 263 | }, 264 | 265 | { "CreateFileW", 266 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E141, 0x13E32C, 0x13E36A, 0x15F8A8 } } } 267 | }, 268 | 269 | { "GetFileInformationByHandle", 270 | { 271 | { AdditionalRuntime::ImportType::PUBLIC, { 272 | 273 | 0x13E1FC, 0x13E717, 0x13E998, 0x13F31B, 274 | 0x15F8D8 275 | 276 | } } 277 | } 278 | }, 279 | 280 | { "FindFirstFileExW", 281 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E434, 0x13E45B, 0x13E77A, 0x15F8BA } } } 282 | }, 283 | 284 | { "GetFileAttributesExW", 285 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E553, 0x15F8D2 } } } 286 | }, 287 | 288 | { "FindNextFileW", 289 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E7E5, 0x15F8C0 } } } 290 | }, 291 | 292 | { "GetVolumePathNameW", 293 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13F352, 0x15F8E4 } } } 294 | }, 295 | 296 | { "MultiByteToWideChar", 297 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E830, 0x15F93E } } } 298 | }, 299 | 300 | { "WideCharToMultiByte", 301 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E885, 0x13E8B1, 0x13E8E1, 0x15F944 } } } 302 | }, 303 | 304 | { "DeviceIoControl", 305 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13ECA7, 0x15F920 } } } 306 | }, 307 | 308 | { "GetCurrentDirectoryW", 309 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EBFF, 0x15F89C } } } 310 | }, 311 | 312 | { "CreateToolhelp32Snapshot", 313 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F5AE } } } 314 | }, 315 | 316 | { "CreateDirectoryW", 317 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13ED1D, 0x15F8A2 } } } 318 | }, 319 | 320 | { "MoveFileExW", 321 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13EECC, 0x15F932 } } } 322 | }, 323 | 324 | { "SetLastError", 325 | { 326 | { AdditionalRuntime::ImportType::PUBLIC, { 327 | 328 | 0x13F088, 0x13F095, 0x13F151, 0x13F15E, 329 | 0x15F91A 330 | 331 | } } 332 | } 333 | }, 334 | 335 | { "CopyFileW", 336 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13F190, 0x15F92C } } } 337 | }, 338 | 339 | { "Module32First", 340 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F5B4 } } } 341 | }, 342 | 343 | { "CreateDirectoryExW", 344 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13F418, 0x15F926 } } } 345 | }, 346 | 347 | { "FreeLibrary", 348 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x14AF64, 0x15F94A } } } 349 | }, 350 | 351 | { "LoadLibraryExA", 352 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x14AF79, 0x14B270, 0x15F956 } } } 353 | }, 354 | 355 | { "GetStartupInfoW", 356 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x157868, 0x15F974 } } } 357 | }, 358 | 359 | { "SetUnhandledExceptionFilter", 360 | { 361 | { AdditionalRuntime::ImportType::PUBLIC, { 362 | 363 | 0x1578CF, 0x1579CD, 0x157FB6, 0x15F96E 364 | 365 | } } 366 | } 367 | }, 368 | 369 | { "UnhandledExceptionFilter", 370 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1579D7, 0x157FBF, 0x15F968 } } } 371 | }, 372 | 373 | { "GetCurrentProcess", 374 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x157FCA, 0x15F980 } } } 375 | }, 376 | 377 | { "GetSystemTimeAsFileTime", 378 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F39A, 0x15F992 } } } 379 | }, 380 | 381 | { "Process32First", 382 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F5DE } } } 383 | }, 384 | 385 | { "Process32Next", 386 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F5E4 } } } 387 | }, 388 | 389 | { "IsProcessorFeaturePresent", 390 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F97A } } } 391 | } 392 | 393 | } 394 | 395 | }, 396 | 397 | 398 | //MSVCP140. 399 | { "msvcp140", 400 | 401 | { 402 | 403 | { "?_Xlength_error@std@@YAXPBD@Z", 404 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6E6 } } } 405 | }, 406 | 407 | { "?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@U_Mbstatet@@@2@XZ", 408 | { 409 | { AdditionalRuntime::ImportType::PUBLIC, { 410 | 411 | 0x1E9F, 0x2558C, 0x3C89C, 0x15F824 412 | 413 | } } 414 | } 415 | }, 416 | 417 | { "?_Winerror_map@std@@YAHH@Z", 418 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6CE } } } 419 | }, 420 | 421 | { "?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ", 422 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x9A044, 0x9A1B4, 0x15F7C4 } } } 423 | }, 424 | 425 | { "?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z", 426 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1EB5, 0x15F80C } } } 427 | }, 428 | 429 | { "??1ios_base@std@@UAE@XZ", 430 | { 431 | { AdditionalRuntime::ImportType::PUBLIC, { 432 | 433 | 0x1FAB, 0x3092, 0x30B6, 0x30EA, 434 | 0x255D9, 0x31248, 0x31390, 0x3151D, 435 | 0x31862, 0x3188A, 0x3C51C, 0x3C8E9, 436 | 0x3DE4A, 0x5F903, 0x62CD3, 0x691F3, 437 | 0x69AF7, 0x6A5BA, 0x6BFF4, 0x10FAF2, 438 | 0x1106EB, 0x1333C2, 0x15F7A6 439 | 440 | } } 441 | } 442 | }, 443 | 444 | { "_Cnd_do_broadcast_at_thread_exit", 445 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F72E } } } 446 | }, 447 | 448 | { "??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ", 449 | { 450 | { AdditionalRuntime::ImportType::PUBLIC, { 451 | 452 | 0x2AE2, 0x31774, 0x5F86E, 0x62C3E, 453 | 0x6997F, 0x6A4EF, 0x6BF1F, 0x15F788 454 | } } 455 | }, 456 | }, 457 | 458 | { "??7ios_base@std@@QBE_NXZ", 459 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1F25, 0x15F7E2 } } } 460 | }, 461 | 462 | { "?_Execute_once@std@@YAHAAUonce_flag@1@P6GHPAX1PAPAX@Z1@Z", 463 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F69E } } } 464 | }, 465 | 466 | { "?_Throw_C_error@std@@YAXH@Z", 467 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6BC } } } 468 | }, 469 | 470 | { "?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z", 471 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1F18, 0x15F800 } } } 472 | }, 473 | 474 | { "??0ios_base@std@@IAE@XZ", 475 | { 476 | { AdditionalRuntime::ImportType::PUBLIC, { 477 | 478 | 0x2A6A, 0x3170A, 0x5F7ED, 0x62BBD, 479 | 0x698FB, 0x6A46E, 0x6BE9E, 0x15F794 480 | 481 | } } 482 | }, 483 | }, 484 | 485 | { "_Cnd_destroy_in_situ", 486 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F728 } } } 487 | }, 488 | 489 | { "?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IAEXPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z", 490 | { 491 | { AdditionalRuntime::ImportType::PUBLIC, { 492 | 493 | 0x2AC2, 0x31754, 0x5F849, 0x62C19, 494 | 0x6995A, 0x6A4CA, 0x6BEFA, 0x15F7FA 495 | 496 | } } 497 | }, 498 | }, 499 | 500 | { "?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ", 501 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3EC06, 0x15F806 } } } 502 | }, 503 | 504 | { "?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z", 505 | { 506 | { AdditionalRuntime::ImportType::PUBLIC, { 507 | 508 | 0x2B8B, 0x316DD, 0x3181D, 0x3C4AC, 509 | 0x3DF1D, 0x3EC39, 0x6A3C8, 0x6A749, 510 | 0x15F7D6 511 | 512 | } } 513 | }, 514 | }, 515 | 516 | { "?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ", 517 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x2FBE, 0x15F7EE } } } 518 | }, 519 | 520 | { "?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ", 521 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6FE } } } 522 | }, 523 | 524 | { "?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z", 525 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x372A, 0x15F71C } } } 526 | }, 527 | 528 | { "?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z", 529 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x363A, 0x15F716 } } } 530 | }, 531 | 532 | { "??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ", 533 | { 534 | { AdditionalRuntime::ImportType::PUBLIC, { 535 | 536 | 0x3C8C, 0x5F8FB, 0x62CCB, 0x691E8, 537 | 0x69223, 0x69AEA, 0x6A5B2, 0x6BFEC, 538 | 0x15F79A 539 | 540 | } } 541 | }, 542 | }, 543 | 544 | { "_Mtx_unlock", 545 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F764 } } } 546 | }, 547 | 548 | { "_Cnd_init_in_situ", 549 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F734 } } } 550 | }, 551 | 552 | { "?_Xout_of_range@std@@YAXPBD@Z", 553 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6EC } } } 554 | }, 555 | 556 | { "??0_Lockit@std@@QAE@H@Z", 557 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3EB1, 0x3ED0, 0x15F78E } } } 558 | }, 559 | 560 | { "_Mtx_current_owns", 561 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F74C } } } 562 | }, 563 | 564 | { "??1_Lockit@std@@QAE@XZ", 565 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3EEA, 0x3F57, 0x15F7A0 } } } 566 | }, 567 | 568 | { "?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SAIPAPBVfacet@locale@2@PBV42@@Z", 569 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3F2A, 0x15F7BE } } } 570 | }, 571 | 572 | { "?_Assign@_ContextCallback@details@Concurrency@@AAEXPAX@Z", 573 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6F2 } } } 574 | }, 575 | 576 | { "?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ", 577 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6AA } } } 578 | }, 579 | 580 | { "?good@ios_base@std@@QBE_NXZ", 581 | { 582 | { AdditionalRuntime::ImportType::PUBLIC, { 583 | 584 | 0x2557B, 0x3C88B, 0x3C9F1, 0x6A2D2, 585 | 0x6A303, 0x6A5F4, 0x6A622, 0x10F54F, 586 | 0x10F57B, 0x10F93F, 0x1105FF, 0x15F7F4 587 | 588 | } } 589 | }, 590 | }, 591 | 592 | { "?good@ios_base@std@@QBE_NXZ", 593 | { 594 | { AdditionalRuntime::ImportType::PUBLIC, { 595 | 596 | 0x2557B, 0x3C88B, 0x3C9F1, 0x6A2D2, 597 | 0x6A303, 0x6A5F4, 0x6A622, 0x10F54F, 598 | 0x10F57B, 0x10F93F, 0x1105FF, 0x15F7F4 599 | 600 | } } 601 | }, 602 | }, 603 | 604 | { "?ReportUnhandledError@_ExceptionHolder@details@Concurrency@@AAEXXZ", 605 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6B0, 0x15F6C8 } } } 606 | }, 607 | 608 | { "?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z", 609 | { 610 | { AdditionalRuntime::ImportType::PUBLIC, { 611 | 612 | 0x31210, 0x31358, 0x314E5, 0x3C4D5, 613 | 0x6985B, 0x6987E, 0x69B59, 0x6A542, 614 | 0x6BF7C, 0x15F830, 0x11062D 615 | 616 | } } 617 | }, 618 | }, 619 | 620 | { "?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z", 621 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3CA0C, 0x10F59D, 0x15F82A } } } 622 | }, 623 | 624 | { "?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z", 625 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3EB27, 0x15F7CA } } } 626 | }, 627 | 628 | { "?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ", 629 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3EB5F, 0x15F812 } } } 630 | }, 631 | 632 | { "?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z", 633 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x699CA, 0x15F7DC } } } 634 | }, 635 | 636 | { "?copyfmt@ios_base@std@@QAEAAV12@ABV12@@Z", 637 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x6A2F6, 0x6A615, 0x15F7E8 } } } 638 | }, 639 | 640 | { "?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z", 641 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6F8 } } } 642 | }, 643 | 644 | { "?_Throw_Cpp_error@std@@YAXH@Z", 645 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6C2 } } } 646 | }, 647 | 648 | { "?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z", 649 | { 650 | { AdditionalRuntime::ImportType::PUBLIC, { 651 | 652 | 0x6A38F, 0x6A68F, 0x6A6C7, 0x6A6FF, 653 | 0x15F81E 654 | 655 | } }, 656 | { AdditionalRuntime::ImportType::INTERNAL, { 657 | 658 | 0x6A32A 659 | 660 | } } 661 | }, 662 | }, 663 | 664 | { "?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ", 665 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x6A3D9, 0x6A75A, 0x15F7D0 } } } 666 | }, 667 | 668 | { "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z", 669 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x6A437, 0x6A514, 0x15F7B2 } } } 670 | }, 671 | 672 | { "??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@M@Z", 673 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x6BE65, 0x6BF4E, 0x15F7B8 } } } 674 | }, 675 | 676 | { "??4?$_Yarn@G@std@@QAEAAV01@PBG@Z", 677 | { 678 | { AdditionalRuntime::ImportType::PUBLIC, { 679 | 680 | 0x9A095, 0x9A0FA, 0x9A205, 0x9A26A, 681 | 0x15F7AC 682 | 683 | } } 684 | }, 685 | }, 686 | 687 | { "?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z", 688 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6A4 } } } 689 | }, 690 | 691 | { "?_Syserror_map@std@@YAPBDH@Z", 692 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6B6 } } } 693 | }, 694 | 695 | { "?_Winerror_message@std@@YAKKPADK@Z", 696 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6D4 } } } 697 | }, 698 | 699 | { "?_Xbad_alloc@std@@YAXXZ", 700 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6DA } } } 701 | }, 702 | 703 | { "_Cnd_broadcast", 704 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F722 } } } 705 | }, 706 | 707 | { "?_Xinvalid_argument@std@@YAXPBD@Z", 708 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F6E0 } } } 709 | }, 710 | 711 | { "?do_encoding@?$codecvt@_SDU_Mbstatet@@@std@@MBEHXZ", 712 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F704 } } } 713 | }, 714 | 715 | { "?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ", 716 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F70A } } } 717 | }, 718 | 719 | { "?uncaught_exception@std@@YA_NXZ", 720 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F710 } } } 721 | }, 722 | 723 | { "_Cnd_signal", 724 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F73A } } } 725 | }, 726 | 727 | { "_Cnd_timedwait", 728 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F740 } } } 729 | }, 730 | 731 | { "_Cnd_wait", 732 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F746 } } } 733 | }, 734 | 735 | { "_Mtx_destroy_in_situ", 736 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F752 } } } 737 | }, 738 | 739 | { "_Mtx_init_in_situ", 740 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F758 } } } 741 | }, 742 | 743 | { "_Mtx_lock", 744 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F75E } } } 745 | }, 746 | 747 | { "_Query_perf_counter", 748 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F76A } } } 749 | }, 750 | 751 | { "_Query_perf_frequency", 752 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F770 } } } 753 | }, 754 | 755 | { "_Thrd_detach", 756 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F776 } } } 757 | }, 758 | 759 | { "_Thrd_hardware_concurrency", 760 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F77C } } } 761 | }, 762 | 763 | { "_Xtime_get_ticks", 764 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F782 } } } 765 | }, 766 | 767 | { "?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ", 768 | { 769 | { AdditionalRuntime::ImportType::PUBLIC, { 0x15F818 } }, 770 | { AdditionalRuntime::ImportType::INTERNAL, { 0x3EB74, 0x3EBB9 } } 771 | } 772 | }, 773 | 774 | { "?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A", 775 | { { AdditionalRuntime::ImportType::INTERNAL, { 0x3EB9 } } } 776 | }, 777 | 778 | { "?write@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QAEAAV12@PB_W_J@Z", 779 | { { AdditionalRuntime::ImportType::INTERNAL, { 0x69B13 } } } 780 | }, 781 | 782 | { "?_Id_cnt@id@locale@std@@0HA", 783 | { { AdditionalRuntime::ImportType::INTERNAL, { 0x1C067C } } } 784 | } 785 | 786 | } 787 | 788 | }, 789 | 790 | //VCRUNTIME140. 791 | { "vcruntime140", 792 | 793 | { 794 | 795 | { "_CxxThrowException", 796 | { 797 | { AdditionalRuntime::ImportType::PUBLIC, { 798 | 799 | 0x20B4, 0x3F94, 0x95B2E, 0x96808, 800 | 0x97B48, 0x97CA8, 0x97E08, 0x97F68, 801 | 0x980C8, 0x98228, 0x9ABB5, 0x9C1B4, 802 | 0x9CE4C, 0x9CF4C, 0x9CF9F, 0x9DDDA, 803 | 0xB2504, 0x15F99E 804 | 805 | } } 806 | } 807 | }, 808 | 809 | { "__std_exception_copy", 810 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9B6 } } } 811 | }, 812 | 813 | { "__current_exception", 814 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9AA } } } 815 | }, 816 | 817 | { "__std_exception_destroy", 818 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9BC } } } 819 | }, 820 | 821 | { "memmove", 822 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9F8 } } } 823 | }, 824 | 825 | { "__CxxFrameHandler", 826 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9A4 } } } 827 | }, 828 | 829 | { "__current_exception_context", 830 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9B0 } } } 831 | }, 832 | 833 | { "__std_type_info_destroy_list", 834 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9C8 } } } 835 | }, 836 | 837 | { "memcpy", 838 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9F2 } } } 839 | }, 840 | 841 | { "__std_terminate", 842 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9C2 } } } 843 | }, 844 | 845 | { "_except_handler4_common", 846 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9CE } } } 847 | }, 848 | 849 | { "_purecall", 850 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9D4 } } } 851 | }, 852 | 853 | { "_setjmp3", 854 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9DA } } } 855 | }, 856 | 857 | { "longjmp", 858 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9E0 } } } 859 | }, 860 | 861 | { "memchr", 862 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9E6 } } } 863 | }, 864 | 865 | { "memcmp", 866 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9EC } } } 867 | }, 868 | 869 | { "memset", 870 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F9FE } } } 871 | }, 872 | 873 | { "strchr", 874 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA04 } } } 875 | }, 876 | 877 | { "strrchr", 878 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA0A } } } 879 | }, 880 | 881 | { "strstr", 882 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA10 } } } 883 | } 884 | 885 | } 886 | 887 | }, 888 | 889 | 890 | //NTDLL. 891 | { "ntdll", 892 | 893 | { 894 | 895 | { "RtlEnterCriticalSection", 896 | { 897 | { AdditionalRuntime::ImportType::PUBLIC, { 898 | 899 | 0x13D8EC, 0x13D93D, 0x13D961, 0x13D9A6, 900 | 0x13D9FE, 0x15F860 901 | 902 | } } 903 | } 904 | }, 905 | 906 | { "RtlLeaveCriticalSection", 907 | { 908 | { AdditionalRuntime::ImportType::PUBLIC, { 909 | 910 | 0x13D929, 0x13D94A, 0x13D994, 0x13D9B2, 911 | 0x13D9E6, 0x15F866 912 | 913 | } } 914 | } 915 | }, 916 | 917 | { "RtlInitializeSListHead", 918 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F3DA, 0x15F998 } } } 919 | }, 920 | 921 | { "RtlDeleteCriticalSection", 922 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13DAC4, 0x15F872 } } } 923 | } 924 | 925 | } 926 | 927 | }, 928 | 929 | //UCRTBASE. 930 | { "ucrtbase", 931 | 932 | { 933 | 934 | { "fgetpos", 935 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x388A, 0x15FAFA } } } 936 | }, 937 | 938 | { "fputc", 939 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x325F, 0x327D, 0x15FB00 } } } 940 | }, 941 | 942 | { "calloc", 943 | { 944 | { AdditionalRuntime::ImportType::PUBLIC, { 945 | 946 | 0x9A0C1, 0x9A126, 0x9A14C, 0x9A231, 947 | 0x9A296, 0x9A2BC, 0x15FAE2 948 | 949 | } } 950 | } 951 | }, 952 | 953 | { "_invalid_parameter_noinfo_noreturn", 954 | { 955 | { AdditionalRuntime::ImportType::PUBLIC, { 956 | 957 | 0x1fc3, 0x2027, 0x2087, 0x26f0, 958 | 0x27f5, 0x2a44, 0x2c32, 0x2d5a, 959 | 0x2eb5, 0x35fe, 0x3e8d, 0x612b, 960 | 0x704c, 0x7a99, 0x8ce4, 0x9893, 961 | 0x9dbf, 0xa086, 0xa3d5, 0xa8bb, 962 | 0xa9c1, 0xb19b, 0xb2b0, 0xb3ea, 963 | 0xba6a, 0xbb27, 0xbba0, 0xc080, 964 | 0xc0fa, 0xc1ac, 0xc261, 0xc320, 965 | 0xc41e, 0x12067, 0x13bc0, 0x15673, 966 | 0x158e5, 0x15b3d, 0x15bd0, 0x15c70, 967 | 0x15dca, 0x15e1d, 0x161de, 0x19ac9, 968 | 0x19c70, 0x19ffd, 0x1a093, 0x1a1c0, 969 | 0x1a227, 0x1e4d4, 0x1eb93, 0x1ec97, 970 | 0x1ecf7, 0x1ed90, 0x1ee2a, 0x211c3, 971 | 0x212d7, 0x21dad, 0x21e4d, 0x21feb, 972 | 0x2219b, 0x22733, 0x25228, 0x25dc7, 973 | 0x261c7, 0x26253, 0x26380, 0x26577, 974 | 0x265d7, 0x26ac2, 0x27623, 0x27a83, 975 | 0x27d9b, 0x2822d, 0x2c36f, 0x2c483, 976 | 0x2c4e7, 0x2c61a, 0x2c6d0, 0x2d2f5, 977 | 0x2dcd6, 0x2e9c3, 0x2eb77, 0x2ed3d, 978 | 0x2edc2, 0x2ee6d, 0x2ef10, 0x2f00f, 979 | 0x2f250, 0x2f30d, 0x2f58b, 0x2f617, 980 | 0x2f677, 0x2f6d7, 0x310a4, 0x3160b, 981 | 0x31969, 0x31efb, 0x320aa, 0x32629, 982 | 0x330de, 0x33cc8, 0x34c68, 0x36cea, 983 | 0x3711e, 0x384d3, 0x38a03, 0x39240, 984 | 0x3991d, 0x399cd, 0x39a9b, 0x39b50, 985 | 0x39d20, 0x3ad8d, 0x3c564, 0x3de58, 986 | 0x3e164, 0x3e4a8, 0x3e648, 0x3e7b4, 987 | 0x3e82a, 0x3e8eb, 0x3eafa, 0x3f5fa, 988 | 0x3fa83, 0x3fb20, 0x41843, 0x41990, 989 | 0x42513, 0x42597, 0x42620, 0x42c8e, 990 | 0x430b7, 0x432f0, 0x43852, 0x438c7, 991 | 0x43927, 0x43997, 0x439f7, 0x43a67, 992 | 0x43ac7, 0x44797, 0x44c99, 0x44dd3, 993 | 0x45bbb, 0x45e7f, 0x4690f, 0x469b0, 994 | 0x477d6, 0x47ad4, 0x47c13, 0x47f57, 995 | 0x49483, 0x4e285, 0x4e5f5, 0x4fa28, 996 | 0x4fd6b, 0x4fee3, 0x4ff70, 0x5036a, 997 | 0x5069d, 0x50786, 0x5086c, 0x50954, 998 | 0x50aa9, 0x50dfd, 0x50edf, 0x50fcd, 999 | 0x51087, 0x51493, 0x52259, 0x54576, 1000 | 0x54603, 0x54941, 0x54a50, 0x54b81, 1001 | 0x54cb0, 0x55012, 0x55af6, 0x55ebe, 1002 | 0x56538, 0x5674e, 0x56867, 0x5699a, 1003 | 0x57423, 0x579b7, 0x57d8d, 0x58623, 1004 | 0x59e52, 0x5b866, 0x5e5b3, 0x6475f, 1005 | 0x653cd, 0x68c63, 0x68fc7, 0x693b8, 1006 | 0x697c4, 0x69bb0, 0x6a5c8, 0x6a961, 1007 | 0x6ae7e, 0x6b0bb, 0x6b160, 0x6b1c7, 1008 | 0x6b5fb, 0x6b697, 0x6b83b, 0x6bc78, 1009 | 0x6c002, 0x6c207, 0x6f593, 0x6f630, 1010 | 0x6fb76, 0x752a0, 0x75481, 0x7551b, 1011 | 0x761b1, 0x762b8, 0x76c81, 0x78a01, 1012 | 0x78a87, 0x78c87, 0x78ceb, 0x78d8d, 1013 | 0x792f2, 0x795c3, 0x79864, 0x79baa, 1014 | 0x79e8b, 0x7a23d, 0x7c161, 0x7c213, 1015 | 0x7c2a7, 0x7c330, 0x7c397, 0x7c552, 1016 | 0x7d43c, 0x7d579, 0x7d620, 0x7d687, 1017 | 0x7db6f, 0x7dbf7, 0x7e1ad, 0x7e243, 1018 | 0x7e7d3, 0x7f568, 0x7f82a, 0x7f8b3, 1019 | 0x7f9b7, 0x7fa17, 0x7fac0, 0x7fb3a, 1020 | 0x7ffef, 0x80253, 0x8047f, 0x80770, 1021 | 0x80a93, 0x81401, 0x81f48, 0x822f3, 1022 | 0x82973, 0x829e7, 0x82b47, 0x82db6, 1023 | 0x83453, 0x83688, 0x84b77, 0x84f70, 1024 | 0x85550, 0x85613, 0x85677, 0x8596d, 1025 | 0x85f63, 0x86676, 0x86703, 0x86790, 1026 | 0x86eab, 0x8733b, 0x87b3b, 0x87e8d, 1027 | 0x880d0, 0x8822d, 0x88470, 0x890e5, 1028 | 0x89e28, 0x8ace2, 0x8bae8, 0x8c8fc, 1029 | 0x8d772, 0x8dcef, 0x8dfcb, 0x8e58d, 1030 | 0x8f15c, 0x90082, 0x90677, 0x90910, 1031 | 0x9871d, 0x98e62, 0x99ecc, 0x9ab77, 1032 | 0x9af38, 0x9b0a0, 0x9b45b, 0x9b566, 1033 | 0x9b887, 0x9bbab, 0x9bd60, 0x9bf08, 1034 | 0x9c15b, 0x9c310, 0x9cb29, 0x9cb8c, 1035 | 0x9cd4c, 0x9cf12, 0x9d14c, 0x9d64e, 1036 | 0x9e9dc, 0xa0bd5, 0xa4258, 0xa471e, 1037 | 0xa484f, 0xa4907, 0xa93f6, 0xa957a, 1038 | 0xaa0bd, 0xaa277, 0xaa8f7, 0xaabfa, 1039 | 0xabce3, 0xabe68, 0xad30c, 0xad3b0, 1040 | 0xad50a, 0xae466, 0xae6cc, 0xaea1e, 1041 | 0xb1fad, 0xb2070, 0xb23c3, 0xb24ce, 1042 | 0xb27c5, 0xb40fb, 0xb536b, 0xb592e, 1043 | 0xb5df8, 0xb5e98, 0xb62b8, 0xb63ca, 1044 | 0xb6f02, 0xb87c5, 0xb9bbc, 0xb9c81, 1045 | 0xba125, 0xba206, 0xba2d9, 0xba9ce, 1046 | 0xbab2e, 0xbada9, 0xbbd0d, 0xbc9f1, 1047 | 0xbd0d5, 0xc013d, 0xc01da, 0xc08a7, 1048 | 0xc1027, 0xc1d74, 0xc24c6, 0xc26b4, 1049 | 0xc38b0, 0xc3c03, 0xc3c94, 0xc3f5c, 1050 | 0xc51f0, 0xc5543, 0xc55fd, 0xc57a8, 1051 | 0xc59fd, 0xc5b62, 0xc69f0, 0xc9250, 1052 | 0xc95a3, 0xc968c, 0xc9701, 0xc9e88, 1053 | 0xca314, 0xca6d5, 0xcab23, 0x109e8f, 1054 | 0x109e95, 0x109e9b, 0x109ea1, 0x109ea7, 1055 | 0x10d59d, 0x10d7aa, 0x10d81b, 0x10d8a1, 1056 | 0x10dd4f, 0x10deca, 0x10e37d, 0x10e5e5, 1057 | 0x10e697, 0x10fb3b, 0x11076b, 0x1109ac, 1058 | 0x112596, 0x1128f5, 0x11366a, 0x113712, 1059 | 0x115af0, 0x115bac, 0x115c98, 0x115ec7, 1060 | 0x115fe9, 0x1189c5, 0x11e1b1, 0x11f4c1, 1061 | 0x1230bb, 0x1251e0, 0x12548e, 0x12605a, 1062 | 0x1260da, 0x12615a, 0x1261da, 0x12625a, 1063 | 0x1262da, 0x12635a, 0x1263da, 0x12645a, 1064 | 0x1264da, 0x12655a, 0x1265da, 0x12665a, 1065 | 0x126834, 0x1268ba, 0x12693a, 0x1269ba, 1066 | 0x126a3a, 0x126b52, 0x126d44, 0x126f34, 1067 | 0x126fba, 0x1270d2, 0x1272c4, 0x1273e2, 1068 | 0x12746a, 0x127654, 0x127844, 0x12796c, 1069 | 0x127e63, 0x127efa, 0x127f61, 0x127fc7, 1070 | 0x1282be, 0x12ab11, 0x12acd7, 0x12bce5, 1071 | 0x12c8a7, 0x12c907, 0x12c967, 0x12c9c7, 1072 | 0x12ca27, 0x12d6e7, 0x12f6f8, 0x12f8cc, 1073 | 0x12f9e1, 0x12fb2d, 0x12fbd2, 0x12fd82, 1074 | 0x131424, 0x1321ed, 0x13238b, 0x13247c, 1075 | 0x132a78, 0x133222, 0x133448, 0x13366a, 1076 | 0x1338bd, 0x133cdc, 0x133de9, 0x13408f, 1077 | 0x134936, 0x134bca, 0x134ce2, 0x134ef2, 1078 | 0x135c4b, 0x135d66, 0x1361f4, 0x136465, 1079 | 0x13669e, 0x136941, 0x136baa, 0x136dea, 1080 | 0x136f1a, 0x138263, 0x138b53, 0x1391b0, 1081 | 0x139423, 0x139863, 0x15fabe 1082 | 1083 | } } 1084 | } 1085 | }, 1086 | 1087 | { "__stdio_common_vsprintf", 1088 | { 1089 | { AdditionalRuntime::ImportType::PUBLIC, { 1090 | 1091 | 0x3E4D5, 0xABB68, 0x1330B1, 0x1332D7, 1092 | 0x15FA40 1093 | 1094 | } } 1095 | } 1096 | }, 1097 | 1098 | { "_atoi64", 1099 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3CB74, 0x3CBB9, 0x98E89, 0x15FADC } } } 1100 | }, 1101 | 1102 | { "_get_stream_buffer_pointers", 1103 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x2F7C, 0x3AC4, 0x15FAB8 } } } 1104 | }, 1105 | 1106 | { "_lock_file", 1107 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x314B, 0x15FAC4 } } } 1108 | }, 1109 | 1110 | { "atoi", 1111 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FAD6 } } } 1112 | }, 1113 | 1114 | { "atol", 1115 | { { AdditionalRuntime::ImportType::INTERNAL, { 0x3D384 } } } 1116 | }, 1117 | 1118 | { "__stdio_common_vswprintf", 1119 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x90175, 0x15FAA6 } } } 1120 | }, 1121 | 1122 | { "_unlock_file", 1123 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x316B, 0x15FACA } } } 1124 | }, 1125 | 1126 | { "fgetc", 1127 | { 1128 | { AdditionalRuntime::ImportType::PUBLIC, { 1129 | 1130 | 0x33F8, 0x34F8, 0x3537, 0x15FAF4 1131 | 1132 | } } 1133 | } 1134 | }, 1135 | 1136 | { "fwrite", 1137 | { 1138 | { AdditionalRuntime::ImportType::PUBLIC, { 1139 | 1140 | 0x322A, 0x37DB, 0x3D1F, 0x15FB18 1141 | 1142 | } } 1143 | } 1144 | }, 1145 | 1146 | { "ungetc", 1147 | { 1148 | { AdditionalRuntime::ImportType::PUBLIC, { 1149 | 1150 | 0x332A, 0x358C, 0x15FB5A 1151 | 1152 | } }, 1153 | 1154 | { AdditionalRuntime::ImportType::INTERNAL, { 1155 | 1156 | 0x359B 1157 | 1158 | } } 1159 | } 1160 | }, 1161 | 1162 | { "_CIcosh", 1163 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA1C } } } 1164 | }, 1165 | 1166 | { "fsetpos", 1167 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3965, 0x15FB12 } } } 1168 | }, 1169 | 1170 | { "abort", 1171 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBE4 } } } 1172 | }, 1173 | 1174 | { "atof", 1175 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3D40E, 0x15FAD0 } } } 1176 | }, 1177 | 1178 | { "_fseeki64", 1179 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3875, 0x15FA7C } } } 1180 | }, 1181 | 1182 | { "fread", 1183 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x36C3, 0x36E4, 0x15FB06 } } } 1184 | }, 1185 | 1186 | { "setvbuf", 1187 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3A34, 0x15FB2A } } } 1188 | }, 1189 | 1190 | { "fflush", 1191 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3B3B, 0x15FAEE } } } 1192 | }, 1193 | 1194 | { "_cexit", 1195 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA4C } } } 1196 | }, 1197 | 1198 | { "fclose", 1199 | { 1200 | { AdditionalRuntime::ImportType::PUBLIC, { 1201 | 1202 | 0x3C0A, 0x3163D, 0x3DE7D, 0x15FAE8 1203 | 1204 | } } 1205 | } 1206 | }, 1207 | 1208 | { "strcat_s", 1209 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x12C495, 0x12C4A9, 0x15FB30 } } } 1210 | }, 1211 | 1212 | { "rand", 1213 | { 1214 | { AdditionalRuntime::ImportType::PUBLIC, { 1215 | 1216 | 0x1AA9D, 0x3AB3F, 0x3DB96, 0x516B8, 1217 | 0x53E36, 0x53FF0, 0x8308F, 0x830A3, 1218 | 0x83127, 0x83144, 0x831BC, 0x831E6, 1219 | 0x832AF, 0x832C3, 0x8333B, 0x833AB, 1220 | 0x89A46, 0x8A89F, 0x8B706, 0x8C514, 1221 | 0x8D334, 0x98908, 0x99D20, 0xB5662, 1222 | 0xB577A, 0x15FB24 1223 | 1224 | } } 1225 | }, 1226 | }, 1227 | 1228 | { "_fdtest", 1229 | { 1230 | { AdditionalRuntime::ImportType::PUBLIC, { 1231 | 1232 | 0x1F7E1, 0x1F86F, 0x1FBCC, 0x20221, 1233 | 0x20809, 0x20830, 0x2084B, 0x20D46, 1234 | 0x20D5F, 0x20D7B, 0x20DA2, 0x6E513, 1235 | 0x6E528, 0x6E53D, 0x6E556, 0x6E56F, 1236 | 0x6E588, 0x15FAB2 1237 | 1238 | } }, 1239 | 1240 | { AdditionalRuntime::ImportType::INTERNAL, { 1241 | 1242 | 0x20914, 0x20DC4 1243 | 1244 | } } 1245 | }, 1246 | }, 1247 | 1248 | { "_configure_narrow_argv", 1249 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA52 } } } 1250 | }, 1251 | 1252 | { "__stdio_common_vsprintf_s", 1253 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x3E515, 0xBC954, 0x15FAA0 } } } 1254 | }, 1255 | 1256 | { "toupper", 1257 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FD16 } } } 1258 | }, 1259 | 1260 | { "strtoul", 1261 | { 1262 | { AdditionalRuntime::ImportType::PUBLIC, { 1263 | 1264 | 0x7E927, 0x1163C7, 0x1178F7, 0x117B47, 1265 | 0x117D97, 0x118227, 0x1184F7, 0x1328C7, 1266 | 0x15FB48 1267 | 1268 | } } 1269 | }, 1270 | }, 1271 | 1272 | { "_crt_at_quick_exit", 1273 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA58 } } } 1274 | }, 1275 | 1276 | { "strcpy_s", 1277 | { 1278 | { AdditionalRuntime::ImportType::PUBLIC, { 1279 | 1280 | 0x125EEC, 0x125F06, 0x125F9D, 0x12C482, 1281 | 0x15FB36 1282 | 1283 | } } 1284 | } 1285 | }, 1286 | 1287 | { "_gmtime64", 1288 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA88 } } } 1289 | }, 1290 | 1291 | { "tolower", 1292 | { 1293 | { AdditionalRuntime::ImportType::PUBLIC, { 1294 | 1295 | 0x86954, 0xB84F4, 0x15FB54 1296 | 1297 | } }, 1298 | 1299 | { AdditionalRuntime::ImportType::INTERNAL, { 1300 | 1301 | 0x88593, 0x88680, 0x88970, 0x88CA0, 0x88EA3, 1302 | 0x88F90, 0x891F3, 0x892E0, 0x895E0, 0x89910, 1303 | 0x89FF3, 0x8A0E0, 0x8A3E0, 0x8A710, 0x8AEB3, 1304 | 0x8AFA0, 0x8B2A0, 0x8B5D0, 0x8BCB3, 0x8BDA0, 1305 | 0x8C0A0, 0x8C3D0, 0x8CAD3, 0x8CBBF, 0x8CEBF, 1306 | 0x8D1EF, 0x10E4CD, 0x8888F, 0x88BAF, 0x894F3, 1307 | 0x89823, 0x8A2F3, 0x8A623, 0x8B1B3, 0x8B4E3, 1308 | 0x8BFB3, 0x8C2E3, 0x8CDD3, 0x8D103, 0xB9A79, 1309 | 0x25F0 1310 | 1311 | } } 1312 | } 1313 | }, 1314 | 1315 | { "wcslen", 1316 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x90125, 0x902D9, 0x15FB60 } } } 1317 | }, 1318 | 1319 | { "_execute_onexit_table", 1320 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA76 } } } 1321 | }, 1322 | 1323 | { "terminate", 1324 | { 1325 | { AdditionalRuntime::ImportType::PUBLIC, { 1326 | 1327 | 0x99EDD, 0x9AB71, 0x9ADCB, 0x9B2DF, 1328 | 0x9CE8F, 0x13E176, 0x13E48E, 0x15FB4E 1329 | 1330 | } } 1331 | }, 1332 | }, 1333 | 1334 | { "_W_Getdays", 1335 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x9A085, 0x9A1F5, 0x15FA8E } } } 1336 | }, 1337 | 1338 | { "free", 1339 | { 1340 | { AdditionalRuntime::ImportType::PUBLIC, { 1341 | 1342 | 0x9A09C, 0x9A101, 0x9A20C, 0x9A271, 1343 | 0x13F007, 0x13F014, 0x13F3C8, 0x13F3D9, 1344 | 0x13F44D, 0x15FB0C 1345 | 1346 | } } 1347 | }, 1348 | }, 1349 | 1350 | { "_crt_atexit", 1351 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA5E } } } 1352 | }, 1353 | 1354 | { "_CItanh", 1355 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA2E } } } 1356 | }, 1357 | 1358 | { "_W_Getmonths", 1359 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x9A0E7, 0x9A257, 0x15FA94 } } } 1360 | }, 1361 | 1362 | { "_except1", 1363 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA70 } } } 1364 | }, 1365 | 1366 | { "_beginthreadex", 1367 | { 1368 | { AdditionalRuntime::ImportType::PUBLIC, { 1369 | 1370 | 0x15FAAC 1371 | 1372 | } }, 1373 | 1374 | { AdditionalRuntime::ImportType::INTERNAL, { 1375 | 1376 | 0x45DEA 1377 | 1378 | } } 1379 | } 1380 | }, 1381 | 1382 | { "_errno", 1383 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x10F7CC, 0x10F870, 0x15FA6A } } } 1384 | }, 1385 | 1386 | { "_strtoi64", 1387 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x10F7F1, 0x15FB42 } } } 1388 | }, 1389 | 1390 | { "strtod", 1391 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x10F88F, 0x15FB3C } } } 1392 | }, 1393 | 1394 | { "malloc", 1395 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x125F42, 0x13EFD2, 0x15FB1E } } } 1396 | }, 1397 | 1398 | { "_initialize_onexit_table", 1399 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB6C } } } 1400 | }, 1401 | 1402 | { "___lc_codepage_func", 1403 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x13E7FD, 0x15FA9A } } } 1404 | }, 1405 | 1406 | { "_CIatan2", 1407 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA16 } } } 1408 | }, 1409 | 1410 | { "_CIfmod", 1411 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA22 } } } 1412 | }, 1413 | 1414 | { "_libm_sse2_asin_precise", 1415 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB84 } } } 1416 | }, 1417 | 1418 | { "_CIsinh", 1419 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA28 } } } 1420 | }, 1421 | 1422 | { "__acrt_iob_func", 1423 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA34 } } } 1424 | }, 1425 | 1426 | { "__stdio_common_vfprintf", 1427 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA3A } } } 1428 | }, 1429 | 1430 | { "_callnewh", 1431 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA46 } } } 1432 | }, 1433 | 1434 | { "_difftime64", 1435 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA64 } } } 1436 | }, 1437 | 1438 | { "_ftelli64", 1439 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FA82 } } } 1440 | }, 1441 | 1442 | { "_initialize_narrow_environment", 1443 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB66 } } } 1444 | }, 1445 | 1446 | { "_initterm", 1447 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB72 } } } 1448 | }, 1449 | 1450 | { "_initterm_e", 1451 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB78 } } } 1452 | }, 1453 | 1454 | { "_libm_sse2_acos_precise", 1455 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB7E } } } 1456 | }, 1457 | 1458 | { "_libm_sse2_cos_precise", 1459 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB8A } } } 1460 | }, 1461 | 1462 | { "_libm_sse2_exp_precise", 1463 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB90 } } } 1464 | }, 1465 | 1466 | { "_libm_sse2_log10_precise", 1467 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB96 } } } 1468 | }, 1469 | 1470 | { "_libm_sse2_log_precise", 1471 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FB9C } } } 1472 | }, 1473 | 1474 | { "_libm_sse2_pow_precise", 1475 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBA2 } } } 1476 | }, 1477 | 1478 | { "_libm_sse2_sin_precise", 1479 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBA8 } } } 1480 | }, 1481 | 1482 | { "_libm_sse2_sqrt_precise", 1483 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBAE } } } 1484 | }, 1485 | 1486 | { "_libm_sse2_tan_precise", 1487 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBB4 } } } 1488 | }, 1489 | 1490 | { "strncmp", 1491 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCF2 } } } 1492 | }, 1493 | 1494 | { "_localtime64", 1495 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBBA } } } 1496 | }, 1497 | 1498 | { "_mktime64", 1499 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBC0 } } } 1500 | }, 1501 | 1502 | { "_pclose", 1503 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBC6 } } } 1504 | }, 1505 | 1506 | { "_popen", 1507 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBCC } } } 1508 | }, 1509 | 1510 | { "_register_onexit_function", 1511 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBD2 } } } 1512 | }, 1513 | 1514 | { "strcoll", 1515 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCDA } } } 1516 | }, 1517 | 1518 | { "_seh_filter_dll", 1519 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBD8 } } } 1520 | }, 1521 | 1522 | { "setlocale", 1523 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCBC } } } 1524 | }, 1525 | 1526 | { "_time64", 1527 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBDE } } } 1528 | }, 1529 | 1530 | { "acos", 1531 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBEA } } } 1532 | }, 1533 | 1534 | { "asin", 1535 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBF0 } } } 1536 | }, 1537 | 1538 | { "atan", 1539 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBF6 } } } 1540 | }, 1541 | 1542 | { "isgraph", 1543 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC6E } } } 1544 | }, 1545 | 1546 | { "atan2", 1547 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FBFC } } } 1548 | }, 1549 | 1550 | { "ceil", 1551 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC02 } } } 1552 | }, 1553 | 1554 | { "clearerr", 1555 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC08 } } } 1556 | }, 1557 | 1558 | { "clock", 1559 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC0E } } } 1560 | }, 1561 | 1562 | { "system", 1563 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FD04 } } } 1564 | }, 1565 | 1566 | { "cos", 1567 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC14 } } } 1568 | }, 1569 | 1570 | { "exit", 1571 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC1A } } } 1572 | }, 1573 | 1574 | { "feof", 1575 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC20 } } } 1576 | }, 1577 | 1578 | { "floor", 1579 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC32 } } } 1580 | }, 1581 | 1582 | { "ferror", 1583 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC26 } } } 1584 | }, 1585 | 1586 | { "fgets", 1587 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC2C } } } 1588 | }, 1589 | 1590 | { "fopen", 1591 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC38 } } } 1592 | }, 1593 | 1594 | { "freopen", 1595 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC3E } } } 1596 | }, 1597 | 1598 | { "frexp", 1599 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC44 } } } 1600 | }, 1601 | 1602 | { "getc", 1603 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC4A } } } 1604 | }, 1605 | 1606 | { "getenv", 1607 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC50 } } } 1608 | }, 1609 | 1610 | { "isalnum", 1611 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC56 } } } 1612 | }, 1613 | 1614 | { "isalpha", 1615 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC5C } } } 1616 | }, 1617 | 1618 | { "iscntrl", 1619 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC62 } } } 1620 | }, 1621 | 1622 | { "isdigit", 1623 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC68 } } } 1624 | }, 1625 | 1626 | { "islower", 1627 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC74 } } } 1628 | }, 1629 | 1630 | { "ispunct", 1631 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC7A } } } 1632 | }, 1633 | 1634 | { "isspace", 1635 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC80 } } } 1636 | }, 1637 | 1638 | { "isupper", 1639 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC86 } } } 1640 | }, 1641 | 1642 | { "isxdigit", 1643 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC8C } } } 1644 | }, 1645 | 1646 | { "ldexp", 1647 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC92 } } } 1648 | }, 1649 | 1650 | { "localeconv", 1651 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC98 } } } 1652 | }, 1653 | 1654 | { "pow", 1655 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FC9E } } } 1656 | }, 1657 | 1658 | { "realloc", 1659 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCA4 } } } 1660 | }, 1661 | 1662 | { "remove", 1663 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCAA } } } 1664 | }, 1665 | 1666 | { "rename", 1667 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCB0 } } } 1668 | }, 1669 | 1670 | { "roundf", 1671 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCB6 } } } 1672 | }, 1673 | 1674 | { "sin", 1675 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCC2 } } } 1676 | }, 1677 | 1678 | { "sqrt", 1679 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCC8 } } } 1680 | }, 1681 | 1682 | { "srand", 1683 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCCE } } } 1684 | }, 1685 | 1686 | { "strcmp", 1687 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCD4 } } } 1688 | }, 1689 | 1690 | { "strerror", 1691 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCE0 } } } 1692 | }, 1693 | 1694 | { "strftime", 1695 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCE6 } } } 1696 | }, 1697 | 1698 | { "strlen", 1699 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCEC } } } 1700 | }, 1701 | 1702 | { "strpbrk", 1703 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCF8 } } } 1704 | }, 1705 | 1706 | { "strspn", 1707 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FCFE } } } 1708 | }, 1709 | 1710 | { "tmpfile", 1711 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FD0A } } } 1712 | }, 1713 | 1714 | { "tmpnam", 1715 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15FD10 } } } 1716 | } 1717 | 1718 | } 1719 | 1720 | }, 1721 | 1722 | //USER32. 1723 | { "user32", 1724 | 1725 | { 1726 | 1727 | { "FlashWindowEx", 1728 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x7D81B, 0x15F5CC } } } 1729 | }, 1730 | 1731 | { "SetWindowLongW", 1732 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1160D4, 0x125D70, 0x15F650 } } } 1733 | }, 1734 | 1735 | { "CallWindowProcW", 1736 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x86843, 0x15F5D2 } } } 1737 | }, 1738 | 1739 | { "GetDesktopWindow", 1740 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x131A20, 0x15F680 } } } 1741 | }, 1742 | 1743 | { "FindWindowA", 1744 | { 1745 | { AdditionalRuntime::ImportType::PUBLIC, { 1746 | 1747 | 0x116059, 0x15F644 1748 | 1749 | } }, 1750 | 1751 | { AdditionalRuntime::ImportType::INTERNAL, { 1752 | 1753 | 0x116070 1754 | 1755 | } } 1756 | } 1757 | }, 1758 | 1759 | { "GetAsyncKeyState", 1760 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x8FA86, 0x8FAD6, 0x15F5D8 } } } 1761 | }, 1762 | 1763 | { "GetWindowRect", 1764 | { 1765 | { AdditionalRuntime::ImportType::PUBLIC, { 1766 | 1767 | 0x15F67A 1768 | 1769 | } }, 1770 | 1771 | { AdditionalRuntime::ImportType::PUBLIC, { 1772 | 1773 | 0x131A10 1774 | 1775 | } } 1776 | } 1777 | }, 1778 | 1779 | { "GetCursorPos", 1780 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x127FDE, 0x15F668 } } } 1781 | }, 1782 | 1783 | { "ScreenToClient", 1784 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x127FEF, 0x15F66E } } } 1785 | }, 1786 | 1787 | { "GetForegroundWindow", 1788 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x131A4F, 0x15F686 } } } 1789 | }, 1790 | 1791 | { "GetDC", 1792 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x131A56, 0x15F68C } } } 1793 | }, 1794 | 1795 | { "ReleaseDC", 1796 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x131A75, 0x15F698 } } } 1797 | } 1798 | 1799 | } 1800 | 1801 | }, 1802 | 1803 | //GDI32. 1804 | { "gdi32", 1805 | 1806 | { 1807 | 1808 | { "SelectObject", 1809 | { 1810 | { AdditionalRuntime::ImportType::PUBLIC, { 1811 | 1812 | 0x1138BC, 0x1138CA, 0x15F614 1813 | 1814 | } }, 1815 | 1816 | { AdditionalRuntime::ImportType::INTERNAL, { 1817 | 1818 | 0x1C062C 1819 | 1820 | } } 1821 | } 1822 | }, 1823 | 1824 | { "CreateCompatibleDC", 1825 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x113820, 0x15F5FC } } } 1826 | }, 1827 | 1828 | { "CreateFontA", 1829 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1138A5, 0x15F60E } } } 1830 | }, 1831 | 1832 | { "SetTextColor", 1833 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1138D9, 0x15F61A } } } 1834 | }, 1835 | 1836 | { "CreateDIBSection", 1837 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x113837, 0x15F602 } } } 1838 | }, 1839 | 1840 | { "SetMapMode", 1841 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x113858, 0x15F608 } } } 1842 | }, 1843 | 1844 | { "SetBkColor", 1845 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1138E2, 0x15F620 } } } 1846 | }, 1847 | 1848 | { "SetTextAlign", 1849 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1138EB, 0x15F626 } } } 1850 | }, 1851 | 1852 | { "GetTextExtentPoint32W", 1853 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x113904, 0x11398F, 0x15F62C } } } 1854 | }, 1855 | 1856 | { "ExtTextOutW", 1857 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x1139C8, 0x15F632 } } } 1858 | }, 1859 | 1860 | { "DeleteDC", 1861 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x113B7E, 0x15F63E } } } 1862 | }, 1863 | 1864 | { "AddFontMemResourceEx", 1865 | { 1866 | { AdditionalRuntime::ImportType::PUBLIC, { 1867 | 1868 | 0x12D0C0, 0x12D1BC, 0x12D23B, 0x12D2BA, 1869 | 0x15F674 1870 | 1871 | } }, 1872 | 1873 | { AdditionalRuntime::ImportType::INTERNAL, { 1874 | 1875 | 0x12D0F3 1876 | 1877 | } } 1878 | } 1879 | }, 1880 | 1881 | { "GetPixel", 1882 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x131A6A, 0x15F692 } } } 1883 | }, 1884 | 1885 | { "DeleteObject", 1886 | { 1887 | { AdditionalRuntime::ImportType::PUBLIC, { 1888 | 1889 | 0x15F638 1890 | 1891 | } }, 1892 | 1893 | { AdditionalRuntime::ImportType::INTERNAL, { 1894 | 1895 | 0x113B6F 1896 | 1897 | } } 1898 | } 1899 | } 1900 | 1901 | } 1902 | 1903 | }, 1904 | 1905 | //D3DX943. 1906 | { "D3DX9_43", 1907 | 1908 | { 1909 | 1910 | { "D3DXCreateSprite", 1911 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F836 } } } 1912 | }, 1913 | 1914 | { "D3DXMatrixMultiply", 1915 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F842 } } } 1916 | }, 1917 | 1918 | { "D3DXCreateTextureFromFileInMemory", 1919 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F83C } } } 1920 | }, 1921 | 1922 | { "D3DXMatrixRotationYawPitchRoll", 1923 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F848 } } } 1924 | }, 1925 | 1926 | { "D3DXMatrixScaling", 1927 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F84E } } } 1928 | }, 1929 | 1930 | { "D3DXMatrixTranslation", 1931 | { { AdditionalRuntime::ImportType::PUBLIC, { 0x15F854 } } } 1932 | } 1933 | 1934 | } 1935 | 1936 | } 1937 | 1938 | }; -------------------------------------------------------------------------------- /src/segment/data/sections/SectionAccessor.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../../Vendor.hpp" 4 | 5 | //Bridge for section data. 6 | namespace SectionAccessor { 7 | 8 | extern std::map > IAT; 9 | extern int Relocations []; 10 | 11 | } -------------------------------------------------------------------------------- /src/segment/internal/SegmentInterpreter.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../Vendor.hpp" 4 | #include "framework/FataEngine.hpp" 5 | #include "../../primal/segment/SegmentTranslator.hpp" 6 | 7 | //SegmentInterpreter -> Internal init routine [Before/After OEP]. 8 | class SegmentInterpreter : public SegmentTranslator { 9 | 10 | public: 11 | 12 | void CallbackWithOEP (CallbackType type) override { 13 | 14 | switch (type) { 15 | 16 | case CallbackType::BEFORE: { 17 | 18 | //Generate security process key. 19 | engine.GenerateProcessKey (); 20 | 21 | //Search outdated offsets. 22 | engine.SearchOffsets (); 23 | 24 | }; break; 25 | 26 | case CallbackType::AFTER: { 27 | 28 | //Destroy second application process. 29 | engine.DestroyChildProcess (); 30 | 31 | }; break; 32 | 33 | } 34 | 35 | }; 36 | 37 | private: 38 | 39 | FataEngine engine = Singleton :: GetInstance (); 40 | 41 | }; -------------------------------------------------------------------------------- /src/segment/internal/framework/FataEngine.cpp: -------------------------------------------------------------------------------- 1 | #include "FataEngine.hpp" 2 | 3 | void FataEngine::GenerateProcessKey () { 4 | 5 | //Premium security bypass. 6 | 7 | //Remove old process id from key. 8 | *reinterpret_cast (Primal::AllocParameters.m_base + 0x1C31D4) ^= 0x5204; 9 | 10 | //Update key with new process id. 11 | *reinterpret_cast (Primal::AllocParameters.m_base + 0x1C31D4) ^= GetCurrentProcessId (); 12 | 13 | } 14 | 15 | void FataEngine::SearchOffsets () { 16 | 17 | //Get info about offsets. (Module & vec) 18 | for (const auto& offsetInfo : m_offsets) { 19 | 20 | //Get all offsets for module. 21 | for (const auto& offset : offsetInfo.second) { 22 | 23 | //Is offset buffer-wrap oriented? 24 | if (offset.m_isBufferOriented) { 25 | 26 | //Buffer for offset [8 bytes]. 27 | // 28 | //p.s 29 | // Internal handler reads only last 4 bytes. 30 | // We can't use free for this memory, because it's storage for "InvokeEngine". 31 | int* buffer = static_cast (malloc (8)); 32 | 33 | //Search offset & set data to allocated buffer. [Alloca + 0x4 = offset] 34 | *reinterpret_cast (buffer + 0x1) = CommonUtil::SearchSignature (offsetInfo.first, offset.m_signature); 35 | 36 | //Set address of new allocated buffer to old. [Override buffer] 37 | *reinterpret_cast (Primal::AllocParameters.m_base + offset.m_rva) = reinterpret_cast (buffer); 38 | 39 | } else { 40 | 41 | //Search offset & set data to rva. 42 | *reinterpret_cast (Primal::AllocParameters.m_base + offset.m_rva) = CommonUtil::SearchSignature (offsetInfo.first, offset.m_signature); 43 | 44 | } 45 | 46 | } 47 | 48 | } 49 | 50 | } 51 | 52 | void FataEngine::DestroyChildProcess () { 53 | 54 | //TODO: Remove syscall for fork current process from segment. 55 | 56 | //5-sec timeout for engine init. 57 | Sleep (5000); 58 | 59 | //Target process info. 60 | HANDLE process; 61 | int processId; 62 | 63 | do { 64 | 65 | //Find second process id. 66 | processId = CommonUtil::GetChildProcessID ("csgo.exe"); 67 | 68 | //1-sec search timeout. 69 | Sleep (1000); 70 | 71 | } while (processId == 0); //Do search while process id is not null. 72 | 73 | //Get access to process. 74 | process = OpenProcess (PROCESS_ALL_ACCESS, FALSE, processId); 75 | 76 | //Destroy child process. 77 | TerminateProcess (process, 1); 78 | 79 | } -------------------------------------------------------------------------------- /src/segment/internal/framework/FataEngine.hpp: -------------------------------------------------------------------------------- 1 | #pragma once 2 | 3 | #include "../../../Vendor.hpp" 4 | 5 | class FataEngine { 6 | 7 | public: 8 | 9 | /** 10 | * 11 | * @function - GenerateProcessKey. 12 | * @point - Generate "security" key for this application. (Engine used this key as xor/Based on ProcessId) 13 | * 14 | * @function - SearchOffsets. 15 | * @point - Keep offsets up2date. [Legacy way] 16 | * 17 | * @function - DestroyChildProcess. 18 | * @point - Destroy second application process. (Created for "Bypass security") 19 | * 20 | */ 21 | 22 | void GenerateProcessKey (), SearchOffsets (), DestroyChildProcess (); 23 | 24 | private: 25 | 26 | //Offset definition. 27 | struct Offset { 28 | 29 | //Signature for sigsearch. 30 | const char* m_signature; 31 | 32 | //RVA to buffer; 33 | int m_rva; 34 | 35 | //If offset native-oriented this value need to be false. 36 | bool m_isBufferOriented = false; 37 | 38 | }; 39 | 40 | //Offsets data. 41 | std::map > m_offsets = { 42 | 43 | { "client", { 44 | 45 | //RankReveal. 46 | { "55 8B EC 51 A1 ? ? ? ? 85 C0", 0x2AD5F0 }, 47 | 48 | //GetCheckSum. 49 | { "53 8B D9 83 C8", 0x2AD704 }, 50 | 51 | //SetAbsAngles. 52 | { "55 8B EC 83 E4 F8 83 EC 5C 53 8B D9 56 57 83 7B", 0x2B1014, true } 53 | 54 | } } 55 | 56 | }; 57 | 58 | }; -------------------------------------------------------------------------------- /src/segment/loader/bootstrap/Bootstrap.cpp: -------------------------------------------------------------------------------- 1 | #include "../../../Vendor.hpp" 2 | #include "BootstrapTaskController.hpp" 3 | 4 | /** 5 | * 6 | * ANOTHER PROJECTS: 7 | * - 8 | * SEGMENT BOOTSTRAP ENGINE: https://github.com/cpu-id/primal. 9 | * 10 | **/ 11 | 12 | BOOL APIENTRY DllMain (HMODULE module, DWORD callTrace, LPVOID lpReserved) { 13 | 14 | if (callTrace == DLL_PROCESS_ATTACH) { 15 | 16 | //New thread for avoid deadlock. 17 | 18 | //Init engine. 19 | CreateThread (NULL, NULL, BootstrapTask::InitializeEngine, NULL, NULL, NULL); 20 | 21 | } 22 | 23 | return TRUE; 24 | 25 | } -------------------------------------------------------------------------------- /src/segment/loader/bootstrap/BootstrapTaskController.cpp: -------------------------------------------------------------------------------- 1 | #include "BootstrapTaskController.hpp" 2 | 3 | DWORD WINAPI BootstrapTask::InitializeEngine (_In_ LPVOID lpParameter) { 4 | 5 | /////////////////////////////////////////////////////////////////////////////////////// 6 | // // 7 | // SEGMENT ROUTINE DATA. // 8 | // // 9 | FataSegment segment = Singleton :: GetInstance (); // 10 | SegmentInterpreter framework = Singleton :: GetInstance (); // 11 | // // 12 | //////////////////////////////////////////////////////////////////////////////////////// 13 | // // 14 | // RUNTIME. // 15 | // // 16 | RuntimeEngine runtime (segment); // 17 | // // 18 | //////////////////////////////////////////////////////////////////////////////////////// 19 | 20 | //Alloca memory & copy segment. 21 | runtime.ExtractSegment (); 22 | 23 | //Reconstruct IAT and relocations. 24 | runtime.ExecuteReconstruction (); 25 | 26 | //Segment routine... 27 | framework.CallbackWithOEP (SegmentTranslator::CallbackType::BEFORE); 28 | 29 | //Invoke OriginalEntryPoint a.k.a DllEntryPoint. 30 | runtime.InvokeOEP (); 31 | 32 | //Segment routine... 33 | framework.CallbackWithOEP (SegmentTranslator::CallbackType::AFTER); 34 | 35 | //Complete. 36 | return 0; 37 | 38 | } -------------------------------------------------------------------------------- /src/segment/loader/bootstrap/BootstrapTaskController.hpp: -------------------------------------------------------------------------------- 1 | #include "../../../Vendor.hpp" 2 | #include "../../internal/SegmentInterpreter.hpp" 3 | #include "../../../primal/runtime/RuntimeEngine.hpp" 4 | #include "../../data/FataSegment.hpp" 5 | 6 | namespace BootstrapTask { 7 | 8 | /** 9 | * 10 | * @point - Engine starter. 11 | * 12 | * @author - 0x000cb. / 18.10.20 13 | * 14 | */ 15 | 16 | extern DWORD WINAPI InitializeEngine (_In_ LPVOID lpParameter); 17 | 18 | }; --------------------------------------------------------------------------------