Public-Mirror/gbe_fork
1
0
Fork 0
mirror of https://github.com/Detanup01/gbe_fork.git synced 2024-10-22 20:48:17 +08:00
Code Issues 1 Projects Releases Wiki Activity

support older variant + auto unload on success or timeout

Browse Source
This commit is contained in:
a 2024-10-05 20:04:15 +03:00
parent d40d306ccd
commit ed5b745e09
3 changed files with 600 additions and 412 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

65
tools/steamclient_loader/win/extra_protection/dllmain.cpp
View File

@ -1,6 +1,49 @@
#include "pe_helpers/pe_helpers.hpp"
#include "extra_protection/stubdrm.hpp"
#define WIN32_LEAN_AND_MEAN
#include <Windows.h>
#include <condition_variable>
#include <mutex>
#include <chrono>
#include <thread>
static std::mutex dll_unload_mtx{};
static std::condition_variable dll_unload_cv{};
static bool unload_dll = false;
static HMODULE my_hModule = nullptr;
static HANDLE unload_thread_handle = INVALID_HANDLE_VALUE;
static void send_unload_signal()
{
{
std::lock_guard lock(dll_unload_mtx);
unload_dll = true;
}
dll_unload_cv.notify_one();
}
DWORD WINAPI self_unload(LPVOID lpParameter)
{
constexpr const auto UNLOAD_TIMEOUT =
#ifdef _DEBUG
std::chrono::minutes(5)
#else
std::chrono::seconds(5)
#endif
;
{
std::unique_lock lock(dll_unload_mtx);
dll_unload_cv.wait_for(lock, UNLOAD_TIMEOUT, [](){ return unload_dll; });
}
unload_thread_handle = INVALID_HANDLE_VALUE;
FreeLibraryAndExitThread(my_hModule, 0);
}
BOOL APIENTRY DllMain(
HMODULE hModule,
DWORD reason,
@ -9,14 +52,26 @@ BOOL APIENTRY DllMain(
switch (reason)
{
case DLL_PROCESS_ATTACH:
stubdrm::patch();
break;
case DLL_THREAD_ATTACH:
case DLL_THREAD_DETACH:
if (!stubdrm::patch()) {
// https://learn.microsoft.com/en-us/windows/win32/dlls/dllmain
// "The system immediately calls your entry-point function with DLL_PROCESS_DETACH and unloads the DLL"
unload_dll = true;
return FALSE;
}
my_hModule = hModule;
stubdrm::set_cleanup_cb(send_unload_signal);
unload_thread_handle = CreateThread(nullptr, 0, self_unload, nullptr, 0, nullptr);
break;
case DLL_PROCESS_DETACH:
if (!unload_dll) { // not unloaded yet, just an early exit, or thread timed out
stubdrm::restore();
if (unload_thread_handle != INVALID_HANDLE_VALUE && unload_thread_handle != NULL) {
TerminateThread(unload_thread_handle, 0);
}
}
break;
}
return TRUE;
}

6
tools/steamclient_loader/win/extra_protection/extra_protection/stubdrm.hpp
View File

@ -1,11 +1,9 @@
#pragma once
#include <string>
#include <vector>
namespace stubdrm
{
bool patch();
bool restore();
void set_cleanup_cb(void (*fn)());
}

281
tools/steamclient_loader/win/extra_protection/stubdrm.cpp
View File

@ -1,100 +1,138 @@
#include "extra_protection/stubdrm.hpp"
#include "pe_helpers/pe_helpers.hpp"
#include "common_helpers/common_helpers.hpp"
#include "extra_protection/stubdrm.hpp"
#include "detours/detours.h"
#include <string>
#include <vector>
#include <tuple>
#include <mutex>
#include <intrin.h>
// MinGW doesn't implement _AddressOfReturnAddress(), throws linker error
// https://gcc.gnu.org/onlinedocs/gcc/Return-Address.html
// https://learn.microsoft.com/en-us/cpp/intrinsics/addressofreturnaddress
#if defined(__GNUC__) && (defined(__MINGW32__) || defined(__MINGW64__))
#define ADDR_OF_RET_ADDR() ((void*)((char*)__builtin_frame_address(0) + sizeof(void*)))
#else // regular windows
#define ADDR_OF_RET_ADDR() _AddressOfReturnAddress()
#endif
typedef struct SnrUnit {
typedef struct _SnrUnit_t {
std::string search_patt{};
std::string replace_patt{};
} SnrUnit_t;
typedef struct SnrDetails {
std::string detection_patt{};
typedef struct _StubSnrDetails_t {
std::string stub_detection_patt{}; // inside the dynamically allocated stub
bool change_mem_access = false;
std::vector<SnrUnit_t> snr_units{};
} SnrDetails_t;
std::vector<SnrUnit_t> stub_snr_units{};
} StubSnrDetails_t;
typedef struct _BindSnrDetails_t {
std::string bind_detection_patt{}; // inside .bind
std::vector<StubSnrDetails_t> stub_details{};
} BindSnrDetails_t;
static const std::vector<BindSnrDetails_t> all_bind_details {
// x64
#if defined(_WIN64)
static const std::vector<SnrDetails> snr_patts {
{
// detection_patt
"FF 94 24 ?? ?? ?? ?? 88 44 24 ?? 0F BE 44 24 ?? 83 ?? 30 74 ?? E9",
// bind_detection_patt
"FF 94 24 ?? ?? ?? ?? 88 44 24 ?? 0F BE 44 24 ?? 83 ?? 30 74 ?? E9", // appid 1684350
// stub_details
{
{
// stub_detection_patt
"??",
// change memory pages access to r/w/e
false,
// snr_units
// stub_snr_units
{
// patt 1 is a bunch of checks for registry + files validity (including custom DOS stub)
// patt 2 is again a bunch of checks + creates some interfaces via steamclient + calls getappownershipticket()
{
"E8 ?? ?? ?? ?? 84 C0 75 ?? B0 33 E9",
"E8 ?? ?? ?? ?? 84 C0 75 ?? B0 3?",
"B8 01 00 00 00 ?? ?? EB",
},
{
"E8 ?? ?? ?? ?? 44 0F B6 ?? 3C 30 0F 84 ?? ?? ?? ?? 3C 35 0F 85",
"E8 ?? ?? ?? ?? 44 0F B6 ?? 3C 30 0F 84 ?? ?? ?? ?? 3C",
"B8 30 00 00 00 ?? ?? ?? ?? ?? ?? 90 E9",
},
},
},
},
},
{
// detection_patt
"FF D? 44 0F B6 ?? 3C 30 0F 85",
// bind_detection_patt
"FF D? 44 0F B6 ?? 3C 30 0F 85", // appid: 537450 (rare, only found in this appid!)
// stub_details
{
{
// stub_detection_patt
"??",
// change memory pages access to r/w/e
false,
// snr_units
{
{
"E8 ?? ?? ?? ?? 44 0F B6 ?? 3C 30 0F 84 ?? ?? ?? ?? 3C ?? 0F 85",
"B8 30 00 00 00 ?? ?? ?? ?? ?? ?? 90 E9 ?? ?? ?? ?? ?? ?? ?? ??",
},
},
},
};
#endif
// x32
#if !defined(_WIN64)
static const std::vector<SnrDetails> snr_patts {
{
// detection_patt
"FF 95 ?? ?? ?? ?? 88 45 ?? 0F BE 4D ?? 83 ?? 30 74 ?? E9",
// change memory pages access to r/w/e
false,
// snr_units
// stub_snr_units
{
// patt 1 is a bunch of checks for registry + files validity (including custom DOS stub)
// patt 2 is again a bunch of checks + creates some interfaces via steamclient + calls getappownershipticket()
{
"5? 5? E8 ?? ?? ?? ?? 83 C4 08 84 C0 75 ?? B0 33",
"E8 ?? ?? ?? ?? 84 C0 75 ?? B0 3?",
"B8 01 00 00 00 ?? ?? EB",
},
{
"E8 ?? ?? ?? ?? 44 0F B6 ?? 3C 30 0F 84 ?? ?? ?? ?? 3C",
"B8 30 00 00 00 ?? ?? ?? ?? ?? ?? 90 E9",
},
},
},
},
},
#endif // x64
// x32
#if !defined(_WIN64)
{
// bind_detection_patt
"FF 95 ?? ?? ?? ?? 88 45 ?? 0F BE 4D ?? 83 ?? 30 74 ?? E9", // appid 588650
// stub_details
{
{
// stub_detection_patt
"??",
// change memory pages access to r/w/e
false,
// stub_snr_units
{
// patt 1 is a bunch of checks for registry + files validity (including custom DOS stub)
// patt 2 is again a bunch of checks + creates some interfaces via steamclient + calls getappownershipticket()
{
"5? 5? E8 ?? ?? ?? ?? 83 C4 08 84 C0 75",
"?? ?? B8 01 00 00 00 ?? ?? ?? ?? ?? EB",
},
{
"E8 ?? ?? ?? ?? 83 C4 ?? 88 45 ?? 3C 30 0F 84 ?? ?? ?? ?? 3C 35 75",
"E8 ?? ?? ?? ?? 83 C4 ?? 88 45 ?? 3C 30 0F 84 ?? ?? ?? ?? 3C 3?",
"B8 30 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 90 E9",
},
},
},
},
},
{
// detection_patt
"FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? EB",
// bind_detection_patt
"FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? 89 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? EB", // appid 201790
// stub_details
{
{
// stub_detection_patt
"??",
// change memory pages access to r/w/e
true,
// snr_units
true, // appid 48000
// stub_snr_units
{
{
"F6 C? 02 0F 85 ?? ?? ?? ?? 5? FF ?? 6?",
@ -104,19 +142,26 @@ typedef struct SnrDetails {
"F6 C? 02 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 0F 85",
"?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 E9 00 03 00 00",
},
{
{ // appid 250180
"F6 05 ?? ?? ?? ?? 02 89 ?? ?? 0F 85 ?? ?? ?? ?? 5? FF ?? 6?",
"?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 E9 03 03",
},
},
},
},
},
{
// detection_patt
// bind_detection_patt
"FF D? 88 45 ?? 3C 30 0F 85 ?? ?? ?? ?? B8 4D 5A",
// stub_details
{
{
// stub_detection_patt
"??",
// change memory pages access to r/w/e
false,
// snr_units
// stub_snr_units
{
{
"5? E8 ?? ?? ?? ?? 83 C4 ?? 88 45 ?? 3C 30 0F 84",
@ -128,32 +173,80 @@ typedef struct SnrDetails {
},
},
},
},
},
};
{
// bind_detection_patt
"FF 95 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 89 ?? ?? ?? ?? ?? 83 A5 ?? ?? ?? ?? ?? EB", // appids: 31290, 94530, 37010
// stub_details
{
{ // appid 31290, 37010
// stub_detection_patt
"F6 05 ?? ?? ?? ?? 04 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89",
// change memory pages access to r/w/e
false,
// stub_snr_units
{
{
"F6 C? 02 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 0F 85",
"?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 E9 57 02 00 00",
},
},
},
#endif // _WIN64
{ // 94530
// stub_detection_patt
"84 ?? ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? A1 ?? ?? ?? ?? 89",
// change memory pages access to r/w/e
false,
// stub_snr_units
{
{
"F6 C? 02 89 ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 0F 85",
"?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 E9 2A 02 00 00",
},
{
"6A 04 5? 5? 8D",
"?? ?? ?? E9 BF 00 00 00",
},
},
},
},
},
#endif // x32
};
static size_t current_snr_details = static_cast<size_t>(-1);
static size_t current_bind_idx = static_cast<size_t>(-1);
static std::recursive_mutex mtx_win32_api{};
static uint8_t *exe_addr_base = (uint8_t *)GetModuleHandleW(NULL);
static uint8_t *exe_addr_base = (uint8_t *)GetModuleHandleW(nullptr);
static uint8_t *bind_addr_base = nullptr;
static uint8_t *bind_addr_end = nullptr;
static bool restore_win32_apis();
// this mutex is used to halt/defer the execution of threads if they tried to use the hooked functions at the same time
// just in case
static std::recursive_mutex mtx_win32_api{};
// these flags are used as a fallback in case Detours lib failed to restore the hooks
static bool GetTickCount_hooked = false;
static bool GetModuleHandleA_hooked = false;
static bool GetModuleHandleExA_hooked = false;
void (*cleanup_cb)() = nullptr;
// stub v2 needs manual change for .text, section must have write access
// old stub variant (found in appid 201790) needs manual change for .text section, it must have write access
static void change_mem_pages_access()
{
auto sections = pe_helpers::get_section_headers((HMODULE)exe_addr_base);
if (!sections.count) return;
constexpr const static unsigned ANY_EXECUTE_RIGHT = PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;
for (size_t i = 0; i < sections.count; ++i) {
auto section = sections.ptr[i];
uint8_t *section_base_addr = exe_addr_base + section.VirtualAddress;
MEMORY_BASIC_INFORMATION mbi{};
constexpr const static auto ANY_EXECUTE_RIGHT = PAGE_EXECUTE | PAGE_EXECUTE_READ | PAGE_EXECUTE_READWRITE | PAGE_EXECUTE_WRITECOPY;
if (VirtualQuery((LPCVOID)section_base_addr, &mbi, sizeof(mbi)) && // function succeeded
(mbi.Protect & ANY_EXECUTE_RIGHT)) { // this page (not entire section) has execute rights
DWORD current_protection = 0;
@ -172,6 +265,14 @@ static void change_mem_pages_access()
}
static void call_cleanup_cb()
{
if (cleanup_cb) {
cleanup_cb();
}
}
static bool restore_win32_apis();
static void patch_if_possible(void *ret_addr)
{
if (!ret_addr) return;
@ -179,8 +280,30 @@ static void patch_if_possible(void *ret_addr)
auto page_details = pe_helpers::get_mem_page_details(ret_addr);
if (!page_details.BaseAddress || page_details.AllocationProtect != PAGE_READWRITE) return;
// find stub variant
const StubSnrDetails_t *current_stub = nullptr;
const auto &bind_details = all_bind_details[current_bind_idx];
for (const auto &stub_details : bind_details.stub_details) {
auto mem = pe_helpers::search_memory(
(uint8_t *)page_details.BaseAddress,
page_details.RegionSize,
stub_details.stub_detection_patt);
if (mem) {
current_stub = &stub_details;
break;
}
}
if (!current_stub) {
// we can't remove hooks here, the drm allocates many pages with read/write access to decrypt other parts
// and their code also gets here, if we restore hooks then we can't patch the actual stub page (which comes much later)
return;
}
// patch all snr units inside stub
bool anything_found = false;
for (const auto &snr_unit : snr_patts[current_snr_details].snr_units) {
for (const auto &snr_unit : current_stub->stub_snr_units) {
auto mem = pe_helpers::search_memory(
(uint8_t *)page_details.BaseAddress,
page_details.RegionSize,
@ -200,49 +323,50 @@ static void patch_if_possible(void *ret_addr)
}
if (anything_found) {
restore_win32_apis();
if (snr_patts[current_snr_details].change_mem_access) change_mem_pages_access();
}
// MessageBoxA(NULL, ("ret addr = " + std::to_string((size_t)ret_addr)).c_str(), "Patched", MB_OK);
restore_win32_apis();
if (current_stub->change_mem_access) {
change_mem_pages_access();
}
call_cleanup_cb();
}
}
// https://learn.microsoft.com/en-us/cpp/intrinsics/addressofreturnaddress
static bool GetTickCount_hooked = false;
static decltype(GetTickCount) *actual_GetTickCount = GetTickCount;
__declspec(noinline)
static DWORD WINAPI GetTickCount_hook()
{
if (GetTickCount_hooked) { // unencrypted apps (like 270880 american truck) don't call GetModuleHandleA()
std::lock_guard lk(mtx_win32_api);
if (GetTickCount_hooked) { // american truck doesn't call GetModuleHandleA
if (GetTickCount_hooked) { // if we win arbitration and hooks are still intact
void* *ret_ptr = (void**)ADDR_OF_RET_ADDR();
patch_if_possible(*ret_ptr);
}
}
return actual_GetTickCount();
}
static bool GetModuleHandleA_hooked = false;
static decltype(GetModuleHandleA) *actual_GetModuleHandleA = GetModuleHandleA;
__declspec(noinline)
static HMODULE WINAPI GetModuleHandleA_hook(
LPCSTR lpModuleName
)
{
std::lock_guard lk(mtx_win32_api);
if (GetModuleHandleA_hooked &&
lpModuleName &&
lpModuleName && lpModuleName[0] &&
common_helpers::ends_with_i(lpModuleName, "ntdll.dll")) {
std::lock_guard lk(mtx_win32_api);
if (GetModuleHandleA_hooked) { // if we win arbitration and hooks are still intact
void* *ret_ptr = (void**)ADDR_OF_RET_ADDR();
patch_if_possible(*ret_ptr);
}
}
return actual_GetModuleHandleA(lpModuleName);
}
static bool GetModuleHandleExA_hooked = false;
static decltype(GetModuleHandleExA) *actual_GetModuleHandleExA = GetModuleHandleExA;
__declspec(noinline)
static BOOL WINAPI GetModuleHandleExA_hook(
@ -251,18 +375,21 @@ static BOOL WINAPI GetModuleHandleExA_hook(
HMODULE *phModule
)
{
std::lock_guard lk(mtx_win32_api);
constexpr const static unsigned HANDLE_FROM_ADDR = GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT;
if (GetModuleHandleExA_hooked &&
(dwFlags == (GET_MODULE_HANDLE_EX_FLAG_FROM_ADDRESS | GET_MODULE_HANDLE_EX_FLAG_UNCHANGED_REFCOUNT)) &&
(dwFlags & HANDLE_FROM_ADDR) &&
((uint8_t *)lpModuleName >= bind_addr_base && (uint8_t *)lpModuleName < bind_addr_end)) {
std::lock_guard lk(mtx_win32_api);
if (GetModuleHandleExA_hooked) { // if we win arbitration and hooks are still intact
void* *ret_ptr = (void**)ADDR_OF_RET_ADDR();
patch_if_possible(*ret_ptr);
}
}
return actual_GetModuleHandleExA(dwFlags, lpModuleName, phModule);
}
static bool redirect_win32_apis()
{
if (DetourTransactionBegin() != NO_ERROR) return false;
@ -295,6 +422,7 @@ static bool restore_win32_apis()
return DetourTransactionCommit() == NO_ERROR;
}
static std::vector<uint8_t> get_pe_header_disk()
{
const std::string filepath = pe_helpers::get_current_exe_path() + pe_helpers::get_current_exe_name();
@ -351,6 +479,7 @@ static bool calc_bind_section_boundaries()
return true;
}
bool stubdrm::patch()
{
if (!calc_bind_section_boundaries()) return false;
@ -358,14 +487,15 @@ bool stubdrm::patch()
auto addrOfEntry = exe_addr_base + pe_helpers::get_optional_header((HMODULE)exe_addr_base)->AddressOfEntryPoint;
if (addrOfEntry < bind_addr_base || addrOfEntry >= bind_addr_end) return false; // entry addr is not inside .bind
for (const auto &patt : snr_patts) {
// find .bind variant
for (const auto &patt : all_bind_details) {
auto mem = pe_helpers::search_memory(
bind_addr_base,
static_cast<size_t>(bind_addr_end - bind_addr_base),
patt.detection_patt);
patt.bind_detection_patt);
if (mem) {
current_snr_details = &patt - &snr_patts[0];
current_bind_idx = static_cast<size_t>(&patt - &all_bind_details[0]);
return redirect_win32_apis();
}
}
@ -377,3 +507,8 @@ bool stubdrm::restore()
{
return restore_win32_apis();
}
void stubdrm::set_cleanup_cb(void (*fn)())
{
cleanup_cb = fn;
}