forked from weak1337/BE-Shellcode
-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathveh.cpp
More file actions
64 lines (53 loc) · 2.2 KB
/
Copy pathveh.cpp
File metadata and controls
64 lines (53 loc) · 2.2 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#include "veh.h"
std::vector<std::tuple<uintptr_t, BYTE>>checks;
LONG WINAPI veh::be_handler(struct _EXCEPTION_POINTERS* ExceptionInfo) {
if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_BREAKPOINT) {
for (std::vector<std::tuple<uintptr_t, BYTE>>::iterator it = checks.begin(); it != checks.end(); ++it)
{
if (std::get<0>(*it) == (uintptr_t)ExceptionInfo->ExceptionRecord->ExceptionAddress) {
DWORD old;
VirtualProtect((LPVOID)ExceptionInfo->ContextRecord->Rip, 0x1, PAGE_EXECUTE_READWRITE, &old);
*(BYTE*)ExceptionInfo->ContextRecord->Rip = 0xC3;
VirtualProtect((LPVOID)ExceptionInfo->ContextRecord->Rip, 0x1, old, &old);
uintptr_t return_address = *(uintptr_t*)ExceptionInfo->ContextRecord->Rsp;
MEMORY_BASIC_INFORMATION mbi{ 0 };
size_t return_length{ 0 };
if (
(NtQueryVirtualMemory((HANDLE)-1, (PVOID)return_address, MemoryBasicInformation, &mbi, sizeof(mbi), &return_length) < 0) ||
mbi.State != MEM_COMMIT ||
mbi.Type != MEM_IMAGE && mbi.RegionSize > 0x2000 ||
*(WORD*)return_address == 0x23FF || //https://www.unknowncheats.me/forum/anti-cheat-bypass/268039-x64-return-address-spoofing-source-explanation.html
*(WORD*)return_address == 0x26FF ||
*(WORD*)return_address == 0x27FF ||
*(WORD*)return_address == 0x65FF ||
*(WORD*)return_address == 0xE3FF
) {
//reportbuffer
beshellcode::report(beshellcode::report_ids::IllegaleCaller);
}
}
}
return EXCEPTION_CONTINUE_EXECUTION;
}
else if (ExceptionInfo->ExceptionRecord->ExceptionCode == EXCEPTION_SINGLE_STEP) {
if (ExceptionInfo->ContextRecord->Rip >= 0x8000000000000000) { //Perfect Injector
beshellcode::report(beshellcode::report_ids::IllegaleCaller);
}
return EXCEPTION_CONTINUE_EXECUTION;
}
return EXCEPTION_CONTINUE_SEARCH;
}
void veh::add_func(uintptr_t func) {
if (!func)
{
return;
}
while (*(BYTE*)func != 0xC3)
func += 1;
std::tuple<uintptr_t, BYTE>newcheck{ func, *(BYTE*)func };
checks.push_back(newcheck);
DWORD old;
VirtualProtect((LPVOID)func, 0x1, PAGE_EXECUTE_READWRITE, &old);
*(BYTE*)func = 0xCC;
VirtualProtect((LPVOID)func, 0x1, old, &old);
}