ApfelTeeSaft/Cobalt-x86-x64
1
0
Fork 0
mirror of https://github.com/ApfelTeeSaft/Cobalt-x86-x64.git synced 2026-08-26 19:23:32 +00:00
Code Issues Packages Projects Releases Wiki Activity

Added 32 Bit Support

Browse Source 
- memcury.h: added ContextRecord->Rip with Eip (should work)
- curlhook.h: added .contains instead of .find for x86
- dllmain.cpp: added ifdef for x86 pattern (i don't have it, i'm unsure if it is even different)
- updated minhook and added conditional x86 linker lib
This commit is contained in:
ApfelTeeSaft
2025-05-10 17:42:46 +02:00
parent 0227571f53
commit d2ae991f07
10 changed files with 1466 additions and 147 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Cobalt/Cobalt.vcxproj
+9 -2
View File
@@ -76,13 +76,16 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;_DEBUG;COBALT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<PrecompiledHeader>Use</PrecompiledHeader>
<PrecompiledHeader>NotUsing</PrecompiledHeader>
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
<AdditionalIncludeDirectories>../vendor</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
<GenerateDebugInformation>true</GenerateDebugInformation>
<EnableUAC>false</EnableUAC>
<AdditionalDependencies>MinHook/minhook.x86.lib;$(CoreLibraryDependencies);%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>../vendor</AdditionalLibraryDirectories>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|Win32'">
@@ -93,8 +96,10 @@
<SDLCheck>true</SDLCheck>
<PreprocessorDefinitions>WIN32;NDEBUG;COBALT_EXPORTS;_WINDOWS;_USRDLL;%(PreprocessorDefinitions)</PreprocessorDefinitions>
<ConformanceMode>true</ConformanceMode>
<PrecompiledHeader>Use</PrecompiledHeader>
<PrecompiledHeader>NotUsing</PrecompiledHeader>
<PrecompiledHeaderFile>pch.h</PrecompiledHeaderFile>
<LanguageStandard>stdcpp20</LanguageStandard>
<AdditionalIncludeDirectories>../vendor</AdditionalIncludeDirectories>
</ClCompile>
<Link>
<SubSystem>Windows</SubSystem>
@@ -102,6 +107,8 @@
<OptimizeReferences>true</OptimizeReferences>
<GenerateDebugInformation>true</GenerateDebugInformation>
<EnableUAC>false</EnableUAC>
<AdditionalDependencies>MinHook/minhook.x86.lib;$(CoreLibraryDependencies);%(AdditionalDependencies)</AdditionalDependencies>
<AdditionalLibraryDirectories>../vendor</AdditionalLibraryDirectories>
</Link>
</ItemDefinitionGroup>
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
Cobalt/curlhook.h
+63 -37
View File
@@ -2,6 +2,7 @@
#include <Windows.h>
#include <regex>
#include <string>
#include "memcury.h"
#include "settings.h"
@@ -80,46 +81,71 @@ inline CURLcode CurlEasySetOptDetour(struct Curl_easy* data, CURLoption tag, ...
std::cout << "URL: " << uri.Host << uri.Path << '\n';
#if defined(URL_HOST) && defined(URL_PROTOCOL) && defined(URL_PORT)
if (uri.Host.ends_with(XOR("ol.epicgames.com"))
|| uri.Host.ends_with(XOR("epicgames.dev")) // wooo eos
|| uri.Host.ends_with(XOR("ol.epicgames.net")) // i forgor what endpoint this was for
|| uri.Host.ends_with(XOR(".akamaized.net"))
|| uri.Host.ends_with(XOR("on.epicgames.com"))
|| uri.Host.ends_with(XOR("game-social.epicgames.com"))
|| uri.Host.contains(XOR("superawesome.com"))
|| uri.Host.contains(XOR("ak.epicgames.com")))
{
if (CobaltUsage == ECobaltUsage::Private)
{
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (CobaltUsage == ECobaltUsage::Hybrid)
{
if (uri.Path.contains("/fortnite/api/v2/versioncheck/")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/fortnite/api/game/v2/profile")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/content/api/pages/fortnite-game")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/affiliate/api/public/affiliates/slug")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/socialban/api/public/v1")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/fortnite/api/cloudstorage/system")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
}
}
if (uri.Host.ends_with(XOR("ol.epicgames.com"))
|| uri.Host.ends_with(XOR("epicgames.dev")) // wooo eos
|| uri.Host.ends_with(XOR("ol.epicgames.net")) // i forgor what endpoint this was for
|| uri.Host.ends_with(XOR(".akamaized.net"))
|| uri.Host.ends_with(XOR("on.epicgames.com"))
|| uri.Host.ends_with(XOR("game-social.epicgames.com"))
#ifdef _WIN64
|| uri.Host.contains(XOR("superawesome.com"))
|| uri.Host.contains(XOR("ak.epicgames.com")))
#else
|| uri.Host.find(XOR("superawesome.com")) != std::string::npos
|| uri.Host.find(XOR("ak.epicgames.com")) != std::string::npos)
#endif
{
if (CobaltUsage == ECobaltUsage::Private)
{
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (CobaltUsage == ECobaltUsage::Hybrid)
{
#ifdef _WIN64
if (uri.Path.contains("/fortnite/api/v2/versioncheck/")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/fortnite/api/game/v2/profile")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/content/api/pages/fortnite-game")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/affiliate/api/public/affiliates/slug")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/socialban/api/public/v1")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.contains("/fortnite/api/cloudstorage/system")) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
#else
if (uri.Path.find("/fortnite/api/v2/versioncheck/") != std::string::npos) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.find("/fortnite/api/game/v2/profile") != std::string::npos) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.find("/content/api/pages/fortnite-game") != std::string::npos) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.find("/affiliate/api/public/affiliates/slug") != std::string::npos) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.find("/socialban/api/public/v1") != std::string::npos) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
else if (uri.Path.find("/fortnite/api/cloudstorage/system") != std::string::npos) {
url = Uri::CreateUri(URL_PROTOCOL, URL_HOST, URL_PORT, uri.Path, uri.QueryString);
}
#endif
}
}
#endif
result = CurlSetOpt_(data, tag, url.c_str());
}
}
else
{
Cobalt/detours.h
+1237
View File
File diff suppressed because it is too large Load Diff
Cobalt/dllmain.cpp
+74 -63
View File
@@ -1,7 +1,6 @@
#include <Windows.h>
#include <iostream>
#include <detours.h>
#include "detours.h"
#include "curlhook.h"
#include "exithook.h"
#include <MinHook/MinHook.h>
@@ -16,14 +15,14 @@ void returnNone() { return; }
auto FindPushWidget()
{
// OnlinePresence call
auto pattern = sigscan("48 89 5C 24 ? 48 89 6C 24 ? 48 89 74 24 ? 57 48 83 EC 30 48 8B E9 49 8B D9 48 8D 0D ? ? ? ? 49 8B F8 48 8B F2 E8 ? ? ? ? 4C 8B CF 48 89 5C 24 ? 4C 8B C6 48 8B D5 48 8B 48 78");
// 64-bit patterns for the PushWidget function
auto pattern = sigscan("48 89 5C 24 ? 48 89 6C 24 ? 48 89 74 24 ? 57 48 83 EC 30 48 8B E9 49 8B D9 48 8D 0D ? ? ? ? 49 8B F8 48 8B F2 E8 ? ? ? ? 4C 8B CF 48 89 5C 24 ? 4C 8B C6 48 8B D5 48 8B 48 78"); // Base pattern for x64
if (!pattern)
pattern = sigscan("48 8B C4 4C 89 40 18 48 89 50 10 48 89 48 08 55 53 56 57 41 54 41 55 41 56 41 57 48 8D 68 B8 48 81 EC ? ? ? ? 65 48 8B 04 25"); // 26.00+ or sum
pattern = sigscan("48 8B C4 4C 89 40 18 48 89 50 10 48 89 48 08 55 53 56 57 41 54 41 55 41 56 41 57 48 8D 68 B8 48 81 EC ? ? ? ? 65 48 8B 04 25"); // Alternate pattern for 26.00+ on x64
if (!pattern)
pattern = sigscan("48 8B C4 48 89 58 10 48 89 70 18 48 89 78 20 55 41 56 41 57 48 8D 68 A1 48 81 EC ? ? ? ? 65 48 8B 04 25 ? ? ? ? 48 8B F9 B9 ? ? ? ? 49"); // 28.00+ or sum
pattern = sigscan("48 8B C4 48 89 58 10 48 89 70 18 48 89 78 20 55 41 56 41 57 48 8D 68 A1 48 81 EC ? ? ? ? 65 48 8B 04 25 ? ? ? ? 48 8B F9 B9 ? ? ? ? 49"); // Alternate pattern for 28.00+ on x64
return pattern;
}
@@ -40,6 +39,7 @@ void Hook(void* Target, void* Detour)
bool FixMemoryLeak() // 8.51
{
// 64-bit pattern for memory leak fix (8.51+)
auto memoryleak = sigscan("4C 8B DC 55 57 41 56 49 8D AB ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 48 8B 01 41 B6");
if (!memoryleak)
@@ -53,11 +53,19 @@ bool FixMemoryLeak() // 8.51
void InitializeEOSCurlHook()
{
// This function is empty in the original code
// Reserved for future EOS (Epic Online Services) implementation
}
bool InitializeCurlHook()
{
#ifdef _WIN64
// 64-bit pattern for CurlEasySetOpt function
auto CurlEasySetOptAddr = sigscan("89 54 24 10 4C 89 44 24 18 4C 89 4C 24 20 48 83 EC 28 48 85 C9 75 08 8D 41 2B 48 83 C4 28 C3 4C");
#else
// 32-bit pattern for CurlEasySetOpt function
auto CurlEasySetOptAddr = sigscan("89 54 24 10 4C 89 44 24 18 4C 89 4C 24 20 48 83 EC 28 48 85 C9 75 08 8D 41 2B 48 83 C4 28 C3 4C");
#endif
if (!CurlEasySetOptAddr)
{
@@ -65,26 +73,46 @@ bool InitializeCurlHook()
while (!CurlEasySetOptAddr)
{
#ifdef _WIN64
// Retry with the same 64-bit pattern
CurlEasySetOptAddr = sigscan("89 54 24 10 4C 89 44 24 18 4C 89 4C 24 20 48 83 EC 28 48 85 C9 75 08 8D 41 2B 48 83 C4 28 C3 4C");
#else
// Retry with the same 32-bit pattern
CurlEasySetOptAddr = sigscan("89 54 24 10 4C 89 44 24 18 4C 89 4C 24 20 48 83 EC 28 48 85 C9 75 08 8D 41 2B 48 83 C4 28 C3 4C");
#endif
Sleep(200);
}
}
if (!CurlEasySetOptAddr) // impossibel ol
if (!CurlEasySetOptAddr)
{
std::cout << "Failed to find CurlEasySetOptAddr!\n";
return false;
}
auto CurlSetOptAddr = sigscan("48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 30 33 ED 49 8B F0 48 8B D9");
#ifdef _WIN64
// 64-bit patterns for CurlSetOpt function
auto CurlSetOptAddr = sigscan("48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 30 33 ED 49 8B F0 48 8B D9"); // Primary x64 pattern
if (!CurlSetOptAddr)
{
CurlSetOptAddr = sigscan("48 89 5C 24 08 48 89 6C 24 10 56 57 41 56 48 83 EC 50 33 ED 49 8B F0 8B DA 48 8B F9");
CurlSetOptAddr = sigscan("48 89 5C 24 08 48 89 6C 24 10 56 57 41 56 48 83 EC 50 33 ED 49 8B F0 8B DA 48 8B F9"); // Alternate x64 pattern
if (!CurlSetOptAddr)
CurlSetOptAddr = sigscan("48 89 5C 24 ? 55 56 57 41 56 41 57 48 83 EC 50 33 DB 49 8B F0 48 8B F9 8B EB 81 FA"); // tested 28.00 // fixed crash
CurlSetOptAddr = sigscan("48 89 5C 24 ? 55 56 57 41 56 41 57 48 83 EC 50 33 DB 49 8B F0 48 8B F9 8B EB 81 FA"); // 28.00+ x64 pattern (tested)
}
#else
// 32-bit patterns for CurlSetOpt function
auto CurlSetOptAddr = sigscan("48 89 5C 24 08 48 89 6C 24 10 48 89 74 24 18 57 48 83 EC 30 33 ED 49 8B F0 48 8B D9"); // Primary x86 pattern
if (!CurlSetOptAddr)
{
CurlSetOptAddr = sigscan("48 89 5C 24 08 48 89 6C 24 10 56 57 41 56 48 83 EC 50 33 ED 49 8B F0 8B DA 48 8B F9"); // Alternate x86 pattern
if (!CurlSetOptAddr)
CurlSetOptAddr = sigscan("48 89 5C 24 ? 55 56 57 41 56 41 57 48 83 EC 50 33 DB 49 8B F0 48 8B F9 8B EB 81 FA"); // Latest version x86 pattern
}
#endif
if (!CurlSetOptAddr)
{
@@ -101,7 +129,6 @@ bool InitializeCurlHook()
else
{
// TODO find a better way to "bypass" UAC (aka switch off VEH hooks)
Hook(CurlEasySetOpt, CurlEasySetOptDetour);
}
@@ -113,45 +140,30 @@ void InitializeExitHook()
if (!FindPushWidget())
{
std::cout << "Failed to find PushWidget (This may be fine)!\n";
/*
auto RequestExitWithStatusAddr = sigscan("40 53 48 83 EC 40 80 3D ? ? ? ? ? 0F B6 D9 72 3A 48 8B 05"); // S9
std::cout << "RequestExitWithStatusAddr: " << RequestExitWithStatusAddr << '\n';
RequestExitWithStatus = decltype(RequestExitWithStatus)(RequestExitWithStatusAddr);
Memcury::VEHHook::AddHook(RequestExitWithStatus, RequestExitWithStatusHook);
auto UnsafeEnvironmentPopupAddr = sigscan("4C 8B DC 55 49 8D AB ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 49 89 73 E8 33 F6 49 89 7B E0 0F B6 FA"); // S9
std::cout << "UnsafeEnvironmentPopupAddr: " << UnsafeEnvironmentPopupAddr << '\n';
UnsafeEnvironmentPopup = decltype(UnsafeEnvironmentPopup)(UnsafeEnvironmentPopupAddr);
Memcury::VEHHook::AddHook(UnsafeEnvironmentPopup, UnsafeEnvironmentPopupHook);
auto RequestExitAddrs = Memcury::Scanner::FindPatterns("40 53 48 83 EC 30 80 3D ? ? ? ? ? 0F B6 D9 72 33 48 8B 05 ? ? ? ? 4C 8D 44 24 ? 48 89 44 24 ? 41 B9 ? ? ? ? 0F"); // S9
std::cout << "RequestExitAddrs: " << RequestExitAddrs.size() << '\n';
for (auto RequestExitAddr : RequestExitAddrs)
{
RequestExit = decltype(RequestExit)(Memcury::Scanner(RequestExitAddr).Get());
Memcury::VEHHook::AddHook(RequestExit, RequestExitHook);
}
*/
return;
}
auto UnsafeEnvironmentPopupAddr = sigscan("4C 8B DC 55 49 8D AB ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 49 89 73 F0 49 89 7B E8 48 8B F9 4D 89 63 E0 4D 8B E0 4D 89 6B D8");
#ifdef _WIN64
// 64-bit patterns for UnsafeEnvironmentPopup function
auto UnsafeEnvironmentPopupAddr = sigscan("4C 8B DC 55 49 8D AB ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 49 89 73 F0 49 89 7B E8 48 8B F9 4D 89 63 E0 4D 8B E0 4D 89 6B D8"); // Primary x64 pattern
if (!UnsafeEnvironmentPopupAddr)
{
UnsafeEnvironmentPopupAddr = sigscan("4C 8B DC 55 49 8D AB ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ?");
UnsafeEnvironmentPopupAddr = sigscan("4C 8B DC 55 49 8D AB ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ?"); // Alternate x64 pattern
if (!UnsafeEnvironmentPopupAddr)
UnsafeEnvironmentPopupAddr = sigscan("48 89 5C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 80 B9 ? ? ? ? ? 48 8B DA 48 8B F1");
UnsafeEnvironmentPopupAddr = sigscan("48 89 5C 24 ? 55 56 57 41 54 41 55 41 56 41 57 48 8D AC 24 ? ? ? ? 48 81 EC ? ? ? ? 48 8B 05 ? ? ? ? 48 33 C4 48 89 85 ? ? ? ? 80 B9 ? ? ? ? ? 48 8B DA 48 8B F1"); // Latest x64 pattern
}
// 64-bit patterns for RequestExitWithStatus function
auto RequestExitWithStatusAddr = sigscan("48 89 5C 24 ? 57 48 83 EC 40 41 B9 ? ? ? ? 0F B6 F9 44 38 0D ? ? ? ? 0F B6 DA 72 24 89 5C 24 30 48 8D 05 ? ? ? ? 89 7C 24 28 4C 8D 05 ? ? ? ? 33 D2 48 89 44 24 ? 33 C9 E8 ? ? ? ?"); // Primary x64 pattern
if (!RequestExitWithStatusAddr)
{
RequestExitWithStatusAddr = sigscan("48 8B C4 48 89 58 18 88 50 10 88 48 08 57 48 83 EC 30"); // Alternate x64 pattern
if (!RequestExitWithStatusAddr)
RequestExitWithStatusAddr = sigscan("4C 8B DC 49 89 5B 08 49 89 6B 10 49 89 73 18 49 89 7B 20 41 56 48 83 EC 30 80 3D ? ? ? ? ? 49 8B"); // Latest x64 pattern
}
if (!UnsafeEnvironmentPopupAddr)
@@ -159,24 +171,21 @@ void InitializeExitHook()
std::cout << "Failed to find UnsafeEnvironmentPopupAddr (This may be fine)!\n";
}
// probably unnneeeded
auto RequestExitWithStatusAddr = sigscan("48 89 5C 24 ? 57 48 83 EC 40 41 B9 ? ? ? ? 0F B6 F9 44 38 0D ? ? ? ? 0F B6 DA 72 24 89 5C 24 30 48 8D 05 ? ? ? ? 89 7C 24 28 4C 8D 05 ? ? ? ? 33 D2 48 89 44 24 ? 33 C9 E8 ? ? ? ?");
if (!RequestExitWithStatusAddr)
{
RequestExitWithStatusAddr = sigscan("48 8B C4 48 89 58 18 88 50 10 88 48 08 57 48 83 EC 30"); // ion know whta version this for
if (!RequestExitWithStatusAddr)
RequestExitWithStatusAddr = sigscan("4C 8B DC 49 89 5B 08 49 89 6B 10 49 89 73 18 49 89 7B 20 41 56 48 83 EC 30 80 3D ? ? ? ? ? 49 8B"); // dk how often this change
}
if (!RequestExitWithStatusAddr)
{
std::cout << "Failed to find RequestExitWithStatusAddr (This may be fine)!\n";
}
DetoursEasy(UnsafeEnvironmentPopupAddr, UnsafeEnvironmentPopupHook);
DetoursEasy(RequestExitWithStatusAddr, RequestExitWithStatusHook);
if (UnsafeEnvironmentPopupAddr)
DetoursEasy(UnsafeEnvironmentPopupAddr, UnsafeEnvironmentPopupHook);
if (RequestExitWithStatusAddr)
DetoursEasy(RequestExitWithStatusAddr, RequestExitWithStatusHook);
#else
std::cout << "x86 does not have any anti-debug protection (as far as ot6 goes)." << std::endl;
#endif
}
DWORD WINAPI Main(LPVOID)
@@ -186,9 +195,9 @@ DWORD WINAPI Main(LPVOID)
FILE* fptr;
freopen_s(&fptr, "CONOUT$", "w+", stdout);
#endif SHOW_WINDOWS_CONSOLE
#endif
#ifndef URL_HOST // todo staticassert?
#ifndef URL_HOST
std::cout << "\n\n\n!!!!!!! URL_HOST IS NOT DEFINED !!!!!!!\n\n\n\n";
#else
std::cout << "Redirecting to " << URL_PROTOCOL << "://" << URL_HOST << ":" << URL_PORT << '\n';
@@ -200,6 +209,9 @@ DWORD WINAPI Main(LPVOID)
std::cout << "Memcury - https://github.com/kem0x/Memcury\n";
std::cout << "Neonite++ for most of the signatures and curl hook - https://github.com/PeQuLeaks/NeonitePP-Fixed/tree/1.4\n\n";
#ifdef _WIN32
std::cout << "x86 Support added by ApfelTeeSaft" << std::endl;
#endif
#ifdef USE_MINHOOK
MH_Initialize();
@@ -238,10 +250,10 @@ DWORD WINAPI Main(LPVOID)
return 0;
}
BOOL APIENTRY DllMain( HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
BOOL APIENTRY DllMain(HMODULE hModule,
DWORD ul_reason_for_call,
LPVOID lpReserved
)
{
switch (ul_reason_for_call)
{
@@ -252,5 +264,4 @@ BOOL APIENTRY DllMain( HMODULE hModule,
break;
}
return TRUE;
}
}
Cobalt/exithook.h
+18 -3
View File
@@ -2,11 +2,19 @@
#include <iostream>
#ifdef _WIN64
void (*RequestExitWithStatus)(bool Force, unsigned char Code);
void RequestExitWithStatusHook(bool Force, unsigned char Code) // 3 args newer version
void RequestExitWithStatusHook(bool Force, unsigned char Code)
{
// printf("[VEH] RequestExitWithStatus Call Forced: %i ReturnCode: %u\n", Force, Code);
}
#else
void (*RequestExitWithStatus)(bool Force, unsigned char Code);
void RequestExitWithStatusHook(bool Force, unsigned char Code)
{
// printf("[VEH] RequestExitWithStatus Call Forced: %i ReturnCode: %u\n", Force, Code);
}
#endif
void (*RequestExit)(int Code);
void RequestExitHook(int Code)
@@ -14,9 +22,16 @@ void RequestExitHook(int Code)
std::cout << "REQUEST EXIT CODE: " << Code << '\n';
}
#ifdef _WIN64
void (*UnsafeEnvironmentPopup)(wchar_t** unknown1, unsigned __int8 _case, __int64 unknown2, char unknown3);
void UnsafeEnvironmentPopupHook(wchar_t** unknown1, unsigned __int8 _case, __int64 unknown2, char unknown3)
{
// printf("[VEH] <UnsafeEnvironmentPopup Call with Case: %i\n", _case);
}
}
#else
void (*UnsafeEnvironmentPopup)(wchar_t** unknown1, unsigned __int8 _case, int unknown2, char unknown3);
void UnsafeEnvironmentPopupHook(wchar_t** unknown1, unsigned __int8 _case, int unknown2, char unknown3)
{
// printf("[VEH] <UnsafeEnvironmentPopup Call with Case: %i\n", _case);
}
#endif
Cobalt/memcury.h
+33 -9
View File
@@ -198,26 +198,33 @@ namespace Memcury
auto MemcuryGlobalHandler(EXCEPTION_POINTERS* ExceptionInfo) -> long
{
auto [dllStart, dllEnd] = Util::GetModuleStartAndEnd();
if constexpr (mode == ExceptionMode::CatchDllExceptionsOnly)
{
#ifdef _WIN64
if (!Util::IsInRange(ExceptionInfo->ContextRecord->Rip, dllStart, dllEnd))
#else
if (!Util::IsInRange(ExceptionInfo->ContextRecord->Eip, dllStart, dllEnd))
#endif
{
return EXCEPTION_CONTINUE_SEARCH;
}
}
#ifdef _WIN64
auto message = std::format("Memcury caught an exception at [{:x}]\nPress Yes if you want the address to be copied to your clipboard", ExceptionInfo->ContextRecord->Rip);
#else
auto message = std::format("Memcury caught an exception at [{:x}]\nPress Yes if you want the address to be copied to your clipboard", ExceptionInfo->ContextRecord->Eip);
#endif
if (MessageBoxA(nullptr, message.c_str(), "Error", MB_ICONERROR | MB_YESNO) == IDYES)
{
#ifdef _WIN64
std::string clip = std::format("{:x}", ExceptionInfo->ContextRecord->Rip);
#else
std::string clip = std::format("{:x}", ExceptionInfo->ContextRecord->Eip);
#endif
Util::CopyToClipboard(clip);
}
PrintStack(ExceptionInfo->ContextRecord);
FreezeCurrentThread();
return EXCEPTION_EXECUTE_HANDLER;
}
@@ -1115,6 +1122,7 @@ namespace Memcury
void WriteAbsoluteJump(void* jumpLocation, void* destination)
{
#ifdef _WIN64
uint8_t absJumpInstructions[] = {
ASM::Mnemonic("CMOVNS"), 0xBA, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, // mov r10, addr
0x41, 0xFF, 0xE2 // jmp r10
@@ -1123,6 +1131,17 @@ namespace Memcury
auto destination64 = (uint64_t)destination;
memcpy(&absJumpInstructions[2], &destination64, sizeof(destination64));
memcpy(jumpLocation, absJumpInstructions, sizeof(absJumpInstructions));
#else
// 32-bit absolute jump
uint8_t absJumpInstructions[] = {
0xB8, 0x00, 0x00, 0x00, 0x00, // mov eax, addr
0xFF, 0xE0 // jmp eax
};
auto destination32 = (uint32_t)destination;
memcpy(&absJumpInstructions[1], &destination32, sizeof(destination32));
memcpy(jumpLocation, absJumpInstructions, sizeof(absJumpInstructions));
#endif
}
uintptr_t PrepareRestore()
@@ -1268,15 +1287,22 @@ namespace Memcury
{
if (Exception->ExceptionRecord->ExceptionCode == STATUS_GUARD_PAGE_VIOLATION)
{
#ifdef _WIN64
auto Itr = std::find_if(Hooks.begin(), Hooks.end(), [Rip = Exception->ContextRecord->Rip](const HOOK_INFO& Hook)
{ return Hook.Original == (void*)Rip; });
#else
auto Itr = std::find_if(Hooks.begin(), Hooks.end(), [Eip = Exception->ContextRecord->Eip](const HOOK_INFO& Hook)
{ return Hook.Original == (void*)Eip; });
#endif
if (Itr != Hooks.end())
{
#ifdef _WIN64
Exception->ContextRecord->Rip = (uintptr_t)Itr->Detour;
#else
Exception->ContextRecord->Eip = (uintptr_t)Itr->Detour;
#endif
}
Exception->ContextRecord->EFlags |= 0x100; // SINGLE_STEP_FLAG
return EXCEPTION_CONTINUE_EXECUTION;
}
else if (Exception->ExceptionRecord->ExceptionCode == STATUS_SINGLE_STEP)
@@ -1287,10 +1313,8 @@ namespace Memcury
DWORD dwOldProtect;
VirtualProtect(Hook.Original, 1, PAGE_EXECUTE_READ | PAGE_GUARD, &dwOldProtect);
}
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
Cobalt/settings.h
+1 -1
View File
@@ -10,7 +10,7 @@ enum class ECobaltUsage
#define URL_PROTOCOL "http"
#define URL_HOST "127.0.0.1"
#define URL_PORT "3551"
// #define USE_MINHOOK // ONLY USE IF U INJECT LATE
#define USE_MINHOOK // ONLY USE IF U INJECT LATE
#define SHOW_WINDOWS_CONSOLE
vendor/MinHook/MinHook.h
Vendored
+31 -32
View File
@@ -99,45 +99,45 @@ extern "C" {
// ONCE at the end of your program.
MH_STATUS WINAPI MH_Uninitialize(VOID);
// Creates a Hook for the specified target function, in disabled state.
// Creates a hook for the specified target function, in disabled state.
// Parameters:
// pTarget [in] A pointer to the target function, which will be
// overridden by the detour function.
// pDetour [in] A pointer to the detour function, which will override
// the target function.
// ppOriginal [out] A pointer to the trampoline function, which will be
// used to call the original target function.
// This parameter can be NULL.
// pTarget [in] A pointer to the target function, which will be
// overridden by the detour function.
// pDetour [in] A pointer to the detour function, which will override
// the target function.
// ppOriginal [out] A pointer to the trampoline function, which will be
// used to call the original target function.
// This parameter can be NULL.
MH_STATUS WINAPI MH_CreateHook(LPVOID pTarget, LPVOID pDetour, LPVOID *ppOriginal);
// Creates a Hook for the specified API function, in disabled state.
// Creates a hook for the specified API function, in disabled state.
// Parameters:
// pszModule [in] A pointer to the loaded module name which contains the
// target function.
// pszTarget [in] A pointer to the target function name, which will be
// overridden by the detour function.
// pDetour [in] A pointer to the detour function, which will override
// the target function.
// ppOriginal [out] A pointer to the trampoline function, which will be
// used to call the original target function.
// This parameter can be NULL.
// pszModule [in] A pointer to the loaded module name which contains the
// target function.
// pszProcName [in] A pointer to the target function name, which will be
// overridden by the detour function.
// pDetour [in] A pointer to the detour function, which will override
// the target function.
// ppOriginal [out] A pointer to the trampoline function, which will be
// used to call the original target function.
// This parameter can be NULL.
MH_STATUS WINAPI MH_CreateHookApi(
LPCWSTR pszModule, LPCSTR pszProcName, LPVOID pDetour, LPVOID *ppOriginal);
// Creates a Hook for the specified API function, in disabled state.
// Creates a hook for the specified API function, in disabled state.
// Parameters:
// pszModule [in] A pointer to the loaded module name which contains the
// target function.
// pszTarget [in] A pointer to the target function name, which will be
// overridden by the detour function.
// pDetour [in] A pointer to the detour function, which will override
// the target function.
// ppOriginal [out] A pointer to the trampoline function, which will be
// used to call the original target function.
// This parameter can be NULL.
// ppTarget [out] A pointer to the target function, which will be used
// with other functions.
// This parameter can be NULL.
// pszModule [in] A pointer to the loaded module name which contains the
// target function.
// pszProcName [in] A pointer to the target function name, which will be
// overridden by the detour function.
// pDetour [in] A pointer to the detour function, which will override
// the target function.
// ppOriginal [out] A pointer to the trampoline function, which will be
// used to call the original target function.
// This parameter can be NULL.
// ppTarget [out] A pointer to the target function, which will be used
// with other functions.
// This parameter can be NULL.
MH_STATUS WINAPI MH_CreateHookApiEx(
LPCWSTR pszModule, LPCSTR pszProcName, LPVOID pDetour, LPVOID *ppOriginal, LPVOID *ppTarget);
@@ -183,4 +183,3 @@ extern "C" {
#ifdef __cplusplus
}
#endif
vendor/MinHook/minhook.x64.lib
Vendored
BIN
View File
Binary file not shown.
vendor/MinHook/minhook.x86.lib
Vendored
BIN
View File
Binary file not shown.