[Release/Guide] Bot

EXPORTS
DirectSoundCaptureCreate=__E__0__ @6
DirectSoundCaptureCreate8=__E__1__ @12
DirectSoundCaptureEnumerateA=__E__2__ @7
DirectSoundCaptureEnumerateW=__E__3__ @8
DirectSoundCreate=__E__4__ @1
DirectSoundCreate8=__E__5__ @11
DirectSoundEnumerateA=__E__6__ @2
DirectSoundEnumerateW=__E__7__ @3
DirectSoundFullDuplexCreate=__E__8__ @10
DllCanUnloadNow=__E__9__ @4
DllGetClassObject=__E__10__ @5
GetDeviceID=__E__11__ @9

#include <Windows.h>
#include <process.h>

FARPROC dsoundFunction[12] = {0};
HMODULE dsound_Orginal				= (HMODULE)INVALID_HANDLE_VALUE;
HANDLE			hMainThread			= INVALID_HANDLE_VALUE;
unsigned int	uiMainThreadID	= 0;

extern unsigned int __stdcall MainThread(void * pParams);

BOOL APIENTRY DllMain(_In_ HANDLE _HDllHandle, _In_ DWORD _Reason, _In_opt_ LPVOID _Reserved)
{
	switch(_Reason){
	case DLL_PROCESS_ATTACH:
		dsound_Orginal = LoadLibrary("dsound_.dll");

		hMainThread = (HANDLE)_beginthreadex(NULL, 0, &MainThread, NULL, NULL, &uiMainThreadID);

		dsoundFunction[0] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureCreate");
		dsoundFunction[1] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureCreate8");
		dsoundFunction[2] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureEnumerateA");
		dsoundFunction[3] = GetProcAddress(dsound_Orginal,"DirectSoundCaptureEnumerateW");
		dsoundFunction[4] = GetProcAddress(dsound_Orginal,"DirectSoundCreate");
		dsoundFunction[5] = GetProcAddress(dsound_Orginal,"DirectSoundCreate8");
		dsoundFunction[6] = GetProcAddress(dsound_Orginal,"DirectSoundEnumerateA");
		dsoundFunction[7] = GetProcAddress(dsound_Orginal,"DirectSoundEnumerateW");
		dsoundFunction[8] = GetProcAddress(dsound_Orginal,"DirectSoundFullDuplexCreate");
		dsoundFunction[9] = GetProcAddress(dsound_Orginal,"DllCanUnloadNow");
		dsoundFunction[10] = GetProcAddress(dsound_Orginal,"DllGetClassObject");
		dsoundFunction[11] = GetProcAddress(dsound_Orginal,"GetDeviceID");
		break;
	case DLL_THREAD_ATTACH:
	case DLL_THREAD_DETACH:
	case DLL_PROCESS_DETACH:
		
		break;
	}
	return TRUE;
}
// DirectSoundCaptureCreate
extern "C" __declspec(naked) void __stdcall __E__0__()
{
	__asm
	{
		jmp dsoundFunction[0*4];
	}
}

// DirectSoundCaptureCreate8
extern "C" __declspec(naked) void __stdcall __E__1__()
{
	__asm
	{
		jmp dsoundFunction[1*4];
	}
}

// DirectSoundCaptureEnumerateA
extern "C" __declspec(naked) void __stdcall __E__2__()
{
	__asm
	{
		jmp dsoundFunction[2*4];
	}
}

// DirectSoundCaptureEnumerateW
extern "C" __declspec(naked) void __stdcall __E__3__()
{
	__asm
	{
		jmp dsoundFunction[3*4];
	}
}

// DirectSoundCreate
extern "C" __declspec(naked) void __stdcall __E__4__()
{
	__asm
	{
		jmp dsoundFunction[4*4];
	}
}

// DirectSoundCreate8
extern "C" __declspec(naked) void __stdcall __E__5__()
{
	__asm
	{
		jmp dsoundFunction[5*4];
	}
}

// DirectSoundEnumerateA
extern "C" __declspec(naked) void __stdcall __E__6__()
{
	__asm
	{
		jmp dsoundFunction[6*4];
	}
}

// DirectSoundEnumerateW
extern "C" __declspec(naked) void __stdcall __E__7__()
{
	__asm
	{
		jmp dsoundFunction[7*4];
	}
}

// DirectSoundFullDuplexCreate
extern "C" __declspec(naked) void __stdcall __E__8__()
{
	__asm
	{
		jmp dsoundFunction[8*4];
	}
}

// DllCanUnloadNow
extern "C" __declspec(naked) void __stdcall __E__9__()
{
	__asm
	{
		jmp dsoundFunction[9*4];
	}
}

// DllGetClassObject
extern "C" __declspec(naked) void __stdcall __E__10__()
{
	__asm
	{
		jmp dsoundFunction[10*4];
	}
}

// GetDeviceID
extern "C" __declspec(naked) void __stdcall __E__11__()
{
	__asm
	{
		jmp dsoundFunction[11*4];
	}
}

#include "main.h"

extern HANDLE			hMainThread;



extern int (__stdcall *DetourRecv)(SOCKET Socket,char *Buffer, int Length, int Flags);
extern int __stdcall FilterRecv(SOCKET Socket,char *Buffer, int iLength, int iFlags);
extern int engineSend(BYTE Header,LPCSTR szFormat,...);

extern DWORD __stdcall DebugConsole(LPVOID*);

unsigned int __stdcall MainThread(void * pParams)
{
	AllocConsole();

	int HandleIn = _open_osfhandle((long)GetStdHandle(STD_INPUT_HANDLE), _O_TEXT);
	int HandleOut = _open_osfhandle((long)GetStdHandle(STD_OUTPUT_HANDLE), _O_TEXT);

	FILE *In = _fdopen(HandleIn, "r");
	FILE *Out = _fdopen(HandleOut, "w");

	*stdin = *In;
	*stdout = *Out;

	SetConsoleTitle("Debug Console");

	DetourRecv = (int (__stdcall *)(SOCKET, char *, int, int))DetourFunction((PBYTE)recv,(PBYTE)FilterRecv);

	CreateThread(NULL,0,(LPTHREAD_START_ROUTINE)DebugConsole,NULL,NULL,0);

	CloseHandle(hMainThread);
	_endthreadex(0);
	return NULL;
}

DWORD _stdcall DebugConsole(LPVOID*){

	char szDebugHandle[255]={0};
	while(true){

		std::cin >> szDebugHandle;

		if(strcmp(szDebugHandle,"test") == 0)
		{

		}
	}

	return NULL;
}

#ifndef MAIN_H
#define MAIN_H

#include <WinSock2.h>
#include <detours.h>
#include <Windows.h>
#include <iostream>
#include <io.h>
#include <fcntl.h>
#include <process.h>
#include <math.h>
#include <stdio.h>

#pragma comment(lib, "detours.lib")
#pragma comment(lib, "ws2_32.lib")

#define INST_NOP 0x90
#define INST_CALL 0xe8
#define INST_JMP 0xe9
#define INST_BYTE 0x00
#define SHORT_JZ 0x74

#define orange 16594
#define lightblue 15073034
#define violett 12615808
#define green 32768
#define pink 16751615
#define blue 15453831
#define red 255


#endif MAIN_H

#include "main.h"

extern DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen, BYTE *bMask, char * szMask);

DWORD dwEngineSendA = dwFindPattern(0x401000,0x2bc000,(BYTE*)"\x55\x8B\xEC\x83\xEC\x18\x83\x3D\x00\x00\x00\x00\x00\x00\x00\x33\xC0","xxxxxxxx???????xx");
DWORD dwEngineSendB = dwFindPattern(dwEngineSendA+1,0x2bc000,(BYTE*)"\x55\x8B\xEC\x83\xEC\x18\x83\x3D\x00\x00\x00\x00\x00\x00\x00\x33\xC0","xxxxxxxx???????xx");
DWORD dwEngineBack = dwEngineSendB + 0x06;


__declspec( naked ) int engineSend(BYTE Header,LPCSTR szFormat,...){

	__asm push ebp;
	__asm mov ebp, esp;
	__asm sub esp, 18h;
	__asm jmp dwEngineBack;
}

#include "main.h"

int (__stdcall *DetourRecv)(SOCKET Socket, char *Buffer, int Length, int Flags);

extern int engineSend(BYTE Header,LPCSTR szFormat,...);

extern void KalChat(int color,char* mFormat,...);


/*

WORD size;
memcpy((void*)&size,(void*)((DWORD)szBuffer),2);
int i;
{
for (i=0;i<=size;i++)
{
printf("%02x ",(BYTE)szBuffer[i]);
}
printf("\n\n");
break;
*/

enum Packets {PlayerAppear=0x32,
			MonsterAppear=0x33,
			Item=0x36,
			MonsterAni=0x3d,
			FirstPacket=0x2a};

struct Items
{
	DWORD dwItemID;
	DWORD AchseX;
	DWORD AchseY;
}Itemx;
struct Monsters 
{
	DWORD dwMonsterUID;
	DWORD dwMonsterUIDx;
	DWORD dwMonsterX;
	DWORD dwMonsterY;
}Monster;

void MyRecv(char* szBuffer,int iLenght)
{
	/*WORD size;
	memcpy((void*)&size,(void*)((DWORD)szBuffer),2);
	int i;
		for (i=0;i<=size;i++)
		{
			printf("%02x ",(BYTE)szBuffer[i]);
		}
		printf("\n\n");
		*/
	switch(szBuffer[2])
	{
	case FirstPacket:
/*
Send Login?!

*/
		break;
	case PlayerAppear:
		break;
	case Item:
		Itemx.dwItemID = *(DWORD*)&szBuffer[5];
		Itemx.AchseX = *(DWORD*)&szBuffer[5+4];
		Itemx.AchseY = *(DWORD*)&szBuffer[5+4+4];
		engineSend(0x1D,"ddd",Itemx.dwItemID,Itemx.AchseX/32,Itemx.AchseY/32);
		break;
	case MonsterAppear:
		break;
	case MonsterAni:
		Monster.dwMonsterUID = *(DWORD*)&szBuffer[3];
		engineSend(0x0D,"bbd",1,1,Monster.dwMonsterUID);
		break;
	}
}
/*
Thanks to ILikeItEasy
*/
int ASyncPos = 0;
int FinalSize = 0;
int __stdcall FilterRecv(SOCKET Socket,char *Buffer, int iLength, int iFlags)
{
	if (ASyncPos==FinalSize && FinalSize>0)
	{
		MyRecv(Buffer, ASyncPos);

		ASyncPos = 0;
	}
	int RecvRET = DetourRecv(Socket, Buffer, iLength, iFlags);
	if (RecvRET<0)
	{
		return RecvRET;
	}
	if (ASyncPos==0)
		FinalSize = *((short int*) Buffer);
	ASyncPos+=RecvRET;

	return RecvRET;
}

#include "main.h"

bool bDataCompare(const BYTE* pData, const BYTE* bMask, const char* szMask)
{
	for(;*szMask;++szMask,++pData,++bMask)
		if(*szMask=='x' && *pData!=*bMask )
			return false;
	return (*szMask) == NULL;
}

DWORD dwFindPattern(DWORD dwAddress,DWORD dwLen, BYTE *bMask, char * szMask) {
	for(DWORD i=0;i<dwLen;i++)
		if( bDataCompare( (BYTE*)( dwAddress+i ),bMask,szMask) )
			return (DWORD)(dwAddress+i);
	return NULL;
}

LPVOID MemcpyEx(DWORD lpDest, DWORD lpSource, int len)
{
	DWORD oldSourceProt,oldDestProt=0;
	VirtualProtect((LPVOID)lpSource,len,PAGE_EXECUTE_READWRITE,&oldSourceProt);
	VirtualProtect((LPVOID)lpDest,len,PAGE_EXECUTE_READWRITE,&oldDestProt);
	memcpy((void*)lpDest,(void*)lpSource,len);
	VirtualProtect((LPVOID)lpDest,len,oldDestProt,&oldDestProt);
	VirtualProtect((LPVOID)lpSource,len,oldSourceProt,&oldSourceProt);
	return (LPVOID)lpDest;
};

DWORD Intercept(int instruction, DWORD lpSource, DWORD lpDest, int len)
{
	DWORD realtarget;
	LPBYTE buffer = new BYTE[len];

	memset(buffer,0x90,len);

	if (instruction != INST_NOP && len >= 5)
	{
		buffer[(len-5)] = instruction; 
		DWORD dwJMP = (DWORD)lpDest - (lpSource + 5 + (len-5));
		memcpy(&realtarget,(void*)(lpSource+1),4);
		realtarget = realtarget+lpSource+5;
		memcpy(buffer + 1 + (len-5),&dwJMP,4);
	}
	if (instruction == SHORT_JZ)
	{
		buffer[0]=instruction;
		buffer[1]=(BYTE)lpDest;
	}
	if (instruction == INST_BYTE)
	{
		buffer[0]=(BYTE)lpDest;
	}
	MemcpyEx(lpSource, (DWORD) buffer, len);// Call to intercept
	delete[] buffer;
	return realtarget;
}
/*
Thanks to Syntex (:
*/
typedef int (__cdecl * Chat_org)(char, char*, int);
BYTE pChat[] = {0x55,0x8B,0xEC,0x83,0x3D,0x48,0x2B,0x86,0x00,0x00,0x74,0x17,0x8B,0x45,0x10,0x50}; // pattern //
char * mChat = "xxx????????xxxx"; // mask //

unsigned long Chat_add = dwFindPattern( 0x00400000,0x00700000,pChat,mChat);

void KalChat(int color,char* mFormat,...){ 
	char* mText = new char[255];
	va_list args;
	va_start(args, mFormat);
	vsprintf_s(mText,255,mFormat,args);
	va_end(args);

	((Chat_org)Chat_add)(0,mText,color);
}