main.cpp
Code:
#include "misc.h"
#include <process.h> // _beginthread | _endthread
void Init(void*)
{
uintptr_t uptr_BaseAddress = reinterpret_cast<uintptr_t>(GetModuleHandle(0));
uintptr_t pGameServerC2S = uptr_BaseAddress + 0x16B6140;
while (!(*reinterpret_cast<uint32_t*>(pGameServerC2S)))
Sleep(10);
GameServerC2S * m_GameServerC2S = *reinterpret_cast<GameServerC2S**>(pGameServerC2S);
VT_RMI_MessageSend = (p_VT_RMI_MessageSend)(*(PDWORD**)(&m_GameServerC2S))[3];
VMTH::HookVMTFunction(reinterpret_cast<PDWORD*>(&m_GameServerC2S), reinterpret_cast<DWORD>(&hk_RMI_MessageSend), 3);
_endthread();
}
BOOL WINAPI DllMain(HINSTANCE hinstDLL, DWORD fdwReason, LPVOID lpReserved)
{
if (fdwReason == DLL_PROCESS_ATTACH)
{
DisableThreadLibraryCalls(hinstDLL);
_beginthread(&Init, 0, 0);
}
return TRUE;
}
misc.h
Code:
#pragma once
#include <Windows.h>
#include "VMTH.h"
#include "GameServerC2S.h"
typedef BOOL(__thiscall* p_VT_RMI_MessageSend)(void*, int8_t*, int32_t, uintptr_t, uintptr_t, LPCWSTR , int32_t);
p_VT_RMI_MessageSend VT_RMI_MessageSend;
BOOL __fastcall hk_RMI_MessageSend(void* ecx, void* edx, int8_t* remotes, int32_t remoteCount, uintptr_t rmiContext, uintptr_t Message, LPCWSTR RMI_Name, int32_t RMI_ID)
{
if (RMI_ID == 3122)
{
uintptr_t Proud_Packet_ByteArray = *reinterpret_cast<uintptr_t*>(Message + 0x8);
uintptr_t Pointer_ByteArray = *reinterpret_cast<uintptr_t*>(Proud_Packet_ByteArray + 0x8);
*reinterpret_cast<uint32_t *>(Proud_Packet_ByteArray + 0xC) = 37;
memcpy((uintptr_t*)(Pointer_ByteArray + 0x5), "a31585229d6e07e16d035e5b7ddf6bad",32);
}
return VT_RMI_MessageSend(ecx, remotes, remoteCount, rmiContext, Message, RMI_Name, RMI_ID);
}
GameServerC2S.h
Code:
#pragma once
#include <cstdint>
class GameServerC2S
{
public:
// Thats all we need
virtual void function0();
virtual void function1();
virtual void function2();
virtual bool RMI_MessageSend(int8_t* remotes, int32_t remoteCount, uintptr_t rmiContext, uintptr_t Message , LPCWSTR RMI_Name, int32_t RMI_ID);
};
Feel free to use this source.