mirror of
https://github.com/gmh5225/awesome-game-security
synced 2026-06-21 13:56:22 +00:00
archive: add 5 repo prompt(s) [skip ci]
This commit is contained in:
github-actions[bot]
File diff suppressed because it is too large
Load Diff
File diff suppressed because it is too large
Load Diff
@@ -0,0 +1,987 @@
|
||||
Project Path: arc_ekknod_MouseClassServiceCallbackMeme_o3t7b__9
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_ekknod_MouseClassServiceCallbackMeme_o3t7b__9
|
||||
├── MouseClassServiceCallbackMeme.sln
|
||||
├── MouseClassServiceCallbackMeme.vcxproj
|
||||
├── MouseClassServiceCallbackMeme.vcxproj.filters
|
||||
├── MouseClassServiceCallbackMeme.vcxproj.user
|
||||
├── README.md
|
||||
├── main.c
|
||||
└── mouse.asm
|
||||
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackMeme.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.2.32630.192
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MouseClassServiceCallbackMeme", "MouseClassServiceCallbackMeme.vcxproj", "{D2002713-76DD-4F66-921E-42F9405372B1}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|ARM64.Deploy.0 = Debug|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|x64.Build.0 = Debug|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|ARM64.Deploy.0 = Release|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|x64.ActiveCfg = Release|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|x64.Build.0 = Release|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|x64.Deploy.0 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {AB3EBD45-1882-414A-A597-95D80D86AD83}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackMeme.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{D2002713-76DD-4F66-921E-42F9405372B1}</ProjectGuid>
|
||||
<TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">x64</Platform>
|
||||
<RootNamespace>MouseClassServiceCallbackMeme</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings" />
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="mouse.asm">
|
||||
<FileType>Document</FileType>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets" />
|
||||
</Project>
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackMeme.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="mouse.asm">
|
||||
<Filter>Source Files</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackMeme.vcxproj.user`:
|
||||
|
||||
```user
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup>
|
||||
<ShowAllFiles>true</ShowAllFiles>
|
||||
</PropertyGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# MouseClassServiceCallbackMeme
|
||||
Calling "own" MouseClassServiceCallback
|
||||
|
||||
```
|
||||
|
||||
`main.c`:
|
||||
|
||||
```c
|
||||
#include <ntifs.h>
|
||||
|
||||
/*
|
||||
* Old project, what can be used for mouse input manipulation
|
||||
*/
|
||||
|
||||
typedef int BOOL;
|
||||
typedef unsigned int DWORD;
|
||||
typedef ULONG_PTR QWORD;
|
||||
|
||||
#pragma warning(disable : 4201)
|
||||
typedef struct _MOUSE_INPUT_DATA {
|
||||
USHORT UnitId;
|
||||
USHORT Flags;
|
||||
union {
|
||||
ULONG Buttons;
|
||||
struct {
|
||||
USHORT ButtonFlags;
|
||||
USHORT ButtonData;
|
||||
};
|
||||
};
|
||||
ULONG RawButtons;
|
||||
LONG LastX;
|
||||
LONG LastY;
|
||||
ULONG ExtraInformation;
|
||||
} MOUSE_INPUT_DATA, *PMOUSE_INPUT_DATA;
|
||||
|
||||
typedef VOID
|
||||
(*MouseClassServiceCallbackFn)(
|
||||
PDEVICE_OBJECT DeviceObject,
|
||||
PMOUSE_INPUT_DATA InputDataStart,
|
||||
PMOUSE_INPUT_DATA InputDataEnd,
|
||||
PULONG InputDataConsumed
|
||||
);
|
||||
|
||||
typedef struct _MOUSE_OBJECT
|
||||
{
|
||||
PDEVICE_OBJECT mouse_device;
|
||||
MouseClassServiceCallbackFn service_callback;
|
||||
BOOL use_mouse;
|
||||
} MOUSE_OBJECT, * PMOUSE_OBJECT;
|
||||
|
||||
|
||||
|
||||
MOUSE_OBJECT gMouseObject;
|
||||
QWORD _KeAcquireSpinLockAtDpcLevel;
|
||||
QWORD _KeReleaseSpinLockFromDpcLevel;
|
||||
QWORD _IofCompleteRequest;
|
||||
QWORD _IoReleaseRemoveLockEx;
|
||||
|
||||
|
||||
|
||||
|
||||
NTSYSCALLAPI
|
||||
POBJECT_TYPE* IoDriverObjectType;
|
||||
|
||||
VOID MouseClassServiceCallback(
|
||||
PDEVICE_OBJECT DeviceObject,
|
||||
PMOUSE_INPUT_DATA InputDataStart,
|
||||
PMOUSE_INPUT_DATA InputDataEnd,
|
||||
PULONG InputDataConsumed
|
||||
);
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
ObReferenceObjectByName(
|
||||
__in PUNICODE_STRING ObjectName,
|
||||
__in ULONG Attributes,
|
||||
__in_opt PACCESS_STATE AccessState,
|
||||
__in_opt ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_TYPE ObjectType,
|
||||
__in KPROCESSOR_MODE AccessMode,
|
||||
__inout_opt PVOID ParseContext,
|
||||
__out PVOID *Object
|
||||
);
|
||||
|
||||
|
||||
void NtSleep(DWORD milliseconds)
|
||||
{
|
||||
QWORD ms = milliseconds;
|
||||
ms = (ms * 1000) * 10;
|
||||
ms = ms * -1;
|
||||
#ifdef _KERNEL_MODE
|
||||
KeDelayExecutionThread(KernelMode, 0, (PLARGE_INTEGER)&ms);
|
||||
#else
|
||||
NtDelayExecution(0, (PLARGE_INTEGER)&ms);
|
||||
#endif
|
||||
}
|
||||
|
||||
void mouse_move(long x, long y, unsigned short button_flags);
|
||||
|
||||
VOID
|
||||
DriverUnload(
|
||||
_In_ struct _DRIVER_OBJECT* DriverObject
|
||||
)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(DriverObject);
|
||||
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] MouseClassServiceCallbackMeme.sys is closed\n");
|
||||
}
|
||||
|
||||
QWORD _KeAcquireSpinLockAtDpcLevel;
|
||||
QWORD _KeReleaseSpinLockFromDpcLevel;
|
||||
QWORD _IofCompleteRequest;
|
||||
QWORD _IoReleaseRemoveLockEx;
|
||||
|
||||
NTSTATUS DriverEntry(
|
||||
_In_ PDRIVER_OBJECT DriverObject,
|
||||
_In_ PUNICODE_STRING RegistryPath
|
||||
)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(DriverObject);
|
||||
UNREFERENCED_PARAMETER(RegistryPath);
|
||||
|
||||
/* Microsoft compiler is sometimes retarded, thats why we have to do this non sense */
|
||||
/* It would otherwise generate wrapper functions around, and it would cause system BSOD */
|
||||
_KeAcquireSpinLockAtDpcLevel = (QWORD)KeAcquireSpinLockAtDpcLevel;
|
||||
_KeReleaseSpinLockFromDpcLevel = (QWORD)KeReleaseSpinLockFromDpcLevel;
|
||||
_IofCompleteRequest = (QWORD)IofCompleteRequest;
|
||||
_IoReleaseRemoveLockEx = (QWORD)IoReleaseRemoveLockEx;
|
||||
|
||||
|
||||
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] MouseClassServiceCallbackMeme.sys is launched\n");
|
||||
DriverObject->DriverUnload = DriverUnload;
|
||||
|
||||
|
||||
for (int i = 0; i < 32; i++) {
|
||||
NtSleep(100);
|
||||
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Moving mouse\n");
|
||||
|
||||
mouse_move(0, -10, 0);
|
||||
}
|
||||
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
|
||||
BOOL mouse_open(void)
|
||||
{
|
||||
// https://github.com/nbqofficial/norsefire
|
||||
|
||||
if (gMouseObject.use_mouse == 0) {
|
||||
|
||||
UNICODE_STRING class_string;
|
||||
RtlInitUnicodeString(&class_string, L"\\Driver\\MouClass");
|
||||
|
||||
|
||||
PDRIVER_OBJECT class_driver_object = NULL;
|
||||
NTSTATUS status = ObReferenceObjectByName(&class_string, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&class_driver_object);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
gMouseObject.use_mouse = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
UNICODE_STRING hid_string;
|
||||
RtlInitUnicodeString(&hid_string, L"\\Driver\\MouHID");
|
||||
|
||||
|
||||
PDRIVER_OBJECT hid_driver_object = NULL;
|
||||
|
||||
status = ObReferenceObjectByName(&hid_string, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&hid_driver_object);
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
if (class_driver_object) {
|
||||
ObfDereferenceObject(class_driver_object);
|
||||
}
|
||||
gMouseObject.use_mouse = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
PVOID class_driver_base = NULL;
|
||||
|
||||
|
||||
PDEVICE_OBJECT hid_device_object = hid_driver_object->DeviceObject;
|
||||
while (hid_device_object && !gMouseObject.service_callback)
|
||||
{
|
||||
PDEVICE_OBJECT class_device_object = class_driver_object->DeviceObject;
|
||||
while (class_device_object && !gMouseObject.service_callback)
|
||||
{
|
||||
if (!class_device_object->NextDevice && !gMouseObject.mouse_device)
|
||||
{
|
||||
gMouseObject.mouse_device = class_device_object;
|
||||
}
|
||||
|
||||
PULONG_PTR device_extension = (PULONG_PTR)hid_device_object->DeviceExtension;
|
||||
ULONG_PTR device_ext_size = ((ULONG_PTR)hid_device_object->DeviceObjectExtension - (ULONG_PTR)hid_device_object->DeviceExtension) / 4;
|
||||
class_driver_base = class_driver_object->DriverStart;
|
||||
for (ULONG_PTR i = 0; i < device_ext_size; i++)
|
||||
{
|
||||
if (device_extension[i] == (ULONG_PTR)class_device_object && device_extension[i + 1] > (ULONG_PTR)class_driver_object)
|
||||
{
|
||||
gMouseObject.service_callback = (MouseClassServiceCallbackFn)(device_extension[i + 1]);
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
class_device_object = class_device_object->NextDevice;
|
||||
}
|
||||
hid_device_object = hid_device_object->AttachedDevice;
|
||||
}
|
||||
|
||||
if (!gMouseObject.mouse_device)
|
||||
{
|
||||
PDEVICE_OBJECT target_device_object = class_driver_object->DeviceObject;
|
||||
while (target_device_object)
|
||||
{
|
||||
if (!target_device_object->NextDevice)
|
||||
{
|
||||
gMouseObject.mouse_device = target_device_object;
|
||||
break;
|
||||
}
|
||||
target_device_object = target_device_object->NextDevice;
|
||||
}
|
||||
}
|
||||
|
||||
ObfDereferenceObject(class_driver_object);
|
||||
ObfDereferenceObject(hid_driver_object);
|
||||
|
||||
if (gMouseObject.mouse_device && gMouseObject.service_callback) {
|
||||
gMouseObject.use_mouse = 1;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return gMouseObject.mouse_device && gMouseObject.service_callback;
|
||||
}
|
||||
|
||||
#define KeMRaiseIrql(a,b) *(b) = KfRaiseIrql(a)
|
||||
void mouse_move(long x, long y, unsigned short button_flags)
|
||||
{
|
||||
KIRQL irql;
|
||||
ULONG input_data;
|
||||
MOUSE_INPUT_DATA mid = { 0 };
|
||||
mid.LastX = x;
|
||||
mid.LastY = y;
|
||||
mid.ButtonFlags = button_flags;
|
||||
if (!mouse_open()) {
|
||||
return;
|
||||
}
|
||||
mid.UnitId = 1;
|
||||
KeMRaiseIrql(DISPATCH_LEVEL, &irql);
|
||||
MouseClassServiceCallback(gMouseObject.mouse_device, &mid, (PMOUSE_INPUT_DATA)&mid + 1, &input_data);
|
||||
KeLowerIrql(irql);
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`mouse.asm`:
|
||||
|
||||
```asm
|
||||
EXTERNDEF _KeAcquireSpinLockAtDpcLevel:PROC
|
||||
EXTERNDEF _KeReleaseSpinLockFromDpcLevel:PROC
|
||||
EXTERNDEF _IofCompleteRequest:PROC
|
||||
EXTERNDEF _IoReleaseRemoveLockEx:PROC
|
||||
EXTERNDEF memmove:PROC
|
||||
|
||||
.data
|
||||
WPP_RECORDER_INITIALIZED dq 0;
|
||||
WPP_GLOBAL_Control dq 0;
|
||||
.code
|
||||
|
||||
WPP_RECORDER_SF proc
|
||||
ret
|
||||
WPP_RECORDER_SF endp
|
||||
|
||||
MouseClassReadCopyData proc
|
||||
mov r11,rsp
|
||||
mov QWORD PTR [r11+8h],rbx
|
||||
mov QWORD PTR [r11+10h],rbp
|
||||
mov QWORD PTR [r11+18h],rsi
|
||||
push rdi
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
push r15
|
||||
sub rsp,50h
|
||||
inc DWORD PTR [rcx+0a8h]
|
||||
mov rsi,rdx
|
||||
mov eax,DWORD PTR [rcx+54h]
|
||||
mov rdi,rcx
|
||||
mov r13,QWORD PTR [rdx+0b8h]
|
||||
lea ebp,[rax+rax*2]
|
||||
mov ebx,DWORD PTR [r13+8h]
|
||||
shl ebp,3h
|
||||
mov edx,DWORD PTR [rdi+88h]
|
||||
cmp ebp,ebx
|
||||
cmovae ebp,ebx
|
||||
sub edx,DWORD PTR [rdi+78h]
|
||||
add edx,DWORD PTR [rdi+68h]
|
||||
mov r12d,ebp
|
||||
cmp ebp,edx
|
||||
cmovae r12d,edx
|
||||
mov r14,QWORD PTR [rsi+18h]
|
||||
mov rdx,QWORD PTR [rdi+78h]
|
||||
mov rcx,r14
|
||||
mov r8d,r12d
|
||||
mov r15d,r12d
|
||||
call memmove
|
||||
add r14,r15
|
||||
mov ebx,ebp
|
||||
sub ebx,r12d
|
||||
je J1A5
|
||||
mov rdx,QWORD PTR [rdi+68h]
|
||||
mov r8,rbx
|
||||
mov rcx,r14
|
||||
call memmove
|
||||
mov rcx,QWORD PTR [rdi+68h]
|
||||
add rcx,rbx
|
||||
mov QWORD PTR [rdi+78h],rcx
|
||||
jmp J1B0
|
||||
J1A5:
|
||||
add QWORD PTR [rdi+78h],r15
|
||||
J1B0:
|
||||
mov ebx,ebp
|
||||
mov rax,0aaaaaaaaaaaaaaabh
|
||||
mul rbx
|
||||
shr rdx,4h
|
||||
sub DWORD PTR [rdi+54h],edx
|
||||
jne J1FF
|
||||
mov BYTE PTR [rdi+42h],1h
|
||||
J1FF:
|
||||
mov QWORD PTR [rsi+38h],rbx
|
||||
lea r11,[rsp+50h]
|
||||
mov rbx,QWORD PTR [r11+30h]
|
||||
xor eax,eax
|
||||
mov rsi,QWORD PTR [r11+40h]
|
||||
mov DWORD PTR [r13+8h],ebp
|
||||
mov rbp,QWORD PTR [r11+38h]
|
||||
mov rsp,r11
|
||||
pop r15
|
||||
pop r14
|
||||
pop r13
|
||||
pop r12
|
||||
pop rdi
|
||||
ret
|
||||
MouseClassReadCopyData endp
|
||||
|
||||
|
||||
|
||||
|
||||
MouseClassDequeueRead proc
|
||||
xor edx,edx
|
||||
lea r8,[rcx+98h]
|
||||
J9:
|
||||
mov rcx,QWORD PTR [r8]
|
||||
cmp rcx,r8
|
||||
je J47
|
||||
cmp QWORD PTR [rcx+8h],r8
|
||||
jne J4C
|
||||
mov rax,QWORD PTR [rcx]
|
||||
cmp QWORD PTR [rax+8h],rcx
|
||||
jne J4C
|
||||
mov QWORD PTR [r8],rax
|
||||
lea rdx,[rcx-0a8h]
|
||||
mov QWORD PTR [rax+8h],r8
|
||||
xor eax,eax
|
||||
xchg QWORD PTR [rdx+68h],rax
|
||||
test rax,rax
|
||||
jne J42
|
||||
mov QWORD PTR [rcx+8h],rcx
|
||||
xor edx,edx
|
||||
mov QWORD PTR [rcx],rcx
|
||||
J42:
|
||||
test rdx,rdx
|
||||
je J9
|
||||
J47:
|
||||
mov rax,rdx
|
||||
ret
|
||||
int 3
|
||||
J4C:
|
||||
mov ecx,3h
|
||||
int 29h
|
||||
MouseClassDequeueRead endp
|
||||
|
||||
|
||||
MouseClassServiceCallback proc
|
||||
mov rax,rsp
|
||||
mov QWORD PTR [rax+8h],rbx
|
||||
mov QWORD PTR [rax+10h],rsi
|
||||
mov QWORD PTR [rax+18h],rdi
|
||||
mov QWORD PTR [rax+20h],r9
|
||||
push rbp
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
push r15
|
||||
mov rbp,rsp
|
||||
sub rsp,70h
|
||||
mov r13,r9
|
||||
mov rbx,r8
|
||||
mov r14,rdx
|
||||
mov r15,rcx
|
||||
|
||||
|
||||
|
||||
|
||||
lea rax, WPP_RECORDER_INITIALIZED
|
||||
xor esi,esi
|
||||
cmp WPP_RECORDER_INITIALIZED, rax
|
||||
jne J61
|
||||
mov rcx,QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],si
|
||||
je J61
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
lea r9d,[rsi+32h]
|
||||
lea r8d,[rsi+3h]
|
||||
mov dl,5h
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J61:
|
||||
|
||||
|
||||
mov rdi,QWORD PTR [r15+40h]
|
||||
sub ebx,r14d
|
||||
mov r12d,esi
|
||||
mov DWORD PTR [r13+0h],esi
|
||||
lea rcx,[rdi+90h]
|
||||
call QWORD PTR _KeAcquireSpinLockAtDpcLevel
|
||||
nop DWORD PTR [rax+rax*1+0h]
|
||||
lea rax,[rbp-10h]
|
||||
mov rcx,rdi
|
||||
mov QWORD PTR [rbp-8h],rax
|
||||
lea rax,[rbp-10h]
|
||||
mov QWORD PTR [rbp-10h],rax
|
||||
call MouseClassDequeueRead
|
||||
mov rsi,rax
|
||||
xor r9d,r9d
|
||||
mov rax,0aaaaaaaaaaaaaaabh
|
||||
test rsi,rsi
|
||||
je J1aa
|
||||
mov r13,QWORD PTR [rsi+0b8h]
|
||||
mov r12d,ebx
|
||||
mov r8d,DWORD PTR [r13+8h]
|
||||
cmp ebx,r8d
|
||||
cmovae r12d,r8d
|
||||
mul r12
|
||||
mov rax,QWORD PTR [rbp+48h]
|
||||
shr rdx,4h
|
||||
add DWORD PTR [rax],edx
|
||||
lea rax, WPP_RECORDER_INITIALIZED
|
||||
cmp WPP_RECORDER_INITIALIZED,rax
|
||||
jne J11d
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],r9w
|
||||
je J11d
|
||||
mov rax,QWORD PTR [rsi+18h]
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov QWORD PTR [rsp+50h],rax
|
||||
mov QWORD PTR [rsp+48h],r14
|
||||
mov DWORD PTR [rsp+40h],r8d
|
||||
mov DWORD PTR [rsp+38h],ebx
|
||||
mov QWORD PTR [rsp+30h],rsi
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J11d:
|
||||
|
||||
mov rax,0fffff78000000014h
|
||||
mov rax,QWORD PTR [rax]
|
||||
lea rdx,WPP_RECORDER_INITIALIZED
|
||||
cmp WPP_RECORDER_INITIALIZED,rdx
|
||||
jne J15e
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
mov DWORD PTR [rsp+40h],r12d
|
||||
mov QWORD PTR [rsp+38h],rax
|
||||
mov QWORD PTR [rsp+30h],rsi
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J15e:
|
||||
|
||||
mov rcx,QWORD PTR [rsi+18h]
|
||||
mov r8,r12
|
||||
mov rdx,r14
|
||||
call memmove
|
||||
mov QWORD PTR [rsi+38h],r12
|
||||
lea rcx,[rbp-10h]
|
||||
xor r8d,r8d
|
||||
mov DWORD PTR [rsi+30h],r8d
|
||||
add rsi,0a8h
|
||||
mov DWORD PTR [r13+8h],r12d
|
||||
mov rax,QWORD PTR [rbp-8h]
|
||||
cmp QWORD PTR [rax],rcx
|
||||
jne J495
|
||||
mov r13,QWORD PTR [rbp+48h]
|
||||
lea rcx,[rbp-10h]
|
||||
mov QWORD PTR [rsi],rcx
|
||||
mov QWORD PTR [rsi+8h],rax
|
||||
mov QWORD PTR [rax],rsi
|
||||
mov QWORD PTR [rbp-8h],rsi
|
||||
|
||||
J1aa:
|
||||
|
||||
mov eax,r12d
|
||||
add r14,rax
|
||||
sub ebx,r12d
|
||||
lea r12,WPP_RECORDER_INITIALIZED
|
||||
xor esi,esi
|
||||
cmp WPP_RECORDER_INITIALIZED,r12
|
||||
jne J1e4
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],si
|
||||
je J1e4
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov DWORD PTR [rsp+30h],ebx
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J1e4:
|
||||
|
||||
test ebx,ebx
|
||||
je J41d
|
||||
cmp WPP_RECORDER_INITIALIZED,r12
|
||||
jne J22f
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],si
|
||||
je J22f
|
||||
mov eax,DWORD PTR [rdi+54h]
|
||||
mov r9d,36h
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov DWORD PTR [rsp+38h],ebx
|
||||
lea edx,[rax+rax*2]
|
||||
mov eax,DWORD PTR [rdi+88h]
|
||||
shl edx,3h
|
||||
sub eax,edx
|
||||
mov DWORD PTR [rsp+30h],eax
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J22f:
|
||||
|
||||
mov ecx,DWORD PTR [rdi+88h]
|
||||
cmp ecx,ebx
|
||||
mov r12d,ecx
|
||||
cmovae r12d,ebx
|
||||
sub ecx,DWORD PTR [rdi+70h]
|
||||
mov ebx,DWORD PTR [rdi+68h]
|
||||
add ebx,ecx
|
||||
lea rax,WPP_RECORDER_INITIALIZED
|
||||
cmp WPP_RECORDER_INITIALIZED,rax
|
||||
jne J287
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],si
|
||||
je J287
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov r9d,38h
|
||||
mov DWORD PTR [rsp+38h],ebx
|
||||
mov DWORD PTR [rsp+30h],r12d
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
lea rax,WPP_RECORDER_INITIALIZED
|
||||
|
||||
J287:
|
||||
|
||||
cmp r12d,ebx
|
||||
mov esi,r12d
|
||||
cmovae esi,ebx
|
||||
cmp WPP_RECORDER_INITIALIZED,rax
|
||||
jne J2cc
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
xor eax,eax
|
||||
cmp WORD PTR [rcx+48h],ax
|
||||
je J2cc
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
lea r9d,[rax+39h]
|
||||
mov rax,QWORD PTR [rdi+70h]
|
||||
mov QWORD PTR [rsp+40h],rax
|
||||
mov QWORD PTR [rsp+38h],r14
|
||||
mov DWORD PTR [rsp+30h],esi
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J2cc:
|
||||
|
||||
mov rcx,QWORD PTR [rdi+70h]
|
||||
mov rdx,r14
|
||||
mov r8d,esi
|
||||
mov ebx,esi
|
||||
call memmove
|
||||
add QWORD PTR [rdi+70h],rbx
|
||||
add r14,rbx
|
||||
mov rdx,QWORD PTR [rdi+68h]
|
||||
mov eax,DWORD PTR [rdi+88h]
|
||||
mov rcx,QWORD PTR [rdi+70h]
|
||||
add rax,rdx
|
||||
cmp rcx,rax
|
||||
jb J301
|
||||
mov QWORD PTR [rdi+70h],rdx
|
||||
mov rcx,rdx
|
||||
|
||||
J301:
|
||||
|
||||
mov ebx,r12d
|
||||
sub ebx,esi
|
||||
je J362
|
||||
lea rdx,WPP_RECORDER_INITIALIZED
|
||||
mov rax,rcx
|
||||
cmp WPP_RECORDER_INITIALIZED,rdx
|
||||
jne J350
|
||||
mov rdx, QWORD PTR WPP_GLOBAL_Control
|
||||
xor r8d,r8d
|
||||
cmp WORD PTR [rdx+48h],r8w
|
||||
je J350
|
||||
mov QWORD PTR [rsp+40h],rcx
|
||||
lea r9d,[r8+03ah]
|
||||
mov rcx,QWORD PTR [rdx+40h]
|
||||
mov QWORD PTR [rsp+38h],r14
|
||||
mov DWORD PTR [rsp+30h],ebx
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
mov rax,QWORD PTR [rdi+70h]
|
||||
|
||||
J350:
|
||||
|
||||
mov r8,rbx
|
||||
mov rdx,r14
|
||||
mov rcx,rax
|
||||
call memmove
|
||||
add QWORD PTR [rdi+70h],rbx
|
||||
|
||||
J362:
|
||||
|
||||
mov ecx,r12d
|
||||
mov rax,0aaaaaaaaaaaaaaabh
|
||||
mul rcx
|
||||
shr rdx,4h
|
||||
add DWORD PTR [rdi+54h],edx
|
||||
mov ecx,DWORD PTR [r13+0h]
|
||||
add ecx,edx
|
||||
mov eax,ecx
|
||||
mov DWORD PTR [r13+0h],ecx
|
||||
lea r12,WPP_RECORDER_INITIALIZED
|
||||
xor esi,esi
|
||||
cmp WPP_RECORDER_INITIALIZED,r12
|
||||
jne J41d
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],si
|
||||
je J41d
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov DWORD PTR [rsp+48h],eax
|
||||
mov rax,QWORD PTR [rdi+78h]
|
||||
mov QWORD PTR [rsp+40h],rax
|
||||
mov rax,QWORD PTR [rdi+70h]
|
||||
mov QWORD PTR [rsp+38h],rax
|
||||
mov eax,DWORD PTR [rdi+54h]
|
||||
mov DWORD PTR [rsp+30h],eax
|
||||
mov QWORD PTR [rsp+28h],r15
|
||||
call WPP_RECORDER_SF
|
||||
jmp J41d
|
||||
|
||||
J3d5:
|
||||
|
||||
mov rcx,rdi
|
||||
call MouseClassDequeueRead
|
||||
mov rbx,rax
|
||||
test rax,rax
|
||||
je J422
|
||||
mov rdx,rax
|
||||
mov rcx,rdi
|
||||
call MouseClassReadCopyData
|
||||
mov DWORD PTR [rbx+30h],eax
|
||||
lea rcx,[rbp-10h]
|
||||
mov rdx,QWORD PTR [rbp-8h]
|
||||
lea rax,[rbx+0a8h]
|
||||
cmp QWORD PTR [rdx],rcx
|
||||
jne J495
|
||||
mov QWORD PTR [rax+8h],rdx
|
||||
lea rcx,[rbp-10h]
|
||||
mov QWORD PTR [rax],rcx
|
||||
mov QWORD PTR [rdx],rax
|
||||
mov QWORD PTR [rbp-8h],rax
|
||||
|
||||
J41d:
|
||||
|
||||
cmp DWORD PTR [rdi+54h],esi
|
||||
|
||||
|
||||
ja J3d5
|
||||
|
||||
J422:
|
||||
|
||||
lea rcx,[rdi+90h]
|
||||
call QWORD PTR _KeReleaseSpinLockFromDpcLevel
|
||||
nop DWORD PTR [rax+rax*1+0h]
|
||||
|
||||
J435:
|
||||
|
||||
mov rbx,QWORD PTR [rbp-10h]
|
||||
lea rax,[rbp-10h]
|
||||
cmp rbx,rax
|
||||
je J49c
|
||||
lea rax,[rbp-10h]
|
||||
cmp QWORD PTR [rbx+8h],rax
|
||||
jne J495
|
||||
mov rax,QWORD PTR [rbx]
|
||||
cmp QWORD PTR [rax+8h],rbx
|
||||
jne J495
|
||||
lea rcx,[rbp-10h]
|
||||
mov QWORD PTR [rbp-10h],rax
|
||||
mov QWORD PTR [rax+8h],rcx
|
||||
mov dl,6h
|
||||
lea rcx,[rbx-0a8h]
|
||||
call QWORD PTR _IofCompleteRequest
|
||||
nop DWORD PTR [rax+rax*1+0h]
|
||||
lea rcx,[rdi+20h]
|
||||
mov r8d,20h
|
||||
lea rdx,[rbx-0a8h]
|
||||
call QWORD PTR _IoReleaseRemoveLockEx
|
||||
nop DWORD PTR [rax+rax*1+0h]
|
||||
jmp J435
|
||||
|
||||
J495:
|
||||
|
||||
mov ecx,3h
|
||||
int 29h
|
||||
|
||||
J49C:
|
||||
|
||||
cmp WPP_RECORDER_INITIALIZED,r12
|
||||
jne J4c7
|
||||
mov rcx, QWORD PTR WPP_GLOBAL_Control
|
||||
cmp WORD PTR [rcx+48h],si
|
||||
je J4c7
|
||||
mov rcx,QWORD PTR [rcx+40h]
|
||||
mov r9d,3ch
|
||||
mov dl,5h
|
||||
lea r8d,[r9-39h]
|
||||
call WPP_RECORDER_SF
|
||||
|
||||
J4c7:
|
||||
|
||||
lea r11,[rsp+70h]
|
||||
mov rbx,QWORD PTR [r11+30h]
|
||||
mov rsi,QWORD PTR [r11+38h]
|
||||
mov rdi,QWORD PTR [r11+40h]
|
||||
mov rsp,r11
|
||||
pop r15
|
||||
pop r14
|
||||
pop r13
|
||||
pop r12
|
||||
pop rbp
|
||||
ret
|
||||
MouseClassServiceCallback endp
|
||||
|
||||
end
|
||||
|
||||
|
||||
```
|
||||
@@ -0,0 +1,719 @@
|
||||
Project Path: arc_ekknod_MouseClassServiceCallbackTrick_p4p1gddl
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_ekknod_MouseClassServiceCallbackTrick_p4p1gddl
|
||||
├── MouseClassServiceCallbackTrick.sln
|
||||
├── MouseClassServiceCallbackTrick.vcxproj
|
||||
├── MouseClassServiceCallbackTrick.vcxproj.filters
|
||||
├── MouseClassServiceCallbackTrick.vcxproj.user
|
||||
├── README.md
|
||||
├── main.c
|
||||
└── mouse.asm
|
||||
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackTrick.sln`:
|
||||
|
||||
```sln
|
||||
|
||||
Microsoft Visual Studio Solution File, Format Version 12.00
|
||||
# Visual Studio Version 17
|
||||
VisualStudioVersion = 17.2.32630.192
|
||||
MinimumVisualStudioVersion = 10.0.40219.1
|
||||
Project("{8BC9CEB8-8B4A-11D0-8D11-00A0C91BC942}") = "MouseClassServiceCallbackTrick", "MouseClassServiceCallbackTrick.vcxproj", "{D2002713-76DD-4F66-921E-42F9405372B1}"
|
||||
EndProject
|
||||
Global
|
||||
GlobalSection(SolutionConfigurationPlatforms) = preSolution
|
||||
Debug|ARM64 = Debug|ARM64
|
||||
Debug|x64 = Debug|x64
|
||||
Release|ARM64 = Release|ARM64
|
||||
Release|x64 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(ProjectConfigurationPlatforms) = postSolution
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|ARM64.ActiveCfg = Debug|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|ARM64.Build.0 = Debug|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|ARM64.Deploy.0 = Debug|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|x64.ActiveCfg = Debug|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|x64.Build.0 = Debug|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Debug|x64.Deploy.0 = Debug|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|ARM64.ActiveCfg = Release|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|ARM64.Build.0 = Release|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|ARM64.Deploy.0 = Release|ARM64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|x64.ActiveCfg = Release|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|x64.Build.0 = Release|x64
|
||||
{D2002713-76DD-4F66-921E-42F9405372B1}.Release|x64.Deploy.0 = Release|x64
|
||||
EndGlobalSection
|
||||
GlobalSection(SolutionProperties) = preSolution
|
||||
HideSolutionNode = FALSE
|
||||
EndGlobalSection
|
||||
GlobalSection(ExtensibilityGlobals) = postSolution
|
||||
SolutionGuid = {AB3EBD45-1882-414A-A597-95D80D86AD83}
|
||||
EndGlobalSection
|
||||
EndGlobal
|
||||
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackTrick.vcxproj`:
|
||||
|
||||
```vcxproj
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project DefaultTargets="Build" ToolsVersion="12.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup Label="ProjectConfigurations">
|
||||
<ProjectConfiguration Include="Debug|x64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|x64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>x64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Debug|ARM64">
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
<ProjectConfiguration Include="Release|ARM64">
|
||||
<Configuration>Release</Configuration>
|
||||
<Platform>ARM64</Platform>
|
||||
</ProjectConfiguration>
|
||||
</ItemGroup>
|
||||
<PropertyGroup Label="Globals">
|
||||
<ProjectGuid>{D2002713-76DD-4F66-921E-42F9405372B1}</ProjectGuid>
|
||||
<TemplateGuid>{1bc93793-694f-48fe-9372-81e2b05556fd}</TemplateGuid>
|
||||
<TargetFrameworkVersion>v4.5</TargetFrameworkVersion>
|
||||
<MinimumVisualStudioVersion>12.0</MinimumVisualStudioVersion>
|
||||
<Configuration>Debug</Configuration>
|
||||
<Platform Condition="'$(Platform)' == ''">x64</Platform>
|
||||
<RootNamespace>MouseClassServiceCallbackMeme</RootNamespace>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.Default.props" />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
<Driver_SpectreMitigation>false</Driver_SpectreMitigation>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>true</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'" Label="Configuration">
|
||||
<TargetVersion>Windows10</TargetVersion>
|
||||
<UseDebugLibraries>false</UseDebugLibraries>
|
||||
<PlatformToolset>WindowsKernelModeDriver10.0</PlatformToolset>
|
||||
<ConfigurationType>Driver</ConfigurationType>
|
||||
<DriverType>KMDF</DriverType>
|
||||
<DriverTargetPlatform>Universal</DriverTargetPlatform>
|
||||
</PropertyGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.props" />
|
||||
<ImportGroup Label="ExtensionSettings" />
|
||||
<ImportGroup Label="PropertySheets">
|
||||
<Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
|
||||
</ImportGroup>
|
||||
<PropertyGroup Label="UserMacros" />
|
||||
<PropertyGroup />
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<PropertyGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DebuggerFlavor>DbgengKernelDebugger</DebuggerFlavor>
|
||||
</PropertyGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|x64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|x64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
<Link>
|
||||
<EntryPointSymbol>DriverEntry</EntryPointSymbol>
|
||||
</Link>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Release|ARM64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemDefinitionGroup Condition="'$(Configuration)|$(Platform)'=='Debug|ARM64'">
|
||||
<DriverSign>
|
||||
<FileDigestAlgorithm>sha256</FileDigestAlgorithm>
|
||||
</DriverSign>
|
||||
</ItemDefinitionGroup>
|
||||
<ItemGroup>
|
||||
<FilesToPackage Include="$(TargetPath)" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.c" />
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="mouse.asm">
|
||||
<FileType>Document</FileType>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
<Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
|
||||
<ImportGroup Label="ExtensionTargets" />
|
||||
</Project>
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackTrick.vcxproj.filters`:
|
||||
|
||||
```filters
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="4.0" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<ItemGroup>
|
||||
<Filter Include="Source Files">
|
||||
<UniqueIdentifier>{4FC737F1-C7A5-4376-A066-2A32D752A2FF}</UniqueIdentifier>
|
||||
<Extensions>cpp;c;cc;cxx;def;odl;idl;hpj;bat;asm;asmx</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Header Files">
|
||||
<UniqueIdentifier>{93995380-89BD-4b04-88EB-625FBE52EBFB}</UniqueIdentifier>
|
||||
<Extensions>h;hpp;hxx;hm;inl;inc;xsd</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Resource Files">
|
||||
<UniqueIdentifier>{67DA6AB6-F800-4c08-8B7A-83BB121AAD01}</UniqueIdentifier>
|
||||
<Extensions>rc;ico;cur;bmp;dlg;rc2;rct;bin;rgs;gif;jpg;jpeg;jpe;resx;tiff;tif;png;wav;mfcribbon-ms</Extensions>
|
||||
</Filter>
|
||||
<Filter Include="Driver Files">
|
||||
<UniqueIdentifier>{8E41214B-6785-4CFE-B992-037D68949A14}</UniqueIdentifier>
|
||||
<Extensions>inf;inv;inx;mof;mc;</Extensions>
|
||||
</Filter>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<ClCompile Include="main.c">
|
||||
<Filter>Source Files</Filter>
|
||||
</ClCompile>
|
||||
</ItemGroup>
|
||||
<ItemGroup>
|
||||
<MASM Include="mouse.asm">
|
||||
<Filter>Source Files</Filter>
|
||||
</MASM>
|
||||
</ItemGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`MouseClassServiceCallbackTrick.vcxproj.user`:
|
||||
|
||||
```user
|
||||
<?xml version="1.0" encoding="utf-8"?>
|
||||
<Project ToolsVersion="Current" xmlns="http://schemas.microsoft.com/developer/msbuild/2003">
|
||||
<PropertyGroup>
|
||||
<ShowAllFiles>true</ShowAllFiles>
|
||||
</PropertyGroup>
|
||||
</Project>
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
# MouseClassServiceCallbackTrick
|
||||
```
|
||||
|
||||
`main.c`:
|
||||
|
||||
```c
|
||||
#include <ntifs.h>
|
||||
|
||||
/*
|
||||
* MouseClassServiceCallbackTrick
|
||||
*
|
||||
* initializing data, jmps at MouHid_ReadComplete ->
|
||||
* MouHid_ReadComplete will call MouseClassServiceCallback, what does in the end spoof the _ReturnAddress.
|
||||
*
|
||||
* this method was used safely at many platforms since of May 2021 to this day.
|
||||
*
|
||||
* the method did get blocked by VGK.sys 19.08.2022, (asdf144) did use it there.
|
||||
* from what i have heard, he didn't get banned.
|
||||
*
|
||||
* maybe they are checking: (PsGetCurrentThreadId() != 0) = block input
|
||||
* since all mouse DPC is done by system KiIdleLoop, ThreadId (0).
|
||||
*
|
||||
* otherwise should be fine, until anti-cheats start to properly validate it.
|
||||
*
|
||||
*
|
||||
* Pros: Anti-Cheat hook does get called, and if they do compare input data to game, it will match.
|
||||
* Cons: Ballsy move, its about taking risk and hoping anti-cheat is not going to check anything else than _ReturnAddress.
|
||||
*
|
||||
*/
|
||||
|
||||
typedef int BOOL;
|
||||
typedef unsigned int DWORD;
|
||||
typedef ULONG_PTR QWORD;
|
||||
|
||||
#pragma warning(disable : 4201)
|
||||
typedef struct _MOUSE_INPUT_DATA {
|
||||
USHORT UnitId;
|
||||
USHORT Flags;
|
||||
union {
|
||||
ULONG Buttons;
|
||||
struct {
|
||||
USHORT ButtonFlags;
|
||||
USHORT ButtonData;
|
||||
};
|
||||
};
|
||||
ULONG RawButtons;
|
||||
LONG LastX;
|
||||
LONG LastY;
|
||||
ULONG ExtraInformation;
|
||||
} MOUSE_INPUT_DATA, *PMOUSE_INPUT_DATA;
|
||||
|
||||
|
||||
|
||||
typedef struct _MOUSE_OBJECT
|
||||
{
|
||||
PDEVICE_OBJECT mouse_device;
|
||||
QWORD service_callback;
|
||||
BOOL use_mouse;
|
||||
} MOUSE_OBJECT, * PMOUSE_OBJECT;
|
||||
|
||||
|
||||
BOOL mouse_open(void);
|
||||
MOUSE_OBJECT gMouseObject;
|
||||
|
||||
|
||||
|
||||
NTSYSCALLAPI
|
||||
POBJECT_TYPE* IoDriverObjectType;
|
||||
|
||||
NTSYSCALLAPI
|
||||
NTSTATUS
|
||||
ObReferenceObjectByName(
|
||||
__in PUNICODE_STRING ObjectName,
|
||||
__in ULONG Attributes,
|
||||
__in_opt PACCESS_STATE AccessState,
|
||||
__in_opt ACCESS_MASK DesiredAccess,
|
||||
__in POBJECT_TYPE ObjectType,
|
||||
__in KPROCESSOR_MODE AccessMode,
|
||||
__inout_opt PVOID ParseContext,
|
||||
__out PVOID *Object
|
||||
);
|
||||
|
||||
|
||||
void NtSleep(DWORD milliseconds)
|
||||
{
|
||||
QWORD ms = milliseconds;
|
||||
ms = (ms * 1000) * 10;
|
||||
ms = ms * -1;
|
||||
#ifdef _KERNEL_MODE
|
||||
KeDelayExecutionThread(KernelMode, 0, (PLARGE_INTEGER)&ms);
|
||||
#else
|
||||
NtDelayExecution(0, (PLARGE_INTEGER)&ms);
|
||||
#endif
|
||||
}
|
||||
|
||||
void mouse_move(long x, long y, unsigned short button_flags);
|
||||
static QWORD GetSystemBaseAddress(PDRIVER_OBJECT DriverObject, const unsigned short* driver_name);
|
||||
static QWORD FindPattern(QWORD module, unsigned char *bMask, char *szMask, QWORD len);
|
||||
|
||||
VOID
|
||||
DriverUnload(
|
||||
_In_ struct _DRIVER_OBJECT* DriverObject
|
||||
)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(DriverObject);
|
||||
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] MouseClassServiceCallbackTrick.sys is closed\n");
|
||||
}
|
||||
|
||||
QWORD g_target_routine = 0;
|
||||
|
||||
NTSTATUS DriverEntry(
|
||||
_In_ PDRIVER_OBJECT DriverObject,
|
||||
_In_ PUNICODE_STRING RegistryPath
|
||||
)
|
||||
{
|
||||
UNREFERENCED_PARAMETER(DriverObject);
|
||||
UNREFERENCED_PARAMETER(RegistryPath);
|
||||
|
||||
if (!mouse_open())
|
||||
{
|
||||
return STATUS_DRIVER_ENTRYPOINT_NOT_FOUND;
|
||||
}
|
||||
|
||||
|
||||
QWORD base = GetSystemBaseAddress(DriverObject, L"mouhid.sys");
|
||||
if (base == 0)
|
||||
{
|
||||
return STATUS_DRIVER_ENTRYPOINT_NOT_FOUND;
|
||||
}
|
||||
|
||||
g_target_routine = FindPattern((QWORD)base, (unsigned char*)"\x74\x54", "xx", 2);
|
||||
if (g_target_routine == 0)
|
||||
{
|
||||
return STATUS_DRIVER_ENTRYPOINT_NOT_FOUND;
|
||||
}
|
||||
g_target_routine += 0x56;
|
||||
|
||||
|
||||
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] MouseClassServiceCallbackTrick.sys is launched\n");
|
||||
DriverObject->DriverUnload = DriverUnload;
|
||||
|
||||
|
||||
for (int i = 0; i < 32; i++) {
|
||||
NtSleep(100);
|
||||
DbgPrintEx(DPFLTR_IHVDRIVER_ID, DPFLTR_ERROR_LEVEL, "[+] Moving mouse\n");
|
||||
|
||||
mouse_move(-10, -10, 0);
|
||||
}
|
||||
|
||||
|
||||
return STATUS_SUCCESS;
|
||||
}
|
||||
|
||||
BOOL mouse_open(void)
|
||||
{
|
||||
// https://github.com/nbqofficial/norsefire
|
||||
|
||||
if (gMouseObject.use_mouse == 0) {
|
||||
|
||||
UNICODE_STRING class_string;
|
||||
RtlInitUnicodeString(&class_string, L"\\Driver\\MouClass");
|
||||
|
||||
|
||||
PDRIVER_OBJECT class_driver_object = NULL;
|
||||
NTSTATUS status = ObReferenceObjectByName(&class_string, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&class_driver_object);
|
||||
if (!NT_SUCCESS(status)) {
|
||||
gMouseObject.use_mouse = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
UNICODE_STRING hid_string;
|
||||
RtlInitUnicodeString(&hid_string, L"\\Driver\\MouHID");
|
||||
|
||||
|
||||
PDRIVER_OBJECT hid_driver_object = NULL;
|
||||
|
||||
status = ObReferenceObjectByName(&hid_string, OBJ_CASE_INSENSITIVE, NULL, 0, *IoDriverObjectType, KernelMode, NULL, (PVOID*)&hid_driver_object);
|
||||
if (!NT_SUCCESS(status))
|
||||
{
|
||||
if (class_driver_object) {
|
||||
ObfDereferenceObject(class_driver_object);
|
||||
}
|
||||
gMouseObject.use_mouse = 0;
|
||||
return 0;
|
||||
}
|
||||
|
||||
PVOID class_driver_base = NULL;
|
||||
|
||||
|
||||
PDEVICE_OBJECT hid_device_object = hid_driver_object->DeviceObject;
|
||||
while (hid_device_object && !gMouseObject.service_callback)
|
||||
{
|
||||
PDEVICE_OBJECT class_device_object = class_driver_object->DeviceObject;
|
||||
while (class_device_object && !gMouseObject.service_callback)
|
||||
{
|
||||
if (!class_device_object->NextDevice && !gMouseObject.mouse_device)
|
||||
{
|
||||
gMouseObject.mouse_device = class_device_object;
|
||||
}
|
||||
|
||||
PULONG_PTR device_extension = (PULONG_PTR)hid_device_object->DeviceExtension;
|
||||
ULONG_PTR device_ext_size = ((ULONG_PTR)hid_device_object->DeviceObjectExtension - (ULONG_PTR)hid_device_object->DeviceExtension) / 4;
|
||||
class_driver_base = class_driver_object->DriverStart;
|
||||
for (ULONG_PTR i = 0; i < device_ext_size; i++)
|
||||
{
|
||||
if (device_extension[i] == (ULONG_PTR)class_device_object && device_extension[i + 1] > (ULONG_PTR)class_driver_object)
|
||||
{
|
||||
gMouseObject.service_callback = (QWORD)(device_extension[i + 1]);
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
class_device_object = class_device_object->NextDevice;
|
||||
}
|
||||
hid_device_object = hid_device_object->AttachedDevice;
|
||||
}
|
||||
|
||||
if (!gMouseObject.mouse_device)
|
||||
{
|
||||
PDEVICE_OBJECT target_device_object = class_driver_object->DeviceObject;
|
||||
while (target_device_object)
|
||||
{
|
||||
if (!target_device_object->NextDevice)
|
||||
{
|
||||
gMouseObject.mouse_device = target_device_object;
|
||||
break;
|
||||
}
|
||||
target_device_object = target_device_object->NextDevice;
|
||||
}
|
||||
}
|
||||
|
||||
ObfDereferenceObject(class_driver_object);
|
||||
ObfDereferenceObject(hid_driver_object);
|
||||
|
||||
if (gMouseObject.mouse_device && gMouseObject.service_callback) {
|
||||
gMouseObject.use_mouse = 1;
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
return gMouseObject.mouse_device && gMouseObject.service_callback;
|
||||
}
|
||||
|
||||
VOID MouseClassServiceCallbackTrick(QWORD rdi_buffer, QWORD rbp_buffer, QWORD target_address);
|
||||
void mouse_move(long x, long y, unsigned short button_flags)
|
||||
{
|
||||
char rdi_buffer[0x500];
|
||||
char rbp_buffer[0x100];
|
||||
|
||||
for (QWORD i = 0; i < 0x500; i++)
|
||||
rdi_buffer[i] = 0;
|
||||
|
||||
for (QWORD i = 0; i < 0x100; i++)
|
||||
rbp_buffer[i] = 0;
|
||||
|
||||
MOUSE_INPUT_DATA *mid = (MOUSE_INPUT_DATA*)&rdi_buffer[0x160];
|
||||
*(QWORD*)&rdi_buffer[0x178] = (QWORD)(PMOUSE_INPUT_DATA)mid + 1;
|
||||
|
||||
mid->LastX = x;
|
||||
mid->LastY = y;
|
||||
mid->ButtonFlags = button_flags;
|
||||
mid->UnitId = 1;
|
||||
|
||||
*(QWORD*)&rdi_buffer[0xE0] = (QWORD)gMouseObject.mouse_device;
|
||||
*(QWORD*)&rdi_buffer[0xE8] = (QWORD)gMouseObject.service_callback;
|
||||
MouseClassServiceCallbackTrick( (QWORD)rdi_buffer, (QWORD)rbp_buffer, (QWORD)g_target_routine );
|
||||
}
|
||||
|
||||
#pragma warning(disable : 4201)
|
||||
typedef struct _LDR_DATA_TABLE_ENTRY
|
||||
{
|
||||
LIST_ENTRY InLoadOrderLinks;
|
||||
LIST_ENTRY InMemoryOrderLinks;
|
||||
LIST_ENTRY InInitializationOrderLinks;
|
||||
PVOID DllBase;
|
||||
PVOID EntryPoint;
|
||||
ULONG SizeOfImage;
|
||||
UNICODE_STRING FullDllName;
|
||||
UNICODE_STRING BaseDllName;
|
||||
ULONG Flags;
|
||||
short LoadCount;
|
||||
short TlsIndex;
|
||||
union
|
||||
{
|
||||
LIST_ENTRY HashLinks;
|
||||
struct
|
||||
{
|
||||
PVOID SectionPointer;
|
||||
ULONG CheckSum;
|
||||
};
|
||||
};
|
||||
union
|
||||
{
|
||||
ULONG TimeDateStamp;
|
||||
PVOID LoadedImports;
|
||||
};
|
||||
PVOID* EntryPointActivationContext;
|
||||
PVOID PatchInformation;
|
||||
LIST_ENTRY ForwarderLinks;
|
||||
LIST_ENTRY ServiceTagLinks;
|
||||
LIST_ENTRY StaticLinks;
|
||||
} LDR_DATA_TABLE_ENTRY, * PLDR_DATA_TABLE_ENTRY;
|
||||
|
||||
static QWORD GetSystemBaseAddress(PDRIVER_OBJECT DriverObject, const unsigned short* driver_name)
|
||||
{
|
||||
PLDR_DATA_TABLE_ENTRY ldr = (PLDR_DATA_TABLE_ENTRY)DriverObject->DriverSection;
|
||||
for (PLIST_ENTRY pListEntry = ldr->InLoadOrderLinks.Flink; pListEntry != &ldr->InLoadOrderLinks; pListEntry = pListEntry->Flink)
|
||||
{
|
||||
PLDR_DATA_TABLE_ENTRY pEntry = CONTAINING_RECORD(pListEntry, LDR_DATA_TABLE_ENTRY, InLoadOrderLinks);
|
||||
if (pEntry->BaseDllName.Buffer && wcscmp(pEntry->BaseDllName.Buffer, driver_name) == 0) {
|
||||
|
||||
return (QWORD)pEntry->DllBase;
|
||||
}
|
||||
}
|
||||
return 0;
|
||||
}
|
||||
|
||||
typedef unsigned char BYTE;
|
||||
|
||||
static BOOLEAN bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
|
||||
{
|
||||
for (; *szMask; ++szMask, ++pData, ++bMask)
|
||||
if ((*szMask == 1 || *szMask == 'x') && *pData != *bMask)
|
||||
return 0;
|
||||
return (*szMask) == 0;
|
||||
}
|
||||
|
||||
static QWORD FindPatternEx(UINT64 dwAddress, QWORD dwLen, BYTE *bMask, char * szMask)
|
||||
{
|
||||
if (dwLen <= 0)
|
||||
return 0;
|
||||
for (QWORD i = 0; i < dwLen; i++)
|
||||
if (bDataCompare((BYTE*)(dwAddress + i), bMask, szMask))
|
||||
return (QWORD)(dwAddress + i);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
||||
#ifdef _KERNEL_MODE
|
||||
typedef struct _IMAGE_DOS_HEADER { // DOS .EXE header
|
||||
unsigned short e_magic; // Magic number
|
||||
unsigned short e_cblp; // Bytes on last page of file
|
||||
unsigned short e_cp; // Pages in file
|
||||
unsigned short e_crlc; // Relocations
|
||||
unsigned short e_cparhdr; // Size of header in paragraphs
|
||||
unsigned short e_minalloc; // Minimum extra paragraphs needed
|
||||
unsigned short e_maxalloc; // Maximum extra paragraphs needed
|
||||
unsigned short e_ss; // Initial (relative) SS value
|
||||
unsigned short e_sp; // Initial SP value
|
||||
unsigned short e_csum; // Checksum
|
||||
unsigned short e_ip; // Initial IP value
|
||||
unsigned short e_cs; // Initial (relative) CS value
|
||||
unsigned short e_lfarlc; // File address of relocation table
|
||||
unsigned short e_ovno; // Overlay number
|
||||
unsigned short e_res[4]; // Reserved words
|
||||
unsigned short e_oemid; // OEM identifier (for e_oeminfo)
|
||||
unsigned short e_oeminfo; // OEM information; e_oemid specific
|
||||
unsigned short e_res2[10]; // Reserved words
|
||||
LONG e_lfanew; // File address of new exe header
|
||||
} IMAGE_DOS_HEADER, *PIMAGE_DOS_HEADER;
|
||||
|
||||
typedef struct _IMAGE_FILE_HEADER {
|
||||
unsigned short Machine;
|
||||
unsigned short NumberOfSections;
|
||||
DWORD TimeDateStamp;
|
||||
DWORD PointerToSymbolTable;
|
||||
DWORD NumberOfSymbols;
|
||||
unsigned short SizeOfOptionalHeader;
|
||||
unsigned short Characteristics;
|
||||
} IMAGE_FILE_HEADER, *PIMAGE_FILE_HEADER;
|
||||
|
||||
typedef struct _IMAGE_DATA_DIRECTORY {
|
||||
DWORD VirtualAddress;
|
||||
DWORD Size;
|
||||
} IMAGE_DATA_DIRECTORY, *PIMAGE_DATA_DIRECTORY;
|
||||
|
||||
typedef struct _IMAGE_OPTIONAL_HEADER64 {
|
||||
short Magic;
|
||||
BYTE MajorLinkerVersion;
|
||||
BYTE MinorLinkerVersion;
|
||||
DWORD SizeOfCode;
|
||||
DWORD SizeOfInitializedData;
|
||||
DWORD SizeOfUninitializedData;
|
||||
DWORD AddressOfEntryPoint;
|
||||
DWORD BaseOfCode;
|
||||
ULONGLONG ImageBase;
|
||||
DWORD SectionAlignment;
|
||||
DWORD FileAlignment;
|
||||
unsigned short MajorOperatingSystemVersion;
|
||||
unsigned short MinorOperatingSystemVersion;
|
||||
unsigned short MajorImageVersion;
|
||||
unsigned short MinorImageVersion;
|
||||
unsigned short MajorSubsystemVersion;
|
||||
unsigned short MinorSubsystemVersion;
|
||||
DWORD Win32VersionValue;
|
||||
DWORD SizeOfImage;
|
||||
DWORD SizeOfHeaders;
|
||||
DWORD CheckSum;
|
||||
unsigned short Subsystem;
|
||||
unsigned short DllCharacteristics;
|
||||
ULONGLONG SizeOfStackReserve;
|
||||
ULONGLONG SizeOfStackCommit;
|
||||
ULONGLONG SizeOfHeapReserve;
|
||||
ULONGLONG SizeOfHeapCommit;
|
||||
DWORD LoaderFlags;
|
||||
DWORD NumberOfRvaAndSizes;
|
||||
IMAGE_DATA_DIRECTORY DataDirectory[16];
|
||||
} IMAGE_OPTIONAL_HEADER64, *PIMAGE_OPTIONAL_HEADER64;
|
||||
|
||||
typedef struct _IMAGE_NT_HEADERS64 {
|
||||
DWORD Signature;
|
||||
IMAGE_FILE_HEADER FileHeader;
|
||||
IMAGE_OPTIONAL_HEADER64 OptionalHeader;
|
||||
} IMAGE_NT_HEADERS64, *PIMAGE_NT_HEADERS64;
|
||||
|
||||
typedef struct _IMAGE_SECTION_HEADER {
|
||||
BYTE Name[8];
|
||||
union {
|
||||
DWORD PhysicalAddress;
|
||||
DWORD VirtualSize;
|
||||
} Misc;
|
||||
DWORD VirtualAddress;
|
||||
DWORD SizeOfRawData;
|
||||
DWORD PointerToRawData;
|
||||
DWORD PointerToRelocations;
|
||||
DWORD PointerToLinenumbers;
|
||||
unsigned short NumberOfRelocations;
|
||||
unsigned short NumberOfLinenumbers;
|
||||
DWORD Characteristics;
|
||||
} IMAGE_SECTION_HEADER, *PIMAGE_SECTION_HEADER;
|
||||
#endif
|
||||
|
||||
static QWORD FindPattern(QWORD module, unsigned char *bMask, char *szMask, QWORD len)
|
||||
{
|
||||
ULONG_PTR ret = 0;
|
||||
PIMAGE_DOS_HEADER pidh = (PIMAGE_DOS_HEADER)module;
|
||||
PIMAGE_NT_HEADERS pinh = (PIMAGE_NT_HEADERS)((BYTE*)pidh + pidh->e_lfanew);
|
||||
PIMAGE_SECTION_HEADER pish = (PIMAGE_SECTION_HEADER)((BYTE*)pinh + sizeof(IMAGE_NT_HEADERS64));
|
||||
|
||||
for (USHORT sec = 0; sec < pinh->FileHeader.NumberOfSections; sec++)
|
||||
{
|
||||
|
||||
if ((pish[sec].Characteristics & 0x00000020))
|
||||
{
|
||||
QWORD address = FindPatternEx(pish[sec].VirtualAddress + (ULONG_PTR)(module),
|
||||
pish[sec].Misc.VirtualSize - len, bMask, szMask);
|
||||
|
||||
if (address) {
|
||||
ret = address;
|
||||
|
||||
break;
|
||||
}
|
||||
}
|
||||
|
||||
}
|
||||
return ret;
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
`mouse.asm`:
|
||||
|
||||
```asm
|
||||
.code
|
||||
|
||||
MouseClassServiceCallbackTrick proc
|
||||
|
||||
push rbp
|
||||
push rbx
|
||||
push rsi
|
||||
push rdi
|
||||
push r12
|
||||
push r13
|
||||
push r14
|
||||
push r15
|
||||
|
||||
mov rbp, rdx
|
||||
sub rsp, 58h
|
||||
mov rdi, rcx
|
||||
|
||||
jmp r8
|
||||
MouseClassServiceCallbackTrick endp
|
||||
|
||||
end
|
||||
|
||||
|
||||
```
|
||||
@@ -0,0 +1,948 @@
|
||||
Project Path: arc_gmh5225_AI-FPS-b00m-h3adsh0t_db6tbh1x
|
||||
|
||||
Source Tree:
|
||||
|
||||
```txt
|
||||
arc_gmh5225_AI-FPS-b00m-h3adsh0t_db6tbh1x
|
||||
├── CODE_OF_CONDUCT.md
|
||||
├── README.md
|
||||
├── _config.yml
|
||||
├── azure-pipelines.yml
|
||||
├── b00m-h3adsh0t
|
||||
├── b00m-h3adsh0t.cfg
|
||||
├── calcangle.h
|
||||
├── gitchbox.cpp
|
||||
├── glitchbox.h
|
||||
├── main.cpp
|
||||
├── memory_searcher.cpp
|
||||
├── playerdata.h
|
||||
├── readme-images
|
||||
│ ├── boom headshot header.png
|
||||
│ ├── gameplay1.png
|
||||
│ ├── gameplay2.png
|
||||
│ ├── logo1.png
|
||||
│ └── logo2.png
|
||||
├── test
|
||||
└── train_game
|
||||
├── GAME.cfg
|
||||
├── GAME.names
|
||||
├── GAME.screenshots
|
||||
├── GAME.weights
|
||||
└── GAME_last.weights
|
||||
|
||||
```
|
||||
|
||||
`CODE_OF_CONDUCT.md`:
|
||||
|
||||
```md
|
||||
# Contributor Covenant Code of Conduct
|
||||
|
||||
## Our Pledge
|
||||
|
||||
In the interest of fostering an open and welcoming environment, we as
|
||||
contributors and maintainers pledge to making participation in our project and
|
||||
our community a harassment-free experience for everyone, regardless of age, body
|
||||
size, disability, ethnicity, sex characteristics, gender identity and expression,
|
||||
level of experience, education, socio-economic status, nationality, personal
|
||||
appearance, race, religion, or sexual identity and orientation.
|
||||
|
||||
## Our Standards
|
||||
|
||||
Examples of behavior that contributes to creating a positive environment
|
||||
include:
|
||||
|
||||
* Using welcoming and inclusive language
|
||||
* Being respectful of differing viewpoints and experiences
|
||||
* Gracefully accepting constructive criticism
|
||||
* Focusing on what is best for the community
|
||||
* Showing empathy towards other community members
|
||||
|
||||
Examples of unacceptable behavior by participants include:
|
||||
|
||||
* The use of sexualized language or imagery and unwelcome sexual attention or
|
||||
advances
|
||||
* Trolling, insulting/derogatory comments, and personal or political attacks
|
||||
* Public or private harassment
|
||||
* Publishing others' private information, such as a physical or electronic
|
||||
address, without explicit permission
|
||||
* Other conduct which could reasonably be considered inappropriate in a
|
||||
professional setting
|
||||
|
||||
## Our Responsibilities
|
||||
|
||||
Project maintainers are responsible for clarifying the standards of acceptable
|
||||
behavior and are expected to take appropriate and fair corrective action in
|
||||
response to any instances of unacceptable behavior.
|
||||
|
||||
Project maintainers have the right and responsibility to remove, edit, or
|
||||
reject comments, commits, code, wiki edits, issues, and other contributions
|
||||
that are not aligned to this Code of Conduct, or to ban temporarily or
|
||||
permanently any contributor for other behaviors that they deem inappropriate,
|
||||
threatening, offensive, or harmful.
|
||||
|
||||
## Scope
|
||||
|
||||
This Code of Conduct applies both within project spaces and in public spaces
|
||||
when an individual is representing the project or its community. Examples of
|
||||
representing a project or community include using an official project e-mail
|
||||
address, posting via an official social media account, or acting as an appointed
|
||||
representative at an online or offline event. Representation of a project may be
|
||||
further defined and clarified by project maintainers.
|
||||
|
||||
## Enforcement
|
||||
|
||||
Instances of abusive, harassing, or otherwise unacceptable behavior may be
|
||||
reported by contacting the project team at low.lucyy@gmail.com. All
|
||||
complaints will be reviewed and investigated and will result in a response that
|
||||
is deemed necessary and appropriate to the circumstances. The project team is
|
||||
obligated to maintain confidentiality with regard to the reporter of an incident.
|
||||
Further details of specific enforcement policies may be posted separately.
|
||||
|
||||
Project maintainers who do not follow or enforce the Code of Conduct in good
|
||||
faith may face temporary or permanent repercussions as determined by other
|
||||
members of the project's leadership.
|
||||
|
||||
## Attribution
|
||||
|
||||
This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
|
||||
available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
|
||||
|
||||
[homepage]: https://www.contributor-covenant.org
|
||||
|
||||
For answers to common questions about this code of conduct, see
|
||||
https://www.contributor-covenant.org/faq
|
||||
|
||||
```
|
||||
|
||||
`README.md`:
|
||||
|
||||
```md
|
||||
|
||||
# b00m-h3adsh0t! 🔷
|
||||
**Neural Network Configurable Aimbot for First-Person-Shooter Games in C/C++** *Note: Aimbots are cheats and illegal in gaming leagues. This repo is solely for educational purposes only.*
|
||||
|
||||
> **┬┴┬┴┬┴┤ (҂ ` ﾛ ´)︻デ═一____________________＼(º □ º )/ ├┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴┬┴**
|
||||
|
||||
<div>
|
||||
|
||||
[]()
|
||||
[](https://github.com/lucylow/Mrs.Robot/issues)
|
||||
[](https://github.com/lucylow/b00m-h3adsh0t/pulls)
|
||||
[]()
|
||||
|
||||
</div>
|
||||
|
||||
## Table of Contents 🔷
|
||||
|
||||
* [Motivation](https://github.com/lucylow/b00m-h3adsh0t#motivation)
|
||||
* [Aimbot Neural Network](https://github.com/lucylow/b00m-h3adsh0t#aimbot-neural-network-)
|
||||
* [Neural Network Model Training Recognition](https://github.com/lucylow/b00m-h3adsh0t#neural-network-model-training-recognition-)
|
||||
* [How a normal aimbot works](https://github.com/lucylow/b00m-h3adsh0t#how-a-normal-aimbot-works-)
|
||||
* [How b00m-h3adsh0t works](https://github.com/lucylow/b00m-h3adsh0t#how-b00m-h3adsh0t-works-)
|
||||
* [Client-Server Backend Implementation](https://github.com/lucylow/b00m-h3adsh0t#client-server-backend-implementation-)
|
||||
* [Security and Efficiency Game Server](https://github.com/lucylow/b00m-h3adsh0t#security-and-efficiency-game-server-)
|
||||
* [Player Behavior Statistics](https://github.com/lucylow/b00m-h3adsh0t#player-behavior-statistics-)
|
||||
* [User Privacy](https://github.com/lucylow/b00m-h3adsh0t#user-privacy-)
|
||||
* [Player Attacks](https://github.com/lucylow/b00m-h3adsh0t#player-attacks-)
|
||||
* [Glitches and Modifications](https://github.com/lucylow/b00m-h3adsh0t#glitches-and-modifications-)
|
||||
* [Conclusion](https://github.com/lucylow/b00m-h3adsh0t#conclusion-)
|
||||
* [References](https://github.com/lucylow/b00m-h3adsh0t#references-)
|
||||
|
||||
## Motivation
|
||||
* **B00m-h3adsh0t is a game bot software for first-person shooting (FPS) games** where players need to constantly move, think, strategize, and shoot enemies all at once. **Aimbot uses game data to automatically shoot at the heads of energy targets.**
|
||||
|
||||
* **Personal motivation to learn C++ compiler programming language, object oriented programing, and how a FPS game executes on an operating system**. B00m-H3adsh0t is 100% written in C++ with Visual Studio compiler providing a very fast, and efficient framework with scripting support such that the framework uses a consistent object-oriented design
|
||||
|
||||
|
||||
|
||||
*Image. “Turn off Lucy's b00m-h3adsh0t aimbot you noob K/D ratio hacker!"*
|
||||
|
||||
|
||||
|
||||
|
||||
## Aimbot Neural Network 🔷
|
||||
|
||||
* **Trained by neural network (NN) with customizable predictions and dynamic speed settings**
|
||||
* Select which FPS game you will use
|
||||
* **Engine-Aim with colored models:**
|
||||
* Hook into the FPS game engine to use actual game data to auto-aim without altering gaming files
|
||||
* Code won't work by itself because we need a handle to the game
|
||||
* Modifies memory of RAM half-life runs on
|
||||
* Gathers information from current game and pixel location
|
||||
|
||||
|
||||
|
||||
*Image. Custom training mode on the aimbot with a range of functionalities*
|
||||
|
||||
* **Custom training mode**
|
||||
* Leverage neural network to detect objects for object recognition using computer vision algorithms
|
||||
* Train with range of distances, lights, and angles for best possible recognition
|
||||
|
||||
## Neural Network Model Training Recognition 🔷
|
||||
|
||||
**Deep Reinforcement Learning**
|
||||
* Allows bot to learn how to aim by interacting with its unknown 3D environment
|
||||
* Bot receives a reward if it correctly kills an enemy, hence the name b00m-h3adsh0. If the bot dies, it gets a penalty.
|
||||
* For each step, bot observes the current states Ot of the environment and decides of an action
|
||||
* Observes reward signal where the goal of the agent is to find a policy that maximizes the expected sum of discounted rewards
|
||||
* Game states are partially observable
|
||||
|
||||
**Q-Learning Adaptation**
|
||||
* Used a Q-Learning adaptation for Deep Learning to train the autonomous agent
|
||||
* Inputs are screenshots of the fps game (pixels)
|
||||
* Deep reinforcement learning allows bot to learn game features simultaneously along with minimizing a Q-learning objective
|
||||
|
||||
**Dynamic Bayesian Network**
|
||||
* Common for aimbot detections in FPS games
|
||||
* Used for probabilistic modeling and inference in discrete-time
|
||||
* Implementation options:
|
||||
* libDAI - A free and open source C++ library for Discrete Approximate Inference in graphical models (C++)
|
||||
* Mocapy++ (C++) - A toolkit for inference and learning in dynamic Bayesian networks
|
||||
|
||||
|
||||
## How a normal aimbot works 🔷
|
||||
|
||||
* **Aimbot can be easily toggled on and off using the mouse or keyboard**
|
||||
* Recognizes game objects in a certain range, then aims at the objects using game physics
|
||||
|
||||
* **Memory Searcher with Cheat Engine**
|
||||
* Understand the memory storage structures within a game
|
||||
* Searching memory to find the values of the player classes such as player coordinates, health, mouse x,y coordinates, etc.
|
||||
* Use **Cheat engine** to find addresses (programs that scans memory depending on the search details you give it and returns the memory addresses)
|
||||
* Base address of "client.dll" (int or DWORD)
|
||||
* Read and write to the game memory
|
||||
* Call the functions **ReadProcessMemory (RPM)** and **WriteProcessMemory (WPM)**
|
||||
* Use multi-level pointers to access information to playerObjectAddress
|
||||
* **CalcAngle**
|
||||
* Needed to calculate angle functions for aimbot since everything is based on game coordinates
|
||||
* Takes two 3D positions in source and distance, and outputs the angle to distance in angles
|
||||
* Pass in the local player's eye position into src, the target's head in dst, and then set the view angles from angles
|
||||
* **Call Game Functions**
|
||||
* For internal hacks where we need to inject DLL
|
||||
* C++ programs call funtion by address via function pointers
|
||||
* **Traceline and RayTrace** commonly used in aimbots:
|
||||
* Draws a line between your player and another player
|
||||
* Checks if there are objects in the way
|
||||
* If there are no collisions between you and your target your aimbot should aim and shoot at that target
|
||||
* **Game Player Detection**
|
||||
* FPS game memory contains the **(X,Y,Z) coordinates of each player for rendering**
|
||||
* Aimbot scans memory locations for this information
|
||||
* **Gain access to two key positions** - the player and enemies coordinates
|
||||
* Subtracting the two positions as vectors == the vector between the two
|
||||
* Calculate the **angle from the player's current vector to the desired angle vector**
|
||||
|
||||
* **Aim Automatically**
|
||||
* Inject information directly to the game
|
||||
* DLL injection
|
||||
* **Overwriting current FPS game aim functions**
|
||||
* Patching in-place the Direct3D or OpenGL DLL
|
||||
* Examining the **functions calls to draw geometry**
|
||||
* Insert own geometry functions (for things like wall-hacks or glitches)
|
||||
* Fine-tune with constants adjusting for any **dynamic data structure moving players** around on you
|
||||
|
||||
|
||||
## How b00m-h3adsh0t works 🔷
|
||||
|
||||
* **Neural Network**
|
||||
|
||||
* Program takes **multiple screenshots** to recognize objects
|
||||
* Different distances, lights, angles for best possible recognition
|
||||
* Output - program writes in **cfg file**
|
||||
* Batch = 1
|
||||
* Subdivision = 1 for testing
|
||||
* Graph of **Training/Validation Set**
|
||||
* Graph x vs y
|
||||
* Error Rate vs Number of Iterations in Training Set
|
||||
|
||||
* **Training Depenencies - Trained Files for Games**
|
||||
|
||||
* Use **b00m-h3adsh0t.cfg file** to change the resolution range for object recognition
|
||||
* Train Files Folder
|
||||
* Darknet folder/subfolders
|
||||
* Data or back up
|
||||
* GAME.names
|
||||
* GAME.cfg
|
||||
* GAME_last.weights
|
||||
* GAME.weights
|
||||
## Client-Server Backend Implementation 🔷
|
||||
|
||||
* Computer has to display the gameplay to the user by rendering the whole map and every player in it
|
||||
|
||||
* **Client–Server Model Method**
|
||||
|
||||
* Model instantaneously calculating/sending game results
|
||||
* **Client sessions run synchronously with aimbot server with user input data**
|
||||
* Run aimbot purely on game server
|
||||
* Run server mirrors client gameplay and continuously validates each game state
|
||||
|
||||
* **Modifying Game Rules World Method**
|
||||
|
||||
* Aimbot targets servers with no rule enforcement or data integrity
|
||||
* **Synchronize all client data with information about all of the other clients**
|
||||
* Reveals where all the players in the game are via (X,Y,Z) coordinates
|
||||
* Reveals user game states with information on player names, position, clip ammo, ammo count, health, class, weapons, frame rate and more.
|
||||
* Data from client will allow player to break game rules, manipulate server, or manipulate other clients
|
||||
|
||||
## Security and Efficiency Game Server 🔷
|
||||
|
||||
* Server responsible for information security and enforcing game rules
|
||||
|
||||
* **Sending Game World State needed for Immediate Display**
|
||||
* Results in client lag under bandwidth constraints
|
||||
|
||||
* **Sending the Player the Entire World State**
|
||||
* Results in faster display for player under the same bandwidth constraints
|
||||
* Exposes data to interception or manipulation
|
||||
* Trade-off between security and efficiency
|
||||
|
||||
## Player Behavior Statistics 🔷
|
||||
Refer to playerdata.h file
|
||||
|
||||
* **Aimbot Evaluation Metrics**
|
||||
* Compare human player with b00m-h3eadsh0t agent
|
||||
* K/D Ratio to compare ratio of kills to deaths
|
||||
* Single player vs multi-player games
|
||||
|
||||
* **Pattern Detection Systems**
|
||||
* Scan player's hard drives for known cheat code or programs
|
||||
* Scan player's system memory for known cheat code or programs
|
||||
* Labor-intensive to constantly track down cheats and update detection patterns
|
||||
|
||||
* **Anti–Cheat Method**
|
||||
* Guaranteed to work on all end–user system configurations
|
||||
* Reduce the amount of false positives
|
||||
|
||||
* **Player Behavior Anomalie Detection**
|
||||
* Detected by statistically analyzing game events
|
||||
* Data sent by client to server by statistical detection systems
|
||||
* Add human element of supervision system (community/admin team looks over player statistics)
|
||||
|
||||
|
||||
|
||||
*Image. Unusual player behavior leads to clientside creating then uploading a gamer report*
|
||||
|
||||
## User Privacy 🔷
|
||||
|
||||
* **End–users concerned with privacy issues and "Never trust the client" is common saying with game developers**
|
||||
* VAC (Valve Anti-Cheat) accessing browsing history
|
||||
* User privacy compromised with packet interception/manipulation
|
||||
* **Man-in-the-Middle Attack**
|
||||
* Reverse engineer the network packet formatting
|
||||
* Security of game circumvented by intercepting or manipulating data in real-time while transit from the client to the server or vice versa
|
||||
* Performed on client machine itself or via external communication proxy
|
||||
* Can provide player positions and other useful related information
|
||||
* Forged packets sent to server to move the player, shoot, or other game actions
|
||||
|
||||
## Player Attacks 🔷
|
||||
|
||||
* **Select button to attack and enable/disable training mode**
|
||||
* Custom zooming control with scroll wheel
|
||||
* Custom crosshairs
|
||||
* Laser sight
|
||||
* Trigger bot
|
||||
* Move speed
|
||||
* Ammo count
|
||||
* Player radar
|
||||
* Name-tag display to detect players
|
||||
* Auto shoot/rapid fire
|
||||
* Most fps games limit the rate weapons are fired regardless of how fast a player presses buttons
|
||||
* Binding the firing button to the scroll wheel of a mouse
|
||||
* Macro setting that will simulate rapid key presses automatically
|
||||
* Set aiming speed and shooting delay
|
||||
* Auto clicker for semi automatic weapons
|
||||
* Dynamic recoil control
|
||||
* Remove gun revoil game element
|
||||
* Control bullet spread
|
||||
* Correcting for bullet drop
|
||||
|
||||
## Glitches and Modifications 🔷
|
||||
|
||||
* Wall hacks
|
||||
* Glitches with game surfaces
|
||||
* Graphics driver modifications that ignore depth checking
|
||||
* Draw all objects on the screen
|
||||
* Reduced flash
|
||||
* Correcting for ping/lag
|
||||
* Resolution range
|
||||
* Pixel memory hack
|
||||
* Transparent buildings, ceilings, obstacles, and trees
|
||||
* Remove visual elements of the game
|
||||
* Ex Replace opengl32.dll with one that would render polygons transparent
|
||||
|
||||
* Display enemy lines
|
||||
* Extrasensory perception (ESP)
|
||||
* Display all the enemy positions on the map
|
||||
* Glowing or lighted players, weapons, and loot.
|
||||
* See all players at all times and plan ahead before making a kill
|
||||
* Show all information ex: player names, position, clip ammo, ammo count, health, class, weapons, frame rate and more
|
||||
## Conclusion 🔷
|
||||
|
||||
B00m-h3adsh0t! is a single architecture neural network configurable aimbot for first-person shooting (FPS) games. We introduced a method to augment a deep reinforcement q-learning model with high-level game information, and feature implementation. We showed that b00m-h3adsh0t! model is able to outperform built-in bots as well as human players and demonstrated the generalizability of our model to do game glitches and modifications.
|
||||
|
||||
|
||||
-------
|
||||
|
||||
## References 🔷
|
||||
|
||||
* Machine Learning Paper. Aimbot Detection in Online FPS Games Using a Heuristic Method Based on Distribution Comparison Matrix: https://link.springer.com/chapter/10.1007/978-3-642-34500-5_77
|
||||
* Exploting supervised learning techniques on game server collecting game data with decision trees, Naive Bayes, random forest, neural networks, and support vector machines. https://ieeexplore.ieee.org/abstract/document/6032016
|
||||
* Multiple classificatoin system for neural networks http://ceur-ws.org/Vol-1659/paper7.pdf
|
||||
* Bayesian Imitation Learning the ROute to Belivable Gamebots. https://www.researchgate.net/profile/Christian_Bauckhage/publication/258510478_Is_Bayesian_imitation_learning_the_route_to_believable_gamebots/links/0c960539de8012b04e000000/Is-Bayesian-imitation-learning-the-route-to-believable-gamebots.pdf
|
||||
* Towards a Fair n Square Aimbot. Machine Learning techniques for spatio-temporal improvements to aimbots. http://vampire-project.de/files/papers/Bauckhage2004-TAF.pdf
|
||||
* Server side machine learning classifiers for anti-cheating in games using game logs https://ieeexplore.ieee.org/abstract/document/6633617
|
||||
* Bayesian network paper on aimbot behavior detection. http://www.cs.cuhk.edu.hk/~cslui/PUBLICATION/detect_cheat.pdf
|
||||
* Classifier systems for controlling NPCs in games. https://pdfs.semanticscholar.org/68cf/3f5b16c452b004d986dcbdefa6fc28fa1c9b.pdf
|
||||
* Game bot detection. Detecting user injections https://dl.acm.org/citation.cfm?id=1653694
|
||||
* C++ code for applications of Dynamic Bayesian Network https://github.com/wengjn/MatlabDBN
|
||||
* DBN++ Data Structures and Algorithms in C++ for Dynamic Bayesian Networks https://github.com/thiagopbueno/dbn-pp
|
||||
* Paper Dynamic Bayesian Neytworks https://www.cs.ubc.ca/~murphyk/Papers/dbnchapter.pdf
|
||||
* Paper A Bayesian Model for Plan Recognition in RTS (Real Time Strategy) Games https://www.aaai.org/ocs/index.php/AIIDE/AIIDE11/paper/viewFile/4062/4416
|
||||
* Learning to Shoot in First Person Shooter Games by Stabilizing Actions and Clustering Rewards for Reinforcement Learning. https://arxiv.org/pdf/1806.05117.pdf
|
||||
* CS:GO external hack base https://github.com/NullTerminatorr/NullBase
|
||||
* FastML. Solve the cheaters problem in Counter Strike, with or without machine learning
|
||||
http://fastml.com/how-to-solve-the-cheaters-problem-in-counter-strike-with-or-without-machine-learning/
|
||||
|
||||
```
|
||||
|
||||
`_config.yml`:
|
||||
|
||||
```yml
|
||||
theme: jekyll-theme-hacker
|
||||
```
|
||||
|
||||
`azure-pipelines.yml`:
|
||||
|
||||
```yml
|
||||
# Starter pipeline
|
||||
# Start with a minimal pipeline that you can customize to build and deploy your code.
|
||||
# Add steps that build, run tests, deploy, and more:
|
||||
# https://aka.ms/yaml
|
||||
|
||||
trigger:
|
||||
- master
|
||||
|
||||
pool:
|
||||
vmImage: 'ubuntu-latest'
|
||||
|
||||
steps:
|
||||
- script: echo Hello, world!
|
||||
displayName: 'Run a one-line script'
|
||||
|
||||
- script: |
|
||||
echo Add other tasks to build, test, and deploy your project.
|
||||
echo See https://aka.ms/yaml
|
||||
displayName: 'Run a multi-line script'
|
||||
|
||||
```
|
||||
|
||||
`b00m-h3adsh0t.cfg`:
|
||||
|
||||
```cfg
|
||||
// b00m-h3adsh0t.cfg Config File
|
||||
// Web: https://github.com/lucylow/b00m-h3adsh0t
|
||||
|
||||
|
||||
// Autoassign # bots (defaults to 0)
|
||||
set b00m-h3adsh0t "0"
|
||||
|
||||
// Add # bots to allies (defaults to 0)
|
||||
set b00m-h3adsh0t_allies "0"
|
||||
|
||||
// Add # bots to axis (defaults to 0)
|
||||
set b00m-h3adsh0t_axis "0"
|
||||
|
||||
// Bot skill level, value from 0.1 to 1.0 (defaults to 1.0)
|
||||
set b00m-h3adsh0t_skill "1.0"
|
||||
|
||||
// Set to 0 - Original (slower speed and more walking) or 1 - Faster (Run & Gun) or 2 - Both (defaults to 2)
|
||||
set b00m-h3adsh0t_playstyle "2"
|
||||
|
||||
// Set to 0 to disable bots choosing a random perk upon spawn.
|
||||
set b00m-h3adsh0t_useperks "1"
|
||||
|
||||
// Set to 1 to enable bots to use the additional character models such as Capt. Price. (defaults to 0)
|
||||
b00m-h3adsh0t_modelchoice "0"
|
||||
|
||||
// Set to 0 to stop bots using battlechatter (talking during game) (defaults to 1)
|
||||
set b00m-h3adsh0t_chatter "1"
|
||||
|
||||
// Set to 1 to disable bots using UAV, Airstrike and Helicopter (defaults to 0)
|
||||
set b00m-h3adsh0t_dewards "0"
|
||||
|
||||
// Set to 1 and bots will drop grenades/RPGs for the player to pick up and restock their grenade/RPG ammunition (defaults to 0)
|
||||
set b00m-h3adsh0t_grenadepickup "0"
|
||||
|
||||
// Set to 1 to be instant level 55 and have all weapons unlocked (defaults to 0)
|
||||
set b00m-h3adsh0t_XPcheat "0"
|
||||
|
||||
// Restarts the listen server after (defaults to 2)
|
||||
set b00m-h3adsh0t_roundCount "2"
|
||||
|
||||
|
||||
// Required to fix bug with UAV, Airstrike and Helicopter. Leave this here.
|
||||
set b00m-h3adsh0t_mode "normal"
|
||||
|
||||
```
|
||||
|
||||
`calcangle.h`:
|
||||
|
||||
```h
|
||||
Vector CAimbot::CalcAngle( Vector& src, Vector& dst )
|
||||
{
|
||||
Vector vAngle;
|
||||
Vector delta( (src.X-dst.X), (src.Y-dst.Y), (src.Z-dst.Z) );
|
||||
double hyp = sqrt( delta.X*delta.X + delta.Y*delta.Y );
|
||||
|
||||
vAngle.X = (float)(asinf( (delta.Z + 64.06f) / hyp ) * 57.295779513082f);
|
||||
vAngle.Y = (float)(atanf( delta.Y / delta.X ) * 57.295779513082f);
|
||||
vAngle.Z = 0.0f;
|
||||
|
||||
if(delta.X >= 0.0)
|
||||
vAngle.Y += 180.0f;
|
||||
|
||||
return vAngle;
|
||||
}
|
||||
|
||||
|
||||
```
|
||||
|
||||
`gitchbox.cpp`:
|
||||
|
||||
```cpp
|
||||
#include "Drawing.h"
|
||||
|
||||
|
||||
void Drawing::DrawBorderBox( int x, int y, int w, int h, int thickness, D3DCOLOR Colour, IDirect3DDevice9 *pDevice)
|
||||
{
|
||||
//Top horiz line
|
||||
DrawFilledRect( x, y, w, thickness, Colour, pDevice );
|
||||
//Left vertical line
|
||||
DrawFilledRect( x, y, thickness, h, Colour, pDevice );
|
||||
//right vertical line
|
||||
DrawFilledRect( (x + w), y, thickness, h, Colour, pDevice );
|
||||
//bottom horiz line
|
||||
DrawFilledRect( x, y + h, w+thickness, thickness, Colour, pDevice );
|
||||
}
|
||||
|
||||
|
||||
//We receive the 2-D Coordinates the color and the device we want to use to draw those colors with
|
||||
void Drawing::DrawFilledRect(int x, int y, int w, int h, D3DCOLOR color, IDirect3DDevice9* dev)
|
||||
{
|
||||
//We create our rectangle to draw on screen
|
||||
D3DRECT BarRect = { x, y, x + w, y + h };
|
||||
//We clear that portion of the screen and display our rectangle
|
||||
dev->Clear(1, &BarRect, D3DCLEAR_TARGET | D3DCLEAR_TARGET, color, 0, 0);
|
||||
}
|
||||
|
||||
|
||||
void Drawing::Draw_Text(LPCSTR TextToDraw, int x, int y, D3DCOLOR Colour, LPD3DXFONT m_font)
|
||||
{
|
||||
// Create a rectangle to indicate where on the screen it should be drawn
|
||||
RECT rct = {x- 120, y, x+ 120, y + 15};
|
||||
|
||||
// Draw some text
|
||||
m_font->DrawText(NULL, TextToDraw, -1, &rct, DT_NOCLIP, Colour );
|
||||
}
|
||||
|
||||
|
||||
|
||||
```
|
||||
|
||||
`glitchbox.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
|
||||
#include "d3d9.h"
|
||||
|
||||
static class Drawing
|
||||
{
|
||||
public:
|
||||
static void Draw_Text(LPCSTR TextToDraw, int x, int y, D3DCOLOR Colour, LPD3DXFONT m_font);
|
||||
static void DrawFilledRect(int x, int y, int w, int h, D3DCOLOR color, IDirect3DDevice9* d3dDevice);
|
||||
static void DrawBorderBox( int x, int y, int w, int h, int thickness, D3DCOLOR Colour, IDirect3DDevice9 *d3dDevice);
|
||||
};
|
||||
|
||||
|
||||
```
|
||||
|
||||
`main.cpp`:
|
||||
|
||||
```cpp
|
||||
#include <Windows.h>
|
||||
#include <iostream>
|
||||
#include "main.h"
|
||||
#include <vector>
|
||||
#include <algorithm>
|
||||
using namespace std;
|
||||
|
||||
|
||||
CHackProcess fProcess;
|
||||
using namespace std;
|
||||
|
||||
#define F6_Key 0x75
|
||||
#define RIGHT_MOUSE 0x02
|
||||
|
||||
int NumOfPlayers = 32;
|
||||
|
||||
//Relative offsets:
|
||||
const DWORD dw_PlayerCountOffs = 0x5EF6BC;//Engine.dll
|
||||
const DWORD Player_Base = 0x4C6708;
|
||||
const DWORD dw_m_angRotation = 0x47F1B4; //ViewAngles - find by moving our mouse around, look for changed/unchanged value, or use cl_pdump 1
|
||||
|
||||
// Entity offsets
|
||||
const DWORD dw_mTeamOffset = 0x9C;
|
||||
const DWORD dw_Health = 0x94;
|
||||
const DWORD dw_Pos = 0x260;
|
||||
|
||||
const DWORD EntityPlayer_Base = 0x4D3904;//Entitylist relative offset
|
||||
const DWORD EntityLoopDistance = 0x10; //Distance in bytes between each ent
|
||||
|
||||
struct MyPlayer_t
|
||||
{
|
||||
DWORD CLocalPlayer; //Address of our ent
|
||||
int Team;
|
||||
int Health;
|
||||
float Position[3];
|
||||
void ReadInformation()
|
||||
{
|
||||
//Get address of entity
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordClient + Player_Base), &CLocalPlayer, sizeof(CLocalPlayer), 0);
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CLocalPlayer + dw_mTeamOffset), &Team, sizeof(Team), 0);
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CLocalPlayer + dw_Health), &Health, sizeof(Health), 0);
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CLocalPlayer + dw_Pos), &Position, sizeof(float[3]), 0);
|
||||
//Get Number of players
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordEngine + dw_PlayerCountOffs), &NumOfPlayers, sizeof(int), 0);
|
||||
}
|
||||
}MyPlayer;
|
||||
|
||||
//struct for targets
|
||||
struct TargetList_t
|
||||
{
|
||||
float Distance;
|
||||
float AimbotAngle[3];
|
||||
|
||||
TargetList_t() {} //default contructor
|
||||
|
||||
TargetList_t(float aimbotAngle[], float myCoords[], float enemyCoords[])
|
||||
{
|
||||
Distance = Get3dDistance(myCoords[0], myCoords[1], myCoords[2],
|
||||
enemyCoords[0], enemyCoords[1], enemyCoords[2]);
|
||||
|
||||
//set aimbot angles for the ent
|
||||
AimbotAngle[0] = aimbotAngle[0];
|
||||
AimbotAngle[1] = aimbotAngle[1];
|
||||
AimbotAngle[2] = aimbotAngle[2];
|
||||
}
|
||||
|
||||
float Get3dDistance(float myCoordsX, float myCoordsZ, float myCoordsY,
|
||||
float eNx, float eNz, float eNy)
|
||||
{
|
||||
return (float)sqrt(
|
||||
pow(double(eNx - myCoordsX), 2.0) +
|
||||
pow(double(eNy - myCoordsY), 2.0) +
|
||||
pow(double(eNz - myCoordsZ), 2.0));
|
||||
}
|
||||
};
|
||||
|
||||
//Struct for other players
|
||||
struct PlayerList_t
|
||||
{
|
||||
DWORD CBaseEntity;
|
||||
int Team;
|
||||
int Health;
|
||||
float Position[3];
|
||||
float AimbotAngle[3];
|
||||
char Name[39];
|
||||
|
||||
void ReadInformation(int Player)
|
||||
{
|
||||
//Get Address of Entity
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordClient + EntityPlayer_Base + (Player * EntityLoopDistance)), &CBaseEntity, sizeof(DWORD), 0);
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CBaseEntity + dw_mTeamOffset), &Team, sizeof(int), 0);
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CBaseEntity + dw_Health), &Health, sizeof(int), 0);
|
||||
ReadProcessMemory(fProcess.__HandleProcess, (BYTE*)(CBaseEntity + dw_Pos), &Position, sizeof(float[3]), 0);
|
||||
}
|
||||
}PlayerList[32];
|
||||
|
||||
// Compare distance when sorting the array of Target Enemies "sort predicate"
|
||||
struct CompareTargetEnArray
|
||||
{
|
||||
bool operator() (TargetList_t & lhs, TargetList_t & rhs)
|
||||
{
|
||||
return lhs.Distance < rhs.Distance;
|
||||
}
|
||||
};
|
||||
|
||||
void CalcAngle(float *src, float *dst, float *angles)
|
||||
{
|
||||
double delta[3] = { (src[0] - dst[0]), (src[1] - dst[1]), (src[2] - dst[2]) };
|
||||
double hyp = sqrt(delta[0] * delta[0] + delta[1] * delta[1]);
|
||||
angles[0] = (float)(asinf(delta[2] / hyp) * 57.295779513082f);
|
||||
angles[1] = (float)(atanf(delta[1] / delta[0]) * 57.295779513082f);
|
||||
angles[2] = 0.0f;
|
||||
|
||||
// Normalize angle
|
||||
if (delta[0] >= 0.0)
|
||||
{
|
||||
angles[1] += 180.0f;
|
||||
}
|
||||
}
|
||||
|
||||
void Aimbot()
|
||||
{
|
||||
// Declare our target list to define our victims through a dynamic array
|
||||
TargetList_t* TargetList = new TargetList_t[NumOfPlayers];
|
||||
|
||||
// Loop through all our players and retrieve their information
|
||||
int targetLoop = 0;
|
||||
for (int i = 0; i < NumOfPlayers; i++)
|
||||
{
|
||||
PlayerList[i].ReadInformation(i);
|
||||
|
||||
// Skip if they're my teammates.
|
||||
if (PlayerList[i].Team == MyPlayer.Team) continue;
|
||||
|
||||
// Skip players without health such as bad ents
|
||||
if (PlayerList[i].Health < 2) continue;
|
||||
|
||||
// PlayerList[i].Position[2] -= 10;
|
||||
CalcAngle(MyPlayer.Position, PlayerList[i].Position, PlayerList[i].AimbotAngle);
|
||||
|
||||
// Populate array of targets with only good targets
|
||||
TargetList[targetLoop] = TargetList_t(PlayerList[i].AimbotAngle, MyPlayer.Position, PlayerList[i].Position);
|
||||
|
||||
// Increment to advance the array for the next iteration
|
||||
targetLoop++;
|
||||
}
|
||||
|
||||
//Aim only if we have any enemies
|
||||
if (targetLoop > 0)
|
||||
{
|
||||
//SORT ENEMIES ARRAY BY DISTANCE by using our sort predicate
|
||||
std::sort(TargetList, TargetList + targetLoop, CompareTargetEnArray());
|
||||
|
||||
//AIM at the closest ent, by default aim at ALL times, if you right click hold it switches it off
|
||||
if (!GetAsyncKeyState(0x2))
|
||||
{
|
||||
WriteProcessMemory(fProcess.__HandleProcess, (BYTE*)(fProcess.__dwordEngine + dw_m_angRotation), TargetList[0].AimbotAngle, 12, 0);
|
||||
}
|
||||
|
||||
}
|
||||
// Reset the loop counter
|
||||
targetLoop = 0;
|
||||
|
||||
delete[] TargetList; //DELETE OUR ARRAY and clear memory
|
||||
}
|
||||
|
||||
int main()
|
||||
{
|
||||
fProcess.RunProcess(); // Waiting for CSS......
|
||||
cout << "Game found! Running b00m h3adsh0t aimbot." << endl;
|
||||
|
||||
//Exit if the F6 key is pressed
|
||||
while (!GetAsyncKeyState(F6_Key))
|
||||
{
|
||||
MyPlayer.ReadInformation();
|
||||
Aimbot();
|
||||
}
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`memory_searcher.cpp`:
|
||||
|
||||
```cpp
|
||||
DWORD pLocalPlayer = { 0x509B74 };
|
||||
DWORD playerObjectAddress = 0;
|
||||
|
||||
// Base address of "client.dll" (int or DWORD)
|
||||
int ClientDLL = (int)GetModuleHandleA("client.dll");
|
||||
|
||||
// Find actual EntityBase address
|
||||
EntityBase = *(int*)(ClientDLL + 0x9D3C6C);
|
||||
|
||||
// Read the memory address of the EntityBase+0x23C4 to find the ID of the entity in the crosshair
|
||||
int in_cross = *(int*)(EntityBase + 0x23C4);
|
||||
|
||||
// ReadProcessMemory reads memory from a given process
|
||||
ReadProcessMemory(handleToGame, (LPCVOID)addressToRead, &variableToStoreReadInformation, sizeof(variableToStoreReadInformation), NULL);
|
||||
|
||||
// WriteProcessMemory writes memory to a given process
|
||||
WriteProcessMemory(handleToGame, (LPVOID)addressToWriteTo, &variableContainingValueToWrite, sizeof(variableContainingValueToWrite), NULL);
|
||||
|
||||
|
||||
```
|
||||
|
||||
`playerdata.h`:
|
||||
|
||||
```h
|
||||
#pragma once
|
||||
#include <math.h>
|
||||
|
||||
// 3D data for each player
|
||||
// Memory addresses within "PlayerData"
|
||||
|
||||
class Vect3d
|
||||
{
|
||||
public:
|
||||
float x;
|
||||
float y;
|
||||
float z;
|
||||
|
||||
Vect3d(float _x, float _y, float _z)
|
||||
{
|
||||
x = _x;
|
||||
y = _y;
|
||||
z = _z;
|
||||
}
|
||||
|
||||
Vect3d()
|
||||
{
|
||||
}
|
||||
|
||||
float length()
|
||||
{
|
||||
return (float)sqrt(x * x + y * y + z * z);
|
||||
}
|
||||
|
||||
float dotproduct(Vect3d dot)
|
||||
{
|
||||
return (x * dot.x + y * dot.y + z * dot.z);
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
struct Color
|
||||
{
|
||||
public:
|
||||
short R;
|
||||
short G;
|
||||
short B;
|
||||
|
||||
Color()
|
||||
{
|
||||
|
||||
}
|
||||
Color(short r, short g, short b)
|
||||
{
|
||||
R = r;
|
||||
G = g;
|
||||
B = b;
|
||||
}
|
||||
|
||||
};
|
||||
|
||||
class PlayerDataVec
|
||||
{
|
||||
public:
|
||||
float xMouse;
|
||||
float yMouse;
|
||||
int isValid;
|
||||
float xPos;
|
||||
float yPos;
|
||||
float zPos;
|
||||
int isAlive;
|
||||
int clientNum;
|
||||
Color color;
|
||||
char name[16];
|
||||
int pose;
|
||||
int team;
|
||||
bool visible;
|
||||
int isInGame;
|
||||
int health;
|
||||
|
||||
Vect3d VecCoords()
|
||||
{
|
||||
Vect3d vec(xPos, zPos, yPos);
|
||||
return vec;
|
||||
}
|
||||
};
|
||||
|
||||
```
|
||||
|
||||
`train_game/GAME.cfg`:
|
||||
|
||||
```cfg
|
||||
GAME.cfg
|
||||
|
||||
Output - program writes in cfg file
|
||||
|
||||
Batch = 1
|
||||
Subdivision = 1 for testing
|
||||
|
||||
```
|
||||
|
||||
`train_game/GAME.names`:
|
||||
|
||||
```names
|
||||
GAME.names
|
||||
|
||||
```
|
||||
|
||||
`train_game/GAME.screenshots`:
|
||||
|
||||
```screenshots
|
||||
void GetScreenShot(void)
|
||||
{
|
||||
int x1, y1, x2, y2, w, h;
|
||||
|
||||
// get screen dimensions
|
||||
x1 = GetSystemMetrics(SM_XVIRTUALSCREEN);
|
||||
y1 = GetSystemMetrics(SM_YVIRTUALSCREEN);
|
||||
x2 = GetSystemMetrics(SM_CXVIRTUALSCREEN);
|
||||
y2 = GetSystemMetrics(SM_CYVIRTUALSCREEN);
|
||||
w = x2 - x1;
|
||||
h = y2 - y1;
|
||||
|
||||
// copy screen to bitmap
|
||||
HDC hScreen = GetDC(NULL);
|
||||
HDC hDC = CreateCompatibleDC(hScreen);
|
||||
HBITMAP hBitmap = CreateCompatibleBitmap(hScreen, w, h);
|
||||
HGDIOBJ old_obj = SelectObject(hDC, hBitmap);
|
||||
BOOL bRet = BitBlt(hDC, 0, 0, w, h, hScreen, x1, y1, SRCCOPY);
|
||||
|
||||
// save bitmap to clipboard
|
||||
OpenClipboard(NULL);
|
||||
EmptyClipboard();
|
||||
SetClipboardData(CF_BITMAP, hBitmap);
|
||||
CloseClipboard();
|
||||
|
||||
// clean up
|
||||
SelectObject(hDC, old_obj);
|
||||
DeleteDC(hDC);
|
||||
ReleaseDC(NULL, hScreen);
|
||||
DeleteObject(hBitmap);
|
||||
|
||||
// screenshot to jpg and save to stream
|
||||
image.Attach(hBitmap);
|
||||
image.Save(stream, Gdiplus::ImageFormatJPEG);
|
||||
IStream_Size(stream, &liSize);
|
||||
DWORD len = liSize.LowPart;
|
||||
IStream_Reset(stream);
|
||||
buf.resize(len);
|
||||
IStream_Read(stream, &buf[0], len);
|
||||
stream->Release();
|
||||
|
||||
// put image in the file
|
||||
std::fstream fi;
|
||||
fi.open(path, std::fstream::binary | std::fstream::out);
|
||||
fi.write(reinterpret_cast<const char*>(&buf[0]), buf.size() * sizeof(BYTE));
|
||||
fi.close();
|
||||
}
|
||||
|
||||
```
|
||||
|
||||
`train_game/GAME.weights`:
|
||||
|
||||
```weights
|
||||
GAME.weights
|
||||
|
||||
```
|
||||
|
||||
`train_game/GAME_last.weights`:
|
||||
|
||||
```weights
|
||||
GAME_last.weights
|
||||
|
||||
```
|
||||
Reference in New Issue
Block a user